Download Proposal

A High Speed TRNG Based on SRAM for Low Power Device
ChunHu Zhang, Yu Yao
University of Virginia
Department of Computer Science
Charlottesville, VA 22903, USA
{cz2v, yy4y}@virgnia.edu
1. Motivation
Truly random number is crucial in modern
cryptography and security system design.
In contrast to pseudo random number
generator, which generate the numbers by
some function in a deterministic and
predicable way, true random number
generator (TRNG) relies on some physical
phenomena, such as thermal noise, shot
noise, radio active decay etc, to produce
unpredictable a bitstream.
The common way to implement
TRNG involves complex hardware
structure, typically using analog circuits to
amplify the thermal noise across a big
resister, which may not suitable for low
power devices. We propose an alternative
way to implement TRNG and achieve
simplicity, speed and low power.
2. Background and Problems
One approach to achieve a Hardware
Random
Number
Generator
takes
advantage of the unpredictable initial state
of an SRAM. In a typical 6 transistor
memory cell, if the transistors are perfectly
matched, the bitcell initial state is
completely determined by the noise.
However, due to process variation, if the
mismatch is large enough, the bitcell will
be immune the noise, and its initial state is
solely determined by the manufacturing
variation. The drawbacks of this approach
are:
a) The random number could be only
obtained once the chip is powered up.
b) It's extremely difficult to manufacture
bitcells with perfect match due to
process variation. Once the transistors
are not perfectly matched, the bitcell's
performance will be deteriorated
because of the biased output of 1 or 0
state. When mismatch is further
enhanced, the bitcell might stopped
functioning as a random number
generator and output a deterministic 1
or 0 state depending on the butterfly
curve of the looped inverters.
c) The noise during power up could also
be non-random, enhancing the biased
output of bitstream.
We propose our TRNG based on our
improved SRAM that could achieve:
a) Simplicity. No amplifier is needed. No
dedicated component, e.g. big resistor
or diode, to retrieve thermal noise. Our
solution relies on the jittering noise of
clock signal and only simple digital
circuit is employed.
b) High sensitivity: without the amplifier,
the new TRNG can still be sensitive to
small noise/jitter accurately.
c) High speed. The random numbers are
generated with high freq clock signal.
d) Continuous random numbers: The
random numbers could be continually
generated without reboot the whole
chip.
e) Immune to process variation: even the
inverters in the memory cell are not
perfect matched, our TRNG still could
produce random numbers.
f) Low-power consumption. Our circuit
works in the sub-threshold region and
consumes less power.
g) High integratability to other digital
circuits.
3. New TRNG Architecture
A schematic of a typical 6-transistor bitcell is
shown below. It has two inverters connected in
series with each other. We can figure out the
way it works with the aid of the butterfly curve
1
also shown below. It has two stable working
points of (0, 1) and (1, 0), and a metastable
working point (Vm, Vm). We start our
discussion with the assumption that the two
inverters are symmetry, ie, they have same
pulling-up and pulling-down abilities, and
identical. Normally, a bitcell wouldn't work at
the metastable point because of its extremely
low possibility and high sensitivity to noise
influence. But in the case of our assumption,
we can force the bitcell to work at the
metastable point by shorting circuiting the Q
and QB nodes, which brings the two inverters
to the working point of (Vm, Vm) by their VTC
curves (we define Vm as the voltage at the
metalstable working point, which is the same as
the point of an inverter when Vout = Vin = Vm
in this ideal case). We actually have a pass gate
to control the on and off state of the shortcircuiting path, which is in turn controlled by
the CLK and CLKB signal, as shown in the
scheme below. When CLK=1, the pass gate is
on, bringing the bitcell to the metastable
position, then when the falling edge of the CLK
signal arrives, the short-circuiting path is cut
off, allowing the bitcell find its stable point
freely. During this process, the bitcell is
extremely sensitive to environmental noise,
which will determine the final rest state of the
bitcell.
Q
QB
CLKB
CLK
Q
QB
If we let the bitcell find its stable state freely, it
will probably take a long time for the bitcell to
stablize. Besides, it might also be influenced by
some systematical noise that is 1-biased or 0biased. We introduced the jittering noise to
overcome these problems. Below is a
simulation plot of our bitcell working in the
way we described above. When the CLKB is
1ns lagged behind the CLK, the bitcell always
produces a 0 state, and when the CLKB is 1ns
ahead of CLK, it always produces a 1 state.
Careful examination reveals that the final state
is determined by the spikes caused by the
outflowing of the injected charges, which is
shown clearly in the plots. The outflow of
negative charges in NMOS will cause a
negative noise at the two nodes while an
outflow of positive charges in the PMOS will
cause a positive noise at the two nodes. Note
that we also added a resistor in series with the
pass gate to produce assymmetry at nodes Q
and QB. The phase jittering between CLK and
CLKB signals determines the arrival of CLK
and CLKB's rising/falling edge in a
probabilistic way, which then determines the
final state of the bitcell.
