SPADs for Quantum Random Number Generators and beyond

Transcription

1 SPADs for Quantum Random Number Generators and beyond Samuel Burri 1 Damien Stucki 2 Yuki Maruyama 3 Claudio Bruschini 1 Edoardo Charbon 1,3 Francesco Regazzoni 4 1 School of Computer & 2 IdQuantique 3 Delft University 4 ALaRI Communication Sciences of Technology USI 1015 Lausanne 1227 Carouge 2628 Delft 6900 Lugano Switzerland Switzerland Netherlands Switzerland samuel.burri@epfl.ch damien.stucki@idquantique.com e.charbon@tudelft.nl regazzoni@alari.ch Abstract Single-Photon Avalanche Diodes (SPADs) are solidstate photo-detectors capable of detecting single photons by exploiting the avalanche effect that occurs in the breakdown of a p-n junction biased above breakdown voltage. By this effect, a SPAD translates an incoming photon to a macroscopic current pulse. These devices are currently used for building medical devices characterized by a very high time resolution. An appealing application of SPAD is to use them as a basic block for building the entropy source of true random number generators. In this paper we focus on such application, and we explore the design challenges behind the realization of a quantum random number generator based on a massively parallel array of SPADs. The matrix under investigation comprises 512x128 independent cells that convert photons onto a raw bit-stream, which, as ensured by the properties of quantum physics, is characterized by a very high level of randomness. The sequences are read out in a 128-bit parallel bus, concatenated, and pipelined onto a de-biasing filter. Subsequently, we fabricated the proposed chip using a standard CMOS process. Our results, achieved on the manufactured device and coupling two matrices, show that our architecture can reach up to 5 Gbit/s while consuming 25pJ/bit, thus demonstrating scalability and performance for any random number generators based on SPADs. I. INTRODUCTION Random numbers are required in many applications, ranging from password or cryptographic key generation to gaming (e.g. winning number drawing or card deck shuffling). Although for certain applications pseudorandom numbers are sufficient and even desirable, true random numbers are increasingly used either for security or regulatory reasons. The emergence of quantum key distribution as a technique to enable secure key exchange according to information theory and the pervasive diffusion of privacy sensitive applications, such as web services for e-commerce and e-health, push for the development of low cost true random number generators in the multi-mb/s range for clients and in the multi-gb/s range for servers. High speed True Random Number Generators (TRNGs) have been proposed based on mechanisms, such as thermally induced jitter from ring oscillators, block RAM write collisions, flip-flop metastability, etc. on FPGAs [12] and ASICs [8]. TRNGs may also exploit optical effects. In [11] and [4], the use of superluminescent LEDs and lasers was proposed as a source of physical entropy achieving rates of up to 300Gb/s, however, both TRNGs were implemented in nonstandard processes. An effective way to create an optical TRNG is to use the quantum nature of photons. Reference [13] for instance measured the quantum phase noise of a laser operating at a low intensity levels for rates up to 6.25 Gbits/s. However, the system is fabricated in a custom process and the operating conditions to achieve stable, high-quality random numbers are hard to achieve and/or to maintain. To date, commercial quantum random generators can only reach speeds of 150Mb/s and are often built in expensive custom processes. Alternatively, CMOS quantum random number generators have been proposed by a number of authors, usually in the multi-mb/s. However, a complete and exhaustive study of the scalability of this approach was still missing thus the use of massively parallel quantum random number generators is so far mainly unexplored. In this paper, we explore the use of a large matrix of SPADs to realize a fully scalable quantum CMOS TRNG. The generator uses the quantum process of single-photon detection, implemented using a standard CMOS technology, whereby a large number of detectors, organized in a regular array, are used in parallel to increase the overall throughput [1]. This approach is sound because each detector tends to respond independently from the others, assuming near-zero crosstalk. However, in real SPAD array crosstalk is non-zero; in additon, another non ideality, namely afterpulsing, emerges. Afterpulsing, as we will see later, relates to spurious pulses generated after a photon detection, resulting in false photon counts correlated to real ones. Our design exploits SPADs as detectors and a LED as photon source. If properly designed, SPADs exhibit the needed low optical and electrical crosstalk, while, the bit-stream of each SPAD can be considered a random process, assuming zero afterpulsing. Afterpulsing, in fact, introduces a correlation between subsequent pulses, thus degrading the quality of the randomness in a similar way as crosstalk. In order to evaluate the quality of our design, we manufactured the proposed quantum CMOS TRNG using a standard CMOS technology. We studied the effects of detector- and source-related properties, while varying the number of activated pixels, as well as supply voltage and temperature. Finally, the throughput and the quality of the TRNG was validated using the NIST and diehard test suites. Overall, our TRNG achieves a throughput of 5Gb/s with an energy requirement of 25pJ/bit, to the best of our knowledge the lowest to date for a TRNG. With the proposed quantum CMOS TRNG /14/$ IEEE 788

