How to mass-produce QRNG chips

Abstract

The invention comprises a test initiation phase which initiates a final test phase, a data collection step in which frames of bit sequences having a length of 1024 KB, preferably 512 KB, generated by a RNG chip are collected, and a uniformity determination step which includes calculating the uniformity of said bit sequences according to the following formula: [Equation 1] TIFF2023553206000007.tif12170 The present invention relates to an RNG chip testing method, which includes a comparison step in which the determined uniformity is compared with a predetermined threshold, and a determination step in which, based on the result of the comparison step, it is determined whether the chip has passed or failed the test.

Description

Detailed Description of the Invention

[0001] [Technical Field] The present invention relates to a method for mass-producing QRNG chips, and more particularly to a method for mass-producing QRNG chips in a short period of time.

[0002] [Background technology] In general, the present invention relates to the generation of random numbers, and more specifically, to a method for manufacturing an RNG. Many tasks in modern science and technology, including simulations, statistical sampling, gaming applications, and cryptography (both classical and quantum), utilize random numbers. A good random number generator will rapidly generate bit strings with high entropy. High entropy means that bit values ​​cannot be predicted before they are known; entropy can also be understood as randomness. This is an essential requirement for most modern cryptographic algorithms and protocols. In fact, all commonly used cryptographic protocols, such as the DSA, RSA, and Diffie-Hellman algorithms, follow Kelfhof's law, which dates back to the 19th century and states that the security of a cipher must reside in a completely unpredictable key, or in other words, in the random sequence used as a seed. Therefore, it is particularly important that keys used in cryptographic algorithms be secure and, in fact, be completely randomly selected, or in other words, randomly generated.

[0003] To be able to generate such random sequences, a QRNG includes controls to perform such random number generation.

[0004] These chips are mass-produced and, of course, testing is required to evaluate the functionality and performance of each chip produced. This is particularly important because the evaluation is performed by a test called Final Test (FT), which is the last test performed on a chip and determines whether the chip can be released to the market.

[0005] In fact, only production chips that are classified as good chips based on the FT results can be shipped to the market.

[0006] Generally, in order to reduce the operating time of production equipment, which is closely related to the test cost, and to increase production capacity, it is necessary to shorten the total test time as much as possible. Typically, the total test time will be several tens of seconds per chip.

[0007] Generally, the entropy produced from any kind of random number generator will follow standards defined in standards such as NIST (National Institute of Standards and Technology) or BSI (British Standards Institution).

[0008] Figure 1 shows the NIST SP800-90B entropy source model.

[0009] NIST SP800-90B includes two types of tests: independent and identically distributed (IID) tests that can check the collection of random variables, and non-IID tests that allow assessing the quality of the entropy, also commonly referred to as "randomness," of the chip's embedded RNG.

[0010] Some users require that non-IID test results be performed with very long RNG sample lengths, in other words, test sequences should exceed 10MB in order to provide a measure of the performance of the generated entropy source.

[0011] Typically, all test cases defined in non-IID testing are 17 different test cases, which takes a long time to execute. Furthermore, it takes time to generate and test long data samples. For example, NIST estimates that a test case takes 1-2 hours, so mass production of 10,000 chips requires 10,000-20,000 hours of testing.

[0012] Thus, according to the prior art, there is no typical way to usefully test or evaluate the quality of entropy sources in mass production.

[0013] Most RNGs aim to provide random numbers as their final output, and the typical method for assessing the quality of random numbers is based on Federal Information Processing Standards (FIPS).

[0014] However, in recent years, QRNGs have been designed to provide an entropy source rather than random numbers, and this has made it necessary to have new methods for testing the quality of their entropy source.

[0015] As an example, in NIST SP800-90B, the non-IID test consists of 17 test cases, and a "randomness" test is performed to evaluate the performance of the entropy source. In practice, many viable noise sources cannot generate IID outputs. Therefore, for non-IID data, the following estimation method shall be calculated for the output of the noise source and the output of any tuning components, and the minimum of all estimates shall be interpreted as the entropy rating of the entropy source for this recommended test.

