WO2024074170A1

WO2024074170A1 - Qrng with prng use and vertical entropy source

Info

Publication number: WO2024074170A1
Application number: PCT/DE2023/100717
Authority: WO
Inventors: Thomas Rotter; Julia Kölbel; Ann-Sophie Rösner; Bernd Burchard
Original assignee: Elmos Semiconductor Se
Priority date: 2022-10-04
Filing date: 2023-09-26
Publication date: 2024-04-11
Also published as: DE102023126171A1; WO2024074170A4; DE102023126167A1; DE102023126170A1; DE102023126168A1

Abstract

The quantum process-based generator (28) for real random numbers (411, 418) has an entropy source (401), and the quantum process-based generator (28) for real random numbers (411, 418) evaluates a signal (405) of the entropy source (401) using a time-to-pseudo random number converter (TPRC) (404.3) and generates one or more random bits (411) and optionally random numbers (418).

Description

QRNG with PRNG usage and vertical entropy source

Priorities

This patent application takes the priorities of the German patent application

DE 10 2022 125574.3 of October 4, 2022 and the German patent application DE 10 2023 126 115.0 of September 26, 2023 and the German patent application DE 10 2023 125543.6 of September 20, 2023.

Field of invention

The invention is directed to a microcontroller that includes at least one quantum process-based generator for true random numbers (QRNG) as a random number generator, in particular for encryption. The present invention includes in particular a random number generator (RNG), in particular a true random number generator (TRNG) of an improved type based on quantum processes and the evaluation of the signal of the entropy source by means of pseudorandom number generators (PRNG) that are located within the entropy extraction.

The present invention thus relates to a data processing device with a quantum technology-based random number generator.

Background of the invention

The automotive industry and other industries are increasingly facing a variety of

Exposed to piracy attacks. The counterfeiters copy the spare parts and products of the industrial producers concerned and usually use their brand names. Another point of attack is the data transfer within the products and/or the data transfer to the product and back.

The entropy properties of common random number generators for such systems are typically inadequate. Quantum process-based generators for true random numbers (QRNGs) are known from the state of the art, but they are difficult to integrate or show a poor quantum yield. It is well known that random number generators are currently used in many applications ranging from science to cryptography.

The technical teaching of EP 3 529 694 Bl is known in particular from the prior art, in which the time duration between pulses of an entropy source consisting of two SPAD diodes is used. The disadvantage of the technical teaching of EP 3 529 694 Bl is the low quantum efficiency in the transfer of photons from the first SPAD diode, which operates as silicon, to the second SPAD diode, which operates as a photodiode. The document presented here therefore quotes sections of statements by the authors and inventors in EP 3 529 694 Bl. The document presented here uses the technical teaching of EP 3 529 694 Bl and builds on the technical teaching of

WO 2023 072 956 Al, the technical teaching of which is repeated in the document presented here in connection with the solution of the problem.

“A typical example of the first case is computer science, which requires the generation of a certain number of random initial states that serve as a description of the initial state of the simulation.

For this type of application, it is generally necessary that the initial configurations are not strictly correlated with each other, but can be reproduced in a deterministic way, for example to check the effects of variations on the codes that perform the simulations. For this reason, these sequences are more correctly called pseudorandom numbers (PRN), since they are defined by complex algorithms that start from an initial value. In other words, given an initial random number, known in technical jargon as a "seed", a formula, no matter how complex, will always reproduce the same sequence of random numbers. The corresponding generators are called pseudorandom number generators (PRNG).

In the second case, however, i.e. when random numbers are used in cryptography techniques to perform banking operations, for example, the approach described above seems weak, since it is necessary to ensure that the sequences generated are absolutely unpredictable in order to guarantee the security of highly sensitive information. In this case, the safest approach is to generate random numbers that come from a generation process that must be truly random and must not allow any prediction of the generated sequence. These generators are called True Random Number Generators (TRNG).

In particular, quantum mechanisms, such as the generation of photons by a light source, are among the best studied methods for obtaining the said sequences of real Random numbers and are based on the uncertainty of the measured event, which is one of the properties of the quantum system itself.

From the point of view of information theory, the degree of unpredictability of the random numbers generated by the two techniques mentioned above can be expressed by the parameter "entropy", which is known as the uncertainty or information present in a random variable.

In addition, it is important to emphasize that the National Institute of Standards and Technology (NIST) in its NIST SP800-22 guideline specifies about fifteen statistical tests that can be used to determine whether a given random number generator has a sufficient level of entropy or not.

As mentioned above, using PRNGs for cryptographic purposes is dangerous not only because certain algorithms have weaknesses that may not become apparent until some time after their introduction, but also because a malicious person who could recover the seed from which all random sequences are generated could predict all subsequent outputs based on the same seed with absolute certainty.

A solution based on physical phenomena, and in particular quantum phenomena, is therefore much more suitable, given the inherent unpredictability of these events, even for people with a thorough knowledge of the algorithms used and with a high computational capacity. However, while the algorithms for generating pseudorandom numbers can be chosen to generate sequences with certain statistical properties that can be determined with absolute certainty due to their deterministic nature, the random numbers obtained from physical phenomena are subject to practical limitations due, for example, to variations in the production quality of the equipment, to variations in the power supply, to environmental factors such as external fields and temperature variations. These deviations from the ideal case generally entail a deviation from a statistical uniform distribution that is independent of the events that can be measured in a sample space. As a result, it is possible to observe even a reduction in the entropy of the said true random number generators.

To avoid this drawback, the said True Random Number Generators require a further step, the so-called post-processing, which is carried out after the extraction of the random code sequence, starting from the specific physical phenomenon. This post-processing step makes it possible to ensure the uniformity of the probability distribution of the random code sequence. The disadvantage, however, is that this post-processing step affects the bit rate that the generator can guarantee.

As already mentioned, it is also known that one of the physical phenomena most exploited for the generation of truly random numbers is quantum photonics. For this reason, these generators, which belong to the macro category of TRNGs, are also called by the acronym QRNG (Quantum Random Number Generator). In these generators, an attenuated light source generates a few photons (low value of the detected photon flux X) that are detected by one or more single-photon detectors, each of which is known by the acronym SPAD (Single Photon Avalanche Diode). In addition, the system includes appropriate electronic circuits downstream of the aforementioned SPADs, consisting of auxiliary circuits and, usually, one or more TDCs (Time to Digital Converter) or counters capable of extracting a random bit sequence from each of the SPADs by measuring the arrival time of the detected photons or by counting them.

In these generators, the light source and the detector(s) are separate devices that must be coupled and shielded in an appropriate manner. The disadvantage, however, is that this design is of course not immune to the influence of uncontrolled external environmental factors. In addition, the fact that the light source and the detector(s) are separate devices that are coupled one after the other makes the entire random number generator very vulnerable to any kind of influence or manipulation.

Another disadvantage is that this implementation entails high costs for the device because the two devices have to be optically aligned.

Having said the above, it should be noted that several types of random number generators based on the QRNG concept are available on the market. These generators cover a wide range of applications, from portable USB devices that deliver only a few hundred kbit/s to large electronic systems that can guarantee a bit rate of hundreds of Mbit/s. Moreover, in the existing literature on the subject, several logics and architectures have been proposed that are designed to determine sequences of truly random numbers starting from a physical phenomenon, in particular from photon detection. Most of them record the "arrival time" or the number of photons that hit the sensitive surface of the SPAD detector(s). An example of a well-known quantum random number generator based on the arrival time can be found in the international publication WO 2016016741 Al. In particular, the technique based on the so-called arrival time has been proposed to measure the time elapsed between the moment when a photon comes into contact with a single SPAD and the moment when the subsequent photon comes into contact with the same SPAD. Although this technique allows a high bit rate to be achieved, it suffers from significant distortion because, as explained above, the photon source obeys the Poisson process.

To overcome this drawback, the state of the art proposes to act directly on the photon source to control the flux of photons produced by this source. This operation involves in particular varying the pilot current of the photon source in order to make its statistical distribution over time as uniform as possible.

The disadvantage of this approach, however, is that a special electronic circuit must be built into the random number generator that can control the photon source, as explained above, which increases the complexity and size of the generator itself."

In many areas of science and technology, random events and the determination of probabilities play a particularly prominent role. For example, Monte Carlo simulations and secure encryption methods are based to a large extent on the provision of random numbers. A distinction is generally made between so-called pseudo-random numbers and true random numbers. While the former are generated using deterministic formulas by pseudo-random number generators (PRNGs), and are therefore not absolutely random, non-deterministic random number generators for the provision of true random numbers (TRNGs) are generally based on real, unpredictable processes such as thermal or atmospheric noise, and not on artificially generated patterns of deterministic algorithms. However, the results of such non-deterministic random number generators based on external parameters can, depending on the underlying random element, still tend slightly towards higher or even numbers due to weak correlations, for example, and thus enable at least a partial predictability of the random numbers generated in this way.

The so-called quantum random number generators (QRNGs), as a special subgroup of TRNGs, are based on fundamental quantum processes for generating random numbers and are therefore, at least theoretically, not linked to other external factors and effects that influence the statistics. Quantum random number generators are therefore currently the best available source for true random numbers. Current digital QNRGs can deliver entropy rates (i.e. a sequence of bit values with maximum randomness or entropy) of up to several hundred Mbps. The random numbers generated are required in both classical encryption methods and in a variety of quantum computing and quantum cryptography methods to ensure secure key exchange ("Secure/Quantum Key Distribution, SKD/QKD"). Non-manipulable and fast QRNGs are therefore essential for generating secure keys in cryptography.

A large number of QRNGs are implemented as photonic QRNGs due to their particularly easy implementation using random properties of photons. A simple concept for generating random numbers is the behavior of a photon that is either reflected or transmitted to a semi-transparent beam splitter independently of other photons. Another approach is to use the random arrival times of photons on a single-photon detector. This distribution effect, based on an intrinsic, in principle non-deterministically calculable photon statistics of the photons of an associated photon source, can also be used to provide true random numbers. The arrival times of photons on a single-photon detector generally exhibit an exponential distribution.

Typically, in a single photon detector (SPD), a single incident photon first generates a detector pulse, which is converted in a time-to-digital converter (TDC) into a digital representation of the detection event with a time stamp and can be further processed accordingly. Laser diodes (LDs) or simple light-emitting diodes (LEDs) that are strongly attenuated to the single-photon level are usually used as photon or entropy sources in QRNGs, the emitted photons of which can then be recorded in a time-resolved manner as SPDs via one or more particularly sensitive single-photon avalanche diodes (SPADs). Such photon sources that only provide single or only a few photons at the same time are also referred to as single-photon sources (SPS) in this application. However, these do not have to be real single-photon emitters, for example based on a single isolated two-level system.

SPADs are a type of photodetector similar to photodiodes (PDs) and avalanche photodiodes (APDs), but with a significantly higher sensitivity. SPADs can be read and evaluated digitally - even within a common integrated circuit. If such a If the integrated detector circuit is excited by individual photons, only one electron-hole pair is generated per exciting photon in the sensorically active area (absorption area), with the excited electrons being drawn to the cathode and the excited holes to the anode by electric fields. In a SPAD, the charge carriers drift through a so-called avalanche area, within which a charge avalanche is generated by increased impact ionization. These are therefore highly sensitive photon receiver elements which, when activated, can provide a high amount of charge (approx. 105 - 106 electrons) with high temporal resolution.

A SPAD is typically operated in Geiger mode above its breakdown voltage, whereby a single photon is detected via the generated charge avalanche and then registered as a single event. To reduce the dead time that occurs during registration, active or passive suppression or quenching of further charge carrier amplification can take place immediately after the onset of the avalanche formation. In addition to the SPAD, the integrated circuit can also include a so-called single-photon counter (SPC). In this case, instead of directly outputting a single detector pulse, an immediate statistical evaluation of the temporal distribution of the individual detected single-photon events is generally carried out.

A statistical evaluation that takes place in parallel to the random number generation can, for example, be used to further secure the generation against possible attacks on the random number generation process. In particular, in the case of non-integrated photonic QRNGs made up of individual components, the required transmission paths within the system offer a wide range of attack options. To increase security, such systems are therefore implemented as compactly as possible and isolated from their external environment. In addition to avoiding potential attack scenarios, another advantage of such compact QRNGs is that natural influences from outside the system that may impair the random number generation can also be minimized as far as possible. Accordingly, compact QRNGs based on photon noise have therefore usually been provided as hybrid integrated systems.

From EP 3 529 694 B1, an integrated quantum random number generator (iQRNG) with a PLC and one or more SPDs is also known, in which the PLC and the SPD(s) are completely integrated in CMOS technology in a single semiconductor substrate in such a way that they are located directly next to each other (see FIG. 1 with the associated figure description). The PLC is provided by a suitably doped pn junction so that it generates a photon current to be detected when the Photon source is suitably biased in forward or reverse direction.

SPDs are to be SPADs in particular, which are preferably supported by joint

manufacturing processes with the PLCs and have the same chemical structure.

The joint integration means that the photon stream generated by the SPS can flow directly to a SPAD arranged next to it through optical crosstalk within one and the same semiconductor material and does not have to first overcome or tunnel through a possibly empty coupling gap that physically separates the two components, as is the case with other hybrid-integrated QRNGs known from the state of the art. The integrated "side-by-side" configuration makes the QRNG presented in the publication more compact and structurally less complex than hybrid QRNGs of the same functional type. In addition, thanks to the integration of all components, the random number generator is significantly more robust and immune to external environmental influences and to attempts at manipulation by external attackers.

However, it is still possible, at significantly increased expense, to interfere with, influence and/or observe the random number generation process during the QRNG's ongoing operation. Since the iQRNG disclosed in the publication essentially has a planar structure, individual photons could be picked up from above or below the level of the substrate or additionally introduced.

The horizontal arrangement of the structures next to each other is also not ideal in terms of efficiency and the required area consumption. The efficiency is limited in particular by the required lateral distance between the SPS and the SPAD and the associated high absorption of the photons in the semiconductor material. Without special precautions, the photons emitted by the SPS are also largely emitted undirected into the material surrounding the SPS, so that only a portion of the generated photons can be detected by an associated SPAD. Although several SPADs can be arranged around a single SPS, so that the efficiency and thus the digital entropy rate can be increased by joint evaluation of the SPADs connected in this way, this significantly increases the area consumption of such an iQRNG. On the other hand, even with a single emitter-detector pair, it must be ensured that the undetected photons do not spread uncontrollably within the substrate and cause interference elsewhere in the substrate. The associated lateral restricted areas therefore also lead to an increase in the effective area consumption of the iQRNG. An iQRNG also realized in CMOS technology (HV-CMOS) with a corresponding arrangement of a photon source and a single-photon detector next to each other is also known from Khanmohammadi et al. (Khanmohammadi, Abbas, et al. "A monolithic silicon quantum random number generator based on measurement of photon detection time." IEEE Photonics Journal 7.5 (2015): 1-13). A Si-LED designed as a photon source in a circular n-well near the surface between a central n++ region as the cathode and several p++ regions arranged in a ring around it as the anode is surrounded in a circular ring by a SPAD as a single photon detector (see FIG. 2 with associated figure description). The photons emitted by the SPS are thus detected on all sides in the plane, which can increase efficiency compared to the iQRNG known from EP 352694 Bl with reduced area consumption. The SPS is thus integrated directly into the SPAD. However, individual photons can also be emitted into the substrate or extracted from its surface. It is also possible to inject corresponding photons from an attacker in this way to Influencing the statistics.

Therefore, in order to further increase security and reduce space consumption, there is a need for further miniaturization of integrated QRNGs compared to the state of the art. The iQRNG should be largely protected against external attacks and at the same time have the highest possible efficiency and the lowest possible substrate losses. In order not to be limited by manufacturing technology restrictions in the design of SoCs (System on Chip, SoC), the underlying manufacturing process should be as technology-open as possible or be based on the broadest possible applicable technology platform for semiconductor structuring.

Task

The present invention aims to overcome all the above-mentioned drawbacks. In particular, an object of the invention is to provide a true random number generator that makes it possible to guarantee a high level of entropy, so that it at least passes the statistical tests defined by NIST.

A further aim of the invention is to provide a generator for true random numbers which makes it possible to achieve an even higher bit rate in the generation of random sequences of bits and to ensure the randomness of the measurement result even if the entropy source fails.

Another object of the invention is to provide a true random number generator that has a more compact, robust and less complex structure than the prior art known random number generators, so that this random number generator can be accommodated in the pad edge of a monolithically integrated semiconductor circuit.

Another object of the invention is to provide a true random number generator that offers a high level of security against any attempt to forcibly alter or tamper with its internal components.

Another object of the invention is to provide a true random number generator that offers a high level of security by detecting and reporting any attempt to forcibly alter or tamper with its internal components.

A further, but no less important, object of the invention is to provide a true random number generator which is more economical compared to the generators of the known prior art.

The device of the independent claim solves this problem. Further developments are the subject of the dependent claims.

The object of the invention to provide a compact entropy source 411 that goes beyond the prior art is achieved by the subject matter of independent patent claims. Preferred developments are the subject matter of further subclaims.

Solution to the task

The automotive industry and other industries are increasingly exposed to various piracy attacks. The counterfeiters copy the spare parts and products of the industrial producers concerned and usually use their brand names. Another point of attack is the data transfer within the products and/or the data transfer to the product and back.

The entropy properties of common random number generators for such systems are typically inadequate. Quantum process-based generators for true random numbers (QRNGs) are known from the state of the art, but they are difficult to integrate or show a poor quantum yield.

It is known in the art to provide an integrated circuit which includes, among other features, a processor. In some applications, it is necessary to ensure that the data being processed, including the executable code, cannot be modified by unauthorized persons accessing data stored outside the integrated circuit or, if such access does occur, that it cannot be done unnoticed.

SUMMARY OF THE INVENTION The quantum process-based generator for true random numbers according to the invention has, in a first embodiment, an entropy source and is configured to evaluate a signal from the entropy source by means of at least one time-to-pseudo-random number converter and to generate one or more random bits as a function of the signal from the entropy source.

In a second independent embodiment, for which independent protection is claimed, the quantum process-based generator for true random numbers according to the invention is designed in one piece on a semiconductor substrate with a surface and has a vertical entropy source with at least one photon source with at least one photon detector. The surface of the semiconductor substrate in the sense of the document presented here is defined as a horizontal plane with a first direction in the plane (1st plane vector) and a second direction in the plane (2nd plane vector), which is different from the first direction in the plane. The photon source and the photon detector are arranged in a vertical direction to the first and second direction in the plane in the semiconductor substrate with respect to the first and second direction in the horizontal plane of the surface of the semiconductor substrate. In this wide independent embodiment of the invention, the quantum process-based generator for true random numbers is designed to generate one or more random bits depending on the signal from the entropy source.

The quantum process-based generator for true random numbers according to the invention comprises, in a third independent embodiment for which independent protection is claimed, an entropy source in a semiconductor substrate with a surface and with a back side which is located opposite the surface on the other side of the semiconductor substrate, and means for detecting an attack on the entropy source by means of photons, wherein this attack can in particular be an attack from a back side of the semiconductor substrate.

In a variant of the third independent embodiment, these means for detecting an attack on the entropy source by means of photons may comprise an observation diode.

In variants of the three independent forms, the quantum process-based generator can include a watchdog.

In variants of the three independent embodiments, the quantum process-based generator may comprise a voltage monitor (423).

In variants of the invention, the watchdog and/or the voltage monitor can be configured to monitor the quantum process-based generator by means of said means for detecting a To monitor the entropy source for an attack or disturbance by means of photons, in particular by means of the observation diode.

In variants of the invention, the at least two device parts of the quantum process-based generator for true random numbers can be designed in one piece on a common semiconductor substrate as a one-piece quantum process-based generator.

In variants of the invention, the quantum process-based generator for true random numbers can be configured to generate at least one random number from a plurality of random bits and to provide or use the at least one random number.

In variants of the invention, the logical values in the temporal order of the pseudorandom bits of a time-to-pseudorandom number converter (TPRG), i.e. the actual pseudorandom bit sequence of the time-to-pseudorandom number converter (TPRG), of the quantum process-based generator depend on one or more quantum random bits and/or one or more quantum random numbers, which are typically operating parameters of the time-to-pseudorandom number converter (TPRG).

In variants of the invention, the watchdog is designed to monitor the correct functioning of the quantum process-based generator for true random numbers.

In variants of the invention, the watchdog is designed to measure the randomness of the generated quantum random bits in the form of one or more measured values and to compare each with a respective tolerance interval or a respective threshold value, and to conclude a respective error in the case of a respective deviation of the respective measured value from the respective tolerance interval or the respective threshold value.

In variants of the invention, the watchdog is designed to monitor the correct functioning of the time-to-pseudorandom number converter (TPRC) of the at least one time-to-pseudorandom number converter (TPRG) of the quantum process-based generator and/or to monitor a behavior in the form of the temporal statistics of the logical values in the temporal order of the pseudorandom bits of the time-to-pseudorandom number converter (TPRC) and to record them in the form of statistical measured values and, in the event of deviations of the statistical measured values from the expected behavior in the form of a departure from permitted measured value ranges for these measured values, to detect and/or signal an error.

In variants of the invention, the quantum process-based generator for true random numbers with its at least two device parts is manufactured in one piece as part of an integrated circuit. In variants of the invention, the integrated circuit with the quantum process-based generator for true random numbers is manufactured in a BCD technology.

In variants of the invention, the integrated circuit with the quantum process-based generator for true random numbers comprises a voltage converter for supplying the entropy source of the quantum process-based generator for true random numbers, wherein the voltage converter then comprises one or more DMOS transistors for increasing the voltage strength.

In variants of the invention, said integrated circuit comprises a circuit such as a microcontroller, a microprocessor, a memory, a DRAM, an SRAM, a RAM, a volatile memory, an OTP memory, an EEPROM, a flash memory, an MRAM, an FRAM, a sensor evaluation circuit, a control circuit for an automotive control circuit, a graphics controller, an evaluation circuit for a biometric sensor or an input device, a control circuit, a chip card circuit, an RFID circuit, an asset circuit of a mobile phone or a smartphone, a circuit of an access control system, a circuit with a coded recording of operating parameters, a circuit of an access control system, a circuit of a security system of electronic security, a radio system circuit, a communication circuit, a circuit of an encryption and/or decryption system, a circuit of an individualization system, a circuit of a game device, a circuit of a simulation system, a circuit of a computer system, a circuit of a noise source, a Circuit with a device for generating and/or using a spreading code, a circuit with a device for generating and/or using a random number for individualizing the circuit, a circuit with a device for generating and/or using a random number for testing purposes, in particular for self-testing purposes and/or for the purposes of testing an application circuit of which the circuit is a part. The document presented here thus discloses a microcontroller, a microprocessor, a memory, a DRAM, an SRAM, a RAM, a volatile memory, an OTP memory, an EEPROM, a flash memory, an MRAM, a FRAM, a sensor evaluation circuit, a control circuit for an automotive control circuit, a graphics controller, an evaluation circuit for a biometric sensor or an input device, a control circuit, a chip card circuit, an RFID circuit, an electronic circuit of a mobile phone or a smartphone, an access control system circuit, a circuit with a coded recording of operating parameters, an access control system circuit, a security system circuit of electronic security devices, a radio system circuit, a Communication circuit, a circuit of an encryption and/or decryption system, a circuit of an individualization system, a circuit of a game device, a circuit of a simulation system, a circuit of a computer system, a circuit of a noise source, a circuit with a device for generating and/or using a spreading code, a circuit with a device for generating and/or using a random number for individualizing the circuit, a circuit with a device for generating and/or using a random number for testing purposes, in particular for self-testing purposes and/or for the purposes of testing an application circuit of which the circuit is a part, with a quantum process-based generator for true random numbers according to the invention and/or the use of random bits and/or random numbers of the quantum process-based generator for true random numbers according to the invention in a microcontroller, a microprocessor, a memory, a DRAM, an SRAM, a RAM, a volatile memory, an OTP memory, an EEPROM, a flash memory, an MRAM, a FRAM, a sensor evaluation circuit, a control circuit for an automotive control circuit, a graphics controller, an evaluation circuit for a biometric sensor or an input device, a control circuit, a chip card circuit, an RFID circuit, an asset circuit of a mobile phone or a smartphone, a circuit of an access control system, a circuit with a coded recording of operating parameters, a circuit of an access control system, a circuit of a security system of electronic security, a radio system circuit, a communication circuit, a circuit of an encryption and/or

Decryption system, a circuit of an individualization system, a circuit of a gaming device, a circuit of a simulation system, a circuit of a computer system, a circuit of a noise source, a circuit with a device for generating and/or using a spreading code, a circuit with a device for generating and/or using a random number for individualizing the circuit, a circuit with a device for generating and/or using a random number for testing purposes, in particular for self-testing purposes and/or in particular for the purposes of testing an application circuit of which the circuit is a part.

In variants of the invention, the integrated circuit (internal interfaces) comprise special circuits at a cryptographic boundary between a control device and other parts of the integrated microelectronic circuit which are classified as non-secure or less secure, and the quantum process-based true random number generator is arranged within the cryptographic boundary between the control device and the other parts of the integrated microelectronic circuit. In variants of the invention, the entropy source comprises a photon source and a photon detector, wherein the photon source is configured to emit photons as a quantum signal when supplied with electrical energy, and wherein the photon source is optically coupled to the photon detector. In this variant of the invention, the photon detector is configured to at least partially receive the quantum signal of the photon source and to generate an output signal of the entropy source or a precursor signal thereof.

In a variant of the invention, the photon source comprises a silicon LED, in particular a Zener avLED or a SPAD diode.

In variants of the invention, the quantum process-based generator is placed in whole or in part in a pad frame between connection pads of the integrated circuit on the die of this integrated circuit, wherein at least the entropy source is placed in the pad frame between the connection pads of the integrated circuit on the die of this integrated circuit.

In variants of the invention, the entropy source of the quantum process-based generator is encapsulated, in particular by means of metal layers and/or silicide layers and vias, except for signal feedthroughs through this encapsulation from at least one side, better at least from two sides, better at least from three sides, better at least from four sides, better at least from five sides.

According to one aspect of the present invention, there is provided a device comprising: a preferably one-piece, preferably monolithic, micro-integrated circuit comprising one or more processors (10-1, 10-2) and one or more non-volatile memories, preferably storing at least one security code; a first preferably read/write memory external or internal to the integrated circuit for storing data, the data preferably being cryptographically protected in a first format; and preferably a second read/write memory external or internal to the integrated circuit for storing data; the device being arranged to transfer data from the first memory to the second memory via a device of the integrated circuit for access by the processor from the second memory; the integrated circuit is arranged to validate the data read from the first memory during transmission using a security code stored in the non-volatile memory and, when the data is validated, to apply cryptographic protection in a second format to the validated data using a security code stored in the non-volatile memory and to store the data protected in the second format in the second memory. The proposed device uses a quantum technology-based micro-integrated random number generator (Q.RNG 28) for

Encryption. Such a random number generator produces a truly random number because the process of random number generation is based on an unpredictable quantum process.

By transmitting data over the integrated circuit devices and using the integrated circuit devices to validate data and protect the transmitted data, security is maintained because validation occurs and protection is applied within the integrated circuit.

The data is secured by cryptographically protecting the data in the first and second memories based on one or more security codes in the non-volatile memory of the integrated circuit.

In one embodiment, only validated data from the first memory is processed, and when data is read by the processor from the second memory, only validated data from the second memory is processed.

In one embodiment, the second memory is a random access memory (RAM) for the processor that allows the processor to store and retrieve individual words that are individually protected, as opposed to the first memory, which is a read-only memory (ROM) that allows only read access to a record.

The invention also provides a data processing device comprising:

An integrated circuit comprising a processor, a non-volatile memory storing at least one security code, a hash calculator and an interface at the boundary of the integrated circuit; and a memory inside or outside the integrated circuit for storing data for use by the processor, the memory, when outside the integrated circuit, preferably being coupled to the processor via an interface at the boundary of the integrated circuit for receiving data, for example in the form of data words, from the processor and supplying data words to the processor. The processor and the hash calculator are arranged to perform the steps of a. calculating the hash by means of a hash function for each data word in dependence on a security code stored in the non-volatile memory and storing the hash in association with the data word, b. retrieving stored data words from the memory, recalculating a hash function for each retrieved data word using the security code and comparing the newly calculated hash value with the stored hash value, and c. Allowing the data processing system to process the retrieved data word only if the newly calculated hashes and the stored hashes have a predetermined relationship.

Embodiments of the proposal will now be described by way of example with reference to the accompanying drawings.

In particular, the true random number generator (quantum random number generator 28) according to the invention comprises a photon source 54 with a flow of detected photons of light 58 transported horizontally in an optical fiber 44, one or more photon detectors 55, preferably single photon detectors (SPADs), and electronic sampling means (403, 2022, 402, 403, 404.2) operatively connected to the one or more photon detectors 55 to generate a bit sequence of quantum random bits 411 (random bit sequence) based on the number of photons detected in the photon detectors 55.

The said generator for true random numbers, hereinafter referred to as quantum random number generator 28 (QRNG), is characterized in particular in that the photon source 54 and the photon detector(s) 55 are arranged as close to one another as possible and optically directly or indirectly coupled and are integrated in a single semiconductor substrate 49. Preferably, the photon source 54 and the photon detector(s) 55 are manufactured in a common semiconductor substrate 49 using CMOS technology, preferably BCD technology. Preferably, the photon source 54 comprises a silicon LED and/or a silicon laser. For example, the photon source 54 can comprise a first SPAD diode 54. For example, the photon detector 55 can comprise a photodiode. For example, the photon detector 55 can comprise a second SPAD diode 55.

The quantum random number generator 28 according to the invention preferably comprises a photon source 54 with a detected photon flux equal to A

It cannot be ruled out that the quantum random number generator 28 in an alternative embodiment comprises more than one photon source 54. However, this has the disadvantage of requiring a larger chip area.

According to the preferred embodiment of the proposal, the proposed

Quantum random number generator 28 preferably also comprises an arrangement of one or more

Photon detectors 55. Preferably, but not necessarily, each of these photon detectors 55 is a single photon detector 55. When one or more photon detectors 55 are implemented as reverse biased PN diodes in a semiconductor substrate 49 with a bias voltage close to the breakdown voltage of the respective PN diode and a limitation of the breakdown current of the respective PN diode, one generally speaks of single photon avalanche photo diodes, which the document presented here also refers to with the acronym SPAD.

As already mentioned, a single photon detector 55 is capable of detecting and providing as output information on the incidence of a single photon in its sensitive volume and possibly on the arrival time of the latter within an observation window of predetermined duration.

Between two consecutive observation windows, each photon detector 55 (every second SPAD diode 55) goes through a phase of restoring the initial conditions, which the document presented here hereinafter refers to as dead time. During the dead time of a second SPAD diode 55, this second SPAD 55 can no longer reliably detect any subsequent photon.

Typically, in the SPAD-type array of photon detectors 54, each respective SPAD diode 55 operates independently and in parallel with the other SPAD diodes 55. Typically, the array of SPAD diodes 55 has a single common output for reading the respective signal generated by the same array of SPAD diodes 55 from the outside.

The typical advantage of an arrangement of closely spaced SPAD diodes 55 is typically that the solid angle of the photons 58 generated by the photon source 55 is increased and that any dead times are reduced, thereby increasing the generation rate of the quantum random bits 411 of the quantum random number generator 28 and thus the rate of the quantum random data words 418 themselves. This in turn enables the encryption of larger amounts of data.

While the technical teaching of EP 3 529694 Bl still assumes a coupling via the semiconductor substrate 49, the technical teaching presented here proposes a first improved coupling of the photon source, i.e. for example the first SPAD diode 54 and/or the silicon LED, with the photon detector 55, i.e. here for example with the second SPAD diode 55, via a light-optical system, for example an optical waveguide 44, which should have a significantly lower absorption rate than the common semiconductor substrate 49 in which the photon source 54 and the photon detector 55 are manufactured. This increases the generation rate of the quantum random bits 411 of the quantum random number generator 28 increases dramatically compared to a device according to the technical teaching of EP 3 529 694 B1.

However, it cannot be ruled out that according to an alternative embodiment of the proposal, the quantum random number generator 28 always comprises an array of second SPAD diodes 55 as an array of photon detectors 55, but each SPAD diode 55 or each photon detector 55 is independent of the others, which means that these device parts can each individually generate a respective signal to the outside, which is typically independent of the signals of the other SPAD diodes 55 or of the other photon detectors 55. According to another embodiment of the proposed quantum random number generator 28, the arrangement can be divided into subgroups of SPAD diodes 55 or subgroups of photon detectors 55, each subgroup comprising a predetermined number of SPAD diodes 55 or photon detectors 55, which are preferably each connected in parallel to one another such that they each generate a single signal outwardly related to the entropy source 401 of the quantum random number generator 28.

In the latter case, each of the subgroups of SPAD diodes 55 or photon detectors 55 can be connected to the outside world of the entropy source 401 of the quantum random number generator 28 independently of the other subgroups of SPAD diodes or photon detectors.

This independence has the advantage that the extraction of the binary random sequences from quantum random bits 411 from the quantum random number generator 28 can be parallelized, whereby the bit rate of the quantum random number generator 28 is further increased by spatial multiplexing.

According to another embodiment, the quantum random number generator 28 of the proposal can also comprise only exactly one second SPAD diode 55 or only exactly one photon detector 55.

Again, a further embodiment of the quantum random number generator 28, as already mentioned, can comprise a plurality of photon sources 54 or silicon LEDs 54 or first SPAD diodes 54, which are each optically connected to an array of photon detectors 55 or second SPAD diodes 55 via an optical system (44) outside the semiconductor substrate 49. Preferably, this optical system 44 comprises micro-optical device parts. Preferably, these micro-optical device parts comprise one or more optical waveguides 44 and/or one or more reflective layers 53 and/or reflective and/or optically refractive structures 53. Preferably, the optical waveguide 44 is manufactured in the metallization stack on the semiconductor substrate 49 of the microelectronic circuit, which typically comprises the photon source or the Silicon LED 54 or the first SPAD diode 54 and the photon detector 55 or the second SPAD diode 55. The optical system - for example the optical waveguide 44 - the photon sources 54 and the photon detectors 55 are therefore preferably part of the one-piece quantum random number generator 28.

In other words, if the combination of a photon source 55 or a silicon LED 54 or a SPAD diode 54 on the one hand with one or more photon detectors 55 or one or more SPAD diodes 55 on the other hand defines pixels in the sense of the document presented here, one embodiment of the entropy source 401 of the proposed quantum random number generator 28 can be viewed, for example, as a pixel matrix which makes it possible to parallelize the process of extracting random numbers.

As regards the photon source 54 or the silicon LED 54 or the first SPAD diode 54, according to a preferred embodiment, this also preferably comprises one or more SPAD diodes 54. In this case, both the arrangement of the photon detectors 54 or the second SPAD diodes 54, which serve as receivers, and the photon sources 54 or the silicon LEDs 54, which preferably comprise one or more SPAD diodes 54, are configured and polarized such that they operate in the so-called Geiger mode with the same polarization voltage.

As already mentioned above, the quantum random number generator 28 of the proposal preferably also comprises electronic sampling means (403, 2022, 402, 403, 404.2) which are preferably functionally connected to the common output 417 in order to read the signal 405 generated by the arrangement of the photon detectors 54 or the second SPAD diodes 54.

It is conceivable that in another embodiment, one or more of the respective electronic sampling means (2022, 402, 403, 404.2) are instead provided for each respective photon detector 54 or each respective second SPAD diode 54, respectively, which each belongs to the array, while individual electronic sampling means of the electronic sampling means (2022, 402, 403, 404.2) are present for the respective individual photon detector 54 or for the respective individual second SPAD diode 54. Finally, in one embodiment, some or more respective sampling means of the electronic sampling means (2022, 402, 403, 404.2) can be provided for each pixel, the sampling signals (407, 407) of which are combined into a common quantum random bit data stream 411 by means of electronic post-processing.

The document presented here proposes to use these electronic scanning devices (403, 2022, 402, 403,

404.2) together or at least in large parts with the photon sources 54 or silicon LEDs

54 or first SPAD diodes 54 and together with the photon detectors 55 or the second SPAD diodes 55 in a common semiconductor substrate 49 as a one-piece micro-integrated circuit. The document presented here proposes electrically connecting these electronic scanning means (403, 2022, 402, 403, 404.2) together with the photon sources 54 or silicon LEDs 54 or first SPAD diodes 54 and together with the photon detectors 55 or the second SPAD diodes 55 via the metallization stack of the one-piece micro-integrated circuit thus manufactured on the surface of the semiconductor substrate 49 by means of metallic electrical conductors. The document presented here proposes optically connecting these photon sources 54 or silicon LEDs 54 or first SPAD diodes 54 and the photon detectors 55 or the second SPAD diodes 55 to one another via the metallization stack of the one-piece micro-integrated circuit thus manufactured on the surface of the semiconductor substrate 49 by means of dielectric optical waveguides 44. The metallization stack of the one-piece micro-integrated circuit thus manufactured on the surface of the semiconductor substrate 49 typically comprises structured metal layers which typically form the electrical conductor tracks (141, 142) in different levels of the metallization stack. The metallization stack of the one-piece micro-integrated circuit thus manufactured on the surface of the semiconductor substrate 49 typically comprises electrical insulation layers between these structured metallization layers (141, 142), which electrically insulate the electrical lines (141, 142) formed in the structured metallization layers between different metallization levels. The electrical insulation layers of the metallization stack of the one-piece micro-integrated circuit thus manufactured on the surface of the semiconductor substrate typically comprise electrical vias 140 between the electrical lines (141, 142) of the structured metallization layers, which electrically connect (via-contact) the electrical lines (141, 142) formed in the structured metallization layers between these different metallization levels. The metallization stack of the one-piece micro-integrated circuit produced in this way on the surface of the semiconductor substrate 49 typically comprises optically transparent electrical insulation layers between these structured metallization layers. As a result, one or more electrical insulation layers can take on the function of an optical waveguide 44 for the photons of the first SPAD diode 54 or the photon source 54 or the silicon LED 54 during their transport to the second SPAD diode 55 or to the photon detector 55. The insulation layers in question are preferably structured for this purpose.

In any case, the electronic sensing means (403, 2022, 402, 403, 404.2) of such a one-piece microelectronic circuit are preferably configured to implement a predefined logic method or a computer or hardware implemented algorithm for Extraction of a binary sequence of quantum random bits 411 based on the arrival times of the photons at the level of the respective photon detectors 55 or SPAD diodes 55. Some preferred examples of the logical extraction method are described in detail in the document presented here.

