Patent Application
20190187957
The present invention, in some embodiments thereof, relates to a compact bit generator and, more particularly, but not exclusively, to a compact bit generator in a logic circuit.
There are many powerful circuit/gate level countermeasures against power analysis attacks that utilize randomization, for example, Randomized Multi-Topology Logic (RMTL), Blurring Gates, randomized power consumption based techniques and others. All require numerous random signals to randomize the power profile and/or the propagation delays of the logic paths. In most cases, a single True Random Number Generator (TRNG) provides the random signals for the required blocks. This kind of implementation has several disadvantages: the implementation cost of a TRNG is high, it consumes high energy since it always works, and even more importantly, a fault injection attack can neutralize it by forcing its output signal to be deterministic.
Existing hardware TRNGs employ a noise source that generates a random signal whose randomness is amplified. There are two types of TRNGs: those whose random output is sampled with the (deterministic) system clock and those that generate an output sequence with a jittered clock.
In general, TRNGs of the first type consist of a noise source, an amplifier, a sampler and other analog blocks. TRNGs of the second type involve a ring-oscillator at the data line, sampled by a noisy (jittered) clock resulting from an amplified noise source and additional analog blocks. The quality of the noise source determines the quality of the TRNG.
These noise based TRNGs have a complex structure since the noise source needs to be generated and amplified. In addition they include custom designed additional analog blocks (e.g., A/D, Sample&Hold module, Current-Controlled Oscillator, filters, etc.) to achieve true randomness. There are other techniques to implement random generators without the need of noise sources, such as metastability based TRNGs. However, similarly to the noise-source based TRNGs, they occupy a large area overhead.
Additional background art includes:
Embodiments of the invention present a compact bit generator (also denoted herein a bit generator). The compact bit generator (cBG) includes a voltage controlled oscillator (VCO) powered by a supply voltage. The VCO produces an analog oscillation signal which is then sampled to generate a non-deterministic bit series whose randomness depends on the inherent background noise (e.g. supply noise) and/or inherent clock jitter. Process variations may introduce differences between the respective bit series generated by different cBGs in the same circuit and from circuit to circuit, even when the cBGs themselves have an identical or highly similar layout.
Due to its compact size, multiple cBGs may be embedded within a logic circuit, thereby providing gate-level randomization which is an effective countermeasure against power analysis attacks. Optionally, cBGs are placed at different physical locations within a logic circuit, thereby producing different and uncorrelated bit sequences at the different circuit locations.
As used herein, the term “bit series” means one or more bits generated by sampling the bit generator output over time. The number of bits in the series (i.e. length of series) and/or timing at which the bit generator output is sampled may vary.
As used herein, the term “non-deterministic bit series” means a series of bits in which even when the initial bits in the series are known it is unknown what the next bit will be. Even if the bit generator produces the same initial bit series, the subsequent bit may be different at different times of operation.
As used herein the term “inherent background noise” means background noise which is not introduced deliberately (e.g. by dedicated circuitry and/or input from an external source).
As used herein the term “inherent clock jitter” means variations in the clock signal which are not introduced deliberately (e.g. by dedicated circuitry which affects the timing of the clock signal).
The cBG does not require a noise source in order to generate the non-deterministic bit series. The cBG amplifies the inherent (residual) noise in voltage supply which exists in any power source. Process variations may serve to amplify the differences between adjacent cBGs.
The cBG may therefore be implemented with a very small size and does not require the additional resources (such as power) which are required by noise source circuitry. Optionally, the cBG includes circuitry to introduce additional noise into the cBG (for example to amplify the effects of the supply noise).
As used herein the term “noise source” means circuit elements and/or electrical connections which are present in the circuit in order to generate a random signal.
Embodiments of the cBG present many benefits, particularly over existing TRNGs, including:
According to an aspect of some embodiments of the present invention there is provided a bit generator which includes a sampler and a voltage controlled oscillator (VCO) powered by a supply voltage. The sampler outputs a non-deterministic bit series which is generated by sampling an output of the VCO. The randomness of the non-deterministic bit series depends on inherent background noise and/or inherent clock jitter.
