Fast True Random Number Generator Based on Chaotic Oscillation in Self-Feedback Weakly Coupled Superlattices

Random numbers play a vital role in communications and cryptography. However, most existing true random number generators have difficulty in satisfying the requirements of high-speed communications due to their complexity and bulkiness, or low speed limitations due to equipment bandwidth. Then, the all-electron true random number generator was presented based on GaAs/Al0.45Ga0.55As superlattices conducted under direct current bias at room temperature, which not only possesses the characteristics of miniaturization but also generates random numbers at rates up to the Gbit/s. However, the bit rate of random number generators based on superlattices is still much slower compared to chaotic laser random number generators. In order to generate higher-rate random numbers, we modified a DC-excited superlattice and then redirected the signal generated by the superlattice back into itself, thus introducing a self-feedback, and achieved a self-feedback superlattice true random number generator. This improvement makes the superlattice have a more detailed signal shape, a more effective signal amplitude, and with lower power consumption. Therefore, these advances made the self-feedback superlattice more suitable for generating random numbers. Moreover, we propose a new post-processing method, called the adjacent bits reversal exclusive-or. This method can reduce the sequence bias and correlation without discarding any random bit. The random number obtained by the self-feedback superlattice at a sampling rate of 10 GS/s passed the triple standard deviation test and the random number standard test (NIST SP 800-22), indicating that it possessed good statistical properties as a miniaturized random number generator.


I. INTRODUCTION
Random numbers play a vital role in Monte Carlo simulation, cryptography, digital authentication, secure communications, and various other fields [1], [2]. In protected communications, when cryptographic technologies used such methods as symmetric passwords, public key passwords, message authentication codes, digital signatures, etc., a key is required. Generally, random numbers are used as the keys to encrypt the original information. Shannon's theory [3] proves that as long as the key is completely random, consistent with the length of the information to be encrypted, and appears only once, called the one-time pad. It is theoretically impossible to decipher, so the rapid generation of safe and reliable random numbers The associate editor coordinating the review of this manuscript and approving it for publication was Chao-Yang Chen .
is pivotal to the security of communication systems. Depending on the method of generation, random numbers can be divided into true random numbers and pseudo-random numbers. Pseudo-random numbers are generated by deterministic algorithms, with periodicity and reproducibility [4], [5].
The true random number generator (TRNG) is based on the unpredictable physical random phenomenon [6], which can generate unpredictable and unreproducible true random numbers. Representative TRNGs are mainly based on physical entropy sources such as circuit thermal noise [7], [8], oscillators [9], and chaotic circuits [10], [11]. But the rate of these random number generators is mostly at the Mbit/s level, which makes it difficult to meet the demands of modern communication systems for high-speed random numbers generation. In recent years, using chaotic lasers as the source of physical entropy, rates of generation of up to 100 Gbit/s [12], VOLUME 8, 2020 This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see https://creativecommons.org/licenses/by/4.0/ 300 Gbit/s [2] off-line, and rates up to 14 Gbit/s [13] and 20 Gbit/s [14] in real-time have been obtained. However, chaotic lasers have high costs and are complex systems, which involve electro-optical and optical-electrical conversion, and can be easily interfered with by external factors. These factors make chaotic laser-based random number generators face many challenges in practical applications. Therefore, an all-solid-state fast physical noise source with high bandwidth, miniaturization, and low power consumption is urgently needed. Semiconductor superlattices (SLs), first proposed by IBM's L.Esaki and R.Tsu, is an all-solid-state electronic device which is periodically grown by two semiconductor materials with proper lattice matching [15]. Yaohui Zhang's team from the Chinese Academy of Sciences was the first in the world to discover the spontaneous chaos oscillation phenomenon of the GaAs/Al 0.45 Ga 0.55 As SL in the liquid nitrogen temperature range and room temperature conditions [16]- [18]. Many scholars over the world have confirmed that this SL was an ideal source of chaotic noise by exploring the structure of the GaAs/Al 0.45 Ga 0.55 As SL and the spontaneous chaos oscillation phenomenon, which could be used to generate true random numbers [19]. The rate of random number generation could be up to 6.25 Gbit/s by means of a single SL chip, and the rate could be increased to 80 Gbit/s when combined with six SL chips [20].
To generate faster random numbers, the signal generated by the SL itself was re-injected into the SL through an adjustable attenuator and bias-tee to form the self-feedback SL random number generator. Contributing to this change, the performance of the superlattice TRNG has been improved a lot, such as quicker changes, larger signal amplitude, and lower power consumption. These improvements made the self-feedback SL random number generator more conducive to the random number generation. In this paper, we propose a new post-processing method, called the adjacent bits reversal exclusive-or (XOR) method, which will take full advantage of the new SL signal to generate higher-rate random numbers. The self-feedback SL random number generator generates a random number at a sampling rate of 10 GS/s. The lowest 4 bits are selected, which means a rate of 40 Gbit/s. These random numbers passed the triple standard deviation test and the random number standard test (NIST SP 800-22). It is expected to promote the further application of SLs in the field of random numbers generator.