According to the proposal, in the quantum random number generator 28, the photon source 54 or the silicon LED 54 or the first SPAD diode 54 and the array of photon detectors 55 or of second SPAD diodes 55 or the individual SPAD detector 54 are arranged next to one another or one below the other and preferably close to one another with a short optical connection for optical coupling via the shortest possible optical path and integrated into a single semiconductor substrate 49 as a microelectro-optical system.

This results in the photon current generated by the photon source 54 or the silicon LED 54 or the first SPAD diode 54 flowing, for example, through the optical waveguide 44 in the metallization stack of the microelectronic circuit in the direction of the preferably nearby arrangement of photon detectors 55 or second SPAD diodes 55 (a phenomenon actually known as "optical crosstalk"), unlike in the known random number generators in which the same photons flow through the empty coupling gap between the two components, which are physically separated from each other, i.e. are typically not manufactured in one piece with the scanning means on a semiconductor substrate 49.

Advantageously, this integrated configuration makes the quantum random number generator 28 proposed in this document more compact and structurally less complex than random number generators of the known type.

Thanks to the integral integration of all components of the quantum random number generator 28, it is also more robust and immune to external environmental influences and to any attempts at manipulation by malicious persons.

A metal cover 142 made of a preferably soft metal and/or a material with good electrical conductivity, for example a gold layer on an iron layer, can shield the entropy source. Preferably, an electrical connection, which can also include vias (e.g. 140), connects the metal cover 142 to a defined electrical potential, for example a ground line or a supply voltage line.

This integrated configuration and thus the direct and/or indirect coupling between the photon source 54 or the silicon LED 54 or the first SPAD diode 54 on the one hand and the photon detector(s) 55 or the second SPAD diodes 55 on the other hand are advantageous compared to solutions using, for example, discrete beam splitters, since they enable uniform illumination of the photon detectors 55 or the second SPAD diodes 55 without having to ensure that the beam splitter is always perfectly aligned.

According to the preferred embodiment of the invention, the photon source 54 or the silicon LED 54 or the first SPAD diode 54 and the array of photon detectors 55 or the second SPAD diodes 55 are manufactured on the semiconductor substrate 49 in the same manufacturing steps, so that the elements have the same chemical-physical structure with respect to the doping profiles. More precisely, as mentioned above, even the photon source 54 or the silicon LED 54 or the first SPAD diode 54 can be manufactured with the same chemical-physical structure as another photon detector 55 or another second SPAD diode 55. The photon source 54 or the silicon LED 54 or the first SPAD diode 54 is, in terms of design and implementation, completely identical to the photon detectors 55 or the second SPAD detectors 55 belonging to the array in certain embodiments of the proposal, except for usual variations of components on a wafer.

This has the advantage that the manufacturing costs of the various components of the proposed quantum random number generator 28 can be drastically reduced, since it is possible to manufacture one or more photon sources 54 or silicon LEDs 54 or first SPAD diodes 54 and/or one or more photon detectors 55 or SPAD diodes 55 on the same semiconductor substrate 49 without the number of manufacturing steps having to be changed, in particular increased. The manufacturing costs therefore remain approximately the same.

According to the preferred embodiments of the proposal, the semiconductor substrate 49 is a silicon substrate 49.

However, it cannot be ruled out that in various embodiments of the invention the semiconductor substrate 49 is made of a semiconductor material other than silicon in order to increase the efficiency of the emitter-source coupling. The document presented here mentions in this context in particular the use of direct semiconductors with a direct transition for the electrons without lattice collision for momentum change.

As regards the arrangement of the photon detectors 55 or the second SPAD diodes 55, it is known that preferably each of them mainly comprises a favourably doped pn junction, so that the phenomenon known in technical terms as "avalanche formation" can occur when the same photon detector 55 or SPAD diode 55, which is favourably polarized, is subjected to the impact of a photon in its photon-sensitive volume. The photon source 54 or silicon LED 54 or first SPAD diode 54 is also defined by a suitably doped pn junction such that the detected photon flow is generated when the photon source 54 or silicon LED 54 or first SPAD diode 54 is suitably biased in the forward direction or (better) in the reverse direction. When a first SPAD diode 54 is polarized in the reverse direction, a pulsed dark current of the diode current is produced, the so-called dark current, which is associated with a pulsed emission of photons that the photon detector 54 or the second SPAD diode 55 can detect.

In particular, according to the preferred embodiment of the invention, the photon source 54 or silicon LED 54 or first SPAD diode 54 is configured to obtain an emission spectrum of the detected photon flux X which lies mainly between 800 nm and 1000 nm. In this spectrum, the efficiency of each photon detector 55 or each second SPAD diode 55 cannot be considered to be excessively high and is less than 10%. Therefore, it is estimated that in order to achieve a detection rate of, for example, about 500,000 counts/sec. a usable photon rate (photon current that reaches the sensitive volume of the photon detector 55 or the second SPAD diode 55 or the photon detectors 55 or the second SPAD diodes 55 from the photon source 54 or silicon LED 54 or first SPAD diode 54) of more than 5,000,000 ph/sec is required.

Returning to the manufacture of the quantum random number generator 28, the fact that the structures of the photon source 54, the silicon LED 54, and the first SPAD diode 54 both have a p-n junction as their main feature confirms the advantage described above, i.e. the possibility of carrying out the same manufacturing steps for the photon source 54, the silicon LED 54, and the first SPAD diode 54 and the photon detectors 55, and the second SPAD diodes 55.

Preferably, but not necessarily, according to the preferred embodiment of the invention, the photon source 54 or the silicon LED 54 or the first SPAD diode 54 and the photon detectors 55 or the second SPAD diodes 55, which are obtained by the same manufacturing steps, have the same chemical-physical structure. However, it cannot be ruled out that in different embodiments of the quantum random number generator 28 according to the invention, the photon source 54 or the silicon LED 54 or the first SPAD diode 54 and the photon detectors 55 or the second SPAD diodes 55 can be manufactured with different chemical-physical structures, in particular with different sizes and/or different doping levels, even if they are obtained by the same manufacturing steps. As far as the technology for integrating these components into the semiconductor substrate 49 is concerned, according to the preferred embodiment of the invention, this is the CMOS or CMOS-compatible technology for microfabrication of microintegrated circuits. So-called BCD technologies are also particularly preferred for producing the proposed one-piece microelectronic circuit of the quantum random number generator 28.

BCT technologies are key technologies for integrated power circuits. A BCD technology is the combination of bipolar electronic components (e.g. bipolar transistors and/or PN diodes) with CMOS components (e.g. CMOS transistors or CCD arrays) with DMOS components (e.g. a DMOS transistor)

The DMOS transistor typically comprises a double-diffusion structure in which the p-region and the n-region serve as lines. It is a type of DMOS power transistor that was developed for radio frequency (RF) applications. It can operate with relatively high supply voltages of 50 to 100 V and is characterized by high reliability, peak performance and robustness. A DMOS transistor (Double-Diffused Metal-Oxide-Semiconductor Transistor) is a crucial element in integrated microelectronic circuits. In contrast to conventional CMOS transistors, a DMOS transistor is characterized by specific features that define its function and areas of application.

A DMOS transistor has a special structure. In this structure, doping regions with different electrical charge carrier concentrations are present in the semiconductor material. These doping regions enable the DMOS transistor to switch higher powers and offer a lower on-resistance compared to CMOS transistors. These properties are particularly advantageous in high-performance applications. In the present case, DMOS transistors are suitable for use in the voltage converters 91 of the monolithic integrated circuit. At the same time, BCD technologies enable the compact manufacture of the first SPAD diodes for the photon sources 54 and the second SPAD diodes 55 for the photon detectors 55. Since the first SPAD diodes 54 typically require a higher supply voltage when used as photon sources 54, the voltage converters 91 very often comprise a charge pump or the like to supply the first SPAD diodes 54 with the required high supply voltage. The DMOS transistors mentioned are particularly suitable for these charge pumps in the voltage converters 91 of the one-piece micro-integrated circuit of the quantum random number generator 28. Therefore, a co-integration of the entropy source 401 with at least one DMOS transistor or several DMOS transistors on a common semiconductor substrate 49 are particularly advantageous. A voltage converter 91 of a one-piece microelectronic integrated circuit of a quantum random number generator 28 therefore preferably comprises at least one, better several DMOS transistors. The DMOS transistors of a respective voltage converter 91 of a one-piece microelectronic integrated circuit of a quantum random number generator 28 are preferably located in a half-bridge or an H-bridge circuit within this voltage converter 91. In the case of a half-bridge, an energy store, for example a capacitor, is preferably connected with one connection to the output node of this half-bridge and can then be recharged thereby. In the case of an H-bridge, an energy store, for example a capacitor, is preferably connected with a first connection to the output node of the first half-bridge of the H-bridge and with a second connection to the output node of the second half-bridge of the H-bridge and can then be recharged thereby. Such a voltage converter 91 preferably comprises an electronically controlled transfer switch which, after switching up the voltage at one terminal of the capacitor, can connect the other terminal to a photon source 54 or a silicon LED 54 or a first SPAD diode 54. This step-up technology for the supply voltage can also be multi-stage in order to achieve larger voltage swings. A further voltage converter 91 and an energy storage device, for example a further capacitor, can be connected downstream and upstream of the entropy source 401 or the photon source 54 or the silicon LED 54 or the first SPAD diode 54 in order to stabilize the supply voltage of the photon source 54 or the silicon LED 54 or the first SPAD diode 54. Preferably, the half-bridge and/or the H-bridge and/or the transfer switches of the voltage converter 91 comprise DMOS transistors in order to be able to provide higher supply voltages and thus increase the quantum random bit data rate of the quantum random bits 411, since the increase in the supply voltage leads to an increase in the pulse density of the entropy source.

Another characteristic feature of a DMOS transistor is its ability to handle higher voltages, making it ideal for such high voltage applications. This aspect distinguishes it from CMOS transistors, which are usually designed for lower voltages.

The word BCD technology stands for Bipolar CMOS-DMOS technology. BCD technology is a family of silicon processes that each combine the strengths of three different process technologies on a single chip, enabling compact, one-piece quantum random number generators in the form of a single micro-integrated circuit 2. The advantage of the CMOS microfabrication technology, more precisely the BCD microfabrication technology, is that it is possible to integrate the sampling means (403, 2022, 402, 403, 404.2) for the output signals of the array of photon detectors 55 or the second SPAD diodes 55 into the semiconductor substrate 49.

An example of a possible quantum random number generator 28 of the proposal obtained by the BCD microfabrication technique preferably uses a doped substrate/epitaxial structure of type p 100. The manufacturing process typically creates a deep n-well in the doped substrate/epitaxial structure of type p 100 and the connections defining the photon source 54, the silicon LED 54 and the first SPAD diode 54, respectively, are made with a type p+ implant 102. In order to avoid electric fields that are higher at the edges of the sensitive region than in the center thereof, "guard ring" structures are preferably provided, forming a ring of p-well around the p+ implant 47.

However, it cannot be excluded that in various embodiments of the invention, the technique used to manufacture the photon source 54 or the silicon LED or the first SPAD diode 54 may be a custom-made type technique. The advantage of this last solution is that the manufacturing steps of the quantum random number generator 28 according to the invention can be optimized to obtain the photon source 55 and/or the silicon LED 55 or the second SPAD diode 55.

According to an example of implementing a quantum random number generator 28 with a customized manufacturing technique, the photon detectors 55 or the second SPAD diodes 55 and the photon source 54 or the silicon LED 54 or the first SPAD diode 54 may be integrated into a doped p-type epitaxial structure/substrate, wherein a so-called "flat" implant and an enhancement implant are defined in the epitaxial structure, wherein the "flat" implant is more superficial, of n+ type and concentric to the epitaxial structure, but has a smaller extension, and the enhancement implant is of p- type and has a lower doping, but in any case a higher doping than that of the epitaxial structure.

In this way, a so-called "virtual guard ring" structure is created. In order to avoid problems related to "charge crosstalk" or "charge injection" caused by the common epitaxial structure of the two implants, it is possible to either separate the photon source 55 or the silicon LED 55 or the SPAD diodes 55 and the photon detector(s) 54 or silicon LED 54 or first SPAD diodes 54 by arranging them at suitable distances, or to create deep trenches. which surround both the region of the photon source 54 or silicon LED 54 or first SPAD diode 54 and the region of the photon detector(s) 55 or second SPAD 55. Finally, it is possible to create an auxiliary connection which, when suitably biased, absorbs the excess charge that can be transferred from the photon source 54 or silicon LED 54 or first SPAD diode 54 to the photon detector(s) 55 or second SPAD diode or diodes 55. The creation of trenches would also reduce optical crosstalk, which is again a desired property. However, this reduction does not exceed a percentage of the order of 30-50%, so it is acceptable if it has the advantage of eliminating the problem completely.

As already explained above, the proposed quantum random number generator 28 is configured such that the photon source 54 or the silicon LED 54 or the first SPAD diode 54 can be biased either in the forward direction or in the reverse direction to generate the detected photon flux.

In the case of reverse bias, photoluminescence is used in the avalanche formation in the photon source 54, here the silicon LED 54 or the first SPAD diode 54, which occurs in a controlled manner but at quantum mechanically random time intervals.

At a forward bias, the photons generated behave very similarly to a reverse bias, and the generation efficiency (photons per electrical charge passed) is relatively similar or higher, but at a forward bias, the power dissipation can be reduced compared to a reverse bias because a lower voltage is applied.

To give an order of magnitude, a forward-directed photon source 54 or silicon LED 54 or first SPAD diode 54 requires a voltage of several volts, while a backward-directed photon source requires a voltage of several dozen volts. When developing the technical teaching of this document, it was recognized that the use of DMOS transistors is particularly advantageous for the co-integrability of preferably all relevant electronic components of a quantum random number generator 28. Such DMOS transistors enable the provision of a voltage of several dozen volts for operating the backward-directed photon sources 54, i.e. here the silicon LEDs 54 or first SPAD diodes 54 operated in the reverse direction, by means of a voltage converter 91, which here in the sense of the document presented here can include any form of suitable voltage converter 91 in terms of content and which is preferably in the semiconductor substrate 49 the one-piece microelectronic integrated circuit of the quantum random number generator 28 presented here. When developing the technical teaching of this document, it was thus recognized that the use of a BCD semiconductor technology for the production of the quantum random number generator 28 presented is particularly advantageous for the co-integrability of these DMOS transistors with the other relevant electronic components of the quantum random number generator 28 presented here. The document presented here thus proposes a quantum random number generator 28 which may comprise a voltage converter 91 with one or more DMOS transistors and an entropy source 401 with one or more photon sources 54 and/or silicon LEDs 54 and/or first SPAD diodes 54 and one or more photon detectors 55 and/or second SPAD diodes 55 and preferably one or more processors (10-1, 10-2) and/or one or more data bus interfaces 64 and/or one or more volatile and/or non-volatile memories (30, 6, 16, 8) and/or a test interface 12.

A forward biased photon source 54 or silicon LED 54 or first SPAD diode 54 in a device variant would therefore advantageously make it possible to also reduce the space necessary to electrically isolate the photon source 54 or silicon LED 54 or first SPAD diode 54 itself from the arrangement of photon detectors 55 or second SPAD diodes 54. As a result, the forward biased photon source 54 or silicon LED 54 or first SPAD diode 54 advantageously enables a more compact design of the quantum random number generator 28 and lower costs due to the smaller amount of semiconductor material used to manufacture the generator itself. However, since the structure and manufacturing technology of the photon source 54 or silicon LED 54 or first SPAD diode 54 and the photon detectors 55 or second SPAD diodes 55 are similar or even identical, the advantage of reverse bias is that the same voltage can be used to bias both components.

In particular, this last device variant makes it possible to reduce the complexity and overall dimensions of both the structure and the external circuitry that may still be necessary: the photon source 54 or silicon LED 54 or first SPAD diode 54 and the photon detectors 55 or second SPAD diodes 55 can in fact share the same semiconductor substrate 49 since they have a common connection. This allows them to be arranged close to each other (on top of each other and/or next to each other) in the semiconductor substrate 49, thus reducing the space occupied while improving their optical coupling. In any case, the low efficiency of the photoluminescence process in generating a few photons suggests "quantum detection" since the photon detector(s) 55 or second SPAD diodes 55 are by definition sensitive to a single photon.

As already mentioned, in the preferred embodiment of the proposal, the electronic scanning means (403, 2022, 402, 403, 404.2) together with the photon source 54 or silicon LED 54 or first SPAD diode 54 and the arrangement of photon detectors 55 or second SPAD diodes 55 are also integrally integrated into the semiconductor substrate 49.

In this case, the electronic scanning means (403, 2022, 402, 403, 404.2) can be configured not only to read the signal(s) 405 generated by the array of photon detectors 55 or second SPAD diodes 55, but also to directly and easily control the operating conditions of one or more photon sources 54 or one or more silicon LEDs 54 or one or more first SPAD diodes 54 and to correct any bias parameters by changing the parameters of one of said voltage converters 91 for supplying energy to one or more photon sources 54 or one or more silicon LEDs 54 or one or more first SPAD diodes 54 or to activate or deactivate one or more photon sources 54 or one or more silicon LEDs 54 or one or more first SPAD diodes 54 in order to achieve the desired photon flux or the desired random bit rate of the Quantum random bits 411 to be obtained.

In this case, the electronic sampling means (403, 2022, 402, 403, 404.2) can be configured to directly and easily control the operating conditions of one or more photon detectors 55 or one or more second SPAD diodes 54 and to correct any bias parameters by changing the parameters of one of said voltage converters 91 for supplying energy to one or more photon detectors 55 or one or more second SPAD diodes 55 or to activate or deactivate one or more photon detectors 55 or one or more second SPAD diodes 55 in order to obtain the desired receivable portion of the photon flux or the desired random bit rate of the quantum random bits 411.

According to a preferred embodiment of the proposal of the document presented here, the quantum random number generator 28 is preferably provided with a light protection filter or a cover, for example a metal layer (53, 142), at the level of the top of the semiconductor substrate 49. In particular, preferably, but not necessarily, the light protection filter comprises a metallization layer (53, 142) which is applied directly during the production process, for example by the sequence of the process steps of a BCD technology, for example as last metallization level can be produced. This metal layer (53, 142) does not necessarily have to be produced last. It is typically sufficient if the relevant device parts of the entropy source 401 are covered. Preferably, further device parts of the one-piece, micro-integrated circuit of the quantum random number generator 28 are covered with this metal cover (53, 142) so that it also protects these circuit parts from manipulation by means of electromagnetic radiation and/or thermal, local stress and/or by means of magnetic fields and/or other interventions by influencing physical parameters of such other circuit parts of the quantum random number generator 28. This protection should preferably in particular cover the memories (e.g. 404.9, 30, 6, 8, 16, 22, 20) and/or the processor (10-1, 10-2) and/or the monitoring devices - such as watchdog 404.5, ADC 403, voltage monitor 413, amplifier 402, finite state machine 404.8. This solution has the function of shielding the photon detector(s) 55 or second SPAD diodes 55 or the other circuit parts of the quantum random number generator 28 from external light and other physical interference signals. This solution therefore also has the function of making the photon detector(s) 55 or second SPAD diode(s) 55 sensitive only to the photons that pass through the semiconductor substrate 49 to the photon detectors 55 or second SPAD diodes 55 due to crosstalk from the photon source 54 or silicon LED 54 or first SPAD diode 54. In addition, the metallization layer (53, 142) also has the function of improving the coupling of the photons emitted by the semiconductor substrate 49, in particular the silicon substrate. For this purpose, the metallization layer 53 reflects the electromagnetic radiation generated by the same photon source 54 or silicon LED 54 or first SPAD diode 54 after exiting the semiconductor material of the semiconductor substrate 49 back into the insulation layers of the metallization stack on the semiconductor substrate 49, so that these photons cannot leave the micro-optical system of the one-piece microelectronic circuit of the quantum random number generator 28. This increases the number of photons that reach the photon detector(s) 55 or the second SPAD diode 55 or the second SPAD diodes 55. This in turn increases the random bit data rate of the quantum random bits 411 of the quantum random number generator 28. This thus strengthens the optical coupling between the photon source 54 or silicon LED 54 or first SPAD diode 54 on the one hand and the array of photon detectors 55 or second SPAD diodes 55 on the other hand.

Furthermore, the metal cover 53 of the optical waveguide 44 in the metallization stack of the microelectronic circuit on the semiconductor substrate 49 advantageously also has the function of protecting the quantum random number generator 28 from any attempts by malicious persons to influence the functionality of the system of the proposed device. Consequently, the presence of the metallization in the form of a metal cover (53, 143) makes it possible to ensure greater security and reliability of the random numbers generated by the quantum random number generator 28 according to the invention.

Finally, the proposed quantum random number generator 28 may optionally also comprise electronic post-processing means (404.3, 404.4, 404.8) configured to receive as input the binary sequences extracted by the electronic sampling means (403, 2022, 402, 403, 404.2), which in turn are connected to the array of photon detectors 55 and second SPAD diodes 55, respectively.

Said electronic post-processing means (404.3, 404.4, 404.8) are preferably configured to process said binary sequences 409, 415 in such a way that a so-called "whitening" operation is performed. This last word designates a plurality of compression operations that serve to improve the statistical properties of the generated binary sequences (415, 409). Consequently, it is advantageous that this further post-processing step makes it possible to increase the entropy level of the proposed quantum random number generator 28.

As already mentioned above, the sampling means (403, 2022, 402, 403, 404.2), which according to the preferred embodiment are directly or indirectly connected to the array of photon detectors 55 or second SPAD diodes 55 or alternatively to a subset of the photon detectors 55 or second SPAD diodes 55 or even to a single pixel, are configured to implement a logical extraction method intended to extract a binary sequence of random bits (409, 415) based on the number of photons detected in the array of photon detectors 55 or second SPAD diodes 55, in the subset, in the only one of the photon detectors 55 or in the only second SPAD diode 55 or even in the single pixel. According to the proposal, a first logical extraction method, which is implemented by the sampling means (2022, 402, 403, 404.2) of the proposed quantum random number generator 28, comprises the division of the observation window of each photon detector 55 or of every second SPAD diode 55 into a plurality of successive observation sub-windows Tw, typically having the same duration. If the entropy extraction generates a pulse on its output line 405, a synchronization stage (403, 2022) synchronizes the pulse with the system clock 2106 of the quantum random number generator 28. An observation sub-window Tw typically corresponds to the temporal period of the system clock 2106. According to the methods commonly used in the state of the art, the post-processing means would typically have to determine the arrival times of the photons at the photon detectors 55 or the photons detected by the second SPAD diodes 55 in relation to a reference time as a digital numerical value using a time counter. However, this has the disadvantage that an attacker may be able to manipulate this time via a so-called side channel, without any information being given as to how this could be done. In the context of the document presented here, it is assumed that the attacker succeeds in carrying out this manipulation in an unknown way. The attacker would then be able to manipulate the supposed "random bits", which would give them a deterministic character, which would possibly enable encryption and/or locks to be broken. The proposal presented here prevents this.

The one-piece, integrated microelectronic circuit of the quantum random number generator 28 typically generates these successive observation subwindows Tw starting from the system clock 2106. An observation window Tw in the sense of the document presented here can, for example, begin with a first edge of the system clock 2106 in a first edge direction, which can be rising or falling, and end with the next directly following edge of the system clock 2106 in the same edge direction (rising or falling). The duty cycle of this system clock 2106 typically defines the time in which the photon detector 55 or the second SPAD diode 55 is at the dead time level (system clock 2106 = H [= high level] ).

The special feature of the method proposed here for entropy extraction at the level of each sub-window Tw is the generation of a first pseudorandom number which corresponds to the arrival time of a second photon from the photon source 54 or the silicon LED 54 or the first SPAD diode 54 at a photon detector 55 or a second SPAD diode 55, respectively, in relation to the arrival time of a preferably immediately preceding first photon from the photon source 54 or the silicon LED 54 or the first SPAD diode 54 at a photon detector 55 or a second SPAD diode 55. The device proposed here of the one-piece integrated microelectronic circuit of the proposed quantum random number generator 28 generates this first pseudorandom number by means of a time-to-random number converter (TPRC). Such a time-to-pseudo-random-number converter (TPRC) can also be composed of several stages. For example, the time-to-pseudo-random-number converter (TPRC, 404.3) can comprise an analog instrument, a time to analog converter (TAC), which would then be followed by an analog to pseudo-random number converter (APRC) in the data path to again result in a time-to-pseudo-random number converter (TPRC, 404.3). The diagram shown in Figure 22 represents the detection of the pulses (2201, 2202, 2203, 2204) on the voltage signal 405 of the entropy source 401. The entropy source 401 preferably comprises the one or more photon sources 54 or the one or more silicon LEDs 54 or the one or more SPAD diodes 54 and the light transmission path 44 between them. The entropy source 401 is preferably manufactured in or on the semiconductor substrate 49 and is thus preferably part of the micro-integrated circuit of the quantum random number generator 28. The output signal 405 of the entropy source 401 is typically the said voltage signal 405 of the entropy source 401. The voltage signal 405 of the entropy source 401 is preferably the signal of one or more photon detectors 55 or one or more second SPAD diodes 55 of the entropy source 401.

The voltage signal 405 shows exemplary pulses 2201, 2202, 2203, 2104 for random events of the voltage signal 405. These can be spontaneous voltage pulses of the photon detector 55 or the second SPAD diode 55 of the entropy source 401, which are not related to the activity of the photon source 54 or the silicon LED 54 or the first SPAD diode 54 of the entropy source 401. However, the pulses 2201, 2202, 2203, 2204 of the photon detector 55 or the second SPAD diode 55 of the entropy source 401 can also be based on stimulated emission, which causes the detection of a photon of the one or more photon sources 54 or the one or more silicon LEDs 54 or the one or more SPAD diodes 54 by the photon detector 55 or by the second SPAD diode 55 of the entropy source 401.

The time interval is random. However, after the reception of a photon by the photon detector 55 or by the second SPAD diode 55 of the entropy source 401, a dead time occurs during which the photon detector 55 or the second SPAD diode 55 of the entropy source 401 is no longer able to receive. If the magnitude of the voltage signal 405 of the entropy source 401 exceeds a threshold value 2105, an analog-to-digital converter (ADC, 403), here an exemplary one-bit analog-to-digital converter 403,

Pulse extension circuit, which is preferably part of the integral microelectronic circuit, generates a pulse with a minimum length of n clock cycles of a system clock 2106 of the quantum random number generator 28, which is preferably one of the system clock cycles of the integral microintegrated circuit, on a synchronized voltage signal 415.

In the example of Figure 21, this pulse extension circuit is designed in such a way that it goes to a first logic level for at least three subsequent clock cycles and then until the next event at the second logic level, here for example with the falling edge of the third clock pulse. Instead of three clock pulses, a to n clock pulses can be used, where is a positive integer.

In the example of Figure 21, the falling edges of the pulses 2211, 2212, 2213, 2214 of the synchronized voltage signal 415 represent the synchronized signals of the entropy source 401.

With a falling edge of a first pulse 2211 of the synchronized voltage signal 415, the time-to-pseudorandom number converter (TPRC) resets a pseudorandom number generator, for example, to a predefined seed value. For example, the pseudorandom number generator of the time-to-pseudorandom number converter (TPRC) can be a feedback shift register that shifts its values by one place to the left or right depending on the design with each clock pulse of the system clock 2106 and feeds the feedback value of the feedback polynomial back into the bit that becomes free.

It is important that, starting with the starting value of the pseudorandom number generator (seed value), each clock pulse of the system clock 2106 is bijectively assigned exactly one pseudorandom number of the pseudorandom number generator from the falling edge. This means that the value of the pseudorandom number must be able to be used to determine the temporal position of the relevant clock pulse of the system clock 2106 after the falling edge of the synchronized voltage signal 415.

With the next falling edge of the second pulse 2212 synchronized voltage signal 415, a first pseudorandom number register takes over the last status of the pseudorandom number generator and the time-to-pseudorandom number converter (TPRC) preferably resets the pseudorandom number generator to the predefined seed value.

With the next falling edge of the voltage signal 415 synchronized with the third pulse 2213, a second pseudorandom number register takes over the last status of the pseudorandom number generator and the time-to-pseudorandom number converter (TPRC) preferably resets the pseudorandom number generator to the predefined seed value. The entropy extraction 401 compares the value in the first pseudorandom number register with the value in the second pseudorandom number register. If the first value in the first pseudorandom number register is greater than the second value in the second pseudorandom number register, the entropy extraction 404.4 can, for example, generate a quantum random bit 411 with a first logical level. If the second value in the first pseudorandom number register is greater than the second value in the second pseudorandom number register, the entropy extraction 404.4 can, for example, generate a quantum random bit 411 with a second logical level that is different from the first level. With the next falling edge of the fourth pulse 2214 of the synchronized voltage signal 415, the first pseudorandom number register takes over the previous value of a second pseudorandom number register and the second pseudorandom number register instead takes over the last status of the pseudorandom number generator and the time-to-pseudorandom number converter (TPRC) preferably resets the pseudorandom number generator to the predefined seed value. The entropy extraction 401 then compares the value in the first pseudorandom number register with the value in the second pseudorandom number register. If the first value in the first pseudorandom number register is greater than the second value in the second pseudorandom number register, the entropy extraction 404.4 can, for example, generate another new and here second quantum random bit 411 with a first logical level. If the second value in the first pseudorandom number register is greater than the second value in the second

Pseudorandom number register, for example, the entropy extraction 404.4 can generate another new and here second quantum random bit 411 with a second logic level that is different from the first level.

In this way, the quantum random number generator 28 can continue this process of quantum random bit generation and thus generate a continuous stream of quantum random bits 411, albeit with phase noise.

The key idea here is to use a pseudorandom number generator, which generates the first and second values, instead of a digital counter as in the prior art. The advantage is that even if a disturbance is successfully introduced into the synchronized voltage signal 415, the randomness of the quantum random bit 411 is only marginally disturbed, since the attacker would also have to know the feedback polynomial.

In order to prevent this, it is useful if, for example, the quantum random number generator 28 changes the feedback polynomial of the linearly feedback shift register of the pseudorandom number generator of the time-to-pseudorandom number converter 404.3 (TPRC) after the complete determination of a number m of random quantum bits 411 as a function of one or more previously determined random quantum bits 411.

In order to prevent this, it is also useful if, for example, the quantum random number generator 28 changes the shift register length n of the linearly fed-back shift register of the pseudorandom number generator of the time-to-pseudorandom number converter 404.3 (TPRC) after the complete determination of a number k of quantum random bits 411 depending on one or more previously determined quantum random bits 411. For this purpose, it is useful if the shift register controller 2103 of the time-to-pseudorandom number converter 404.3 (TPRC) or a Processor (10-1, 10-2) rewrites the value of the feedback polynomial selection register 2112 for this purpose. The value stored in the feedback polynomial selection register 2112 preferably controls the feedback multiplexer 2102 of the time-to-pseudo-random number converter 404.3 (TPRC). Thus, the value stored in the feedback polynomial selection register 2112 preferably selects which feedback polynomial of the m feedback polynomial circuits RKNi to RKN _m determines the logical value of the shift register reload value line 2104 of the time-to-pseudo-random number converter 404.3 (TPRC). Preferably, by means of a line 2022 for preventing the use of a quantum random bit 411 by the finite state machine 404.8, the shift register controller 2103 of the time-to-pseudo-random number converter 404.3 (TPRC) or one of the processors (10-1, 10-2) or another device prevents the forwarding of a generated quantum random bit 411 by the finite state machine 404.8 when this quantum random bit 411 is used for the feedback polynomial selection register 2112. This prevents double use and thus increases security. Instead, the shift register controller 2103 of the time-to-pseudorandom number converter 404.3 (TPRC) or the processor (10-1, 10-2) or the other device preferably uses this quantum random bit 411 to generate a random data word for storage in the feedback polynomial selection register 2112. This has the advantage that the feedback polynomial of the m feedback polynomial circuits RKNi to RKN _m selected by the feedback polynomial selection register 2112 is completely random. It is therefore no longer possible for an attacker to feed in a deterministic bit data stream instead of the data bit stream of the quantum random bits 411, even if an attack on the entropy source 401 is successful.

In order to further harden the proposed micro-integrated quantum random number generator 28, it is also useful if, for example, the quantum random number generator 28 changes the start value (seed value) of the linear feedback shift register of the pseudorandom number generator of the time-to-pseudorandom number converter 404.3 (TPRC) after the complete determination of a number p of random quantum bits 411 depending on one or more previously determined quantum random bits 411. For this purpose, it is useful if the shift register controller 2103 of the time-to-pseudorandom number converter 404.3 (TPRC) or a processor (10-1, 10-2) rewrites the value of a seed reload register in the shift register controller 2103 of the time-to-pseudorandom number converter 404.3 (TPRC) with quantum random bits 411 for this purpose. The bit width of a seed reload register in the shift register controller 2103 of the time-to-pseudo-random number converter 404.3 (TPRC) preferably corresponds to the number n of the shift register bits SBi to SB _n of the time-to-pseudo-random number converter 404.3 (TPRC). The shift register controller 2103 of the time-to-pseudo-random number converter 404.3 (TPRC) preferably counts the number of successfully generated quantum random bits 411. Preferably, the finite state machine 404.8 signals the For this purpose, the shift register controller 2103 of the time-to-pseudo-random number converter 404.3 (TPRC) generates a valid quantum random bit 411. Instead of counting the valid quantum random bits 411, it is also possible to count the successfully generated random data words 418 in the finite state machine 404.8. The shift register controller 2103 of the time-to-pseudo-random number converter 404.3 (TPRC) preferably loads the new seed value of a seed reload register in the shift register controller 2103 into the shift register bits SBi to SB _n of the time-to-pseudo-random number converter 404.3 (TPRC) at one or more of the following events.

• upon reaching a predetermined number of successfully generated quantum random bits 411 and/or

• upon reaching a predetermined number of successfully generated random data words 418 and/or

• when changing the value of the feedback polynomial selection register 2112 of the time-to-pseudorandom number converter 404.3 (TPRC) and thus the selected feedback polynomial of the m feedback polynomials RKNi to RKN _m of the time-to-pseudorandom number converter 404.3 (TPRC).

This reliably prevents any kind of predictability.

Preferably, the circuit parts of the quantum random number generator 28 are covered with a metal layer 142, 53 in order to ward off any influence by temperature or electromagnetic radiation or electrostatic fields or magnetic fields. Preferably, the metal layer also comprises a soft magnetic layer to ward off attempts at attack using magnetic fields.

Preferably, by means of a line 2022 for preventing the use of a quantum random bit 411 by the finite state machine 404.8, the shift register controller 2103 of the time-to-pseudo-random number converter 404.3 (TPRC) or one of the processors (10-1, 10-2) or another device prevent the forwarding of a generated quantum random bit 411 by the finite state machine 404.8 if this quantum random bit 411 is used for the seed reload register in the shift register controller 2103 in the time-to-pseudo-random number converter 404.3 (TPRC). This prevents double use and thus increases security. Instead, the shift register controller 2103 of the time-to-pseudorandom number converter 404.3 (TPRC) or the processor (10-1, 10-2) or the other device preferably uses this quantum random bit 411 for generating a random data word for

Storage in the seed reload register in the shift register controller 2103. This has the advantage that the selected by the seed reload register in the shift register controller 2103 Seed value of the linear feedback shift register of the n shift register bits SBi to SB _n is completely random. Since a linear feedback shift register has two cycles when using simple primitive feedback polynomials, one of which only includes one shift register value, this one-cycle shift register value must be prevented. If the random reload value of the seed reload register in the shift register controller 2103 corresponds to the one-cycle seed value of the linear feedback shift register with the current feedback polynomial or the next feedback polynomial provided, the shift register controller 2103 of the time-to-pseudorandom number converter 404.3 (TPRC) or one of the processors (10-1, 10-2) or another device generates a new random reload value in the seed reload register of the shift register controller 2103.

Preferably, the m feedback polynomials RKNi to RKN _m are selected such that the one-cycle seed values are equal. This reduces the effort for detecting the one-cycle shift register value, since this no longer depends on the selected feedback polynomial of the feedback polynomials RKNi to RKN _m . In any case, it is recommended that the time-to-pseudorandom number converter 404.3 (TPRC) includes a detection circuit 2113 for detecting an illegal value of the state vector of the n shift register bits SBi to SB _n when linear feedback shift registers are used. If the state vector of the n shift register bits SBi to SB _n is in such an illegal state, the detector 2113 preferably signals this illegal state to the shift register controller 2103 of the time-to-pseudo-random number converter 404.3 (TPRC) or one of the processors (10-1, 10-2) or another device. The detector 2113 or the shift register controller 2103 of the time-to-pseudo-random number converter 404.3 (TPRC) or the processor (10-1, 10-2) or the other device then resets the value of the state value of the state vector of the n shift register bits SBi to SB _n to a predetermined value and/or the value of the seed reload register in the shift register controller 2103. These reload values are preferably different from the one-cycle shift register value. This preferably also occurs when the watchdog 404.5 and/or the voltage monitor 413 detect a fault or a suspected or possible attack. Preferably, the shift register controller 2103 of the time-to-pseudo-random number converter 404.3 (TPRC) counts the number of these faults. Preferably, the shift register controller 2103 of the time-to-pseudo-random number converter 404.3 (TPRC) reduces this counter value again depending on the number of random quantum bits 411 and/or random data words 418 successfully generated, in particular since the last fault. If this number and/or the event density of such events exceeds a certain predetermined temporal density and/or a certain numerical value, the shift register controller 2103 of the time-to-pseudo-random number converter 404.3 (TPRC) preferably signals to the watchdog 404.5 and/or a Processor (10-1, 10-2) detects a defect in the quantum random number generator 28 or a successful attack on the quantum random number generator 28. Typically, the shift register controller 2103 of the time-to-pseudo-random number converter 404.3 (TPRC) then signals the finite state machine 404.8 that no more random numbers may be generated. Preferably, a processor (10-1, 10-2) must then reactivate the shift register controller 2103 of the time-to-pseudo-random number converter 404.3 (TPRC) using a predetermined reactivation code word. The processor (10-1, 10-2) then writes this reactivation code word via the internal data bus 419 of the quantum random number generator 28 into a special reactivation register of the shift register controller 2103 of the time-to-pseudo-random number converter 404.3 (TPRC), which reactivates the shift register controller 2103 of the time-to-pseudo-random number converter 404.3 (TPRC) and the quantum random number generator 28 and preferably resets all error counters. The number of possible reactivations is preferably limited. If the maximum number of reactivations is exceeded, the quantum random number generator 28 can preferably no longer be reactivated. The counter for the reactivations of the quantum random number generator 28 can preferably be reset by means of a special reset command before this maximum value is reached. Preferably, the shift register controller 2103 of the time-to-pseudorandom number converter 404.3 (TPRC) of the quantum random number generator 28 or another device of the quantum random number generator 28 issues a warning before reaching this blocking limit.

