Random number generation

Abstract

An entropy source (900) for use in random number generation is described. The entropy source includes a noise source (905) that outputs a first sequence of bits (911), and a noise conditioner (910) that receives the first sequence of bits (911) from the noise source (905) and outputs a second sequence of decorrelated bits (912). The noise conditioner 910 includes multiple noise conditioning stages 913, 914 communicatively coupled in series. Each noise adjustment stage (913, 914) includes a k-bit shift register structure (808) that stores a set of previous input bit values ​​and stores a set of von Neumann cell states (818) for performing von Neumann bias removal, each von Neumann cell having a state, and a selector (810) that receives the input bit values ​​and selects one of the set of von Neumann cell states (818) to conditionally generate an output bit value based on the bit values ​​of the shift register structure, the selected von Neumann cell state being updated after selection. The entropy source (900) also includes a buffer (915) for receiving and storing the second decorrelation bit sequence from the noise adjuster (910), the buffer (915) being configured to be polled to deliver a number of bits as an output random bit sequence.

Description

[Technical Field]

[0001] The present invention relates to random number generation. More specifically, but not exclusively, to an entropy source used for generating random numbers (or random bit sequences), and a noise modifier that can increase entropy in the entropy source and other random number generation pipelines. [Background technology]

[0002] True random number generation is one of the most critical parts of any computer security system, as it is from which private keys and other highly sensitive security parameters ultimately originate. Anything less than true randomness, or rather, a random bit sequence, increases the chances of cyberattacks, which may be based on the ability to predict sequences that are not truly random.

[0003] Many methods for generating random numbers are known. For example, certain Intel® processors provide RDRAND or RDSEED instructions that return random numbers from an on-chip hardware random number generator seeded from an on-chip entropy source.

[0004] In this specification, an entropy source is generally a hardware bit source that generates a bitstream containing random characters. Because external entropy may be unavailable or unreliable, entropy sources are typically found on-chip. An entropy source may generate random bits using a noise source based on phenomena such as thermal noise from an electronic circuit or system, such as a ring oscillator. For example, the entropy source for the RDSEED instruction is executed asynchronously in a self-timing circuit and uses thermal noise within the silicon to output a random bitstream.

[0005] Entropy sources typically have a modifiable level of entropy. High entropy implies high randomness, while low entropy implies low randomness, and different entropy sources result in different levels of entropy. The level of entropy can be established using industry-standard test procedures.

[0006] In many cases, the entropy source itself is not used to distribute the random numbers used by the application. Instead, the output from the entropy source can be used to seed downstream random number generators, such as cryptographic and / or deterministic pseudorandom number generators, which generate the random numbers used by the software application. Such downstream random number generators can be implemented in hardware or software based on the random bits provided by each entropy source.

[0007] Certain known random number generators associated with large integrated circuits such as Intel® and AMD® processors implement cryptographic tuners using existing instructions such as AES. For example, they take bit samples from a source and generate conditioned (i.e., encrypted) entropy samples.

[0008] While known cryptographic tuners work well in some scenarios, they may not be suitable for applications using resource-constrained, so-called lightweight processors and / or embedded systems. They may lack the chip real estate or processing power to support features like AES. Therefore, a new kind of entropy source is needed that is suitable for lightweight microcontrollers, reduced instruction set architectures such as RISK-V, and / or processors adapted to post-quantum cryptography.

[0009] In the paper "Independent unbiased coin flips from a correlated biased source - a finite state Markov Chain" by M. Blum, Combinatorica 6 (2) (1986), pp 97-108, the use of von Neumann's scheme to simulate a completely unbiased coin, which extends it using a biased coin and generates an independent unbiased sequence of Hs and Ts from any Markov chain in the expected linear time, is described. Blum presents two algorithms, A and B, and shows that algorithm A is a "bad" algorithm and algorithm B is a "good" algorithm. Blum's paper is theoretical and mathematical and does not lead to a specific design of an entropy source suitable for low-cost embedded computing platforms. "Algorithm B" is presented as a high-level method, but no specific implementation of this algorithm is provided.

Summary of the Invention

[0010] Aspects and embodiments of the present invention are disclosed in the appended claims. The various features of the present disclosure will become apparent from the following detailed description in conjunction with the accompanying drawings that illustrate the features of the present disclosure together.

Brief Description of the Drawings

[0011] [Figure 1] FIG. is a schematic block diagram of an architecture including an entropy source by way of example and a software environment capable of receiving entropy bits from the entropy source. [Figure 2] FIG. is a block diagram of a hardware noise source by way of example. [Figure 3] FIG. is a schematic block diagram of a 1-state Markov chain. [Figure 4] FIG. is a schematic block diagram of a 2-state Markov chain. [Figure 5]It is a schematic block diagram of a 4-state Markov chain. [Figure 6] It is a graph showing how various noise regulators function according to the number of Markov states. [Figure 7] It is a schematic block diagram of an 8-state Markov chain. [Figure 8] It is a schematic block diagram of a hardware implementation of a noise regulator having 8 states by way of example. [Figure 9] It is an example of pseudo-code capable of performing von Neumann bias removal by way of example. [Figure 10] a is a graph of the yield with respect to sigma (σ) of a von Neumann device as by way of example. b is a graph of the yield with respect to sigma (σ) of a 64-state Bram B regulator. [Figure 11] It is an architecture of a practical entropy source by way of example. [Figure 12] It is a flowchart showing steps performed by a noise regulator by way of example.

Modes for Carrying Out the Invention

[0012] The examples described herein provide an entropy source for securely and efficiently generating sequences of random numbers. In a preferred example, the entropy source is implemented in hardware and used as a resource by a secure kernel or operating system service to deliver random bit sequences to applications on a computing platform. In other examples, the entropy source may be implemented in firmware and / or software, either as a “protected” random number source or as a “virtual entropy source” for enclaves, simulators, and virtual machines. The entropy source may include a lightweight, adaptive, non-encryptive (arithmetic) noise reduction mechanism, particularly with an efficient computational configuration. In a “single-vendor” implementation where the manufacturer controls both hardware and software (e.g., firmware), the examples may result in a set of components that ensure an uncorrupted noise source, allowing for independent evaluation. Thus, the current examples of entropy sources present a minimal true random number generator that can be included as part of a secure microcontroller profile. The preferred hardware configuration for the entropy source can be built inexpensively from standard cellular logic components through simple synthesis via application-specific integrated circuits (ASICs), as well as in the form of field-programmable gate arrays (FPGAs) via common FPGA development platforms.

[0013] In certain examples, both the noise source and the noise tuner of the entropy source perform continuous testing. A pre-processed noise signal from the noise source can also be used for evaluation. The entropy source can be implemented as part of a reduced instruction set computer (RISC) central processing unit (CPU), such as a RISC-V CPU, and can be implemented with a noise source, noise tuner, health test, and alarm signaling mechanism. The CPU's global reset line can serve two purposes: zeroing and initiating a built-in self-test. The noise tuners described herein use far less energy than cryptographic tuners, have a much smaller implementation area, and can be implemented without the assumption of computational hardness, thus making them essentially "quantum secure." The entropy source also supports numerous "post-quantum" security standards (such as those set by the National Institute of Standards and Technology (NIST)), thus forming the basis for large-scale post-quantum implementations.

