JP7698288B2 - Random Number Generator - Google Patents

Description

The present invention relates to a random number generator.

As the IoT (Internet of Things) advances, the demand for security for things is growing. To meet this demand, methods that use random numbers for passwords and encryption keys, for example, have been put to practical use. However, with so-called pseudo-random numbers that generate random numbers based on an algorithm, the random numbers can be easily reproduced if the seed is leaked. Even if the seed is not leaked, there is a risk that the random numbers can be reproduced using recent advances in AI technology and quantum computers.

For this reason, random number generators have been proposed that use dynamic randomness based on physical phenomena such as thermal noise. Random numbers that use such physical phenomena are unpredictable and highly random, and are called true random numbers in contrast to the pseudorandom numbers mentioned above.

Known random number generators that generate true random numbers include those that use the frequency fluctuation of a ring oscillator (see, for example, JP 2010-117846 A) and those that use the metastable state of a latch circuit (see, for example, WO 2011/117929 A).

JP 2010-117846 A International Publication No. 2011/117929

Conventional random number generators using ring oscillators can generate relatively stable, high-quality random numbers, i.e., random numbers that generate 0s and 1s with roughly equal probability, but the circuit scale is large and the power consumption required to generate a 1-bit random number tends to be high. In addition, when subjected to a so-called noise injection attack in which a disturbance wave with a frequency close to the oscillation frequency of the ring oscillator is superimposed, the oscillation frequency is locked to that frequency, making the generator vulnerable to a decrease in randomness.

Conventional random number generators that use latch circuits have a small basic circuit scale and consume little power, but due to the nature of the circuit's variability characteristics, the probability of either 0 or 1 occurring tends to be high, resulting in biased random numbers. This bias can be eliminated by using corrections such as feedback control or by preparing multiple latch circuits and taking their exclusive OR, but this offsets the inherent advantage of using latch circuits, which is low power consumption.

The present invention was made based on the above circumstances, and aims to provide a random number generator that can generate high-quality random numbers with low power consumption and has high resistance to noise injection attacks.

A random number generator according to one aspect of the present invention includes a feedback inverter unit that is a source of randomness, and a digital conversion circuit that generates random numbers based on the randomness generated by the feedback inverter unit, the feedback inverter unit having an inverter circuit having one input and one output, the potential of the output being an inverted amplification of the potential of the input, and a feedback circuit having one or more resistive feedback paths that feed the output of the inverter circuit back to the input, and the conductance of at least one of the resistive feedback paths is smaller than the mutual conductance of the inverter circuit in an equilibrium state in which the potentials of the input and output of the inverter circuit are statically equal.

The random number generator can generate, for example, oscillation or damped oscillation using the thermal noise voltage superimposed on the feedback inverter as a seed by making the conductance of the resistive feedback path of the feedback inverter section, which acts as an amplifier, smaller than the mutual conductance of the inverter circuit, thereby obtaining a noise voltage with a large amplitude. This noise voltage generates relatively random and unbiased states in which the input is larger and smaller than the output, centered on an equilibrium state in which the potentials of the input and output of the inverter circuit of the feedback inverter section are statically equal, and thus serves as a source of good quality randomness. In addition, in the random number generator, the digital conversion circuit generates random numbers based on this noise voltage with a large amplitude, so that good quality random numbers can be generated with a small circuit scale, i.e., low power consumption. Furthermore, in the random number generator, a noise voltage with a large amplitude can be obtained with a relatively small number of cycles, so that it is less likely to be locked even when subjected to a noise injection attack, and has high resistance to noise injection attacks.

The feedback circuit may have a plurality of resistive feedback paths with different conductances, and a control unit that selects one resistive feedback path from the plurality of resistive feedback paths. By providing the feedback circuit with a plurality of resistive feedback paths with different conductances in this way and using the plurality of resistive feedback paths, it is possible to reduce autocorrelation when continuously obtaining random numbers. It is also possible to increase resistance to noise injection attacks.

It is preferable that one of the resistive feedback paths has a plurality of resistive elements, and at least one of the resistive elements is used in common with a resistive element of another of the resistive feedback paths. By providing a resistive element that is used in common with a plurality of resistive feedback paths in this way, it is possible to reduce the area of the feedback circuit, and power consumption can be further reduced.

The resistive feedback path of 1 has a plurality of resistive elements connected in series, and the conductance of two or more of the plurality of resistive elements is preferably smaller than the mutual conductance of the inverter circuit. When resistive elements connected in series are used in this way, the phase change of the oscillation wave increases due to the effect of parasitic capacitance elements between the series connections, making it easier to generate oscillations using the thermal noise voltage as a seed. Since the seeds are random, an oscillation wave with randomly varying phases can be generated each time oscillation occurs. In addition, since the circuit area of the resistive elements can be kept relatively small and the amplitude of the oscillation wave is large, the scale of the digital conversion circuit can be reduced, further reducing power consumption.

When the digital conversion circuit includes a pair of the feedback inverter units, the pair of feedback inverter units being a first feedback inverter unit and a second feedback inverter unit, the digital conversion circuit may have a first selection circuit that selects whether or not a connection is made between the inverter circuit output and the input of the first feedback inverter unit and the second feedback inverter unit via a feedback circuit, and a second selection circuit that selects whether or not a connection is made between the output of the inverter circuit of the first feedback inverter unit and the input of the inverter circuit of the second feedback inverter unit, and between the output of the inverter circuit of the second feedback inverter unit and the input of the inverter circuit of the first feedback inverter unit. By configuring the random number generator as described above, it is possible to prevent bias in the random numbers generated due to variations in the characteristics of the elements that make up the digital conversion circuit.

The inverter circuit includes a MOS transistor, the resistive element of the resistive feedback path is composed of a MOS transistor, and the composite value of the gate width ratio to gate length of the MOS transistors constituting the resistor of at least one of the resistive feedback paths is smaller than the composite value of the MOS transistors included in the inverter circuit. In this way, by using MOS transistors for the inverter circuit and the resistive element of the resistive feedback path and by making the composite value of the gate width ratio to gate length have the above-mentioned relationship, it is possible to easily implement the random numbers in an integrated circuit while maintaining the quality of the generated random numbers. Furthermore, since the above-mentioned relationship is maintained even in a circuit that is proportionally scaled down in response to the miniaturization of transistor manufacturing technology, it is possible to easily benefit from miniaturization in manufacturing costs, power consumption, and speed with a relatively simple design.

