Abstract:
A method for generating a random number, comprising steps of receiving a data transmission binary signal subjected to phase jitter, generating several oscillator signals substantially of a same average frequency and having distinct respective phases, sampling a status of each of the oscillator signals upon the appearance of edges of the binary signal, and of generating a random number using the statuses of each of the oscillator signals. The method may be applied to an integrated circuit usable in a smart card.

Description:
BACKGROUND OF THE INVENTION 
       [0001]    1. Field of the Invention 
         [0002]    The present description relates to the generation of random or pseudo-random numbers in an integrated circuit, and in particular, but not exclusively, smart card integrated circuits or integrated circuits equipped with a communication interface conforming to the USB (Universal Serial Bus) standard. 
         [0003]    2. Description of the Related Art 
         [0004]    Random or pseudo-random numbers are used by numerous functions such as encryption functions or protection functions for protection against attacks particularly by fault injection. 
         [0005]    There are many methods for generating a random number. Thus, certain methods use an internal noise signal that is sampled to generate a random variable. The noise signals are generally of very low amplitudes. It is therefore necessary to amplify them. This amplification introduces a correlation factor, because the amplifier is also subjected to the same conditions (same technology, supply voltage, temperature, etc.) as the internal source of noise. Such a correlation enables the random variable generator to be controlled from the external environment, and therefore to be used to inject errors into the integrated circuit if it is used in a smart card. 
         [0006]    In U.S. patent application Ser. No. 09/805,265, a first sawtooth signal is sampled by a second signal. The two signals are asynchronous. The amplitude of each sample is compared with a threshold voltage, and the result of the comparison supplies the value of a bit of a pseudo-random number. This method for generating a random number requires two sources of signals to be implemented. The random nature of the numbers generated depends, in particular, on the level of correlation between the source of the sawtooth signal. and the source of the sampling signal. Now, in an integrated circuit, such as those used to equip smart cards, it is difficult to produce decorrelated oscillators, due to the fact that these units are produced with the same technology and are subjected to the same environmental conditions (temperature, sound and light) and electrical supply conditions (average amplitude, level of amplitude and frequency interference). In smart cards, the use of an external source of signals is not desirable because it may impair the resistance of the chip to attacks. 
       BRIEF SUMMARY OF THE INVENTION 
       [0007]    One embodiment of the present invention uses the random nature of the phase shifts or jitter that occur in certain digital data transmissions, and in particular in the signals transmitted by serial links such as USB-type links. This phase jitter has the advantage of resulting from the combination of several non-correlated contributions such as the contributions from the user, from the local application, from the local clock, from the sharing of the bus with other peripherals, from the function performed by the smart card, from the traffic generators and from the processing times. This phase jitter is difficult to control, and therefore, its use by a random number generator increases the resistance of the integrated circuit to attacks by fault injection. 
         [0008]    One embodiment of the present invention provides a method for generating a random number that comprises steps of:
       receiving a data transmission binary signal subjected to phase jitter,   generating several oscillator signals substantially of a same average frequency and having distinct respective phases,   sampling a status of each of the oscillator signals upon the appearance of edges of the binary signal, and   generating a random number using the status of each of the oscillator signals.       
 
         [0013]    According to one embodiment of the present invention, a status of each of the oscillator signals is sampled upon each edge of the binary signal. 
         [0014]    According to one embodiment of the present invention, the value of the random number generated varies according to the position of the edge of the binary signal in relation to the edges of the oscillator signals. 
         [0015]    According to one embodiment of the present invention, the average phase deviation between two oscillator signals of consecutive phases is substantially constant. 
         [0016]    According to one embodiment of the present invention, the oscillator signals have an average frequency at least four times greater than the average frequency of the data transmission rate of the data transmission binary signal. 
         [0017]    According to one embodiment of the present invention, there are 8 oscillator signals, and the average phase deviation between two oscillator signals of consecutive phases is substantially equal to π/4. 
         [0018]    According to one embodiment of the present invention, the binary signal received conforms to the USB standard. 
         [0019]    Embodiments of the present invention also relate to a device for generating a random number. According to one embodiment, the device comprises:
       a data transmission binary signal input subjected to phase jitter,   several oscillator signal inputs, the oscillator signals supplied at the oscillator signal inputs having an average frequency substantially identical and distinct respective phases,   sampling circuits for sampling a status of each of the oscillator signals upon edges of the binary signal, and   a logic circuit to generate bits of a random number according to the statuses of the oscillator signals.       
 
