Random number generator diagnostic method

Abstract

The present invention relates to an entropy measurement method, comprising: (i) a start-up phase, comprising the step of activating an entropy source unity; (ii) a signal emission step, comprising the step of emitting a quantum signal characterized by a total noise consisting of classical noise and quantum noise; (iii) a noise measurement step, comprising the steps of measuring total noise statistics through illuminated active pixels and measuring classical noise statistics through non-illuminated pixels; (iv) a quantum noise calculation step, comprising the step of calculating the quantum noise based on the difference between the total noise and the classical noise; (v) a health check step, comprising the step of comparing the resulting quantum noise with an expected quantum noise and / or a predetermined threshold; and (vi) a health control step of controlling the entropy source unit based on the result of the entropy estimation step.

Description

[Technical Field]

[0001] The present invention relates to a method for diagnosing the functioning of a random number generator, more particularly to a method for estimating the entropy of a RNG in real time, and even more particularly to a method for a health check of a random number generator. [Background technology]

[0002] Generally, the present invention is in the context of random number generation. Random numbers are used in many tasks in modern science and technology, including simulation, statistical sampling, gaming applications, and cryptography (both classical and quantum). A good random number generator should quickly generate bit sequences with high entropy. High entropy means that no one can predict the value of a bit before it is revealed; entropy can also be understood as randomness. This is an essential requirement for most modern cryptographic algorithms and protocols. In fact, commonly used cryptographic protocols such as the DSA algorithm, the RSA algorithm, and the Diffie-Hellman algorithm all follow Kerckhoffs' principle, which dates back to the 19th century. Kerckhoffs' principle asserts that the security of a cryptography must reside entirely in the key, i.e., in the random sequence used as a completely unpredictable secret. Therefore, it is particularly important that the keys used in cryptographic algorithms are secure. Practical requirements require that keys be completely chosen at random, i.e., randomly generated.

[0003] Many types of true random number generators are in practical use today. In cryptography, the term "true random" is used to emphasize that a random number generator generates real, genuine random bits, rather than pseudo-random or random-looking bits. Currently, a random number generator can be called a true random number generator if it has a good physical entropy source, a good extraction method, and its security is supported by theoretical evidence. A true random number generator uses its own physical entropy source to generate unpredictable random signals or bit sequences. However, the physical entropy generation principle (source) is complex and unclear, making it difficult to properly estimate the quality of the resulting entropy.

[0004] Furthermore, in addition to the primary entropy noise generated by the entropy generation principle, the entropy output is also affected by various additional noises (e.g., noise from physical or electronic components that accumulate with other noises). These additional noises may be deterministic (i.e., predictable), uncontrollable, or beyond interpretation, making entropy measurement impossible. Therefore, for proper entropy estimation, the contribution of these additional noises should be minimized or eliminated.

[0005] Furthermore, to provide a good random number generator—i.e., a “secure” and “real random and of high entropy” RNG—it is important to detect entropy quality drops or failures as soon as they occur so they can be corrected as soon as possible. The most common way to handle this is to apply statistical health check functions, such as the “repetition count test” and “adaptive proportion test” in NIST SP800-90B, as described by Turan et al. in their January 2018 “Recommendation for the Entropy Sources Used for Random Bit Generation.” Such health functions detect statistical anomalies by checking for the consistent or frequent occurrence of less typical or unlikely bit sequences.

[0006] However, for random number generators with entropy sources that are somehow capable of producing patterns that are not very biased, or that are well-mixed, or that appear random, this statistical method cannot detect entropy faults.

[0007] Therefore, to recognize entropy degradation, additional processing is required, such as real-time entropy estimation by monitoring various parameters of the physical components or other signatures that may indicate entropy quality. To improve safety, the entropy output is sent to subsequent steps, such as post-processing or a user application, only when statistical tests and entropy estimation provide acceptable entropy measurements.

[0008] Most commercially available random number generators cannot calculate entropy in real time and only apply the statistical health check function described above, as required by cryptographic standards. Some advanced random number generators, such as quantum random number generators, allow for the measurement of actual entropy based on entropy generation principles. However, due to the complexity of entropy generation theory and implementation, entropy calculations require long periods of time, preventing real-time measurement. In practice, checking entropy quality typically requires the use of extensive external equipment, where the signal, noise, and current state of various components are analyzed. In most cases, this is only available in laboratories, and after deployment, real-time entropy estimation is usually not possible.