Here, "an inverter circuit whose output potential is the inverse amplification of the input potential" refers to an inverter circuit in which the differential coefficient of the output potential change with respect to the input potential change is 0 or less, and the differential coefficient at the input potential where the input and output potentials are statically equal is less than -1, i.e., the absolute value of the differential coefficient is greater than 1 and has an amplifying effect.

In this specification, the "one resistive feedback path" of a feedback circuit refers to the entire circuit network composed of circuit elements that are arranged between the output and input of an inverter circuit when forming a feedback circuit that feeds back the output of an inverter circuit to the input, and through which a feedback current flows from the output to the input, and does not require that all of the resistive circuit elements that make up the path are connected in series. Therefore, when a resistive feedback path is composed of multiple circuit elements, the "conductance of a resistive feedback path" refers to the composite conductance of the entire circuit network connected between the output and input of an inverter circuit. Furthermore, even if some or all of the constituent circuit elements are common, if the circuit network configurations are different, they will be classified as different resistive feedback paths.

"Composite value of gate width ratio to gate length of MOS transistor" refers to a single composite value obtained by calculating the ratio (W/L) of gate width W to gate length L of each MOS transistor for all MOS transistors constituting the target inverter circuit or one resistive feedback path, and repeating the process for all MOS transistors in the target circuit (or circuit network) by taking the sum of the above W/L (if the target MOS transistors are composite, the composite ratio; the same applies below) as the composite ratio for the MOS transistor parts connected in parallel, and the reciprocal of the sum of the reciprocals of the above W/L as the composite ratio for the MOS transistor parts connected in series.

The random number generator of the present invention can generate high-quality random numbers with low power consumption and is highly resistant to noise injection attacks.

FIG. 1 is a schematic circuit diagram showing a random number generator according to an embodiment of the present invention. FIG. 2 is a schematic equivalent circuit diagram for explaining the operation of the feedback inverter unit of FIG. FIG. 3 is a schematic graph showing an output waveform when the output of the inverter circuit of the feedback inverter unit of FIG. 2 is monotonically attenuated. FIG. 4 is a schematic graph showing an output waveform when the output of the inverter circuit of the feedback inverter unit of FIG. 2 undergoes damped oscillation. FIG. 5 is a graph showing the results of a noise simulation of the output of the inverter circuit under monotonic decay conditions and damped oscillation conditions. FIG. 6 is a timing chart showing inputs to external input terminals F and SE of the random number generator of FIG. FIG. 7 is a schematic circuit diagram showing a random number generator according to an embodiment different from that shown in FIG. FIG. 8 is a schematic graph showing an output waveform when the output of the inverter circuit of the feedback inverter unit in FIG. 7 oscillates. FIG. 9 is a schematic circuit diagram showing a random number generator according to an embodiment different from that shown in FIG. 1 and FIG.

[First embodiment]
Hereinafter, a random number generator according to a first embodiment of the present invention will be described with reference to the drawings as appropriate.

The random number generator 1 shown in FIG. 1 includes a feedback inverter unit 10 that is a source of randomness, and a digital conversion circuit 20 that generates random numbers based on the randomness generated by the feedback inverter unit 10.

<Feedback inverter section>
The feedback inverter section 10 includes an inverter circuit 10a and a feedback circuit 10b.

(Inverter circuit)
The inverter circuit 10a has one input Vin and one output Vout, and is configured so that the potential of the output Vout is the inverted and amplified potential of the input Vin (hereinafter, the input Vin and the output Vout may be simply referred to as "Vin" and "Vout", respectively).

The inverter circuit 10a includes a MOS transistor. That is, the inverter circuit 10a includes a PMOS MOS transistor _PINV and an NMOS MOS transistor _NINV (hereinafter, for example, the MOS transistor _PINV is also simply referred to as " _PINV ". The same applies to other MOS transistors. P indicates PMOS and N indicates NMOS). Specifically, as shown in FIG. 1, _PINV and _NINV are connected to each other with their drains as a connection point, the source of _PINV is connected to a power supply VDD (hereinafter, also simply referred to as "VDD"), and the source of _NINV is grounded. In addition, Vin is connected to the gates _{of PINV} and _NINV , and Vout is connected to the drains (the above connection points) of PINV and _NINV .

(Feedback circuit)
The feedback circuit 10b feeds back the output Vout of the inverter circuit 10a to the input Vin, and has two resistive feedback paths 11 with different conductances (a high resistance feedback path 11a and a low resistance feedback path 11b), and a control unit 12 that selects one of the two resistive feedback paths 11. The resistive elements of the resistive feedback path 11 are composed of MOS transistors.

As shown in FIG. 1, the high resistance feedback path 11a is composed of a transmission gate TG1 (hereinafter simply referred to as "TG1"; the same applies to other elements) which is a resistive element and is fixed in the ON state. Specifically, TG1 is composed of a PMOS transistor P _TG1 and an NMOS transistor N _TG1 , and their sources and drains are connected to each other. TG1 is disposed between Vin and Vout of the inverter circuit 10a (the source is connected to Vin and the drain is connected to Vout), the gate of P _TG1 is grounded, and the gate of N _TG1 is connected to VDD. In other words, both P _TG1 and N _TG1 are fixed in the ON state.

On the other hand, the low resistance feedback path 11b is composed of the above-mentioned TG1 and a transmission gate TG2. That is, the low resistance feedback path 11b has two resistive elements (TG1 and TG2), and one of the above-mentioned multiple resistive elements, TG1, is used in common with the resistive element (TG1) of the high resistance feedback path 11a, which is the other resistive feedback path 11. By providing a resistive element that is used in common by multiple resistive feedback paths 11 in this way, it is possible to reduce the area of the feedback circuit 10b, and further reduce power consumption.

TG2 is disposed between Vin and Vout of the inverter circuit 10a, the gate of _PTG1 is connected to an external input terminal F of the control unit 12 described later, and the gate of _NTG1 is connected to an inverted signal of the external input terminal F.

Here, the high resistance feedback path 11a is composed of only TG1, and the low resistance feedback path 11b is composed of a circuit network consisting of TG1 and TG2 connected in parallel, so the resistance value of the high resistance feedback path 11a is higher than the resistance value of the low resistance feedback path 11b. In terms of conductance, which is the reciprocal of the resistance value, the conductance of the high resistance feedback path 11a is smaller than the conductance of the low resistance feedback path 11b.