II. SL STRUCTURE AND PRINCIPLE
The structure of the investigated sample is schematically shown in Fig. 1, and consists of a 50-period, weakly coupled GaAs/Al 0.45 Ga 0.55 As SLs with CaAs wells and Al 0.45 Ga 0.55 As barriers. The mole fraction of Al in the barriers was selected at 0.45 to suppress the thermal leakage current though the X Valley [21], [22]. The conductor SL was deposited by molecular beam epitaxy (VG V80H) on a 2-inch Si-doped GaAs substrate (Wafer Technology Ltd.) [23]. It was packaged into a dual in-line package type for facilitating the experiment. Its core size is only 1.5 mm×1.5 mm. From a microcosmic aspect, the SL is sandwiched between two 300nm silicon-based GaAs layers, forming an n+-n-n+ diode structure. The thickness of the Al 0.45 Ga 0.55 As barrier layer is 4nm, and the total thickness of the GaAs potential well layer is 7nm, in which there are 2nm thick undoped GaAs layers on both sides of the doped silicon-based GaAs layer to prevent the diffusion of silicon (Si) atoms to the adjacent Al 0 .45 Ga 0.55 As barrier layer [20]. Although these structures are periodic, during the growth process, their layer thickness, doping concentration, etc. inevitably introduce random fluctuations, thus constituting a random nonlinear system with a tremendous degree of freedom. The alternately grown GaAs and Al 0.45 Ga 0.55 As materials constitute the well and barrier of the quantum well, respectively. The charge is confined to each quantum well in a weakly coupled SL, and the transport of charge is achieved by resonance tunneling between each adjacent quantum well. The sequential resonant tunneling effect of the weakly coupled SL introduces a negative differential conductance effect, which makes the behavior of electrons in the electric field non-linear, so the electrons lose their phase information, forming a particularly complicated random process.

III. EXPERIMENT DESIGN
The Schematic diagram SL random number generator is shown in Fig. 2, improved from the SL random number generator under the DC bias voltage. The system can be divided into two sections: the SL physical entropy source and the random number extraction. The physical entropy source section was obtained by injecting the signal of the SL back to the SL with a DC bias voltage appended to the SL. The random number extraction section digitizes the physical entropy source signal and finally generates detectable random bits after post-processing. In this paper, we use a digital source meter (DSM, Keithley-2400) to provide the voltage regulation to the SL device and measure the corresponding current and voltage and output a linear sweep voltage to measure the I-V characteristics. The voltage sweep of the Keithley 2400 digital source meter was used to measure and 182694 VOLUME 8, 2020 plot the I-V characteristics. We set the voltage type to linear, from 0 V to 6 V, and set the step size to 1 mV, and the source table upper limit current was set to within 20 mA to ensure the protection of the SL device.
The DSM connected a bias-tee (Mini-Circuits ZFBT-6G+, 50 , 10 to 6000 MHz) before connecting the SL, in order to avoid the influence of parasitic capacitance on high-frequency signals. The bias-tee consists of an ultrabandwidth, near-ideal inductor L and capacitor C. The inductance prevents high-frequency signals from leaking into the DC power supply system, and the capacitor prevents the DC voltage from leaking into the high-frequency circuits and measurement instruments [24]. The connections between each device of the physical entropy source are the Small A Type (SMA) interface high-frequency coaxial cables with a bandwidth of 6 GHz. The SL was connected to the bias-tee through SMA coaxial cables to obtain a DC power supply and then grounded after a 50 SMA copper-nickel coaxial load for resistance matching. The signal between the negative electrode of the SL and the load resistance was sent to the capacitor of the bias-tee through a coaxial cable to form a selffeedback. A variable attenuator is added to the path to investigate the process of the feedback signal from small to large. The attenuator has six settings: 16 dB, 8 dB, 4 dB, 2 dB, 1 dB, and 0 dB (when no button is pressed), and it will produce the corresponding attenuation when the button is pressed. The signal generated from the SL was observed and measured by the oscilloscope (OSC, Lecroy, HDO 9404-MS, 40 GS/s). Sampling and quantization were carried out in 10-bit mode, and the 4 least significant bits (LSBs) were selected for adjacent bits reversal XOR (ABRX) processing, and finally, a random sequence was obtained for detection.