[0014] The entropy sources described herein are particularly well-suited for providing lightweight, secure, true random number generators for microcontrollers that perform exceptionally well within a small (silicon) area while meeting the engineering and verification requirements of a complex set (e.g., those set by various cryptographic standards). Embedded systems, according to the implementations described, may particularly benefit from on-chip entropy sources because external entropy may not be available or may not meet advanced cryptographic standards (e.g., it may be open to operations and / or generally untrustworthy).

[0015] In the examples described, certain requirements for a true random number generator can be met by a dedicated hardware (or software) entropy source. This reduces the need for computationally intensive cryptographic adjustments to be performed in software before use. This example of an entropy source is a departure from previous CPU-based random number generation, often involving cryptographic adjustments after "30 parts" and "1 part" of entropy generation. This is because these CPU-based random number generators are typically open to cryptographic attacks and manipulations. This example further provides an entropy source, with additional random bits supplied as needed (e.g., by polling). In comparison, CPU-based random number generators (such as those used in Intel® processors) may require resource-intensive computation for larger bit sequences (e.g., over 128 bits), such as large blocks (e.g., 512 bits), especially for battery-powered or other embedded implementations.

[0016] Figure 1 shows an architecture 100 applicable to the examples described herein. Architecture 100 includes an entropy source 110, a hardware entropy source 112 which in this case (but not necessarily) includes a noise source, a noise modifier 114, a buffer 116 for receiving and storing entropy bits from the noise modifier 114, and a hardware interface 118 for receiving polling signals and distributing entropy bits.

[0017] For this purpose, the noise modifier 114 can be thought of as a device or processing module that increases the entropy of bits received from the noise source 112, and aims to retain "important" features or entropy bits of the bitstream while discarding features that are known to be redundant (from models, etc.). For example, assuming that jitter accumulates at a constant rate per cycle in an electronic circuit such as a ring oscillator, low-frequency inputs (with fewer cycles involved) may have more bits to "discard" than high-frequency inputs. For example, in the case of a low-frequency oscillator source, the discarded bits may include long runs of zeros or ones, but the least significant bit of those runs may hold a considerable amount of entropy. In that situation, the noise modifier 114 can be seen as analogous to a dynamic "irreversible compression algorithm".

[0018] Architecture 100 also includes software 120, which includes a software driver 122 and a software application 160. The software driver 122 includes a polling interface 124 for interacting with a hardware interface 118 by sending polling signals and receiving entropy bits. The software driver 122 may include further tuners 126, such as a cryptographic tuner, and / or a deterministic random number generator (DRNG) 126 that takes entropy bits and generates random bits of the required specifications as needed by the software application 160.

[0019] In this example, the software application 160 could be an encryption application that receives entropy bits from the entropy source 110 via the software driver 122. When instructed by the software application 160, the software driver polls the buffer 116 via the hardware interface 118 and receives a bitstream, for example, 256 bits (if the buffer has 256 positions). Once the buffer 116 is full, the entropy source 110 can deliver only entropy bits. The configuration of the software driver 122 and the software application 160 varies depending on the use case, and further details are not presented here. The entropy source 110 may, in some cases, be implemented as part of a secure microcontroller profile for a RISC-based processor, such as a RISC-V processor.

[0020] Figure 2 shows a noise source 200 suitable for the entropy source 110 in this example. The noise source 200 in this example is a hardware circuit comprising a ring oscillator configured for an odd number of NOT gates 205a, 205b, and 205c (inverters) connected in a free-running loop. As is known, oscillation is possible with an odd number of NOT gates because the output is single-ended and inverted. In this example, there are essentially three NOT gates. The first NOT gate 205a is implemented as a NAND gate, so that the enable signal "enable" applied to the enable input 215 of the NAND gate activates the circuit and logically causes the NAND gate to operate as the first NOT gate in the loop. Thus, the ring oscillator operates when the enable signal is "1" and the value output by the NAND gate is the inverted input applied to the second input of the NAND gate. The second input 220 to the NAND gate is fed back from the output 225 of the last NOT gate 205c in the loop via a feedback line 230. The output bits are sampled at the output of loop 225 by a D-type latch 235, which is clocked by the system clock CLK signal. The system clock runs at a rate lower than the free-running frequency of the loop. The noise source 200 outputs noise bits from the output 240 of latch 235.

[0021] Ring oscillators of the type shown in Figure 2 are known to be used as noise sources. During operation, the timing of transitions (1→0 or 0→1) is affected by electronic phase noise and becomes unpredictable (i.e., obviously more random) over time. Therefore, the signal level at the output of the ring oscillator can be periodically sampled by a clock latch 235, as shown, for example, to derive “noise” samples used to generate bits input to the noise tuner 114. Of course, noise samples are not perfectly random and usually exhibit some degree of bias and correlation, but randomness can be improved by downstream conditioning, as will be discussed later. In implementation, noise sources such as those shown in Figures 1 and 2 can be implemented using digital or analog circuits or probabilistic simulators. In preferred implementations, noise sources 110 and 200 can be implemented using standard cellular logic components, such as those available for ASIC or FPGA implementations.

[0022] The randomness of a ring oscillator is due to timing jitter. Timing jitter can be shown to have a strong Gaussian characteristic, where the phase difference relative to the reference clock CLK accumulates and the variance σ t 2 It can be seen that it increases almost linearly with each cycle.

[0023] It should be noted that comparison noise sources such as the XOR sequence of multiple Lang oscillators were considered. However, it was found that such configurations resulted in a pseudo-random number generator where the output sequence appeared random even without much jitter. This made it difficult to accurately estimate the generated entropy.

[0024] Under general conditions, the standard deviation (uncertainty) of the transition time after time t is σ t However, in the case of a CMOS ring oscillator, for example, it can be estimated as follows.

number

[0025] From the aforementioned equations, it is clear that fluctuations in temperature and voltage significantly affect the jitter of the ring oscillator, and consequently, can affect the entropy levels of each noise source. Therefore, as will be further discussed herein, it is recognized for the purposes of this invention that entropy sources can benefit from some degree of adaptive behavior to adapt to increases or decreases in entropy levels.

[0026] Other examples may use different noise sources. These include continuous and Schott (Poisson) electronic noise processes, such as noisy diodes. Physical sources that can be digitized as noise inputs include thermal, optical, mechanical, and quantum phenomena. Quantum phenomena that introduce randomness include superposition of quantum states, entanglement of quantum states, Heisenberg uncertainty, quantum tunneling, and spontaneous emission or radioactive decay. The noise source does not have to be directly physical. Examples of derived random sources include system events in computer systems and communication traffic. Other examples based on the teachings herein may use any such alternative noise source.

[0027] An entropy source may include tuners, sometimes called noise tuners, to increase the entropy of the bitstream delivered by the entropy source. Entropy can be increased by removing redundant bits, such as long streams of 0s or 1s, or artifacts that characterize the noise source, which would otherwise work to decrease the entropy of the entropy source.

[0028] The noise tuner 114 in this example uses functions and logic that implement one or more Markov chains to tune the bits output from the noise source 112. The use of Markov chains in so-called deterministic circuits can be criticized (see, for example, David Johnston, “Random Number Generators - Principles and Practices: A Guide for Engineers and Programmers”, De Gruyter, 2018). This is because a Markov chain has only a finite set of states, whereas real-world entropy bits, such as those derived from the noise source 112 described above, likely have an infinite number of states. Therefore, it is impossible for a real Markov chain to track all possible states of a real-world entropy bitstream. Furthermore, it is perhaps counterintuitive to expect that a “stated tuner” can make the bits in the bitstream more independent. However, it has been determined herein that the use of Markov chains, even with only a few states, is very helpful in reducing the bias and correlation of the entropy bits generated by the noise source 112. In fact, the Markov chain applied to the noise modulator described herein has been shown to be able to increase the entropy well above the lower threshold required by industry standards.

