Discrete Chaos - BasedRandom Number Generator

Julio A. AGUILAR ANGULO ∗, Edith KUSSENER∗, Herve BARTHELEMY∗ and Benjamin DUVAL†Email: juloaguilar@gmail.com, edith.kussener@im2np.fr, herve.barthelemy@im2np.fr, benjamin.duval@invia.fr

∗Institut Materiaux Microelectronique Nanosciences de Provence, UMR CNRS 6242, Marseille, France† Analog IP’s and Technologies Manager. INVIA. Aix-en-Provence, France

Abstract—This paper presents a low power True RandomNumber Generator (TRNG), based on the discrete time-chaos,intended for a RFID security applications, to be developped onCMOS 350nm standard technology.The circuit relies on a discrete time chaotic oscillator to generatepatterns to be sampled to get a raw random signal to be debiasedby a digital corrector.

I. INTRODUCTION

Secured data application (wired or conctactless datatransactions) relies on random numbers for keys/identifiergeneration. It guarantees non-vulnerability against maliciousattacks (spectral analysis , i.e.).Thus the strength of a secured cryptographic system dependsdirectly on the good statistical properties of Random NumberGenerators (RNG). There exist two types of ramdomnesssources: deterministic and physical.

Deterministic sources use algorithms, depending of aninitial seed value; they are susceptible to observation andreverse engineering methods. RNG using this sources arecalled Pseudo Random Number Generators (PRNG).

Physical sources such as nuclear decay, cosmicradiation, intrinsec topology imperfections, thermal noiseor metastability, come from intrinsecal matter propertiesand they have real random properties, and they are used asa basis for True Random Number Generators (TRNG) design .

Common techniques used in TRNG design include:• sampling of direct thermal noise amplified signals,• jittered oscillator sampling,• chaotic systems (continous or discrete),• metastability stages/ oscillators,• physically unclonable functions (PUF).

Due to the low power characteristics required, direct noisesampling and continuous time chaotic systems are not takein account, as they require a considerable amount of powerconsumption budget to operate. Metastability-based solutionsand PUFs are not easy to model and process dependent.Jitter clock sampling is best suited for low power andsimplicity [5][11][10]. It involves a high speed clock

sampling the slow, jittered one.

RFID systems tend to reuse the carrier signal from theantenna as the high frequency clock source. As we will notuse this system in order to design a completely autonomousIP, we will not use the slow, jittered versus high speed clockapproach.

We will explore the discrete time chaotic oscillators as asource for an unpredictable signal to be sampled and shapedto get random binary patterns.Section II present the basic concept of discrete time chaoticsystems, section III in order to present the system to bedeployed. Section IV describes the system blocks, and finallythe results from simulations and testchip are presented.

II. DISCRETE-TIME CHAOOTIC SYSTEMS

Discrete-time chaotic systems use a periodic iteration of anon-linear function, f , to acchieve the chaotic state (fig. 1.a):

Xk+1 = f(λ,Xk) (1)

Fig. 1. Discrete time chaotic system: (a)general concept. (b)proposedimplementation.

f(x), called chaos map, depends on additional parameters(λ) to guarantee its chaotic behavior. This allows thepossibility of switching from monotonal output to aperiodicand even periodic signals by controlling those parameters.

Well known chaos maps in the literature are the ’logistic’,’tent’ or ’Bernoulli shift’ maps. They differ from each other in

978-1-4799-3773-8/14/$31.00 ©2014 IEEE

terms of probability density, and complexity of the involvedfunction.

Due to their region behavior, it’s possible to easilyimplement non linear blocks, order to switch between twodifferent regions between them to create differents ranges ofdc operation. In the other side, low consumption is a veryinteresting feature to achieve with less transistors.

In order to implement the circuit of figure 1.a, slightmodifications to the reference scheme were done (fig. 1.b).The sample and hold system is replaced by a switch arrayand an intermediary buffer. Ca and Cb act as memory ele-ment between both stages. We use the intrinsecal equivalentcapacitances on each stage, in order to save area.

III. PROPOSED SYSTEM

Figure 2 illustrates the macrocell implementation presentedon fig. 1.b, with the nonlinear mal and the buffer connectedto generate a chaotic oscillator (CELL 01 and CELL 02) anda 1 bit ADC (SAMPLER) in order to obtain a raw biasedrandom binary signal to be post processed later.

Fig. 2. Proposed TRNG block diagram.