[0016] Non-IID testing: H bits = Min(MCV bits, Collision, Markov bits, Compression, T-Tuple bits, LRS bits, Multi-MCW bits, Delay bits, Multi-Markov bits, LZ78Y bits) H base = minimum value (MCV base, T-Tuple base, LRS base, multi-MCW base, delay base, multi-Markov base, LZ78Y base) The estimation methods are Maximum Common Value (MCV) estimation, Collision estimation, Markov estimation, Compression estimation, T-Tuple estimation, Longest Repeating Subsequence (LRS) estimation, Multi Maximum Common Window Prediction (MCW) estimation, Delayed Prediction estimation, Multi MMC Prediction estimation, and LZ78Y Prediction estimation.

[0017] From this test, a final min-entropy is derived, where the final min-entropy ranges from 0 (low or poor) to 1 (high or best): H minimum value = minimum value (H bit, H base point / 8) Below are some example test results:

[0018] [Table 1] Here, chip ID is the identification number of the tested chip, and iteration is the number of tests. However, as mentioned above, many of these test cases are not suitable for FT processing for mass production due to time constraints. Therefore, there is a need for an entropy source evaluation or inspection method that can shorten the test time and make it suitable for mass production. Therefore, an object of the present invention is to dramatically shorten the test time for RNG mass production.

[0019] In this regard, the primary object of the present invention is to solve the above-mentioned problems, and more specifically, to provide a random number generating chip manufacturing method including an entropy source testing method that reduces the overall testing time so as to be suitable for mass production.

[0020] Summary of the Invention The solution to the time-saving objective of the present invention is achieved by shortening the test data length while improving the accuracy of the test. In particular, the present invention uses a block uniformity method, which tests only a portion of the sample data output by a chip, called a block, rather than the entire data sequence. Typically, the portion tested has a length of 512 KB to 1024 KB, rather than the aforementioned 10 MB.

[0021] This block uniformity method can be repeated for each single chip in production to assess whether such chip is good or not.

[0022] If the sample data is not long enough, the block uniformity will vary greatly, and to address such variations, an alternative or complementary method called the pixel uniformity method is proposed in addition to the block uniformity method.

[0023] A first aspect of the present invention comprises a test initiation phase which initiates a final test phase; a data collection step in which frames of a bit sequence having a length of 1024 KB, preferably 512 KB, generated by a RNG chip are collected; and a uniformity determination step which includes calculating the uniformity of said bit sequence according to the following formula:

[0024]

number

[0025] Preferably, the RNG chip testing method further comprises a chip sample management step of discarding the chip sample if the test fails.

[0026] Conveniently, the data acquisition step comprises acquiring a frame of bit sequences having a length of 1024 KB, preferably 512 KB, for each of the 64 pixels of the chip.

[0027] According to a preferred embodiment of the present invention, the uniformity determining step includes calculating the uniformity of all 64 pixels independently and the average uniformity of all 64 pixels.

[0028] Advantageously, the comparing step compares the average uniformity of all 64 pixels with a predetermined threshold and discards those chips for which the average uniformity is below the threshold.

[0029] According to a preferred embodiment of the present invention, the RNG chip testing method further includes a peak uniformity measurement step of calculating the minimum or maximum peak value of each pixel.

[0030] Preferably, the RNG chip testing method further comprises a compensation step in which only those chips that pass the comparison step are inspected for peak uniformity of each pixel.

[0031] According to a preferred embodiment of the present invention, the determining step determines that either all pixels of the chip pass the compensation step and the chip is considered a good sample, or at least one pixel of the chip fails the compensation step and the chip is considered a bad sample and is to be discarded.

[0032] A second aspect of the present invention relates to a method for manufacturing an RNG chip, including the RNG chip testing method of the first aspect of the present invention.

[0033] Preferably, the RNG chip manufacturing method is included in the mass production process.

[0034] A third aspect of the present invention relates to a random number generator including a chip manufactured by the RNG chip manufacturing method of the second aspect of the present invention.

[0035] BRIEF DESCRIPTION OF THE DRAWINGS Further particular advantages and features of the present invention will become more apparent from the following non-limiting description of at least one embodiment of the invention, which refers to the accompanying drawings.

[0036] Figure 1 shows the NIST SP800-90B entropy source model.