         [0024]    According to one embodiment of the present invention, the device comprises means for sampling the clock signals upon each edge of the binary signal. 
         [0025]    According to one embodiment of the present invention, the value of the random number generated by the logic circuit varies according to the position of the edge of the binary signal in relation to the edges of the oscillator signals. 
         [0026]    Embodiments of the present invention also relate to an integrated circuit comprising:
       a receive circuit for receiving a binary signal,   a data processing unit connected to the receive circuit, and   a circuit for generating oscillator signals connected to the receive circuit.       
 
         [0030]    According to one embodiment of the present invention, the integrated circuit comprises a random number generating device as defined above, supplying the processing unit with random numbers, the random number generating device being connected to the clock signal generating circuit and to the receive circuit that supplies it with the binary signal received. 
         [0031]    According to one embodiment of the present invention, the oscillator signal generating circuit comprises a ring oscillator supplying the random number generating device with oscillator signals substantially of a same average frequency and of distinct phases. 
         [0032]    According to one embodiment of the present invention, the receive circuit conforms to the USB standard. 
     
    
     
       BRIEF DESCRIPTION OF THE SEVERAL VIEWS OF THE DRAWING(S) 
         [0033]    These and other features and advantages of the present invention shall be presented in greater detail in the following description of an embodiment of the present invention, given in relation with, but not limited to the following figures, in which: 
           [0034]      FIG. 1  represents in block form an integrated circuit connected to a computer through hubs, according to one illustrated embodiment. 
           [0035]      FIG. 2  represents an oscillator signal generating circuit of the integrated circuit, according to one illustrated embodiment. 
           [0036]      FIG. 3  shows in the form of timing diagrams the shape of oscillator signals supplied by the oscillator signal generating circuit, according to one illustrated embodiment. 
           [0037]      FIG. 4  represents a random number generating circuit according to the present invention, according to one illustrated embodiment. 
           [0038]      FIG. 5  shows in the form of timing diagrams the operation of the random number generating circuit, according to one illustrated embodiment. 
           [0039]      FIG. 6  represents a logic circuit of the random number generating circuit according to one illustrated embodiment. 
       
    
    