[0009] In particular, US Patent No. 20180260192, "Device and method for managing performance of quantum noise-based random number generator," describes a conventional calibration method for light and a CMOS image sensor to maintain entropy quality. Specifically, the method first turns off the light, then measures the classical noise level, and finally adjusts the classical noise level by controlling various electronic components, such as the analog-to-digital converter offset, analog gain, and exposure time.

[0010] According to this prior art, the level of classical noise in a quantum random number generator is measured only to increase the analog-to-digital converter offset so that the classical noise is no longer visible. However, the classical noise is already mixed into the input signal prior to the analog-to-digital converter. Therefore, increasing the analog-to-digital converter offset neither reduces the classical noise nor makes the quantum noise dominant.

[0011] Therefore, it is necessary to calculate additional statistics of the classical noise of the random number generator, namely the variance as well as the mean, and use them to calculate the quantum entropy of the random number generator.

[0012] In this regard, the main object of the present invention is to solve the above-mentioned problems, and more particularly to provide an efficient method for estimating quantum entropy by minimizing or eliminating the contribution of additional classical noise, and to provide a diagnostic or health check method based on real-time entropy estimation and statistical health tests.

[0013] Additionally, instead of terminating entropy generation when the classical noise contribution is high, the present invention further provides an effective method for reducing the classical noise contribution while the quantum noise contribution remains dominant. Summary of the Invention

[0014] The present invention provides an efficient method for calculating pure quantum entropy in real time and then using this information to check whether a physical entropy source produces enough entropy. In addition, the present invention provides an efficient method for reducing the classical noise contribution to entropy and allowing the quantum noise contribution to entropy to dominate.

[0015] A first aspect of the present invention relates to an entropy measurement method, comprising: (i) a start-up phase including powering on an entropy source unit; (ii) a signal emission step including emitting a quantum signal characterized by an overall noise consisting of classical noise and quantum noise; (iii) a noise measurement step including measuring statistics of the overall noise through illuminated active pixels and measuring statistics of classical noise through non-illuminated pixels; (iv) a quantum noise calculation step including calculating the quantum noise based on a difference between the total noise and the classical noise; (v) an entropy estimation step including comparing the resulting quantum noise with expected quantum noise and / or a predetermined threshold; and (vi) a health check step of controlling the entropy source unit based on a result of the entropy estimation step.

[0016] Advantageously, said classical noise detection step comprises detecting said classical noise through at least one optically dark pixel.

[0017] In this way, the classical noise and the total noise are preferably detected simultaneously.

[0018] Alternatively, the classical noise detecting step comprises periodically turning a light source on and off, and detecting the classical noise through at least one active pixel when the light is turned off.

[0019] In this case, the entropy measurement method preferably includes a storage step which comprises storing the statistics of photon detection in a memory while light is switched off until the statistics of the classical noise are obtained.

[0020] Preferably, if a small degradation is measured, the health check step indicates the amount of entropy to the user and checks the next number of samples.

[0021] According to a preferred embodiment of the present invention, if a degradation in quality exceeding a predetermined threshold is measured, the health check step cuts off the output of the corresponding entropy bit, indicates the amount of entropy to the user, and checks the next number of samples.

[0022] Advantageously, if a sustained degradation exceeding the threshold is measured, the health check process detects a total failure, blocks the output of the corresponding entropy bit, and restarts / resets the quantum entropy source.

[0023] According to a preferred embodiment of the present invention, if a continued degradation above the threshold is measured even after a reboot, the health check detects repeated total failure and signals that the system is at end of life.

[0024] Preferably, at least one of said ODPs is a pixel or a pixel array of multiple pixels.

[0025] Advantageously, the entropy measurement method further comprises steps of measuring and minimizing additional noise, said noise coming from the group comprising after-pulse noise, additional digitization processes, format or unit converting, etc.

[0026] Preferably, the entropy measurement method further comprises an ADC sensitivity modulation step, the ADC sensitivity modulation step being adapted to reduce the sensitivity of the ADC when the statistics of the classical noise exceed a predetermined threshold.

[0027] According to a preferred embodiment of the present invention, the ADC sensitivity modulation step can be performed before or after the entropy estimation step.

[0028] Advantageously, the method according to the invention provides information as to whether the entropy amount and / or entropy level passes the test or not and whether to continue with the next step for the generation of truly random numbers.

[0029] Preferably, the method according to the present invention is applied to all quantum random number generators that use the quantum shot noise of light as the entropy generation principle.

[0030] According to a preferred embodiment of the present invention, the statistics of the quantum entropy signal and the classical noise can be calculated simultaneously and separately.

[0031] The present invention allows the measured statistics of quantum and classical signals to provide an actual quantum entropy measure and to detect quantum entropy failures in real time.