According to some embodiments of the invention, the bit generator does not include noise source circuitry configured to generate a random signal.
According to some embodiments of the invention, the bit generator includes an enable input adapted to input an enable signal for enabling and disabling the VCO.
According to some embodiments of the invention, an output of the bit generator is connected to an input of a digital element. According to further embodiments of the invention, the digital element is powered by the supply voltage.
According to some embodiments of the invention, the bit generator is embedded in a logic circuit.
According to some embodiments of the invention, a sampling rate of the sampler is smaller than an oscillation frequency of the VCO.
According to some embodiments of the invention, the VCO includes multiple logic gates interconnected so as to create an oscillator.
According to some embodiments of the invention, the VCO is a ring oscillator.
According to some embodiments of the invention, the VCO includes at least one standard digital cell.
According to some embodiments of the invention, the VCO includes inverters connected in a ring.
According to some embodiments of the invention, the VCO includes an exclusive OR (XOR) gate connected to an inverter in a ring. The inverter output is connected to an input of the XOR gate and to an input of the sampler.
According to some embodiments of the invention, the VCO includes a XOR gate and one input of the XOR gate is connected to an enable signal. Inputting a first logic level into the second input enables operation of the VCO and inputting a second logic level into the second input disables operation of the VCO.
According to some embodiments of the invention, the sampler is configured to sample the output of the VCO in accordance with a clock signal.
According to some embodiments of the invention, the sampler includes a Flip-Flop (FF) having a first input connected to an output of the VCO and a second input connected to the clock signal.
According to an aspect of some embodiments of the present invention there is provided a logic circuit which includes multiple bit generators and multiple logic gates. The bit generators output respective non-deterministic bit series, wherein a respective randomness of each of the non-deterministic bit series depends on at least one of: inherent background noise for the respective bit generator and inherent clock jitter for the respective bit generators. Each of the logic gates includes:
According to some embodiments of the invention, at least one of the bit generators does not include noise source circuitry configured to produce random electrical noise.
According to some embodiments of the invention, at least one of the bit generators includes a respective enable input adapted to input an enable signal for enabling and disabling the respective bit generator.
According to some embodiments of the invention, at least two of the bit generators output uncorrelated non-deterministic bit series.
According to some embodiments of the invention, at least two of the bit generators are powered by different supply voltages.
According to some embodiments of the invention, each of the bit generators includes:
According to some embodiments of the invention, for at least one of the bit generators, a sampling rate of the respective sampler is smaller than an oscillation frequency of the respective VCO.
According to some embodiments of the invention, for at least one of the bit generators, the respective VCO includes multiple logic gates interconnected so as to create an oscillator.
According to some embodiments of the invention, for at least one of the bit generators, the respective VCO includes a ring oscillator.
According to some embodiments of the invention, for at least one of the bit generators, the respective VCO includes an exclusive OR (XOR) gate connected to an inverter in a ring. The inverter output is connected to an input of the XOR gate and to an input of the sampler. A second input of the XOR gate is connected to an enable signal for enabling and disabling the VCO.
According to some embodiments of the invention, for at least one of the bit generators, the respective sampler samples the output of the VCO in accordance with a clock signal.
According to some embodiments of the invention, the respective sampler includes a Flip-Flop (FF) which has a first input connected to an output of the VCO and a second input connected to the clock signal.
According to some embodiments of the invention, at least one of the logic gates is a blurring gate.
According to an aspect of some embodiments of the present invention there is provided a logic unit which includes a logic gate and a voltage controlled oscillator (VCO) powered by a supply voltage and configured to output an analog oscillation signal.
The logic gate includes:
According to some embodiments of the invention, the logic unit does not include noise source circuitry configured to generate a random signal.
According to some embodiments of the invention, logic unit further includes an enable input adapted to input an enable signal for enabling and disabling the VCO.
According to some embodiments of the invention, a sampling rate of the sampler is smaller than an oscillation frequency of the VCO.
According to some embodiments of the invention, the VCO includes multiple logic gates interconnected so as to create an oscillator.
According to some embodiments of the invention, the VCO includes a ring oscillator.