As shown in FIG. 1, the control unit 12 has an external input terminal F that determines the resistive feedback path 11 to be selected, and an inverter element INV1 whose input is connected to the external input terminal F and that outputs an inverted signal of the external input terminal F.

INV1 can be realized by, for example, a CMOS inverter. The output of INV1 is connected to the gate of _NTG1 constituting TG2. The external input terminal F is also connected to the gate of _PTG1 . In this configuration, when the external input terminal F is set to a logical value of 1 (potential of the power supply VDD), the gate of _NTG1 is supplied with an inverted signal, that is, a logical value of 0 (ground potential), so that TG2 is turned OFF and the high resistance feedback path 11a consisting of only TG1 is selected. Conversely, when the external input terminal F is set to a logical value of 0, TG2 is turned ON and the low resistance feedback path 11b consisting of TG1 and TG2 is selected.

(Operation of the feedback inverter section)
Here, the operation of the feedback inverter unit 10 will be described. FIG. 2 shows an equivalent circuit of the feedback inverter unit 10 in a state where one resistive feedback path 11 is selected. In FIG. 2, C1 and C2 (each of whose capacitance values is represented by C1 and C2) are parasitic capacitances, or parasitic capacitances and capacitance elements added thereto. For example, C1 includes the drain capacitance of PINV, the drain capacitance of _NINV , the gate capacitance of _N3 , etc. as parasitic capacitances, and C2 includes the gate capacitance of _PINV , the gate capacitance of _NINV , and the gate capacitance of N2 as parasitic capacitances. G1 represents the mutual conductance of the inverter circuit 10a in an equilibrium state where the potentials of the input Vin and the output Vout of the inverter circuit 10a are statically equal (hereinafter, also simply referred to as the "mutual conductance of the inverter circuit"). The potential of the output Vout in the above equilibrium state is Veq, and the following formula 1 is satisfied using the input Vin and the output current Iout. G2 is the equivalent conductance of the resistive feedback path of the selected one.
Iout=-(Vin-Veq)×G1...1

Considering the transient response in the circuit of Figure 2 when the potential of the output Vout fluctuates from Veq due to thermal noise or the like, if the time constant C2/G2 of the feedback circuit 10b is smaller than a certain critical value, ΔVout = Vout - Veq exhibits a monotonic decay behavior that decays monotonically to 0, as shown in Figure 3. On the other hand, if the time constant C2/G2 is made larger than the critical value, ΔVout exhibits a damped oscillation behavior in which the amplitude approaches 0 while oscillating, as shown in Figure 4.

The capacitance value of the parasitic capacitance element shown in FIG. 2 is generally C1≒C2, and in this case the critical value is C1/G1≒C2/G1. In other words, when the conductance G2 of the resistive feedback path 11 is larger than the mutual conductance G1 of the inverter circuit 10a, the time constant C2/G2 becomes smaller than the critical value and monotonically decays. On the other hand, when the conductance G2 of the resistive feedback path 11 becomes smaller than the mutual conductance G1 of the inverter circuit 10a, the time constant C2/G2 becomes larger than the critical value and damped oscillation occurs.

Thermal noise is constantly generated and has a wide range of frequency components and random amplitudes and phases. Under damped oscillation conditions, components with frequencies close to the damped waveform reinforce each other, resulting in a large noise voltage ΔVout, which is the accumulation of many past noise voltages. Figure 5 shows the results of noise simulation under monotonic damping conditions of G1 < G2 (left side of the graph) and damped oscillation conditions of G2 < G1 (right side of the graph). During damped oscillation, the amplitude of the Vout voltage (upper side of the graph, voltage axis on the left) is larger than during monotonic damping, and certain frequency components are observed, but it is not a periodic waveform like a sine wave, and both the amplitude and phase are random. At this time, the Vin voltage (lower side of the graph, voltage axis on the right side) also has a random amplitude and phase centered on Veq (0.33 V in Figure 5) like Vout, and is different for each cycle.

In the random number generator 1, the conductance of the high resistance feedback path 11a is configured to be smaller than the mutual conductance of the inverter circuit 10a, and the conductance of the low resistance feedback path 11b is configured to be larger than the mutual conductance of the inverter circuit 10a. In other words, in the random number generator 1, the conductance of at least one resistive feedback path 11 is configured to be smaller than the mutual conductance of the inverter circuit 10a, and when the high resistance feedback path 11a is selected, damped oscillation occurs, and when the low resistance feedback path 11b is selected, monotonic damping occurs.

The upper limit of the ratio of the conductance of the high resistance feedback path 11a to the mutual conductance of the inverter circuit 10a is 1, more preferably 0.9, even more preferably 0.5, and particularly preferably 0.1. By setting the conductance ratio below the upper limit, a large noise voltage can be easily obtained. As described above, C1 ≒ C2 is usually the case. However, by setting the conductance ratio below 0.9, damped oscillation can be generated when the difference between C1 and C2 is 2 times or less, and by setting the conductance ratio below 0.5, damped oscillation can be generated when the difference between C1 and C2 is 5 times or less, so that the random number generator 1 can be operated stably. Note that "the difference between C1 and C2 is N times or less" means that either C1/C2 ≦ N or C2/C1 ≦ N is satisfied.

On the other hand, the lower limit of the conductance ratio is not particularly limited and may be the theoretical limit value of 0, but is preferably 0.01. If the conductance ratio is below the lower limit, the time required for feedback and the associated time required for amplitude increase will be longer, which may reduce the throughput (the number of random numbers obtained per unit time) and increase the power consumption per bit of random number.

As described above, in the random number generator 1, the resistive elements of the resistive feedback path 11 are composed of MOS transistors. It is preferable that the composite value of the gate width ratio to the gate length of the MOS transistors constituting the high resistance feedback path 11a, whose conductance is smaller than the mutual conductance of the inverter circuit 10a, in the resistive feedback path 11 is smaller than the composite value of the MOS transistors included in the inverter circuit 10a. Specifically, in the high resistance feedback path 11a, since two MOS transistors constituting TG1 are connected in parallel, the composite value X1 is expressed by the following formula 2. On the other hand, in the inverter circuit 10a, since two MOS transistors are connected in parallel to VDD and ground, the composite value X2 is expressed by the following formula 3, and it is preferable that X1<X2. Note that the subscripts in formulas 2 and 3 represent the corresponding MOS transistors in FIG. 1.

