TW202147097A - Physical unclonable function based true random number generator and method for generating true random numbers - Google Patents

Abstract

A Physical Unclonable Function (PUF) based true random number generator (TRNG) and a method for generating true random numbers are provided. The PUF based TRNG may include a first obfuscation circuit, a cryptography circuit coupled to the first obfuscation circuit, and a second obfuscation circuit coupled to the cryptography circuit. The first obfuscation circuit obtains a first PUF value from a PUF pool of the electronic device, and performs a first obfuscation function on a preliminary seed based on the first PUF value to generate a final seed. The cryptography circuit utilizes the final seed as a key of a cryptography function to generate preliminary random numbers. The second obfuscation circuit obtains a second PUF value from the PUF pool, and performs a second obfuscation function on the preliminary random numbers based on the second PUF value to generate final random numbers.

Description

A true random number generator based on a physically unreproducible function and a method for generating true random numbers

The present invention relates to a true random number generator, especially a true random number generator based on a physical non-reproducible function and a method for generating true random numbers.

The physical non-reproducible function can be regarded as the fingerprint on the wafer. Since the physical characteristics of different wafers will be slightly different due to some uncontrollable factors in the manufacturing process, these differences cannot be reproduced or predicted, so they can be used as Static entropy value for information security related applications. In some related technologies, the physical non-replicable function pool requires storage space in the electronic device. In particular, in order to improve the randomness of the output value based on the physical non-replicable function, the required hardware resources will also increase accordingly. Therefore, there is a need for a novel architecture and related methods to improve the output randomness of physically non-reproducible function based true random number generators with no or less side effects.

Therefore, the object of the present invention is to provide a true random number generator based on a physical non-replicable function and a method for generating a true random number, so as to improve the true random number based on the physical non-replicable function without greatly increasing the overall hardware cost. The overall performance of the random number generator.

At least one embodiment of the present invention provides a true random number generator based on a Physical Unclonable Function (PUF) for an electronic device. The physically non-replicable function-based true random number generator may include a first obfuscation circuit, a cryptography circuit coupled to the first obfuscation circuit, and a second cryptography circuit coupled to the cryptographic circuit Obfuscated circuit. The first obfuscation circuit is used to obtain a first physical non-replicable function value from a physical non-replicable function pool of the electronic device, and perform a first obfuscation function on a preliminary seed based on the first physical non-replicable function value to produces a final seed. The cryptographic circuit is used for generating a preliminary random number sequence using the final seed as a key for a cryptographic function. The second obfuscation circuit is used to obtain a second physical non-replicable function value from the physical non-replicable function pool, and perform a second obfuscation function on the preliminary random number sequence based on the second physical non-replicable function value to generate a The final random number sequence.

At least one embodiment of the present invention provides a method for generating true random numbers, wherein the method is applicable to an electronic device. The method may include: using a first obfuscation circuit to perform a first obfuscation function on a preliminary seed based on a first physical non-reproducible function value to generate a final seed; using a cryptographic circuit to treat the final seed as the result of a cryptographic function a key to generate a preliminary random number sequence; and using a second obfuscation circuit to perform a second obfuscation function on the preliminary random number sequence based on a second physical non-copyable function value to generate a final random number sequence. Especially, the first physical non-replicable function value and the second physical non-replicable function value are obtained from a physical non-replicable function pool of the electronic device.

The physical non-replicable function-based true random number generator and related methods provided by the embodiments of the present invention can have various characteristics such as cryptographic functions (such as good security, and good pseudo-randomness), dynamic entropy (such as providing "live" "live" entropy to the system, especially the electronic device) and static entropy (such as physical non-reproducible functions, which can be viewed as fingerprints on the chip) to improve overall performance. Therefore, embodiments of the present invention can improve the security and output randomness of a true random number generator based on a physically non-replicable function with no or less side effects.

FIG. 1 is a schematic diagram of an electronic device 10 according to an embodiment of the present invention, wherein the electronic device 10 may include a Physical Unclonable Function (PUF) pool 15 and a base coupled to the PUF pool 15 True random number generator 100 for PUF. As shown in FIG. 1, the PUF-based true random number generator 100 may include a first obfuscation circuit such as obfuscation circuit 110, a cryptography circuit 120, and a second obfuscation circuit such as obfuscation circuit 130, The encryption circuit 120 is coupled to the obfuscation circuit 110 , and the obfuscation circuit 130 is coupled to the encryption circuit 120 . In this embodiment, the obfuscation circuit 110 can obtain a first PUF value such as the PUF value PUF1 from the PUF pool 15 and perform a first obfuscation function on a preliminary seed based on the PUF value PUF1 to generate a final seed SEED _FINAL . The cryptographic circuit 120 can be used to generate a preliminary random number sequence {RN _PRE } _{using the final seed SEED FINAL as a key for a cryptographic function.} For example, the cryptographic circuit 120 may perform cryptographic algorithms of DES, AES, RSA or MD5. The obfuscation circuit 130 can obtain a second PUF value such as the PUF value PUF2 from the PUF pool 15 and _{perform a second obfuscation function on the preliminary random number sequence {RN PRE} } based on the PUF value PUF2 to generate a sequence of final random numbers {RN _FINAL } , wherein each random number in the final random number sequence {RN _FINAL } can be used as an output random number of the PUF-based true random number generator 100 when needed.