According to some embodiments of the invention, the VCO includes at least one standard digital cell.
According to some embodiments of the invention, the VCO includes inverters connected in a ring.
According to some embodiments of the invention, the VCO includes an exclusive OR (XOR) gate connected to an inverter in a ring, and the inverter output is connected to an input of the XOR gate and to an input of the sampler.
According to some embodiments of the invention, the VCO includes a XOR gate and an input of the XOR gate is connected to an enable signal for enabling and disabling the VCO.
According to some embodiments of the invention, sampler samples the output of the VCO in accordance with a clock signal.
According to some embodiments of the invention, the sampler includes a Flip-Flop (FF) having a first input connected to an output of the VCO and a second input connected to the clock signal.
Unless otherwise defined, all technical and/or scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which the invention pertains. Although methods and materials similar or equivalent to those described herein can be used in the practice or testing of embodiments of the invention, exemplary methods and/or materials are described below. In case of conflict, the patent specification, including definitions, will control. In addition, the materials, methods, and examples are illustrative only and are not intended to be necessarily limiting.
Implementation of the method and/or system of embodiments of the invention can involve performing or completing selected tasks manually, automatically, or a combination thereof. Moreover, according to actual instrumentation and equipment of embodiments of the method and/or system of the invention, several selected tasks could be implemented by hardware, by software or by firmware or by a combination thereof using an operating system.
For example, hardware for performing selected tasks according to embodiments of the invention could be implemented as a chip or a circuit. As software, selected tasks according to embodiments of the invention could be implemented as a plurality of software instructions being executed by a computer using any suitable operating system. In an exemplary embodiment of the invention, one or more tasks according to exemplary embodiments of method and/or system as described herein are performed by a data processor, such as a computing platform for executing a plurality of instructions. Optionally, the data processor includes a volatile memory for storing instructions and/or data and/or a non-volatile storage, for example, a magnetic hard-disk and/or removable media, for storing instructions and/or data. Optionally, a network connection is provided as well. A display and/or a user input device such as a keyboard or mouse are optionally provided as well.
Some embodiments of the invention are herein described, by way of example only, with reference to the accompanying drawings. With specific reference now to the drawings in detail, it is stressed that the particulars shown are by way of example and for purposes of illustrative discussion of embodiments of the invention. In this regard, the description taken with the drawings makes apparent to those skilled in the art how embodiments of the invention may be practiced.
In the drawings:
The present invention, in some embodiments thereof, relates to a compact bit generator and, more particularly, but not exclusively, to a compact bit generator in a logic circuit.
Embodiments of the cBG include a VCO followed by a sampler as described in more detail below. The randomness of the cBG output bit series output depends on the inherent background noise (which may originate in the power supply) and/or the inherent jitter of the sampler clock signal.
Optionally, the cBG does not include additional circuitry which serves to generate a random signal (e.g. a noise source). This is in contrast with TRNGs, which include dedicated noise source circuitry.
It is noted that even though the cBG does not include a noise source for the purpose of generating the bit series, a noise source may be present for other purposes in a circuit in which the cBG is embedded.
Optionally, the cBG does not include any element or circuitry adapted to neutralize the inherent noise in the power supply and/or the inherent jitter of the sampler clock signal.
Before explaining at least one embodiment of the invention in detail, it is to be understood that the invention is not necessarily limited in its application to the details of construction and the arrangement of the components and/or methods set forth in the following description and/or illustrated in the drawings and/or the Examples. The invention is capable of other embodiments or of being practiced or carried out in various ways.
Compact Bit Generator (cBG)
Referring now to the drawings,
cBG 100 includes VCO 110 followed by sampler 120. VCO 110 is powered by a supply voltage and outputs an analog oscillation signal. Sampler 120 samples the VCO output signal and outputs the resulting in a non-deterministic (e.g. random) bit series.
Optionally, cBG 100 further includes an enable input for inputting an enable signal which enables and disables VCO operation. When the VCO is disabled cBG 100 may consume less power than when the VCO is operating, thereby creating a power saving mode for cBG operation. For example, in the exemplary cBG illustrated in
VCO 110 may be designed in any way known in the art including but not limited to:
i) Multiple logic gates interconnected to form an oscillator;
ii) A ring oscillator;
iii) Inverters connected in a ring; and
iv) An exclusive OR (XOR) gate connected to an inverter in a ring (see
Optionally, sampler 120 samples the output of VCO 110 when triggered by a sampling signal.