In order to have more than one degree of freedom formanual/automatic callibration the circuit has control pins toconfigure the values of the required biasing.

IV. SYSTEM DESCRIPTION

A. Chaotic Oscillator

The discrete time chaotic oscillator presented is composedby a non linear map, a buffer and a clock generator circuit.

1) Tent Map: It uses three transistors MP1,MP2 and MN1(fig. 3.a). Its nonlinear caracteristic is depicted on figure 3.b, interms of the biasing Vbb voltage applied to the BIAS terminal.

Fig. 3. tent cell:schematic and parametric sweep vs model.

The positive slope in the curve is created by the sourcefollower formed by MP2 and MP1 (MN1 remains off, untilthe input voltage arises its threshold voltage). Once MN1

is activated, it reachs the saturation region and it forms aninverter with MP2, with MP1 progressively turned off, thispart is observed as a change into a negative slope. The finalpart of the curve is due to the transition of MN1 to the trioderegion. For the transitions, MP2 acts as an active load, andits sizing defines the total current used by the map.

Fig. 4. buffer:schematic and parametric sweep.

The biasing pin allows us to control the behavior of theoscillator, being able to switch from chaotic to periodic.

2) buffer: This block is a simple NMOS source followerthat uses an active load. As shown in figure 4 the buffercaracteristic has an input voltage shift.

3) Clock Generator: The oscillator (fig. 5.a) is modifiedring oscillator with shutdown and using a current starvedinverter topology array, allowing to reduce power and in-troducing switching artifacts in terms of current. The threestage shared current inverter array (MP1:3,MN1:3) in theoscillator generate weak oscillations to be buffered with aninverter (MP4,MN4) and finally completing the none numberof gates of the ring by passing accross the shutdown logic(MP5:6,MN5:6) tied to the ring biasing(MP9). An outputinverter generates a square wave with a frequency of 250KHz.

Fig. 5. (a)Clock generator with shutdown. (b) switch controller

4) Switch Controller: The switch controller (fig. 5.b) reusesthe generated clock to sequentially switch MN2 and MN3.

B. Biasing and Start-up Circuit

1) Startup circuit: This circuit (fig. 6) uses an Ogueyreference with a proper startup circuit and a voltage shifterto obtain the desired biasing points for the rest of the circuit(PBIAS=2.5V,NBIAS=0.5V,IBIAS= 50nA, tstartup=50µs).

Fig. 6. Biasing-Startup Circuit.

2) Programmable Biasing: It provides the biasing levels tothe cells of the chaotic oscillator and the comparator (fig. 7).

This allows the use of two possible biasings. The first isinternal based on voltage shifters and current mirrors, to testthe precalculated biasing that puts the oscillator in chaoticoperation. A switch array allows to bypass the internal one andprovide external callibration in order to correct any deviationdue to post-layout and process variations.

Fig. 7. selectable biasing circuit.

C. One bit Sampler

Fig. 8. One bit Sampler.

This block (fig. 8), is based on a comparator plus an outputbuffer stage to digitize the signal from the chaotic oscillator.The comparator is a rail-to-rail OTA, based on the ”symmet-rical” architecture [2]. The output buffer allow us to have adigital output and to increase the load capacity.

Fig. 9. block diagram of the design under test.

V. RESULTS

A set of post-layout parametric simulations on the system(fig. 9) allowed to identify the regions of chaotic behaviorgiven by the biasing parameters VCTRL1, VCTRL2, VC-TRL3. The biasing values, with a tolerance of 10%, were: VC-TRL1= 0.7V, VCTRL2=0.7V, VCTRL3=0.5V. Circuit com-sumption in stand-by mode remains around 2µA and in freerunning mode it varies from 10µA to 50µA

Fig. 10. Chaotic Oscillator and binary stream

The signals obtained at the output of the chaotic oscillatorand the sampler are shown on fig. 10. the plot is shifted dueto the voltage losses on each switch. Due to the switchingtransitions, some signal overshoot is added, spikes areproduced in both sides of the transitions, adding moreinestability to the signal.

A plot of the caracteristic function gives the curve of fig.11. The effects of the spikes are present in the second halfof the curve, instead of the flat part of the original non linearcell. In the remaining, part of the non linear function, we canobserve the original tent cell, with some losses in both inputand output due to the non modelized MOS switches and thevoltage shift on the buffer.