In this embodiment, the PUF-based true random number generator 100 may further include an entropy circuit 140 for providing an entropy seed such as a dynamic entropy seed SEED _DYN as the preliminary seed. For example, the entropy circuit 140 may include at least one oscillator for outputting a plurality of random unit cell values. Specifically, the oscillator can generate a periodic signal, the periodic signal varies between a logic value "0" and a logic value "1" at an oscillation frequency, and the value of the periodic signal is a is sampled at a sampling frequency (eg, by a sampler built at the output terminal of the oscillator, where the sampler is controlled by the sampling frequency) to output the plurality of random unit values, wherein the sampled The frequency is different from the oscillation frequency (eg, the sampling frequency can be lower than the oscillation frequency). Due to some factors such as temperature, noise, etc., the logic value "1" and the logic value "0" generated by the periodic signal will be sampled in a random manner, so that the logic value "1" and the logic value "0" occurs randomly among the plurality of random unit cell values. In addition, the physical properties of different wafers may vary slightly due to some uncontrollable factors in the manufacturing process. These differences cannot be replicated or predicted, and the differences will be reflected in the PUF value in the PUF pool 15 of the electronic device 10. (eg PUF1 and PUF2). Therefore, these PUF values can be considered as fingerprints on the wafer, and in this embodiment these PUF values provide static entropy. In some embodiments, the first PUF value may be different from the second PUF value (eg, PUF1 ≠ PUF2).

In order to determine whether a random number sequence is available, the random number sequence needs to pass certain test items defined by the National Institute of Standards and Technology (NIST)-800-22. Although the dynamic entropy seed SEED _DYN generated based on an oscillator seed has a certain degree of randomness, the dynamic entropy seed SEED _DYN may still fail to pass all the test items of NIST-800-22. For example, dynamic entropy SEED _DYN might pass the binary matrix rank test, the non-overlapping template matching test, the linear complexity test, and the random offset mutation test ( random excursion variant test), but may fail frequency tests such as monobit test, frequency within a block test, runs test, longest running time in block test (longest run ones in a block test), discrete Fourier transform tests such as discrete Fourier transform spectral test, Overlapping template matching test, Mayuer general statistics Tests (Maurer's statistical universal test), serial test (serial test), approximate entropy test, cumulative sums test (cumulative sums test) and random excursion test (random excursion test). However, after processing by the obfuscation circuit 110 and the encryption circuit 120, the preliminary random number sequence {RN _PRE } can pass all the above-mentioned test items. The frequency (unit) test is used to detect whether the probabilities of "0" and "1" are close to each other, and the serial test is used to detect whether the longest continuous "0" and the longest continuous "1" are reasonable ( For example, if it is below a predetermined threshold), the non-overlapping template matching test is used to detect whether the repeated pattern of a random number sequence is reasonable (for example, to determine whether the pattern repeats regularly or randomly). Since these test items are defined in the well-known NIST-800-22 standard, those with ordinary knowledge in the art should understand the meaning of these test items, and the relevant details are not repeated here for brevity.

In this embodiment, any (eg, each) of the first obfuscation function and the second obfuscation function may include addition arithmetic (eg, addition), multiplication (eg, multiplication), permutation, Substitution, one-way function, encryption, or a combination thereof. For example, any (eg, each) of obfuscation circuits 110 and 130 may be an exclusive-OR (XOR) logic circuit to implement an additive arithmetic function. Those skilled in the art should understand how to implement logic circuits corresponding to the other types of obfuscation functions mentioned above, and the related details are not repeated here for the sake of brevity. In some embodiments, the first obfuscation function may be the same as the second obfuscation function (eg, obfuscation circuits 110 and 130 may be implemented by the same type of logic circuits). In some embodiments, the first obfuscation function may be different from the second obfuscation function (eg, obfuscation circuits 110 and 130 may be implemented by different types of logic circuits). When each of the obfuscation circuits 110 and 130 are mutually exclusive OR logic circuits, the obfuscation circuit 110 _{performs a mutually exclusive OR operation on the dynamic entropy seed SEED DYN} and the PUF value PUF1 to generate the final seed SEED _FINAL , while the obfuscation circuit 130 performs an exclusive OR operation on the initial seed SEED FINAL . The random number sequence {RN _PRE } is mutually exclusive ORed with the PUF value PUF2 to generate the final random number sequence {RN _FINAL }.