In this way, by using MOS transistors for the resistive elements of the inverter circuit 10a and the resistive feedback path 11, and by making the composite value of the gate width ratio to the gate length have the above-mentioned relationship, it is possible to easily implement the random numbers in an integrated circuit while maintaining the quality of the generated random numbers. Furthermore, since the above-mentioned relationship is maintained even in circuits that are proportionally scaled down in response to the miniaturization of transistor manufacturing technology, it is possible to easily enjoy the benefits of miniaturization in manufacturing costs, power consumption, and speed with a relatively simple design.

<Digital conversion circuit>
The digital conversion circuit 20 receives both the input Vin and the output Vout of the inverter circuit 10a as inputs, and outputs a logic value according to the potentials of the input Vin and the output Vout of the inverter circuit 10a.

The digital conversion circuit 20 shown in FIG. 1 is a so-called strong-arm latch, and has a latch circuit 21. The latch circuit 21 includes a first CMOS inverter 21a and a second CMOS inverter 21b, and is configured to be able to hold data of opposite polarity to each other. Specifically, the output Q of the first CMOS inverter 21a is connected to the input of the second CMOS inverter 21b, and the output QB of the second CMOS inverter 21b is connected to the input of the second CMOS inverter 21b. With this configuration, the latch circuit 21 is stable with the outputs Q and QB inverted to each other, and data is held.

The digital conversion circuit 20 further includes four PMOS transistors P1, P2, P3, and P4, three NMOS transistors N1, N2, and N3, and an external input terminal SE. P1 is disposed between the output Q of the first CMOS inverter 21a and the power supply VDD, P2 is disposed between the source of the NMOS transistor Na constituting the first CMOS inverter 21a and the power supply VDD, P3 is disposed between the output QB of the second CMOS inverter 21b and the power supply VDD, and P4 is disposed between the source of the NMOS transistor Nb constituting the second CMOS inverter 21b and the power supply VDD. The gates of P1 to P4 are connected to the external input terminal SE. The source of N1 is grounded, and the drain is connected to the sources of N2 and N3. The drain of N2 is connected to the source of Na of the first CMOS inverter 21a, and the drain of N3 is connected to the source of Nb of the second CMOS inverter 21b. Furthermore, the gate of N1 is connected to the external input terminal SE, the gate of N2 is connected to the input Vin of the inverter circuit 10a of the feedback inverter section 10, and the gate of N3 is connected to the output Vout of the inverter circuit 10a of the feedback inverter section 10.

The operation of the digital conversion circuit 20 will be described below. First, SE is set to a logical value of 0 (ground potential), which sets N1 to the OFF state and P1 to P4 to the ON state. At this time, regardless of the ON/OFF state of the PMOS transistor Pa constituting the first CMOS inverter 21a and the PMOS transistor Pb constituting the second CMOS inverter 21b, all internal nodes of the latch circuit 21 are precharged to the power supply potential VDD.

Next, when the feedback circuit 10b is in a damped oscillation state, that is, when the high resistance feedback path 11a is selected, if SE is set to a logical value of 1 (power supply potential), N1 is in the ON state, P1 to P4 are in the OFF state, and the latch operation of the latch circuit 21 begins. Specifically, the potential of the precharged internal node decreases. Here, the rate at which the potentials of the outputs Q and QB decrease depends on the on-resistances of N2 and N3, respectively. For example, when Vin>Vout, the on-resistance of N2 becomes smaller, so the potential of Q decreases faster, and the latch circuit stabilizes with Q=0, QB=1, and data is latched. Conversely, when Vin<Vout, the latch circuit stabilizes with Q=1, QB=0, and data is latched.

As described above, both Vin and Vout of the inverter circuit 10a change randomly around Veq, so the states Vin>Vout and Vin<Vout occur randomly with equal probability. Therefore, if the variation in the transistors that make up the latch circuit 21 is sufficiently small, a truly random number is obtained in which the probability that the latch circuit 21 will take 0 is equal to the probability that it will take 1 (probability 0.5).

On the other hand, if the variation in the transistors that make up the latch circuit 21 cannot be ignored, a bias that makes it easier for either 0 or 1 to be generated may occur. Here, the variation in the transistors is on the order of several tens of mV in terms of potential. Meanwhile, the thermal noise itself is typically on the order of several mV, and as is, the variation in the transistors cannot be ignored. However, the random number generator 1 uses damped oscillation to amplify the amplitude of the thermal noise, thereby reducing the effects of the variation in the transistors and improving the randomness.

It is preferable that the response speed of the digital conversion circuit 20 (the time required for the latch circuit 21 to obtain a random number after SE is changed from 0 to 1) is shorter than the period of the damped oscillation. This makes it possible to obtain stable, high-quality random numbers.

<How to use the random number generator>
The random number generator 1 can select the low resistance feedback path 11b that generates monotonic decay in addition to the high resistance feedback path 11a that generates a damped oscillation. The advantages of using both paths and how to use them will be described below.

When the random number generator 1 is used to obtain consecutive random numbers, 0s and 1s are repeatedly input to the SE. If the repetition interval is short, the next random number may be obtained while still retaining the effects of the previous decaying oscillation that contributed to obtaining the previous random number. In this case, autocorrelation may occur with the previous random number, which may reduce the randomness of the number. This autocorrelation can be avoided by making the period for obtaining random numbers sufficiently large relative to the period of the decaying oscillation, but this would also reduce the throughput of random number generation.

By using the low resistance feedback path 11b in combination, it is possible to reduce autocorrelation while preventing a decrease in the throughput of random number generation. Specifically, as shown in FIG. 6, the external input terminals F and SE are controlled. When F=1 in FIG. 6, the high resistance feedback path 11a is selected and a damped oscillation occurs. On the other hand, when F=0, the low resistance feedback path 11b is selected and monotonic damping occurs. A random number is obtained (SE=0→1) when F=1, i.e., when the high resistance feedback path 11a is selected, but before the next random number is obtained, the low resistance feedback path 11b is selected (F=0) and a period of monotonic damping is provided. By providing a period of monotonic damping, the thermal noise immediately prior to the damped oscillation quickly converges to Veq, thereby reducing the impact on the acquisition of the next random number.