IV. ANALYSIS OF SL SIGNAL
According to previous research results [19], [20], the signals output from the GaAs/Al 0.45 Ga 0.55 As SL at different bias voltages represent different characteristics, and the chaotic oscillation signal only appears in a specific voltage range. The SLs under DC can be regarded as the amplitude of the feedback signal is infinitesimal (the attenuation coefficient is infinite). The amplitude of the feedback signal increases with the decrease of the attenuation coefficient. We continuously increased the feedback signal until no attenuation was added, and measured the I-V characteristics of the SLs with different feedback attenuation coefficients and DC bias.
When the scanning voltage of the source table is close to the chaotic oscillation region, the slope of the I-V curve increases sharply at first, then decreases, and the negative differential phenomenon appears (Fig. 3). Note that the chaotic oscillation region here does not refer to the oscillation of the I-V curve, but to the voltage range in which the SL device will produce a time-domain trace oscillation. The negative differential conductance effect is caused by the resonance tunneling effect of the electrons in the SL. The current in the semiconductor increases with the increase of voltage under normal conditions. However, the current decreases with the increase of voltage in the negative differential voltage range, which leads to the generation of the oscillation of the SL signal.
The oscillation range was about 3 V, when the amplitude of the feedback signal was very small (and the attenuation coefficient was large). While the chaotic oscillation region moves into the region of about 1V, when the feedback signal continued to increase (and the attenuation coefficient became smaller). These voltage ranges are described in detail in Table 1. When the feedback attenuation coefficient was between infinity to 4 dB, the maximum power of the SL was 14.39 mW. But the maximum power was only 3.53 mW when the attenuation coefficient was 2 to 0 dB, which was less than 1/4 of the former's power. So, from the point of view of power consumption, it was better to select a feedback coefficient of between 2 and 0 dB. The I-V characteristics, waveform shape, and amplitude of the SL with 16-4 dB feedback coefficient are very similar to those under DC. When the feedback signal continued to increase (2-0 dB), the SL waveform changed significantly, and the waveform amplitude increased along with the increase of the feedback signal. Therefore, the self-feedback SL without attenuation (0 dB) was a better option for the entropy source of the random numbers, both in terms of power consumption and waveform amplitude.
The three most representative traces of the SL are shown in Fig. 4. The three signals are DC period, DC chaotic oscillation, and 0 dB self-feedback chaotic oscillation. It is easy to find the periodicity of the signal by observing the signal trace produced by the SL in Fig. 4 (a), and a waveform with the same shape repeatedly appears, similar to a pulse. In the frequency domain, the signal also has the characteristic of a discrete periodic signal, and the peak appears at the integral multiple of the basic frequency. So this signal can not be used for random numbers due to periodicity. The latter two are chaotic oscillation signals, quite different from the previous periodic signals. The chaotic oscillation signal in Fig. 4 (b) is similar to a time-varying pulse. The width of the peak is 3 ns, and the interspike interval (ISI) is about 7 ns, with the amplitude of the peak exceeding 90 mV. The noise amplitude between the peaks is at least one order of magnitude lower than the amplitude of the peak. These noises may come from the background noise of the test equipment and the thermal noise or scattering noise inside the SL [25]. The voltage between each peak is very low, equivalent to a ''blank area''. In order to avoid continuous acquisition in this area, the sampling interval has to be increased, which limits the sample rate leading to the rate of random number generation lower than expected. The power spectrum of the chaotic signal under DC is not as discrete as the previous DC periodic signal. As shown in Fig. 4 (e), it is continuous and has a bandwidth of hundreds of MHz. Fig. 4 (c) displays the 100 ns trace of the self-feedback SL signal. The ''blank area'' between two peaks under DC bias disappears, meaning that the self-feedback signal contains more information, and higher sampling frequency can be adopted for a higher rate of random numbers. More importantly, the amplitude and shape of the signal change more dramatically under self-feedback than under DC chaotic. Fig. 5(a) presents the calculated probability density function (PDF) for the amplitude of the waveform generated by superlattices. Although the PDF resembles a Gaussian distribution, the PDF is clearly identified by comparing it with the fitted Gaussian (blue curve in Fig. 5(a)), which means that keeping all the 10-bit of data cannot pass the statistical tests of randomness. Therefore, to extract random bits from the entropy, post-processing should be employed. The autocorrelation trace for the SL signal is shown in Fig. 5(b). The correlation coefficient after zero-graduation decays to 0 rapidly, indicating that the signal has almost no autocorrelation. Fig.6 shows the chaotic attractors [26] of the superlattice signal. The existence of chaotic attractors means that the proposed entropy source is chaotic and can be used to generate true random numbers.