In one embodiment, the obfuscation circuit 110 may concatenate the preliminary seeds such as the dynamic entropy seed SEED _DYN and the PUF value PUF1, eg, by sequentially arranging the dynamic entropy seed SEED _DYN and the PUF value PUF1, to generate the final Seed SEED _FINAL . For example, assuming that the dynamic entropy seed SEED _DYN is an M-bit value and the PUF value PUF1 is an N-bit value, the obfuscation circuit 110 may use the dynamic entropy seed SEED _DYN as the first M bits of the final seed SEED _{FINAL and add another} after the final PUF value PUF1 seed sEED _fINAL as the N bits to produce the final seed sEED _fINAL M + N bits.

In one embodiment, the cryptographic function may include a cipher function (eg, a stream cipher such as Trivium cipher) or a hash function. When a specific key (eg, the final seed SEED _FINAL ) is input to the cryptographic circuit 120 , a corresponding bit stream is output with good security and good pseudo-randomness. If the key is constant every time the electronic device 10 is turned on, the corresponding bit stream will also be constant every time. To further improve security and randomness, the key used by the cryptographic circuit 120 may be dynamic. Since the final seed SEED _FINAL is generated based on the dynamic entropy seed SEED _DYN and the PUF value PUF1, the preliminary random number sequence {RN _PRE } can have the benefit of using the dynamic entropy seed and the PUF value PUF1, thereby improving security and randomness. Furthermore, even if the cryptographic function is implemented by well-known methods or standards, it is still difficult for those skilled in the art to _{backtrack from the final random number sequence {RN FINAL} } to decipher the cryptographic function, because The final output (ie {RN _FINAL }) is generated by the obfuscation circuit 130 based on the unpredictable PUF value PUF2. Therefore, the security performance of the final random number sequence {RN _{FINAL } is further improved.} It should be noted that the cryptographic function is not limited to a specific type of cryptographic function, and some well-known algorithms can also be used for the cryptographic function of the present invention.

2 is a schematic diagram of an electronic device 20 according to an embodiment of the present invention, wherein the electronic device 20 may include a PUF pool 15 and a PUF-based true random number generator 200 coupled to the PUF pool 15 . The embodiment of FIG. 2 is similar to that of FIG. 1, but the main difference is that the PUF-based true random number generator 200 may include a non-volatile memory (NVM) 150 (marked as "NVM" for simplicity) is used to provide the preliminary seed, especially a non-volatile memory seed (NVM seed for short) SEED _NVM stored in the non-volatile memory 150 is provided as the preliminary seed. In addition, a feedback random number can be written into the non-volatile memory 150 at one or more predetermined time points to update the NVM seed SEED _NVM stored in the non-volatile memory 150 . In one embodiment, the feedback random number can be obtained from a preliminary random number sequence {RN _PRE }, as shown in FIG. 2 . In another embodiment, the feedback random number can be obtained from the final random number sequence {RN _FINAL }, as shown in FIG. 3 . Similar to the embodiment of FIG. 1 _{, each random number in the final random number sequence {RN FINAL} } can be used as an output random number of the PUF-based true random number generator 200 when needed.

_{It should be noted that the time point of updating the NVM seed SEED NVM} stored in the non-volatile memory 150 is not a limitation of the present invention. For example, the feedback random number can be the first random number of the preliminary random number sequence {RN _PRE } or the final random number sequence {RN _FINAL } after the electronic device 20 is powered on, and once the first random number is generated, the first random number is generated. A random number can be written into the non-volatile memory 150 . For another example, the feedback random number can be written into the non-volatile memory 150 every predetermined time interval to update the NVM seed SEED _NVM . For another example, when the electronic device 20 receives a shutdown command, the feedback random number may be _{the latest random number of the preliminary random number sequence {RN PRE} } or the final random number sequence {RN _FINAL } after the electronic device 20 is powered on, and the The latest random number can be written to the non-volatile memory 150 to update the NVM seed SEED _NVM before the electronic device 20 is turned off.