[0032] The present invention makes it easy to manage the overall level of classical noise by controlling the sensitivity of the analog-to-digital converter.

[0033] Further particular advantages and features of the present invention will become more apparent from the following non-limiting description of at least one embodiment of the invention, which refers to the accompanying drawings. [Brief explanation of the drawings]

[0034] [Figure 1a] 1 represents an embodiment of a detector used to detect and measure classical noise as well as total noise during the method according to the invention. [Figure 1b] 1 represents an embodiment of a detector used to detect and measure classical noise as well as total noise during the method according to the invention. [Figure 2] 1 represents a preferred embodiment of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0035] This detailed description is intended to illustrate the invention in a non-limiting manner, as any feature of one embodiment may be advantageously combined with any other feature of a different embodiment.

[0036] The main aspect of the present invention is to measure / detect classical noise statistics. To do this, only the classical noise signal, unaffected by light illumination, must be read. To achieve this, the present invention includes two alternatives. The first is to use additional, shielded optical dark pixels, as shown in Figure 1a. In this case, these pixels can be operated simultaneously with the active pixels. This allows simultaneous acquisition of total noise (quantum + classical) statistics from the active pixels and classical noise statistics from the optical dark pixels. Alternatively, there are no such optical dark pixels, and the light source is periodically turned on and off. Total noise statistics are acquired during the time the light is on. Classical noise statistics are acquired during the time the light is off. Both are acquired from the active pixels.

[0037] 1a and 1b show two embodiments of a detector used to detect and measure classical noise during the entropy measurement method according to the invention.

[0038] Figure 1a shows a first embodiment using at least one pixel, called an optical dark pixel (ODP), that is shielded from exposure to light. Figure 1b shows activating an active pixel while periodically turning off the light source. Both alternatively allow for the measurement of classical noise.

[0039] Here, an important aspect of the present invention is that it is necessary to have no pixels exposed to light when measuring classical noise statistics. In this regard, two alternatives are possible. The first, in Fig. 1a, is where a well-shielded additional ODP is placed alongside the active pixel array. The classical noise statistics can be measured from the ODP without turning off the light, so that the active pixels can simultaneously generate entropy bits based on photon number fluctuations. Alternatively, in Fig. 1b, no ODP is present. Therefore, to measure classical noise statistics, it is necessary to periodically turn off the light so that only classical noise is measured.

[0040] More specifically, according to a first embodiment of the present invention shown in FIG. 1a, at least one optically dark pixel is activated simultaneously with the active pixel.

[0041] An ODP can be a single pixel or a pixel array of several pixels. The ODP is usually placed next to a dummy pixel and covered by a metal shield. The physical operation is the same as the normal operation of a pixel in a CIS. All these outputs are fed to the ADC according to the read-out clock management. Therefore, a function on the ODP can collect these outputs and calculate the mean and variance of the classical noise. Another function on the active pixel array collects the outputs and calculates the mean and variance of the total noise (quantum and classical) in the same way.

[0042] Depending on the method for reading out pixel outputs, the outputs of each active pixel and each optically dark pixel for the entire frame can be transferred sequentially or in parallel. If the CIS module has one ADC, all of these pixel outputs must be transferred sequentially to the ADC. However, if there are multiple ADCs, they can be processed in parallel. In either case, a sufficient number of outputs must be counted to obtain statistics of the active pixel outputs and optically dark pixels. Therefore, depending on the number of pixels in the active array and ODP array, a partial frame, a single frame, or multiple frames must be used.

[0043] An optically dark pixel is a pixel that is shielded from radiation incident on the surface of an optical sensor. As shown in Figure 1a, an optically dark pixel is a photodiode in the shielded zone. The pixel itself is identical to other pixels in the active zone. However, a metal shield (or similar) and a dummy pixel on top prevent photons from reaching the ODP, so the ODP outputs only classical noise values.

[0044] In this way, it is not necessary to turn off the light in order to measure the classical noise power.

[0045] In fact, the digitized output of an optically dark pixel represents the total level of additive classical noise, including additive classical noise from electronic components, including analog-to-digital converter noise, and additive classical noise from the analog signal prior to the ADC, including the classical noise of the pixel, readout noise on the circuit, crosstalk between circuits, etc. Furthermore, additive electrical noise and digitization distortions are created by the ADC during the digitization process. Reading these outputs provides various statistics for the total classical noise, including the mean and variance.