[0037] FIG. 2 shows a schematic representation of the final test process sequence using the block uniformity method of the present invention.

[0038] FIG. 3 is a schematic representation of data collection for the block uniformity method of the present invention.

[0039] FIG. 4 shows a schematic example of the results of the block uniformity method.

[0040] FIG. 5 shows a schematic representation of the final test process sequence using the pixel uniformity method of the present invention.

[0041] FIG. 6 illustrates a schematic representation of data collection from each pixel for the pixel uniformity method of the present invention.

[0042] Detailed Description of the Invention The detailed description of the present invention is intended to explain the invention in a non-limiting manner, since any feature of an embodiment may be combined in an advantageous manner with any other feature of a different embodiment.

[0043] Figure 2 illustrates a first embodiment of the present invention, a method for calculating uniformity in a QRNG chip. According to this method, called the block uniformity method, data from a tested RNG or QRNG is collected over a fixed length of time from CMOS image sensor pixels, as shown in Figure 3. Here, the term RNG is intended to define any type of random number generator, including quantum random number generators and the like. Also, the term RNG may refer herein to the entire RNG or the RNG chip independently, depending on the context.

[0044] As mentioned above, in practice, due to time constraints, it is not possible to perform full non-IID testing in mass production in order to classify samples as good or bad so that they can be released to the market.

[0045] For this reason, the present invention relates to an RNG chip testing method, which includes a step of starting a final test and then collecting data, preferably a frame of a bit sequence having a length of 1024 KB, preferably 512 KB, The RNG chip testing method includes a block uniformity step as shown in Figure 2, which calculates the uniformity of the bit sequence output by the RNG according to the following formula to solve the technical problem:

[0046]

number

[0047]

number

[0048] Once the uniformity is calculated, it is compared to a cutoff criterion or value. The cutoff criterion must be set to the upper limit of the dynamic range of the block uniformity. However, as shown in Figure 4, the block uniformity will have large fluctuations if the data length is not long enough.

[0049] For this reason, while the block uniformity method can indicate the overall performance of a chip, it cannot accurately indicate the performance of each pixel contained in the chip, as a single defective pixel may be masked by the overall performance.

[0050] For this reason, an alternative or complementary test method has also been developed, the pixel uniformity method shown in FIG.

[0051] The first step of the pixel uniformity method is similar in nature to the block uniformity method in that it involves a similar first step, which consists of starting the final test and then collecting a frame of data, preferably a bit sequence having a length of 1024 KB, preferably 512 KB. The main difference here is in the collection step, where a frame is collected for each pixel.

[0052] Generally, the RNG chip has 64 pixels and the method consists in collecting a frame of bit sequences of 1024 KB, preferably 512 KB, for each pixel according to FIG.

[0053] After collecting the data, a pixel uniformity test is performed on each of the 64 pixels, following the same formula as above for the block uniformity test, taking into account that each of the 64 pixels has two bits, and each bit can be 0, 1, 2, or 3.

[0054] Basically, the block uniformity method and pixel uniformity method have the same formula because the basic unit of uniformity is calculated as 2 bits. However, as can be seen from Figures 3 and 6, the difference between these methods lies rather in the collected data and whether the calculation is performed using the entire data or the data for each pixel.

[0055] At that point, two processes start independently.

[0056] The first is a linear cutoff process where the average uniformity of all 64 pixels is calculated and compared to a threshold or cutoff criterion or value, so that if the average uniformity fails the linear cutoff test, the chip is discarded.

[0057] The second is a measurement of the minimum or maximum peak value for each pixel.

[0058] At that point, if the linear cutoff step results in a positive result, i.e., if the average uniformity is acceptable, a compensation step is initiated in which the peak uniformity of each pixel is determined, i.e., the maximum value among the uniformities of the 64 pixels. For a 512 kB frame, the average cutoff is preferably 2.3% and the peak uniformity is preferably 10%.

[0059] This compensation process allows us to prevent dramatic occurrences of uniformity in a small number of pixels that could cause errors in that pixel or significantly affect overall performance. For example, if the uniformity of 63 pixels ideally converges to 0, but only one pixel has a uniformity above 10, it is not a uniformly distributed entropy source. To prevent this, the compensation concept is to cut off the peak uniformity.