FIG. 4 is a schematic diagram of an electronic device 40 according to an embodiment of the present invention. As shown in FIG. 4 , the electronic device 40 may include a PUF pool 15 and a PUF-based true random number generator 400 coupled to the PUF pool 15 , wherein the PUF-based true random number generator 400 can be regarded as FIG. 1 A combination of the PUF-based true random number generator 100 shown, the PUF-based true random number generator 200 shown in any of Figures 2 and 3, and one or more additional circuits. Specifically, the PUF-based true random number generator 400 may include the obfuscation circuit 110 , the encryption circuit 120 , the obfuscation circuit 130 , the entropy circuit 140 and the non-volatile memory 150 mentioned in the above embodiments, and may further include a Test circuits such as a health test circuit 160 and a multiplexer (MUX) 170 (labeled as "MUX" in the figure for simplicity). In this embodiment, the health test circuit 160 is coupled to the entropy circuit 140 , and the multiplexer 170 is coupled to the entropy circuit 140 , the non-volatile memory 150 and the health test circuit 160 . For example, the health test circuit 160 can be used to test the dynamic entropy seed SEED _DYN (or any data/signal related to the operation of the entropy circuit 140 ) to generate a test result TEST, especially the health test circuit 160 is used to test the health of the dynamic entropy seed SEED _DYN The multiplexer 170 can be used to _{select one of the dynamic entropy seed SEED DYN} and the NVM seed SEED _NVM according to the test result TEST to be output to the obfuscation circuit 110 as the preliminary seed (eg SEED _{PRE ).}

Specifically, when the test result TEST indicates that the entropy circuit 140 is in a healthy state, the multiplexer 170 may select the dynamic entropy seed SEED _DYN as the preliminary seed SEED _PRE , and when the test result TEST indicates that the entropy circuit 140 is in a non-healthy state state, the multiplexer 170 may select the NVM seed SEED _NVM as the preliminary seed SEED _PRE . For example, the health test circuit 160 can collect a certain number of random unit cell values from the oscillator in the entropy circuit 140 every predetermined time interval as a set of data. If the health test circuit 160 detects that the coverage of the logical value "0" (or the logical value "1") in a set of data falls within a predetermined range (eg, from 20% to 80%), the health test circuit 160 may A test result TEST with a first logic state (eg, "0") is output to indicate that the entropy circuit 140 is "healthy" and the multiplexer 170 may select the dynamic entropy seed SEED _DYN as the preliminary seed SEED _PRE . If the health test circuit 160 detects that the coverage of the logical value "0" (or the logical value "1") in a set of data does not fall within the predetermined range (eg, greater than a predetermined upper limit such as 80% or less than a predetermined lower limit such as 20%), the health test circuit 160 may output a test result TEST with a second logic state (eg, "1") to indicate that the entropy circuit 140 is "unhealthy," and the multiplexer 170 may select the NVM seed SEED _NVM as preliminary seed SEED _PRE . It should be noted that the detailed operation related to the above at least one test is only for the purpose of illustration, and is not a limitation of the present invention. For example, one or more of the test items defined by the NIST-800-22 standard can also be used in the above. At least one test.

In some cases, either the entropy circuit 140 and the non-volatile memory 150 are at risk of being hacked/hacked or destroyed from outside the electronic device 40, resulting in security concerns. Since the obfuscation circuit 110 has two sources for obtaining the preliminary seed SEED _PRE , if one of the entropy circuit 140 and the non-volatile memory 150 is hacked/hacked or corrupted, the other can take its place and provide the preliminary seed SEED _PRE . Therefore, the robustness and security performance of the PUF-based true random number generator 400 are improved.

In some embodiments, the health test circuit 160 can be omitted, and the multiplexer 170 can _{select one of the dynamic entropy seeds SEED DYN} and NVM seeds SEED _{NVM in} response to another control signal to be output as a preliminary seed SEED _PRE , wherein the control signal can be obtained from outside the electronic device 40 . For example, by controlling the logic state of the control signal, the user can manually control the multiplexer 170 to select one of the dynamic entropy seeds SEED _DYN and the NVM seed SEED _NVM to be output as the preliminary seed SEED _PRE , and the health test The circuit 160 may be omitted, but the present invention is not limited thereto.