     DETAILED DESCRIPTION OF THE INVENTION 
       [0040]      FIG. 1  represents an integrated circuit SC connected to a computer PC through hubs HB 1 , HB 2  and serial links SL. The computer PC comprises a serial link interface UICT 1  paced by an oscillator XT and connected to transmit amplifiers A 1 , A 2  for sending data on the serial link SL. 
         [0041]    Each hub HB 1 , HB 2  comprises a transceiver UT paced by an oscillator XT. The transceiver is connected to the serial link SL through a receiving amplifier AD 1  for receiving, and through transmit amplifiers A 1 , A 2  for sending. 
         [0042]    The integrated circuit SC comprises a processing unit CPU, a serial link interface UICT connected to the serial link SL through a receiving amplifier AD. The integrated circuit also comprises a clock signal generating circuit CKGEN which supplies the interface UICT with a clock signal UCK. 
         [0043]    According to one embodiment, the integrated circuit comprises a random number generating circuit RNGEN connected to the circuit CKGEN and supplying the processing unit with random numbers RND. 
         [0044]    For more clarity of the figure, only the amplifiers used to transmit data from the computer PC to the integrated circuit SC have been represented. 
         [0045]      FIG. 2  represents an oscillator RO of the clock signal generating circuit CKGEN. The oscillator RO, of ring oscillator type, comprises several differential amplifiers OA 1 -OA 4  interconnected in a ring (4 oscillators in the example in the figure), two PMOS-type transistors MP 1 , MP 2 , and two NMOS-type transistors MN 1 , MN 2 . The oscillator RO also comprises several amplifiers OA 5 -OA 12  each supplying an oscillator signal P 0 -P 7 . 
         [0046]    Each of the amplifiers OA 1 -OA 4  supplies two opposite phase signals Qi, QiB (i being a whole number between 0 and 3). The gates of the transistors MP 1 , MP 2 , MN 1 , MN 2  receive a start signal S for starting the oscillator RO. The drain of the transistor MP 1  is connected to the ground, and the source of this transistor is connected to the direct input of the amplifier OA 1 . The source of the transistor MP 2  receives a reference voltage Vref, and the drain of this transistor is connected to the inverted input of the amplifier OA 1 . The source of the transistor MN 1  is connected to the direct input of the amplifier OA 1 , and the drain of this transistor is connected to the output Q 3  of the amplifier OA 4 . The source of the transistor MN 2  is connected to the inverted input of the amplifier OA 1 , and the drain of this transistor is connected to the output Q 3 B of the amplifier OA 4 . The output Q 0  of the amplifier OA 1  is connected to the direct input of the amplifier OA 5  and to the inverted input of the amplifier OA 6 . The output Q 0 B of the amplifier OA 1  is connected to the inverted input of the amplifier OA 5  and to the direct input of the amplifier OA 6 . The output Q 1  of the amplifier OA 2  is connected to the direct input of the amplifier OA 7  and to the inverted input of the amplifier OA 8 . The output Q 1 B of the amplifier OA 2  is connected to the inverted input of the amplifier OA 7  and to the direct input of the amplifier OA 8 . The output Q 2  of the amplifier OA 3  is connected to the direct input of the amplifier OA 9  and to the inverted input of the amplifier OA 10 . The output Q 2 B of the amplifier OA 3  is connected to the inverted input of the amplifier OA 9  and to the direct input of the amplifier OA 10 . The output Q 3  of the amplifier OA 4  is connected to the direct input of the amplifier OA 11  and to the inverted input of the amplifier OA 12 . The output Q 3 B of the amplifier OA 4  is connected to the inverted input of the amplifier OA 11  and to the direct input of the amplifier OA 12 . 
         [0047]    When the start signal S is inactive, the outputs Q 3  and Q 3 B are not connected to the inputs of the amplifier OA 1  and these inputs are respectively biased to the ground and Vref by the transistors MP 1  and MP 2 . When the start signal S is active, the outputs Q 3  and Q 3 B are connected to the inputs of OA 1  that are insulated from the ground and from the voltage Vref. An oscillation is then produced. 
         [0048]    The oscillator signals P 0 -P 7  at output of the amplifiers OA 5 -OA 12  have a same average period and are staggered by an average duration Δφ of one eighth of a period. 
         [0049]      FIG. 3  represents the shape of the oscillator signals P 0 -P 7 . In this figure, the signals P 0 -P 7  are phase-shifted in relation to one another. Thus, two signals of consecutive phases Pi, Pi+1 (i being a whole number between 0 and 6) are phase-shifted by an average phase deviation Δφ substantially equal to 2π/n, n being the number of signals P 0 -P 7  generated. In the example in  FIG. 3 , there are 8 oscillator signals P 0 -P 7  and the average phase deviation Δφ is equal to π/4. 
         [0050]      FIG. 4  represents the random number generating circuit RNGEN. The circuit RNGEN comprises inputs for receiving the oscillator signals P 0 -P 7 , and a signal input for receiving the signal RxD. The circuit RNGEN comprises a flip-flop F 8  and a logic gate XG of EXCLUSIVE OR type. The signal RxD at output of the amplifier AD is applied to a D input of the flip-flop F 8  and to an input of the gate XG. The signal P 0  is applied to the clock input of the flip-flop F 8 . The Q output of the flip-flop F 8  is connected to another input of the gate XG the output of which supplies a signal SCK. 
         [0051]    The circuit RNGEN comprises flip-flops F 0 -F 7  the number of which corresponds to the number of the oscillator signals P 0 -P 7 . Each flip-flop receives at its D input one of the signals P 0 -P 7  and at its clock input the signal SCK at output of the gate XG. The Q output of each flip-flop F 0 -F 7  supplies a signal S 0 -S 7  that is applied to an input of a logic circuit LGCT. The circuit LGCT supplies a random binary number RND at output. 
         [0052]    To show the operation of the circuit RNGEN,  FIG. 5  represents the shape of the signals RxD, P 0  and SCK, and the shape of the signal Q(F 8 ) at the Q output of the flip-flop F 8 . 
         [0053]    When the signal Q(F 8 ) is on 0, the signal P 0  is on 0, and the signal RxD is on 1. When the signal RxD changes to 1, the output Q(F 8 ) remains on 0 and the signal SCK at output of the gate XG changes to 1. When in this state, the signal P 0  changes to 1, the output Q(F 8 ) changes to 1 and the signal SCK changes to 0. 
         [0054]    When the signal Q(F 8 ) is on 1, the signal P 0  is on 0 and the signal RXD is on 1. When in this state, the signal RXD changes to 0, the output Q(F 8 ) remains on 1 and the signal SCK at output of the gate XG changes to 1. When the signal P 0  changes to 1, the output Q(F 8 ) changes to 0 and the signal SCK at output of the gate XG changes to 0. 
         [0055]    Therefore, the signal SCK at output of the gate XG comprises a rising edge, i.e., changes to 1 upon each rising and falling edge of the signal RxD. The signal SCK comprises a falling edge, i.e., changes to 0 upon each rising edge of the signal P 0 . 
         [0056]    The output signal Si (S 0 -S 7 ) of each flip-flop Fi (F 0 -F 7 ) changes to 0 upon a rising edge of the signal SCK if the signal Pi (P 0 -P 7 ) applied at input of the flip-flop is on 0. Conversely, the output signal Sj (S 0 -S 7 ) of each flip-flop Fj (F 0 -F 7 ) changes to 1 upon a rising edge of the signal SCK if the signal Pj (P 0 -P 7 ) applied at input of the flip-flop is on 1. 
         [0057]    Thus, each flip-flop F 0 -F 7  samples the status of the signal P 0 -P 7  applied to its input upon each edge of the signal RxD. 
         [0058]      FIG. 6  represents an example of a logic circuit LGCT enabling a random number RND to be generated according to the signals applied to the inputs S 0 -S 7  of this circuit by the flip-flops F 0 -F 7 . The circuit LGCT supplies a random number RND on 3 bits RND( 0 ), RND( 1 ) and RND( 2 ), upon each rising edge of the signal SCK, i.e., upon each edge of the signal RxD. The value of the number RND varies according to the position of this edge in relation to the rising edges of the oscillator signals P 0 -P 7 . For this purpose, the circuit LGCT comprises four AND-type logic gates AG 1 , AG 2 , AG 3 , AG 4  with three inputs, and an OR-type logic gate with 4 inputs. 
         [0059]    The output RND( 0 ) is connected to the input S 0  of the circuit LGCT. The output RND( 1 ) is connected to the input S 2 . The inputs of the gate AG 1  are connected to the inputs S 0 , S 1  and S 6 . The inputs of the gate AG 2  are connected to the inputs S 0 , S 2  and S 3 . The inputs of the gate AG 3  are connected to the inputs S 2 , S 4  and S 5 . The inputs of the gate AG 4  are connected to the inputs S 4 , S 6  and S 7 . Each of the outputs of the gates AG 1  to AG 4  is connected to an input of the gate OG the output of which is connected to the output RND( 2 ) of the circuit LGCT. 
         [0060]    Thus, the circuit LGCT implements the following equations: 
         [0000]      RND(0)= S 0  (1) 
         [0000]      RND(1)= S 2  (2) 
         [0000]      RND(2)= S 0 .S 1 .S 6 +S 0 .S 2 .S 3 +S 2 .S 4 .S 5 +S 4 .S 6 .S 7  (3) 
         [0000]    in which “.” represents the AND operator, and “+” represents the OR operator. 
         [0061]    The following table summarizes the values of the number RND obtained at output of the circuit RNGEN, and of the signals S 0 -S 7  applied to the inputs of the circuit LGCT, according to the rising edges of the oscillator signals P 0 -P 7  between which the edge of the signal RxD is situated: 
         [0000]    
       