When the quantum random number generator 28 is started, the shift register controller 2103 of the time-to-pseudo-random number converter 404.3 (TPRC) first ensures that the shift register controller 2103 of the time-to-pseudo-random number converter 404.3 (TPRC) first determines a new seed value based on quantum random numbers 411 and a new value of the feedback polynomial selection register 2112 based on quantum random numbers from quantum random bits 411 by means of a predetermined seed value and a predetermined value of the feedback polynomial selection register 2112. Only when the seed value and the value of the feedback polynomial selection register 2112 are based on quantum random numbers is the initialization phase of the quantum random number generator 28 completed and the shift register controller 2103 of the time-to-pseudo-random number converter 404.3 (TPRC) signals the finite state machine 404.8 that it may use and pass on the quantum random bits 411 and the quantum random data words 418 (quantum random numbers). The finite state machine 404.8 preferably signals this fact to one or more processors (10-1, 10-2). This has the advantage that the device only generates quantum random numbers 418 generated with full protection. By using a time-to-pseudorandom number generator 404.3 (TPRC), it is no longer possible for an attacker to feed in a deterministic bit data stream instead of the data bit stream of the quantum random bits 411, even if an attack on the entropy source 401 is actually successful for whatever reason.

In order to prevent this, it is also useful if, for example, the quantum random number generator 28 changes this number m after the complete determination of a number m of quantum random bits 411 depending on one or more previously determined quantum random bits 411.

Preferably, the finite state machine 404.8 of the quantum random number generator 28 does not output these already used quantum random bits 411 and does not use them for generating quantum random data words 418.

The logic extraction method also includes three borderline cases, which are described below.

Typically, the time-to-pseudo-random number generator 404.3 (TPRC) uses the logical value of the shift register reload value line 2104 of the time-to-pseudo-random number converter 404.3 (TPRC) as the value of the output 410 of the time-to-pseudo-random number converter 404.3 (TPRC). If necessary, a buffer amplifier can be provided which detects the logical value of the shift register reload value line 2104 of the time-to-pseudo-random number converter 404.3 (TPRC) and outputs it as the value of the output 410 of the time-to-pseudo-random number converter 404.3 (TPRC).

The entropy extraction 404.4 now compares two different pseudorandom numbers generated by the time-to-pseudorandom number converter 404.3 (TPRC) from the output 410 of the time-to-pseudorandom number converter 404.3, a first pseudorandom number 410.1 and a second pseudorandom number 410.2.

If the first pseudorandom number 410.1 and the second pseudorandom number 410.2 are the same, the entropy extraction 404.4 discards one of the two pseudorandom numbers, the first pseudorandom number 410.1 or the second quantum random number 410.2, and replaces it with a new pseudorandom number 410.3 from the time-to-pseudorandom number converter 404.3 (TPRC). The entropy extraction 404.4 preferably uses a counter to count the events in which the two pseudorandom numbers, the first pseudorandom number 410.1 and the second pseudorandom number 410.2, are the same and increases the counter by a first counter step size with each such event. Preferably, the entropy extraction 404.4 also counts the events in which the two pseudorandom numbers, the first pseudorandom number 410.1 and the second pseudorandom number 410.2, are unequal using this counter and decrements the counter by a second counter step size with each such event, preferably the value 0 is not undercut. Preferably, the second counter step size is smaller in magnitude than the first counter step size of the counter in the entropy extraction 404.4. If the value of this counter exceeds a predetermined value, the control device of the entropy extraction 404.4 assumes a defect in the time-to-pseudo-random number converter 404.3 (TPRC). Preferably, the control device of the entropy extraction 404.4 then signals a defect in the quantum random number generator 28 or a successful attack on the quantum random number generator 28 to a processor (10-1, 10-2). Preferably, the entropy extraction 404.4 then no longer signals the finite state machine that a quantum random bit 411 has been successfully generated, so that the finite state machine 404.8 can no longer report successful quantum random number generation to a processor (10-1, 10-2) and no longer generates quantum random numbers 1018.

If the first pseudorandom number 410.1 is smaller than the second pseudorandom number 410.2, the entropy extraction 404.4 generates a quantum random bit of a first logical value, for example a logical '1', and signals the successful generation to the finite state machine 404.8.

If the first pseudorandom number 410.1 is greater than the second pseudorandom number 410.2, the entropy extraction 404.4 generates a quantum random bit of a second logical value, for example a logical '0', which is different from the first logical value, and signals the successful generation to the finite state machine 404.8.

The finite state machine converts the successfully generated quantum random bits 411 into quantum random data words 418, each of which represents a quantum random number, and makes these available to the processors (10-1, 10-2) via a RAM or a FIFO 404.9 via the internal data bus 419. The finite state machine 404.8 preferably signals the provision of one or more quantum random numbers to one or more processors (10-1, 10-2).

One problem may be a jitter of the system clock 2106. By using a time-to-pseudorandom number generator 404.3 (TPRC), a monofrequency or otherwise systematic disturbance of the system clock 2106 is spread in the spectrum with a random spreading code, making detection difficult, if not impossible, for an attacker.

This further complicates the vulnerability of the quantum random number generator 28.

By using quantum random numbers for the seed value of the linear feedback shift register of the time-to-pseudorandom number converter and a quantum random number for the selection of the simple primitive feedback polynomial, the behavior of the time-to-pseudorandom number converter 404.3 (TPRC) itself is at a random level of a Quantum random number. By regularly changing these values, it is made even more difficult for an attacker to influence the generated quantum random numbers.

Therefore, the proposed quantum random number generator 28 achieves all of the above-mentioned goals.

In particular, the proposal achieves the objective of providing a one-piece, micro-integrated quantum random number generator 28 that makes it possible to guarantee a high level of entropy so that it at least passes the statistical tests defined by NIST.

It is a further object of the proposal to provide a one-piece, micro-integrated quantum random number generator 28 which makes it possible to achieve a high bit rate when generating random sequences of quantum random bits 411 and/or quantum random data words 418.

It is a further object of the proposal to provide a one-piece, micro-integrated quantum random number generator 28 which, compared to the quantum random number generators of the prior art, has a more compact, more robust and less complex and, above all, micro-integrated and CMOS compatible structure, which allows one-piece manufacturing and co-integration into conventional systems such as memories (such as DRAMS, SRAMS, flash memories and the like) or processors (microprocessors and/or microcontrollers and/or SoCs with a processor on the IC).

Here too, the proposal achieves the goal of providing a quantum random number generator 28 with a high degree of security against any attempt to manipulate its internal components. In particular, the use of a time-to-pseudo-random number generator 1004.3 (TRNG) prevents the evaluation of successful attacks on the entropy source 401. Furthermore, the many tests enable a reliable detection of an attack on the quantum random number generator 28 and thus prevent the use of manipulated numbers as supposedly secure quantum random numbers.

Finally, the proposal also achieves the objective of providing a quantum random number generator 28 which is more economical than the generators of the known state of the art, in particular due to the ability to be co-integrated into CMOS circuits.

Another aspect of the present disclosure relates to an integrated quantum random number generator, 28, with an entropy source 401 comprising a photon source 54 and a single photon detector 55, wherein the photon source 54 and the single photon detector 55 are arranged in the vertical direction for further compaction of the device based on the surface of the semiconductor substrate 49, which marks the horizontal direction in the sense of the present document, are arranged one above the other in a common substrate made of a semiconductor material. An entropy source 401 according to the invention can also comprise several photon sources coupled to a single single-photon detector 55 (e.g. to increase the photon rate or the reliability) 54 or several single-photon detectors coupled to a single photon source 54 (e.g. for monitoring purposes) 55 or several single-photon detectors coupled to several photon sources 54 (e.g. for monitoring purposes) 55. The combination of several photon sources 54 and single-photon detectors 55 to form a single entropy source 401 is also possible.

In contrast to the prior art, the photon sources 54 and photon detectors 55 are not arranged side by side, but rather a compact arrangement of a photon source 54 and a single photon detector 55 one above the other. This is therefore a particularly compact monolithic 3D integration with minimal space consumption for the entropy source 401. In particular, an arrangement is preferred in which the single photon detector 55 is arranged lower than the photon source 54 in the semiconductor material (i.e. photon source 54 above, single photon detector 55 below) for improved shielding against external influences. In an alternative embodiment, however, the single photon detector 55 can also be arranged higher than the photon source 54 in the semiconductor material (i.e. photon source 54 below, single photon detector 55 above). For example, in addition to an inversion of the basic structural design during processing from the surface of the semiconductor substrate 49, an inverse arrangement of the elements can also be carried out by appropriate structuring from the back of the semiconductor substrate 49. In particular, structuring can be carried out on both sides from both the front and the back of the semiconductor substrate 49.

Preferably, the photon source 54 is a single photon source (SPS) designed to provide only single photons or a few photons at a time at random time intervals. Such photon sources 54 that provide only single photons or a few photons at a time are also referred to as single photon sources 54 in the context of this application. However, they do not have to be real single photon emitters, for example based on a single isolated two-level system; rather, conventional light sources can also be designed as SPS 54 by attenuating the emission or the supplied current to a correspondingly high degree.

In the context of the present disclosure, a semiconductor substrate 54 is understood to mean the entire

Semiconductor chip is understood as a body in which, for example, by means of bipolar, BiCMOS, CMOS or other semiconductor technologies, a specific element structure is structured into the semiconductor material 49, for example by forming differently doped wells or regions. However, the structure formation can also be carried out additively by applying further layers and structures or by a sequence of etching and application steps for such further layers and structures, preferably with the formation of the analog and digital circuits for evaluating and processing the output signal 404 of the entropy source 401. A corresponding semiconductor substrate 49 can therefore comprise, in addition to a so-called carrier or base substrate (e.g. an unstructured single-crystal semiconductor substrate 49 as a basis for the epitaxial growth of further semiconductor layers), a large number of such epitaxially grown layers 48 and other coatings. The semiconductor substrate 49 is therefore understood in this application as a material carrier for the semiconductor structures of an entropy source 401 according to the invention and not in the sense of a simple carrier or base substrate for applying these structures. In this respect, the formation of an entropy source 401 according to the invention one above the other in a common semiconductor substrate 49 made of a semiconductor material represents a demarcation, in particular compared to hybrid-integrated combinations (e.g. by means of flip-chip assembly) of at least one photon source 54 and at least one single-photon detector 55, for example on a common submount as a carrier structure.

Preferably, in the case of the vertical arrangement of photon source 54 and photon detector 55, the photon source 54 is a light-emitting silicon LED 54 operated at an operating point below or close to the breakdown voltage, better an avalanche Zener diode (Zener-avLED) 54. Preferably, the Zener-avLED 54 has a breakdown voltage of < 10 V, more preferably a breakdown voltage of < 8 V and even more preferably a breakdown voltage of < 7 V. The advantages of using a Zener-avLED as a single photon source 54 are explained in more detail below. This new type of single photon source 54 allows a high single photon rate of photons emitted by the single photon source 54 at a relatively low operating voltage, even below and in the range of the Zener breakdown voltage, and, with the desired design, shows a preferably directed radiation of the generated photons into the interior of the semiconductor substrate 49 and thus in the direction of the single photon detector 54. The close proximity of the single photon detector 55 to the single photon source 54 outweighs the disadvantage of the increased attenuation in the semiconductor substrate 49. This makes Zener avLEDs particularly suitable for use as a single photon source 54 in an entropy source 401. Preferably, the single photon detector 55 is a single photon avalanche diode (SPAD), i.e. second SPADs 55. In the context of this document, this refers to detectors which, due to their particularly high sensitivity with high amplification and low (dark) noise, are in principle capable of detecting and proving individual photons.

A main idea of the inventive entropy source 401 of the present invention is thus to provide a particularly compact and safe integrated entropy source 401 by arranging a Zener avLED as photon source 54 and a second SPAD 55 as single photon detector 55 vertically one above the other in a common semiconductor substrate 49.

One approach to improving the entropy sources 401 known from the state of the art is to select a correspondingly broad technology platform. For SoC designs with the widest possible range of possible applications, integrated circuits in bipolar CMOS DMOS technology (BCD technology) on silicon offer great potential. Silicon LEDs are known for this technology. Highly efficient SPADs have already been successfully demonstrated and implemented in BCD technology. BCD technology allows a particularly effective and optimized integration of these SPADs with a large number of other functional groups such as digital and analog circuit components, particularly energy-efficient digital memory and switching elements, general power and driver electronics as well as detector and sensor components. The document presented here particularly points out the advantage of the availability of DMOS transistors for the necessary voltage-stable voltage converters for generating the increased supply voltages for operating the entropy source 401 in such a way that the photon sources 54 and/or the photon detectors 55 can be operated close to their breakdown voltages, e.g. in Geiger mode.

The silicon-based PLCs known in the state of the art can in principle also be implemented in BCD technologies. However, due to the undirected radiation of the photons and the fact that they are usually implemented close to the surface, such silicon LEDs are not optimal for the realization of particularly efficient entropy sources 401 that are protected from attacks. The implementation close to the surface also usually results in degradation in the case of a silicon LED used in avalanche operation. Since silicon, as an indirect semiconductor, is poorly suited to the generation of photons and these can generally only be generated by further processes via an additional interaction with the crystal lattice, the selection of possible alternative photon sources based on silicon is very limited. When examining Zener diodes provided in a BCD technology in different layers by corresponding pn junctions, which are optimized for a permanent operating point even in the breakdown region, with a Zener diode close to the surface as an emitter and a simple pn diode underneath without bias (English "zero bias") as a photon detector 55, it was shown that in this configuration, contrary to the general expectation of the expert, strong electroluminescence with an effectiveness of at least 0.03% can be observed on the Zener diode in avalanche operation at the breakdown voltage. In the prior art, corresponding Zener diodes are usually not intended for operation as optoelectronic components (LEDs).

In particular, the photons generated are preferably emitted in the direction of the lower p-n diode, which can thus detect almost all emitted photons, which can also be demonstrated in the inventive structure via a photocurrent (see FIGS. 29 to 32 with the associated figure description). It was thus shown that the Zener diode examined has a low but nevertheless significant efficiency in the area of the breakdown/Zener voltage (approx. one detected photon per 3000 electrons of the Zener diode current) and therefore appears to be extremely suitable as single photon sources for the realization of entropy sources 401 in silicon-based BCD technology. In particular, the preferred radiation in the direction of the photon detector offers clear advantages over the isotropic radiation of conventional photon sources 54 used in entropy sources 401. The silicide commonly used in CMOS technology to represent reduced contact resistance between the metal contacts and the semiconductor silicide is on the one hand light-tight and on the other hand mirror-smooth, so that photons originally emitted upwards can be reflected back into the interior of the semiconductor substrate 49 by the silicide mirror thus formed. Zener diodes designed accordingly and operated as SPS in avalanche mode are therefore also referred to below as light-emitting avalanche Zener diodes (Avalanche Light Emitting Zener Diodes, Zener-avLED) 54, in contrast to the silicon LEDs 54 known from the prior art.

The Zener avLEDs provided in the BCD technology used emit photons with wavelengths from the visible spectral range when used as a photon source 54 and have a relatively low Zener operating voltage of usually less than 8 V. This simplifies the design of the charge pumps in the voltage regulators 91 for supplying the entropy sources 401 with electrical energy. Since the radiation of a Zener avLED when used as a photon source 54 is also typically directed such that the photons are emitted preferably in a vertical direction, ie away from the surface of the semiconductor substrate 49 into the semiconductor substrate 49, when used in a Entropy source 401 can achieve a much stronger isolation of the SPS and the photons generated from the environment of the semiconductor material 49, and tapping or injecting photons on the surface of the photon detector 55 is made significantly more difficult. With a suitable design of the second SPAD diode 55 belonging to an entropy source 401, the efficiency of the random number generation of the quantum random number generator 28 can also be significantly increased and uncontrolled photon propagation in the semiconductor material 49 with corresponding crosstalk to other circuit parts of the micro-integrated circuit 2 can be largely prevented. The document presented here therefore also discloses the idea of minimizing the optical crosstalk between the entropy source 401 and other device parts of the micro-integrated circuit 2 by a vertical arrangement of the photon source 54 and the photon detector 55 in a common substrate with the other device parts of the micro-integrated circuit 2.

The second essential component for constructing a compact entropy source 401 is therefore the selection of a correspondingly adapted SPAD design for the second PSPAD diode of the photon detector 55. Typically, the second SPAD diodes 55 in BCD technologies are also implemented close to the surface by appropriately forming p- or n-wells. Such near-surface SPADs as second SPAD diodes 55 are certainly comparable to the SPADs implemented in CMOS technology in the prior art. In principle, the entropy source known from EP 3 529 694 B1 could therefore also be implemented in BCD technologies with the Zener avLEDs described above. However, as already described above, the Zener avLEDs as photon source 54 advantageously emit the photons preferably in the direction into the semiconductor substrate 49. A juxtaposition of a Zener avLED as SPS and when used as a photon source 54 and a near-surface SPAD as a second SPAD diode 55 and as a photon detector 55, as known from the prior art, could in principle be implemented, but not necessarily effectively. When using Zener avLEDs as photon sources 54, it is therefore expedient to arrange the associated second SPAD diode 55 below the Zener avLED, which serves as the photon source 54.

In addition to the implementation of conventional n-SPADs and p-SPADs, BCD technology also enables the implementation of completely new SPAD concepts, including the use of deep n- or p-doped layers in a BCD substrate.

In this case, a method for generating deep pn junctions in a BCD process, also recently developed by the applicant, made it possible to create a particularly efficient, deep single-photon avalanche diode ("deepSPAD") based on this process, which is based on can be arranged in a simple manner directly below a Zener avLED designed to provide single photons as a photon source 54. The combination of a Zener avLED as a photon source 54 in combination with a deep-lying second SPAD diode 55 as a photon detector 55 thus provides the essential components of an entropy source 401 that is completely vertically integrated in BCD technology, in contrast to a horizontal integration of an entropy source 401 based on CMOS technology according to the prior art.

By vertically arranging a Zener avLED as photon source 54 and a deepSPAD realized by means of extremely deep p-n junctions as a second SPAD diode 55 and thus as photon detector 55, a miniaturized quantum random number generator 28 based on a monolithic silicon die as semiconductor substrate 49 with an entropy source 401 with highly efficient optical coupling of the photon source 54 and the photon detector 55, high security against attacks and a relatively low operating voltage and thus reduced voltage converter effort can be realized in BCD technologies. The design of the vertical entropy source 401 presented here on a BCD basis with a photon detector 55 arranged vertically to a photon source 54 in a one-piece micro-integrated circuit 2 therefore represents an optimal solution to the inventive task. In particular, the vertical 3D integration can further increase the compactness of an entropy source 401 and reduce the chip area consumption compared to conventional lateral 2D designs while simultaneously increasing efficiency. This is what makes it possible to place the entropy source 401 in the pad edge 2403 of a micro-integrated circuit 2. This reduces the effective chip area consumption for the proposed entropy source 401 to effectively 0, which results in a massive economic advantage.

Preferably, an entropy source 401 according to the invention and the associated quantum random number generator 28 are therefore formed in a BCD substrate as a semiconductor substrate 49, which was manufactured using a BCD technology.

The BCD substrate preferably comprises a carrier substrate 49 of the proposed vertical entropy source 401 and an epitaxial layer 48 grown on the carrier substrate 49 of the proposed vertical entropy source 401, wherein a deep pn junction in the epitaxial layer 48 was created between the carrier substrate 49 of the proposed vertical entropy source 401 and the epitaxial layer 48 by diffusion of dopants introduced into a surface of the carrier substrate 49 of the proposed vertical entropy source 401 below the epitaxial layer 48. The carrier substrate 49 of the proposed vertical entropy source 401 can preferably be a p-substrate. However, n-substrates or intrinsic substrates can also be used. The substrate material of the carrier substrate 49 of the proposed vertical entropy source 401 can in particular be silicon. However, the methods can in principle also be adapted for other semiconductor materials. A typical dopant for forming a p-region is boron. Phosphorus (P), arsenic (As) or antimony (Sb) can be used to form an n-region. In silicon, for example, boron diffuses significantly further as a dopant than the heavy donors (P, As or Sb). It can also be seen that the n-regions created are largely dominant due to the higher doses used, i.e. an n-region already doped with phosphorus can retain its existing conduction type even after additional boron has been introduced. To provide the deep pn junctions, additional mask, lithography and epitaxy steps in the usual BCD process can sometimes be dispensed with.

The first and second dopant preferably have different diffusion properties in the carrier substrate and/or in the epitaxial layer. The second dopant preferably has a higher mobility in the carrier substrate and/or in the epitaxial layer than the first dopant. The first dopant and/or the second dopant are preferably introduced without a mask or using a mask process. For maskless introduction, a direct ion beam writing process, for example using focused ion beams, can be used. In a mask process, the introduction is carried out using a mask that has been provided beforehand and/or is preferably produced photolithographically, the introduction being carried out using a chemical or physical deposition process or also using an ion beam writing process. Preferably, immediately after the introduction of the second dopant, in a plan view of the surface of the carrier substrate, the first region or the second region completely overlays the other region. Preferably, the first region is a deep n-layer (NBL layer) and the second region is a deep p-layer (PBL layer).

Preferably, the single photon detector 55 forms an avalanche region in a region around the deep p-n junction and comprises an absorption region for converting photons into electron-hole pairs, wherein the absorption region is directly adjacent to the deep p-n junction.

It is preferred that the deep pn junction is formed at least partially between a deep n-layer as a cathode and a deep p-layer immediately adjacent to the deep n-layer. It is also preferred that the absorption region is directly adjoins the deep p-layer and is essentially designed as a p-region. Essentially means that the absorption region can also be partially designed as an intrinsic region. It is also preferred that an anode designed as a p+ region directly adjoins the absorption region.

Preferably, a second deep pn junction (e.g. in the carrier substrate 49) formed below the deep pn junction of the single photon detector 55 in the epitaxial layer 48 is used as an additional photon detector 55 for monitoring for external attacks. The said method for producing deep pn junctions in a BCD process results in a second pn junction underneath the first pn junction in some embodiments (see FIG. 27 with associated figure description) (observation diode 28040). This second pn junction can also be configured as a photon detector 55 or single photon avalanche diode 55 due to its largely identical electronic properties. Since this additional photon detector 55 is thus arranged below the actual arrangement of the entropy source 401, buried deep in the semiconductor material 49, it can provide an additional protective function, unknown from the prior art, against photons injected from the back of the semiconductor substrate 49. Preferably, the proposed watchdog 404.5 and/or the proposed voltage monitor 423 use this second pn junction as a light-sensitive observation diode 28040. Preferably, the proposed watchdog 404.5 and/or the proposed voltage monitor 423 evaluate the diode voltage of the observation diode 28040 (observation diode voltage) in the form of this second PN junction, record the diode voltage of this observation diode 28040 as an observation diode voltage value and compare this observation diode voltage value with a permitted observation diode voltage value interval. If the observation diode voltage value is outside the observation diode voltage value interval, the proposed watchdog 404.5 and/or the proposed voltage monitor 423 conclude that there is a defect or a photonic attack on the entropy source 401. In this case, after detecting such an incident, the presence of such an incident is signaled to one of the processors 10-1, 10-2 and/or such information is provided. The watchdog 404.5 preferably signals such an incident by means of an interrupt signal via an interrupt line to the intended processor 10-1, 10-2. The watchdog 404.5 preferably checks whether there is a correlation between a photon detection of the observation diode 28020 and a signal at the output 405 of the entropy source 401. If this is the case, the photons do not come from outside, but from the entropy source 401. The watchdog 404.5 and the voltage monitor 413 preferably ignore such events. Typically, other circuit parts also emit of the micro-integrated circuit 2 and/or the quantum random number generator 28 parasitic photons that can hit the observation diode 28020. Typically, the observation diode 28020 also detects some of these parasitic normal operation photons. The watchdog 404.3 can detect the level of these normal operation photons and make them available to the processor 10-1, 10-2, for example via the data bus 419, as a measured value for other purposes. If necessary, the processor 10-1, 10-2 or another device part of the micro-integrated circuit 2 can conclude an operating state of the micro-integrated circuit 2 depending on a transmitted or provided measured value of the level of the normal operation photons. The permitted observation diode voltage value interval is preferably set such that a photonic attack is only detected if the measured value of the level of the normal operating photons is significantly outside the expected measured values of the level of the normal operating photons.

The watchdog 404.3 can thus detect attack photons in the immediate vicinity of the entropy source 401 in a wide angular range by means of the observation diode 28040 and typically with the aid of the voltage monitor 413. This enables the processor 10-1, 10-2 to detect external attacks with a high degree of probability.

Preferably, the top and/or bottom of the semiconductor substrate 49 in the region of the entropy source 401 are mirrored on one surface. Preferably, the top and/or bottom of the semiconductor substrate 49 in the region of the entropy source 401 can also comprise a light-blocking layer - which can also be mirrored - on one surface. Mirroring the surfaces of a semiconductor substrate 49 (e.g. by means of metallization 142, 53 or the application of dichroic layers) and the application of a light-blocking layer are known in the prior art and have already been discussed above. Even with an entropy source 401 as proposed, these approaches can be used to shield against external photons ("shading") and to increase efficiency by reflecting back the photons generated by the associated photon source 54. Alternatively or additionally, a corresponding encapsulation can also be carried out in the area of the entropy source 401 or this area can be surrounded by a metal box.

Preferably, the surface of the semiconductor substrate 49 is covered with a silicide layer in the region of the entropy source 401 and above with a metallization 142, 53. Preferably, the metallization 142, 53 is closed in the region of the entropy source 401. The metallization 142, 53 can act as a mirror coating for the inner region and/or as a wavelength-independent shading for external photons. The same applies to a formed silicide layer. Preferably, photons provided by the single photon source 54 are prevented from escaping at the surface of the semiconductor substrate 49 and/or the back of the semiconductor substrate 49 by a combination of at least one element each of metal covers, side wall contacts and vias. This prevents the signal generation from being observable by microscopes or the like. The elements mentioned can achieve a largely complete shielding or encapsulation of the entropy source 401, which can ensure not only shielding from the outside but also a high level of immunity to external interference. Preferably, this encapsulation also includes other device parts of the quantum random number generator 28. A second corresponding encapsulation can also include the other device parts of the quantum random number generator 28 and the already encapsulated entropy source 401 by means of additional layers and vias.

Preferably, several entropy sources 401 according to the invention or a multi-channel entropy source 401 are implemented in a system of several quantum random number generators 28 as a QRNG system. Such a QRNG system preferably comprises a large number of proposed entropy sources 401, which are preferably implemented together on the same semiconductor substrate 49 of a preferably one-piece micro-integrated circuit 2. Together with a compact shielding of the individual entropy sources 401, very high integration densities can be achieved with a high number of densely packed entropy sources 401 that are decoupled from one another as a result of the shielding by means of the said layers and vias, and thus overall high effective random number rates. Preferably, such a QRNG system comprises, in addition to the necessary plurality of shielded entropy sources 401, the necessary plurality of analog-to-digital converters 403, the necessary plurality of time-to-pseudo-random number converters 404.3, the plurality of entropy extractors 404.4, also a device that combines the plurality of generated quantum random bits 411 into a sequence of quantum random numbers. This is typically a modified FSM 404.8. In the case of entropy sources 401 in the prior art, the integration density is limited primarily by the structural juxtaposition of the individual components.

Preferably, a proposed quantum random number generator 28 comprises an electronic circuit for generating and outputting a digital quantum random number sequence based on the statistical evaluation of the temporal sequence of signals 405 of the single photon detector 55 of the entropy source 401.

Another aspect of the present proposal concerns the integrated microelectronic

Integrated Circuit (IC) comprising at least one proposed Entropy source 401. In particular, these can be ICs 2 for applications based on safety-relevant chip-based systems (System on Chip, SoC).

The advantages of a proposed vertical entropy source 401 with a photon source 54 arranged vertically to the photon detector 55 compared to the known horizontal implementations in the prior art are based primarily on the further miniaturization of the entire random number generator structure and the resulting high degree of integration or miniaturization of the generated structures and the resulting increase in the quantum random bit rate. Due to the complete isolation of the SPS (photon source 54) and the associated second SPAD diode 55 from the environment through the proposed shielding by means of layers and vias, the security of the quantum random number generation can be significantly increased. The directed vertical radiation from the Zener avLED 54 used in the proposed vertical entropy source 401 as the SPS (photon source 54) also contributes to increasing the security and to a significant increase in the efficiency of the quantum random number generation of the quantum random number generator 28.

A second deep pn junction provided by means of a novel BCD technology and formed below the pn junction of the second SPAD 55 of the vertical entropy source 401 can be used as an additional photon detector as an observation diode 28020 for monitoring attacks, in particular from the rear side of the semiconductor substrate 49. In the example discussed here, the observation diode 28040 is connected between the substrate 49 and the cathode 26132 of the second SPAD diode 55 buried in the semiconductor substrate 49 of the vertical entropy source 401, which operates as a photon detector 55. The watchdog 404.5 and/or the voltage monitor 413 preferably record the observation diode voltage value of the voltage of the observation diode 28020. The watchdog 404.5 preferably compares the synchronized voltage signal 415 with a likewise synchronized signal of the observation diode voltage value of the observation diode 28020. If the synchronized signal of the observation diode voltage value of the observation diode 28020 shows a plus that is synchronous with a pulse of the synchronized voltage signal 415, the watchdog 404.5 assumes that this is not an attack but a regular signal and typically does not trigger an alarm. From time to time, however, the watchdog 404.5 and/or the processor 10-1, 10-2 can interrupt the voltage supply of the entropy source 401, so that the synchronized voltage signal 415 of the observation diode voltage value should no longer show any pulses. In this case, the synchronized signal of the observation diode voltage value of the observation diode 28020 must no longer show any pulses. Shows However, if the synchronized signal of the observation diode voltage value of the observation diode 28020 continues to pulse, the watchdog 404.5 typically concludes that there is an attack or a fault. The watchdog 404.5 preferably reports such an attack or a fault to the processor 10-1, 10-2 via the data bus 419 and/or by means of an interrupt signal via an interrupt line. The watchdog 404.3 can also keep the information about such a suspected attack ready in a register or memory of the quantum random number generator 28. The watchdog 404.5 then typically prevents the generation of random numbers 418 by the FSM 404.8 at least until the processor 10-1, 10-2 explicitly allows this generation again by means of a corresponding command to the watchdog 404.5, preferably by means of a password via the data bus 419.

The voltage monitor 413 preferably monitors the voltage level of the observation diode voltage value of the voltage of the observation diode 28020. If the observation diode voltage value of the voltage of the observation diode 28020 is outside the predefined observation diode voltage value interval, the voltage monitor 413 preferably reports this to the watchdog 404.5. In the case of such an out-of-spec message from the voltage monitor 413 for the observation diode voltage value of the observation diode 28040, the watchdog 404.5 typically again concludes that there is an attack or a fault. The watchdog 404.5 preferably reports such an attack or a fault to the processor 10-1, 10-2 via the data bus 419 and/or by means of an interrupt signal via an interrupt line. The watchdog 404.3 can also keep the information about such a suspected attack in a register or memory of the quantum random number generator 28. Typically, the watchdog 404.5 then prevents the generation of random numbers 418 by the FSM 404.8 at least until the processor 10-1, 10-2 explicitly allows this generation again by sending a corresponding command to the watchdog 404.5, preferably by means of a password via the data bus 419.

The efficiency of the optical coupling into the associated second SPAD diodes 55 as well as the isolation and safety can be further increased by using internal metal and silicide mirrors. For the Zener avLED used as photon source 54, only a relatively low operating voltage of < 8 V is required compared to the state of the art. This further simplifies the necessary voltage converters 91 for generating the operating voltages of the entropy source 401. Since the absorption length of the emitted visible light in the silicon is also small (ie the associated absorption coefficient is high), very good optical isolation between neighboring elements can also be achieved. The close proximity of the photon source 54 to the photon detector 55 in the vertical entropy source 401 prevents This disadvantage of the short absorption length of the emitted visible light in the silicon becomes effective with regard to the efficiency of the photon transport. This enables the arrangement of the vertical entropy sources 401 in an array with a high cell density and a resulting correspondingly high generation or entropy rate of the quantum random number generator 28. Further aspects of the present invention are disclosed in the dependent claims or in the following description of the drawings.

Features of the invention

The features of the invention summarize these again. Applications of the technical teaching can combine the features with one another, provided that these combinations do not cause factual contradictions. In this respect, the dependencies and relationships presented here only represent particularly preferred, exemplary embodiments.

Feature 1: Quantum process-based generator (28) for true random numbers (411, 418) (Quantum Random Number Generator: QRNG), wherein the quantum process-based generator (28) for true random numbers (411, 418) (Quantum Random Number Generator: QRNG) has an entropy source (401) and wherein the quantum process-based generator (28) for true random numbers (411, 418) (Quantum Random Number Generator: QRNG) evaluates a signal (405) of the entropy source (401) by means of a time-to-pseudo-random number converter (TPRC) (404.3) and generates one or more random bits (411).

Feature 2: Quantum process-based generator (28) for true random numbers (411, 418) according to feature 1, wherein the quantum process-based generator (28) for true random numbers (411, 418) generates one or more random numbers (418) from several random bits (411) and makes them available or uses them.

Feature 3: Quantum process-based generator (28) for true random numbers (411, 418) according to feature 1 or 2, wherein the behavior of the P of a time-to-pseudo-random number converter (TPRG) (404.3) depends on one or more quantum random bits (411) and/or one or more quantum random numbers (418).

Feature 4: Quantum process-based generator (28) for true random numbers (411, 418) according to one of features 1 to 3, wherein the quantum process-based generator (28) for true random numbers (411, 418) comprises a watchdog (404.5) which ensures the correct functioning of the quantum process-based generator (28) for true random numbers (411, 418).

Feature 5: Quantum process-based generator (28) for true random numbers (411, 418) according to one of features 1 to 4, wherein the quantum process-based generator (28) for true random numbers (411, 418) comprises a watchdog (404.5) which monitors the correct functioning of the quantum process-based generator (28) for true random numbers (411, 418) by measuring the randomness of the generated quantum random bits (411) in the form of a measured value and comparing it with a tolerance interval or a threshold value and concluding that there is an error in the event of a deviation.

Feature 6: Quantum process-based generator (28) for true random numbers (411, 418) according to one of features 1 to 5, wherein the quantum process-based generator (28) for true random numbers (411, 418) comprises a watchdog (404.5) which monitors the correct functioning of a time-to-pseudorandom number converter (TPRC) (404.3) and detects and/or signals an error in the event of deviations from an expected behavior.

Feature 7: Quantum process-based generator (28) for true random numbers (411, 418) according to one of features 1 to 6, wherein the quantum process-based generator (28) for true random numbers (411, 418) is manufactured in one piece as part of an integrated circuit (2) and wherein the integrated circuit (2) comprises a voltage converter (91) for supplying the entropy source (401) of the quantum process-based generator (28) for true random numbers (411, 418) and wherein the voltage converter (91) comprises one or more DMOS transistors.

Feature 8: Quantum process-based generator (28) for true random numbers (411, 418) according to feature 7, wherein the integrated circuit (2) is manufactured using a BCD technology. Feature 9: Quantum process-based generator (28) for true random numbers (411, 418) according to one of features 1 to 8, wherein the quantum process-based generator (28) for true random numbers (411, 418) is manufactured in one piece as part of an integrated circuit (2) and wherein the integrated circuit (2) is one of the following circuits or comprises one of the following circuits:

A microcontroller, a microprocessor, a memory, a DRAM, an SRAM, a RAM, a volatile memory, an OTP memory,

- an EEPROM, a flash memory, an MRAM, an FRAM, a sensor evaluation circuit, a control circuit for an automotive control circuit, a graphics controller, an evaluation circuit for a biometric sensor or an input device, a control circuit, a chip card circuit, an electronic circuit of a mobile phone or a smart phone, a circuit of an access control system, a circuit with a coded recording of operating parameters, a circuit of an access control system, a circuit of an electronic security system, a radio system circuit, a communication circuit, a circuit of an encryption and/or decryption system, a circuit of an individualization system, a circuit of a gaming device, a circuit of a simulation system, a circuit of a computer system, a circuit of a noise source, a circuit with a device for generating and/or using a spreading code.

Feature 10: Quantum process-based generator (28) for true random numbers (411, 418) according to one of features 1 to 9, wherein the entropy source (401) comprises a photon source (54) and wherein the entropy source (401) comprises a photon detector (55) and wherein the photon source (54) emits photons as a quantum signal when supplied with electrical energy and wherein the photon source (54) is optically coupled to the photon detector (55) and wherein the photon detector (55) at least partially receives the quantum signal of the photon source (54) and generates the output signal (405) of the entropy source (401) or a precursor signal thereof.

Feature 11: Secure microcontroller for controlling devices, in particular in automobiles, with a semiconductor crystal and with memory elements and with at least one internal bus (419) and with at least one processor (10-1), in particular an 8/16/32/15-bit microcontroller core, and with one or more data interfaces and with at least one quantum process-based generator (28) for true random numbers (411, 418) (English: Quantum Random Number Generator: QRNG) according to one of features 1 to 9, and wherein the memory elements are connected to the internal bus (419) and wherein the data interface is connected to the internal bus (419) and wherein in particular the quantum process-based generator for true random numbers (QRNG) (28) can be connected to the internal bus (419) and wherein the processor (10-1) is connected to the internal bus (419) and wherein the quantum process-based generator for true random numbers (QRNG) (28), in particular upon request of the Processor (10-1), generates or provides a random number (418) and wherein the processor (10-1) generates a key with the aid of a program from one or more of its memory elements and with the aid of the random number, and wherein the processor (10-1) encrypts and decrypts data with the aid of a program from one or more of its memory elements and with the aid of the key, which data it exchanges with devices outside the secure microcontroller via the data interface, and wherein the semiconductor crystal integrally comprises these sub-devices of the secure microcontroller, wherein these sub-devices of the secure microcontroller comprise the memory elements, the internal bus (419), the at least one processor (10-1), the data interfaces and the quantum process-based generator for true random numbers (English: Quantum Random Number Generator: QRNG) (28),

Feature 12: Secure microcontroller according to feature 11, wherein the memory elements comprise one or more read/write memories RAM and/or one or more writable non-volatile memories, in particular EEPROM memories and/or flash memories and/or OTP memories, and/or one or more read-only memories and/or one or more non-volatile manufacturer memories, in particular one or more manufacturer ROMs and/or one or more manufacturer EEPROMs and/or one or more manufacturer flash memories.