In this way, by providing multiple resistive feedback paths 11 with different conductances in the feedback circuit 10b and using multiple resistive feedback paths 11, it is possible to reduce autocorrelation when continuously obtaining random numbers. It is also possible to increase resistance to noise injection attacks. Furthermore, by providing a period of monotonic decay, it is possible to reduce the magnitude of the through current that constantly flows through the inverter circuit 10a, which can also reduce power consumption.

<Advantages>
The random number generator 1 can obtain a noise voltage with a large amplitude by attenuating and oscillating the thermal noise voltage superimposed on the feedback inverter unit 10 as a seed, by making the conductance of the resistive feedback path 11 of the feedback inverter unit 10, which acts as an amplifier, smaller than the mutual conductance of the inverter circuit 10a. This noise voltage generates a state in which the input Vin is larger than the output Vout and a state in which the input Vin is smaller than the output Vout relatively randomly and without bias, centering on an equilibrium state in which the potentials of the input and output of the inverter circuit 10a of the feedback inverter unit 10 are statically equal, and thus serves as a source of good quality randomness. In addition, in the random number generator 1, the digital conversion circuit 20 generates random numbers based on this noise voltage with a large amplitude, so that good quality random numbers can be generated with a small circuit scale, i.e., low power consumption. Furthermore, in the random number generator 1, the thermal noise voltage can be attenuated and oscillated in a relatively small number of periods to obtain a noise voltage with a large amplitude, so that the random number generator 1 is less likely to be locked even when subjected to a noise injection attack, and has high resistance to the noise injection attack.

[Second embodiment]
7 includes a feedback inverter unit 14 that is a source of randomness, and a digital conversion circuit 20 that generates random numbers based on the randomness generated by the feedback inverter unit 14. Of these, the digital conversion circuit 20 can be configured in the same manner as the digital conversion circuit 20 of the first embodiment, and therefore is given the same reference numeral and detailed description thereof will be omitted.

The feedback inverter unit 14 has an inverter circuit 10a having one input Vin and one output Vout, and configured so that the potential of the output Vout is the inverted and amplified potential of the input Vin, and a feedback circuit 14b. Of these, the inverter circuit 10a is the same as the inverter circuit 10a of the first embodiment, so it is given the same reference numeral and detailed description is omitted.

The feedback circuit 14b has three resistive feedback paths 15 that feed back the output Vout of the inverter circuit 10a to the input Vin, and a control unit 16 that selects one of the three resistive feedback paths 15.

As shown in FIG. 7, the control unit 16 has two external input terminals F1 and F2 that determine the resistive feedback path 15 to be selected, and two inverter elements INV2 and INV3 whose inputs are connected to the external input terminals F1 and F2, respectively, and which output the inverted signals of the external input terminals F1 and F2.

In the random number generator 2, the resistive feedback path 15 includes a monotonic attenuation feedback path 15a that generates monotonic attenuation and a damped oscillation feedback path 15b that generates damped oscillation, as well as an oscillation feedback path 15c. Of these, the conductance of the damped oscillation feedback path 15b and the oscillation feedback path 15c is smaller than the mutual conductance of the inverter circuit 10a. In other words, the conductance of at least one resistive feedback path 15 is smaller than the mutual conductance of the inverter circuit 10a in an equilibrium state in which the potentials of the input Vin and output Vout of the inverter circuit 10a are statically equal. The oscillation feedback path 15c will be described below. The resistive element of the resistive feedback path 15 is composed of a MOS transistor.

(Oscillation feedback path)
The oscillation feedback path 15c is configured by two transmission gates TG3 and TG4 connected in series as shown in FIG. 7. The configuration of the transmission gate is as described in the first embodiment. TG3 and TG4 of the oscillation feedback path 15c are fixed to the ON state and are used in common with the resistive elements of the monotonic attenuation feedback path 15a and the attenuated oscillation feedback path 15b, which are the other resistive feedback paths 15. The conductance of this oscillation feedback path 15c is smaller than the mutual conductance of the inverter circuit 10a. Also, the conductances of TG3 and TG4 that configure the series connection are each smaller than the mutual conductance of the inverter circuit 10a. That is, in the random number generator 2, one resistive feedback path 15 (oscillation feedback path 15c) has a plurality of resistive elements connected in series, and the conductance of two or more resistive elements among the plurality of resistive elements is configured to be smaller than the mutual conductance of the inverter circuit 10a.

In the random number generator 1 of the first embodiment, there is one stage of resistive elements. In contrast, in the random number generator 2, there are two stages of resistive elements, and the RC circuit with the parasitic capacitance is configured in two stages. In this way, in an RC circuit with two or more stages, by appropriately controlling the RC value of each, the phase change in feedback becomes larger than in the case of a one-stage RC circuit configuration, and oscillation can be achieved as shown in Figure 8. At this time, the amplitude of Vout during oscillation can be amplified to about half the power supply voltage.

It is preferable that the composite value of the gate width ratio to the gate length of the MOS transistors constituting the oscillation feedback path 15c, whose conductance is smaller than the mutual conductance of the inverter circuit 10a, is smaller than the composite value of the MOS transistors included in the inverter circuit 10a. Specifically, it is preferable that the composite value X3 of the oscillation feedback path 15c expressed by the following formula 4 and the composite value X4 of the inverter circuit 10a expressed by the following formula 5 are X3<X4. Moreover, the composite values X5 and X6 of the two-stage resistive elements TG3 and TG4 constituting the oscillation feedback path 15c are expressed by the following formulas 6 and 7, and it is more preferable that X5<X4 and X6<X4. Note that the subscripts in formulas 4 to 7 represent the corresponding MOS transistors in FIG. 7.

When oscillation feedback path 15c is selected, the logical values of external input terminals F1 and F2 are both 1.

(Damped oscillation feedback path)
The attenuated oscillation feedback path 15b includes a transmission gate TG5 in addition to the transmission gates TG3 and TG4 constituting the oscillation feedback path 15c. Of the two transmission gates TG3 and TG4 connected in series, TG5 is connected in parallel to TG4, which is located downstream as viewed from the output Vout of the inverter circuit 10a. The gate of TG5 is controlled by an external input terminal F2. When the external input terminal F2 is set to a logical value of 0, TG5 is in the ON state. In other words, the logical values of the external input terminals F1 and F2 when the attenuated oscillation feedback path 15b is selected are F1 being 1 and F2 being 0.