FIG. 5 is a schematic diagram of an electronic device 50 according to an embodiment of the present invention. As shown in FIG. 5 , the electronic device 50 may include a PUF pool 15 and a PUF-based true random number generator 500 coupled to the PUF pool 15 , wherein the PUF-based true random number generator 500 may be regarded as the first An example of the PUF-based true random number generator 400 is shown in FIG. 4, and the health test circuit 160 is not shown in FIG. 5 for simplicity. Specifically, FIG. 5 illustrates the implementation details of the entropy circuit 140 . In this embodiment, the entropy circuit 140 may include an oscillator 141 , and a collection circuit such as a selective entropy collector 145 coupled to the oscillator 141 , wherein the oscillator 141 may be used to output a random control bit SEL (eg, each of the plurality of random unit values described above), and the selective entropy collector 145 can decide whether to update the dynamic entropy seed SEED _{DYN by means of a feedback random number RN FB in response to the random control bit SEL} . In the embodiment of FIG. 5, the feedback random number RN _FB is obtained from the final random number sequence {RN _FINAL }, but the present invention is not limited to this. In some embodiments, the feedback random number RN _FB is obtained from the preliminary random number sequence {RN _PRE }, but the present invention is not limited thereto. In detail, the selective entropy collector 145 may include a third obfuscation circuit such as the exclusive OR logic circuit 142 (labeled "XOR" in the figure for simplicity), coupled to the oscillator 141 and the exclusive OR logic circuit A multiplexer 143 of 142 (labeled "MUX" in the figure for simplicity), and an entropy collector 144 coupled to the multiplexer 143 and the exclusive OR logic circuit 142 . For example, the third obfuscation circuit such as the mutex OR logic circuit 142 can be used to perform a third obfuscation function such as a mutex OR operation on the dynamic entropy seed SEED _{DYN based on the feedback random number RN FB to generate an updated entropy seed, and more} The processor 143 can be used to select one of the entropy seed before the update (ie the entropy seed from the output of the entropy collector 144 ) and the entropy seed after the update in response to the random control bit SEL to output a newest entropy seed (eg dynamic entropy seed). The latest version of the entropy seed SEED _DYN). In addition, the entropy collector 144 can receive and output the latest entropy seed as the dynamic entropy seed SEED _DYN , and the dynamic entropy seed SEED _DYN is a feedback entropy seed to be sent to the multiplexer 143 and the exclusive OR logic circuit 142 . Therefore, the mutually exclusive OR logic circuit 142 performs the mutually exclusive OR operation to generate the updated entropy seed (which is _{the mutually exclusive OR result of the dynamic entropy seed SEED DYN} and the feedback random number RN _FB ), and the multiplexer 143 may The control bit SEL outputs the updated entropy seed or the dynamic entropy seed SEED _DYN before the update to the entropy collector 144, wherein the entropy collector 144 can be implemented by a flip-flop, but the present invention is not limited thereto . Since the random control bit SEL is randomly switched between logic states "0" and "1", the operation of updating the dynamic entropy seed SEED _DYN can be performed randomly. For example, when the random control bit SEL is "0", the dynamic entropy seed SEED _DYN will not change; and when the random control bit SEL is "1", the dynamic entropy seed SEED _DYN will be updated. It should be noted that the mutually exclusive OR logic circuit 142 does not limit the implementation of the third obfuscation circuit, _{and any logic circuit capable of changing the dynamic entropy seed SEED DYN} belongs to the scope of the present invention.

In the embodiment of FIG. 5, when the multiplexer 170 selects the NVM seed SEED _NVM and the multiplexer 143 selects the updated entropy seed, the dynamic entropy seed SEED _DYN can be generated from the NVM seed SEED _NVM. In detail, when the multiplexer 170 selects the NVM seed SEED _NVM as the preliminary seed SEED _PRE , the feedback random number RN _FB is generated according to the preliminary seed SEED _PRE (indicating that the feedback random number RN _FB is generated according to the NVM seed SEED _NVM ), and The mutually exclusive OR logic circuit 142 generates the mutually exclusive OR result _{according to the feedback random number RN FB.} Next, the multiplexer 143 outputs the mutually exclusive OR result as the updated entropy seed, and since the updated entropy seed is _{generated according to the NVM seed SEED NVM} , the entropy collector 144 can generate the dynamic entropy seed _{according to the NVM seed SEED NVM} SEED _DYN .

In addition, the embodiment of FIG. 5 does not limit the present invention. In some embodiments, the entropy circuit 140 shown in FIGS. 1 and 4 may be implemented with different architectures. For example, entropy circuit 140 may include an oscillator and a collection circuit coupled to the oscillator, wherein the oscillator may be used to output a plurality of random unit values, and the collection circuit may be used to collect the random unit values to generate The dynamic entropy seed SEED _DYN (eg, by concatenating, such as sequentially arranging, a predetermined number of random identity values from the random identity values to generate the dynamic entropy seed SEED _DYN ), but the invention is not limited thereto.