Feature 13: A secure microcontroller as defined in feature 12, wherein the manufacturer ROM includes the boot software.

Feature 14: Secure microcontroller according to feature 12 or 13, wherein a manufacturer memory firewall is provided between the manufacturer memory and the internal bus (419).

Feature 15: Secure microcontroller according to one or more of features 11 to 14 with one or more of the following components: a clock generator (92) (inter alia for the system clock 2106), a reset circuit (83) and/or one or more voltage converters (91) which provide the operating voltages, and/or a ground circuit in the negative supply voltage line (GND), in particular for defence against attacks via ground offset, and/or an input/output circuit and/or one or more processing modules, wherein the processing modules are configured to communicate with the internal bus (419), and wherein the processing modules comprise one or more of the following modules: a CRC module (Cyclic Redundancy Check), a clock generator module, with a DES accelerator and/or an AES accelerator, one or more timer modules, a security monitoring and control circuit, a data interface, in particular a Universal Asynchronous Receiver Transmitter (UART).

Feature 16: Secure microcontroller according to one or more of features 11 to 15, with at least one photon source (54), in particular a silicon LED (54) or a first SPAD diode (54), and with at least one photon detector (54), in particular a second SPAD diode (55), and with at least one processing circuit and with at least one operating circuit, wherein the quantum process-based generator for true random numbers (QRNG) (28) comprises at least the photon source (54) as a light source for the optical quantum signal and wherein the quantum process-based generator for true random numbers (QRNG) (28) comprises at least the photon detector (55) as a photodetector for the optical quantum signal and wherein the quantum process-based generator for true random numbers (QRNG) (28) comprises at least the processing circuit and wherein the at least one photon source (54) is optically coupled to the at least one photon detector (55) and wherein the operating circuit the photon source (54) is supplied with electrical energy such that the photon source (54) emits light and wherein the processing circuit detects the signal from the photon detector (55) and forms the random number therefrom and makes it available to the processor (10-1).

Feature 17: Secure microcontroller 11 according to feature 16, with at least one optical fiber (44), wherein the quantum process-based true random number generator (Q.RNG) (28) comprises at least the optical waveguide (44), and wherein the at least one optical waveguide (44) optically couples the at least one photon source (54) to the at least one photon detector (55).

Feature 18: Secure microcontroller according to feature 17, wherein the semiconductor crystal has a surface (56) and wherein the semiconductor crystal has a semiconducting material below its surface (56), and wherein the surface (56) of the semiconductor crystal has a metallization stack, and wherein the metallization stack has a typically structured and optically transparent and electrically insulating layer (44), and wherein at least a part of this typically structured, transparent and electrically insulating layer (44) of the surface (56) forms the optical waveguide (44), and wherein the photon source (54) from the semiconducting material of the semiconductor substrate radiates into this optical waveguide (44), and wherein the optical waveguide (44) radiates the photon detector (54) such that the light from within the optical waveguide (44) penetrates back into the semiconducting material of the semiconductor substrate from the surface and hits device parts of the photon detector (55).

Feature 19: Secure microcontroller according to feature 17 and/or 18, wherein the at least one operating circuit supplies the at least one photon source (54) at least temporarily with electrical energy and wherein the at least one photon source (54) feeds photons into the at least one optical waveguide (44) when supplied with sufficient electrical energy and wherein the at least one optical waveguide (44) radiates such photons into the photon detector (55).

Feature 20: Secure microcontroller according to one or more of the preceding features 11 to 19, wherein a data interface of the one or more data interfaces is a wired automotive data bus interface and wherein the wired automotive data bus interface in particular a CAN data bus interface and/or a CAN-FD data bus interface and/or a Flexray data bus interface and/or a PSI5 data bus interface and/or a DSI3 data bus interface and/or a LIN data bus interface and/or an Ethernet data bus interface and/or a LIN data bus interface and/or a MELIBUS data bus interface

Feature 21: Secure microcontroller according to one or more of the preceding features 11 to 20, wherein a data interface of the one or more data interfaces is a wireless data bus interface and wherein the wireless data bus interface in particular comprises a WLAN interface and/or a Bluetooth interface.

Feature 22: Secure microcontroller according to one or more of the preceding features 11 to 21, wherein a data interface of the one or more data interfaces is a wired data bus interface and wherein the wireless data bus interface is in particular a KNX data bus interface and/or an EIB data bus interface and/or a DALI data bus interface and/or a PROFIBUS data bus interface.

Feature 23: A device, the device comprising an integrated circuit (4) with a first processor (10-1) and a non-volatile memory (16), and the device comprising a first memory, the non-volatile memory storing at least one security code; the first memory storing data and wherein the data in the first memory is cryptographically protected in a first format and wherein the integrated circuit is configured to validate the data read from the first memory during a transfer of data from the first memory and, wherein the device comprises a quantum random number generator (28) according to one of features 1 to 9 and wherein the integrated circuit and the quantum random number generator (28) are manufactured in a semiconductor crystal and wherein the semiconductor crystal has a surface (56) and wherein the semiconductor crystal has a semiconducting material below its surface (56) and wherein the surface (56) of the semiconductor crystal has a metallization stack and wherein the metallization stack has a typically structured and optically transparent and electrically insulating layer (44) and wherein at least a part of this typically structured, transparent and electrically insulating layer (44) of the surface (56) forms the optical waveguide 44 and wherein the first SPAD diode (54) emits photons (57) from the semiconducting material of the semiconductor substrate into this optical waveguide (44) and wherein the at least one optical waveguide (44) transports such photons (58) to the second SPAD diode (55) and wherein the optical waveguide (44) irradiates the second SPAD diode (55) such that the light (59) from within the optical waveguide (44) penetrates back into the semiconducting material of the semiconductor substrate from the surface (56) and there strikes device parts of the second SPAD diode (55) and wherein the first SPAD diode (54) and the second SPAD diode (55) and the optical waveguide (44) are part of the quantum random number generator (28).

Feature 24: Device according to feature 23, wherein the device has at least one operating circuit and wherein the at least one operating circuit supplies the at least one first SPAD diode (54) at least temporarily with electrical energy and wherein the at least one first SPAD diode (54) feeds photons (57) into the at least one optical waveguide (44) when supplied with sufficient electrical energy and wherein the at least one optical waveguide (44) transports such photons (58) to the second SPAD diode (55) and wherein the at least one optical waveguide (44) radiates such photons (59) into the second SPAD diode (55).

Feature 25: Device according to feature 24, wherein the quantum random number generator (28) comprises at least the first SPAD diode (54) as a light source for the optical quantum signal and wherein the quantum random number generator (28) comprises at least the second SPAD diode (55) as a photodetector for the optical quantum signal and wherein the quantum random number generator (28) comprises at least one processing circuit and wherein the quantum random number generator (28) comprises at least the optical waveguide (44) and wherein the at least one optical waveguide (44) optically couples the at least one first SPAD diode (54) to the at least one second SPAD diode (55) and wherein the operating circuit supplies the first SPAD diode (54) with electrical energy such that the first SPAD diode emits light (54) and wherein the processing circuit detects the signal of the second SPAD diode (55) and forms the random number therefrom and supplies it to the processor (10) or another part of the device.

Feature 26: Device according to one of features 23 to 24, wherein the first memory is located inside or outside the integrated circuit and wherein the device has a second memory for storing data and wherein the second memory is located inside or outside the integrated circuit; wherein the device is arranged to transfer data from the first memory to the second memory via the integrated circuit so that the processor can access it from the second memory, and wherein the integrated circuit is arranged to during a transfer of data from the first memory to the second memory, to validate the data read from the first memory using a security code stored in the non-volatile memory and, if the data is validated, to apply cryptographic protection in a second format to the validated data using a security code stored in the non-volatile memory, and to store the data protected in the second format in the second memory.

Feature 27: Device according to one of features 23 to 26, wherein the first memory comprises a read-only memory.

Feature 28: Apparatus according to any one of features 26 to 27, wherein the second memory comprises a random access memory.

Feature 29: Apparatus according to any one of features 26 to 28, wherein the cryptographic protection applied to the data in the first memory is different from the cryptographic protection applied to the data in the second memory.

Feature 30: Apparatus according to any one of features 23 to 29, wherein the integrated circuit includes a memory for storing data to be processed by the processor, and wherein the device is arranged to store some data of the validated data set in the memory and the remainder in the second memory.

Feature 31: Apparatus according to any one of features 26 to 30, wherein the first memory stores data in a first data format and the second memory is arranged to store data in a second, different data format. Feature 32: The apparatus of feature 31, wherein the data stored in the first memory is protected by a first authentication technique, and wherein the apparatus is configured to protect the data in the second memory by a second, different authentication technique.

Feature 33: Apparatus according to any one of features 26 to 32, wherein the data is stored in the first memory in at least one data set and the or each data set is cryptographically protected as a set, and wherein the apparatus is arranged to store in the second memory words or groups of words of a validated data set, each word or group of words being separately cryptographically protected.

Feature 34: Apparatus according to feature 33, arranged to read the words or groups of words from the second memory, to validate the read words or groups of words using a security code stored in the non-volatile memory, and to process the read and validated words or groups of words in the processor.

Feature 35: Apparatus according to feature 34, wherein the integrated circuit comprises a hash calculator, and wherein the processor and the hash calculator (hash engine) are arranged to: a) calculate a hash function for each word or group of words in dependence on a security code stored in the non-volatile memory and store the hash in association with the word or group in the second memory, b) retrieve a stored word or group from the second memory, recalculate a hash function for the retrieved word or group using the security code and compare the newly calculated hash with the stored hash, and (c) only allow the data processing system to process the retrieved word or group if the newly calculated and stored hashes are in a certain relationship to each other.

Feature 36: The apparatus of feature 35, wherein the hash calculator is a circuit in the integrated circuit.

Feature 37 The device of any one of features 23 to 36, wherein the non-volatile memory of the integrated circuit is a one-time programmable memory.

Feature 38 Apparatus according to any one of features 23 to 37, wherein the or each data set stored in the first memory is cryptographically protected by a corresponding digital signature.

Feature 39: Device according to one of features 23 to 38, wherein the or each data set stored in the first memory is cryptographically protected by a corresponding digital signature with the aid of at least one random number of the quantum random number generator.

Feature 40: Device according to feature 38 or 39, wherein a security code is stored in the non-volatile memory of the integrated circuit, which the device has generated at least partially by means of at least one random number of the quantum random number generator (28).

Feature 41: Device according to one of features 38 to 39, wherein the device is arranged to validate a digital signature of the data set by reference to or by reference to the security code stored in the non-volatile memory of the integrated circuit.

Feature 42: A data processing device, wherein the data processing device comprises an integrated circuit, and wherein the integrated circuit comprises a processor, and wherein the integrated circuit comprises a non-volatile memory, and wherein the non-volatile memory stores at least one security code, and wherein the integrated circuit comprises a hash calculator, and wherein the integrated circuit comprises an interface at the boundary of the integrated circuit, and wherein the integrated circuit comprises a quantum random number generator according to one of features 1 to 9, and wherein the integrated circuit and the quantum random number generator are manufactured in a semiconductor crystal, and wherein the semiconductor crystal comprises a surface (56), and wherein the semiconductor crystal comprises a semiconducting material beneath its surface (56), and wherein the surface (56) of the semiconductor crystal comprises a metallization stack, and wherein the metallization stack comprises a typically structured and optically transparent and electrically insulating layer (44), and wherein at least a portion of this typically structured, transparent and electrically insulating layer (44) of the surface (46) forms the optical waveguide (44), and wherein the first SPAD diode (54) is made of the semiconductive material of the semiconductor substrate radiates photons (57) into this optical waveguide (44), and wherein the at least one optical waveguide (44) transports such photons (58) to the second SPAD diode 55, and wherein the optical waveguide (44) irradiates the second SPAD diode (55) such that the light (59) from within the optical waveguide (44) penetrates back into the semiconductive material of the semiconductor substrate from the surface (56) and there strikes device parts of the second SPAD diode (55), and wherein the first SPAD diode (54) and the second SPAD diode (55) and the optical waveguide (44) are part of the quantum random number generator (28).

Feature 43: Data processing device according to claim 42, wherein the processor and/or another device part of the data processing device encrypts or decrypts data with the aid of at least one random number of the quantum random number generator.

Feature 44: A data processing device according to feature 42 or 43, wherein the data processing device comprises a memory, and wherein the memory is for storing data when used by the processor, and; wherein the memory is coupled to the processor to receive words from the processor and to provide words to the processor.

Feature 45: A data processing device according to any one of features 42 to 44, wherein the memory is external to the integrated circuit, and wherein the memory is coupled to the processor via the interface at the boundary of the integrated circuit for receiving words from the processor and providing words to the processor.

Feature 46 A data processing apparatus according to any one of claims 42 to 45, wherein the processor and the hash calculator are arranged to: a) calculate a hash function for each word in dependence on a security code stored in the non-volatile memory and store the hash in association with the word, b) retrieve stored words from the memory, recalculate a hash function for each retrieved word using the security code and compare the newly calculated hash value with the stored hash value, and c) permit processing of the retrieved word by the data processing system only if the newly calculated and stored hashes have a predetermined relationship.

Feature 47: A device comprising: an integrated circuit including a data processing means and a non-volatile storage means storing at least one security code; a first means storing data, the data being cryptographically protected in a first format by at least one authentication code; and a quantum random number generator (28) according to one of features 1 to 9 as part of the integrated circuit, wherein the quantum random number generator comprises a photon source (54) and a photon detector (55) which are or can be coupled to one another, in particular via an optical waveguide (44) which is manufactured in particular outside the semiconductor substrate of the integrated circuit on the surface of the integrated circuit, and wherein the device uses at least one random number of the quantum random number generator (28) for encrypting or decrypting a date or the authentication code, at least temporarily.

Feature 48 A device according to feature 47, wherein the device comprises a second device, in particular external to the integrated circuit, for storing data, and wherein the device comprises means for transferring data from the first memory via the integrated circuit to the second memory so that the processor can access it from the second memory, and wherein the device comprises means for validating the data read from the first memory during transfer using a security code stored in the non-volatile memory, and wherein the device comprises means for applying cryptographic protection comprising at least one authentication code to the validated data in a second format using a security code stored in the non-volatile memory when the data is validated, and wherein the device comprises means for storing the protected data in the second memory in the second format.

Feature 49: Device, in particular according to one of features 23 to 48, wherein the device comprises a quantum random number generator (28) according to one of features 1 to 9 and wherein the quantum random number generator comprises the following device parts: a photon source (54) a photon detector (55), wherein the photon detector (55) is optically coupled to the photon source (55), an optional optical waveguide (44) for this optical coupling, an optional amplifier (404) and/or filter, an analog-to-digital converter (403), an optional comparator (404.2), a time-to-pseudo-random number converter (404.3), an entropy extraction device (404.4) which converts output values of the time-to-pseudo-random number converter (403) into first and second values and generates quantum random bits 411 therefrom.

Feature 50: Device according to feature 49, wherein the device comprises a watchdog (404.5) which monitors device parts of the quantum random number generator (28).

Feature 51: Device according to one of features 49 to 50, wherein the device comprises a voltage monitor (413) which detects and monitors analog values of analog signals of the quantum random number generator (28) and/or for the operation of the quantum random number generator (28).

Feature 52: Device according to one of features 49 to 51, wherein the device comprises a further pseudorandom number generator (404.6), in particular in the form of a linear feedback shift register (404.6).

Feature 53: Device according to one of features 49 to 52, wherein the device comprises a signal multiplexer (404.7) which, in the event of an error, switches from the signal of the output (411) of the entropy extraction device to a signal of a replacement random number generator or a replacement pseudorandom number generator (404.6).

Feature 54: Device according to one of features 49 to 53, wherein the starting value of the additional pseudorandom number generator 404.6 in the event of an error depends on previously correctly generated quantum random bits 411 of the quantum random number generator (28).

Feature 55: Method for generating a random bit

Generating a pulse sequence with random intervals by means of a photon source (54), in particular a silicon LED (54) and/or in particular a first SPAD diode (54), and a photon detector (55), in particular a second SPAD diode (55),

Generating (501) a first value in the form of a first pseudorandom number depending on the time interval between a first pulse and a second pulse which is different from the first pulse; Generating (501) a second value in the form of a second pseudorandom number depending on the time interval between a third pulse, which is different from the first pulse, and a fourth pulse, which is different from the first pulse and the second pulse and the third pulse.

Comparing (502) the first value with the second value and

Outputting (503) a first logical value as a quantum random bit (411) if the first value is greater than the second value, and

Outputting (503) a second logical value, different from the first logical value, as the random bit if the first value is less than the second value.

Feature 56: Method (3700) for generating a quantum random number QZ (418) with m quantum random bits (411) with the steps;

Generation (3710) of a random single photon stream 57, 58, 59, 44 from single photons by means of one or more photon sources, in particular one or more silicon LEDs (54) and/or one or more first SPAD diodes (54);

Transmission (3720) of the random single photon stream (57, 58, 59, 44), in particular by means of an optical waveguide 44 different from the semiconductor substrate (49, 48) and/or the semiconductor substrate or by direct transmission, to one or more photon detectors (55), in particular one or more second SPAD diodes (55);

Converting (3730) the random single photon stream (57, 58, 59, 44) into a detection signal by means of the one or more photon detectors (55);

conditioning (3740) the detection signal into a conditioned detection signal;

Determining (3760) a first pseudorandom number as a function of a first time interval between a first pulse and a second pulse of a first pair of two successive pulses of the processed detection signal produced by coupling the emissions of the photon source (54) and the photon detector (55) and

Determining (3765) a second pseudorandom number as a function of a second time interval between a third pulse and a fourth pulse of a second pair of two successive pulses of the conditioned detection signal produced by coupling the emissions of the photon source (54) and the photon detector (55);

Determining (3770) the bit value of a quantum random bit (411) by comparing the value of the first pseudorandom number and the value of the second pseudorandom number; If the number (3780) n of the random bits determined is less than the desired number m of the random bits of the quantum random number QZ (418) to be generated, repeating the above steps (3710 to 3770) and ending the process for generating a quantum random number if the number (3780) n of the random bits determined is greater than or equal to the desired number m of the random bits of the quantum random number to be generated

(418) QZ is.

Advantage

The monolithically integrable quantum random number generator 28 presented here is particularly robust against external attacks. Even in the event of a successful attack on the entropy source 401, the quantum random numbers 411 are not influenced in such a way that the attacker can break an encryption without considerable additional effort. The secure microcontroller presented here therefore has an improved entropy of its random number generator. As a result, the encryption of this secure microcontroller is post quantum secure, in contrast to the state of the art. The advantages are not limited to this, however.

List of characters

The above objects and the advantages described below will be highlighted in the description of a preferred embodiment of the invention, presented as a non-limiting example with reference to the accompanying drawings, in which:

Figure 1 shows a schematic block diagram of a data processing device in combination with a controlled system;

Figure 2 shows a schematic block diagram of a circuit for deactivating a test interface of the device of Figure 1;

Figure 3 shows a diagram illustrating the verification of digital signatures;

Figure 4 is a flow chart illustrating the use of HASH functions in storing and retrieving data from a DRAM of the device of FIG. 1.

Figure 5 shows a proposed SPAD diode in cross section.

Figure 6 shows the combination of two proposed SPAD diodes in cross section.

Figure 7 shows the combination of two proposed SPAD diodes in cross section, with several insulation layers now forming the optical waveguide 44.

Figure 8 shows the integration of the SPAD diodes and the optical fiber into an evaluation and operating circuit

Figure 9 corresponds to Figure 8, which is now supplemented by monitoring circuits.

Figure 10 shows a typical output signal of the second SPAD diode. Figure 11 shows an exemplary oscillogram of the voltage signal 404 of the entropy source 401.

Figure 12 shows the schematic flow of a server-client communication using a proposed quantum random number generator.

Figure 13 shows the schematic flow of the functions KeyExchangeServer() and KeyExchangeClient().

Figure 14 shows a schematic flow of the setPrimes() function.

Figure 15 shows the schematic flow of the function setE() 3400.

Figure 16 shows the schematic flow of the findD() function.

Figure 17 shows the schematic sequence of a secure transmission of quantum-based random numbers between a first processor 10-1 of the computer, in particular in the form of a proposed integrated circuit 2, a server 3600 and a first processor 10-1 of the computer, in particular in the form of another proposed integrated circuit 2, a client 3610.

Figure 18 shows schematically the proposed method 3700 for generating a quantum random number.

Figure 19 shows another exemplary proposal for a one-piece, monolithic integrated circuit 2.

Figure 20 shows a device similar to the device of Figures 8 and 9.

Figure 21 shows an example of a time-to-pseudo-random number converter 404.3. Figure 22 shows a diagram illustrating the detection of the pulses (2201, 2202, 2203, 2204) on the voltage signal 405 of the entropy source 401.

Figure 23 shows an exemplary voltage converter 91 for supplying the entropy source 411 with a sufficient operating voltage of the supply voltage line VENT of the entropy source 411 relative to the reference potential line GND at the reference potential.

Figure 24 shows an example of a rough layout of an imaginary integrated circuit 2, for example a microcontroller, with a proposed quantum random number generator 28 in plan view to illustrate the placement of a quantum random number generator 28 in whole or in part in the pad frame 2403 or a proposed entropy source 401 in the pad frame 2403.

###########

Figure 25 shows a schematic representation of a first embodiment of a quantum random number generator according to the prior art in plan view;

Figure 26 shows a schematic representation of a second embodiment of a horizontal entropy source 401 according to the prior art in a side view;

Figure I shows a schematic representation of a BCD substrate provided by a method for providing deep p-n junctions in a BCD process and a TCAD representation of the resulting dopant distribution;

Figure 28 shows a schematic representation of an exemplary first embodiment of an entropy source 401 according to the invention;

Figure 29 shows a schematic representation of an exemplary second embodiment of an entropy source 401 according to the invention; Figure 30 shows a schematic representation of an exemplary third embodiment of an entropy source 401 according to the invention;

Figure 31 shows a graphical representation of the dependence of the SPAD current (A) on the Zener reverse voltage (V) at different SPAD reverse voltages (less than, equal to, greater than the breakdown voltage VBD) within an entropy source 401 according to the invention.

Figure 32 shows a graphical representation of the dependence of the ratio between

SPAD current and Zener current as a function of the Zener reverse voltage (V) at different SPAD reverse voltages (less than, equal to, greater than the breakdown voltage VBD) within an entropy source 401 according to the invention.

Description of the characters

The figures show, by way of example and in simplified form, essential parts of the proposed devices and methods. For purposes of illustration, specific examples constructed in accordance with the teachings of this disclosure will now be described with reference to the accompanying drawings in which:

Detailed embodiments will now be described, which are shown by way of example in the accompanying drawings. The effects and features of these embodiments will be described with reference to the accompanying drawings. In the drawings, like reference numerals designate like elements, and redundant descriptions are omitted. The present disclosure may be embodied in various forms and should not be construed as limited only to the embodiments shown herein. Rather, these embodiments are examples so that this disclosure will be thorough and complete, and will fully convey the aspects and features of the present disclosure to those skilled in the art. Therefore, methods, elements, and techniques that are not necessary for those skilled in the art to fully understand the aspects and features of the present disclosure may not be described. In the drawings, the relative sizes of elements, layers, and regions may be exaggerated for clarity.

As used herein, the term "and/or" includes any combination of one or more of the listed elements. Furthermore, the use of "may" in describing embodiments of the present disclosure refers to "one or more embodiments of the present disclosure." In the following description of embodiments, the terms in the singular may also include the plural, unless the context clearly indicates otherwise.

Although the terms "first" and "second" are used to describe various elements, these elements should not be limited by these terms. These terms are used only to distinguish one element from another element. For example, a first element may be referred to as a second element, and similarly a second element may be referred to as a first element, without departing from the scope of the present disclosure. Terms such as "at least one of," when preceded by a list of elements, modify the entire list, not just the individual elements of the list.

Terms such as "substantially", "approximately" and similar terms are used as terms of approximation rather than degrees and are intended to take into account the inherent variations in measured or calculated values that will be recognized by those skilled in the art. When the term "substantially" is used in connection with a characteristic expressed by a numerical value, the term "substantially" means a range of at least +/- 5% of the value centered on the value.

DETAILED DESCRIPTION OF EMBODIMENTS OF THE INVENTION

In this example, the data processing device is a computer in the form of a monolithic, micro-integrated circuit 2, for example the microcontroller, for controlling a controlled system 26.

The following description first describes the configuration of an exemplary microcontroller as an example of a monolithic microintegrated circuit 2 with a proposed quantum random number generator 28 and the exemplary contents of its various memories as it would be used after manufacture.

The computer in the form of the monolithic, micro-integrated circuit 2, for example the microcontroller, is connected to a controlled system 26 via a connection 3. The controlled system can be, for example, a backup tape drive. In a backup tape drive, it is important that the integrity of the backed up data is maintained. It is therefore important that the integrity of the data and programs used by the computer in the form of the monolithic, micro-integrated circuit 2, for example the microcontroller, is maintained.

Figure 1

The computer in the form of the monolithic, microintegrated circuit 2, for example the microcontroller, comprises in the example of Figure 1, for example the monolithic integrated circuit 2 of an exemplary microcontroller, which comprises, for example, a control device 4, a non-volatile memory 6 and a memory with random access 8, hereinafter also referred to as RAM (Random Access Memory). The non-volatile memory 6 can comprise any suitable type, e.g. a flash memory and other types. In this example, it is a read-only memory, e.g. an EEPROM. The microcontroller here is only an exemplary embodiment of a one-piece and monolithic integrated circuit 2 with a monolithic integrated quantum random number generator 28. Other microelectronic integrated circuits 2 are expressly included in the technical teaching of the document presented here. When this document refers to an "integrated circuit 2 of a microcontroller" or an "integrated circuit 2 of the microcontroller", the technically skilled person automatically reads other microelectronic integrated circuits and devices. These microelectronic integrated circuits and devices include In the sense of the document presented here, the following also expressly applies: MEMS (micro-electro-mechanical system), MOEMS (also: MOMS) (micro-optical-electro-mechanical system), optical MEMS, optical microsystems, BioMEMS (stands for the application of MEMS to e.g. cell biology or related areas), micromachines, MEFS (micro-electro-fluidic systems), NEMS (nano-electro-mechanical system), pMEMS (piezo-electric micro-electro-mechanical resonators), RF-MEMS (radio-frequency MEMS).

The document presented here therefore sees the term "microcontroller" used here only as an example. The person skilled in the art immediately reads the use of a quantum random number generator 28 with a time-to-pseudo-random number converter 404.3, as proposed here, in a monolithic co-integration with conventional micro-integrated circuits when reference is made to "integrated circuit 2 of the microcontroller", and expressly does not limit the technical teaching of this document to the co-integration of the proposed quantum random number generator 28 with a microcontroller.

Such other conventional integrated circuits 2 may include, for example:

- Microcontrollers, microprocessors, memories, DRAMs, SRAMs, RAMs, volatile memories, OTP memories, EEPROMs, flash memories, MRAMs, FRAM bus transceivers, sensor evaluation circuits, motor driver circuits, control circuits for automotive control circuits, graphics controllers, communication circuits, evaluation circuits for biometric sensors, evaluation circuits for input devices, control circuits, chip card circuits, circuits for mobile phones or smart phones, circuits for servers. Circuits for personal computers, circuits for laptops, circuits for entry and/or access control systems, circuits for the coded recording of operating parameters, circuits for electronic security devices, radio system circuits, communication circuits, circuits for encryption and/or decryption systems, circuits for individualisation and identification purposes and/or identification systems and/or identification systems, circuits for gaming devices, circuits for simulation systems, circuits for computer systems, circuits for noise and/or signal sources, circuits for modulation systems and/or devices, circuits with a device for generating and/or using spreading codes. The above list is certainly not exhaustive.

The random access memory 8 may be any suitable memory, e.g. an SRAM, but in this case it is a DRAM. The non-volatile memory 6 and the random access memory 8 are located outside the control device 4 in the example of Figure 1. Another Non-volatile memory 30 can optionally be provided within the micro-integrated circuit outside the control device 4 and connected to it via an internal interface 301.

The micro-integrated circuit 2 with the exemplary control device 4 is preferably a monolithic integrated circuit, which comprises, for example, the following: one or more processors 10-1, 10-2; a tightly coupled memory 14, which can be, for example, an SRAM; a non-volatile boot ROM 16, which contains a preferably non-changeable code; a hashing engine 18, for example, present; one or more one-time programmable memories (OTP) 20 and 22; a JTAG test interface 12; an interface 32; internal interfaces 63, 81 and 301, which are coupled to the memories 6, 8 and 30; a quantum random number generator 28, which the document presented here also refers to as QRNG (English abbreviation for Quantum Random Number Generator); and hardwired test disabling circuitry 24. OTP memories 20 and 22 may be separate memories or portions of memory within example integrated circuit 2. In this example, they are portions of a single memory. Test disabling circuitry 24 is preferably located between test port 12, which in this example is a JTAG port, and processor(s) 10. Preferably, disabling circuitry 24 is responsive to data in OTP memory portion 22. Optional hashing engine 18 uses data (one or more keys) in OTP memory portion 20. OTP memory portion 20 preferably stores critical security parameters (CSPs) including a secret key and at least one public key. Additional keys may be stored in OTP memory portion 20. In one embodiment of the proposal of this example application of a quantum random number generator 28, the secret key is preferably unique for each instance of the exemplary microintegrated circuit 2 proposed here.

The processor(s) 10 preferably executes instructions only from the tightly coupled memory 14 and from the DRAM 8 in the example of Figure 1 presented here. The boundary of the control device 4 is a cryptographic virtual boundary, and the data and program execution within this boundary are considered secure in this first proposal for the application of a proposed quantum random number generator 28, as explained below. The EEPROM 6 and the DRAM 8 (and the memory 30, if present) are outside the cryptographic boundary, and without security measures the contents of these memories would not be secure in the sense of the document presented here. The interfaces 12, 63, 301, 32 and 81 are located at the physical and cryptographic boundary of the control device 4 Within the micro-integrated circuit 2. The document presented here thus discloses a micro-integrated circuit 2 having internal interfaces 63, 301, 32 and 81 at a cryptographic boundary between a control device 4 and other parts (8, 30, 6) of the integrated microelectronic circuit 2 that are classified as non-secure or less secure. The essential purpose of these internal interfaces 63, 301, 32 and 81 is thus the secure shielding of an internal control device 4 within the micro-integrated microelectronic circuit 2.

The contents of the DRAM 8 and the EEPROM 6 are preferably cryptographically protected by authentication codes. In this example, the authentication codes used in the DRAM 8 are preferably of a different type than the authentication codes used in the EEPROM 6. In this example, the contents of the EEPROM 6 are protected against undetected malicious modification at least by the use of digital signatures. The format of the data in the EEPROM 6 is also preferably different from that in the DRAM 8.

For example, the EEPROM 6 preferably stores the firmware arranged in one or more data records 61, each with a digital signature 62. The digital signatures used in this example of the proposal use public and private keys. Therefore, the details of the digital signatures are not described further, as they are known to the person skilled in the art. When a processor (10-1, 10-2) reads a data record from the EEPROM 6, the processor 10 checks its digital signature. If the digital signature is valid, the data record is processed by the processor(s) 10 using computer-implemented methods of the firmware. The processor(s) 10 thus preferably only executes validly signed firmware. For signing, the processors 10 preferably use keys and authentication codes that depend on quantum random numbers 418 of one or more quantum random number generators 28.

As shown in Figure 1, in one example, the boot ROM 16 contains code that the processor 10 uses to read a loader program S2 from the EEPROM 6 to read further records from the EEPROM 6. Logic in the processor 10 loads a program counter (not shown) in the processor 10 with the start address 15 of the boot ROM 16. The processor 10 then executes the code in the boot ROM 15. This boot ROM 15 code can read a computer-implemented loader program from the EEPROM 6. The boot code in the boot ROM 15 is considered secure because it is within the cryptographic boundary 4. The loader program is protected by a digital signature that the processor 10 verifies when executing the boot ROM code S4 in the boot ROM 15 against the public key stored in the first OTP memory 20. Subsequent records are read using the loader program S6. The loading program in EEPROM 6 and the subsequent data records are each provided with a digital signature and have a or several public keys embedded. When executing the loading code of the loading program in the EEPROM 6 in step S8, the processor 10 checks the signature of the data set newly read from the EEPROM 6 using a public key that is embedded in a data set previously loaded or stored in the OTP memory 20.

A record read from the EEPROM 6 may contain too much firmware code/data for the small, tightly coupled memory TCM 14 of the controller 4 within the microelectronic circuit 2 to store. The TCM 14 preferably stores firmware code/data that is immediately required by the processor(s) 10. The remainder of the firmware record is transferred to the DRAM 8. Since the DRAM 8 lies outside the cryptographic boundary 4, the codes/data stored there are cryptographically protected by authentication codes that the processor 10 has preferably generated using quantum random numbers from the quantum random number generator 28.

Figure 3

As shown in Figure 3, the processor 10 reads the data as a record from the EEPROM 6 and writes it as words into the DRAM 8 or reads these words back from this DRAM 8. In this example, when the processor 10 reads a record from the EEPROM in step S20, the processor 10 validates it as described in Figure 4 and the associated description. The processor 10 stores at least part of the data of the record in the TCM 14 in step S21. The processor 10 processes the remaining data of the record, for example as follows, and stores it in the DRAM 8. The processor(s) 10 cooperates with the optional hash engine 18 to calculate a hash value for each word of the remaining data, for example in step S22, and to store the hash value in the DRAM 8 at a location associated with the stored word in step S24. The word size is chosen according to the system limitations. It can be as small as one byte. In practice, it can be 32 bits. When the processor 10 reads a word from the DRAM 8 in step S26, the processor 10 and the hash engine 18 preferably recalculate the hash value and compare the recalculated hash value with the corresponding hash value stored in the DRAM 8 in step S30. If the hash values have a predetermined relationship, which is checked in step S34, e.g. are equal, the processor 10 processes the read data in a step S38. If the hash values do not have the predetermined relationship, the processor 10 interrupts processing in step S36 and/or the processor 10 generates an error message and/or the processor 10 ignores the data/code. Storing words in the DRAM 8 with corresponding authentication codes, which are preferably based on quantum random numbers from the quantum random number generator 28, facilitates random access to the words by the processor(s) 10.

The hash function can be any suitable hash function. An example is the well-known HMAC function. In this example, the HASH function uses the secret key stored in the OTP memory 20. It could also use another key stored in the OTP memory. Preferably, the secret key is based on a quantum random number from the quantum random number generator 28. An example of the hash value is HMAC (address | | data | | secret key), where the character string " | | " here stands for the concatenation. Taking into account the number of bytes that the DRAM 8 can store, the HASH value preferably comprises at least enough bits to avoid or at least reduce duplication of HASH values in the DRAM 8. The number of bits of the HASH value is preferably at least 96 bits and can also be significantly larger. The industry standard is 160 bits, which reduces the probability of duplication of HASH values to a sufficiently low level.

By providing the cryptographic boundary 4 and protecting the data stored in the DRAM 8 and EEPROM 6, the integrated circuit 2, in particular that of the microcontroller, is protected against unauthorized access to the programs and data used by the processor(s) 10 of the computer in normal operation. This is of particular importance in the automotive field to prevent plagiarism and unauthorized spare parts, which usually require knowledge of the firmware of the illegally copied spare parts. The JTAG test interface 12 could, however, allow access to the processor(s) 10 in a test mode with known EMULATE and TRACE routines and still allow illegal program modifications. The JTAG test port 12 is required for testing at least during the manufacturing process of the integrated circuit 2, for example that of a microcontroller, and can be used for fault diagnosis after manufacturing. Such an analysis capability of an automotive integrated circuit 2, for example an automotive microcontroller, is an indispensable prerequisite for meeting the quality requirements of T16491.

In order to prevent unauthorized and in particular illegal use of the JTAG interface 12, the OTP memory 22 can, for example, comprise at least one security bit which, together with the blocking circuit 24, blocks the JTAG interface 12.

In an example, the OTP memory 22 contains only one bit. The OTP memory 22 allows a bit to be changed only once from one state, e.g. "0", to the opposite state "1". During the During manufacture of the integrated circuit 2, e.g. the microcontroller, the bit is e.g. "0", which enables testing. In a final test step, the manufacturer of the exemplary integrated circuit 2, e.g. the microcontroller, sets the bit to "1" before releasing the integrated circuit 2, e.g. the microcontroller, for delivery and use. The JTAG port 12 typically has a serial input and a serial output (see Figure 2). The deactivation circuit, which is part of the circuit of the control device 4 within the integrated circuit 2, e.g. the microcontroller, preferably comprises a gate 241, e.g. located between the serial output of the JTAG interface 10 and the processor(s) 10, and a gate 242, e.g. located between the serial input of the JTAG interface 10 and the processor(s) 10. The security bit "1" in the OTP memory 22 deactivates the gates 241 and 242. Since the security bit cannot be changed, the test port is then secured against use after the manufacture and delivery of the integrated circuit 2, for example the microcontroller.

In another example, the OTP memory 22 has a two-bit security code, which is initially "00". This allows a check during manufacture, after which the code is set to "01", i.e. one of the two bits is set to "1". This code "01" locks the gates 241 and 242. If an error occurs, the integrated circuit 2, for example of the microcontroller, is returned to its manufacturer, who sets the other bit to "1", resulting in the code "11", which allows a check via the terminal 12. Such a check is preferably destructive, since it does not allow a reset to the original value. Access to the OTP memory 22 to change the security code can be made by a suitable access code, preferably generated by means of a quantum random number generator 28, which is provided with a digital signature that can be verified by a quantum random number-based key stored in the OTP memory 20. The key may, for example, be the standard public key stored in memory 20. This allows the security code to be changed to "11", which enables verification via JTAG interface 12. The original integrated circuit 2, for example the microcontroller, is preferably retained by the manufacturer and preferably destroyed and the user receives a new integrated circuit 2, for example a microcontroller.