V. POST PROCESSING
Generally, the random number quantized by direct sampling does not meet the requirements of statistical characteristics. In order to make up for the non-uniformity of quantitative data distribution and further eliminate the autocorrelation, various post-processing is needed.

A. SELECT THE LEAST SIGNIFICANT BITS
Shannon entropy [27] and minimum entropy [28] are effective tools to depict the statistical characteristics of random numbers. Shannon entropy can quantitatively evaluate the effective information in a random sequence, and the independence and uncertainty of each bit. The larger the value, the more information it contains. The minimum entropy means that the system with the minimum entropy is in a reliable state, which represents the difficulty of predicting random numbers. Shannon entropy and minimum entropy are where H n is the Shannon entropy, and H min is the minimum entropy, and X is a discrete random variable in the range R = {x 1 , x 2 , x 3 , . . . , x 2 n }, and p i is the probability of value when X = x i . It can be obtained by calculation that when the random number sequence corresponds to a uniform distribution, p i = 1/2 n , the Shannon entropy value of the sequence reaches the maximum value H n (X ) = n, and at the same time makes H min (X ) have a minimum value = n. The Shannon entropy value reaches the maximum value so that the random number sequence has the maximum information entropy. Meanwhile, it has the maximum stability with minimum entropy. Shannon VOLUME 8, 2020 entropy and minimum entropy both indicate that the random number sequence should conform to a uniform distribution. In order to make up for the non-uniformity of quantified data distribution and further eliminate autocorrelation, selecting the m least significant bits (LSBs) is a relatively common and simple method to improve the uniformity of distribution [29]. Hirano et al. [30], Nguimdo et al. [31], and Li and Chan [32] selected the 6, 4, and 3 LSBs, respectively, and obtained uniformly distributed random bits. Oliver et al. [33] pointed out that it is effective to estimate the appropriate number of bits by drawing histograms of amplitude-frequency distributions of different digits, and successively lowering the value of m bit a flat frequency distribution histogram is obtained within the allowed statistical variation range. Consistent with the descriptions in references [29], [33], when more high bits are continuously discarded, and fewer LSBs are selected, the unevenness of distribution is greatly improved, gradually approaching a uniform distribution. When m = 4, the amplitude distribution of the quantized result and the uniform distribution are almost consistent, as shown in Fig. 7. The quantized output bits of the multi-bit ADC determine the speed of random number generation. The more digits are reserved, the higher the rate. Therefore, when extracting m LSBs as a random number output, it is necessary to make the value of m as large as possible under the premise of satisfying the quantized amplitude distribution of the balance, at the same time taking into account the rate of random number generation.