[0046] In particular, by subtracting the statistics of the ODP, which contains only classical noise, from the statistics of the active pixel's output, an estimate of the quantum entropy can be derived, which represents only the entropy contributed by the light source and thus represents a more accurate estimate.

[0047] It is important to note that the active pixel output is ADC digitized for the convolution of the quantum signal with the classical noise signal.

[0048] If the classical noise statistics are too large or exceed a threshold, the sensitivity of the ADC can be reduced. The threshold is not fixed; the mean and variance of the classical noise output from the ODP can be set to maintain a negligible classical noise effect. A larger variance always equates to a larger entropy. However, as mentioned above, classical noise is not random; it merely appears random. Therefore, the fluctuation of the classical noise must be kept as small as possible, preferably below a certain value. This reduction can be achieved by increasing the input voltage range of the ADC. In this way, the classical noise signal is weakened and compressed in this configuration, resulting in smaller statistics. In this scenario, the fluctuation of the quantum signal must be kept high enough to provide good randomness even at this smaller sensitivity of the ADC. This can be achieved by increasing the light intensity (see also the prior art mentioned above).

[0049] After the above, if the classical noise level is within an acceptable level, the entropy estimation phase can begin. For simplicity, we assume that the digitized quantum noise and classical noise follow normal distributions and are independent of each other. From the active pixel output and the ODP output, the mean and variance of the pixel output (E pixel , V pixel) and the mean and variance of the classical noise (E ODP , V ODP ) is calculated as follows:

[0050] E pixel =E Quantum +E Classical , V pixel =V Quantum +V Classical , E ODP =E Classical , and V ODP =V Classical Considering this, the following equation can be derived: E Quantum =E pixel -E ODP , and ,V Quantum =V pixel -V ODP .

[0051] (E Quantum , V Quantum ) the entropy of the quantum signal is finally calculated.

[0052] (E Quantum , V Quantum ) is calculated, a probability distribution can be derived and the entropy can be calculated. More specifically, for given E and V, a probability distribution {p_i} can be obtained, based on which the Shannon entropy H=sum_i-p_i*log_2(p_i) can be calculated, or the min-entropy H=-log_2(p_max) can be calculated.

[0053] For practical efficiency, only meaningful p_i are considered. For example, negligible probabilities smaller than 10^-1 or 10^-2 are ignored in this calculation. The entropy thus obtained is compared with a predetermined threshold to check its quality.

[0054] Generally speaking, a predetermined threshold for entropy per bit should be set based on the quality of the physical entropy source as measured by long-term testing, and also based on the minimum entropy required. Long-term testing can identify a reliable range for entropy per bit. For example, if a physical entropy source generates more than 0.9 entropy per bit most of the time, the threshold could be 0.9 or less. Considering the case where the quality of the physical entropy gradually deteriorates but still generates enough entropy (e.g., 0.5) for some requirements, a second threshold can be set between 0.5 and 0.9. These tiered thresholds would be set accordingly based on alarm severity (e.g., weak, instantaneous, strong, persistent, etc.).

[0055] Alternatively, the predetermined threshold may be determined directly from the pair (E Quantum , V Quantum ) can be set based on

[0056] Depending on the measured entropy, the health check function can be configured to perform different levels of checks, as shown in the list below.

[0057] 1. If normal or small degradation is measured, the health check simply shows the amount of entropy and checks the next few samples. 2. If a degradation above the threshold is measured, the health check will shut off the output of the corresponding entropy bit, indicate the amount of entropy, and check the next few samples after adjusting the light intensity and pixel exposure time (as shown as option 1 in Figure 2). 3. If a sustained degradation (complete failure) above a threshold is measured, the health check will shut off the output of the corresponding entropy bit, and either (i) option 1 in Figure 2 will be applied again, and if the failure persists, the quantum entropy source will be restarted / reset, as shown as option 2 in Figure 2, or (ii) option 2 will be applied immediately. 4. If persistent degradation above the threshold is measured even after reboot (repeated complete failure), the health check will signal that the system is at end of life.

[0058] Alternatively, multiple thresholds can be set to define multiple types of faults (weak, strong, momentary, etc.) and corresponding responses.

[0059] Alternatively, as shown in Figure 1b, if no optically dark pixels are available, the light source can be periodically turned off while the active pixels are activated.

[0060] When the light source is turned off, the same procedure as above can be applied to measure the classical noise statistics. Indeed, without ODP, to obtain E_quantum and V_quantum, it is necessary to know E_pixel, V_pixel, E_classical, and V_classical. The former and latter need to be calculated with and without light, respectively. For this, the light is alternately turned on and off.