[0060] After the compensation process, if all pixels of the chip pass the peak uniformity, the chip is considered a good sample and is considered acceptable, or if at least one pixel of the chip fails the peak uniformity, the chip is considered a bad sample and is discarded.

[0061] The advantage of this method is that the data extracted from each pixel exhibits smaller variations in uniformity than the block uniformity method, since each pixel has its own unique characteristics in terms of electronic features. Therefore, even when the data length available for FT processing is small, pixel uniformity is more effective than block uniformity in terms of yield, cost, or accuracy.

[0062] While the embodiments have been described in conjunction with a number of embodiments, many alternatives, modifications, and variations will be or become apparent to those skilled in the applicable arts. Accordingly, the present disclosure is intended to encompass all such alternatives, modifications, equivalents, and variations that are within the scope of the present disclosure. This is particularly the case, for example, when it comes to systems that embed chips and any type of hardware that performs the method. [Brief explanation of the drawings]

[0063] [Figure 1] This is a diagram showing the NIST SP800-90B entropy source model. [Figure 2] FIG. 1 is a diagram illustrating a final test process sequence using the block uniformity method of the present invention. [Figure 3] FIG. 1 is a diagrammatic representation of data collection for the block uniformity method of the present invention. [Figure 4] FIG. 10 is a diagram illustrating an example of the results of a block uniformity method. [Figure 5] 1 is a diagram illustrating a schematic sequence of a final test process using the pixel uniformity method of the present invention. [Figure 6] FIG. 2 is a diagram that schematically illustrates data collection from each pixel for the pixel uniformity method of the present invention.

Claims

1. A test initiation phase in which the hardware initiates a final test phase; a data collection step in which the hardware collects frames of bit sequences generated by the RNG chip, the frames having a length of at least 512 KB and at most 1024 KB; a uniformity determination step, the hardware calculating the uniformity of the bit sequence according to the following formula: [Equation 1] a comparison step in which the hardware compares the determined uniformity with a predetermined threshold; a determining step in which the hardware determines whether the RNG chip passed or failed the test based on the result of the comparing step; Including, the maximum value is the number of frames having the most frequently occurring bit value among the bit values ​​of frames in one of the collected bit sequences; the minimum value is the number of frames having the least frequently occurring bit value among the bit values ​​of frames in one of the collected bit sequences; the average value is the arithmetic mean value of the number of times each bit value of a frame appears in one of the collected bit sequences; RNG chip testing method.

2. 2. The RNG chip testing method according to claim 1, further comprising a chip sample management step in which the hardware determines to discard the RNG chip sample if the test fails.

3. 3. The RNG chip testing method of claim 1, wherein the data collection step includes the hardware collecting a frame of a bit sequence having a length of at least 512 KB and at most 1024 KB for each of 64 pixels of the RNG chip.

4. 4. The method of claim 3, wherein the step of determining uniformity includes the hardware calculating the individual uniformity of all 64 pixels and the average uniformity of all 64 pixels.

5. 5. The RNG chip testing method according to claim 3, wherein in the comparison step, the hardware compares the average uniformity of all 64 pixels with a predetermined threshold and decides to discard the RNG chip whose average uniformity is lower than the threshold.

6. An RNG chip testing method described in any one of claims 1 to 5, characterized in that the hardware further includes a peak uniformity measurement process in which the minimum peak value or maximum peak value of each pixel is calculated.

7. 7. The RNG chip testing method according to claim 1, further comprising a compensation step in which the hardware checks peak uniformity of each pixel only for the RNG chips that pass the comparison step.

8. 8. The RNG chip testing method of claim 7, wherein the determining step comprises the hardware determining that either all pixels of the RNG chip pass the compensation step and the RNG chip is considered a good sample, or at least one pixel of the RNG chip fails the compensation step and the RNG chip is considered a bad sample and is discarded.

9. A method for manufacturing an RNG chip, comprising the method for testing an RNG chip according to any one of claims 1 to 8.

10. 10. The RNG chip manufacturing method according to claim 9, which is included in a mass production process.

Images