         
               
               
               
               
               
               
               
               
               
               
             
               
               
               
               
               
               
               
               
               
               
             
           
               
                   
                 TABLE 1 
               
               
                   
                   
               
               
                   
                 S0 
                 S1 
                 S2 
                 S3 
                 S4 
                 S5 
                 S6 
                 S7 
                 RND 
               
               
                   
                   
               
             
             
               
                   
               
             
          
           
               
                 P0/P1 
                 1 
                 0 
                 0 
                 0 
                 0 
                 1 
                 1 
                 1 
                 001 
               
               
                 P1/P2 
                 1 
                 1 
                 0 
                 0 
                 0 
                 0 
                 1 
                 1 
                 101 
               
               
                 P2/P3 
                 1 
                 1 
                 1 
                 0 
                 0 
                 0 
                 0 
                 1 
                 011 
               
               
                 P3/P4 
                 1 
                 1 
                 1 
                 1 
                 0 
                 0 
                 0 
                 0 
                 111 
               
               
                 P4/P5 
                 0 
                 1 
                 1 
                 1 
                 1 
                 0 
                 0 
                 0 
                 010 
               
               
                 P5/P6 
                 0 
                 0 
                 1 
                 1 
                 1 
                 1 
                 0 
                 0 
                 110 
               
               
                 P6/P7 
                 0 
                 0 
                 0 
                 1 
                 1 
                 1 
                 1 
                 0 
                 000 
               
               
                 P7/P0 
                 0 
                 0 
                 0 
                 0 
                 1 
                 1 
                 1 
                 1 
                 100 
               
               
                   
               
             
          
         
       
     