Optionally sampler 120 samples the VCO output when triggered by a sampling signal.
Optionally, the sampling signal is a sampling clock signal with inherent clock jitter. Jitter (inherent and/or deliberately added) in the sampling clock signal may be one factor which introduces randomness into the sampled oscillation signal.
Optionally, the sampling signal is provided by an external circuit element. Alternately, sampler 120 includes an internal clock.
Optionally the sampler samples the VCO output at one or more of:
i) per cycle of the sampling clock signal;
ii) per multiple cycles of the sampling clock signal (e.g. once every three cycles);
iii) as required (i.e. at the time the next bit in the series is needed for circuit operation);
iv) at random intervals; and
v) in bursts of the same or different lengths.
Optionally, the sampling rate of the sampler is smaller than the oscillation frequency of the VCO. Typically, the sampling clock rate is a given parameter. Using high oscillation frequency increases the probability of sampling different digital values every sampling (clock) cycle. In one test case, the oscillation frequency was designed to be approximately 5 GHz for a sampling rate of approximately 100 MHz, yielding many high-frequency oscillation cycles in each low-frequency cycle. The randomness of the cBG output series depends on the background noise and process variations. As such it has been found to give satisfactory results when real power supply characteristics taken from laboratory experiments are utilized during simulations of the cBG (as demonstrated by the results presented below).
Further optionally, the oscillation frequency of the VCO is:
i) at least 5 times the sampling rate;
ii) at least 10 times the sampling rate.
Optionally, sampler 120 is a Flip-Flop (FF), with one input connected to the output of the VCO and a second input for the sampling clock signal.
Optionally, cBG 100 is a CMOS cell. However the cBG is not limited to CMOS implementations. Other technologies in which the cBG may be implemented include but are not limited to:
a) Pass Transistor Logic (PTL);
b) Differential PTL;
c) Pseudo-NMOS;
d) Pseudo-PMOS;
e) Dynamic Logic;
f) Differential Dynamic Logic;
g) Domino Logic; and
h) NP-CMOS.
Optionally, cBG 100 is designed from standard digital cells which are referenced in a standard cell library as known in the art.
Optionally, cBG 100 is designed using standard circuit design tools known in the art.
An exemplary embodiment of a cBG is described below and illustrated in
Optionally, the non-deterministic bit series is used to introduce randomization into the operation of a logic gate.
Reference is now made to
In
cBG 210 includes a VCO followed by a sampler. The non-deterministic bit series output by cBG 210 is provided to an input of the logic gate. Examples of logic gates which may follow the cBG include but are not limited to:
Optionally, cBG 210 may be switched off, so that logic gate 220 implements the logic function on the input logic signals without introducing randomization by cBG 210.
cBG 210 and/or logic gate 220 may be designed in any way known in the art, including but not limited to the embodiments presented herein.
In
Optionally, additional (i.e. non-inherent) noise is introduced into the sampling clock signal, thereby introducing additional randomization into the output of logic path 252.
VCO 240 and/or sampler 251 and/or logic path 252 may be designed in any way known in the art, including but not limited to the embodiments presented herein.
Optionally, the logic unit is designed with standard circuit design tools utilizing a standard cell library as known in the art.
Logic Circuit with Embedded cBGs
Due to the compact size attainable with embodiments of the cBG presented herein, multiple cBGs may be interspersed within a logic circuit design in order to add randomness to the power usage of the logic circuit thereby combating power analysis attacks.
Reference is now made to
For purpose of illustration,
Although
Optionally, at least two of the cBGs are powered by different supply voltages.
Optionally, the circuit design is configured to reduce correlation between the non-deterministic bit series output by at least two of the cBGs. For example, the cBGs may be placed in different physical locations in the logic circuit, in proximity to different sources of background noise and/or with different length wires from the power supply. Other optional factors which may reduce correlation include but are not limited to:
It is noted that even when multiple cBGs are connected to the same clock signal the inherent clock jitter may differ amongst the multiple cBGs due differences, for example, in circuit layout and other design and manufacturing parameters.