Furthermore, each final random number in the final random number sequence {RN _FINAL } is preferably transmitted to only one object. For example, the PUF-based true random number generator 500 may further include a de-multiplexer (DEMUX) 180 (labeled "DEMUX" in the figure for brevity) coupled to the obfuscation circuit 130 . In this embodiment, the final random number sequence {RN _FINAL } may have three possible paths, including a first path for providing an output random number to the outside of the PUF-based true random number generator 500, a second path The signal path is used to update the NVM seed SEED _NVM , and a third signal path is used to update the dynamic entropy seed SEED _DYN , wherein the demultiplexer 180 controls only one of these signal paths to be enabled at a single point in time ( enabled). Therefore, any single final random number obtained from the final random number sequence {RN _FINAL } will not be reused by different elements, thus ensuring the security of the PUF-based true random number generator 500 . For example, the first final random number of the final random number sequence {RN _FINAL } after the electronic device 50 is powered on can be preset to be written into the non-volatile memory 150 (for example, the second signal path after the electronic device 50 is powered on will be enabled in the first operating cycle); then, after the NVM seed SEED _NVM stored in the non-volatile memory 150 is updated, the second signal path will be disabled and the third signal path will be disabled. The signal path is enabled; and the first signal path is enabled only when another element in the electronic device 50 requests to follow the random number. It should be noted that the above-mentioned scheduling of enabling the first signal path, the second signal path, and the third signal path is only for the purpose of illustration, and does not limit the present invention.

FIG. 6 is a workflow of a method for generating true random numbers according to an embodiment of the present invention, wherein the method is applicable to an electronic device such as the electronic device shown in FIGS. 1 to 5 Devices 10 , 20 , 40 and 50 . It should be noted that, the work flow shown in FIG. 6 is only for the purpose of illustration, rather than limiting the present invention. As long as it does not affect the overall result, one or more steps may be added, deleted or modified in the workflow shown in FIG. 6, and these steps do not have to be performed in exactly the order shown in FIG. 6.

In step 610 , the obfuscation circuit 110 obtains a first PUF value (eg, PUF1 ) from the PUF pool 15 .

_{In step 620, the obfuscation circuit 110 performs a first obfuscation function on a preliminary seed (eg SEED PRE} ) based on the first PUF value (eg PUF1 ) to generate a final seed (eg SEED _FINAL ).

At step 630, the cryptographic circuit 120 uses the final seed (eg, SEED _FINAL ) as a key for a cryptographic function to generate a preliminary random number sequence (eg, {RN _PRE }).

At step 640 , the obfuscation circuit 130 obtains a second PUF value (eg, PUF2 ) from the PUF pool 15 .

At step 650, the obfuscation circuit 130 performs a second obfuscation function (eg, mutual exclusive OR) on the preliminary random number sequence (eg, {RN _{PRE }) based on the second PUF value (eg, PUF2) to generate a final random number sequence (} e.g. {RN _FINAL }).

The PUF-based true random number generator and the related method of the present invention can control the related operations in combination with the cryptographic function, the characteristics of dynamic entropy and static entropy. In addition, the present invention can reduce the size requirement of the PUF pool without reducing randomness and security. Therefore, the present invention can improve the overall performance of a PUF-based true random number generator with no or less side effects. The above descriptions are only preferred embodiments of the present invention, and all equivalent changes and modifications made according to the scope of the patent application of the present invention shall fall within the scope of the present invention.

10, 20, 40, 50: electronic device 15: physical non-replicable function pool 100, 200, 400, 500: true random number generator based on physical non-replicable function pool 110: obfuscation circuit 120: cryptographic circuit 130: obfuscation circuit 140 : Entropy Circuit 141: Oscillator 142: Mutually Exclusive OR Logic Circuit 143: Multiplexer 144: Entropy Collector 145: Selective Entropy Collector 150: Non-Volatile Memory 160: Health Test Circuit 170: Multiplexer 180: Demultiplexer PUF1, PUF2: Physical non-reproducible function value SEED _DYN : Dynamic entropy seed SEED _NVM : Non-volatile memory seed SEED _PRE : Preliminary seed SEED _FINAL : Final seed {RN _PRE }: Preliminary random number sequence {RN _FINAL }: Final random number sequence TEST: Test results 610, 620, 630, 640, 650: Steps

FIG. 1 is a schematic diagram of an electronic device according to an embodiment of the present invention. FIG. 2 is a schematic diagram of an electronic device according to an embodiment of the present invention. FIG. 3 is a schematic diagram of an electronic device according to another embodiment of the present invention. FIG. 4 is a schematic diagram of an electronic device according to an embodiment of the present invention. FIG. 5 is a schematic diagram of an electronic device according to an embodiment of the present invention. FIG. 6 is a workflow of a method for generating a true random number according to an embodiment of the present invention.