[0029] In the specific examples described herein, a noise tuner is used as a device configured to retain "important" feature or entropy bits while discarding bit sequences known to be redundant from the model. The noise tuner can be thought of as implementing a form of irreversible compression algorithm on a raw noise source. In some cases, the noise tuner in the entropy source may be followed by cryptographic conditioning (e.g., internally in post-polling software), such as a hash function, which further evenly distributes the input entropy to the output bits. In the examples, the noise tuner can be configured to yield appropriate independent entropy content under both normal and adversarial conditions. If the noise (e.g., bits from the noise source) cannot be processed to satisfy the required set of constraints, the entropy source has characteristic and identifiable failure modes and mechanisms for detecting them. All of this is provided within a small, power-efficient implementation circuit.

[0030] Figures 3, 4, and 5 show examples of Markov chains that can be modeled as part of a noise tuner implementation. Figure 3 is the first example of a Markov chain 300 with one state N. The configuration in Figure 3 can also be applied as a so-called von Neumann debiaser, as will be discussed later. In the Markov chain 300 of Figure 3, the one state N can be 0 or 1 (or heads H or tails T), and the state has two possible transitions Pr(0)=pN and Pr(1)=1-pN. In an unbiased system, such as one that determines transitions using an unbiased coin toss, Pr(0)=Pr(1)=0.5. However, in a biased system, for example, one in which a series of coin tosses produces far more heads than tails, a von Neumann debiaser based on a single-state Markov chain can be used to remove the bias in the sequence by considering the pairs of coin tosses, such that Pr(0)≠Pr(1). The von Neumann debiaser can assign 0 to the sequence HT and 1 to the sequence TH, and subtract any sequence containing HH or TT. This produces an unbiased bitstream, and we notice that Pr(0).Pr(1)=Pr(1).Pr(0)=pN.(1-pN). In short, a tuner based on the von Neumann debiaser will produce unbiased output bits regardless of the level of input bit entropy, as long as the coins (output bits) are not correlated, even without prior knowledge of pN and even at an output rate of up to 25% of the input sequence bit rate. Correlation can be, for example, a long run "HHHHHHTTTTTT", which may indicate a "positive" sequence correlation, while an alternating pattern "HTHTHTHTHT" may indicate a "negative" sequence correlation. Any kind of correlation could be an artifact of an imperfect noise source 112, or imperfect environmental conditions of the noise source 112 (e.g., very low operating temperature). Correlation is generally an undesirable trait with respect to randomness because it can sometimes help predict the next coin toss based on previous tosses.Note that there is no absolute bias, H = 1 / 2 and T = 1 / 2, in either of the above examples, and thus the basic von Neumann adjuster does not protect against serial correlation (only against absolute bias, assuming it is constant at the source), and as will be explained, this is why additional countermeasures are needed.

[0031] Correlation can be reduced using the n - state Markov model proposed by Manuel Blum, where n>1. FIG. 4 shows a two - state Markov chain 400 and FIG. 5 shows a four - state Markov chain 500. Each Markov chain is shown with its respective transitions and the probabilities of occurrence of the associated transitions. As will be explained, the two - state Markov chain 400 can relax the correlation between the current bit and the previous bit, and the four - state Markov chain 500 can relax the correlation between the current bit and the two preceding bits. More generally, it has been found that a two k - state Markov chain can reduce the local correlation of up to k preceding bits.

[0032] In the case of a Markov chain, a single input bit and the current state 0≦i < n determine the next state. Here again, there are two options with complementary probabilities p i and 1 - p i for exiting the state. These "exit probabilities" can be assumed to be static as long as they do not change over time. With these assumptions, any state is selected, the state transitions are tracked, and the end bits are recorded only from that single state. The resulting bit sequence has an uncorrelated bias p i . It is then understood that applying a von Neumann debiaser only to those bits can simultaneously remove the correlation (through the above - mentioned state - correlation assumptions) and generate an unbiased bit sequence.

[0033] Blum observed that a direct approach, which treats all states as independent von Neumann debiasers and increases the output rate by directly merging their outputs, does not yield independent, unbiased output bits. Therefore, as an alternative approach, Blum proposed a modification to address this. This assumes that the Markov assumption (i.e., the memoryless property of the probabilistic model) holds, but that there is no knowledge of its static exit probability. The modification is presented in Blum's so-called "Algorithm B" (as presented in "Independent unbiased coin flips from a correlated biased source-a finite state Markov Chain", M Blum, Combinatorica 6 (2) (1986), pp97-108). In this modification, the model outputs von Neumann bits (unbiased) from a state only after that state has been re-inputted. This delay makes the approach adopted in Algorithm B "patient".

[0034] The tuners described herein that generally operate or implement Bram's algorithm B are referred to as Bram B tuners. The implementations described herein address a common criticism of Bram's algorithm, namely that real-world entropy source circuits tend to have an infinite number of states. Therefore, it is impossible to track these states effectively. Thus, a simple implementation of Bram's algorithm needs to address the need to track states. In this example, a multi-stage, multi-state configuration, as shown in Figures 8, 9, and 11, was found to provide an efficient and viable noise tuner configuration to address this. The noise tuners described herein have been tested to operate with various noise sources and simulations. Testing included exposing the noise source device (such as an FPGA implementing the noise source) to various ambient temperatures (including as low as -50°C) and allowing long-term execution (such as testing the phase lock of a ring oscillator). Note that many theoretical models do not consider how entropy sources behave under real-world conditions, nor do they consider resource constraints such as silicon area and computational cycles.

[0035] In experiments conducted for this purpose, the Markov chain 400 shown in Figure 4 was examined. Experiments using an actual ring oscillator demonstrated that by having two states (and two "von Neumann-Debiassa" states), the tuner can significantly mitigate the common problem of strong positive or negative sequence correlation between directly consecutive bits, which is represented as a run or alternating pattern of 0s and 1s (..010101..). In such a two-state model, the probability p0 of a 1 bit following a 0 bit is different (independent) from the probability p1 of a 1 bit following another 1 bit. While it is possible to identify the limitations of such a simple correlation removal, it is far more effective than assuming that the two exit probabilities are the same.

[0036] For this purpose, the capabilities of various tuners are evaluated using various noise corpus datasets {corpus A to corpus E}. In the graph in Figure 6, the x-axis represents the number of Markov states of the tuner, and the y-axis scale represents the entropy of the various noise corpus datasets after they have been tuned using the various tuners, from von Neumann-De Biasa (1 Markov state) to 2 k This ranges from various Bram B regulators having a number of Markov states, where k is in the range of 2 to 10. As can be seen, the entropy increases rapidly up to k=3, but beyond k=3, the entropy levels off (settling in the range of 0.8 to 0.9) despite the increasing number of Markov states.

[0037] Therefore, from a practical standpoint, 2 3 A Bram B tuner with 8 states has been shown to produce relatively high entropy in the form of unbiased and relatively uncorrelated bits, for example in an embedded processor, while minimizing architectural and power overhead. In other words, a Bram B tuner with more states can be applied to the examples herein, but the architectural overhead of the additional states is not usually guaranteed because the increase in entropy of the resulting bit sequence is relatively small. Furthermore, assuming the strongest correlation with the most recent bit input from the noise source, an 8-state Bram B tuner should be expected to perform decorrelation well in most cases.