Optionally, logic circuit 300 includes at least two differently designed cBGs (e.g. a first cBG with a VCO formed from a ring of inverters and a second cBG with a VCO formed from a XOR gate and inverter).
Optionally, at least one of the logic gates is a blurring gate.
Optionally, the logic circuit is designed with standard circuit design tools utilizing a standard cell library as known in the art.
Reference is now made to
The embodiment of
Embodiments of the cBG, logic unit and/or logic circuit described herein may be implemented in circuits, including, but not limited to:
a) An integrated circuit (IC) customized for a particular use, such as an Application-Specific Integrated Circuit (ASIC);
b) A programmable logic device intended for general-purpose use. Examples of such programmable logic devices include, but are not limited to: Field-Programmable Gate Array (FPGA), Gate Array, Uncommitted Logic Array (ULA), Programmable Logic Array (PLA), Programmable Array Logic (PAL), Complex Programmable Logic Device (CPLD), Erasable Programmable Logic Device (EPLD) and Structured ASIC.
Reference is now made to
When CLK1=‘0’, the XOR and the inverter in VCO 510 form a free running ring-oscillator circuit and the VCO_Out (high frequency) signal is impacted by the supply noise of these gates. DFF 520 samples the VCO_Out signal with a lower frequency than the VCO's CLK2. Note that larger supply noise bandwidth leads to increased randomness at the RNG_Out output. When CLK1=‘1’, VCO 510 is locked on a constant value.
The XOR gate may be used to save power when there is no need to generate a random sequence. If power dissipation is not a concern, the XOR gate may be replaced, for example, by two inverters.
Optionally, several exemplary cBG cells are embedded at different physical locations in a design and each cell operates from a supply voltage with different noise. Additionally, each of the exemplary cBG cells performs differently due to process variations. Thus different bit sequences are generated.
Reference is now made to
It is noted that because of its structure, an exemplary cBG cell may reach metastability (in the case where CLK1=CLK2). However, this temporary phenomenon is not a concern because it is only necessary to have a distinct logic value right before the sampling time (rather than preventing the temporary metastable state). Since DFF 520 ensures that this occurs, no additional hardware components are needed. This is in contrast with other random number generators (e.g. TRNGs), which dedicate resources to preventing metastability (e.g. by adding a delay, flip-flop or inverter to the random generator design).
A blurring gate (BG) based implementation is used as a test case in order to demonstrate the performance of the exemplary cBG cell. BG units are standard cell-based logic gates which are implemented at different locations along the propagation paths of an existing design. BGs do not change the functionality of the system. Each BG may operate in a static CMOS-like mode or in one of two dynamic modes, pre-charge or pre-discharge. A BG may switch randomly between the two operational modes, thus producing a random initial condition at its output node and a random power profile for the device.
As illustrated in
As demonstrated herein, the expensive TRNG may be replaced by exemplary cBG cells without noticeable degradation in immunity to power attacks. In fact, due to process variations and the dependency of the noise and the RPC phases on the BG physical locations, it is possible to implement physically adjacent exemplary cBG cells with similar supply noise and still obtain different output sequences.
It is also noted that random sequences generated by two different (and even adjacent) exemplary cBG cells are not be correlated because all the logic including the (typically relatively small number of) cRBC cells are connected to the same voltage supply, thus the effect of each noise is negligible. Moreover, Monte Carlo simulations over 1,000 different exemplary cBGs with a pure (noiseless) supply voltage show that the standard deviation on the oscillation frequency is σ=150 MHz. The difference between the output sequences increases when the exemplary cBG cells are connected to different loads.