In another example, the security code may consist of three or more bits that change when the signed access code is used. When manufactured, the code is "000" and when released to a user, it is "001". If an error occurs, the code is changed by the manufacturer to "011" to allow testing. After testing, the code is changed to "111", thereby securing the JTAG interface 12 against use and the integrated circuit 2, for example, the microcontroller, to which the user can be returned. Only a signed access code provided with a digital signature verified by a key in the OTP memory 20 can be used to change the code stored in the OTP memory 22.

Security codes of two or more bits provide an audit trail for testing (or any unauthorized testing attempts) after manufacturing.

Additional interface and additional EEPROM

As shown in Figure 1, the control device 4 of the integrated circuit 2, for example the microcontroller, can optionally have at least one further interface 32 in addition to the connections 3 and 12. This further interface 32 can be, for example, an Ethernet connection or a Fibre Channel connection or an automotive data bus connection for data buses such as CAN, LIN, DSI3 or PSI5. A Fibre Channel connection in the sense of the document presented here is a data connection that uses an optical fiber or another waveguide for electromagnetic radiation.

The integrated circuit 2, for example the microcontroller, can additionally have a further non-volatile memory 30 outside the control device 4 of the integrated circuit 2, for example a microcontroller, which stores data that is cryptographically protected by a security parameter stored in the OTP memory 20. The further non-volatile memory 30 is coupled to the control device 4 via the internal interface 301 of the integrated circuit 2, for example the microcontroller.

The further non-volatile memory 30 can be an EEPROM, for example. The further memory 30 can store further critical security parameters outside the control device 4. The further parameters are preferably encrypted and provided with digital signatures to make them secure. The further parameters are preferably encrypted with the secret key that is only valid for the control device 4 and is stored in the OTP memory 20. Preferably, the secret key is based on a quantum random number from a quantum random number generator 28. The digital signatures of the further parameters are created using the unique secret key stored in the OTP memory 20. This secret key is used to decrypt the further security parameters and to verify the digital signatures read from the further memory 30.

The additional non-volatile memory 30 may contain other encrypted and/or digitally signed data. The additional security parameters outside the control device 4 of the integrated circuit 2, for example the microcontroller, can be used to secure the data and codes transmitted via the interface(s) 32.

Manufacturing of the integrated circuit 2, for example the microcontroller.

During manufacture of the integrated circuit 2, e.g. the microcontroller, the boot code is preferably hard-coded in the boot ROM 16; the loader and other codes/data are stored in the EEPROM 6 with digital signatures based on the public and private keys, preferably generated using quantum random numbers of a quantum random number generator 28; and preferably at least one public key is generated using a quantum random number of a quantum random number generator and stored in the OTP memory 20.

The secret key is preferably only stored in the OTP 20 when the security code, which is preferably based on a quantum random number of a quantum random number generator 28, is set in the OTP 22 and the test port of the exemplary JTAG interface 12 has been blocked. The control device 4 of the integrated circuit 2, for example the microcontroller, contains the necessary quantum random number generator QRNG 28 in the example presented here. The firmware stored in the tightly coupled memory 14 or in the DRAM 8 reads one or more quantum random numbers of e.g. 256 bits from the quantum random number generator 28 and stores them in the OTP 20 as a secret key without this data leaving the control device 4, preferably within the integrated circuit 2, for example the microcontroller. This preferably only happens after the test port 12 has been deactivated in order to prevent access to the secret key even for persons who have access to the manufacturing process. Preferably, the logic gates of the integrated circuit 2, for example the microcontroller, or at least those of the control device 4 of the integrated circuit 2, for example the microcontroller, are designed in such a way that the current peaks that occur when logical states change within the circuits of the logic gates do not allow any conclusions to be drawn about the processes and/or the data and/or the quantum random numbers and/or the circuit states of the device. This avoids so-called side channels. For this purpose, the proposed device can comprise current sources, complementary switching, complementary dummy circuits, energy reserves (e.g. capacitances), etc.

The hash function of the hashing engine 18 may be any suitable hash function and is not limited to the example of HMAC described above. The on-chip quantum random number generator 28 QRNG could be omitted from the integrated circuit 2, for example the microcontroller, and instead an off-chip quantum random number generator QRNG could be used to generate the secret key during the manufacturing process. However, an on-chip quantum random number generator QRNG is significantly more secure.

The firmware stored in the EEPROM 6 is preferably cryptographically protected, in this example by digital signatures. During production, the firmware is first compiled. It is then digitally signed with a secret private key of a private-public key system. Preferably, the secret private key of the private-public key system is based on a quantum random number of a quantum random number generator 28. The public key is preferably stored in the OTP memory 20 so that the signature can be verified. The signed firmware is stored in the EEPROM 6. The digital signatures can be created by transmitting the compiled firmware to a secure signature generator during the production process. The secure signature generator can be the integrated circuit 2, for example of the microcontroller, namely the control device 4 in cooperation with the quantum random number generator 28 itself. The signed firmware can be downloaded into the EEPROM 6 via a communication connection, e.g. the Internet, if the signing is done externally. However, the processor 10 can remove the signature of the firmware before storing it in the EEPROM 6 and replace it with its own quantum random number-based signature based on a quantum random number from its quantum random number generator 28, which then makes it impossible for anyone to read the firmware without exception.

Instead of an EEPROM, the non-volatile memory 6 can be any other suitable memory, for example a FLASH memory.

The additional non-volatile memory 30 may, for example, be a serial EEPROM memory.

The one-time programmable memory OTP 22, which contains the security code, can be replaced with another re-programmable, non-volatile memory and the security code can be changed using signed firmware. However, a memory 22 that can only be programmed once is more secure because its programming is irreversible.

The DRAM 8 can be further protected by making access to the DRAM 8 physically very difficult and detectable in case of an attempt. For example, the connections between the DRAM 8 and the control device 4 can be buried in layers of the metallization stack of the integrated circuit 2, for example the microcontroller, or otherwise protected against physical scanning (eg by e-beam). Preferably, the Device parts of the control device 4 have such a scanning protection. In particular, it is advantageous if the quantum random number generator 28 has such a scanning protection, for example in the form of a metal layer 53, 142 lying at a predefined potential.

The entire integrated circuit 2, for example of the microcontroller, can be provided with such scanning protection, for example in the form of a metal layer 53, 142 lying at a predefined potential. The entire integrated circuit 2, for example of the microcontroller, can also be housed in a tamper-proof housing with tamper-proof seals.

The secure integrated circuit 2, for example of the microcontroller, preferably has at least one photon source 54 or a silicon LED 54 or a first SPAD diode 54 as a photon source for photons of the quantum random number generator 28. The secure integrated circuit 2, for example of the microcontroller, preferably has at least one photon detector 55 or a second SPAD diode 55. An optical system preferably optically couples the at least one photon source 54 or the silicon LED 54 or the first SPAD diode 54 to the photon detector 55 or the second SPAD diode 55 by means of these photons. The optical system can comprise an optical waveguide 44. The quantum random number generator 28 is preferably a quantum process-based generator for true random numbers (QRNG) 28. The quantum process-based generator for true random numbers (QRNG) 28 preferably comprises a photon source 54 or a silicon LED 54 or a first SPAD diode 54 as a light source for an optical quantum signal and a photon detector 55 or a second SPAD diode 55 as a photodetector for this optical quantum signal. Furthermore, the quantum process-based generator for true random numbers (QRNG) 28 preferably comprises at least the processing circuit and optionally the optical fiber 44. The optical fiber 44, which may be present, preferably optically couples the photon source 54 or the silicon LED 54 or the first SPAD diode 54 to the photon detector 55 or a second SPAD diode 55. An operating circuit supplies the photon source 54 or the silicon LED 54 or the first SPAD diode 54 with electrical energy in such a way that the photon source 54 or the silicon LED 54 or the first SPAD diode 54 emit light. The emission of light requires that the operating voltage provides a sufficient electrical bias voltage for the photon source 54 or the silicon LED 54 or the first SPAD diode 54. A processing circuit (402, 403, 404) detects the signal from the photon detector 55 or the second SPAD diode 55 and forms the quantum random number 418 from it. The processing circuit then preferably makes the quantum random number 418 thus formed available to one or more of the one or more processors 10 via a data bus 419. The semiconductor crystal of the integrated circuit 2, for example of the microcontroller, preferably has a surface 56. The semiconductor crystal typically has a semiconducting material below its surface 56. In particular when using conventional semiconductor circuit manufacturing processes, such as CMOS processes, bipolar processes, BiCMOS processes and BCD processes, the surface 56 of the semiconductor crystal typically has a metallization stack as structured metal layers and electrical insulation layers. The structured metal layers typically form the electrically conductive conductor tracks, which are electrically separated from one another by the insulation layers. The metallization stack thus has a typically structured and optically transparent and electrically insulating layer 44. At least part of this typically structured, transparent and electrically insulating layer 44 of the surface 56 preferably forms the optical waveguide 44.

The examples presented here in Figures 6 and 7 use a first SPAD diode 54 as photon source 54. In the examples in Figures 6 and 7, the first SPAD diode 54 radiates light 57 from the semiconducting material of the semiconductor substrate 49 into this optical waveguide 44, for example. This means that the first SPAD diode 54 generally radiates perpendicular to the surface 56, essentially upwards, and not sideways, into the semiconductor substrate 49 of the semiconductor crystal 49. The material of the semiconductor crystal 49 has a high attenuation for this light. Nevertheless, the emission of the photons 57 of the first SPAD diode 54 in the optical waveguide 44 is not directed. In particular, the emission via the substrate 48, 49 is very attenuated, since visible light has a very high absorption. This arrangement allows the device to couple more photons from the first SPAD diode 54 directly to the second SPAD diode 55, which here serves as the photon detector 54 in the examples of Figures 6 and 7. In the examples in Figures 6 and 7, the optical waveguide 44 transports these photons 57, 58, 59 of the first SPAD diode 54 in the optical waveguide 44 to the second SPAD diode 55 with virtually no loss compared to other prior art solutions. In the examples in Figures 6 and 7, the optical waveguide 44 irradiates the second SPAD diode 55 with these photons 57, 58, 59 of the first SPAD diode 54 in such a way that the light 59 penetrates from within the optical waveguide 44 back into the semiconducting material of the semiconductor substrate 49 from the surface 56 and there strikes device parts of the second SPAD diode 55. The second SPAD diode 55 then generates a received signal depending on the irradiation with these photons 59.

Typically, at least one operating circuit in the examples of Figures 6 and 7 supplies the at least one first SPAD diode 54 with electrical energy at least temporarily. The at least one first SPAD diode 54 then feeds Photons 57 into the optical waveguide 44 provided in Figures 6 and 7. The optical waveguide 44 then transports these photons 57, 58, 59 further. The optical waveguide 44 provided in the examples in Figures 6 and 7 then radiates the transported photons 58 as essentially vertically moving photons 59 into the second SPAD diode 55. Since this transport of photons from the first SPAD diode 54 to the second SPAD diode 55 loses significantly fewer photons due to the low attenuation in the optical waveguide 44 than in other prior art designs that use the highly absorbent semiconductor substrate 49, 49, the quantum efficiency is massively higher. This increases the bit rate of the quantum random bits 411 with which the device can generate quantum random numbers 418. Therefore, in the construction presented here, a pair of a single first SPAD diode 54 and a single second SPAD diode 55 is sufficient. Other prior art devices typically use multiple SPAD diodes.

In a further development of the proposed secure integrated circuit 2, for example of the microcontroller, at least one data interface of the one or more data interfaces 64 is a wired automotive data bus interface 64. In this case, the wired automotive data bus interface 64 can be, for example, a CAN data bus interface or a CAN-FD data bus interface or a Flexray data bus interface or a PSI5 data bus interface or a DSI3 data bus interface or a LIN data bus interface or an Ethernet data bus interface or an SPI data bus interface or a MELIBUS data bus interface.

In a further development of the proposed secure integrated circuit 2, for example the microcontroller, at least one data interface 64 of the one or more data interfaces 64 is a wireless data bus interface. The wireless data bus interface 64 can be, for example, a WLAN interface or a Bluetooth interface.

In a further development of the proposed secure integrated circuit 2, for example the microcontroller, at least one data interface 64 of the one or more data interfaces 64 is a wired data bus interface 64. The wireless data bus interface 64 can be, for example, a KNX data bus interface or an EIB data bus interface or a DALI data bus interface or a PROFIBUS data bus interface.

Although the proposed device is described by way of example with reference to a

Control device 4 and the integrated circuit 2, for example the microcontroller, As described above, it is not limited to a control device 4 or the integrated circuit 2, for example the microcontroller. The proposed device can also be applied to other types of integrated circuit processors and other integrated circuits. A microprocessor is only a particularly favorable, because complex, example of a proposed exemplary integrated circuit 2.

The embodiments of the proposed device store data inside and possibly also outside the integrated circuit 2, for example the microcontroller. The embodiments of the proposal ensure that the data to be processed, including the executable code, cannot be changed by unauthorized persons who access the data stored outside the integrated circuit 2, for example the microcontroller, or, if such access occurs, ensure that this access and/or such an attempted access does not go unnoticed and that the data and/or program codes and/or keys and/or authentication data etc. cannot be changed unnoticed. Security is ensured by security data, and the security data itself is secure because it is stored within the integrated circuit 2, for example the microcontroller, in a protected area 4 and protected from unauthorized access.

The description presented herein is not intended to be exhaustive and does not limit this disclosure to the examples shown. Other variations to the disclosed examples can be understood and practiced by those of ordinary skill in the art from the drawings, the disclosure and the claims. The indefinite articles "a" or "an" and their inflections do not exclude a plurality, while the mention of a certain number of elements does not exclude the possibility of more or fewer elements being present. A single unit may perform the functions of several elements mentioned in the disclosure, and conversely, several elements may perform the function of a unit. Numerous alternatives, equivalents, variations and combinations are possible without departing from the scope of the present disclosure.

Unless otherwise stated, all features of the present invention can be freely combined with one another. This applies to the entire document presented here. The features described in the description of the figures can also be freely combined with the other features as features of the invention, unless otherwise stated. A restriction of individual features of the embodiments to the combination with other features of the embodiments is expressly not intended. In addition, material features of the device can also be reformulated and used as process features and Process features reformulated as physical features of the device. Such a reformulation is therefore automatically disclosed.

In the foregoing detailed description, reference is made to the accompanying drawings. The examples in the description and drawings should be considered as illustrative and are not to be considered as limiting the specific example or element described. Multiple examples may be derived from the foregoing description and/or drawings and/or the claims by modifying, combining or varying certain elements. In addition, examples or elements not described verbatim may be derived from the description and/or drawings by a person skilled in the art.

Figure 6

The secure integrated circuit 2, for example of the microcontroller, has, in the example of Figure 6, at least one first SPAD diode 54 and at least one second SPAD diode 55 and at least one optical waveguide 44. The quantum random number generator 28 is preferably a quantum process-based generator for true random numbers (QRNG) 28. The quantum process-based generator for true random numbers (QRNG) 28 in the example of Figure 6 comprises a first SPAD diode 54 as a light source for an optical quantum signal and a second SPAD diode 55 as a photodetector for the optical quantum signal. Furthermore, the quantum process-based generator for true random numbers (QRNG) 28 in the example of Figure 6 comprises at least the processing circuit and the optical waveguide 44. Preferably, the optical waveguide 44 in the example of Figure 6 optically couples the at least one first SPAD diode 54 to the at least one second SPAD diode 55. In the example of Figure 6, an operating circuit supplies the first SPAD diode 54 with electrical energy in such a way that the first SPAD diode 54 emits light 57. In the example of Figure 6, the emission of light 57 requires that the operating voltage provides a sufficient electrical bias voltage for the first SPAD diode 54 (404.1). In the example of Figure 6, a processing circuit (402, 403, 404) detects the signal of the second SPAD diode 55 (404.3) and forms the quantum random number 418 therefrom. The processing circuit then preferably makes the quantum random number 418 thus formed available to one or more of the one or more processors 10 via a data bus 419.

Preferably, the semiconductor crystal 49 of the control device 4 of the integrated circuit 2, for example the microcontroller, has a surface 56. Typically, the semiconductor crystal 49 has a semiconducting material below its surface 56. In particular, when using conventional semiconductor circuit manufacturing processes, such as CMOS processes, In bipolar processes, BiCMOS processes and BCD processes, the surface 56 of the semiconductor crystal 49 typically has a metallization stack as structured metal layers and electrical insulation layers. The structured metal layers typically form the electrically conductive conductor tracks, which are electrically separated from one another by the insulation layers. The metallization stack thus has a typically structured and optically transparent and electrically insulating layer 44. At least part of this typically structured, transparent and electrically insulating layer 44 of the surface 56 preferably forms the optical waveguide 44.

In the example of Figure 6, the first SPAD diode 54 radiates light 57, for example, from the semiconducting material of the semiconductor substrate 49 into this optical waveguide 44. This means that in the example of Figure 6, in contrast to other devices from the prior art, the first SPAD diode 54 radiates perpendicular to the surface 56 essentially upwards and not sideways into the semiconductor substrate 49 of the semiconductor crystal, which has a high attenuation. Nevertheless, the emission of the photons 57 of the first SPAD diode 54 is not directed in the optical waveguide 44. In particular, the emission via the substrate 48, 49 is very attenuated, since visible light has a very high absorption. As a result, the device of Figure 6 can couple more photons of the first SPAD diode 54 directly to the second SPAD diode 55 compared to devices from the prior art. The optical waveguide 44 transports these photons 57, 58, 59 of the first SPAD diode 54 in the example of Figure 6 in the optical waveguide 44 to the second SPAD diode 55 with virtually no loss compared to other devices from the prior art. The optical waveguide 44 irradiates the second SPAD diode 55 with these photons 57, 58, 59 of the first SPAD diode 54 in the example of Figure 6 in such a way that the light 59 penetrates from within the optical waveguide 44 back into the semiconducting material of the semiconductor substrate 49 from the surface 56 and there strikes device parts of the second SPAD diode 55. The second SPAD diode 55 then generates a received signal in the example of Figure 6 depending on the irradiation with these photons 59.

Typically, at least one operating circuit in the example of Figure 6 supplies the at least one first SPAD diode 54 with electrical energy at least temporarily. The at least one first SPAD diode 54 then feeds photons 57 into the at least one optical waveguide 44 in the example of Figure 6 when supplied with sufficient electrical energy. The optical waveguide 44 then transports these photons 57, 58, 59 further in the example of Figure 6. The at least one optical waveguide 44 then radiates the transported photons 58 as essentially vertically moving photons 59 into the second SPAD diode 55 in the example of Figure 6. Since this transport of the photons from the first SPAD diode 54 to the second SPAD diode 55 in the example of Figure 6 is due to the low attenuation in the optical waveguide 44 loses significantly fewer photons than in other prior art designs that use the highly absorbent semiconductor substrate 48, 49, the quantum efficiency is massively higher. This increases the quantum random bit rate that can be generated in a device according to the example in Figure 6, with which the device can in turn generate quantum random numbers. Therefore, in the design presented here in Figure 6, a pair of a single first SPAD diode 54 and a single second SPAD diode 55 is typically sufficient. Prior art devices typically use multiple SPAD diodes.

Figure 7 Figure 7 essentially corresponds to Figure 6. In contrast to Figure 6, the semiconductor crystal 49 and the epitaxial layer 48 are now covered with a first optically transparent insulator layer, for example an oxide layer 143. The vias 140 are filled with electrically conductive metal in the example in Figure 7. The metallization level 1 with the electrical lines of the first wiring level 141 contact these vias 140 in the example in Figure 7. On this first insulation layer 142 and the first metallization layer with the first wiring level 141, a second optically transparent insulation layer 144, preferably also in the form of an oxide layer, is applied in the example in Figure 7. This can also be plated through by vias that are not shown in Figure 7, so that lines of the first metallization level can be connected to lines of the second metallization level in the example in Figure 7. The dashed boundary surface 145 between the first optically transparent insulation layer 143 and the second optically transparent insulation layer 144 is also essentially optically transparent in the example in Figure 7 and preferably does not reflect and/or absorb the light from the first SPAD diode 55. In the example in Figure 7, the first optically transparent insulation layer 143 and the second optically transparent insulation layer 144 essentially form the optical waveguide in the region of the first SPAD diode 54 and the second SPAD diode 55. In the example in Figure 7, there are preferably no vias 140 and no metal lines 141 in the optical path between the first SPAD diode 54 and the second SPAD diode 55, so that the light from the first SPAD diode 54 can reach the second SPAD diode 55 unhindered in the example in Figure 7. A metal cover 142 prevents photons from escaping upwards in the example of Figure 7 and preferably reflects them back into the optical waveguide 44 in the example of Figure 7. The vias 140 and the metal lines of the first metallization level 141 similarly prevent light from the optical waveguide 44 from being lost horizontally in the metallization stack in the example of Figure 7. Figure 8

Figure 8 shows a schematic simplified block diagram of a quantum-based random number generator

(Quantum Random Number Generator 28) as proposed in this document.

A preferably common system clock 2106 preferably clocks the digital circuits of the device shown by way of example in Figure 8. The quantum random number generator 28 of Figure 8 is preferably part of the control device 4 and thus of the integrated circuit 2, for example the microcontroller. The structure of the quantum random number generator 28 includes an entropy source 401, in the example of Figure 8 a broadband 40 dB high-frequency amplifier 402 or the like and an analog-digital converter 403, which may also be just an inverter or the like. In experiments, an analog-to-digital converter 403 with a resolution of 14 bits and a sampling rate of 125 MS/s and with an evaluation device 404 was successfully used.

The entropy source 401 of the quantum random number generator 28 comprises in the example of Figure 8 an array 54 of single photon avalanche diodes (SPAD) 54 as photon sources 54 and an array 55 of single photon avalanche diodes (SPAD) 55 as photon detectors 55. It can also be a single common array. The voltage converters 91 of the integrated circuit 2, for example of the microcontroller, supply the first SPADs 54 of the array 54 of single photon avalanche diodes (SPAD) 54 of the quantum random number generator 28, which serve as photon sources 54, and the second SPADs 55 of the array 55 of single photon avalanche diodes (SPAD) 55 of the quantum random number generator 28, which serve as photon detectors 55, preferably with such an operating voltage that they are preferably in the so-called Geiger mode. The operating voltage of these SPAD diodes 54, 55 is then above the breakdown voltage. The SPAD diodes 54, 55 are then preferably connected in the reverse direction. In addition, a quenching resistor 401.4 is preferably connected in series for each SPAD diode 54, 55. The quenching resistor 401.4 prevents thermal destruction of the respective SPAD diode 54, 55 in the event of a charge carrier avalanche being triggered. The respective quenching resistor 401.4 in Figure 8 also serves as a shunt resistor for detecting the electrical diode current through the SPAD diodes 54, 55. The current signal of the second single photon avalanche diodes 55 of the array 55 of single photon avalanche diodes (SPAD) is measured via a shunt resistor 401.4 for these second SPAD diodes 55. In the example in Figure 8, the series resistor for limiting the current through the respective SPAD diodes forms the shunt resistor 401.4. However, the shunt resistor 401.4 can be inserted into the supply line of the respective SPAD diode 54, 55 independently of the quenching resistor 401.4. An exemplary common array of SPAD diodes in the example in Figure 8 comprises four active first SPAD diodes 54 and twelve passive second SPAD diodes 55. The exemplary four active first SPAD diodes 54 and twelve passive second SPAD diodes 55 are preferably coupled via an optical waveguide (optical waveguide 44). The active first SPAD diodes 54 emit individual light pulses 57 spontaneously and randomly. They correspond to the first SPAD diode 54 of Figures 6 and 7. The active first SPAD diodes 54 are preferably located inside the array of first and second SPAD diodes 54 and 55. The proposed device supplies the active first SPAD diodes 54 with an increased supply voltage by means of its voltage converters. For this purpose, the proposed device preferably uses particularly voltage-resistant DMOS transistors in these voltage converters. It is therefore particularly advantageous if the one-piece, micro-integrated quantum random number generator 28 is manufactured using a BCD semiconductor technology, which typically allows the manufacture of CMOS circuits, SPADs and DMOS transistors simultaneously at low cost and with effective chip area. The proposed device therefore operates the active, first SPAD diodes 54 in the example of Figure 8 preferably well above the breakdown voltage of the first SPAD diodes 54. This operation at an increased supply voltage of the first SPAD diodes 54 increases the dark count rate of these first SPAD diodes 54, which leads to a higher number of spontaneously emitted photons 57. The optical waveguide 44 passes some photons 58 of the emitted photons 57 on to the passive, second SPAD diodes 55 in the example of Figure 8. The optical waveguide 44 corresponds to the optical waveguide 44 of Figures 6 and 7. The passive, second SPAD diodes 55 correspond to the second SPAD diode 55 of Figures 6 and 7. One or more voltage converters of the proposed device supply the passive, second SPAD diodes 55 in the example of Figure 8 with an increased supply voltage. For this purpose, too, the proposed device preferably uses particularly voltage-resistant DMOS transistors in these voltage converters. It is therefore particularly advantageous if the one-piece, micro-integrated quantum random number generator 28 is manufactured using a BCD semiconductor technology, which typically allows the manufacture of CMOS circuits, SPADs and DMOS transistors at the same time in a cost-effective and chip-area-effective manner. The proposed device operates the passive, second SPAD diodes 55 just above the breakdown voltage. Preferably, the passive, second SPAD diodes 55 are arranged as a ring around the active, first SPAD diodes 54 in the example of Figure 8. Other arrangements are conceivable. In particular, it is conceivable to replace the first SPAD diodes 54 with other silicon LEDs and to use an arrangement of such other silicon LEDs and second SPAD diodes 55 close to each other, in which case the light transmission takes place directly through the semiconductor substrate 49 as an optical waveguide 44 with an extremely short light transmission path of only a few pm. The passive, second SPAD diodes 55 detect at least some of the photons 59 arriving via the optical waveguide 44 in the example of Figure 8. The passive, second SPAD diodes 55 generate, depending on the incoming photons 59 a current flow via a shunt resistor which is assigned to the second SPAD diodes 55. In the example of Figure 8, the entropy source 401 preferably comprises the shunt resistors, the operating device of the SPAD diodes, the SPAD diodes 54 and 55 and the optical waveguide 44. A voltage signal 405 of the entropy source 401 preferably connects the entropy source 401 to a preferred, exemplary, broadband 40 dB high-frequency amplifier 402. In other embodiments of the proposal, this 40 dB high-frequency amplifier 402 is not required. In this respect, the 40 dB high-frequency amplifier 402 is optional. The voltage signal preferably corresponds to the voltage drop across the quenching resistor 401.4, which in the example of the figure functions as a shunt resistor 401.4. It is conceivable to supply the first SPAD diodes 54 and the second SPAD diodes 55 via a common quenching resistor 401.4, which then also functions as a common shunt resistor. The proposed exemplary high-frequency amplifier 402 preferably has a bandwidth of 30 to 4000 MHz and preferably a 1 dB compression point of 20 dBm. The voltage swing of the voltage signal 405 of the entropy source 401 was in the sub-millivolt range in tests in connection with the elaboration of the technical teaching of the document presented here. The exemplary proposed high-frequency amplifier 402 amplifies, for example, the voltage swing of this voltage signal 405 of the entropy source 401 to, for example, 50 to 150 mV.

An amplifier output signal 406 of the high-frequency amplifier 402 connects, for example, the exemplary high-frequency amplifier 402 to an exemplary evaluation device 404, which essentially comprises sub-devices of the control device 4. The evaluation device 404 of Figure 8 is only one of many different implementation options of the technical teaching presented in this document. The evaluation device 404 is preferably part of the integrated circuit 2, for example the microcontroller. The integrated circuit 2, for example the microcontroller, preferably comprises one or more processors 10-1, 10-2. In the examples of Figures 8 and 9, the evaluation circuit 404 has an exemplary 14-bit analog-digital converter (ADC) 403 with an exemplary sampling rate of 125 mega-samples/s and an exemplary bandwidth of 50 MHz. During development, it has been shown that smaller bit widths and lower sampling rates are possible. If necessary, analog preprocessing before digitization by the analog-to-digital converter 403 using pulse broadening circuits 2022 is expedient. The amplified voltage signal of the exemplary high-frequency amplifier 402 is the amplifier output signal 406 of the high-frequency amplifier 402. The analog-to-digital converter 403 samples the amplifier output signal 406 of the high-frequency amplifier 402 at a sampling rate of the analog-to-digital converter 403. Preferably, the sampling rate depends on the system clock 2106. As a rule, the sampling rate of the analog-to-digital converter 403 is equal to the Frequency of the system clock 2106. The analog-to-digital converter 403 passes on the determined sample values of the amplifier output signal 406 of the high-frequency amplifier 402 digitally with a bus width of 14 bits, for example, to the evaluation device 404. A proposal is also described below which works without a high-frequency amplifier 402 and which provides an analog-to-digital converter 403 with a bit width of 1.

The device shown in simplified form as a block diagram in Figure 8 includes, for example, a comparator 404.2, a time-to-pseudo-random number converter (TPRC) 404.3, an entropy extraction device 404.4 and a finite state machine 404.8.

In the example of Figure 8, the comparator 404.2 compares the exemplary digital 14-bit value 407 of the analog-to-digital converter 403 with a constant 404.1, which represents a threshold value, and generates a two-cycle 1-bit output pulse on its output signal 409 of the comparator 404.2 if the output value of the analog-to-digital converter 403 is greater than the constant 404.1. In the case of a device without a high-frequency amplifier 402 and with an analog-to-digital converter 403 with a bit width of 1, the comparator 404.2 and the constant 404.1 are omitted and the analog-to-digital converter 403 immediately generates the output signal 409 of the comparator, since the analog-to-digital converter 403 then also fulfills the function of the comparator 404.2. The disadvantages of such a design include its reduced flexibility and the increased demands on design and production. The output signal 409 of the comparator 404.2 connects the comparator 404.2 to the time-to-pseudo-random number converter 404.3 (TPRC). The time-to-pseudo-random number converter 404.3 (TPRC) preferably comprises, for example, a linearly-coupled 32-bit shift register that counts up with the system clock 2106 of the integrated circuit 2, for example the microcontroller. The oscillator 30 and the clock system of the control device 4 typically provide this clock. The bit width of this linearly-coupled shift register can vary depending on the application. This bit width can preferably be set via a register of the control device 4 of the integrated circuit 2, for example the microcontroller. Preferably, the feedback polynomial of the linearly fed back shift register of the time-to-pseudo-random number converter 404.3 (TPRC) can be set via a register of the control device 4 of the integrated circuit 2, for example the microcontroller. The system clock 2106 can have a frequency of 125 MHz, for example. A pulse on the 1-bit output signal of the comparator 404.2 preferably causes the time-to-pseudo-random number converter 404.3 (TPRC) to output the current shift register value of the linearly fed back shift register of the time-to-pseudo-random number converter 404.3 (TPRC) as a pseudo-random number at the output 410 of the time-to-pseudo-random number converter 404.3 (TPRC). The pseudorandom numbers typically change with the clock period of the system clock 2106, which results in a time resolution with regard to the pulses on the 1 bit output signal of the comparator 404.2. With an exemplary 125 MHz system clock 2106, this results in a time resolution of 1/(125 MHz)=8 ns. The output 410 of the time-to-pseudorandom number converter

404.3 (TPRC) passes the exemplary 32 bit shift register value, also called raw data, of the time-to-pseudorandom number converter 404.3 (TPRC) to the entropy extraction following in the signal path

404.4. The entropy extraction 404.4 converts the random raw data RD of the time-to-pseudo-random number converter 404.3 (TPRC) on the signal of the output 410 of the time-to-pseudo-random number converter 404.3 (TPRC) into a 1-bit random number 411 RN. The raw data on the signal of the output 410 of the time-to-pseudo-random number converter 404.3 (TPRC) typically represents the last shift register value at which the output signal 409 of the comparator 404.2 showed a pulse. The output 411 of the entropy extraction 404.4 is connected to the input of the finite state machine FSM 404.8.

The finite state machine 404.8 typically has the task of receiving data in the form of a serial stream of quantum random bits 411 from the entropy extraction 404.4, converting the serial stream of random data bits into random data words and storing these in the RAM block 404.9 of the evaluation device 404, which is typically the volatile memory. The finite state machine 404.8 preferably communicates with the processor 404.11 (10-1, 10-2) via an internal data bus 419. After a successful write operation, the finite state machine 404.8 sets a finish flag 404.10. The processor 404.11 can preferably write and/or read the finish flag 404.10 via the internal data bus 419. The finish flag 404.10 can optionally be part of the RAM 404.9 or a register of the processor 404.11. The processor 404.11 preferably controls and monitors the finite state machine 404.8 via the internal data bus 419. The finish flag 404.10 is preferably not set when the system starts. The processor 404.11 can then access the RAM block 414.9 and read the random number from the RAM 404.9, for example using a C program that is started on the embedded processor 404.11, for example a dual-core Arm Cortex-A9 MPCore. The processor 404.11 is preferably identical to the first processor 10-1 in Figure 1. The processor 404.11 can be a dual-core Arm Cortex-A9 MPCore, for example. The processor 404.11 can also carry out some of the functions of the sub-devices of the evaluation device 404 by means of a suitable program and thus replace these device parts if necessary.

Preferably, the processor 404.11 controls a watchdog 404.5. In the sense of the document presented here, the watchdog 404.5 is not only a watchdog timer that includes a timer that is synchronized with the system clock of the quantum random number generator 28 or the system clock 2106 of the processor 404.11 is clocked and which must be reset to a start value by the processor 404.11 at regular intervals in order to avoid interrupting the program execution of the processor 404.11 when a watchdog counter reading threshold is reached and/or crossed by the counter reading of the timer of the watchdog 405.5. The watchdog 405.5 also carries out further monitoring tasks within the quantum random number generator 28. For example, the watchdog 404.5 preferably monitors the entropy of the quantum random bits 411. In particular, the watchdog 404.5 preferably ensures that the quantum random bits 411 preferably do not have more than q consecutive random bits of the same logical value. If this is the case, the watchdog 404.5 preferably inserts other bits instead of the quantum random bits 411 into this serial bit data stream from the entropy extraction 404.5 to the finite state machine 407.8. More on this in the following Figure 9. In this case, the watchdog 404.5 preferably inserts random bits from another true random number generator and/or another quantum random number generator and/or pseudorandom bits from a pseudorandom number generator whose starting value is determined by valid random bits from a quantum random number generator (QRNG) or a true random number generator (TRNG). Since the time-to-pseudorandom number converter 404.3 (TPRC) already ensures by design that this case should not occur, the watchdog 404.5 preferably outputs an error message to the processor 404.11 in such a case. Preferably, the watchdog 404.5 is also a watchdog of the first processor 10-1. In addition, the watchdog 404.5 monitors other variables within the meaning of the document presented here, such as the agreement of voltage values within the quantum random number generator 28 and/or within the device by means of one or more analog-to-digital converters and/or by means of one or more voltage monitoring devices such as voltage monitors 413, etc.

Figure 9

Figure 9 shows the expanded exemplary evaluation device 404, which now includes monitoring of the random number 411 RN and has an additional backup system for the event of an error in order to ensure the security of the application circuit by means of an emergency operation procedure even if the quantum random number generator fails. For a better overview, the components processor 404.11 RAM 404.9 and finish flag 404.10 are omitted. The reader should still consider these device parts or functions to be present in Figure 9. However, the person skilled in the art can easily copy the connection to the finite state machine 404.8 from Figure 8 into Figure 9 and then arrive at the disclosed technical teaching. The watchdog 404.5, an optional additional linear feedback shift register 404.6 as a backup pseudorandom number generator PRNG and a signal multiplexer 404.7 expand the device of Figure 8 to the device of Figure 9. The output 411 of the entropy extraction 404.4 is now connected to the watchdog 404.5 and the signal multiplexer 404.7 as an example. The watchdog 404.5 monitors the quantum random number RN at the output 411 of the entropy extraction 404.4. The watchdog 404.5 detects at least three defined error cases as proposed. For this purpose, the watchdog 404.5 passes valid quantum random bits 411 to the optional additional linear feedback shift register 404.6, for example, while generating a seed value S 412. The watchdog 404.5 preferably prevents the use of these valid quantum random bits by the finite state machine 404.8. If an error occurs, the watchdog 404.5 sets error bits in an unmarked error register ER of the processor 404.11. Which error bit the watchdog 404.5 sets in the error register of the processor 404.11 preferably depends on the respective error case that the watchdog 404.5 detects. In addition, the watchdog 404.5 is connected to a voltage monitor 413 via one or more, preferably digital input/output signal lines 414 in the example in Figure 9. The watchdog circuit 404.5 preferably monitors the voltage values that the voltage monitor 413 determines. It has proven useful if the voltage monitor 413 not only determines and monitors the voltages in the quantum random number generator 28, but also other voltages within the respective application circuit. The voltage monitor 413 can be the aforementioned analog-to-digital converter.

In the example of Figure 9, the voltage monitor 413 preferably monitors the operating voltages of the entropy source 401 and/or other voltages that voltage converters generate within the application circuit. If, for example, one of the operating voltages of a photon source 54 and/or a silicon LED 54 and/or a first SPAD diode 54 and/or a photon detector 55 and/or a second SPAD diode 55 is too low, i.e. the voltage value is below a lower operating voltage threshold for these components, or too high, i.e. the voltage value is above an upper operating voltage threshold for these components, the voltage monitor 413 detects this voltage deviation and reports it to the watchdog 404.5 and/or the processor 10-1, 404.11. Preferably, the processor 404.11 can read the values of the voltage monitor 413 via the internal data bus 419 of the control device 4 of the integrated circuit 2, for example the microcontroller. In the case of such a voltage deviation, the voltage monitor 413 signals such a deviation to the watchdog 404.5 or directly to the processor 404.11. In the case of a signal to the watchdog 404.5, the watchdog 404.5 can, for example, generate an interrupt signal 420 for the processor 404.11. The watchdog 404.5 can, for example, trigger such an interrupt 420 of the microcontroller 404.11 or another sub-device of an application system if the supply voltage of the entropy source 401 or the high-frequency amplifier 402 or another device part of the quantum random number generator QRNG 28 and/or the integrated circuit 2, for example the microcontroller, and/or the application device is faulty. If the watchdog 404.5 has detected a fault in the quantum random number generator 28, it preferably causes the quantum random number generator 28 to switch to an emergency running state. For this purpose, the watchdog 404.5 preferably sets the selection signal 416 of a signal multiplexer 404.7, so that the signal multiplexer 404.7 applies the pseudorandom number PRN of the optional additional linear feedback shift register 404.6 in the form of a stream of pseudorandom bits via a pseudorandom signal line 417 to the input of the finite state machine 404.8 instead of the output 411 of the entropy extraction 404.4 as a replacement for the at least potentially erroneous random number RN of the output 411 of the entropy extraction 404.4.