2 we demonstrate the scalability of our approach from a single pair of single-photon detectors to 65,536 pairs in a dual chip configuration, paving the way to the use of massively parallel arrays of detector as high performance random number generators. The reminder of the paper is organized as follows. Section II introduces the concepts of SPADs. Section III describes the architecture of our TRNG. Section IV reports the performance of the proposed chip. II. SINGLE PHOTON AVALANCHE DIODE A SPAD is a pn junction biased above breakdown, so as to operate in Geiger mode. In this mode of operation, the SPAD is capable of detecting single photons with a probability known as photon detection probability (PDP). The PDP is a function of the excess bias voltage, i.e. the voltage above breakdown at which the diode is biased, and wavelength. SPADs have been known for a long time and their characteristics are the topic of several publications [2, 6]. Only recently, however, SPADs have been integrated together with their driving circuits in a standard CMOS fabrication process [9]. At the beginning, there were only single diodes (pixels) and small arrays on a chip, while nowadays it is possible to integrate thousands of pixels into much more complex systems [10]. In order to fabricate SPADs using a standard CMOS processes, it is necessary to create planar diodes between layers commonly available for transistor layout. This approach allows to place a large number of electronic components needed to drive and read out the SPADs next to the pixels with limited parasitics. It must be noticed however that standard fabrication procedures are not ideal manufacturing of SPAD. Thus, CMOS SPADs are generally noisier then their counterpart implemented in dedicated technologies. The p+ anode to deep n-well cathode junction forms the active part of the device where the avalanches is triggered. A p-well guard ring is fabricated around the p+ anode to prevent premature edge breakdown. Putting the whole structure in the p-substrate allows independent voltages and provides additional isolation [7]. As an example Figure 1 reports the cross-section of the SPAD used for the random number generator which will be described in the following sections. The p+ anode to deep n-well cathode junction forms the active part of the device where the avalanches occur. A p-well guard ring is fabricated around the p+ anode to prevent premature edge breakdown. Putting the whole structure in the p-substrate allows independent voltages and provides additional isolation [7]. A SPAD has several sources of non-idealities: dead time, dark counts, afterpulsing, and crosstalk. Dead time relates to the time required to return to the initial state after an avalanche has occurred; it is the minimum time between detection pulses. Dark counts relate to a SPAD s activity in the dark. Dark counts are spurious thermal events due to two quantum mechanisms, i.e. trap-assisted and band-to-band tunneling. It is generally a Poissonian process and it is characterized through dark count rate (DCR), a mean or median event rate, which a function of excess bias, temperature, and the active area of the SPAD. Afterpulsing is a phenomenon by which spurious events occur after a primary photon absorption. These pulses are due to Fig. 1.: Cross-section of a SPAD standard CMOS fabrication process. The p+ anode to deep n-well cathode junction forms the active part of the device where the avalanches occur. A p- well guard ring is fabricated around the p+ anode to prevent premature breakdown. Putting the whole structure in the p- substrate allows independent voltages and provides additional isolation[7]. secondary avalanches triggered by a primary avalanche that, in turn, is caused by a photon or a dark count. Secondary avalanches are due to trapped carriers that are released at a random time after the primary avalanche. Afterpulsing is characterized by afterpulsing probability, a parameter that relates the probability of secondary and higher-order avalanches to excess bias and dead time. It is generally derived by inter-arrivaltime characterization in the dark and in controlled illumination. Figure 2 plots the typical afterpulsing probability in a SPAD as Fig. 2.: Afterpulsing probability as a function of the dead time between readout operations, equivalent to the read cycle time [3]. a function of dead time and excess bias at room temperature. Crosstalk is a SPAD s spurious activity due to the activity of adjacent SPADs by way of optical and electrical coupling. Electrical coupling occurs due to substrate and supply line spurious pulses that propagate from a SPAD to others via metal lines. Optical crosstalk is due to photons emitted during an avalanche by impact ionization that are captured by victim SPADs that are triggered consequently. Crosstalk is a function of the radiation intensity to the overall sensor and it rapidly decays with SPAD to SPAD separation. We assume an exponential decay based on observation. This behavior is due to photon 789