[0038] Figure 7 shows a Markov chain 700 for an 8-state Bram B tuner that can be implemented according to this example. Figure 7 shows each of the possible transitions between states (due to the arrival of a new bit D). More specifically, each state has two possible entry transitions and two possible exit transitions. For example, state 000 can be entered from state 001 (when the next bit D=0) and itself (when the next bit D=0). The exit transitions from state 000 are state 100 (when the next bit D=1) and itself (when the next bit D=0). In another example, state 110 can be entered from state 101 (when the next bit D=1) and state 100 (when the next bit D=1). Exit transitions from state 110 include state 111 (when the next bit D=1) and state 011 (when the next bit D=0), and so on. Such state machines have been proven effective as tuners to remove bias and address local correlations of at least k=3 (in the case of the previous three states) in relation to the input bits, as will be discussed later.

[0039] Figure 8 shows an architecture configured to implement an 8-state Bram B tuner 800 that implements the Markov chain 700 of Figure 7. The Bram B tuner has an input D802 that receives samples ("0" or "1") from the output 240 of a noise source 200 (Figure 2). The input bitstream, including the input bits, is loaded when the enable input W806 is active, clocked by the clock signal CLK804, and supplied to the shift register configuration 808 and selector 810. Architecture 800 also has a reset input RST812 for resetting (or re-preparing) the tuner as needed. Architecture 800 further has an output Q814 that outputs the value of the bias-relaxed / decorrelated bit that forms the output bitstream, and an enable output E816 that sends the value of the enable line W806 to a downstream module.

[0040] Since a shift register configuration acts as memory for the previous input bit, it is understood that a shift register configuration approximates the state of a Bram B tuner (or, in practice, any circuit that implements a Markov chain) and can be represented or corresponded to by each transition. Thus, a 1-bit shift register can be used in a 2-state Markov chain, a 2-bit shift register in a 4-state Markov chain, and in this present example, a 3-bit shift register can be used in an 8-state Markov chain, and so on. In the examples herein, any suitable configuration of memory and instruction / logic circuitry can be applied to fulfill the role of the shift register configuration 808.

[0041] Selector 810 is configured in this example to select one of eight destination logic cells, including von Neumann cell 818, which, as described later, are bit values ​​{D} of shift register configuration 808. j-1 , D j-2 , D j-3 The von Neumann bias rejection is performed according to the addressing or selection determined by}. Input D is sent to the von Neumann cell 818 selected by selector 810. The selected von Neumann cell 818 generates the output Q of the Bram B tuner based on its current state S and the value of the new input bit D. The remaining seven von Neumann cells maintain their state and perform no function until they are selected again by selector 810. In the next clock cycle CLK, input bit D is D j-1 Then it enters the shift register configuration 808, and the oldest bit D of the shift register 808 j-3 It is dropped or discarded. In the examples herein, any suitable configuration of memory and instruction / logic circuits can be applied to fulfill the role of selector 810.

[0042] As can be understood, when the input bits enter the shift register configuration 808, the selector 801 selects a von Neumann cell 818 according to the inter-cell transitions represented by the Markov chain 700 in Figure 7, thereby performing decorrelation. In the examples herein, any suitable configuration of memory and instruction / logic circuits can be applied to fulfill the role of the von Neumann cell 818.

[0043] The operation of the architecture in Figure 8 can be explained as follows with respect to the transition corresponding to the selection of the following von Neumann cell 818: Assume that the bit input stream is {a,b,c,d,e,f}. The following address, namely [cba,dcb,edc,fed], is generated as the input bit "clock" to the shift register configuration 810 (because the new bit D always goes into the left cell of the shift register configuration 808, and the rightmost bit drops out from the right cell of the shift register). For example, if the values ​​are {a,b,c,d,e,f}={0,1,0,1,1,0}, the resulting transition in the Markov chain 700 in Figure 7 is 010(d=1)→101(e=1)→110(f=0)→011.

[0044] Of course, supplying bits to the left side of the shift register configuration 808 is only one option. It is also possible to supply bits to the right side of the shift register configuration 808, in which case the address [abc,bcd,cde,def] is delivered, and the shift register configuration 808 instead operates across the input bitstream like a "sliding window". In this case, certain transitions in the Markov chain 700 must be modified to match the new set of possible transitions.

[0045] According to Bram's algorithm B, it will be understood that the architecture in Figure 8 does not perform complete decorrelation. This is because, for complete decorrelation, the state transitions of the Markov chain would need to precisely match the probabilistic model of each noise source, which is impractical. However, the shift register / addressing approach applied in Figure 8 is known to provide a high degree of decorrelation, at least insofar as the correlation with the most recent bit input from the noise source is the strongest.

[0046] The von Neumann cell 818 processes input bit D according to the logic and the pseudocode in Figure 9. Each von Neumann cell has five possible states S i ={λ,0,1,H,T} and has input / output corresponding to that of the Bram B tuner 800. The next input bit D and the current state S determine the behavior of the von Neumann cell 818, which operates on a sequence of input bit pairs to perform von Neumann bias rejection, as already mentioned.

[0047] Referring to the operation of the von Neuman cell and Figure 9, the following occurs: Action (W is active and input D is on CLK): When S = λ, S takes on the value of D. o If S=0 and D=1, S takes the form 'H'; otherwise, S takes the form λ. o If D=0 and S=1, S takes the value 'T'; otherwise, S takes the value λ. If S='H', output Q=0 and set S to the value of D. If S='T', output Q=1 and set S to the value of D.

[0048] As already shown, input bit D802, when clocked by the clock signal CLK804 (when enable input W806 is active), is supplied to the shift register configuration 808 and selector 810, which generate (or not generate) output Q814 according to the logic. When generating an output, the state is set to the value of D regardless of whether S=H or T. This can be thought of as a "wipe-on read". Each von Neumann cell can be efficiently implemented using three internal flip-flops to store the state, and each cell can be provided with a simple external serial data stream interface.

[0049] One advantage of the two-stage noise tuner described in Figures 8, 9, and 11 is that, while some entropy bits are lost, its state adapts quickly to the characteristics of the noise, and the output rate may even change as the characteristics of the noise change. This allows the entropy source to deal with the less-than-perfect behavior of real-world noise sources in a practical way, in contrast to academic or theoretical models that require and assume theoretical perfection. It also allows the entropy source to use different noise sources. For example, the same noise tuner can be combined with different noise sources and its output adapted accordingly.

[0050] In arriving at the exemplary designs described herein, various entropy source configurations were modeled and tested under the assumption of a sampled digital oscillator noise source. For a sampled digital oscillator source, the signal amplitude is ignored, and a pulse wave with period T is considered to have a relative pulse width ("duty cycle") D. A constant sampling rate is assumed, and sample bits are used as a measure of time.

[0051] The sinusoidal phase ω is normalized to x = (ω - δ) / 2π in the range 0 ≤ x < 1, where δ is the position of the leading edge. The fundamental frequency F = 1 / T is the bitwise increment of the phase, and the bitwise jitter σ 2 This is its variance (F,D,σ2 The operation of the noise source sampler can be modeled as follows:

number

number

[0052] Given some initial state x0, a normal distribution random generator (sampler) N $ Using these two equations, we can generate a simulated sequence of bits z1, z2, z3, ... that matches the model. The variance per bit is σ. 2 This is the standard deviation √(σ 2 RMS jitter measurement by / F) jit(cc) It is associated with.