[0061] However, in this case, to estimate the quantum entropy, the photon detection statistics must be stored in memory until the classical noise statistics are obtained, since the light must be switched off. Once the photon detection statistics have been measured for both the quantum and classical regimes, an entropy estimate can be calculated and used as described above.

[0062] In conclusion, to measure the classical noise statistics, the pixel output needs to be read without the influence of light on the pixel. If an ODP is available, this can be done without turning off the light, i.e., while keeping the active pixel activated. Since all ODPs are masked, only classical noise affects the ODP output. However, if there is no additional ODP, the light can alternatively be turned off for a while and the output read from the active pixel to determine the classical noise statistics.

[0063] While the embodiments have been described in conjunction with several embodiments, it is evident that many alternatives, modifications, and variations will be or will be apparent to those skilled in the applicable arts. Accordingly, the present disclosure is intended to cover all such alternatives, modifications, equivalents, and variations that are within the scope of the present disclosure. For example, this is particularly true with regard to various available devices.

Claims

1. A method for measuring entropy using a random number generator, comprising: a start-up phase, including activating an entropy source unit; a signal generation step including the step of generating a quantum signal characterized by a total noise consisting of classical noise and quantum noise; a noise measurement step including measuring total noise statistics through illuminated active pixels and measuring classical noise statistics through non-illuminated pixels; an entropy estimation step, comprising calculating the quantum noise based on the difference between the total noise and the classical noise; a health check step, comprising comparing the resulting quantum noise with an expected quantum noise and / or a predetermined threshold; a health control step for controlling the entropy source unit based on the result of the entropy estimation step; An entropy measurement method, including:

2. 2. The entropy measurement method of claim 1, wherein the noise measurement step includes detecting the classical noise through at least one optical dark pixel.

3. 3. The entropy measurement method according to claim 1, wherein the classical noise and the total noise are detected simultaneously.

4. 2. The entropy measurement method of claim 1, wherein the noise measurement step includes the steps of periodically turning a light source on and off and detecting the classical noise through at least one active pixel when the light is turned off.

5. 5. The entropy measurement method according to claim 4, further comprising a storage step including the step of storing in a memory the statistics of photon detection while light is switched off until the statistics of the classical noise are obtained.

6. 6. The entropy measurement method according to claim 1, wherein the entropy estimation step comprises a step of calculating the entropy quantity from its mean E_quantum and its variance V_quantum.

7. 7. The entropy measurement method of claim 6, wherein the entropy estimation step includes the step of directly using E_quantum and V_quantum to check whether the entropy source unit generates good entropy.

8. E_quantum and V_quantum are expressed by the following formula: E_quantum=E_pixel-E_classical, V_quantum=V_pixel-V_classical is calculated through 8. The entropy measurement method according to claim 6 or 7, characterized in that E_classical and V_classical are obtained through detection of the classical noise associated with the noise measurement step by at least one optically dark pixel and / or at least one active pixel when the light is turned off.

9. Method for measuring entropy according to any one of claims 1 to 8, characterized in that if a small degradation is measured, the amount of entropy is indicated to the user and the next several samples are checked.

10. 9. The entropy measurement method according to claim 1, wherein if a degradation in quality exceeding a predetermined threshold is measured, the output of the corresponding entropy bit is blocked, the amount of entropy is indicated to the user, and the next several samples are checked after adjusting the light intensity and the exposure time of the pixel.

11. If a continuous degradation exceeding said threshold is measured, a complete failure is detected and the output of the corresponding entropy bit is blocked; The light intensity and pixel exposure time are readjusted and, if the fault persists, the entropy source unit is restarted, or or, Method for measuring entropy according to any one of claims 1 to 8, characterized in that the entropy source unit is immediately restarted.

12. A method for measuring entropy according to any one of claims 1 to 8, characterized in that if a continuing degradation exceeding the threshold is measured even after rebooting, a recurring complete failure is detected and the user is notified that the system is at the end of its life.

13. Method for measuring entropy according to any one of claims 1 to 12, characterized in that at least one said non-illuminated pixel is a single pixel or a pixel array of multiple pixels.

14. An entropy measurement method as described in any one of claims 1 to 13, characterized in that it further comprises a step of modulating the sensitivity of an analog-to-digital converter, the step including a step of modulating the sensitivity of the analog-to-digital converter adapted to reduce the sensitivity of the analog-to-digital converter when the statistics of the classical noise exceed a predetermined threshold.

15. 15. The entropy measurement method according to claim 14, wherein the step of modulating the sensitivity of the analog-to-digital converter can be performed before or after the entropy estimation step.

Images