True Random Number Generator Circuits Based on Single- and Multi- Phase Beat Frequency Detection

Transcription

1 True Random Number Generator Circuits Based on Single- and Multi- Phase Beat Frequency Detection Qianying Tang, Bongjin Kim, Yingjie Lao, Keshab K. Parhi, and Chris H. Kim University of Minnesota, Minneapolis, MN USA 1

2 Agenda Background Proposed beat freq. based TRNG 65nm single-phase TRNG test chip 65nm multi-phase TRNG test chip Summary 2

3 Example of TRNG Appliction Ciphertext jg Plaintext Plaintext Univ. of Minnesota Encryption Decryption Univ. of Minnesota Secret Keys Random Numbers Random Numbers Use random numbers to generate secret keys Encrypt plaintext into ciphertext with secret keys 3

4 Prior Work Direct noise amplification from devices Random Telegraph Noise (R. Brederlow, ISSCC, 2006) Resistor thermal noise (V. Kaenel, CICC 2007) Conventional ROSCs based TRNG(M. Bucci, Tran. on Comp., 2003) Harvesting noise from oscillator jitter Generally requires noise amplification otherwise yield with low efficiency Metastability TRNG (C. Tokunaga, JSSC, 2008; S. Mathew, JSSC, 2012) Inverter pair driven to metastable state Requires continuous calibrating loop 4

5 Prior Work: Dual Oscillator Based TRNG + - Fast Oscillator Slow Oscillator D DFF Q Faster oscillator sampled by a much slower oscillator Output is truly random only when ΔT slow > T fast Amplification is required to enlarge ΔT slow Less amenable to be integrated with digital processor 5

6 Prior Work: Meta-stability Based TRNG a Voltage b a b Shift Register FSM Time Fine/Coarse Tune Inverter pair driven to meta-stability and resolved to 0 or 1 depending on noise direction Percentage of 0 s and 1 s is relatively sensitive to inverter pair mismatch (requires ΔV INV <0.24σ Vnoise ) Limited randomness: P(0) (probability of generating 0 s) is 33~49% for a supply range from 0.8V to 1.2V S. K. Mathew, et al., JSSC, vol. 47,

7 Random Bit Generation Using BFD f A f B Scheme A B D Q DFF C Reset Counter N A B 7

8 Random Bit Generation Using BFD f A f B Scheme A B D Q DFF C Reset Counter N A B 8

9 Counter Reset Random Bit Generation Using BFD Scheme A B D Q DFF C N f A f B A C B N 9

10 LSB Select, Von Neum. Logic 12 bit Counter Single-phase TRNG Implementation Trimming Capacitors B Enable Reset TRNG Output F n <0> F n <1>... F n <5> A Beat Freq. Detector N Parallel to Serial... F n <0> F n <1>... F n <5> 1X 2X... 32X B A ROSC F 2 <0:5> Freq.... Trimming F n <0:5> ROSC Freq. Trimming F 1 <0:5> C D D Q 5b DFF Maj. Voter Start/End Control Logic Enable Reset Sampling CLK Sampling CLK C D Enable Bubble Rejection Cnt. Output Sampling CLK Reset Trimming capacitors: ensure desirable count range 5 bit majority voter: prevents functional errors Start/end control: reduces unnecessary switching power 10

11 Count versus Trimming Cap. Setting Count Time (a.u) 65nm, 0.8V, 27ºC Trim. Cap. Setting =3, Avg. Cnt. = 3040 Trim. Cap. Setting = 2, Avg. Cnt. = 519 Trim. Cap. Setting = 1, Avg. Cnt. = 352 Trim. Cap. Setting= 0, Avg. Cnt. = Count value increases as ROSC frequencies are brought closer together 11

12 NIST Randomness Test Results Percentage nm, 0.8V, 27ºC, 1M Cnt's (LSB) (MSB) Bit Number 0 s 1 s Average Count = 352 Avg. count = 352 P-Val / Proportion Frequency Block Frequency *Cumulative Sums Runs Longest Run Rank FFT *Nonoverlapping Temp. Overlapping Template Universal Approximate Entropy *Random Excursions *Rand. Excursions Var. Serial Linear Compelxity P-Val 1st LSB nd LSB rd LSB Prop. P-Val Prop. P-Val Prop th LSB P-Val Prop. * Tests with 2 or more subtest, P-val and Prop shown here are the smaller or median values ** Concatenate 1 st ~3 rd LSBs and 4 th LSB after von Neumann correction Estimate randomness from percentage of 0 s and 1 s NIST test further verifies the randomness 55 1M random bits test: P-Value > 0.01 and Proportion > st ~ 3 rd LSBs pass all NIST tests while 4 th LSB fails 12