Several statistical tests were used to characterize the effectiveness of the exemplary cBG cell for gate level randomization countermeasures to power analysis attacks. The BG-based implementation of [2] is referred to as a benchmark. The tests performed includes:
i) Template Matching—
The purpose of this test is to detect when there are too many occurrences of given aperiodic patterns. Template matching tests are important for high statistic averaging; when too many aperiodic patterns occur, an attacker may establish large statistics to construct the power profile from these patterns (these tests are equivalent to NIST tests #7, 8 [18]).
ii) Discrete Fourier Transform—
The purpose of this test is to detect periodic features (i.e., repetitive patterns that are near each other) in the tested sequence. This test is highly important since the attacker may use periodic features to choose when to attack, for example by synchronizing the attack to these periodic patterns (this test is equivalent to NIST test #6).
iii) Linear Complexity—
This test determines whether or not the sequence is complex enough to be considered random by examining the length of a linear feedback shift register (this test is equivalent to NIST tests #10).
iv) Frequency of m-Bit Patterns—
This test shows the frequency of all possible overlapping m-bit patterns over the entire sequence (this test is equivalent to NIST tests #11).
v) Random Excursions—
These tests determine the number of cycles having exactly K visits in a cumulative sum random walk, and the total number of times that a particular state occurs in a cumulative sum random walk (these tests are equivalent to NIST tests #14, 15).
The NIST test suite [18] includes additional tests which are not relevant in the context of the immunity to power analysis when several exemplary cBGs are implemented in the BG-based module. This is because the sequences generated by those exemplary cBGs are uncorrelated. In other words, in some of these tests embedding many (inherently) uncorrelated exemplary cBG cells compensates for the possible failure of one or some of those exemplary cBG cells.
The testing was performed on an exemplary cBG circuit implemented in 65 nm standard CMOS technology with a 1.2V VDD, using a Cadence Virtuoso environment, with a 100 MHz clock. Two test setups were constructed, as shown in
Several noise types were examined, including white noise with a 10 GHz Bandwidth, white noise combined with dominant spurs at the system clock frequency multiples, and white noise combined with dominant spurs at different frequency multiples from the system clock frequency. The output sequences of the exemplary cBG cells (for the single cell test) and the power profile traces (for the system level test) were extracted by Virtuoso and processed using Matlab.
The characteristics of the (residual) noise in power supplies was studied in [7]-[9], and present a measurement system for characterization of power supply noise in advanced technologies. The supply noise measurement results of several chips showed that the spectrums of the noise contain white noise as well as dominant harmonics (spurs) of the system clock and its multiplications.
In order to resemble a real power supply, the exemplary cBGs were tested using simulated supply noise with characteristics similar to the ones reported in [7]-[9]. Several test cases were examined, as shown in Table I. Each test case corresponds to a different supply noise content: 20 mvrms white noise, 10 mvrms white noise, 10 mvrms white noise+spurs@k×100 MHz, k∈, and 10 mvrms white noise+spurs@k×500 MHz, k∈
. Ten exemplary cBG output sequences of 1 Mbit were considered in each test. The numbers in the brackets in the ‘TEST’ column denote the equivalent NIST tests. Tests that were passed are indicated by a check mark (“√”). Tests that were failed are indicated by an x mark (“
”).
The first two columns show the statistical test results for an exemplary cBG cell with 20 mvrms and 10 mvrms white noise at the cBG power supply respectively. It is seen that the 20 mvrms white noise test case exhibits good statistical properties and that it passes all the tests. The 10 mvrms white noise test case passed most of the tests. The last two columns present statistical test results for an exemplary cBG cell with 10 mvrms white noise with additional spurs (and their multiples) at 100 MHz and 500 MHz respectively at the cBG power supply, both of which were 15 mvrms dominant spur magnitudes. In these cases the cell failed several tests.
However, the exemplary cBG cell successfully passed all the tests that are essential for immunity to power analysis, namely: Template Matching, Discrete Fourier Transform, Linear Complexity, Frequency of m-bit Patterns and Random Excursions.
The test-bench and power analysis attack process described in [2] were used to evaluate the security of the system level implementation. Module Under Test (MUT) 700 consists of two main blocks: combinatorial logic consisting of the 8-bit CMOS 5-box and an ADDKEY module (a nonlinear part of the AES algorithm [19]), both of which included embedded BG gates. MUT 700 also includes register arrays located at the input and output of the combinatorial logic. To examine the exemplary cBG based implementation, the RPC signals (the control signals of the BG gates) were generated by exemplary cBG cells.