Since TG5 is connected in parallel to TG4, the conductance of the entire circuit network of the attenuating oscillation feedback path 15b is greater than the conductance of the oscillation feedback path 15c. As a result, when the attenuating oscillation feedback path 15b is selected, it is configured not to satisfy the oscillation conditions. On the other hand, the conductance of the attenuating oscillation feedback path 15b, which has TG3 as its main conductance component, is configured to be smaller than the mutual conductance of the inverter circuit 10a, so that when the attenuating oscillation feedback path 15b is selected, attenuating oscillation occurs. At this time, the combined value of the gate width ratio to the gate length of the MOS transistors that make up the attenuating oscillation feedback path 15b is smaller than X4 expressed by the above formula 5 and larger than X3 expressed by the above formula 4.

(monotonically decaying feedback path)
The monotonic attenuation feedback path 15a includes at least a transmission TG6 in addition to the transmission gates TG3 and TG4 constituting the attenuation oscillation feedback path 15b. TG6 is connected in parallel to the series-connected TG3 and TG4. The gate of TG6 is controlled by an external input terminal F1. When the external input terminal F1 is set to a logical value of 0, TG6 is in an ON state. On the other hand, as long as the conductance of the entire circuit network is greater than the mutual conductance of the inverter circuit 10a, TG5 may be in an ON state or an OFF state. In other words, the logical value of F2 is selected to be either 0 or 1.

Since TG6 is connected in parallel to TG3 and TG4, which are connected in series, the conductance of the entire circuit network of the monotonically attenuating feedback path 15a becomes even greater than the conductance of the attenuating oscillation feedback path 15b. As a result, when the monotonically attenuating feedback path 15a is selected, its conductance is configured to be greater than the mutual conductance of the inverter circuit 10a, and thermal noise is attenuated monotonically.

<How to use the random number generator>
The random number generator 2 can select one resistive feedback path 15 from three resistive feedback paths 15: a monotonic decay feedback path 15a, a decaying oscillation feedback path 15b, and an oscillation feedback path 15c. The advantages of using the three paths and how to use them are described below.

The random number generator 2 has an oscillation feedback path 15c that causes oscillation, so it can extract the initial minute amplitude of thermal noise with a large amplitude. This can further suppress bias in random numbers caused by transistor variations in the digital conversion circuit 20. However, when switching directly from the monotonically attenuating feedback path 15a to the oscillation feedback path 15c to suppress autocorrelation, as in the random number generator 1 of the first embodiment, the oscillation feedback path 15c grows using the highly identical single-shot noise generated at the time of switching as a seed, so it tends to have the same waveform and phase each time. For this reason, the generated random numbers tend to be biased toward 0 or 1, and there is a risk that good quality random numbers will not be obtained.

In the random number generator 2, this problem can be solved by using the damped oscillation feedback path 15b. That is, in the random number generator 2, first, the monotonic damped feedback path 15a is selected and damped. This selection plays a role in rapidly returning Vin and Vout of the inverter circuit 10a, which became large amplitude in the previous cycle, to Veq. Next, the damped oscillation feedback path 15b is selected to cause damped oscillation. This allows the amplitude of Vin and Vout to be increased. When the amplitude increases due to the damped oscillation, it switches to the oscillation feedback path 15c. Then, the amplitude increases further and oscillation occurs. Finally, the external input terminal SE is set to a logical value of 1, and a random number value is obtained according to the magnitude of Vin-Vout at that moment. At this time, the seed growing into oscillation is noise generated by damped oscillation, so the phase changes randomly each time. Furthermore, because the amplitude grows significantly due to the oscillation, the effect of variations in the MOS transistors of the digital conversion circuit 20 is reduced compared to when the attenuated oscillation feedback path 15b is used, making it easier to obtain random numbers that generate 0s and 1s with an almost equal probability. After obtaining the random value, it is possible to repeatedly select the monotonic attenuated feedback path 15a and perform the above-mentioned procedure to obtain good quality random numbers continuously.

In the above description, the random number generator 2 uses three resistive feedback paths 15 by switching between them. However, it is also possible to control the waveform of the signal input to the external input terminal F1, for example, to slowly change the transition from 0V to VDD or from VDD to 0V over time, thereby transitioning from monotonic decay to damped oscillation and then to oscillation. When performing such control, the external input terminals F2, INV3, and TG5 can be omitted. It is also assumed that monotonic decay is achieved by turning on only TG6 in addition to TG3 and TG4.

Alternatively, the external input terminals F2, INV3, and TG5 may be omitted, and TG6 may be provided so that damped oscillation occurs when the logical value of F1 is set to 1. The random number generator 2 can achieve the same effect even if it transitions from damped oscillation (logical value of F1 is 0) to oscillation (logical value of F1 is 1) without using monotonic damping.

<Advantages>
In the random number generator 2, a part of the resistive feedback path 15 (oscillation feedback path 15c) is configured using resistive elements connected in series. When resistive elements connected in series are used in this way, the phase change of the oscillation wave becomes large due to the effect of parasitic capacitance elements between the direct connections, making it easier to generate oscillations seeded by the voltage of thermal noise. Such an oscillation wave has a periodic waveform close to a sine wave, but the phase differs for each oscillation, so randomness remains, and the random number generator 2 can generate random numbers by utilizing this randomness of phase.

When the latch circuit of the digital conversion circuit 20 is constructed with MOS transistors as in the random number generator 2, if the size (gate length L and gate width W) is small, the threshold voltage Vth of the transistors tends to vary randomly in inverse proportion to the square root of W x L. If this Vth variation becomes large, the generated random numbers tend to become biased. In the random number generator 2, the amplitude of the oscillation wave is increased while retaining randomness, so that even if a relatively large Vth variation is allowed, the generated random numbers are less likely to become biased. In other words, it is possible to reduce the size of the MOS transistors. As a result, the scale of the digital conversion circuit 20 can be reduced, and power consumption can be further reduced.

[Third embodiment]
The random number generator 3 shown in FIG. 9 comprises a pair of feedback inverter units (a first feedback inverter unit 17 and a second feedback inverter unit 18) that serve as a source of randomness, and a digital conversion circuit 30 that generates random numbers based on the randomness generated from the pair of feedback inverter units.