The optional additional linear feedback shift register 404.6 is connected in the example of Figure 9 to the output Seed S 412 of the watchdog 404.5. In the event of an error, the watchdog 404.5 activates the optional additional linear feedback shift register 404.6. The optional additional linear feedback shift register 404.6 then generates pseudorandom numbers PRN as a pseudorandom number generator PRNG. The seed S 412 preferably has the last quantum random bits that are still valid. The watchdog 404.5 preferably applies these last valid quantum random bits 411 to the input of the optional additional linear feedback shift register 404.6. The seed S thus serves as a random PQC secure starting value for the generator polynomial of the feedback of the optional, further linear feedback shift register 404.6 for the generation of the pseudorandom number PRN and its signaling via the pseudorandom signal line 417. The generator polynomial and the degree of the generator polynomial are preferably freely selectable.

The signal of the output 411 of the entropy extraction 404.4 with the 1 bit random number RN of the entropy extraction 404.4 or the signal of the pseudorandom signal line 417 with the pseudorandom number PRN of the linear feedback shift register 404.6 are connected to the inputs of the signal multiplexer 404.7. The signal multiplexer 404.7 forwards one of the two inputs to the finite state machine 404.8 depending on the value of the selection signal 416 SEL. It is of course conceivable to use a multiplexer with more than two inputs and a more complex control signal if the application requires it. The number of inputs of the signal multiplexer 404.7 is therefore typically greater than or equal to two.

Here too, the finite state machine 404.8 has the task of receiving the random data RN or the pseudorandom number PRN at the output of the signal multiplexer 404.7 and writing it into the RAM block 404.9, 15 of the evaluation device 404 within the control device 4. If the writing process is successful, the finite state machine 404.8 sets the finish flag 404.10 again. The processor 404.11 can then access the RAM block 404.9, for example by means of a C program that preferably runs on the embedded processor 404.11, and read out the random number and use it, for example, for encryption.

Preferably, time-to-pseudo-random number converter 404.3 records the time between two pulses on the output signal 409 of comparator 404.2 as a time value. If a time value at the output 410 of time-to-pseudo-random number converter 404.3 is less than a minimum value, it is a value that lies within the dead time of the second SPAD diodes 55. When such a value occurs, evaluation device 404 preferably discards the generated pseudo-random numbers and preferably increases the error counter by the first error step size, which can also be negative. In this case, entropy extraction 404.4 waits for the next random number to be determined by time-to-pseudo-random number converter 404.3. Once the random bit has been extracted in this way, quantum random number generator 28 starts the process from the beginning.

If the error counter crosses or reaches the error counter threshold, an error may be present, for example, in which the time-to-pseudorandom number converter 404.3, for example, delivers constant numerical values due to an error.

This device is thus able to detect a failure of the voltage supply 5 of the entropy source 401 or other parts of the device (e.g. 4, 28). The processor 404.11 can also use the analog-to-digital converter 403 to record voltages and currents in the quantum random number generator 28 and/or within the control device 4 of the integrated circuit of a microcontroller and/or within the integrated circuit 2, for example the microcontroller, for test purposes and compare the values thus determined with expected value ranges in which these values must lie. The processor 404.11 can also record digital values within the quantum random number generator 28 and/or within the control device 4 of the integrated circuit of a microcontroller and/or within the integrated circuit 2, for example the microcontroller.

For example, the processor 404.11 can set the constant Const 404.1 so low for test purposes that the noise floor essentially controls the time-to-pseudo-random number converter 404.3. To do this, the processor 404.11 preferably sets an operating state of the time-to-pseudo-random number converter 404.3 in which the time-to-random number converter 404.3 restarts with the last seed value after generating a pseudo-random number. The values of the time-to-pseudo-random number converter 404.3 should then satisfy an expected statistic within a tolerance band. If this is not the case, an error is present. The processor 404.11 can create this statistic and, if necessary, conclude that this error exists if the statistical values determined do not lie within an expected value interval. The watchdog 404.5 can monitor the entropy of the quantum random bits 411 provided. If the average entropy of the quantum random bits 411 deviates from the expected random mean value of 50% by significantly more than an allowed entropy deviation value over an entropy measurement period, the watchdog 404.5 preferably concludes that there is an error in the quantum random number generator 28 and preferably increments the error counter by the said error counter step size. The watchdog 404.5 then preferably stops the use of these quantum random bits of the output 411 of the entropy extraction 404.4 in order to prevent the device from sending plain text over the data bus. In the sense of the document presented here, plain text means that the data sent and/or stored is in a form that allows a third party to gain unauthorized access to the content of a data message and/or stored data and/or program code directly and/or by applying statistical or other methods. It is conceivable that a virtual permanent one or a virtual permanent zero is generated randomly even in functioning sub-devices. Randomness also includes the permanent zero and the permanent one. It is therefore sensible if the maximum length of a bit sequence without changing the logical state at the output 411 of the entropy extraction 404.4 is limited by the watchdog 404.5 to a value that can be programmed by the processor 404.11.

Essentially, the quantum random number generator 28 described above can thus detect the following errors and, by means of an emergency run using an optional, additional pseudorandom number generator,

404.6, for example by means of an optional additional linear feedback shift register

4104.6, with a lower safety level:

• Disturbance of supply voltages

• Faulty signal generation of the photon sources 54 and/or the silicon LEDs 54 and/or the first SPAD diodes 54,

• Faulty signal generation of the photon detectors 55 and/or the second SPAD diodes 55,

• Malfunction of the optional fiber optic cable 44,

• Disturbance of the coupling of the photon sources 54 and/or the silicon LEDs 54 and/or the first SPAD diodes 54 to the optical waveguide 44,

• Disturbance of the coupling of the photon detectors 55 and/or the second SPAD diodes 55 to the optical waveguide 44,

• Circuit failures in the digital part 404 of the quantum random number generator 28,

• Incorrect entropy of the supplied quantum random bits 411. It is conceivable to use a second complete quantum random number generator 28 instead of the optional, additional linear feedback shift register 404.6 or the optional, additional pseudorandom number generator 404.6, the output 411 of which is the entropy extraction

404.4 then the multiplexer 404.7 is used instead of the signal of the optional additional pseudorandom signal line 417 for the emergency operation of the quantum random number generator 28. In the event that the output of the optional, additional pseudorandom number generator 404.6 depends on one or more real quantum random bits 411 as seed 412, it is again a quantum random number as long as the number of inserted bits is limited. Preferably, the watchdog 405.5 determines the number q of the permitted, maximum consecutive quantum random bits 411 by means of a quantum random number. If this quantum random number, which the watchdog 404.5 uses to determine q, only includes quantum random bits 411 with a single logical value, there is a possibility that an error is present. The number q should then not be maximum in order to avoid sending or storing plain text. Rather, the watchdog 404.5 should then choose the number q very small, preferably minimal.

Figure 10

Fig. 10 shows the flow chart 500 of the entropy extraction method, which, for example, carries out the entropy extraction 404.4. The method provides for determining two values of the output 410 of the time-to-pseudo-random number converter 404.3 in a first step 501 and storing them in a shift register of the entropy extraction 404.4. If two values are stored in the shift register of the entropy extraction 404.4, the entropy extraction 404.4 compares these two values in a second step 502. The two values in the shift register of the entropy extraction

404.4 thus comprise a first value and a second value, both of which the time-to-pseudo-random number converter 404.3 has determined by means of two different pseudo-random number determinations depending on the respective time period between two signal pulses of the output signal 409 of the comparator 404.2. In a third step 503, the entropy extraction 404.4 evaluates the two values. If the first value is smaller than the second value and the difference between value 1 and value 2 is greater than a minimum difference e, the entropy extraction sets

404.4 sets the value of its output 411 to a first logical value. If the first value is greater than the second value and the difference between the first value and the second value is greater than the minimum difference e, the entropy extraction 404.4 sets its output to a second logical value that is different from the first logical value. If the difference between the first value and the second value is smaller than the minimum difference e, the entropy extraction discards the first value and the second value. In such a case, the entropy extraction preferably causes the watchdog 404.5 to increase an error counter by a first error counter step size. The first error counter step size can be negative. Conversely, the entropy extraction 404.4 can Decrement the error counter of the watchdog 404.5 by a second error counter step size if the difference between the first value and the second value is greater than the minimum difference e. The second error counter step size can be equal to the first error counter step size. Typically, the signs of the first error counter step size and the second error counter step size are the same. Preferably, the processor 404.11 can set the error counter step sizes and the start value of the error counter and an error counter threshold value. If the count of the error counter crosses the error counter threshold value, the watchdog 404.5 signals the presence of a critical error state to the processor 404.11, preferably by means of an interrupt 420 or another signaling. The processor 404.11 then typically starts a self-test program to test the various parts of the quantum random number generator 28. For this purpose, the processor 404.11 can preferably, for example, put the analog-to-digital converter 403 into a state in which the processor 404.11 can write test values to an output register of the analog-to-digital converter 403, which the subsequent signal chain then processes like real sample values. Since the test values are known in advance, the processor 404.11 can observe and evaluate the correct reaction of the rest of the system, for example the incrementing of the error counter in the watchdog 404.5. The microcontroller 404.11 can therefore preferably monitor as many memory nodes as possible of the evaluation circuit 404 or the control device 4 and read their logical state.

Figure 11

Figure 11 shows an example oscillogram of the voltage signal 404 of the entropy source 401. As can easily be seen, first spikes 601 occur with a first height and second spikes 602 with a second height. The scatter of the first height of the first spikes 601 and the scatter of the second height of the second spikes 602 are each so small that a clear separation of these events 601, 602 is possible by means of an example cutting level 603 via the selection of the constant 404.1. The cutting level 603 corresponds to the value that the processor location 404.11 sets using the constant 404.1, which is preferably implemented as a register of the processor 404.11.

Figure 12

Figure 12 shows the schematic sequence of a server-client communication using a proposed quantum random number generator. A first device, such as that in Figure 1, as a server, should communicate in an encrypted manner via a data bus with a second device, such as that in Figure 1, as a client. In a first example, both the first device and the second device should each comprise a quantum random number generator 28, which the respective first processor 10-1 of the computer Ill

(here the exemplary micro-integrated circuit 2) for the encryption. The quantum random number generator 28 preferably corresponds in whole or in part to a construction according to one of Figures 5 to 9. Most preferably, the quantum random number generators of the first device and the second device each comprise a quantum random number generator 28, each of which has at least one photon source 54 or a silicon LED 54 or a first SPAD diode 54 and each, for example, an optical waveguide 44, for example in the form of the oxide stack 44 on the semiconductor surface of the semiconductor substrate 49 and preferably at least one photon detector 55 or a second SPAD diode 55 as a receiver. This increases the data rate of the generated quantum random bits 411 and enables the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the respective device to generate and exchange the keys very quickly. The respective first processors 10-1 of the respective computers (here the exemplary micro-integrated circuit 2) of the respective devices encrypt their mutual communication preferably by means of an RSA encryption method. The exemplary RSA encryption method is known, for example, from RL Rivest, A. Shamir, and L. Adleman, "A Method for Obtaining Digital Signatures and Public-Key Cryptosystems" Communications of the ACM, February 1978, Vol. 21, No. 2, pages 120 to 126. The prime numbers that the respective first processor 10-1 of the respective computer (here the respective exemplary micro-integrated circuit 2) of the respective device preferably uses to generate the public and private keys are preferably randomly generated by the quantum random number generator 28 QRNG. The communication of the computer (here the exemplary micro-integrated circuit 2) of the server with the respective first processor 10-1 of the respective computer (here the exemplary micro-integrated circuit 2) of the client preferably comprises, firstly, the process "Server Process", which is executed on the respective first processor 10-1 of the respective computer (here the exemplary micro-integrated circuit 2) of the server, i.e. the first device, is started, and secondly the process "Client Process", which is started on the respective first processor 10-1 of the respective computer (here the exemplary micro-integrated circuit 2) of the client, i.e. the second device. The respective first processor 10-1 of the respective computer (here the exemplary micro-integrated circuit 2) of the client typically communicates with the respective first processor 10-1 of the respective computer (here the exemplary micro-integrated circuit 2) of the server via so-called sockets. These are communication points which the respective operating system of the respective computer (here the exemplary micro-integrated circuit 2) provides. The functions required to establish communication preferably come, for example, from the standard C library socket. h. The following explains the communication according to Figure 12 as an example: At the beginning, the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server generates a socket descriptor in step 3000. A socket descriptor in the sense of the document presented here is an integer-like file handle that is generated, for example, by the standard C library function socket() of the socket.h library. The first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server can use this socket descriptor in later function calls that use sockets.

The first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server preferably binds the socket descriptor to a port and an IP address in step 3010. Binding in the sense of this document means that the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server uses the standard C function bind() from the standard C library socket.h to logically link the port and the IP address to the socket descriptor generated in step 3000. In the sense of this document, a port is a part of the network address that enables the assignment of data packets between server and client programs. In the sense of this document, an IP address is a network address that makes a participant in a network uniquely identifiable.

In the next step 3020, the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server goes into a passive waiting state 3020 and waits for connection requests from a first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of a client. In the sense of the document presented here, the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server preferably calls the standard C function I isten() of the socker.h library for this purpose. The function indicates that the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server is ready, that the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) can accept connection requests from clients. The first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) creates a queue for incoming connection requests from the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client in one of the memories of the computer (here the exemplary micro-integrated circuit 2) or the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) or another device part of the computer (here the exemplary micro-integrated circuit 2). If the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server detects a connection request from a first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of a client, the first processor 10-1 accepts the connection request. Processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server receives this connection request from the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client.

The first processor 10-1 of the computer (here of the exemplary micro-integrated circuit 2) of the server then establishes a connection to the first processor 10-1 of the computer (here of the exemplary micro-integrated circuit 2) of the client in a following step 3030. The first processor 10-1 of the computer (here of the exemplary micro-integrated circuit 2) of the server detects a connection request from the first processor 10-1 of the computer (here of the exemplary micro-integrated circuit 2) of the client by the first processor 10-1 of the computer (here of the exemplary micro-integrated circuit 2) of the server leaving the listen() function. The first processor 10-1 of the computer (here of the exemplary micro-integrated circuit 2) of the server accepts the connection request preferably by calling the standard C function accept() of the socket.h standard C library. The first processor 10-1 of the computer (here the example micro-integrated circuit 2) of the server preferably extracts the first connection request from the queue of open connection requests for the server and then uses it to establish the connection to the first processor 10-1 of the computer (here the example micro-integrated circuit 2) of the client. If successful, the accept() function returns a socket descriptor of the client to the first processor 10-1 of the computer (here the example micro-integrated circuit 2). A socket descriptor in the sense of this document is an integer similar to a file handle of the standard C library socket.h. This then creates the connection between the first processor 10-1 of the computer (here the example micro-integrated circuit 2) of the server and the first processor 10-1 of the computer (here the example micro-integrated circuit 2) of the client.

If such a connection exists, the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server preferably starts a function keyExchangeServer() in a subsequent step 3040. The first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server then executes this function keyExchange() in this step 3040 in order to send the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client its public key. However, this function keyExchangeServer() is not a standard C function. In this function, in this step 3040, the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server generates quantum random numbers using a quantum random number generator 28 Q.RNG. The quantum random number preferably has a bit width of n. Here, n is a positive integer including zero. This Random numbers of the quantum random number generator 28 of the computer (here the exemplary micro-integrated circuit 2) of the server serve in the example presented in this document as indices for a look-up table of the first 2n prime numbers. This look-up table is preferably located in one of the memories of the computer (here the exemplary micro-integrated circuit 2) or in a memory of sub-devices of the computer (here the exemplary micro-integrated circuit 2) of the server. The first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server then reads the prime number corresponding to this index of the quantum random number of the quantum random number generator 28 of the computer (here the exemplary micro-integrated circuit 2) from the memory of the computer (here the exemplary micro-integrated circuit 2) of the server. Using these prime numbers, the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) server generates both a public and a private key according to the aforementioned RSA encryption method.

The first processor 10-1 of the computer (here of the exemplary micro-integrated circuit 2) then transmits a public key to the first processor 10-1 of the computer (here of the exemplary micro-integrated circuit 2) of the client via the data interface 64 of the computer (here of the exemplary micro-integrated circuit 2) of the server and the data bus 95 and the data interface 64 of the computer (here of the exemplary micro-integrated circuit 2).

The first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server then waits for a message from the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client via the data interface 64 of the computer (here the exemplary micro-integrated circuit 2) of the client and the data bus 65 and the data interface 64 of the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server. Preferably, this message from the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client includes a public key of the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client. Thus, the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client typically transmits the private key of the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client via the data interface 64 of the computer (here the exemplary micro-integrated circuit 2) of the client and the data bus 95 and the data interface 64 of the computer (here the exemplary micro-integrated circuit 2) of the server to the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server. If the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server has received the public key of the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client, the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server stores this public key in a memory of the computer (here the exemplary micro-integrated circuit 2) of the server.

The first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server then sends, for example, its public key via its data bus interface 64 and the data bus 65 and the data bus interface 64 of the computer (here the exemplary micro-integrated circuit 2) of the client to the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client.

Thus, the server is typically prepared for the exchange of encrypted data between the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client and the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server.

After the keys have been exchanged, the first processor 10-1 of the computer (here the example micro-integrated circuit 2) of the server preferably executes the function recv() 3050 and waits for an encrypted message from the first processor 10-1 of the computer (here the example micro-integrated circuit 2) of the client. If the first processor 10-1 of the computer (here the example micro-integrated circuit 2) of the server receives a message, the first processor 10-1 of the computer (here the example micro-integrated circuit 2) of the server preferably initially stores this encrypted message in a temporary buffer of the computer (here the example micro-integrated circuit 2) of the server. In the sense of the present document, the function recv() is preferably a standard C function of the standard C library socket. h. The recv() function typically reads incoming data from a socket descriptor, in this case the socket descriptor of the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client from step 3030 of the method. The recv() function, which the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server typically executes, typically stores the received data in the temporary cache of the computer (here the exemplary micro-integrated circuit 2) of the

Server. If the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server has received an encrypted message in this way, the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server preferably executes the function Decrypt() 3060 in a further step 3060. This function Decrypt() is not a standard C function. In this step 3060, the function DecryptQ decrypts the message of the server's private key from step 3040, which is temporarily stored in the memory of the computer (here the exemplary micro-integrated circuit 2), in accordance with the RSA method. As a result, the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server decrypts the received encrypted message from the client using the private key from step 3040 temporarily stored in the memory of the computer (here the exemplary micro-integrated circuit 2) according to the RSA method. The first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server preferably stores the then decrypted message in a temporary buffer of the computer (here the exemplary micro-integrated circuit 2) of the server.

If the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server does not receive a message from the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client within a predetermined period of time, the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server jumps to the step now described. The first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server checks whether a message should be sent to the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client. Typically, such a message is stored in a memory of the computer (here the exemplary micro-integrated circuit 2) of the server for sending in such a case. If necessary, the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server can also collect or receive such a message from another memory or system before sending it. The first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server then preferably stores such a message temporarily in a buffer of the computer (here the exemplary micro-integrated circuit 2) of the server. If such a message to be sent is waiting to be sent in a memory or buffer of the computer (here the exemplary micro-integrated circuit 2) of the server, the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server preferably executes the Encrypt() function in a further step 3070. The first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server encrypts in this step 3070 in in this case, the server encrypts its own message using the client's public key from 3040 according to the RSA method. This Encrypt() function is not a standard C function. The server stores its now encrypted message in a temporary buffer on the server's computer (here the example micro-integrated circuit 2).

The first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server now executes the send() function in a step 3080. In step 3080, the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server sends its encrypted message stored in the buffer of the computer (here the exemplary micro-integrated circuit 2) to the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client via the data bus interface 64 of the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server and via the data bus 65 and via the data interface 64 of the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2). For the purposes of this document, the send() function is a standard C function from the standard C library socket.h. The send() function sends data via a socket descriptor, in this case the client's socket descriptor from step 3030. The typical cycle ends when the transfer ends.

Thereafter, the encrypted communication for the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server starts again at step 3040.

If the communication is terminated by the first processor 10-1 of the computer (here the example micro-integrated circuit 2) of the server or the first processor 10-1 of the computer (here the example micro-integrated circuit 2) of the client, the first processor 10-1 of the computer (here the example micro-integrated circuit 2) of the server executes the function close() 3090. The close() function is a standard C function of the standard C library socket.h. By executing the close() function, the first processor 10-1 of the computer (here the example micro-integrated circuit 2) of the server closes the open connection to a socket, here the socket of the client, and thus terminates the communication.

In an analogous manner, the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client executes a client process.

At the beginning of the "client process", the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client creates a socket descriptor in a step 3100. A socket descriptor in the sense of this document is again an integer similar to a file handle, for example the standard C library function socket() of the socket.h library, which the first Processor 10-1 of the client's computer (here, the exemplary micro-integrated circuit 2) can use in subsequent function calls that use sockets. The first processor 10-1 of the client's computer (here, the exemplary micro-integrated circuit 2) makes a connection request to the first processor 10-1 of the server's computer (here, the exemplary micro-integrated circuit 2) using the port and IP address specified in step 3010.

To do this, the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client preferably executes the standard C function connect() of the standard C library socket.h. This function establishes a connection between the server socket from step 3010 and the client socket from step 3100.

If the connection was accepted by the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server in accordance with step 3030, the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client executes the function KeyExchangeClient() in a step 3120. This function is not a standard C function. By executing this function, the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client generates one or more QRNG quantum random numbers using the quantum random number generator 28. This quantum random number has a bit width n. Here, n is a positive integer including zero. These random numbers of the quantum random number generator 28 of the computer (here the exemplary micro-integrated circuit 2) of the client preferably serve as indices for a look-up table of the first 2 ⁿ prime numbers. Using these prime numbers or other prime numbers, the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client generates both a public and a private key according to RSA encryption (ANGANG). The first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client stores its public key generated in this way and its private key generated in this way preferably in a memory of the computer (here the exemplary micro-integrated circuit 2) of the client. The first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client then sends its public key to the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server via the data interface 64 of the computer (here the exemplary micro-integrated circuit 2) of the client and via the data bus 65 and via the data interface 54 of the computer (here the exemplary micro-integrated circuit 2) of the server. The first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client then waits for a message from the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server. This message from the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server typically contains the public key of the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server.

The first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client then executes the EncryptQ function 3130. By executing the Encrypt() function in step 3130, the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client encrypts its own message using the public key of the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server from step 3040 using the RSA method. This function is not a standard C function. The client saves the encrypted message in a temporary buffer.

The first processor 10-1 of the computer (here the example micro-integrated circuit 2) of the client now executes the send() function in step 3140 and sends its encrypted message to the first processor 10-1 of the computer (here the example micro-integrated circuit 2) of the server. In the sense of this document, the send() function is a standard C function of the standard C library socket.h. By executing the send() function, the first processor 10-1 of the computer (here the example micro-integrated circuit 2) of the client sends data via a socket descriptor, in this case the client's socket descriptor from 3100.

The first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client then executes the function recv() 3150. In the process, the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client waits in step 3150 for an encrypted message from the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server. If the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client receives a message, the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client stores this received and typically encrypted message in a temporary buffer. In the sense of the present document, the function recv() is preferably a standard C function of the standard C library socket.h. The first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client reads incoming data from a socket descriptor, in this case from the socket descriptor of the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client from step 3100, by executing the function recv(). The first processor 10-1 of the The client's computer (here the exemplary micro-integrated circuit 2) preferably stores the read data in a temporary buffer of the client's computer (here the exemplary micro-integrated circuit 2).

If the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client has received an encrypted message in this way, the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client preferably executes the function DecryptQ in a step 3160. This function DeCryptQ is not a standard C function. The first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client decrypts an encrypted message of the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server received by the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client by executing the function Decrypt() using the private key of the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client from step 3120 using the RSA method. The first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client then stores the message decrypted in this way in a temporary buffer of the computer (here the exemplary micro-integrated circuit 2) of the client.

Thereafter, the communication between the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server and the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client starts again at step 3120.

If the communication is terminated by the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client or the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server, the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client executes the close() function in step 3170. The close() function is a standard C function of the standard C library socket.h. By executing the close() function, the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client closes the open connection to a socket and thus ends the communication with the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server. Figure 13

When starting the KeyExchangeServer() function, the first processor 10-1 of the computer (here the example micro-integrated circuit 2) of the server first calls the setPrimes() function in step 3200. This KeyExchangeServer() function is not a standard C function. The first processor 10-1 of the computer (here the example micro-integrated circuit 2) of the server uses the KeyExchangeServer() function to generate two different prime numbers p and q, the product n=p*q and the Euler phi function phi = (p-l)(q-l) in step 3200.

The first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server then calls the setE() function in step 3210. This setE() function in step 3210 is not a standard C function. When the setE() function is called in step 3210, the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server generates a number e that is coprime to phi, where the number phi is the number from step 3200. Coprime in the sense of this document means that there is no natural number other than the number one that divides the number e and phi at the same time.

The first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server then executes the findD() function in step 3220. This findD() function is not a standard C function. The first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server uses the findD() function to calculate the multiplicative inverse of e, so that (e*d)mod phi = 1.

Now the first processor 10-1 of the computer (here the example micro-integrated circuit 2) of the server calls the function recv() in step 3230. The first processor 10-1 of the computer (here the example micro-integrated circuit 2) of the server now waits for an incoming message from the first processor 10-1 of the computer (here the example micro-integrated circuit 2) of the client, which should typically include the client's public key. In the sense of this document, the function recv() is a standard C function of the standard C library socket.h. By calling the function recv(), the first processor 10-1 of the computer (here the example micro-integrated circuit 2) of the server reads the incoming data from a socket descriptor, in this case the socket descriptor of the client. The first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server preferably stores the read data in a temporary buffer of the computer (here the exemplary micro-integrated circuit 2). Now the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server calls the send() function in step 3240. In this step 3240, the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server sends its public key (d,n) from steps 3200 and 3220 to the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client. In the sense of this document, the send() function is a standard C function of the standard C library socket. i.e. the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server uses the send() function to send data via a socket descriptor, in this case the client's socket descriptor from step 3030.

Subsequently, the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server leaves the function KeyExchangeServer() in step 3245.

When starting the KeyExchangeClient() function, the first processor 10-1 of the computer (here of the example micro-integrated circuit 2) of the client first calls the setPrimes() function in step 3250. This function is not a standard C function. The first processor 10-1 of the computer (here of the example micro-integrated circuit 2) of the client uses the KexExchangeClient() function to generate the prime number p and the prime number q that is different from q. The first processor 10-1 of the computer (here of the example micro-integrated circuit 2) of the client uses the KexExchangeClient() function to generate the product n=p*q. The first processor 10-1 of the computer (here of the example micro-integrated circuit 2) of the client uses the KexExchangeClient() function to generate the Euler Phi function phi = (p-l)(q-l).

The first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client then calls the function setE() in step 3260. This function is not a standard C function. The first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client uses the function setE() to generate an integer e that is coprime to the number phi from step 3250. Coprime in the sense of this document means that there is no natural number other than the number one that simultaneously divides the number e and the phi without a remainder.

The first processor 10-1 of the client's computer (here the example micro-integrated circuit 2) then calls the function findD() 3270. This function is not a standard C function. The first processor 10-1 of the client's computer (here the example micro-integrated circuit 2) uses the function findD() to calculate the multiplicative inverse of the number e, so that (e*d)mod phi = 1. Now the first processor 10-1 of the computer (here the example micro-integrated circuit 2) of the client calls the send() function 3280 and sends its public key (d,n) from steps 3250 and 3270 to the first processor 10-1 of the computer (here the example micro-integrated circuit 2) of the server. In the sense of this document, the send() function is a standard C function of the standard C library socket.h. The first processor 10-1 of the computer (here the example micro-integrated circuit 2) of the client uses the send() function to send data via a socket descriptor, in this case the client's socket descriptor from step 3100.

Now the first processor 10-1 of the computer (here the example micro-integrated circuit 2) of the client calls the function recv() in step 3290. The first processor 10-1 of the computer (here the example micro-integrated circuit 2) of the client now waits for an incoming message from the first processor 10-1 of the computer (here the example micro-integrated circuit 2) of the server with the public key of the first processor 10-1 of the computer (here the example micro-integrated circuit 2) of the server. In the sense of this document, the function recv() is a standard C function of the standard C library socket.h. The first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client reads incoming data from the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server from a socket descriptor, in this case from the socket descriptor of the client from step 3100, using the recv() function and stores the data in a temporary buffer of the computer (here the exemplary micro-integrated circuit 2) of the client.

Subsequently, the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client leaves the function KeyExchangeClient() in step 3295.

Figure 14

FIG. 14 shows a schematic flow of the function setPrimes().

The first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client and the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server each call this function at the given time. If one of these first processors 10-1 calls the setPrimes() function, the calling processor 10-1, in the case of the present document the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server or the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client, a quantum random number using a quantum random number generator QRNG 28 in step 3300. This quantum random number has a bit width n. Here, n is a positive integer including zero. In the technical teaching of the document presented here, these quantum random numbers serve as indices for a look-up table of the first 2 ⁿ prime numbers. The calling first processor 10-1 stores the prime number, which is indexed by the quantum random number, as a variable p.

The calling first processor 10-1 then generates another quantum random number in step 3310 with the preferred bit width n using the quantum random number generator 28 QRNG. These quantum random numbers preferably serve the calling first processor 10-1 again as indices for a look-up table of the first 2 ⁿ prime numbers. The calling first processor 10-1 stores the prime number, which is indexed by the random number, as a variable q in a buffer of the computer (here the exemplary micro-integrated circuit 2), of which the first processor 10-1 is preferably a part.

Now the calling first processor 10-1 checks in step 3320 whether the logical statement q ==p is true. If this statement is true, step 3310 is repeated.

The calling processor 10-1 then calculates the product n = p * q in step 3330.

Then the calling processor 10-1 calculates the Euler phi function phi = (q-1) * (p-1) in step 3340.

The calling processor 10-1 then exits the setPrimes() function in step 3350.

Figure 15

Figure 15 shows the schematic sequence of the setE() function 3400. When the setE() function is called in step 3400, the caller, in the case of the present document the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server or the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client, generates a random number e which is coprime to the number phi. Coprime in the sense of the present document means that there is no natural number other than the number one that divides the number e and phi at the same time. The calling processor 10-1 can generate the number e both by a random number from the quantum random number generator 28 QRNG and by a pseudo-random number generator PRNG and by iterating up an integer number starting with 2. However, generation using the quantum random number generator 28 QRNG is preferred. Then, the calling processor 10-1 checks in step 3410 whether the logical statement gcd(e,phi) 1= 1 is satisfied.

If the logical statement is fulfilled, the calling processor 10-1 repeats step 3400.

If the logical statement is not fulfilled, the calling processor 10-1 exits the setE() function and returns the current value of e to the calling processor 10-1. The gcd(a,b) function is not a standard C function. The calling processor 10-1 uses this gcd(a,b) function to calculate the greatest common divisor of the parameters a, b and returns the result to the calling processor 10-1.

Figure 16

Figure 16 shows the schematic flow of the findD() function. When the calling processor 10-1 calls the findD() function in step 3500, the calling processor 10-1 initializes a variable d with 0 in step 3500.

In the subsequent step 3510, the calling processor 10-1 adds the number 1 to the number d.

Now, in step 3520, the calling processor 10-1 checks whether the logical statement (e*d) (mod phi) == 1 is true. If the logical statement (e*d) (mod phi) == 1 is not true, the calling processor repeats the steps from step 3510.

If the logical statement (e*d) (mod phi) == 1 is fulfilled, then in step 3530 the calling processor 10-1 leaves the function findD() and the calling processor 10-1 returns the current value of d to the calling processor 10-1, in the case of the present document the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server or the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client.

Figure 17

Figure 17 shows the schematic sequence of a secure transmission of quantum-based random numbers between a first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of a server 3600 and a first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of a client 3610. In the case of the present document, the server 3600 is a first processor 10-1 of a computer (here the exemplary micro-integrated circuit 2), wherein the computer (here the exemplary micro-integrated circuit 2) of this server 3600 has a quantum random number generator 28 Q.RNG. In the case of the present document, the client 3610 is another first processor 10-1 of a computer 2, wherein this computer (here the exemplary micro-integrated circuit 2) of the client 3610 should NOT have a quantum random number generator 28 Q.RNG.

At the beginning, the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server 3600 generates quantum random numbers QZ1. The quantum random numbers QZ1 serve the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server 3600 as a basis for generating a private and a public key of the server 3600 according to an asymmetric encryption method.

The asymmetric encryption method can, for example, be the RSA method.

In a step 3620, the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server 3600 sends the public key of the server 3600 via a non-tap-proof channel to the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client 3610.

The first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client 3610 then generates a pseudo-random number PZ or a random number generated in another way. The first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client 3610 stores the pseudo-random number PZ or the random number generated in another way in a memory of the computer (here the exemplary micro-integrated circuit 2) of the client 3610. The first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client 3610 generates a first private key of the client 3610 and a first public key of the client 3610 using this pseudo-random number PZ or this random number generated in another way.

The first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client 3610 encrypts the first public key of the client 3610 using the public

Server 3600 key. The first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client 3610 then sends the encrypted first public key of the client 3610 to the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server 3600.

The first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server 3600 now decrypts this message with its first private key. As a result, the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server 3600 now has the first public key of the client 3610 without this being known to third parties.

The first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server 3600 then generates a further, second quantum random number QZ2 using the quantum random number generator 28. The bit width of this second quantum random number is preferably equal to the bit width of the random number PZ of the client 3610.

The first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server 3600 now encrypts the second quantum random number QZ2 with the first public key of the client 3610. For example, the first public key of the client 3610 can be the client's. In this case, the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server 3600 can encrypt the second quantum random number QZ2, for example by bitwise XORing the second quantum random number QZ2 with PZ to form an encrypted second quantum random number QZ2'. The first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server 3600 then preferably sends the encrypted second quantum random number QZ2' to the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client 3610 in a step 3640.

The first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client 3610 decrypts the encrypted second quantum random number QZ2' using its first private key to form the second quantum random number QZ2. If the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) has determined the second encrypted quantum random number QZ2' by bitwise XORing the random number PZ with the second quantum random number QZ2, the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client 3610 can decrypt the encrypted second quantum random number QZ2' with the random number PZ known to it, for example by bitwise XORing the encrypted second quantum random number QZ2' with the random number PZ known to it to form the second quantum random number QZ2. Preferably, the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client 3610 uses the second quantum random number QZ2 that it now has as a basis for generating a second private key and a second public key according to an asymmetric encryption method. The asymmetric encryption method can be, for example, the RSA method (APPENDIX). The first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client 3610 now sends its second public key to the server 3600 via the non-tap-proof channel. In doing so, it preferably encrypts this second public key of the client 3610 with the public key of the server 3600. The server 3600 decrypts the encrypted second public key of the client 3610 and then uses this second public key of the client to encrypt further messages to the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client 3610. Preferably, the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server 3600 generates and sends after a predetermined time or after sending a predetermined amount of data to the processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the Clients 3610 generate a new public key based on a new quantum random number from its quantum random number generator 28 QRNG encrypted with the second public key of the client 3610. Preferably, the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server 3600 and the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client then carry out the previously described process again so that the keys change permanently. This also makes it impossible for a quantum computer to break the keys.

This means that after exchanging these keys, communication can be carried out based on the selected asymmetric encryption method.

Figure 18

The method 3700 begins with the generation 3710 of a random single photon stream (57, 58, 59, 44) by means of one or more photon sources 54 or one or more silicon LEDs 54 or one or more first SPAD diodes (54), which are preferably manufactured in one piece in a semiconductor material 49. The method 3700 continues with the transmission 3720 of the random single photon stream (57, 58, 59, 44), for example by means of an optical waveguide 44 different from the semiconductor substrate (49, 48) or by means of the semiconductor substrate 49 as an optical waveguide or by means of direct irradiation to one or more photon detectors 55 or one or more second SPAD diodes 55.

This is followed in the method 3700 by the conversion 3730 of the random single photon stream (57, 58, 59, 44) into a detection signal in the form of a voltage signal 405 of the entropy source 401, which preferably comprises the photon sources 54 or the silicon LEDs 54 or the first SPAD diodes 54 and the optical system for optical coupling and the photon detectors 55 or the second SPAD diodes 55. The optical system can comprise a direct optical coupling of these components and/or comprise an optical waveguide 44.

Then, in the method 3700, the processing 3740, in particular amplifying and/or filtering and/or analog-to-digital converting, of the detection signal into a processed detection signal, in particular a digital 14-bit value 407 of the analog-to-digital converter 403 or a 1-bit analog-to-digital converter, follows.

Then, in the method 3700, the pulses of the conditioned detection signal generated by coupling the emissions of a photon source 54 or a silicon LED 54 or a first SPAD diode 54 on the one hand and a photon detector 55 or a second SPAD diode 55 on the other hand are optionally separated 3750 from the pulses of the conditioned detection signal generated by spontaneous emission by comparing the conditioned detection signal with a threshold value, in particular in a comparator 404.2 and generating a corresponding output signal 409, in particular of the comparator 404.2. If necessary, the analog-to-digital converter 403 can generate the output signal 409 directly if it is a 1-bit analog-to-digital converter 403. In this respect, this step 3750 is optional and is therefore only shown in dashed lines.

This is followed by the determination 3760 of a first pseudorandom number as a function of a first time interval between the first pulse and the second pulse of a first pair of two successive pulses of the processed detection signal, which pulses are generated by optical coupling of the emissions of a photon source 54 or a silicon LED 54 or a first SPAD diode 54 on the one hand and a photon detector 55 or a second SPAD diode 55 on the other hand, as the first value of the output 410 of the time-to-pseudorandom number converter 404.3.