B. ADJACENT BITS REVERSAL XOR
The random bits processed by the LSBs method do not mean that they can pass all the statistical tests of randomness because there are still obvious deviations or correlations in the generated random bits. So it is still necessary to combine with other post-processing steps to ensure that the random numbers meet the requirements for good randomness. Ido Kanter [2] adopts an 8-bit ADC to sample and quantize the signal converted from chaotic lasers to voltage at a rate of 40 GS/s, then performed multi-order differentials, and selected m LSBs to ensure passing the random number test. The schematic diagram of the device Ido Kanter operated is quoted in Fig. 8(a). Additionally, Sze Chun Chan directly performs XOR on the 3 LSBs of adjacent signals after obtaining ADC quantization as quoted in Fig. 8(b). The method proposed by Ido Kanter is very effective and achieves a breakthrough 300 Gbit /s random generator under the laboratory conditions, which is a historic breakthrough in the rate of random numbers generation. However, due to the large number of calculations and the need for a large amount of cache, it is difficult to realize such a rate in reality. Conversely, Sze Chun Chan's method has almost no computation, and only selects LSBs and conducts XOR, without any multi-step differential calculation. But half of the random bits are discarded during the XOR operation.
Therefore, we need post-processing which can meet the following three conditions. Firstly, it can reduce the bias and correlation of random sequences to ensure that it can pass the random number test. Secondly, it only needs a few calculations to facilitate real-time processing. Thirdly, it does not need to discard the random bits to improve the random number generation rate.
As XOR is considered to be a very important method to process random numbers, we will analyze it here. Suppose that the values of two random variables X and Y are 0 or 1, and their mathematical expectation values are µ and ν respectively. We carry out an XOR operation between X and Y to obtain a new random variable Z , and so its mathematical expectation value is as follows [34]: where ρ is the cross-correlation coefficient of X and Y , representing the degree of correlation between them. When the correlation degree of random variables X and Y is very small so that ρ can be ignored. Because X and Y are random variables, µ and ν are very close to 0.5, and (µ-10.5)×(ν-0.5) is much less than either of (µ-10.5) or (ν-0.5). So when X and Y are independent, the error of the sequence after XOR will be less than any of the original sequence. If we find a way to make the two adjacent random numbers lose correlation, then we would treat random numbers by direct XOR. The Hamming distance [35] between different binary sequences can reflect the independence between them. If the hamming distance is closer to 0.5, their independence is stronger. Table 2 shows the hamming distance between the different bits(1 Gbit data at 10GS/s). Therefore, we propose a new method, called adjacent bits reversal XOR, which is illustrated in Fig. 9. And there is no correlation between the first bit and the last bit of the data collected by ADC [36]. Firstly, the original data is processed with m LSB and the least 4 bit data is selected to improve its uniformity. Secondly, reverse the original 4-bit bits at time t, and then XOR them directly with the four bits sampled from t+1 the following time, then output the result. According to this method, input 4 (n + 1) bit data, and finally obtain 4 n bit data. When n is very large, it can be considered that there is no need to discard random bits during the adjacent bits reversal XOR process, and the random bit generation rate will not decrease. But the deviation and correlation of random bits is reduced greatly. Compared with the previous method, the adjacent bits reversal XOR is quite different because the former needs to discard half of the random numbers. However, our method only needs to reverse the data for XOR (change the byte high-order and low-order read order), without introducing complex calculations such as multi-level difference and other resource-consuming calculations. This post-processing, as presented is easy, and is also easy to conduct in the Embedded hardware. In summary, the adjacent bits reversal XOR can greatly reduce the random sequence deviation and autocorrelation coefficient without losing random numbers and greatly reduces the number of post-processing calculations.