<Feedback inverter section>
The first feedback inverter section 17 includes a first inverter circuit 17a having one input Vin1 and one output Vout1, and configured so that the potential of the output Vout1 is an inverted and amplified potential of the input Vin, and a first feedback circuit 17b having two resistive feedback paths that feed back the output Vout1 of the first inverter circuit 17a to the input Vin1. The first feedback inverter section 17 includes at least one resistive feedback path whose conductance is smaller than the mutual conductance of the first inverter circuit 17a in an equilibrium state in which the potentials of the input Vin and the output Vout of the first inverter circuit 17a are statically equal.

The second feedback inverter section 18 has a second inverter circuit 18a having one input Vin2 and one output Vout2, and configured so that the potential of the output Vout2 is an inverted amplified potential of the input Vin2, and a second feedback circuit 18b having two resistive feedback paths that feed back the output Vout2 of the second inverter circuit 18a to the input Vin2. In addition, the second feedback inverter section 18 has at least one of the resistive feedback paths whose conductance is smaller than the mutual conductance of the second inverter circuit 18a in an equilibrium state in which the potentials of the input Vin2 and the output Vout2 of the second inverter circuit 18a are statically equal.

The first inverter circuit 17a and the second inverter circuit 18a can be configured in the same manner as the inverter circuit 10a in the first embodiment, so a detailed description will be omitted. It is preferable that the first inverter circuit 17a and the second inverter circuit 18a have the same configuration.

The first feedback circuit 17b and the second feedback circuit 18b can be, for example, the feedback circuit 10b of the first embodiment, the feedback circuit 14b of the second embodiment, or another configuration. It is preferable that the first feedback circuit 17b and the second feedback circuit 18b have the same configuration. Here, an example is described in which the first feedback circuit 17b and the second feedback circuit 18b are both configured similarly to the feedback circuit 10b of the first embodiment, but the configuration of the first feedback circuit 17b and the second feedback circuit 18b is not limited to the configuration of the feedback circuit 10b of the first embodiment.

<Digital conversion circuit>
The digital conversion circuit 30 has a first selection circuit 31 that selects whether or not to connect via a feedback circuit between the output and input of the inverter circuits of the first feedback inverter section 17 and the second feedback inverter section 18, and a second selection circuit 32 that selects whether or not to connect between the output Vout1 of the inverter circuit of the first feedback inverter section 17 and the input Vin2 of the inverter circuit of the second feedback inverter section 18, and between the output Vout2 of the inverter circuit of the second feedback inverter section 18 and the input Vin1 of the inverter circuit of the first feedback inverter section 17.

Specifically, as shown in FIG. 9, the first selection circuit 31 has two transmission gates TG11 and TG12, an inverter element INV4, and an external input terminal SE1. TG11 is disposed between the output Vout1 of the first inverter circuit 17a of the first feedback inverter section 17 and the first feedback circuit 17b, and TG12 is disposed between the output Vout2 of the second inverter circuit 18a of the second feedback inverter section 18 and the second feedback circuit 18b. The gates of the PMOS transistors of TG11 and TG12 are connected to the external input terminal SE1, and the gates of the NMOS transistors of TG11 and TG12 are connected to INV4, which is connected to the external input terminal SE1 and generates an inverted signal.

In this configuration, in the first selection circuit 31, when SE1 is set to a logical value of 0, TG11 and TG12 are turned ON, and the output and input of the inverter circuits of the first feedback inverter unit 17 and the second feedback inverter unit 18 are connected via a feedback circuit, and the first feedback inverter unit 17 and the second feedback inverter unit 18 each form a feedback inverter. On the other hand, when SE1 is set to a logical value of 1, TG11 and TG12 are turned OFF, and the output and input of the inverter circuits of the first feedback inverter unit 17 and the second feedback inverter unit 18 are disconnected.

As shown in FIG. 9, the second selection circuit 32 has two transmission gates TG21 and TG22, an inverter element INV5, and an external input terminal SE2. TG21 is arranged between the output Vout1 of the inverter circuit of the first feedback inverter section 17 and the input Vin2 of the inverter circuit of the second feedback inverter section 18, and TG22 is arranged between the output Vout2 of the inverter circuit of the second feedback inverter section 18 and the input Vin1 of the inverter circuit of the first feedback inverter section 17. The gates of the PMOS transistors of TG21 and TG22 are connected to the external input terminal SE2, and the gates of the NMOS transistors of TG21 and TG22 are connected to INV5, which is connected to the external input terminal SE2 and generates an inverted signal.

In this configuration, in the second selection circuit 32, when SE2 is set to a logical value of 0, TG21 and TG22 are turned ON, and a connection is made between the output Vout1 of the inverter circuit of the first feedback inverter unit 17 and the input Vin2 of the inverter circuit of the second feedback inverter unit 18, and between the output Vout2 of the inverter circuit of the second feedback inverter unit 18 and the input Vin1 of the inverter circuit of the first feedback inverter unit 17, forming a latch circuit. On the other hand, when SE2 is set to a logical value of 1, TG21 and TG22 are turned OFF, and the above-mentioned connections are cut off.

<How to use the random number generator>
In the random number generator 3, initially, the logical values SE1=0 and SE2=1 are set, forming feedback inverter circuits in the first feedback inverter unit 17 and the second feedback inverter unit 18. Here, by changing the logical values of the external input terminals F of the first feedback inverter unit 17 and the second feedback inverter unit 18 from 0 to 1, the first feedback inverter unit 17 and the second feedback inverter unit 18 perform damped oscillation.

When the first feedback inverter unit 17 and the second feedback inverter unit 18 are in a damped oscillation state, setting SE1=1 cuts off the feedback, and the voltages of the inputs Vin1 and Vin2, on which the noise voltage at that moment is superimposed, are held in their respective C2s. This noise voltage is amplified by the first inverter circuit 17a and the second inverter circuit 18a, respectively.

Next, when SE2=0, a latch circuit is formed by the first inverter circuit 17a and the second inverter circuit 18a. At this time, the value held by the latch circuit is dependent on the noise voltage held in C2 of the first inverter circuit 17a and the second inverter circuit 18a, so it is a random value each time.

<Advantages>
As described in the first embodiment, when the variation of the transistors constituting the latch circuit cannot be ignored, the random numbers obtained may be biased toward generating either 0 or 1. In the random number generator 3, the inverter circuit constituting the latch circuit also constitutes a feedback inverter circuit, so the effect of this variation can be offset. Therefore, by configuring the random number generator 3 as described above, it is possible to prevent the occurrence of bias in the random numbers generated due to the variation in the characteristics of the elements constituting the digital conversion circuit 30.