[0053] Figure 10a is a graph showing the results of simulating the jitter randomness (sigma, σ) according to the aforementioned model for the yield of a single-state von Neumann-Deviassa, while Figure 10b shows the same results but with 64 states (i.e., k=6) and is a graph of a Bram B tuner with a sliding window shift register design.

[0054] The yield (y-axis) on the graph is the ratio of the number of bits output from the tuner to the number of bits input to the tuner. The yield not only indicates the "output speed" of the tuner for any given input bitrate, but also approximately √(σ 2 This is an important parameter because it shows the accumulated RMS jitter, which is (Y) / Y.

[0055] Because the Bram B tuner initially discards some bits (since all states are initially "λ"), the tuner does not accept the given parameters (F, D, σ). 2The continuous yield was estimated by supplying 2000 bits and measuring how many bits were output. For the von Neumann debiasa, the output could be between 0 and 500 (maximum yield 0.5, the first 1000 bits are discarded). The simulations used n=40000 samples (1000 bits) each. The bias was set to a duty cycle D=1 / 2, as the von Neumann debiasa is expected to handle the basic bias completely. The frequency F was random modulo the sampling frequency between 0 and the "Nyquist boundary" 1 / 2.

[0056] As shown in Figure 10a, the von Neumann-de Biasa yield is averaged at Y=0.25 regardless of jitter. As σ increases, the von Neumann-de Biasa yield is maintained at a mean of 0.25, the variance near the mean decreases, and as a result, the yield remains in the range of approximately 0.2 to 0.3 until σ approaches 0.4. In contrast, the Bram B tuner also yields Y=0.25 when σ is sufficiently large (and delivers low variance at yields <0.1, and a roughly linear jitter response when σ < 0.20 (approximating Y=0.06 + 0.9 × σ)). This is a desirable response characteristic because jitter entropy accumulates as the variance of each output byte decreases. From a practical point of view, this shows that the Bram B tuner is adaptive, producing fewer entropy bits when the σ (and therefore the level of entropy) of the input bitstream is low, and producing more bits as the σ (and therefore the level of entropy) increases. When the sigma (and the level of entropy) of the input bitstream is sufficiently high, the Bram B tuner approaches a yield of 0.25, which is the same average level as the von Neumann-DeBiasa.

[0057] The adaptive nature of the Bram B tuner means not only that it operates with various types of noise sources, but also that the minimum level of entropy in the output bits is maintained even when environmental parameters, particularly temperature, change. This is crucial for devices and systems that can be installed in all kinds of locations and extreme environments, unlike computer servers and other computer systems that typically reside in temperature-controlled environments. For this purpose, the capability was tested by varying the operating temperature down to -50°C by freezing the circuit using a freezing spray, and the adaptive nature of the Bram B tuner was consistent with the modeling.

[0058] When considering the practical design of a Bram B tuner, it should be noted that the bit pattern state i of the Bram B tuner can perform decorrelation by "separating" local entropy "features" such as leading and falling edges. However, the scope of such decorrelation is related to k input bits rather than output bits, which is recognized as a problem of low-entropy or variable-entropy noise sources. As mentioned above, increasing the number of states k may slightly improve the situation, but this leads to a decrease in return and comes at the cost of an exponentially increasing circuit footprint. Therefore, the examples herein apply two-stage tuners, each with a moderate number of states (and relatively low real estate overhead), rather than a single tuner with a much larger number of states. In one example, both stages of the tuner are Bram B tuners. In this way, the adaptive noise conditions of the two stages of variable yield are combined to mitigate more macroscopic features. Conveniently, both stages of the Bram B tuner employ k=3 (8 states). Having two 8-state stages not only results in a smaller implementation size but also potentially offers superior adaptive capabilities compared to a single tuner limited to a 6-bit window. In other words, because both Bram B tuners are adaptively dynamic, the overall "memory" reaches far beyond the 6-bit distance, and the capabilities of the 2x8-state Bram B tuner should result in better decorrelation and yield than a single 64-state Bram B tuner. Thus, the configurations in Figures 8 and 11 result in an improved entropy source not proposed by standard implementations of Bram's "Algorithm B." For example, the entropy source can be efficiently implemented in hardware, and an interface for a RISC-V entropy source can be provided, for example, in RISC-V derivatives and low-cost chips. The entropy source could then provide a secure source of random bits for advanced and efficient cryptographic applications, such as post-quantum cryptography for smart cards and other smart devices.

[0059] This is useful for strongly biased or serially tuned inputs. For example, the yield in the first "feature detection" stage could be as low as 0.1, and the output from the second stage would recognize 3 bits, since it is a function of 3 / 0.1 = 30 raw noise bits instead of 6.

[0060] Therefore, the specific example described herein results in a two-stage noise tuner that violates conventional design principles. For example, it is usually desirable to avoid pseudorandomness in the entropy path before either encryption tuner. However, in this example, a stateful tuner is used. However, this stateful tuner is applied to make the output bits more independent. For example, different input bits result in branches to von Neumann cells with different delays, and the input bits to the von Neumann cell set the state change of the cell. This results in a cascade of branch states based on the input bits, but the carry-on effect is limited by the "erase on read" property implemented by the von Neumann cell (for example, when a bit is read from the state, state bit S i (It is set to λ and no longer contains any information about its output bits.)

[0061] An example of a practical entropy source 900 is shown in Figure 11. The structure of the entropy source 900 broadly follows the hardware portion 110 of the architecture in Figure 1. Specifically, the entropy source 900 comprises a noise source 905, a noise tuner 910, and a buffer 915 that can be polled by a software driver (not shown). The noise tuner 910 is further characterized by having two stages 913, 914 of noise tuning, including a first Bram B tuner in series with a second Bram B tuner, where outputs Q, E from the first stage enter the second stage as inputs D, W. The noise tuner has an input 911 for receiving bits from the noise source 905 and an output 912 for distributing the bits to the buffer 915. By example, each Bram B tuner of the noise tuner 910 is an 8-state Bram B tuner. Both Bram B tuners are arranged, for example, according to Figure 8. For example, each noise adjustment stage (i.e., implemented as a Bram B tuner) may comprise a k-bit shift register configuration 808 for storing a previous set of input bit values ​​and a set of von Neumann cells 818 for performing von Neumann bias rejection, each von Neumann cell having a state S and a selector 810 that receives an input bit value and selects one of the set of von Neumann cells 818 to conditionally generate an output bit value based on the bit value of the shift register configuration, the selected von Neumann cell state being updated after selection. The noise source 905 outputs a sequence of first bits 911 in the form of "raw" noise bits, and the noise tuner 910 receives the sequence of first bits 911 from the noise source 905 and outputs a sequence of second decorrelated bits 912. The noise tuner 910 comprises a plurality of noise adjustment stages 913, 914 coupled in series in a communicative manner. Buffer 915 receives and stores a second sequence of decorrelation bits from the noise tuner 910. Buffer 915 is configured to be polled to distribute a large number of bits as an output random bit sequence to a software driver, for example, to poll an entropy source and retrieve bits from the buffer when it is full.