3 absorption and transport in silicon, the dominant mechanism supporting crosstalk. 2nd Sensor LED Row Decoder Ctrl. Registers 512x128 Pixel Array USB Bridge FIFO Memory LED Ctrl. Control Signals Ctr. Sig. Tree: Off, ReChg, 16 4 Data Registers 512: GATE Fig. 3.: Schematic of the 9T pixel in the proposed TRNG. The SPAD is quenched via N1; the cathode drives N3 which in turn sets the latch formed by N4-N5-N9-N10, upon photon detection. The NMOS latch is controlled by TOPGATE that can also be used to save power, and reset by RS via N6. The output of the latch controls the pulldown N7 that is used to change the column line via select transistor N8 controlled by signal OE. The latter is pulled up at the top of the column and read out at the bottom. A complete sensor contains pixels formed by a circuit made of a SPAD and several transistors. The sensor circuit used for realizing the TRNG which will be described in the following sections is depicted in Figure 3 and it is composed of nine transistors. The SPAD is quenched via N1; the cathode drives N3 which in turn sets the latch formed by N4-N5-N9-N10, upon photon detection. The NMOS latch is controlled by TOPGATE that can also be used to save power, and reset by RS via N6. The output of the latch controls the pulldown N7 that is used to change the column line via select transistor N8 controlled by signal OE. The latter is pulled up at the top of the column and read out at the bottom. Each pixel contains local shutter transistors for fast response and a memory where photon detections during the active time are registered. Through selection and reset transistors a full line of the sensor will be read out and reset in one operation. III. TRNG ARCHITECTURE The block diagram of the system, shown in Figure 4, it comprises three main units: the photon source, the detector array, and an algorithmic post-processing unit. The photon source is a pulsed LED with peak emission at 830nm, and it is placed on the center of the array at a distance of 2cm to allow homogeneous illumination of the whole matrix. The detector array consists of a dual 512x128 pixel array. Each pixel comprises a SPAD, implemented as described in Section II, and a one-bit memory element. The chip supports two possible acquisition modes: global-shutter mode, in which all the sensors have the same shutter signals, and rolling shutter Fig. 4.: Block diagram of the proposed true random number generator. The pulsed light is produced by a LED with peak emission at 830nm, which is placed on the center of the array at a distance of 2cm to allow homogeneous illumination of the whole matrix. The internal memory bank (512 memory elements) is connected with external memory elements, which are read out in parallel and concatenated to produce the bit stream. The bit-stream is input to a filter to remove the bias of the sequence and final stream is output outside. mode, in which the integration time of each line is equal to the time which passes between one read-out of the line and the next read-out of the same line, resulting in integration periods which roll across time. The row decoder signal enables the desired row in the array at the time of the read-out after which the memories in the row are reset. Every column is read out independently via a fast memory and a serializer. The entire content of one array (65,536 bits) is completely read out in 6.4μs (frame duration) via a 128- bit bus; note that a bit-stream of 10.2Gb/s is achieved by the circuit, irrespectively of the sequence and the number of rows read out in the frame duration. As mentioned before, our system comprises a dual detector array operating independently, thus doubling the throughput. To acquire one frame of random data the memories in the sensor are reset and the SPADs are activated by applying the excess voltage which brings them in the Geiger regime. The LED is then activated for a duration which will give each SPAD a 50% chance of being triggered by a photon. After deactivation of the SPAD frontend circuit, the resulting random bits are read out and the memories reset again for the next acquisition. The bit-streams are pipelined onto the algorithmic postprocessing unit, which implements a von Neumann filter to debias the sequence thereby suppressing any residual optical and electrical crosstalk. More in details, the von Neumann filter considers pairs of bits at a time and performs one of the following three actions: if two successive bits are equal, they are discarded; if the sequence is 1;0, the output will be 1 and the sequence if 0;1, the output will be 0. The used filter is expected to reduce the throughput from a raw bit-stream of 20.4Gb/s to 5Gb/s of a de-biased bit stream. The overall system is controlled by a dedicated FPGA which takes care of uploading the streams of bits to the computer us- 790