         [0062]    Table 1 shows that each possible position of an edge of the signal RxD in relation to the rising edges of the oscillator signals P 0 -P 7  corresponds to a distinct value of the number RND. 
         [0063]    It will be understood that any other combinational logic circuit can be considered to produce the numbers RND using the signals S 0  to S 7 . It is sufficient that the circuit produces a value different from the number RND for each possible position of an edge of the signal RxD in relation to the rising edges of the oscillator signals P 0 -P 7 . 
         [0064]    The circuit RNGEN that has just been described can be applied more particularly to a USB-type (Universal Serial Bus) serial link. According to the USB specifications, the data are transmitted on the link SL with a rate of 1.5 Mbit/s in low speed, 12 Mbit/s in full speed and 480 Mbit/s in high speed. Therefore, each data transmitter on the link SL comprises two amplifiers A 1 , A 2 . Each receiver comprises a differential amplifier AD, AD 1 . According to the number of hubs or intermediate repeaters between a transmitter and a final receiver, a more or less significant phase shift or jitter can appear, each transceiver adding phase jitter to the phase jitter introduced by the transceivers situated upstream on the serial link. According to the USB specifications, this phase shift must remain below +/−18.5 ns for an application in full speed, with a maximum authorized number of five hubs or intermediate repeaters. Each transceiver interposed in the serial link introduces phase jitter that depends on factors such as the stability of the supply voltage, the surrounding noise, the temperature, and the technology used to produce it. 
         [0065]    The circuit RNGEN thus enables the phase jitter that occurs in the signal RxD received to be sampled. This sampling is performed by using the phase-shifted oscillator signals produced by the ring oscillator that is used by the communication interface UICT. The average frequency of the signal circulating in the ring oscillator RO is, in a classic manner, between 50 and 100 MHz, i.e., 4 to 8 times the frequency of the signal received RxD in the case of a Full Speed transmission. If the ring oscillator supplies eight phase-shifted signals P 0 -P 7 , the phase deviation between two signals of consecutive phases Pi and Pi+1 (i being a whole number between 0 and 6) is between 1.25 and 2.5 ns. If the eight signals are used to sample the phase jitter, this amounts to applying an equivalent sampling period of 1.25 to 2.5 ns. This sampling period is perfectly adapted for sampling phase jitter typically between −10 and +10 ns. The number RND resulting from this sampling has a highly random nature for the following reasons. 
         [0066]    The phase jitter that is produced in the serial link USB is advantageously an external source of noise, which results from a combination of several independent primary sources of noise situated in the computer PC and in any hubs HB 1 , HB 2  or repeaters. As the primary sources of noise depend on a large number of factors, they are very difficult to control. Unlike the solutions of previous practices that use a small internal source of noise, the phase jitter used in one embodiment of the present invention as a source of noise does not need to be amplified. 
         [0067]    Furthermore, the circuit RNGEN enables a relatively large flow of random variables to be obtained: 3 bits upon each edge of the signal RxD, i.e., 3 bits at a frequency of 12 MHz. It is easy to increase this flow, by increasing the number of amplifiers OA in the ring oscillator RO, or by increasing the average frequency of the signal that propagates in the ring oscillator. 
         [0068]    It shall be noted that one embodiment uses the presence of a ring oscillator in the integrated circuits equipped with a USB-type serial communication interface. Such a ring oscillator supplies several signals substantially of the same average frequency, phase-shifted in relation to one another by a substantially constant average phase deviation. These signals are logically combined with the signal received by the communication interface, and the signals obtained by these logic combinations are used to generate random numbers. 
         [0069]    It will be understood by those skilled in the art that various alternative embodiments and applications of the present invention are possible. Thus, it is not essential to sample the signals P 0 -P 7  upon each edge of the signal received RxD. The sampling can be carried out only upon each rising or falling edge of the signal received. To that end, the signal RxD only needs to be applied directly to the clock signal input of the flip-flops F 0 -F 7 . The flow of random numbers generated will then be smaller. 
         [0070]    It is not necessary either for the phase deviation between the oscillator signals to be substantially constant. This feature comes from the use of a ring oscillator. The absence of this feature merely introduces a bias into the random nature of the numbers RND generated. 
         [0071]    Embodiments of the present invention do not only apply to USB-type links. They can be applied to any data transmission link in which phase jitter can occur. Embodiments of the present invention do not apply exclusively to integrated circuits used in smart cards either. They can be applied more generally to any device equipped with a communication interface that must generate random numbers. 
         [0072]    All of the above U.S. patents, U.S. patent application publications, U.S. patent applications, foreign patents, foreign patent applications and non-patent publications referred to in this specification and/or listed in the Application Data Sheet, are incorporated herein by reference, in their entirety.