[0062] As shown in Figure 11, in this example, both the output of the noise source 905 and the noise tuner 911 optionally have online tests 920, 930 that can generate alarms. In this example, the non-operating state (OPST) 940, which can be polled or read by external software such as a software driver, is determined by such alarms and / or the state of buffer 915, and the entropy bit becomes available by the Poll_Entropy instruction when buffer 915 is full and no alarms have been generated. OPST 940 may include bits accessible by a state register. For example, the OPST940 indicators are ES16 (state: 01 - no alarm, buffer full, entropy bits available), WAIT (state: 10 - buffer not yet full), BIST (state: 00 - built-in self-test, occurs after operational reset RST or after a recoverable fault is detected), and DEAD (state: 11 - fatal / unrecoverable - entropy source is operating below the expected threshold or not operating). Online testing and / or access to raw noise may allow for continuous testing and evaluation, which may be used to identify security risks or attacks and verify secure functionality. In certain implementations, the processor's global reset (RST) line may have two purposes: zeroing and initiating a built-in self-test (BIST).

[0063] The noise tuner in Figure 11 also optionally has a GetNoise interface that can be used (e.g., via the software driver 122) to read raw samples from the noise source 905 before noise tuning. In this way, the capabilities of the noise source 905 and the quality of the generated bits can be evaluated outside the entropy source using known techniques.

[0064] According to the examples provided herein, two false positive rates are applied to online tests. The first rate is α = 2 -64 This indicates a critical noise source failure, and the second rate β=2-20 This indicates a failure in a recoverable entropy source. The rate can be expressed "per tested bit". The boundary is configurable and can be set according to the use case.

[0065] For this purpose, the fatal failure rate α is expressed in relation to the noise source bits. This is chosen so that even if the continuously operating noise source is relatively fast, it does not significantly affect the overall system failure rate. The false positive rate reaches 50% in each test after approximately 400 / GHz, depending on the relevant sampling frequency.

[0066] Assuming that the software driver 122 has a cryptographic tuner 126 that processes 16 × 16 = 256-bit ES16 blocks, the secondary alarm rate β is interpreted in relation to the output bits of the noise tuner. Therefore, in the four tests, 1 - (1 - β) 4·256 It was found to be approximately 0.001, meaning that about 1 in 1000 entropy source blocks generates a recoverable alarm. This is chosen to be high enough so that the proportion of non-fatal alarms can be monitored. Yield of the 1 / 16 noise modifier (β) 3 Assuming / 16 = α, we can see that the fatal boundary is satisfied after three consecutive failures.

[0067] Online testing 920 of the noise source 905 includes a randomized controlled test (RCT) 922 and an adaptive proportional test (APT) 924. Both tests aim to have a threshold entropy level below which an alarm is generated, preventing entropy bits from being output from the entropy source 900. In this example, the entropy level (minimum entropy) is set to H=0.5, which corresponds to p=2 -0.5 This corresponds to the maximum probability of 0.7071. Of course, the noise source (a ring oscillator in this example) is better designed than this, so if any worse bias occurs, it may indicate degradation or failure in the respective circuit.

[0068] In this example, RCT922 counts repeated identical samples (runs of 1 or 0). A fatal cutoff threshold is set, and if it falls below this threshold, an alarm is generated, preventing the output of entropy bits from the entropy source 900. In this example, the fatal cutoff is calculated as follows:

number

[0069] An alarm will be generated for any run of repeating samples exceeding 129 bits. Other thresholds can be used depending on the use case.

[0070] In this example, APT924 is a simple bias test as follows: Let B0 and B1 be the number of 0s or 1s in a 1024-bit window W. {B0,B1}≧C apt The cutoff value C apt In that case, a fatal alarm will be triggered.

number

[0071] Minimum entropy H = 0.5, C apt The threshold is 841, and values ​​exceeding this threshold trigger a fatal alarm that prevents the output of entropy bits from the entropy source 900. Other thresholds can be used depending on the use case.

[0072] Regarding the capabilities of the noise tuner 910, for example, if the pseudo-random behavior of the noise source causes significant overall entropy loss (e.g., due to external interference or complex phase locking), bias or short repeating patterns may be expected. These can be tested using autocorrelation tests. For example, this can be done by XORing the output bit sequence with its own delayed (or shifted) version. If the original sequence is sufficiently random, the result of the XOR should also be random, but sequence correlation will cause bias. In this example, four noise tuner output tests measure the bias (without XOR) and the bias with XOR on position-delayed sequences of 1, 2, and 3 bits. These tests can be performed assuming H > 0.5.

[0073] BIST can be initiated when a non-fatal alarm is generated by a shutdown or by a noise regulator test. For example, the following BIST test can be used: - Warm-up: The first 100,000 cycles from the noise source are discarded before the noise source tests (APT and RCP) become active. The state is BIST. If the noise source tests the alarm at any time other than warm-up, the state becomes DEAD. - Output Test: The first 1,024 bits from the noise regulator are not output but are used as a self-test in BIST mode. This stage has four full 256-bit blocks and counts NCT alarms. Alarm 0 means BIST was successful, alarm 1 or 2 restarts BIST from the beginning (but does not clear the timeout), while alarm 3 or 4 causes a fatal DEAD state. - Timeout: If the BIST test does not complete within 106 cycles (due to insufficient output), it will result in a fatal error, DEAD state.

[0074] The aforementioned tests and associated parameters can be adjusted to work well with a specific ring oscillator or operating frequency. For example, the BIST state persists until it is polled at least once by the software driver 120, so that the driver can register even non-fatal errors.

[0075] The following table shows the results of tests performed using a variety of 256-megabit noise corpora (Samples A to D) with a two-stage noise tuner of the type shown in Figure 11 (each stage being an 8-state Bram B tuner). [Table 1]

[0076] The evaluation of entropy and yield is performed without assuming that the data are IID (independent and identically distributed), using input 911, H0Y1, between the two BlumB tuners, H1Y2, and outputs 912, H2Y2 from the noise tuner 910. Furthermore, H min This is shown. This is the final minimum entropy of the arrangement when the output is considered to produce IID bits (based on bias only). As seen in sample A, H2 is not always higher than H1, which means there is some variation in ability depending on the input sample due to the “randomness” nature. However, in general, the first-stage Bram B tuner has been shown to greatly increase entropy and yield, while the second-stage Bram B tuner is H min It has been shown that the gains of entropy and yield increase toward [a certain point].

[0077] As shown, the total yield is Y1Y2 < 1 / 16. Therefore, the tuner may appear to have a nominal output speed of over 1 Mbps for a noise source sampling the ring oscillator against a 25 MHz reference clock. This is fast enough for most applications requiring a random bitstream from a practical standpoint.

[0078] The specific examples described herein may result in output random bit sequences that are close to independent and identically distributed (IID) and / or contain at least 0.997 bits of Shannon entropy per output bit. This differs from comparative raw noise sources that are not typically IID and / or do not meet the aforementioned entropy criteria. In these examples, we present "arithmetic" rather than encryption post-processing in the form of noise tuners built into the entropy source. These are well-suited for post-quantum computing and encryption because they are far more resource-efficient and may not involve computationally difficult assumptions (for example, making them inherently "quantum-secure").