VI. RANDOMNESS TEST A. TRIPLE STANDARD RANDOM TEST
Triple standard deviation test (3σ criterion) [37] based on the feature of ideal random bits is a common method to validate random numbers. A model that generates random numbers by tossing a coin under ideal conditions is set up for 3σ criterion. The probability of either side of the coin landing face up is equal, and in the equation the positive side represents 1 and the negative side represents 0.
Under the same initial conditions, n repeated coin tossing experiments are carried out to obtain a random sequence X of length n. As the number of coin flips n increases, the probability of the event gradually approaches the Gaussian distribution from the binomial distribution. The variance (D(x)) of VOLUME 8, 2020 the sequence X is: where E(x) is the mathematical expectation. According to the central limit theorem: when n → ∞.
To calculate the first-order autocorrelation coefficient (a 1 (n)) of sequence X : Because of x i = 0, 1, , the numerator of the formula can be simplified according to the values of x i and x i+1 shown in Table 3.
where x and y is a random sequence. With the help of the coin toss model, it is simple to calculate a 1 (n), but the difference is that the positive side represents 1 and the negative side represents −1. So the distribution of the first-order autocorrelation coefficient a 1 is: According to the principle of hypothesis testing, within the range [−3σ , 3σ ], the area enclosed by the probability function and the x-axis is 99.7%. This means that the probability that the offset of a true random sequence of length n falls within the range [−1.5/ √ n, 1.5/ √ n] is 99.7%. Similarly, the first-order autocorrelation coefficient of the random sequence should also fall within the range [−3/ √ n, 3/ √ n]. By comparing the deviation and autocorrelation coefficient of the random sequence to be detected with the sequence deviation and autocorrelation coefficient of the coin-tossing model, it is very easy to determine whether the random sequence meets the triple standard error test.
1 Gbit data from SL, with and without the adjacent bits reversal XOR method, was examined at a sampling rate of 10 GS/s to validate the method proposed in this paper. This 1 Gbit data was obtained by selecting only 4 LSBs. We recorded the deviation of data |e(N )|disposed by adjacent bits reversal XOR and |e(N )| without using this process in Fig. 10(a). The first-order autocorrelation coefficient a 1 of this 1 Gbit data, recorded respectively |a 1 (N )|and |a 1 (N )|. The curve of |e(N )| was always below the 3σ e , but the |e(N )| exceeded the ideal random curve, so it did not pass the 3σ criterion. Like the former, |a 1 (N )|was always below 3σ a 1 , but |a 1 (N )| exceeded the 3σ a 1 as shown in Fig. 10(b).

B. NIST STATISTICAL TESTSUITE
The statistical test suite 800-22 from the National Institute of Standards and Technology(NIST) [38] is a recognized standard for testing random numbers. So we used it for further testing and verification of the quality of the random bits of the final output. The random bit sequence passed the NIST statistical test using 1000 bitstreams of 1 Mbit length. Test items  and outcomes, pass rate, and p-values are shown in Table 4. It lists the P-values of all 15 sub-test items and corresponding pass rates at the sampling rates of 2.5 Gs/s, 5 Gs/s, and 10 Gs/s in turn. We extracted the 4LSBs from each 10-bit sample, and converted sampling rates to the rates of random bits, which were respectively 10 Gbit/s, 20 Gbit/s and 40 Gbit/s. And as the sampling rate continued to increase, the NIST test failed. An all-electronic physical random number generator at rates up to 40 Gbit/s is realized by a single SL chip. Usually the significant level α = 0.01, when the P-Value > α, can it be considered to have passed the test. The possibility of P-Value > 0.01 should fall in the range of [0.9805,0.9995] [39]. All of the tests succeeded, and it showed that the random number from self-feedback SL has good statistical randomness. In summary, a single SL chip generates random numbers with a rate of up to 40 Gbit/s and can pass 3σ deviation and NIST tests. Table 5 includes the TRNG system, post-processing, speed of random bits, etc., to compare the different performances of advanced TRNG in recent years. Although The superlattice TRNG has been greatly improved, there is still a gap between superlattice TRNG and laser TRNG in speed.

VII. CONCLUSION
Random numbers are crucial for communications and cryptography. And superlattice TRNG is a new generator in recent years. In order to generate higher-rate random numbers, we presented a self-feedback superlattice TRNG, which can generate random bits at rates up to 40 Gbit/s with adjacent bits reversal exclusive-or method for post-processing. It is expected to play a vital role in the field of random numbers with its ultra-low power consumption, small size and high speed. He is currently a Professor of physics with the National University of Defense Technology. His research interests include superlattice, photonics, and optical information processing. VOLUME 8, 2020