13 Final Output After Post-processing von Neumann Count 1 st LSB 2 nd LSB 3 rd LSB 4 th LSB 4 th LSB w/ von Neu. Corr. Final Out Raw Data Corr. Data Drop 0 1 Drop Final Output NIST result P-Val / Proportion Frequency Block Frequency Cumulative Sums Runs Longest Run Rank FFT Nonoverlapping Temp. Overlapping Template Universal Approximate Entropy Random Excursions Rand. Excursions Var. Serial Linear Compelxity P-Val Prop Concatenating lower LSBs Apply von Neumann correction on just the 4 th LSB Keep 1 st ~3 rd LSBs, buffer and insert corrected 4 th LSB 13

14 Yes Startup Routine Counts from BFD One-time Calibration Sample Counts in Range? No Tune Trim. Caps. Scan Out Count 1000 Count range of 200 to 500 provides good trade-off between speed and efficiency One-time calibration at initial startup Achieves target range within a few beat frequency periods Incurs negligible power overhead Target Range =200~500 Chip # 65nm, 0.8V, 27ºC Before Calibration After Calibration

15 Robustness of TRNG nm, 0.8V, 27ºC nm, 27ºC Avg. Count 350 Avg. Count Time (hrs) Voltage (V) Average count does not drift during 15 hours operation For a supply voltage range of 0.8V to 1.2V Average count remains within desirable range Variation of the count value decreases slightly 15

16 Portion 5.0% 2.5% Simulation and Modeling ROSC A µ A = σ=0.006 ROSC B µ B = σ=0.006 Portion 8.0% 4.0% 65nm, 0.8V, 27C Meas. Data MC Sim. 0.0% Frequency (a.u.) 0.0% Counts pdf ( N) pdf min N : T B N 1 i 1 T A ( i) T B ( i) Modeling of ROSC frequencies: Same deviation (σ=0.006) Tunable average frequency (µ A, µ B ) Monte Carlo simulation matches well with test chip data 16

17 Parallel to Serial LSB Select, Von Neum. Counter3 BFD Counter2 BFD Counter1 BFD Parallel to Serial LSB Select, Von Neum. Multi-phase TRNG Implementation Singlephase Shift Register & Adder Trig Multiphase Counter Counter2 Counter3 Avg Count Adder Out Beat Frequency Detectors (BFDs) used in each stage Independent noise on each stage induces small variation in different counter values Sum of counter values provides a larger final count 17

18 Multi-phase vs Single-phase Count nm, 0.8V, 27ºC Multi-phase Out Single phase Out Time (a.u) # of stages 3 31 # of phases Single Multi Single Multi # of bits passing NIST Efficiency (Mb/mW) Multi-phase TRNG improves performance: More # of bits passing NIST test: 1 or 5 more random bits generated for 3-stage and 31-stage ROSCs, respectively Higher bit generation efficiency 18

19 Multi-phase TRNG with Different ROSC Stage Count 3 65nm, 0.8V, 27ºC 16 65nm, 0.8V, 27ºC Bit rate (Mb/s) 2 1 Efficiency (Mbits/mW) # of ROSC stages # of ROSC stages Multi-phase TRNG utilizing fewer ROSC stages shows improved bit rate and efficiency 19

20 Single- and Multi-phase TRNG Die Photo 52µm DCAP ROSC A ROSCs (3~31 stage) ROSCs (3~31 stage) DCAP BFD & Counter Scan out ROSC B Beat Freq. Detectors Adder Process 65nm LP CMOS 65nm LP CMOS Operating Voltage TRNG Feature ROSC Chain Length Gen. Efficiency Core Circuit Area 0.8V ~ 1.2V 0.8V ~ 1.2V Single-phase TRNGs Multi-phase TRNGs 5 stage 3,7,15 and 31 stage 2.5Mb/mW Mb/mW 7000µm µm 2 (3 stage) 20

21 Summary A fully digital beat frequency detector based TRNG implemented in 65nm Measured data shows satisfactory TRNG performance across a wide supply voltage range without an elaborate calibrating loop A one-time calibration scheme is proposed to ensure count values are in the desirable range To further improve the efficiency, a multi-phase TRNG was demonstrated that samples phase noise from each ROSC stage 21