So far as our discussion is concerned, we are
talking about two identical ideally symmetric
inverters. The situation becomes more
complicated when we take into consideration
the actual process variations and mismatch. We
haven't enough simulations or data to prove it is
with out doubt plausible, but a simple analysis
indicates that it is quite promising.
When the process variation is considered, the
2
actually devices will have slightly different
butterfly curves than the ideal one. We consider
the worst case of having an inverter with
stronger pull-up ability and another having
stronger pull-down ability. The actual butterfly
curve will have slightly lower Vm (note the
definition of Vm here, it is different from the
point of Vout = Vin in this case) than the ideal
value. The pass gate in series with a resistor
can still work here. When the path is on, the
short-circuiting path will bring the working
point of the looped inverters to a point near the
metastable point (Vm, Vm) but not exactly the
metastable point. This is because near the
metastable point there is voltage difference
between Q and QB nodes, giving rise to a
current flow in the pass gate and resistor
branch. We need to theoretically solve a
complex equation based on the fact that the
three branches of current cancel at node Q, to
calculate the actual working point for unideal
inverters. In this case, the final state of the
bitcell is deterministic when we release the
bitcell freely from this forced working point,
always producing a 0 or 1. But we can also see
that when we simply increase the resistance of
the resistor, same voltage difference between
nodes Q and QB is maintained with less current
through(but at the expense of slower speed),
which means less influence from the the pass
gate branch to the looped inverters, thus closer
the actual working point is to the theoretical
metastable point. On the other hand, we also
got from our simulation that when we increase
the drain area of PMOS/NMOS of the pass
gate, greater noise spikes are introduced. The
outflow of injected charges can solely
determine the final state of the bitcell if the
introduced spikes are greater than the voltage
difference between actual working point and
the theoretical Vm. This can be achieved by
carefully sizing the resistor and pass gate
PMOS/NMOS width.
A few simulations have been done to verify our
proposition, but not sufficient work is done to
make the final conclusion. Some simulation is
shown below.
1. The ideal bitcell produces a random number
when CLK and CLKB is fully synchronized
Here it shows clk, clkb, Q and QB. If the two
inverters are perfectly matched, the outcome of
Q is determined by the noise or jitter.
2. The bitcell produces a determined 1 or 0
state depending on the phase shifting of CLK
and CLKB signals.
If the delay between clk and clkb is 1ns, then
after the cell stabled, the bits in Q always ‘0’
If the delay between clk and clkb is -1ns, then
after the cell stabled, the bits in Q always ‘1’
3
3. Increase in drain area of PMOS/NMOS of pass gate contribute to a determined state
4. pass delay of inverter chain and the delay distribution caused by jittering
We simulated the pass delay for a chain of inverters. The input signal is a pulse signal with 6n
period and 400ps rise and fall time. One branch of the signal passes through 5 inverters to CLK,
another branch passes through 6 inverters to the CLKB node. The simulated dalay of the CLK and
CLKB shows that the average delay between CLK and CLKB is 0.648ns with a standard deviation
of 0.014ns. But the plot of deviation of delay from average value shown below didn't show much
randomness, but rather seems to be acting in a
deterministic way. We still need to further look
into the methods to simulate the jittering effect
2.0000000E-011
in cadence.
1.5000000E-011
1.0000000E-011
5.0000000E-012
0.0000000E+000
-5.0000000E-012
-1.0000000E-011
-1.5000000E-011
-2.0000000E-011
Column J
2
1
4
3
6
5
8
7
10 12 14 16 18 20
9 11 13 15 17 19
4
4. Following work
A lot of work remains to be done. One
important part is to continue simulating the
jittering between the CLK and CLKB
signal to produce enough phase shifting.
Another important work is to size the
resistance and pass gate PMOS/NMOS
size for proper random number generation.
Reference:
Hardware random number generators, Robert
Davis, Statistics Research Associates Limited
A Noise-Based IC Random Number Generator
for Applications in Cryptography
Craig S. Petrie, Member, IEEE, and J. Alvin
Connelly, Fellow, IEEE
An Integrated Analog/Digital Random Noise
Source
W. Timothy Holman, Member, IEEE, J. Alvin
Connelly, Fellow, IEEE, and Ahmad B.
Dowlatabadi, Member, IEEE
The Intel® random number generator
Cryptography Research, Inc. White Paper
Prepared for Intel Corporation
Initial SRAM State as a Fingerprint and Source
of True Random Numbers for RFID Tags
Daniel E. Holcomb, Wayne P. Burleson, and
Kevin Fu
PUF-Based Random Number Generation
Charles W. O’Donnell, G. Edward Suh, and
Srinivas Devadas