[Other embodiments]
The above-mentioned embodiment does not limit the configuration of the present invention. Therefore, the above-mentioned embodiment may omit, replace or add components of each part of the above-mentioned embodiment based on the description in this specification and common general technical knowledge, and it should be understood that all of these are within the scope of the present invention.

In the above embodiment, the inverter circuit includes MOS transistors, and the resistive elements of the resistive feedback path are configured with MOS transistors. However, some or all of the inverter circuit and the resistive elements of the resistive feedback path may be configured with elements other than MOS transistors. For example, the resistive elements of the resistive feedback path may be configured with well resistors, polysilicon resistors, chip resistors, etc.

In the above embodiment, a case where the feedback circuit has multiple resistive feedback paths has been described, but a random number generator having one resistive feedback path is also within the scope of the present invention. A random number generator having one resistive feedback path has the same effect. In this case, the conductance of the one resistive feedback path is smaller than the mutual conductance of the inverter circuit. Furthermore, in this configuration, the control unit of the feedback circuit can be omitted.

In the above embodiment, the digital conversion circuit uses both the input and output of the inverter circuit as inputs, but it is also possible to use either the input or the output of the inverter circuit as input. In addition, the digital conversion circuit is not limited to the configuration of the above embodiment, and may be any circuit that can extract a logical value at any timing from the feedback inverter unit, which is the source of noise.

In the above third embodiment, a method was described in which a transmission gate was used as the first selection circuit to select whether or not to connect the output of the inverter circuit of each feedback inverter unit to the feedback circuit, but the presence or absence of a connection via the feedback circuit between the output and input of the inverter circuit may be selected by controlling all resistive feedback paths in the feedback circuit to be disconnected. For example, when using the feedback circuit 14b shown in FIG. 7, all resistive feedback paths in the feedback circuit can be disconnected by turning TG3 and TG6 to the OFF state. In this case, the transmission gates (TG11 and TG12 in FIG. 9) of the first selection circuit can be omitted.

In the above embodiment, a case has been described in which a resistive feedback path with a conductance smaller than the mutual conductance of the inverter circuit causes oscillation or damped oscillation, but it is not essential that a resistive feedback path with a conductance smaller than the mutual conductance of the inverter circuit causes oscillation or damped oscillation. Even if damped oscillation is not reached, the amplitude of the noise voltage can be increased by making the conductance of the resistive feedback path smaller than the mutual conductance of the inverter circuit, thereby achieving the same effect as the above embodiment.

As described above, the random number generator of the present invention can generate high-quality random numbers with low power consumption and is highly resistant to noise injection attacks.

1, 2, 3 Random number generator 10, 14 Feedback inverter section 10a Inverter circuit 10b, 14b Feedback circuit 11 Resistive feedback path 11a High resistance feedback path 11b Low resistance feedback path 12, 16 Control section 15 Resistive feedback path 15a Monotonic damping feedback path 15b Damping oscillation feedback path 15c Oscillation feedback path 17 First feedback inverter section 17a First inverter circuit 17b First feedback circuit 18 Second feedback inverter section 18a Second inverter circuit 18b Second feedback circuit 20 Digital conversion circuit 21 Latch circuit 21a First CMOS inverter 21b Second CMOS inverter 30 Digital conversion circuit 31 First selection circuit 32 Second selection circuit Vin, Vin1, Vin2 Input Vout, Vout1, Vout2 Output VDD Power supply F, F1, F2, SE, SE1, SE2 External input terminal P _INV , N _INV MOS transistors TG1, TG2, TG3, TG4, TG5, TG6 Transmission gates TG11, TG12, TG21, TG22 Transmission gates P _TG1 , P _TG2 , P _TG3 , P _TG4 , P _TG5 , P _TG6 MOS transistors N _TG1 , N _TG2 , N _TG3 , N _TG4 , N _TG5 , N _TG6 MOS transistors INV1, INV2, INV3, INV4, INV5 Inverter elements C1, C2, C3 Capacitor elements G1, G2 Equivalent resistances Pa, Pb, Na, Nb MOS transistor Q Output of first CMOS inverter QB Output of second CMOS inverter P1, P2, P3, P4 MOS transistors N1, N2, N3 MOS transistor

Claims (6)

A feedback inverter unit which is a source of randomness;
a digital conversion circuit that generates a random number based on the randomness generated by the feedback inverter unit;
The feedback inverter unit is
an inverter circuit having one input and one output, the potential of the output being an inverted and amplified potential of the input;
a feedback circuit having one or more resistive feedback paths feeding back the output of the inverter circuit to the input,
a conductance of at least one of the resistive feedback paths is smaller than a mutual conductance of the inverter circuit in an equilibrium state in which the potentials of the input and the output of the inverter circuit are statically equal;
A random number generator that obtains random numbers by selecting a resistive feedback path whose conductance is smaller than the mutual conductance of the inverter circuit . The feedback circuit is
A plurality of resistive feedback paths having different conductances;
and a control unit that selects one resistive feedback path from the plurality of resistive feedback paths. one of the resistive feedback paths includes a plurality of resistive elements;
3. The random number generator according to claim 2, wherein at least one of said plurality of resistive elements is used in common with other resistive elements of said resistive feedback paths. one of the resistive feedback paths includes a plurality of resistive elements connected in series;
4. The random number generator according to claim 1, wherein the conductance of at least two of said plurality of resistive elements is smaller than the mutual conductance of said inverter circuit. A pair of the feedback inverter units is provided,
When the pair of feedback inverter units are a first feedback inverter unit and a second feedback inverter unit,
The digital conversion circuit is
a first selection circuit that selects whether or not a connection is made between an output and an input of an inverter circuit of the first feedback inverter unit and the second feedback inverter unit via a feedback circuit;
5. The random number generator according to claim 1, further comprising: a second selection circuit that selects whether or not a connection is established between the output of the inverter circuit of the first feedback inverter section and the input of the inverter circuit of the second feedback inverter section, and between the output of the inverter circuit of the second feedback inverter section and the input of the inverter circuit of the first feedback inverter section. the inverter circuit includes a MOS transistor;
the resistive element of the resistive feedback path is composed of a MOS transistor,
6. A random number generator as claimed in claim 1, wherein a composite value of the gate width to gate length ratio of a MOS transistor constituting a resistor of at least one of the resistive feedback paths is smaller than the composite value of a MOS transistor included in the inverter circuit.

Images