In order to guarantee the chaotic nature of the oscillator,the verification by the largest Lyapunov exponents has beenperformed under databins of blocks of ten milliseconds ofsignal, giving as result a negative value, that correspond toa chaotic oscillator.

Fig. 11. recovere d map showing additional switching effects.

After sampling the chaotic output, we need to analize thebit stream in order to apply any post processing. Figure 12.arepresents the distribution of bits in the input stream. Is clearthat the overshoot artifacts cause a tendency to increase thelogical ’1’ values on the distribution. After applying a 8 bitLFSR corrector (x7 + x3 + x2 + x1 in the example), thedistribution becomes uniform (fig. 12.a). Finally, in order

Fig. 12. Binary distribution (a) before processing (b) after processing.

Fig. 13. binary stream (a) before processing (b) after processing.

to verify the level of reliability, the NIST test suite wasapplied to the extracted values. It passed most of the tests: Monobit Test, Frequency Test within a Block, Runs Test ,Test for the Longest Run of Ones in a Block, Binary MatrixRank Test,Spectral Test, Non-overlapping Template Matching,Overlapping Template Matching Test, Maurers ’Universal Sta-tistical’ Test, Linear Complexity Test.

VI. TESTCHIP

A testchip of the chaotic oscillator and sampler was released(fig. 14) on AMS 350nm 3.3V standard process in order toverify the behavioral of the raw stream and recalibrate thebiasing if necessary to compensate any process variation. Thesystem is still under test phase.

Fig. 14. Proposed TRNG Block Diagram.

VII. CONCLUSION

We presented a true random number generator based ona chaotic oscillator noise-like source, that uses a discreteiteration of a non linear map. The circuit was designed toprovide random bit streams at 250KHz and implemented instandard CMOS AMS 0.35µm, 3.0V process

A more elaborated study of the post-processing block isunder study too in order to improve the ramdomness. Weexpect to be able to show more experimental results duringthe conference.

REFERENCES

[1] Mandal, S. and Arfin, S. and Sarpeshkar, R., Fast startup CMOS currentreferences, ISCAS 2006. Proceedings. IEEE International Symposiumon Circuits and Systems, 2006.

[2] Baru, Marcelo and de Oliveira, Oscar and Silveira, Fernando, A 2Vrail-to-rail micropower CMOS comparator, Proceedings of the XIConference of the Brazilian Microelectronics Society, 1996.

[3] Toru Nakura, Makoto Ikeda, Kunihiro Asada, Ring Oscillator BasedRandom Number Generator Utilizing Wake-up Time Uncertainty, Pro-ceedings of the Solid-State Circuits Conference, 2009. A-SSCC 2009.

[4] Wei Chen, Wenyi Che, Zhongyu Bi, Jing Wang, Na Yan, Xi Tan, JunyuWang, Hao Min, Jie Tan, A 1.04 µW Truly Random Number Generatorfor Gen2 RFID tag, Solid-State Circuits Conference, 2009. A-SSCC2009.

[5] Amaki, Takehiko, Hashimoto, Masanori, Onoye, Takao, An oscillator-based true random number generator with jitter amplifier, InternationalSymposium on Circuits and Systems (ISCAS), 2011.

[6] Balachandran, G.K., Barnett, R.E., A 440-nA True Random NumberGenerator for Passive RFID Tags,IEEE Transactions on Circuits andSystems I: Regular Papers, 2008.

[7] J. Holleman, B. Otis, S. Bridges, A. Mitros, C. Diorio,A 2.92uWhardware random number generator, Proc. 32nd European Solid-StateCircuits Conference (ESSCIRC 2006), pp. 134-137, IEEE, Sept. 2006.

[8] N. Stefanou, S.R. Sonkusale,High speed array of oscillator-based trulybinary random number generators, Proceedings of the 2004 InternationalSymposium on Circuits and Systems, 2004.

[9] Ihor Vasyltsov, Eduard Hambardzumyan, Young-Sik Kim and BohdanKarpinskyy,Fast Digital TRNG Based on Metastable Ring Oscillator ,Proceedings of the CHES 2008, 2008.

[10] Craig S. Petrie and J. Alvin Connelly,Modelling and simulation of oscil-lator based random number generators, ISCAS ’96., IEEE InternationalSymposium on Circuits and Systems, 1996.

[11] Zhou, S.; Zhang, W.; Wu, N., An ultra-low power CMOS randomnumber generator , Solid-State Electronics, vol. 52, issue 2, pp. 233-238,2007.