[0079] It should be noted that many "randomness tests" used in comparative random number generators may be suitable for evaluating the randomness of Monte Carlo simulations, but may not be suitable for security and cryptographic applications. For example, cryptographic analysis using linear algebra has shown that the "random" bit sequences generated by linear feedback shift registers used in certain random number generators can pose security risks. In these comparative examples, the internal state of the linear feedback shift register can be derived from a relatively small amount of output, and future and past outputs can be reproduced with little effort. If the output of the "random" generator is used for an encryption keyring, this can have catastrophic consequences. In contrast, this example yields a random bit sequence suitable for cryptographic applications without the risk of discovering past or future outputs.

[0080] Figure 12 shows a flowchart illustrating the operation of an entropy source using an example.

[0081] In the first step 1000, a noise sample is generated by the noise source 905. Next, at 1010, the first Bram B tuner stage 913 of the noise tuner 910 tunes the noise sample, and then at 1020, the tuned noise sample is further tuned by the second Bram B tuner stage 914 of the noise tuner 910. The tuned noise sample is then stored in the buffer 915, from which the software driver 122 can poll and receive the tuned noise sample.

[0082] The above explanation has been presented to illustrate the principles described, providing examples. This explanation is not intended to be exhaustive, nor is it intended to limit these principles to any specific form disclosed. Many variations and modifications are possible in light of the above teachings. For example, different noise sources may be used to deliver random bits to the noise tuner. Such noise sources may constitute the circuit "on-chip" or be derived from an external device or system. The shape of the noise tuner may also vary. For example, any number of Bram B tuners can be used. There may be just one Bram B tuner, there may be two (as illustrated), or there may be more than two, such as three, four, five, or more Bram B tuners. For each Bram B tuner, the number of states can be any number 2. kThe number of states may differ from 8. Alternatively, one Bram B tuner may have 8 states, while another may have a different number of states. The number of states in a Bram B tuner determines the logic configuration, for example, in terms of the number of stages in a shift register or the associated logic for selecting an output (e.g., a von Neumann debiaser). In another example, a noise tuner may comprise at least one Bram B tuner and one or more other stages that perform debiasing and / or decorrelation in other ways. Various other tests or alarms, with associated parameters and / or thresholds, can be applied to various configurations of the entropy source. According to the examples herein, noise tuners, and more generally actual entropy sources, can be implemented without limitation in hardware such as fixed wiring or configurable circuits, firmware, software, or any suitable combination thereof, as determined by the use case. The entropy sources according to the examples herein may be integrated with a central processing unit, or they may operate and be implemented independently, for example, as a coprocessor or other separate processing unit of the entire computer / processing architecture. In other examples, the entropy source can be integrated into a standalone processing environment, such as an embedded processor that can be deployed in a connected IoT device or apparatus. In this example, the entropy source is adapted to be deployed in a lightweight microcontroller, a reduced instruction set architecture such as RISK-V, and / or a processor adapted to post-quantum cryptography.

[0083] It should be understood that any feature described in relation to any one example can be used alone or in combination with other features described, and can also be used in combination with any feature of any other example, or any combination of any other examples.

[0084] Specific examples not claimed are presented hereby as a series of clauses.

[0085] In some cases, a processing module or noise modifier is provided to reduce the bias and / or increase the entropy of the output bit sequence compared to the input bit sequence. The processing module is configured to output the output bit sequence at an output bit rate that varies according to the entropy of the input bit sequence, so that an increase in the entropy of the input bit sequence is associated with an increase in the output bit rate, and a decrease in the entropy of the input bit sequence is associated with a decrease in the output bit rate.

[0086] The processing module may have an input for receiving input bits from a source and an output for generating output bits used for random number generation. The processing module may have a state in which each state has two entry transitions from one or more previous states and two exit transitions to one or more subsequent states. k A Markov chain of states (for example, when k=3) can be implemented. The processing module may have processing blocks configured to output bits according to Bram's algorithm B, and the processing blocks implement a Markov chain. The processing module may have at least two first Markov chains in series with the first Markov chain. k The Markov chain of the state and the second 2 J A Markov chain of the state can be implemented, where both k and J may be equal to 3. The processing block may be configured to output bits according to at least two consecutive steps of Bram's algorithm B, each step implementing an instance of the Markov chain.

[0087] In certain cases, input, selector, and 2 L A logic device is provided having L output logic cells, and a selector is arranged to select an output logic cell based on a sequence of L input bits from an input bit sequence received at the input, and the selected output logic cell is configured to generate output bits according to the logic of an output logic cell that operates on the input bit values. The logic device may include a von Neumann cell, as described in the example above.

[0088] The logic device may include a shift register that receives an input bit sequence, and the L stage of the shift register addresses a selector, 2 L The selector is configured to select one of several output logic cells (e.g., L=3). Each output logic cell may be configured to perform a debiasing logic operation, which may include a delayed von Neumann debiasing logic operation. The logic device may be configured to output bits according to Bram's algorithm B and / or to implement a Markov chain. The selector may be configured to select an output logic cell based on an input bit sequence, thereby realizing a Markov chain.

[0089] In some cases, the processing module described above may also include at least one logic device as described above. In other cases, two or more logic devices may be arranged in series, with output bits from the first logic device being supplied as input bits to the second logic device.

[0090] In some cases, the entropy source used for random number generation may include a noise source and a noise modifier in the form of the processing module described above. The hardware circuit used for random number generation can constitute this entropy source. The noise source may include a ring oscillator, which may include multiple inverters connected in a free-running loop, for example, three inverters. Preferably, the number of inverters is odd. The hardware circuit may include a buffer for holding some bits in the output random bit sequence. The buffer may be configured to be polled and deliver some bits of the held random bit sequence.

[0091] In some cases, an adaptive rate entropy source is provided to reduce the bias and / or increase the entropy of the output bit sequence compared to the input bit sequence, and the adaptive rate entropy source is configured to output the output bit sequence at an output bit rate that adapts according to the entropy of the input bit sequence, so that an increase in the entropy of the input bit sequence is associated with an increase in the output bit rate, and a decrease in the entropy of the input bit sequence is associated with a decrease in the output bit rate.

[0092] In some cases, a processing module is provided configured to reduce the bias and / or increase the entropy of an output bit sequence compared to an input bit sequence, the processing module further configured to output the output bit sequence at an output bit rate that varies depending on the entropy of the input bit sequence, where an increase in the entropy of the input bit sequence is associated with an increase in the output bit rate, and a decrease in the entropy of the input bit sequence is associated with a decrease in the output bit rate, thereby reducing the bias and / or increasing the entropy of the output bit sequence compared to the input bit sequence, the output bit rate being reduced by discarding input bits that would otherwise lead to an increase in bias and / or a decrease in entropy.