4 Fig. 5.: Chip micrograph of the true random number generator. The inset shows the detail of the pixels, which compose the complete array. The chip was fabricated in standard 0.35m CMOS technology. It measures 12.3mm x 3.3mm. The RBE is plotted in Figure 7 as a function of excess bias voltage and LED pulse length. The plots, obtained at the indicated temperature range, demonstrate that an optimum is found in a large region of operation, showing the insensitivity of the quality of the random sequences from temperature, voltage, and LED parameters. Fig. 6.: Photograph of the chip mounded and wire-bonded on a PCB. ing th USB 2.0 interface. The chip was implemented using a standard 0.35μm CMOS technology and it measures 12.3mm x 3.3mm. The micrograph of one of the two pixel arrays is captured on Figure 5. The figure also reports the detail of the pixel used to build the complete true random number generator. The photograph of both the pixel arrays mounded and wire-bonded on a PCB is reported in Figure 6. IV. RESULTS In this section we report the experiments we carried out to demonstrate the scalability of quantum random number generator based on CMOS and we analyze its performance. The architecture of the chip was designed to investigate the trade-offs between architectural parameters, source parameters, and throughput. We define Random Bit Efficiency (RBE) as the ratio between de-biased bit-streams and the raw bit-streams. RBE is 100% when the raw bit-streams are perfectly biased and it is zero when no random content can be found in the raw bit-stream. RBE was computed on the output bit-stream of the chip for a range of temperatures from -25C to 70C biasing the SPADs in the pixels at an excess bias voltage from 2.0V to 5.5V. The LED was biased at an average power of 100μW and pulsed at 156kHz with a duty cycle of 0-15%, i.e. a pulse length from 0 to 900ns. Next, a variable number of pixels was activated on the chip, so as to analyze the impact of the number of independent pixels operating at the same time to the quality of the random bit-stream. The plot in Figure 8 shows the throughput of the TNRG plotted as a function of activated pixels before and after de-biasing; with fewer pixels, the minimum readout cycle of 50ns is used. At this speed, afterpulsing degrades the quality of the TRNG sequences and thus the usable throughput after debiasing, is relatively low. Increasing the number of activated pixels has the effect of increasing the readout cycle, thereby reducing afterpulsing and thus increasing RBE and thus the overall throughput. The relation between afterpulsing and readout cycle time is complex however it becomes negligible at readout cycles in the order of μs [3]. De-biasing is effective in improving the quality of our TRNG that is already below 50% at any time for an excess bias of less than 2.5V; this explains why the measured curve approaches the theoretical one even at low pixel counts. The maximum theoretical throughput is never achieved but it is approached at less than 1% (1-sigma) with 4096 pixels, far fewer than the maximum of 65,536 pixels. Above this count a raw throughput of 20.0Gb/s is always guaranteed, irrespective of temperature (in the -25C to 70C range) and supply voltage (10%). After de-biasing, the raw throughput is reduced to 5Gb/s and it is guaranteed to pass all NIST and diehard tests. A performance comparison between the proposed TRNG and the literature is illustrated in Table I. To the best of our knowledge, the proposed TRNG is the fastest implemented in a standard CMOS process, while higher throughput is only achieved by Wei et al [11], using a non-quantum process in a custom, non-cmos technology. Our architecture is expected to outperform the performance obtained by Wei et al [11] if fabricated in standard 65nm CMOS, a process that is widely available since 2009 and for which SPADs are already available. Finally, Table II lists the tests passed by the TRNG and the conditions in which these tests were conducted. 791

5 25 Light pulse 100 [ns] 25 Excess bias 1.8 [V] RBE RBE SPAD excess bias [V] (a) LED pulse length [ns] (b) Fig. 7.: Measured random bit efficiency (RBE) vs. (a) excess bias voltage and (b) LED pulse length. The plot shows a maximum efficiency of 25%. These measurements were repeated in the temperature range with no statistical deviation Raw theory Raw measured Filtered theory Filtered measured Fig. 8.: Measured and theoretical throughput vs. number of pixels activated in an experiment with 2.8V of excess bias. The throughput is shown before and after de-biasing, whereas a 4x reduction is caused by von Neumann based de-biasing. The plot shows that the theoretical linear relation between throughput and the number of active pixels is achieved with the increase of the number of active pixels. De-biasing is effective in eliminating the effects of afterpulsing. However, due to 5% of the pixels that are non-functional, a certain level of redundancy must always be added and thus the measured and theoretical curves (before and after de-biasing) do not perfectly overlap. 792