10: Electronics

15: Physical non-replicable function pool

100: True random number generator based on a pool of physically non-replicable functions

110: Obfuscation circuit

120: Cryptographic Circuits

130: Obfuscation circuit

140: Entropy Circuits

PUF1, PUF2: Physical non-copyable function values

SEED _DYN : Dynamic Entropy Seed

SEED _FINAL : Final Seed

{RN _PRE }: Preliminary random number sequence

{RN _FINAL }: final random number sequence

Claims (20)

A true random number generator based on a Physical Unclonable Function (PUF) for an electronic device, the true random number generator based on the Physical Unclonable Function comprising: a first obfuscation circuit for obtaining a first physical non-replicable function value from a physical non-replicable function pool of the electronic device, and performing a first Obfuscation function to generate a final seed; a cryptography circuit, coupled to the first obfuscation circuit, for generating a preliminary random number sequence using the final seed as a key for a cryptographic function; and a second obfuscation circuit, coupled to the encryption circuit, for obtaining a second physical non-replicable function value from the physical non-replicable function pool, and performing a random number sequence on the preliminary random number sequence based on the second physical non-replicable function value A second obfuscation function to generate a final random number sequence. The true random number generator based on physical non-replicable function as described in claim 1, wherein the first obfuscation circuit concatenates the preliminary seed and the first physical non-replicable function value to generate the final seed. The true random number generator based on the physical non-replicable function as described in item 1 of the claimed scope, wherein the true random number generator based on the physical non-replicable function further comprises an entropy circuit to provide the preliminary seed, and This entropy circuit contains: an oscillator for outputting a plurality of random unit cell values; and a collection circuit for collecting the plurality of random unit cell values to generate the preliminary seed. The true random number generator based on the physical non-replicable function as described in item 1 of the scope of the patent application, wherein the true random number generator based on the physical non-replicable function further comprises a non-volatile memory (NVM) ) to provide the preliminary seed, wherein a feedback random number is written into the non-volatile memory at one or more predetermined time points to update the preliminary seed stored in the non-volatile memory, and the feedback random number is automatically The preliminary random number sequence or the final random number sequence is obtained. The true random number generator based on the physical non-replicable function as described in item 1 of the scope of the application, wherein the true random number generator based on the physical non-replicable function further comprises: an entropy circuit for providing an entropy seed; A non-volatile memory for providing a non-volatile memory seed, wherein a feedback random number is written into the non-volatile memory at one or more predetermined time points to be updated and stored in the non-volatile memory the non-volatile memory seed and the feedback random number are obtained from the preliminary random number sequence or the final random number sequence; a test circuit, coupled to the entropy circuit, for testing the entropy seed to generate a test result; and a multiplexer, coupled to the entropy circuit, the non-volatile memory and the test circuit, for selecting one of the entropy seed and the non-volatile memory seed according to the test result for outputting the Preliminary seeds. The true random number generator based on physical non-replicable function as described in item 5 of the scope of the patent application, wherein the test circuit performs a health level test on the entropy seed, when the test result indicates that the entropy circuit is in a healthy state , the multiplexer selects the entropy seed as the preliminary seed, and when the test result indicates that the entropy circuit is in a non-healthy state, the multiplexer selects the non-volatile memory seed as the preliminary seed. The true random number generator based on the physical non-replicable function as described in claim 1, wherein the true random number generator based on the physical non-replicable function further comprises an entropy circuit to provide an entropy seed, and the entropy circuit Include: an oscillator for outputting a random control bit; and a collection circuit coupled to the oscillator, wherein the collection circuit determines whether to update the entropy seed by means of a feedback random number in response to the random control bit, and the feedback random number is from the preliminary random number sequence or the The final random number sequence is obtained. The true random number generator based on physical non-replicable function as described in item 7 of the scope of the application, wherein the collection circuit comprises: a third obfuscation circuit for performing a third obfuscation function on the entropy seed based on the feedback random number to generate an updated entropy seed; and A first multiplexer, coupled to the oscillator, selects one of the entropy seed before updating and the entropy seed after updating according to the random control bit to output a newest entropy seed. The true random number generator based on the physical non-replicable function as described in item 8 of the scope of the patent application, wherein the true random number generator based on the physical non-replicable function further comprises: a non-volatile memory for providing a non-volatile memory seed, wherein the feedback random number is written into the non-volatile memory at one or more predetermined time points to update the non-volatile memory the non-volatile memory seed in the; and a second multiplexer, coupled to the non-volatile memory and the collection circuit, for selecting one of the non-volatile