Table II presents the SNR values obtained for the power analysis attacks on the BG based implementation, for a single key chosen as an example. The SNR was defined as the ratio between the maximum correlation value of the correct key and the maximal correlation among the wrong key values. If the SNR is greater than 1, the correct key may be extracted. Therefore the goal is to reduce the average SNR (over all possible keys) to 1 or less. For comparison, the column labeled “External TRNG” in Table II shows the results presented in [2] in which the RPC signals were generated by an external TRNG module.
The effectiveness of the exemplary cBG combinatorial logic was tested on all the keys and proved to be efficient. The SNR values for the exemplary cBG test case were measured for three types of supply noise with 10 mvrms white noise. Table II clearly shows that the use of exemplary cBG cells as the RPC signals of the BG gates kept the S-box immune to power analysis attacks (i.e. SNR was less than 1 in all test cases).
Changes in temperature or in power supply level do not significantly affect the outcome. Changing these parameters may affect the amplitude, DC level and the frequency of the VCO. However, changes in the VCO amplitude are not problematic since a logical ‘0’ or ‘1’ at the exemplary cBG cell is obtained in any case. If the DC level changes at the VCO output, a similar DC level change will occur at the DFF as well (reflecting its decision point) since they are both standard CMOS cells. The designer only has to ensure that there are a sufficiently large number of VCO oscillations within a DFF clock cycle so that the change in the VCO frequency will not impact the output sequence. The test case presented herein uses a 100 MHz clock, which is sufficient since the VCO oscillates at around 6 GHz.
Table III shows the high efficiency in terms of area overhead and effective throughput obtained when using exemplary cBG cells.
The area values of the exemplary cBG cell and the TRNG modules presented in [10], [11], [13], [15] and [16] are shown in Table III. For a fair comparison, these values were scaled to the values related to a 65 nm process. Two scaling calculations are shown: a scaling of 70% between consecutive processes as a common estimation for digital implementation, and a scaling of 90% as an estimation for analog implementations (which is more accurate scaling for the TRNGs, since they mostly consist of analog components).
As shown in Table III, the areas of all the TRNGs are many times larger than the area of the exemplary cBG cell. If the routing area saved by the use of exemplary cBG cells is also considered, additional area is saved. As another benefit, the exemplary cBG cells generate different sequences whereas each of the TRNGs produces one sequence.
It was found that in order to achieve the high immunity of an 8-bit S-box to power analysis attacks, approximately 100 BG gates should be embedded in the S-box (assuming the percentage of BG gates out of all gates in the S-box is around 20%), and should receive different sequences.
The power consumption (rms) of a single active exemplary cBG element (CLK1=0) is equivalent to 1.15 standard library-cell FFs (a positive edged-triggered, D-type FF) power consumption operating at CLK2=500 MHz.
The effective throughput of the sequence generator is defined as the number of bits generated per second normalized to a 1 mm2 area. This parameter indicates the efficiency of the modules for the same number of different sequences. The throughput values of the TRNGs are 12.5 Mbps for [10], 10 Mbps for [13], 1.4 Mbps for [11], 2.4 Gbps for [15], and 50 Mbps for [16]. A throughput of 100 Mbps is considered for the exemplary cBG though it may still provide similar results for 400 MHz clock. As can be seen from Table III, the effective throughput of the exemplary cBG is about 30 times higher than the effective throughput of the TRNG presented in [15], and much higher than the other TRNGs.
The embodiments described herein present a compact bit generator which may easily be embedded within a logic circuit design due to its small size and low resource costs. The randomness of cBG output bit series is created by inherent properties of circuit operation, such as background noise and clock jitter. There is therefore no need for additional noise source circuitry which actively generates a random signal. The cBG may be formed from standard digital cells using a standard circuit design tool. Implementing multiple cBGs as an integral part of the logic circuit design makes it extremely difficult to neutralize them; i.e., makes a tampering attack infeasible.
The methods as described above are used in the fabrication of integrated circuit chips.