Then follows the determination of 3765 second first pseudorandom number depending on a second time interval between the third pulse and the fourth pulse of a second pair of two successive pulses of the conditioned detection signal, produced by optical coupling of the emissions of a photon source 54 or a silicon LED 54 or a first SPAD diode 54 on the one hand and a photon detector 55 or a second SPAD diode 55 on the other hand, as the second value of the output 410 of the time-to-pseudo-random number converter 404.3.

On this basis, the bit value of a quantum random bit 411 is then determined 3670 by comparing the value of the first pseudorandom number and the value of the second pseudorandom number.

In a final check 3680, the first processor 10-1 of the computer (here of the exemplary micro-integrated circuit 2) and/or a finite state machine 404.8 check whether the number n of random bits determined is still smaller than the desired number m of random bits of the desired quantum random number. If this is not the case, the first processor 10-1 of the computer (here of the exemplary micro-integrated circuit 2) and/or finite state machine 404.8 repeat the above steps 3710 to 3770. Otherwise, the processor 10-1 of the computer (here of the exemplary micro-integrated circuit 2) or the finite state machine 404.8 terminate the process for generating a quantum random number. If necessary, the finite state machine 404.8 makes the quantum random number available to the processor 10-1 and preferably signals this availability to the processor 10-1, for example by an interrupt via an interrupt signal 420 or by setting a flag.

Preferably, the processor 10-1 and/or the finite state machine 404.8 control this process of generating a quantum random number.

Figure 19

Figure 19 shows another exemplary proposal for a one-piece, monolithic integrated circuit 2, for example a microcontroller.

The exemplary one-piece, monolithic integrated circuit 2, for example the microcontroller, here comprises one or more processors 10-1, 10-2; a bus arbiter 82; an internal data bus 419; a read-only memory ROM 19; a volatile random access memory RAM 8; a first non-volatile, multi-programmable memory NVM 6; a second non-volatile, multi-programmable memory NVM 30; a first non-volatile, only once programmable memory OTP I 20; a second non-volatile, only once programmable memory OTP II 22; a test controller 12, in particular a JTAG test controller; a circuit (block) 24 for deactivating tests; one or more data bus interfaces 64; a tightly coupled memory TCM 14; an interface 32 to a system 32 controlled by the integrated circuit 2, for example by the microcontroller; a Quantum random number generator 28; a reset circuit 83; an analog input processing 84, an analog-to-digital converter 85; a digital signal processing 86; one or more digital-to-analog converters 87; an analog output processing 88; one or more voltage converters 91;

The one voltage converter 91 or the multiple voltage converters 91 generate the necessary internal operating voltages of the integrated circuit 2, for example the microcontroller, from the external supply voltages. Since the entropy source 401 in particular generally requires a higher operating voltage than the supply voltages provided externally, at least one of the voltage converters 91 preferably comprises a charge pump or the like. Typically, such voltage converters 91 here comprise DMOS transistors.

An analog input processor 84 acquires one or more external analog signals 89 and prepares them for analog-to-digital conversion. For example, the analog input processor 84 may include one or more amplifiers, filters, analog adders, analog multipliers, logarithmizers, exponentiators, voltage sources, current sources, and/or other analog circuits for adapting, enhancing, or modifying the external analog signals 89.

An analog-to-digital converter 85 can then convert the external analog signals 89 thus processed into a data stream of digital samples of the external analog signals 89, for example with a sampling frequency that typically depends on the system clock 2106.

A digital signal processor 86 can then convert the digitized and processed external analog signals 89 into digital output signals using circuits that carry out circuit-implemented methods and/or computer-implemented methods. The digital signal processor 86 can also generate new digital output signals. The digital signal processor 86 typically works with the system clock 2106. When generating these two output signal groups, the digital signal processor 86 can use quantum random numbers from the quantum random number generator 28. If the digital signal processor 86 is to generate a modulated excitation signal for a sensor, for example, and is to evaluate a response signal from this sensor as an external analog signal 89 after processing and digitization, it is useful in some applications, for example, if the digital signal processor 86 uses such a quantum random number as a spreading code for generating the excitation signal of the sensor and then searches for and detects this spreading code in the external analog signal 89, for example using a synchronous demodulator. The digital-to-analog converter(s) 87 converts the digital output signals of the digital signal processing 86 to internal analog output signals.

The analog output processing 88 processes the analog internal output signals into analog output signals 90. For example, the analog output processing 88 can include filters, amplifiers and power amplifiers.

The rest circuit 83 brings the integrated circuit 2, for example the microcontroller, into a predefined state. Such a reset can occur, for example, when the operating voltage is switched on or when the operating voltage drops or when one of the processors 10-1, 10-2 requests such a rest from the reset circuit 83, for example via the data bus 419 or a SW rest signaling line, or when a means for monitoring the correct functioning of the quantum random generator 28 (watchdog 404.5, voltage monitor 2013) detects an error from a predefined set of errors. This enables the system to be restarted.

The quantum random number generator 28 preferably has the features presented here. Most preferably, the quantum random number generator 28 comprises a time-to-pseudo-random number generator 404.3.

Preferably, the quantum random number generator 28 comprises means for monitoring the correct functioning of the quantum random number generator 28. Such means can be, for example, a voltage monitor 413 and/or a watchdog 404.5. These means typically generate an interrupt signal 420 in the event of an error and/or a suspected attack.

Other circuit parts of the integrated circuit 2, for example the microcontroller, can also trigger interrupts using additional interrupt lines. An interrupt logic in the processors controls the behavior of the processors 10-1, 10-2.

Preferably, the processors 10-1, 10-2 execute computer-implemented methods, the program code of which they retrieve from memories of the device during execution and execute. In one or more of these computer-implemented methods, the processors 10-1, 10-2 use quantum random numbers of the quantum random number generator 28. If the means of the quantum random number generator 28 for monitoring the correct functioning of the quantum random number generator 28, for example by means of the interrupt line 420, signal an error in the quantum random number generator 28, the processors 10-1, 10-2 preferably execute other computer-implemented replacement methods instead of these computer-implemented methods or modify parameters of these computer-implemented methods or execute These computer-implemented methods preferably no longer exist at all, at least as long as the error no longer exists.

The circuit (block) 24 for deactivating tests, also referred to here as the deactivation circuit, is preferably able to control and prevent or allow access by meta-customers of the customers of the semiconductor manufacturer and the customers of the semiconductor manufacturer and the analysis department of the semiconductor manufacturer of the integrated circuit 2, for example the microcontroller, to circuit parts and contents of memories of the integrated circuit 2, for example the microcontroller. Typically, the deactivation circuit 24 can, for example, allow or prevent the activation of predetermined test modes. This can include, for example, the activation of scan paths and access to memory contents.

Preferably, the processor 10-1, 10-2 can only influence some of the accesses by reconfiguring the deactivation circuit 24. Thus, certain circuit and memory areas are not accessible for access after processor activation by a processor 10-1, 10-2. These circuit and memory areas are thus protected against processor activation of the access. It can be provided that no processor activation at all is possible by a processor 10-1, 10-2.

Preferably, the test interface (JTAG interface) 12 can only influence some of the accesses by reconfiguring the deactivation circuit 24. Thus, certain circuit and memory areas are not accessible for access after test controller activation by the test interface (JTAG interface) 12. These circuit and memory areas are thus protected against access by test controller activation. It can be provided that no test controller activation at all is possible through the test interface (JTAG interface) 12.

Access can be activated, for example, by writing access codes into the second non-volatile, once-programmable memory OTP II 22.

The contents of the first, non-volatile and only once programmable memory OTP I 20 can, for example, include critical system parameters (CSPs).

The contents of the second, non-volatile and only once programmable memory OTP II 22 can include, for example, access codes.

The first volatile, multi-programmable memory NVM 6 may comprise an EEPROM and/or a flash memory or the like. The memory content of the first volatile, multi-programmable memory programmable memory NVM 6 may, for example, include records 61 and signatures 61.

The volatile random access memory RAM 8 may comprise an SRAM and/or a DRAM or the like. The second processor 10-2 is intended to be optional in Figure 19.

The bus arbiter 82 regulates the access of the device parts of the exemplary one-piece, monolithic integrated circuit 2, for example the microcontroller, which want to gain active write access to the internal data bus 419. In the case of Figure 19, these are the two processors 10-1, 10-2.

The above description is not intended to be exhaustive and does not limit this disclosure to the examples shown. Other variations to the disclosed examples can be understood and practiced by those of ordinary skill in the art from the drawings, the disclosure and the claims. The indefinite articles "a" or "an" and their inflections do not exclude a plurality, while the mention of a certain number of elements does not exclude the possibility of more or fewer elements being present. A single unit may perform the functions of several elements mentioned in the disclosure, and conversely, several elements may perform the function of a unit. Numerous alternatives, equivalents, variations and combinations are possible without departing from the scope of the present disclosure.

Unless otherwise stated, all features of the present invention can be freely combined with one another. This applies to the entire document presented here. The features described in the description of the figures can also be freely combined with the other features as features of the invention, unless otherwise stated. A restriction of individual features of the exemplary embodiments to the combination with other features of the exemplary embodiments is expressly not intended. In addition, material features of the device can be reformulated and used as process features, and process features can be reformulated as material features of the device. Such a reformulation is therefore automatically disclosed.

Figure 20

Figure 20 shows a device similar to the device of Figures 8 and 9. In contrast to Figures 8 and 9, the quantum random number generator 28 in Figure 20 does not comprise a high frequency amplifier 402 and an analog-digital converter (ADC) 403 with a width of 14 bits and a comparator 404.1 and a constant 404.1. The device of Figure 20 is suitable for forming a quantum random number generator 28 in which the photon source 54 and the Photon detector 55 are electrically connected in series. In this case, the stimulated emissions can no longer be distinguished from the dark count.

One problem is that the pulses on the voltage signal 405 of the entropy source 401 are usually shorter than the frequency of the system clock 2106. This means that a direct sampling of the voltage signal 405 of the entropy source 401 with a sampling frequency equal to the frequency of the system clock 2106 no longer satisfies the Nyquist condition. Therefore, the exemplary 1-bit analog-digital converter (ADC) 403 is followed by a pulse extension circuit 2023 which extends a pulse on the voltage signal 405 of the entropy source 401 to a time length greater than one clock period of the system clock 2106 and preferably ends the generated pulse synchronously with the system clock 2106, so that the pulse on the voltage signal 405 of the entropy source 401 can be reliably synchronized by a subsequent flip-flop. The processor 10-1, 10-2 generated in this way can preferably access the registers of the watchdog 404.5, the memory RAM 404.9 or the FIFO 404.9 and the finish flag 404.10 via the internal data bus 419 and read them and, as far as permitted or possible, write them. The finish flag 404.10 preferably signals to the processor 10-1, 10-2 via an interrupt line (not shown) that a new quantum random number is available in the RAM/FIFO 404.9. Reading the contents of the RAM/FIFO preferably clears this finish flag 404.10 again. In order to save energy, it is sensible to switch off device parts of the quantum random number generator 28 when the finish flag 404.10 is set. Preferably, the processor 10-1, 10-2 can access device parts of the quantum random number generator 28 via the data bus 419 and switch certain parts of the quantum random number generator 28 on and off by setting or deleting flags in the registers of these device parts. These device parts can be, for example: the voltage monitor 419, a voltage converter 91 of the quantum random number generator 28, in particular a charge pump for supplying the entropy source 401, the ADC 403, the pulse extension circuit 2023, the time-to-pseudo-random number converter (TPRC) 404.3, the entropy extraction 404.4, the finite state machine 404.8. Preferably, the watchdog 404.5 evaluates these register bits and checks whether an enable register inside it has a permissible authentication code for these switches on or off. The finite state machine 404.8 preferably also evaluates these flags and preferably only allows the generation of quantum random numbers 418 when all parts of the quantum random number generator 28 are working.

The synchronized voltage signal 415 can then be processed as described above. With regard to the remaining device parts, the document presented here refers to the preceding descriptions. Figure 21

Figure 21 shows an example of a time-to-pseudorandom number converter 404.3. The key idea here is to use a pseudorandom number generator 404.3 in the quantum random number generator 28 instead of a digital counter as in the prior art, which generates the first and second values for the entropy extraction 404.4. The document presented here refers to Figure 18 for the corresponding process. The advantage is that even if a disturbance is successfully introduced into the synchronized voltage signal 415, the randomness of the quantum random bit 411 is only marginally disturbed, since the attacker would also have to know the feedback polynomial. However, this is also randomly selected according to the proposal. The same applies to the seed value of the pseudorandom number generator, which the attacker would also have to determine. Another advantage of a pseudorandom number generator instead of a counter is the smaller area required for the feedback logic of a simple, primitive feedback polynomial compared to a binary counter. If the linear feedback shift register of the pseudorandom number generator is long enough, a unique pseudorandom number is typically assigned to each clock pulse between two pulses of the voltage signal 405 of the entropy source 401. Preferably, the shift register controller 2103 of the time-to-pseudorandom number converter 404.3 (TPRC) starts the generation of a pseudorandom number by the shift register of the time-to-pseudorandom number converter 404.3 (TPRC) with a first pulse on the voltage signal 405 of the entropy source 401 and ends the generation of the pseudorandom number with a subsequent second pulse on the voltage signal 405 of the entropy source 401.

In order to make tapping even more difficult, it is useful if, for example, the quantum random number generator 28 changes the feedback polynomial of the linearly feedback shift register of the pseudorandom number generator of the time-to-pseudorandom number converter 404.3 (TPRC) after the complete determination of a number m of random quantum bits 411 as a function of one or more previously determined random quantum bits 411.

The following simple primitive feedback polynomials are known from the literature, for example:

As can easily be seen, the number of XNOR operations is very limited, which makes the linear feedback shift registers very fast. The longest chain listed has a length of 2 ¹⁶⁸ -1 clock cycles with a shift register length of n=168 shift register bits. At a GHz=10 ⁹ Hz, a period lasts 2 ¹⁵⁹ seconds, or in other words about 2 ¹⁵³ minutes, or in other words about 2 ¹⁴⁷ hours, or in other words about 2 ¹⁴² days, or in other words (very roughly) about 2 ¹³¹ years. It obviously takes too long to solve the problem in a finite time with a normal computer. This, in combination with a permanent quantum random number key change, makes it almost impossible for an attacker to break the corresponding barrier. In order to prevent the protection of the quantum random number generator 28 from being broken, it is also useful if, for example, the quantum random number generator 28 changes the shift register length n of the linear feedback shift register of the pseudorandom number generator of the time-to-pseudorandom number converter 404.3 (TPRC) after the complete determination of a number k of random quantum bits 411 depending on one or more previously determined random bits. For this purpose, it is useful if the shift register controller 2103 of the time-to-pseudorandom number converter 404.3 (TPRC) or a processor (10-1, 10-2) rewrites the value of the feedback polynomial selection register 2112 for this purpose. The value stored in the feedback polynomial The value stored in the selection register 2112 preferably controls the feedback multiplexer 2102 of the time-to-pseudo-random number converter 404.3 (TPRC). Thus, the value stored in the feedback polynomial selection register 2112 preferably selects which feedback polynomial of the m feedback polynomial circuits RKNi to RKN _m determines the logical value of the shift register reload value line 2104 of the time-to-pseudo-random number converter 404.3 (TPRC). Preferably, by means of a line 2022 for preventing the use of a quantum random bit 411 by the finite state machine 404.8, the shift register controller 2103 of the time-to-pseudo-random number converter 404.3 (TPRC) or one of the processors (10-1, 10-2) or another device prevents the forwarding of a generated quantum random bit 411 by the finite state machine 404.8 when this random bit 411 is used for the feedback polynomial selection register 2112. This prevents double use and thus increases security. Instead, the shift register controller 2103 of the time-to-pseudorandom number converter 404.3 (TPRC) or the processor (10-1, 10-2) or the other device preferably uses this random bit 411 to generate a random data word for storage in the feedback polynomial selection register 2112. This has the advantage that the feedback polynomial of the m feedback polynomial circuits RKNi to RKN _m selected by the feedback polynomial selection register 2112 is completely random. This means that it is no longer possible for an attacker to feed in a deterministic bit data stream instead of the data bit stream of the quantum random bits 411, even if an attack on the entropy source 401 is successful.

In order to further harden the proposed micro-integrated quantum random number generator 28, it is also useful if, for example, the quantum random number generator 28 changes the start value (seed value) of the linear feedback shift register of the pseudorandom number generator of the time-to-pseudorandom number converter 404.3 (TPRC) after the complete determination of a number p of random quantum bits 411 depending on one or more previously determined random bits. For this purpose, it is useful if the shift register controller 2103 of the time-to-pseudorandom number converter 404.3 (TPRC) or a processor (10-1, 10-2) rewrites the value of a seed reload register in the shift register controller 2103 of the time-to-pseudorandom number converter 404.3 (TPRC) with random bits for this purpose. The bit width of a seed reload register in the shift register controller 2103 of the time-to-pseudo-random number converter 404.3 (TPRC) preferably corresponds to the number n of the shift register bits SBi to SB _n of the time-to-pseudo-random number converter 404.3 (TPRC). The shift register controller 2103 of the time-to-pseudo-random number converter 404.3 (TPRC) preferably counts the number of successfully generated quantum random bits 411. For this purpose, the finite state machine 404.8 preferably signals the generation of a valid random bit to the shift register controller 2103 of the time-to-pseudo-random number converter 404.3 (TPRC). Instead of counting the valid quantum random bits 411, it is also possible to count the successfully generated random data words 418 in the finite state machine 404.8. The shift register controller 2103 of the time-to-pseudo-random number converter 404.3 (TPRC) preferably loads the new seed value of a seed reload register in the shift register controller 2103 into the shift register bits SBi to SB _n of the time-to-pseudo-random number converter 404.3 (TPRC) in one or more of the following events.

This reliably prevents any kind of predictability.

Preferably, by means of a line 2022 for preventing the use of a quantum random bit 411 by the finite state machine 404.8, the shift register controller 2103 of the time-to-pseudo-random number converter 404.3 (TPRC) or one of the processors (10-1, 10-2) or another device prevents the forwarding of a generated quantum random bit 411 by the finite state machine 404.8 when this random bit 411 is used for the seed reload register in the shift register controller 2103 in the time-to-pseudo-random number converter 404.3 (TPRC). This prevents double use and thus increases security. Instead, the shift register controller 2103 of the time-to-pseudo-random number converter 404.3 (TPRC) or the processor (10-1, 10-2) or the other device preferably uses this random bit 411 to generate a random data word for storage in the seed reload register in the shift register controller 2103. This has the advantage that the

Seed reload register in the shift register controller 2103 selected seed value of the linear feedback shift register of the n shift register bits SBi to SB _n is completely random. Since a If the linear feedback shift register has two cycles when using simple primitive feedback polynomials, one of which only includes a shift register value, this one-cycle shift register value must be prevented. If the random reload value of the seed reload register in the shift register controller 2103 corresponds to the one-cycle seed value of the linear feedback shift register with the current feedback polynomial or the next intended feedback polynomial, the shift register controller 2103 of the time-to-pseudorandom number converter 404.3 (TPRC) or one of the processors (10-1, 10-2) or another device generates a new random reload value in the seed reload register of the shift register controller 2103.

Preferably, the m feedback polynomials RKNi to RKN _m are selected such that the one-cycle seed values are equal. This reduces the effort required to detect the one-cycle shift register value, since this no longer depends on the selected feedback polynomial of the feedback polynomials RKNi to RKN _m . In any case, it is recommended that the time-to-pseudorandom number converter 404.3 (TPRC) includes a detection circuit 2113 for detecting an illegal value of the state vector of the n shift register bits SBi to SB _n when linear feedback shift registers are used. If the state vector of the n shift register bits SBi to SB _n is in such an illegal state, the detector 2113 preferably signals this illegal state to the shift register controller 2103 of the time-to-pseudo-random number converter 404.3 (TPRC) or one of the processors (10-1, 10-2) or another device. The detector 2113 or the shift register controller 2103 of the time-to-pseudo-random number converter 404.3 (TPRC) or the processor (10-1, 10-2) or the other device then resets the value of the state value of the state vector of the n shift register bits SBi to SB _n to a predetermined value and/or the value of the seed reload register in the shift register controller 2103. These reload values are preferably different from the one-cycle shift register value. This preferably also occurs when the watchdog 404.5 and/or the voltage monitor 413 detect a fault or a suspected or possible attack. The shift register controller 2103 of the time-to-pseudo-random number converter 404.3 (TPRC) preferably counts the number of these faults. Preferably, the shift register controller 2103 of the time-to-pseudo-random number converter 404.3 (TPRC) reduces this counter value again depending on the number of random quantum bits 411 and/or random data words 418 successfully generated, in particular since the last disturbance. If this number and/or the event density of such events exceeds a certain predetermined temporal density and/or a certain numerical value, the shift register controller 2103 of the time-to-pseudo-random number converter 404.3 (TPRC) signals a defect in the quantum random number generator 28 or a successful Attack on the quantum random number generator 28. Typically, the shift register controller 2103 of the time-to-pseudo-random number converter 404.3 (TPRC) then signals the finite state machine 404.8 that no more random numbers may be generated. Preferably, a processor (10-1, 10-2) must then reactivate the shift register controller 2103 of the time-to-pseudo-random number converter 404.3 (TPRC) using a predetermined reactivation code word. The processor (10-1, 10-2) then writes this reactivation code word via the internal data bus 419 of the quantum random number generator 28 into a special reactivation register of the shift register controller 2103 of the time-to-pseudo-random number converter 404.3 (TPRC), which reactivates the shift register controller 2103 of the time-to-pseudo-random number converter 404.3 (TPRC) and the quantum random number generator 28 and preferably resets all error counters. The number of possible reactivations is preferably limited. If the maximum number of reactivations is exceeded, the quantum random number generator 28 can preferably no longer be reactivated. The counter for the reactivations of the quantum random number generator 28 can preferably be reset by means of a special reset command before this maximum value is reached. Preferably, the shift register controller 2103 of the time-to-pseudorandom number converter 404.3 (TPRC) of the quantum random number generator 28 or another device of the quantum random number generator 28 issues a warning before reaching this blocking limit.

When the quantum random number generator 28 is started, the shift register controller 2103 of the time-to-pseudo-random number converter 404.3 (TPRC) first ensures that the shift register controller 2103 of the time-to-pseudo-random number converter 404.3 (TPRC) first determines a new seed value based on quantum random numbers 411 and a new value of the feedback polynomial selection register 2112 based on quantum random numbers from quantum random bits 411 by means of a predetermined seed value and a predetermined value of the feedback polynomial selection register 2112. Only when the seed value and the value of the feedback polynomial selection register 2112 are based on quantum random numbers is the initialization phase of the quantum random number generator 28 completed and the shift register controller 2103 of the time-to-pseudo-random number converter 404.3 (TPRC) signals the finite state machine 404.8 that it may use and pass on the quantum random bits 411 and the quantum random data words 418 (quantum random numbers). The finite state machine 404.8 preferably signals this fact to one or more processors (10-1, 10-2). This has the advantage that the device only generates quantum random numbers 418 generated with full protection.

By using a time-to-pseudorandom number generator 404.3 (TPRC), it is possible for a

Attackers can no longer use a deterministic bit stream instead of the data bit stream the quantum random bits 411, even if an attack on the entropy source 401 is actually successful for whatever reason.

In order to prevent this, it is also useful if, for example, the quantum random number generator 28 changes this number m after the complete determination of a number m of quantum random bits 411 depending on one or more previously determined random bits.

Typically, the time-to-pseudo-random number generator 404.3 (TPRC) uses the logic value of the shift register reload value line 2104 of the time-to-pseudo-random number converter 404.3 (TPRC) as the value of the output 410 of the time-to-pseudo-random number converter 404.3 (TPRC). If necessary, a buffer amplifier can be provided which uses the logic value of the

Shift register reload value line 2104 of time-to-pseudo-random number converter 404.3 (TPRC) and output as the value of output 410 of time-to-pseudo-random number converter 404.3 (TPRC).

If the first pseudorandom number 410.1 and the second pseudorandom number 410.2 are the same, the entropy extraction 404.4 discards one of the two pseudorandom numbers, the first pseudorandom number 410.1 or the second quantum random number 410.2, and replaces it with a new pseudorandom number 410.3 from the time-to-pseudorandom number converter 404.3 (TPRC). The entropy extraction 404.4 preferably uses a counter to count the events in which the two pseudorandom numbers, the first pseudorandom number 410.1 and the second pseudorandom number 410.2, are the same and increases the counter by a first counter step size with each such event. Preferably, the entropy extraction 404.4 also counts the events in which the two pseudorandom numbers, the first pseudorandom number 410.1 and the second pseudorandom number 410.2, are unequal using this counter and decrements the counter by a second counter step size with each such event, preferably not falling below the value 0. Preferably, the second counter step size is smaller in magnitude than the first counter step size of the counter in the entropy extraction 404.4. If the value of this counter is a exceeds a predetermined value, the control device of the entropy extraction 404.4 assumes a defect in the time-to-pseudorandom number converter 404.3 (TPRC). The control device of the entropy extraction 404.4 then preferably signals a processor (10-1, 10-2) a defect in the quantum random number generator 28 or a successful attack on the quantum random number generator 28. The entropy extraction 404.4 then preferably no longer signals the finite state machine that a quantum random bit 411 has been successfully generated, so that the finite state machine 404.8 can no longer report successful quantum random number generation to a processor (10-1, 10-2) and no longer generates quantum random numbers 418.

By using quantum random numbers from quantum random bits 411 for the seed value of the linear feedback shift register of the time-to-pseudo-random number converter and a quantum random number for the selection of the simple primitive feedback polynomial, the behavior of the time-to-pseudo-random number converter 404.2 (TPRC) itself is at a random level of a quantum random number. By regularly changing these values, it is made even more difficult for an attacker to influence the generated quantum random numbers. Therefore, the proposed quantum random number generator 28 achieves all of the above-mentioned goals.

It is also an object of the proposal to provide a one-piece, micro-integrated quantum random number generator 28 which, compared to the quantum random number generators of the prior art, has a more compact, more robust and less complex and, above all, micro-integrated and CMOS compatible structure which allows one-piece manufacture and co-integration into conventional systems such as memories (such as DRAMS, SRAMS, flash memories and the like) or processors (microprocessors and/or microcontrollers and/or SoCs by means of a processor on the IC).

Figure 22

The diagram shown in Figure 22 represents the detection of the pulses (2201, 2202, 2203, 2204) on the voltage signal 405 of the entropy source 401. The entropy source 401 preferably comprises the one or more photon sources 54 or the one or more silicon LEDs 54 or the one or more SPAD diodes 54 and the light transmission path 44 between them. The entropy source 401 is preferably manufactured in or on the semiconductor substrate 49 and thus preferably part of the micro-integrated circuit of the quantum random number generator 28. The output signal 405 of the entropy source 401 is typically the said voltage signal 405 of the entropy source 401. The voltage signal 405 of the entropy source 401 is preferably the signal of one or more photon detectors 55 or one or more second SPAD diodes 55 of the entropy source 401.

In the example of Figure 22, the pulse extension circuit 2023 is designed, for example, such that it goes to a first logic level for at least three subsequent clock pulses of the system clock 2106 and then falls back to the second logic level until the next event, here for example with the falling edge of the third clock pulse. Instead of three clock pulses, a to n clock pulses can be used, where a whole positive number is greater than 0.

In the example of Figure 22, the falling edges of the pulses 2211, 2212, 2213, 2214 of the synchronized voltage signal 415 represent the synchronized signals of the entropy source 401. With a falling edge of a first pulse 2211 of the synchronized voltage signal 415, the time-to-pseudorandom number converter (TPRC) resets a pseudorandom number generator, for example, to a predefined seed value. For example, the pseudorandom number generator of the time-to-pseudorandom number converter (TPRC) can be a feedback shift register that shifts its values by one place to the left or right depending on the design with each clock pulse of the system clock 2106 and feeds the feedback value of the feedback polynomial back into the bit that becomes free.

With the next falling edge of the third pulse 2213 synchronized voltage signal 415, a second pseudorandom number register takes over the last status of the pseudorandom number generator and the time-to-pseudorandom number converter (TPRC) preferably resets the pseudorandom number generator to the predefined seed value. The entropy extraction 401 compares the value in the first pseudorandom number register with the value in the second pseudorandom number register. If the first value in the first pseudorandom number register is greater than the second value in the second pseudorandom number register, the entropy extraction 404.4 can, for example, generate a random bit with a first logical level. If the second value in the first pseudorandom number register is greater than the second value in the second pseudorandom number register, the entropy extraction 404.4 can, for example, generate a random bit with a second logical level that is different from the first level.

With the next falling edge of the fourth pulse 2214 of the synchronized voltage signal 415, the first pseudorandom number register takes over the previous value of a second pseudorandom number register and the second pseudorandom number register instead takes over the last status of the pseudorandom number generator and the time-to-pseudorandom number converter (TPRC) preferably resets the pseudorandom number generator to the predefined seed value. The entropy extraction 401 then compares the value in the first pseudorandom number register with the value in the second pseudorandom number register. If the first value in the first pseudorandom number register is greater than the second value in the second pseudorandom number register, then the entropy extraction 404.4 can, for example, generate another new and here second quantum random bit 411 with a first logical level. If the second value in the first pseudorandom number register is greater than the second value in the second pseudorandom number register, then the entropy extraction 404.4 can, for example, generate another new and here second quantum random bit 411 with a second logical level that is different from the first level.

Figure 23

Figure 23 shows an example of a voltage converter 91 for supplying the entropy source 411 with a sufficient operating voltage of the supply voltage line V _E NT of the entropy source 411 relative to the reference potential line GND at the reference potential. The voltage converter 91 corresponds to that of Figure 20. In this respect, Figure 23 is a section of Figure 20, with only the most important parts being shown for better clarity.

The voltage converter 91 of Figure 23 is only one example of several possible voltage converter designs. The voltage converter is only intended as an example to explain the possible use of DMOS transistors in a proposed quantum random number generator 28 or an integrated circuit 2, for example a microcontroller, with such a quantum random number generator 28.

The voltage converter 91 of Figure 23 comprises a first half-bridge. In the example of Figure 23, the reference potential line GND and the positive supply voltage line VDD supply the voltage converter to supply the entropy source 411 with a sufficient operating voltage of the supply voltage line V _E NT of the entropy source 411 relative to the reference potential line GND at the reference potential with electrical energy.

The first half-bridge of the exemplary voltage converter 91 is connected in the example of Figure 23 between the reference potential line GND and the positive supply voltage line VDD. The first half-bridge of the exemplary voltage converter 91 of Figure 23 comprises the high-side transistor 2301 of the first half-bridge of the charge pump for the entropy source 411 and the low-side transistor 2302 of the first half-bridge of the charge pump for the entropy source 411.

The second high-side transistor 2303 of the charge pump for the entropy source 411 is electrically connected to the positive supply voltage line VDD.

The control device 2330 of the voltage converter 91 controls the high-side transistor 2301 of the first half-bridge via the control contact (gate) 2311 of the high-side transistor 2301 of the first half-bridge.

The control device 2330 of the voltage converter 91 controls the low-side transistor 2302 of the first half-bridge via the control contact (gate) 2312 of the low-side transistor 2302 of the first half-bridge.

The control contact (gate) 2311 of the second high-side transistor 2303 is electrically connected to the output node 2321 of the charge pump. As a result, the high-side transistor 2303 of the second half-bridge forms a MOS diode that becomes conductive when the potential of the output node 2321 of the charge pump falls below the positive potential of the positive supply voltage line VDD minus the threshold voltage of the second high-side transistor 2303. The second high-side transistor 2303 then charges the first energy storage device, here a first capacitor 2306.

In the example of Figure 23, the first capacitor 2306 is electrically connected to the output node 2321 of the charge pump by its second connection of the first capacitor 2306. In the example of Figure 23, the first capacitor 2306 is electrically connected to the output node 2320 of the first half-bridge of the charge pump by its first connection of the first capacitor 2306.

The control device 2330 of the voltage converter 91 initially blocks the high-side transistor 2301 of the first half-bridge and the low-side transistor 2302 of the first half-bridge.

A transfer transistor 2305 of the charge pump for the entropy source 411 is connected in the example of Figure 23 between the output node 2321 of the charge pump and the positive supply voltage line VEXT of the entropy source 411. In the example of Figure 23, the transfer transistor 2305 of the charge pump for the entropy source 411 is connected as a MOS diode. As a result, the transfer transistor 2305 forms a MOS diode that becomes conductive when the potential of the output node 2321 of the charge pump falls below the positive potential of the positive supply voltage line VEXT of the entropy source 411 minus the threshold voltage of the transfer transistor 2305 falls. The transfer transistor 2305 then charges the second energy storage device, here a second capacitor 2307.

In the example of Figure 23, the second capacitor 2307 is electrically connected to the positive supply voltage line VEXT of the entropy source 411 via its second terminal of the second capacitor 2307. In the example of Figure 23, the second capacitor 2307 is electrically connected to the reference potential line GND via its first terminal of the second capacitor 2307.

Preferably, the control device 2330 of the voltage converter 91 switches the low-side transistor 2302 of the first half-bridge on for a short time in an initialization phase.

This connects the first terminal of the first capacitor 2306 to the reference potential line GND. If the first capacitor 2306 is not charged or is charged with a reverse polarity, the second high-side transistor 2303 then charges the first capacitor 2306 to the voltage between the positive supply voltage terminal VDD and the reference potential line GND minus the threshold voltage of the second high-side transistor 2303.

In a subsequent step, the control device 2330 of the voltage converter 91 blocks the low-side transistor 2302 of the first half-bridge. This ends the charging process of the first capacitor 2306.

In a subsequent step, the control device 2330 of the voltage converter 91 switches the high-side transistor 2301 of the first half-bridge to conduct. This shifts the output potential of the output 2321 of the charge pump to a potential with a voltage that corresponds to twice the voltage between the positive supply voltage line VDD and the reference potential line GND minus the threshold voltage of the second high-side transistor 2303. The potential of the output 2321 of the charge pump is thus above the potential of the positive supply voltage line VEXT of the entropy source 411 if the second capacitor 2307 is not charged or is only insufficiently charged or has the wrong polarity. If the voltage difference between the potential of the output 2321 of the charge pump and the potential of the supply voltage line VEXT of the entropy source 411 is greater than the threshold voltage of the transfer transistor 2305, the transfer transistor 2305 switches on and connects the output 2321 of the charge pump to the supply voltage line V _E XT of the entropy source 411. This causes charge to pass from the first capacitor 2306 to the second capacitor 2307, which increases the potential of the supply voltage line VEXT of the entropy source 411 until the voltage drops across the first capacitor 2306 and the second capacitor 2307 have equalized.

The control device 2330 of the voltage converter 91 repeats these steps until no more charge transfer takes place.

If necessary, the processor 10-1 or the voltage monitor 413 can determine this state of no longer occurring charge transfer, for example by means of an analog-to-digital converter or a comparator, and then interrupt the charging process, for example by signaling the control device 2330 of the voltage converter 91, until they determine that the potential of the supply voltage line VEXT of the entropy source 411 has fallen below a minimum potential. If this is the case, the processor 10-1 or the voltage monitor 413 preferably restart the charge pump of the voltage converter 91 by means of another signaling to the control device 2330 of the voltage converter 91 and keep it in operation until no significant charge transfer takes place again.

If the processor 10-1 or the voltage monitor 413 does not detect this state of essentially no longer occurring charge transfer within a predefined period of time after the charge transfer has been restarted, then a defect or a malfunction or an attack is probably present. Preferably, the processor 10-1 and/or the voltage monitor 413 signal this error. For example, the voltage monitor 413 can signal such an error to the watchdog 404.5 via a signal line 414.

The voltage converter 91 and the second capacitor 2307 can thus supply the entropy source 411 with a sufficient operating voltage on the supply voltage line VEXT of the entropy source 411.

The first capacitor 2306 and/or the second capacitor 2307 can be manufactured externally of the integrated circuit 2, for example the microcontroller, and connected via terminals of the housing of the integrated circuit 2, for example the microcontroller. This enables very high capacitance values for the first capacitor 2306 and/or the second capacitor 2307 in a cost-effective manner.

However, it is advantageous if the first capacitor 2306 and/or the second capacitor 2307 are silicon capacitors. In one embodiment, the first capacitor 2306 and/or the second capacitor 2307 can, when integrating the first capacitor 2306 and/or the second capacitor 2307 into the integrated circuit 2, for example into the microcontroller, for example each be a circuit of trench capacitors which are in the Semiconductor substrate 49 of the quantum random number generator 28. In a further additional or alternative embodiment, when integrating the first capacitor 2306 and/or the second capacitor 2307 into the integrated circuit 2, for example into the microcontroller, the first capacitor 2306 and/or the second capacitor 2307 can each comprise, for example, an interconnection of MIM capacitors that are manufactured in the metallization stack on the semiconductor substrate 49 of the quantum random number generator 28. MIM stands for metal-insulator-metal. An insulation layer of the metallization stack then preferably comprises a high-K material, such as hafnium oxide.

Of course, it is also conceivable to provide, for example, gate capacitances of additional transistors as device components of the first capacitor 2306 and/or the second capacitor 2307.

In the example of Figure 23, during operation, an increased voltage is then present at least temporarily between gate 2313 and substrate of the second high-side transistor 2303 and between gate 2315 and substrate of the transfer transistor 2305. These transistors must therefore be particularly voltage-resistant. The second high-side transistor 2303 and/or the transfer transistor 2305 are therefore preferably each designed as a DMOS transistor. It is therefore advantageous to manufacture the integrated circuit 2, for example the microcontroller, or the monolithically integrated quantum random number generator 28 using BCD technology.

Figure 24

Figure 24 shows an example of a rough layout of an imaginary integrated circuit 2, for example a microcontroller, with a proposed quantum random generator 28 in plan view.

The integrated circuit 2, for example a microcontroller, has an inner region 2405 of the integrated circuit 2 in which the essential subcircuits of the integrated circuit 2, for example the microcontroller, are located. Typically, this inner region 2405 of the integrated circuit 2, for example the microcontroller, is surrounded by a wiring region 2404 in which supply voltage lines, data bus lines and other lines are typically routed.