memory seed and the entropy seed as the preliminary seed; When the second multiplexer selects the non-volatile memory seed, the feedback random number is generated based on the non-volatile memory seed, and the updated entropy seed is generated based on the feedback random number. The true random number generator based on the physical non-replicable function as described in item 1 of the claimed scope, wherein the true random number generator based on the physical non-replicable function further comprises an entropy circuit for providing the preliminary seed, and the An entropy circuit contains at least: an oscillator for outputting a plurality of random unit values, wherein the oscillator generates a periodic signal, and the periodic signal varies between a first logic value and a second logic value at an oscillation frequency, and the periodic signal is sampled at a sampling frequency so that the first logic value and the second logic value randomly appear in the plurality of random unit values; Wherein the sampling frequency is different from the oscillation frequency. A method for generating true random numbers, applicable to an electronic device, comprising: Using a first obfuscation circuit to perform a first obfuscation function on a preliminary seed based on a first Physical Unclonable Function (PUF) value to generate a final seed; Using a cryptography circuit to use the final seed as a key for a cryptographic function to generate a preliminary random number sequence; and Using a second obfuscation circuit to perform a second obfuscation function on the preliminary random number sequence based on a second physical non-replicable function value to generate a final random number sequence; The first physical non-replicable function value and the second physical non-replicable function value are obtained from a physical non-replicable function pool of the electronic device. The method of claim 11, wherein using the first obfuscation circuit to perform the first obfuscation function on the preliminary seed based on the first physical non-reproducible function value to generate the final seed comprises: The preliminary seed is concatenated with the first physical non-replicable function value using the first obfuscation circuit to generate the final seed. The method described in Item 11 of the scope of the application further includes: generating a plurality of random unit cell values; and The preliminary seed is obtained according to the plurality of random unit element values. The method described in Item 11 of the scope of the application further includes: The preliminary seed is obtained from a non-volatile memory (NVM) in which a feedback random number is written into the non-volatile memory at one or more predetermined time points to update the storage in the non-volatile memory The preliminary seed in vivo and the feedback random number are obtained from the preliminary random number sequence or the final random number sequence. The method described in Item 11 of the scope of the application further includes: Obtain an entropy seed from an entropy circuit; A non-volatile memory seed is obtained from a non-volatile memory, wherein a feedback random number is written into the non-volatile memory at one or more predetermined time points to update the non-volatile memory stored in the non-volatile memory the volatile memory seed, and the feedback random number is obtained from the preliminary random number sequence or the final random number sequence; testing the entropy seed with a test circuit to generate a test result; and A multiplexer is used to select one of the entropy seed and the non-volatile memory seed in response to the test result for output as the preliminary seed. The method of claim 15, wherein the testing circuit performs a health test on the entropy seed, and the step of selecting one of the entropy seed and the non-volatile memory seed comprises: When the test result indicates that the entropy circuit is in a healthy state, selecting the entropy seed as the preliminary seed; and When the test result indicates that the entropy circuit is in a non-healthy state, the non-volatile memory seed is selected as the preliminary seed. The method described in Item 11 of the scope of the application further includes: generating a random control bit; and The random control bit determines whether to update an entropy seed by means of a feedback random number obtained from the preliminary random number sequence or the final random number sequence. The method of claim 17, wherein the step of determining whether to update the entropy seed by means of the feedback random number in response to the random control bit comprises: performing a third obfuscation function on the entropy seed based on the feedback random number to generate an updated entropy seed; and According to the random control bit, one of the entropy seed before updating and the entropy seed after updating is selected to output a newest entropy seed. The method described in item 18 of the scope of the application further includes: A non-volatile memory seed is obtained from a non-volatile memory, wherein the feedback random number is written into the non-volatile memory at one or more predetermined time points to update the non-volatile memory stored in the non-volatile memory the non-volatile memory seed; and selecting one of the non-volatile memory seed and the entropy seed as the preliminary seed; When the non-volatile memory seed is selected, the feedback random number is generated based on the non-volatile memory seed, and the updated entropy seed is generated based on the feedback random number. The method of claim 17, wherein the step of generating the random control bit comprises: utilizing an oscillator to generate a periodic signal that varies between a first logic value and a second logic value at an oscillation frequency; and sampling the periodic signal at a sampling frequency, so that the first logic value and the second logic value randomly appear in a plurality of random unit values output by the oscillator to generate the random control bit; Wherein the sampling frequency is different from the oscillation frequency.

Images