6 TABLE I : Comparison of the proposed TRNG performance and the state-of-the-art. *) The area refers to the active core. **) Data not available. Measure Min Typ Max Unit Reference This work [13] [5] [12] [8] [11] [4] Raw Throughput Gb/s Temp. Range ** ** ** ** ** ** C Vdd N/A N/A N/A N/A N/A N/A V Excess Bias N/A N/A N/A N/A N/A N/A V LED Pulse Length N/A N/A N/A N/A N/A N/A ns LED Duty Cycle N/A N/A N/A N/A N/A N/A % Power 500 ** 1.9 ** 29 ** ** mw Area 7.7 ** ** ** ** mm Energy/bit 25 ** 950 ** 725 ** ** pj/bit Technology 0.35μm Custom SiN CMOS 0.35μm Custom Custom CMOS (InGaAs) MOSFET (FPGA) CMOS TABLE II : Results of the NIST tests applied to a sequence generated with a LED pulse length of 100ns and an excess bias voltage of 2.8V. The tests were run on the data from the de-biasing filter. Test Accept Von Pass / Threshold Neumann No Pass Frequency Y BlockFrequency Y CumulativeSum Y Runs Y LongestRun Y Rank Y FFT Y NonOverlapping Y Template Universal Y ApproximateEntropy Y RandomExcursion Y RandomExcursion Y Variant Serial Y LinearComplexity Y V. CONCLUSION In this paper we explored the use of SPADs as security building block, focusing in particular on the scalability of one of the most appealing applications for quantum CMOS: true random number generation. In particular, we discussed the two coupled matrices each consisting of 512x128 independent cells that convert photons onto a raw bit-stream. This TRNG is characterized by a very high level of randomness. The performance is measured on a device manufactured in standard CMOS process. Measurements show that our architecture can reach up to 5 Gbit/s while consuming 25pJ/bit. Our results prove the scalability and performance for any random number generators based on SPADs, while achieving the lowest power consumption to date. VI. ACKNOWLEDGEMENTS The authors are grateful to Xilinx for providing the FPGAs used in the readout system. This work has been partially supported by the Swiss NCCR-QP, NCCR-QSIT, NCCR-MICS, Swiss Experiment, and EMRP (project IND06-MIQC). The EMRP is jointly funded by the EMRP participating countries within EURAMET and the European Union REFERENCES [1] S. Burri, D. Stucki, Y. Maruyama, C. Bruschini, E. Charbon, and F. Regazzoni. Jailbreak Imagers: Transforming a Single-Photon Image Sensor into a True Random Number Generator. In International Image Sensors Workshop, Snowbird Resort, Utah, USA, June [2] S. Cova, A. Longoni, and A. A. Towards picosecond resolution with single-photon avalanche diodes. Rev. Sci. Instrum., 52: , [3] M. Fishburn. Fundamentals of CMOS Single-Photon Avalanche Diodes. PhD Thesis. TU Delft, Sep [4] I. Kanter, Y. Aviad, I. Reidler, E. Cohen, and M. Rosenbluh. An Optical Ultrafast Random Bit Generator. Nature Photonics, 4:58 61, [5] M. Matsumoto, S. Yasuda, R. Ohta, K. Ikegami, T. Tanamoto, and S. Fujita. 1200μm 2 Physical Random- Number Generators Based on SiN MOSFET for Secure Smart-Card Application. In IEEE International Solid- State Circuits Conference, ISSCC Proceedings of the, pages , Feb [6] R. J. McIntyre. Recent developments in silicon avalanche photodiodes. Measurment, 3:6, [7] C. L. Niclass. Single-Photon Image Sensors in CMOS: Picosencond Resolution for Three-Dimensional Imaging, volume 4161 of PhD Thesis. Ecole Polytechnique Fdrale de Lausanne (EPFL),

7 [8] F. Pareschi, G. Setti, and R. Rovatti. Implementation and Testing of High-Speed CMOS True Random Number Generators Based in Chaotic Systems. In IEEE Trans. Circ. & Sys., volume 57 I(12), pages , Oct [9] A. Rochas, M. Gosch, A. Serov, P. A. Besse, R. S. Popovic, T. Lasser, and R. Rigler. First fully integrated 2-D array of single-photon detectors in standard CMOS technology. IEEE Photonics Technology Letters, 15: , Jul [10] C. Veerappan, J. Richardson, R. Walker, D.-U. Li, M. W. Fishburn, Y. Maruyama, D. Stoppa, F. Borghetti, M. Gersbach, R. K. Henderson, and E. Charbon. A 160x128 single-photon image sensor with on-pixel 55ps 10b time-to-digital converter. In IEEE International Solid-State Circuits Conference, ISSCC Proceedings of the, pages , Feb [11] W. Wei, G. Xie, A. Dang, and H. Guo. High-Speed and Bias-Free Optical Random Number Generator. Photonics Technology Letters, 24(6): , June [12] K. Wold and S. Petrovic. Optimizing Speed of a True Random Number Generator in FPGA by Spectral Analysis. ICCIT, pages , Nov [13] F. Xu, B. Qi, X. Ma, H. Xu, H. Zheng, and H.-K. Lo. Ultrafast Quantum Random Number Generation based on Quantum Phase Fluctuations. Optics Express, 20(11): , Nov