[0093] In some cases, a noise tuner is provided, comprising an input for receiving an input bitstream having a first entropy and an output for delivering an output bitstream having a second entropy increased compared to the first entropy. The noise tuner operates in each clock cycle of the system clock, loading the next input bit of the input bitstream into the shift register configuration, and two shift register configurations, each clocked into its respective destination logic cell, which either output an output bit or not, and which are arranged to perform a debiasing operation based on the next and previous input bits of the input bitstream, according to the result of a debiasing operation performed by each destination logic cell. k The system may include a destination logic cell and a selector that operates to select a destination logic cell based on an address determined by the k preceding input bits of the input bitstream loaded into the shift register array, wherein each subsequent input bit introduced into the shift register is also clocked in to the selected logic cell, and the respective debiasing operation is performed, and the sequence of addresses determined by the selector is a predetermined 2 k The sequence of destination logic cells is selected in the order corresponding to the transitions in the Markov chain of states. The noise tuner can contain two processing blocks, as described above, the second of which has the same form as the first processing block and operates in series. [Explanation of symbols]

[0094] 100 Architectures 110 Entropy Source 112 Hardware Entropy Source 114 Noise Adjuster 116 buffers 118 Hardware Interfaces 120 Software 122 Software Drivers 124 Polling Interface 126 Regulator 160 Software Applications 200 Noise Sources 205a, 205b, 205c NOT gate 220 Second input to NAND gate 225 loops 230 Feedback Line 235 D-type latch 240 Latch Output 300 Markov chains 400 2-state Markov chain 500 4-state Markov chain 700 Markov chains 800 Bram B Adjuster 801 Selector 802 Input D 804 Clock signal CLK 806 Enable Input W 808 Shift Register Configuration 810 Selector 812 Reset input RST 814 Output Q 816 Enable Output E 818 von Neumannsell 900 Entropy Source 905 Noise source 910 Noise Adjuster 911 Sequence of the first bit 912 Sequence of the second decorrelation bit 913, 914 Two stages of noise reduction 915 buffer 920, 930 Online Test 922 Repeated Tests (RCTs) 924 Adaptive Proportional Test (APT) 940 OPST

Claims

1. An entropy source (900) for use in random number generation, A noise source (905) that outputs a sequence of the first bit (911), A noise adjuster (910) receives a sequence of first bits (911) from the noise source (905) and outputs a sequence of second decorrelation bits (912), It comprises multiple noise adjustment stages (913, 914) that are connected in series in a communicative manner, Each noise adjustment stage (913, 914) is: A k-bit shift register configuration (808) that stores the previous set of input bit values. A set of von Neumann cells (818) that perform von Neumann bias removal, wherein each von Neumann cell has a state, and The noise tuner (910) comprises a selector (810) which receives an input bit value and selects one of the sets of phon neumann cells (818) to conditionally generate an output bit value based on the previous set of input bit values ​​in the k-bit shift register configuration, wherein the state of the selected phon neumann cell is updated after the selection. An entropy source (900) comprising a buffer (915) for receiving and storing the second decorrelation bit sequence from the noise adjuster (910), the buffer (915) being configured to be polled in order to distribute the bits of the second decorrelation bit sequence as an output random bit sequence.

2. The noise source (905) includes a ring oscillator (905), as described in claim 1, for the entropy source (900).

3. The entropy source (900) according to claim 2, wherein the ring oscillator (905) includes a plurality of inverters (205) commutatably coupled in a free-running loop, the plurality of inverters including an odd number.

4. The entropy source (900) according to claim 3, further comprising a latch (235) for outputting bits sampled from the free-running loop based on a system clock signal.

5. An entropy source (900) according to any one of claims 1 to 4, comprising a raw noise interface that yields the first bit sequence (911).

6. The entropy source (900) according to any one of claims 1 to 5, wherein each noise adjustment stage (913, 914) is provided with an enable input (806), and when the enable input (806) is active, a sequence of input bits is supplied to the k-bit shift register configuration and the selector.

7. The entropy source (900) according to claim 6, wherein the enable input (806) of the first noise adjustment stage (913) in the plurality of noise adjustment stages (913, 914) is output by the first noise adjustment stage (913) and passed as the enable input (806) to the second noise adjustment stage (914) in the plurality of noise adjustment stages (913, 914).

8. The entropy source (900) according to claim 7, wherein each of the plurality of noise adjustment stages (913, 914) is provided with a clock input, and each of the plurality of noise adjustment stages (913, 914) is activated when the clock input and the enable input are active.

9. The entropy source (900) according to any one of claims 1 to 8, wherein each von Neumann (818) cell has five possible states and, when selected, is configured to transition between states based on an input bit value and the current state of the von Neumann cell.

10. When each of the aforementioned von Neumann cells (818) is selected, In state λ, the state is set to the input bit value, In state 0, if the input bit value is 1, the state is set to the "H" state representing the first value; otherwise, the state is set to state λ. In state 1, if the input bit value is 0, the state is set to the "T" state representing the second value; otherwise, the state is set to state λ. In the aforementioned "H" state, the output is set to 0, and the state is set to the input bit value. In the "T" state, the output is set to 1, and the state is set to the input bit value. The entropy source (900) according to claim 9, further configured as follows.

11. An entropy source (900) according to any one of claims 1 to 10, wherein k is equal to 3.

12. The entropy source (900) according to any one of claims 1 to 11, wherein the entropy source (900) comprises a hardware circuit that is polled by a software driver.

13. The entropy source (900) according to claim 12, wherein the software driver includes an encryption tuner (126) that applies cryptographic operations to the output random bit sequence supplied by the entropy source (900) before supplying data derived from the encryption tuner (126) to a software application (160).

14. An entropy source (900) according to any one of claims 1 to 13, comprising a register (940) indicating the operating state of the entropy source (900).

15. The aforementioned operating state is as follows: A first state indicating that the buffer (915) can supply the output random bit sequence, A second state indicating that the buffer (915) is not yet full, A third state indicating the test state, and The entropy source (900) according to claim 14, which represents at least one of the fourth states indicating a failure.

16. An entropy source (900) according to claim 14 or claim 15, comprising one or more online tests (920, 930).

17. The one or more online tests (920, 930) The repetition count test (922) counts the number of repetition bits output by the noise source (905) and outputs an alarm in response to the number exceeding a defined threshold, The entropy source (900) according to claim 16, comprising one or more adaptive proportional tests (924) that compare a number of 0 bits and 1 bits within a predetermined window of the bit value output by the noise source (905).

18. Entropy source (900) according to any one of claims 1 to 17, wherein the first bit sequence has entropy and bias, the output random bit sequence has entropy and bias, the entropy source (900) is configured to reduce the bias and / or increase the entropy of the output random bit sequence compared to the first bit sequence, the entropy source (900) is configured to output the output random bit sequence at an output bit rate that varies according to the entropy of the first bit sequence, the increase in the entropy of the first bit sequence is associated with an increase in the output bit rate, and the decrease in the entropy of the first bit sequence is associated with a decrease in the output bit rate, thereby reducing the bias and / or increasing the entropy of the output random bit sequence compared to the first bit sequence, the output bit rate is reduced by discarding input bits which lead to an increase in bias and / or a decrease in entropy.

19. The k-bit shift register configuration operates in each clock cycle of the system clock, loading the next input bit of the first bit sequence into the k-bit shift register configuration. The aforementioned set of von Neuman cells consists of 2k destination logic cells, and each destination logic cell is: A bias removal operation is performed based on the next and previous input bits of the sequence of first bits that are clocked into the destination logic cell. The destination logic cell is configured to output an output bit or not output an output bit, according to the result of the bias removal operation performed by the destination logic cell. The selector operates to select a destination logic cell based on an address determined by the sequence of input bits k preceding the first sequence of bits loaded into the k-bit shift register configuration, thereby each subsequent input bit introduced into the k-bit shift register configuration is also clocked into the selected destination logic cell, and the respective debiasing operations are performed. The sequence of addresses determined by the selector is one of two predetermined sequences. ｋ An entropy source (900) according to any one of claims 1 to 18, which selects each sequence of destination logic cells in an order corresponding to the transitions of a Markov chain of states.

20. A non-temporary computer-readable storage medium comprising computer program code configured to implement the entropy source (900) described in any one of claims 1 to 19 when executed by a processor.

Images