Aspects of the present invention are described herein with reference to flowchart illustrations and/or block diagrams of methods and apparatus (systems) according to embodiments of the invention. It will be understood that some blocks of the flowchart illustrations and/or block diagrams, and some combinations of blocks in the flowchart illustrations and/or block diagrams, may be implemented at least in part by computer readable program instructions.
The flowchart and block diagrams in the Figures illustrate the architecture, functionality, and operation of possible implementations of systems and methods according to various embodiments of the present invention. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware-based systems that perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.
The descriptions of the various embodiments of the present invention have been presented for purposes of illustration, but are not intended to be exhaustive or limited to the embodiments disclosed. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The terminology used herein was chosen to best explain the principles of the embodiments, the practical application or technical improvement over technologies found in the marketplace, or to enable others of ordinary skill in the art to understand the embodiments disclosed herein.
It is expected that during the life of a patent maturing from this application many relevant voltage controlled oscillators, samplers, inverters, flip-flops, logic circuits, circuit design tools, cell libraries and logic circuit technologies will be developed and the scope of the term oscillator, sampler, inverter, flip-flop, logic circuit, circuit design tool, cell library and logic circuit technology is intended to include all such new technologies a priori.
The terms “comprises”, “comprising”, “includes”, “including”, “having” and their conjugates mean “including but not limited to”.
The term “consisting of” means “including and limited to”.
The term “consisting essentially of” means that the composition, method or structure may include additional ingredients, steps and/or parts, but only if the additional ingredients, steps and/or parts do not materially alter the basic and novel characteristics of the claimed composition, method or structure.
As used herein, the singular form “a”, “an” and “the” include plural references unless the context clearly dictates otherwise. For example, the term “a compound” or “at least one compound” may include a plurality of compounds, including mixtures thereof.
Throughout this application, various embodiments of this invention may be presented in a range format. It should be understood that the description in range format is merely for convenience and brevity and should not be construed as an inflexible limitation on the scope of the invention. Accordingly, the description of a range should be considered to have specifically disclosed all the possible subranges as well as individual numerical values within that range. For example, description of a range such as from 1 to 6 should be considered to have specifically disclosed subranges such as from 1 to 3, from 1 to 4, from 1 to 5, from 2 to 4, from 2 to 6, from 3 to 6 etc., as well as individual numbers within that range, for example, 1, 2, 3, 4, 5, and 6. This applies regardless of the breadth of the range.
Whenever a numerical range is indicated herein, it is meant to include any cited numeral (fractional or integral) within the indicated range. The phrases “ranging/ranges between” a first indicate number and a second indicate number and “ranging/ranges from” a first indicate number “to” a second indicate number are used herein interchangeably and are meant to include the first and second indicated numbers and all the fractional and integral numerals therebetween.
It is appreciated that certain features of the invention, which are, for clarity, described in the context of separate embodiments, may also be provided in combination in a single embodiment. Conversely, various features of the invention, which are, for brevity, described in the context of a single embodiment, may also be provided separately or in any suitable subcombination or as suitable in any other described embodiment of the invention. Certain features described in the context of various embodiments are not to be considered essential features of those embodiments, unless the embodiment is inoperative without those elements.
Although the invention has been described in conjunction with specific embodiments thereof, it is evident that many alternatives, modifications and variations will be apparent to those skilled in the art. Accordingly, it is intended to embrace all such alternatives, modifications and variations that fall within the spirit and broad scope of the appended claims.
All publications, patents and patent applications mentioned in this specification are herein incorporated in their entirety by reference into the specification, to the same extent as if each individual publication, patent or patent application was specifically and individually indicated to be incorporated herein by reference. In addition, citation or identification of any reference in this application shall not be construed as an admission that such reference is available as prior art to the present invention. To the extent that section headings are used, they should not be construed as necessarily limiting.
This application claims the benefit of priority under 35 USC § 119(e) of U.S. Provisional Patent Application No. 62/607,393 filed on Dec. 19, 2017. The contents of the above application are all incorporated by reference as if fully set forth herein in its entirety.
| Number | Date | Country | |
|---|---|---|---|
| 62607393 | Dec 2017 | US |