The wiring area 2404 and the inner area 2405 of the integrated circuit 2, for example the microcontroller, are surrounded by the pad frame 2403, which includes the connection pads (connection areas) 2402 for the electrical bond connections or other electrical connection connections. The document presented here now proposes placing the quantum random number generator 28, as shown for example in Figure 20 by way of example, entirely or at least in substantial parts in the pad frame 2403, since the gaps between the connection pads 2402 are often not filled with electronic circuit parts, but nevertheless have to be processed during production and therefore cause unnecessary costs. This placement of the quantum random number generator 28 entirely or at least in substantial parts in the pad frame 2403 therefore significantly reduces the additional costs for such a quantum random number generator 28. The document presented here proposes, very preferably, to place at least the entropy source 401 in the pad frame between two connection pads 2402. The document presented here also preferably proposes to also place the analog-to-digital converter 403 in the pad frame between two connection pads 2402. The document presented here preferably also proposes to place the voltage converter 91 for the energy supply of the entropy source 401 in the pad frame between two connection pads 2402. The document presented here preferably also proposes to place the pulse extension circuit 2023 in the pad frame between two connection pads 2402. The document presented here preferably also proposes to place other analog parts of the quantum random number generator 28 (eg the amplifier 402) in the pad frame between two connection pads 2402.

Figure 25

Figure 25 shows a schematic representation of a first embodiment of a quantum random number generator 28 according to the prior art in plan view. The representation is based on a corresponding figure in EP 3 529 694 B1 and shows the surface O of an associated substrate 49 in which the entropy source 401 is integrated. A circular photon source 54 with a pn junction set up to provide photons is supplied with power via a corresponding contact and is thereby excited to emit individual horizontally propagating photons 58. To detect the emitted photons 58, an associated single photon detector 55 in the form of a SPAD diode 55 is arranged next to the photon source 54. However, as with conventional hybrid approaches for photonic entropy sources 401, the photon source 54 and the single photon detector 55 are still structurally and functionally separate elements that are simply arranged next to one another for integration in a common semiconductor substrate 49 and in which the transport of the photons 58 through the semiconductor substrate 49 takes place with great attenuation. This results in a low data rate. A current pulse generated by the single photon detector 55 when a photon 58 is absorbed can then first be registered and evaluated in an associated electronic sampling means 25152, in particular to generate a bit sequence based on the number of photons detected in the single photon detector 55. Furthermore, an electronic post-processing means 25154 is provided, which is to be configured to process the binary sequences of the electronic sampling means 55 in such a way that a so-called "whitening" operation is carried out. This is to include a large number of compression operations that serve to improve the statistical properties of the generated binary sequences. The post-processing step is to increase the entropy level of the bit stream of the entropy source 401. However, it must be ensured that the compression operations used do not in turn lead to a fundamental predictability of the generated random numbers by introducing deterministic dependencies in the application.

To increase the efficiency of random number generation, i.e. In order to increase the effective entropy rate, the photonic part, i.e. the entropy source 401, of the Q.RNG on the surface O of the semiconductor substrate 49 is preferably protected by a light-blocking layer 142, 53 ("light inhibitor filter"), which serves to shade against external light incidence. The light-blocking layer 142, 53 can be provided in particular by a metallization layer that can be applied directly during the production process, for example by CMOS technology, as the last metallization level. This is intended to shield the photon detector 55 from external light and to make it sensitive only to those photons that pass through the semiconductor substrate 49 due to crosstalk from the photon source 54. In addition, the metallization layer 142, 53 is also intended to improve the optical coupling of the photons 58 emitted by the photon source 54 by reflecting them inwards and thus preventing them from exiting the surface O of the semiconductor substrate 49.

The disadvantage of such an arrangement of the optical components next to each other is the distance between the components, which reduces the coupling strength due to the small illumination angle and the potential photon absorption in the various materials. In addition, despite the partially applied light-blocking layer 142, 53, there is still the potential for optical access and thus an attack from the surface O of the substrate 49 or even from the back of the semiconductor substrate 49. This can be used, for example, to specifically inject or extract additional photons, so that ultimately the counting statistics and thus the entropy of the random numbers generated can be influenced and compromised. Furthermore, the illustration also shows that the individual Photons 58 are emitted isotropically distributed in all spatial directions, so that only a fraction of the photons 58 can be detected by the photon detector 55 and thus statistically evaluated. On the one hand, this significantly reduces the efficiency of the random number generation and, on the other hand, leads to a large number of photons 58 being emitted unused into the semiconductor substrate 49, where they may also be extracted elsewhere by observers or attackers or may lead to interference.

Figure 26

Figure 26 shows a schematic representation of a second embodiment of an entropy source 401 according to the prior art in a side view. The representation is based on a corresponding figure from Khanmohammadi et al. (A. Khanmohammadi, R. Enne, M. Hofbauer and H. Zimmermann, "A Monolithic Silicon Quantum Random Number Generator Based on Measurement of Photon Detection Time," in IEEE Photonics Journal, vol. 7, no. 5, pp. 1-13, Oct. 2015, Art no. 7500113). In this example, too, the basic structure of a side-by-side arrangement of a photon source 54 (Si-LED), which is set up to emit individual photons 58, and a single-photon detector 55 (SPAD) can be clearly seen. In contrast to the arrangement shown in Figure 25, however, the photon source 54 is provided as a circular central element which is essentially completely surrounded by a correspondingly adapted circular ring-shaped single-photon detector 55. The common radial axis of symmetry R is accordingly located in the center of the entropy source 401 formed in this way. The photon source 54 is realized by an n-well (“n well”) formed in a deep n-well (“deep n well”), which is supplied with power via an n++ region introduced into the surface O of the substrate 49 (“p-substrate”) centrally around the radial axis of symmetry R as cathode 26122 and a p++ region arranged next to it as anode 26124. Outside the deep n-well, the single photon detector 55 is also contacted to the surface O via an introduced n++ region as cathode 26132 and a p++ region arranged further away from the radial axis of symmetry R as anode 26134. A p-well (“p well”) is connected below the cathode 26132. Below the anode 26134, however, a p-well ("p well") is formed in a deep p-well ("deep p well"). The photon source 54 is provided as an element within the structure of the photon detector 55, so that in contrast to Figure 25, these form a structural and functional unit.

In this example of an entropy source 401 according to the prior art, the photons 58 are emitted essentially from all sides into the semiconductor substrate 49, so that the disadvantages already described for the embodiment according to Figure 25 with regard to security against observers or attackers and reduced efficiency also apply. However, the specific structure as a circular arrangement and the structural linking of the single photon detector 55 with the photon source 54 means that the integration density can be further increased compared to Figure 25. In addition to a smaller area requirement for forming the entropy source 401, this also includes increased security against attacks and increased efficiency in random number generation or the entropy rate as advantages. This is particularly related to the fact that by reducing all distances, the loss of photons 58 due to material absorption and unfavorable emission directions is reduced. In addition, the area for possible attacks is reduced. Apart from that, in principle it is still possible for attackers to extract or inject individual photons 58, particularly at the surface 0 and at other points on the semiconductor substrate 49, in order to influence the counting statistics. Such a juxtaposition of the two optical components of an optical entropy source 401 therefore has some disadvantages that have so far prevented particularly secure, compact and reliable random number generation for SoC applications.

Figure 27

Figure 27 shows a schematic representation of a BCD substrate 27110 provided with a method for providing deep p-n junctions 27050 and 27052 in a BCD process and a TCAD representation of the resulting dopant distribution. An embodiment of a method for producing deep p-n junctions 27050 and 27052 in a BCD process comprises providing a carrier substrate 49; introducing a first dopant to form a first region 27022 (e.g. NBL) of the first conductivity type (negative for NBL) into a surface S of the carrier substrate 49; introducing a second dopant to form a second region 27032 (e.g. PBL) of the second conduction type (positive for PBL) into the surface S of the carrier substrate 49, wherein the first region 27022 (NBL) and the second region 27032 (PBL) at least partially overlap; growing an epitaxial layer 48 on the surface S of the carrier substrate 49, wherein the first region 27022 (NBL) and the second region 27032 (PBL) spread by diffusion of the first dopant and the second dopant in the epitaxial layer 48 and thereby form a p-n junction 27050 lying in the epitaxial layer 48.

In the illustration, the first region 27022 is a deep NBL layer and the second region 27032 is a deep PBL layer. However, the order can be interchanged, so that the first region 27022 can also be a deep PBL layer and the second region 27032 can be a deep NBL layer. By appropriately adapting the diffusion lengths of the individual dopants, the The layer sequence of the pn junctions 27050 and 27052 can be reversed, e.g. in Figure 27 the NBL and PBL layers at the pn junction 27050 and 27052 could also be swapped.

The method described differs from the conventional methods for providing BCD substrates 27110 according to the prior art in particular in that the first region 27022 (NBL) and the second region 27032 (PBL) at least partially overlap. In particular, immediately after the introduction of the second dopant, in a plan view of the surface S of the carrier substrate 49, the first region 27022 or the second region 27032 can completely overlap the other region (27032, 27022). Therefore, in the embodiment shown, immediately after the introduction of the second dopant to form the second region 27032 (PBL), the second region 27032 (PBL) lies completely in the first region 27022 (NBL) in a plan view of the surface S of the carrier substrate 49. In order to form a p-n junction 27050 lying in the epitaxial layer, the first and the second dopant preferably have different diffusion properties in the carrier substrate 49 and/or in the epitaxial layer 48. In particular, the second dopant in the second region 27032 (PBL), as shown, can have a higher diffusion mobility (and thus diffusion length) in the carrier substrate 49 and in the epitaxial layer 48 than the first dopant in the first region 27022 (NBL).

To increase the diffusion, the carrier substrate 49 can be heated after the introduction of the first dopant and/or the second dopant. Furthermore, after the growth of the epitaxial layer 48, the carrier substrate 49 can be heated to increase the dopant diffusion. In the method presented, the first dopant and/or the second dopant can be introduced either maskless or using a mask method. In the BCD wafer shown, a complete overlay of the first region 27022 (NBL) with a single second region 27032 (PBL) can be assumed. Conventionally, however, the first and second regions 27022 and 27032 are formed spatially separated from one another. In particular, their distance is generally chosen to be at least large enough that even after the individual dopants have diffused out, no overlapping regions are created.

The TCAD representation (Technology Computer-Aided Design, TCAD) shown below the schematic representation shows the dopant distribution within the contacted BCD substrate 27110 for simulating a corresponding integrated diode structure. Due to the double structure shown in this embodiment with an upper pn junction 27050 in the epitaxial layer 48 and a lower pn junction 27052 in the carrier substrate 49, the side view shown results in an effective constriction of the n-region NBL enclosed in the area of the pn junctions 27050 and 27052 by the two of this n-region NBL surrounding p-regions PBL. Both pn junctions 27050 and 27052 can be designed to provide independent SPADs with a doping density and field strength distribution suitable for generating an avalanche effect.

By means of corresponding BCD substrates 27110 for further use in BCD technologies, particularly deep-lying SPADs ("deepSPADs") can thus be produced. In particular, there is still sufficient installation space above the SPADs provided for the integration of further optoelectronic components. According to the invention, a Zener avLED formed above the deep-lying SPAD can therefore be used in particular to realize a particularly compact, vertically constructed entropy source 401, in which individual photons 58 are emitted by the Zener avLED as photon sources 55 preferably vertically downwards in the direction of the upper p-n junction 27050 and are thus provided for detection by a SPAD formed immediately below the Zener avLED as a photon detector 54 at the upper p-n junction 27050 as a single photon detector 55 (see Figure 28 with associated figure description).

Figure 28

Figure 28 shows a schematic representation of an exemplary first embodiment of a proposed vertical entropy source 401. A vertical entropy source 401 is characterized in the sense of the document presented here by a vertical arrangement of the photon source 54 relative to the photon detector 55. The horizontal is defined by the surface O of the semiconductor substrate 48 with the epitaxial layer 48. The connecting line of the centers of gravity of the vertical arrangement of the photon source 54 and the photon detector 55 is thus arranged vertically relative to the surface O of the substrate 49 with the epitaxial layer 48, with vertical here being understood to be a relatively soft angle of more than 30°, optimally 90° of this line relative to the surface O. The monolithically integrated entropy source 401 shown comprises a photon source 54 and a single photon detector 55, wherein the photon source 54 and the single photon detector 55 are arranged vertically one above the other in a common substrate 49 made of a semiconductor material. The photon source 54 is preferably a single photon source (SPS) 54, designed to provide only individual or a few vertical photons 57 at the same time. The photon source 54 is preferably a light-emitting avalanche Zener diode (Zener-avLED) 54 operated at an operating point below or close to the breakdown voltage. The single photon detector 55 is preferably a single photon avalanche diode (second SPAD 55). The entropy source 401 is preferably formed in a BCD substrate 27110 using BCD technology. The BCD substrate 27110 preferably comprises a carrier substrate 49; and an epitaxial layer 48 grown on the carrier substrate 49, wherein a deep pn junction 27050 lying in the epitaxial layer was created between the carrier substrate 49 and the epitaxial layer 48 by diffusion of dopants introduced into a surface S of the carrier substrate 49 below the epitaxial layer 48 (see Figure 27). Preferably, the single photon detector 55 forms an avalanche region in a region around the deep pn junction 27050 and comprises an absorption region 47/28010 with a high-voltage p-type well 28010 and a p-type well 47 for converting photons into electron-hole pairs, wherein the absorption region 47/28010 is directly adjacent to the regions NBL (27022) and PBL (27032) forming the deep pn junction 27050. The fully developed high-voltage p-type well 28010 enables an optimal connection of the deep pn junction 27050 from the anode.

It is preferred that the deep p-n junction 27050 is formed at least partially between a deep n-layer NBL (27022) as a cathode 26132 and a deep p-layer PBL (27032) directly adjoining the deep n-layer NBL (27022), the absorption region 47/28010 directly adjoins the deep p-layer PBL (27032) and is formed essentially as a p-region (optionally comprising an intrinsic region), and an anode 26134 formed as a p+ region directly adjoins the absorption region 47/28010.

In the exemplary embodiment shown, the respective anodes 26124 and 26134 of the photon source 54 and the single photon detector 55 are combined. These can then be electrically contacted, for example, via a common second metallization 142, 53 on the surface S of the BCD substrate 27110. A common and continuous metallization 142, 53 (here, for example, a second metallization) can also be used to achieve shading to shield the entire installation space below against electromagnetic wave radiation from above. The associated cathodes 26122 and 26132 are each designed individually, for example, and can be electrically contacted via a first associated first metallization 141. The proposed vertical entropy source 401 can be designed as a circular structure (corresponds to a spatial rotation of the representation plane shown around an imaginary central axis in the vertical direction). However, other designs of the structure shown are also possible. Figure 29

Figure 29 shows a schematic representation of an exemplary second embodiment of an entropy source 401 according to the invention. The embodiment shown largely corresponds to the first embodiment shown in FIG. 28. The reference numerals and their respective assignment to individual features therefore apply accordingly. In comparison to FIG. 28, however, the high-voltage p-well 28010 has been structurally replaced by a tapered high-voltage p-well 28010 and a weakly n-doped or intrinsic epitaxial region 29010. The high-voltage p-well 28010 of the absorption region 47/28010 merely forms a narrow channel between the upper p-well 47, also shown in FIG. 2, and the deep p-layer PBL of the deep p-n junction 27050. The area around the channel is defined by the weakly n-doped or intrinsic epitaxial region 29010. The channel allows the deep p-n junction 27050 to be connected from the anode without an additional punch through the weakly n-doped or intrinsic epitaxial region 29010.

Figure 30

Figure 30 shows a schematic representation of an exemplary third embodiment of an entropy source 401 according to the invention. The embodiment shown largely corresponds to the embodiment shown in FIG. 29. The reference numerals and their respective assignment to individual features therefore apply accordingly. In comparison to Figure 29, the channel-shaped high-voltage p-tub 28010 in the absorption region 47/28010 was omitted and the weakly n-doped or intrinsic epitaxial region 29010 extends over the entire lower region. In this respect, in comparison to Figure 28, the high-voltage p-tub 28010 was structurally replaced by a weakly n-doped or intrinsic epitaxial region 29010. The deep p-n junction 27050 is thus only connected after an additional punch through the weakly n-doped or intrinsic epitaxial region 29010 from the anode, which results in a decoupling of possibly several cells arranged next to one another in parallel.

Figure 31

Figure 31 shows a graphical representation of the dependence of the SPAD current on the Zener blocking voltage at different SPAD blocking voltages (less than, equal to, greater than the breakdown voltage) within an entropy source 401 according to the invention. The dependence shown clearly shows that the SPAD current increases exponentially with the Zener blocking voltage in the range from 5.6 V to 6.6 V. This applies to all operating modes of the second SPAD 55, ie below its own breakdown voltage (< VBD, linear range), close to the breakdown voltage (~ VBD, avalanche range) as well as above the breakdown voltage (> VBD) and thus also in Geiger operation. Figure 32

Figure 32 shows a graphical representation of the dependence of the ratio between SPAD current and Zener current as a function of the Zener blocking voltage at various SPAD blocking voltages (less than, equal to, greater than the breakdown voltage) within an entropy source 401 according to the invention. The lower curve shown (< VBD) shows that the measured current ratio between the SPAD current and the Zener current for various Zener blocking voltages in the range 5.8 to 6.6 V is approximately 1:4000. In the breakdown voltage range (~ VBD) of the second SPAD diode 55, the ratio increases to values of around 1:10. This is due to the so-called multiplication factor of the SPAD diode 55, which leaves the linear range in the breakdown voltage range. The upper curve finally indicates the corresponding ratio for the second SPAD diode 55 operated above the associated breakdown voltage (> VBD) (approximately 1:1). This means that when a second SPAD diode 55 is operated above the associated breakdown voltage (> VBD), the generated photocurrent and the Zener current of the Zener avLED (as photon source 55) are approximately equal and a clear measurement signal can be measured by means of the coupling of photons on the second SPAD 55.

List of reference symbols

Numerical reference symbols

Reference numbers from 0 to 1000

2 integrated circuit, for example a microcontroller;

3 connection;

4 Control device. Preferably, the control device 4 is part of a microelectronic circuit;

6 non-volatile memory, internal and/or external EEPROM and/or external non-volatile memory via a data interface;

8 Random access memory and/or external read/write memory accessible via a data interface;

10-1 first processor 10-1;

10-2 second processor 10-2;

11 concatenation 11;

12 JATG test interface with JTAG test controller 12 and with JTAG test connectors (TDI, TDO, TCK, TM);

14 tightly coupled memory TCM 14;

15 Start address 15 of the boot ROM 16;

16 non-volatile boot memory (boot ROM) 16;

18 Hashing engine 18 (device for generating a hash from data received from a processor (10-1, 10-2) via the data bus 419.);

20 first one-time programmable memory (OTP) (first one-time

Programmable Memory (OTP) 20 ;

22 second one-time programmable memory (OTP) 22 (second one-time

Programmable memory (OTP));

24 Circuit 24 for deactivating tests, deactivation circuit;

26 controlled system 26 (e.g. controlled plant, controlled system);

28 quantum random number generator 28;

30 additional internal non-volatile memory 30 and/or additional via a

Data interface accessible external non-volatile memory;

32 Interface 32 to a controlled system 26;

40 Example first SPAD diode 40 for use as a sensor element of a

single photon detector; 41 Isolation, for example shallow trench isolation STI 41 of the exemplary SPAD diode 40 or LOCOS isolation;

42 Anode contact 42 of the exemplary SPAD diode 40;

43 Cathode contact 43 of the exemplary SPAD diode 40. The cathode contact

43 of the exemplary SPAD diode 40 is preferably made of indium tin oxide (ITO) or another transparent and electrically conductive material;

44 Optical fiber 44 for transporting the photons from the first SPAD diode 54 to the second SPAD diode 55. The optical fiber 44 is made of a covering oxide

44 or optically transparent insulating layer 44 of the exemplary SPAD diode 40;

45 highly doped first connection region 45 of a first conduction type, also referred to as n+ S/D implantation. In a CMOS technology with a p-doped wafer material, this can be, for example, an n+-doped region in the semiconducting substrate material of the SPAD diode 54;

46 first doped well 46 of a second conduction type. In a CMOS technology with a p-doped wafer material, this can be, for example, a p-doped region in the semiconducting substrate material of the first SPAD diode 40;

47 second doped well 47 of a second conduction type. In a CMOS technology with a p-doped wafer material, it can be, for example, a p-doped region in the semiconducting substrate material 49. It can be part of a SPAD diode 40, which is used as a photon source 54 or photon detector 55 in a horizontal entropy source 401. In the examples of Figures 28 to 30, it is a p-well of the Zener diode, which serves as a photon source 54 of the vertical entropy source 401;

48 epitaxial layer 48 of a second conduction type. In a CMOS technology with a p-doped wafer material, this can be, for example, a p-doped epitaxial layer in the semiconducting substrate material of the SPAD diode 40;

49 Base material 49 and/or semiconductor substrate 49 of the exemplary semiconducting single-crystal wafer or wafer piece, which preferably has a second conduction type. In a CMOS technology with a p-doped wafer material, this is, for example, a p-doped single-crystalline semiconductor wafer or a p-doped single-crystalline semiconductor wafer piece (die);

50 second doped well of a second conduction type (i.e., in the case of a p-doped substrate, a p-doped region) below the anode contact. In a CMOS technology with a p-doped wafer material, this can, for example, be a p-doped region in the semiconducting substrate material of the SPAD diode 40;

51 highly doped second connection region of a second conduction type, also referred to as p+ S/D implantation. In a CMOS technology with a p-doped wafer material, this can, for example, be a p+-doped region in the semiconducting substrate material of the SPAD diode 40;

52 Insulation, for example an oxide or the like;

53 Metal cover of the optical fiber 44;

54 First SPAD diode. The first SPAD diode 55 serves at least temporarily as a light source for irradiating the second SPAD diode 45 with photons from the first SPAD diode 54;

55 Second SPAD diode 55. The second SPAD diode 55 serves, for example, at least temporarily as a photodetector for the light from the first SPAD diode 54.

56 Surface 56 of the wafer within the meaning of the document presented here;

57 light 57 of the first SPAD diode 54 emitted vertically upwards (or downwards in Figures 28 to 30) in a direction perpendicular to the surface 56;

58 light 58 transported horizontally in the optical waveguide 44, which is a part of the light 57 radiated vertically by the first SPAD diode 54 into the optical waveguide 44;

59 light 59 of the first SPAD diode 54 radiated vertically downwards in a direction perpendicular to the surface 56 from the optical waveguide 44 into the second SPAD diode 55, which was emitted by the first SPAD diode 54 as perpendicular light 57 into the optical waveguide 44 and was then transported horizontally by the optical waveguide 44 to the second SPAD diode 55;

61 records;

62 digital signature;

63 interface;

64 data bus interface; 65 external data bus. The external data bus can be a wired data connection or a wireless data connection within the meaning of the document presented here;

81 interface 81;

82 Bus Arbiter 82;

83 Reset circuit 83;

84 analog input processing 84;

85 Analog-to-digital converter 85;

86 digital signal processing 86;

87 Digital-to-analog converter 87

88 analog output processing 88;

89 one or more external analog signals 89;

90 analog output signals 90;

91 Voltage converter 91;

92 Clock generator 92. The clock generator 92 preferably generates the system clock 2106. Preferably, the watchdog 404.5 monitors the system clock 2106 for too low or too high speed and for clock jitter. If the system clock 2106 of the clock generator 92 shows a clock jitter, the watchdog 404.5 reports an error to the processor 10-1 via the data bus 419 or via the interrupt line 420;

140 contact;

141 Metal 1 cables;

142 Metal 2 lines / Metal 2 covers;

241 gates

242 gates

301 Interface

401 Entropy Source 401;

402 High frequency amplifier 402;

403 Analog-to-digital converter (ADC) 403;

404 Evaluation circuit 404;

404.1 Constant 404.1;

404.2 Comparator 404.2;

404.3 Time-to-Pseudo-Random Number Converter 404.3 (TPRC);

404.4 Entropy Extraction Device 404.4;

404.5 Watchdog 404.5; 404.6 optional additional linear feedback shift register. The feedback is preferably a simple primitive polynomial to generate pseudorandom bit sequences;

404.7 Signal multiplexer 404.7;

404.8 Finite State Machine;

404.9 RAM or FIFO;

404.10 Finish Flag;

404.11 Processor 10-1, 10-2;

405 Voltage signal of entropy source 401;

406 Amplifier output signal 406 of the high frequency amplifier 402;

407 Output signal 407 of the analog-to-digital converter 403. of the digital bit value 407 of the analog-to-digital converter 403. Bit widths other than 1 bit are conceivable;

408 Signal of constant 404.1;

409 Output signal 409 of comparator 404.2;

410 Output 410 of the time-to-pseudo-random number converter 404.3 (TPRC);

411 Output of entropy extraction 404.4;

412 Seed S;

413 Voltage monitor;

414 signal lines;

415 synchronized voltage signal 415. The synchronized

Voltage signal 415 is generated by the pulse extension circuit 2023 (MF) from the output signal 407 of the analog-to-digital converter 403 in dependence on the system clock 2106;

416 selection signal;

417 Pseudorandom signal line;

418 quantum random data words;

419 internal data bus 419 of the quantum random number generator 28. Preferably, this is the internal data bus of the control device 4;

420 Interrupt signal 420 of the watchdog 404.5 of the quantum random number generator 28 or the control device 4;

500 Flowchart 500 of the entropy extraction process;

501 first step 501 with determination of the first value of the output 410 of the time-to-pseudo-random number converter 404.3 and the second value of the output 410 of the time-to-pseudorandom number converter 404.3 and storage in a shift register of the entropy extraction 404.4;

502 second step of comparing the first value with the second value;

503 third step of evaluating the first value and the second value and generating the quantum random bit 411;

601 first spikes;

602 second spikes;

603 cutting level;

Reference numbers from 1001 to 2999

2021 monitored internal tensions 2021;

2022 Line 2022 for preventing the use of a quantum random bit 411 by the finite state machine 404.8;

2023 Pulse extension circuit 2023, typically in the form of a monoflop MF. The monoflop MF extends a pulse on the line of the digital bit value 407 of the analog-to-digital converter 403 to a temporal length of at least one clock period of the system clock 2106;

2101 Shift register bus 2101 of the time-to-pseudo-random number converter 404.3 (TPRC);

2102 Feedback multiplexer 2102 of the time-to-pseudo-random number converter 404.3 (TPRC);

2103 Shift register controller 2103 of the time-to-pseudo-random number converter 404.3 (TPRC). The shift register controller 2103 of the time-to-pseudo-random number converter 404.3 (TPRC) switches the n shift register bits (SBi to SB _n ) from the serial shift register operating mode to the parallel shift register operating mode via the internal data bus 419 by means of a parallel to serial shift register mode switching line 2107, for example at the instigation of a processor (10-1, 10-2), so that the shift register bits (SBi to SB _n ) of the shift register use the current logic value of the TPRG data bus 2110 of the time-to-pseudo-random number converter 404.3 (TPRC) as the starting value (seed) of the linear feedback shift register. The shift register controller 2103 of the time-to-pseudo-random number converter 404.3 (TPRC) activates, for example, at the instigation of a processor (10-1, 10-2) via the internal data bus 419 by means of a parallel to serial shift register mode switching line 2107, the n shift register bits (SBi to SB _n ) from the serial shift register operating mode to the serial shift register operating mode, so that the first shift register bit SBi of the n shift register bits (SBi to SB _n ) take over the current logical value of the shift register reload value line 2104 of the time-to-pseudo-random number converter 404.3 (TPRC) with the next clock of the system clock 2106 and the other shift register bits SBj of the shift register bits (SBi to SB _n ) of the shift register take over the respective logical value of their predecessor shift register bit SBy-i; with the next clock of the system clock 2106.

One or more processors (10-1, 10-2) can write and/or read one or more registers of the shift register controller 2103 of the time-to-pseudo-random number converter 404.3 (TPRC) via the internal data bus 419.

Preferably, the processors (10-1, 10-2) can write one or more registers of the shift register controller 2103 of the time-to-pseudo-random number converter 404.3 (TPRC) via the internal data bus 419 and thus determine the logical value of the TPRG data bus 2110 of the time-to-pseudo-random number converter 404.3 (TPRC) that the shift register uses as the next seed value. This function can possibly be blocked by an access code in the OPT II memory 22 by means of the deactivation circuit 24.

Preferably, however, the shift register controller 2103 of the time-to-pseudorandom number converter 404.3 (TPRC) generates the logical value of the TPRG data bus 2110 of the time-to-pseudorandom number converter 404.3 (TPRC) from the data stream of the quantum random bits 411 in a special internal register of the shift register controller 2103 of the time-to-pseudorandom number converter 404.3 (TPRC), which the shift register uses as the next seed value. This has the advantage that the behavior of the circuit then depends on a quantum process and is therefore unpredictable. If the detection circuit 2113 detects an illegal value of the state vector of the n shift register bits SBi to SB _n , it reports this to the shift register controller 2103 of the time-to-pseudo-random number converter 404.3 (TPRC), which then takes action. One such typical action is resetting the state vector of the n shift register bits SBi to SB _n to a predetermined value, for example the seed value of the current value of the TPRG data bus 2110 of the time-to-pseudo-random number converter 404.3 (TPRC) or another predefined

Value. The shift register controller 2103 of the time-to-pseudorandom number converter 404.3 (TPRC) activates or deactivates, preferably via the shift register bit activation bus 2109, the data transfer of the n shift register bits (SBi to SB _n ) at the next clock edge of the clock edge direction used, typically bit-selectively.

Preferably, however, the shift register controller 2103 of the time-to-pseudorandom number converter 404.3 (TPRC) generates the logical reload value of the feedback polynomial selection register 2112 from the data stream of the quantum random bits 411 in a special internal register of the shift register controller 2103 of the time-to-pseudorandom number converter 404.3 (TPRC) and loads this reload value into the feedback polynomial selection register 2112.

By means of a line 2022 for preventing the use of a quantum random bit 411 by the finite state machine 404.8, the shift register controller 2103 of the time-to-pseudorandom number converter 404.3 (TPRC) preferably prevents the finite state machine 404.8 from using those quantum bits 411 that the shift register controller 2103 of the time-to-pseudorandom number converter 404.3 (TPRC) has already used;

2104 Shift register reload value line 2104 of the time-to-pseudo-random number converter 404.3 (TPRC), which selects the next serial reload value for the first shift register bit SBi of the time-to-pseudo-random number converter 404.3 (TPRC) when one of the m feedback networks (RKNi to RKN _m ) of the time-to-pseudo-random number converter 404.3 (TPRC) is selected by the feedback multiplexer 2102 and when the serial shift mode is set by the shift register controller 2103 as n, which is loaded into the first shift register bit SBi of the time-to-pseudo-random number converter 404.3 (TPRC) with the next clock of the system clock 2106;

2105 Threshold 2105;

2106 System clock 2106 of the quantum random number generator 28 and the time-to-pseudorandom number converter 404.3 (TPRC) of the quantum random number generator 28;

2107 Parallel to serial shift register mode switching line 2107, which switches the n shift register bits (SBi to SB _n ) from the serial shift register operation mode can switch to the parallel shift register operating mode depending on its logic value;

2109 Shift register bit activation bus 2109 with typically n shift register bit activation lines of the respectively associated n shift register bits (SBi to SB _n ) for the respective, preferably bit-selective activation of the data transfer of the n shift register bits (SBi to SB _n ) at the next clock edge of the clock edge direction used, wherein the respective data source of the data transfer is determined by the respective shift register bit of the respectively associated n shift register bits (SBi to SB _n ) by one or more parallel-to-serial shift register mode switching lines 2107 of the shift register controller 2103 of the time-to-pseudo-random number converter 404.3 (TPRC);

2110 TPRG data bus 2110 of the time-to-pseudo-random number converter 404.3 (TPRC), which typically comprises one data line for each shift register bit of the shift register bits (SBI to SB _n ) of the time-to-pseudo-random number converter 404.3 (TPRC), the logical content of which represents one bit of the TPRG data bus 2110. These bits of the TPRG data bus 2110 of the time-to-pseudorandom number converter 404.3 (TPRC) typically form the starting value (seed) of the time-to-pseudorandom number converter 404.3 (TPRC), which the shift register controller 2103 of the time-to-pseudorandom number converter 404.3 (TPRC) loads into the shift register cells of the shift register bits (SBI to SB _n ) via the internal data bus 1901 on the command of a processor (10-1, 10-2);

2111 Control register 2111 of the feedback multiplexer 2102 of the time-to-pseudo-random number converter 404.3 (TPRC). Preferably, the shift register controller 2103 of the time-to-pseudo-random number converter 404.3 (TPRC) loads the control register 2111 of the feedback multiplexer 2102 of the time-to-pseudo-random number converter 404.3 (TPRC) and thereby selects the feedback polynomial by selecting the current feedback network of the feedback networks (RKNi to RKN _m ). Preferably, the shift register controller 2103 of the time-to-pseudo-random number converter 404.3 (TPRC) changes the value of the control register 2111 of the feedback multiplexer 2102 only when a quantum random bit 411 has been successfully generated or when the shift register controller 2103 of the time-to-pseudo-random number converter 404.3 (TPRC) has generated at least one start pulse for the

2112 Feedback polynomial selection register 2112; 2113 Detection circuit 2113 for detecting an illegal value of the state vector of the n shift register bits SBi to SB _n ;

2201 first exemplary pulse 2201 of the entropy source 401 on the voltage signal 405 of the entropy source 401;

2202 second exemplary pulse 2202 of the entropy source 401 on the voltage signal 405 of the entropy source 401;

2203 third exemplary pulse 2203 of the entropy source 401 on the voltage signal 405 of the entropy source 401;

2204 fourth exemplary pulse 2204 of the entropy source 401 on the voltage signal 405 of the entropy source 401;

2211 first exemplary pulse of the synchronized voltage signal 415 generated from the first exemplary pulse 2201 of the entropy source 401;

2212 second exemplary pulse of the synchronized voltage signal 415 generated from the second exemplary pulse 2202 of the entropy source 401;

2213 third exemplary pulse of the synchronized voltage signal 415 generated from the third exemplary pulse 2203 of the entropy source 401;

2214 fourth exemplary pulse of the synchronized voltage signal 415 generated from the fourth exemplary pulse 2204 of the entropy source 401;

2301 High-side transistor 2301 of the first half-bridge of the charge pump for the entropy source 411;

2302 Low-side transistor 2302 of the first half-bridge of the charge pump for the entropy source 411;

2303 second high-side transistor 2303 of the second half-bridge of the charge pump for the entropy source 411. In the example of Figure 23, the second high-side transistor 2301 of the charge pump for the entropy source 411 is connected as a MOS diode;

2305 Transfer transistor 2305 of the charge pump for the entropy source 411. In the example of Figure 23, the transfer transistor 2305 of the charge pump for the entropy source 411 is connected as a MOS diode;

2306 first energy storage, here in the example of Figure 23 a first capacitor 2306; 2307 second energy storage, here in the example of Figure 23 a second

Capacitor 2307;

2311 Control contact (gate) 2311 of the high-side transistor 2301 of the first half-bridge of the charge pump for the entropy source 411;

2312 Control contact (gate) 2311 of the low-side transistor 2302 of the first half-bridge of the charge pump for the entropy source 411;

2313 Control contact (gate) 2311 of the second high-side transistor 2303 of the charge pump for the entropy source 411;

2320 Output node 2320 of the first half bridge of the charge pump for the entropy source 411;

2321 Output node 2321 of the charge pump for the entropy source 411;

2330 Control device 2330 of the voltage converter 91 for supplying the

Entropy source 411 with a sufficient operating voltage of the supply voltage line VENT of the entropy source 411 relative to the reference potential line GND at the reference potential.

2401 exemplary imaginary semiconductor die 2401 of the integrated circuit 2, for example the microcontroller, for explaining the optimal placement of a quantum random number generator in an exemplary layout of a microintegrated circuit 2;

2402 connection pads (connection area) of a line of the micro-integrated circuit 2;

2403 micro-integrated circuit pad frame 2;

2404 Wiring area of micro-integrated circuit 2;

2405 inner area of the microintegrated circuit 2;

Reference numbers from 3000 to 3999

3000 Creating a socket descriptor;

3010 Binding the socket descriptor to a port and IP address;

3020 passive wait state and waiting for connection requests from an integrated circuit 2, for example a microcontroller, a client;

3030 Establishing a connection from the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server to the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client by the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server; 3040 Generating a quantum random number 411 and generating a public and a private key by means of an RSA method by the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server by means of a quantum random number generator 28 Q.RNG and an RSA method.

3050 Waiting for an encrypted message from the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client by the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server;

3060 Decrypting the message of the private key from step 3040 stored temporarily in a memory of the computer (here the exemplary micro-integrated circuit 2) according to the RSA method

3070 Encryption of the message of the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server by means of the public key of the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client from step 3040 according to the RSA method by the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server;

3080 Sending the encrypted message stored in the buffer of the computer (here the exemplary micro-integrated circuit 2) of the server to the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client via the data bus interface 64 of the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server and via the data bus 65 and via the data interface 64 of the first processor 10-1 of the computer by the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server;

3090 Execution of the function close() and closing the open connection to a socket, here the socket of the client, and terminating the communication with the client by the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server;

3100 Generating a socket descriptor by the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client and submitting a connection request to the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server using the port and the IP address which were determined in the step 3010, by the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client;

3110 Establishing a connection between the server socket from step 3010 and the client socket from step 3100;

3120 Generating a quantum random number based on quantum random bits 411 and generating a public and a private key using an RSA method by the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client using a quantum random number generator 28 Q.RNG and an RSA method.

3130 Encrypting the client's own message using the public key of the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server from step 3040 using the RSA method by the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client;

3140 Sending the encrypted message of the client to the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server by the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client;

3150 Waiting for an encrypted message from the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server by the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client and receiving a message from the first processor 10-1 of the server by the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client and storing the thus received and typically encrypted message from the first processor 10-1 of the server in a temporary buffer of the computer (here the exemplary micro-integrated circuit 2) by the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client and reading the incoming data from the first processor 10-1 of the server by the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the Clients by executing the function recv() from a socket descriptor, in this case from the socket descriptor of the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client from step 3100 and store the read data preferably in a temporary buffer of the computer (here the exemplary micro-integrated circuit 2) of the client by the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client;

3160 Decryption of an encrypted message from the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server received by the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client by the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client by executing the function DecryptQ by the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client using the private key of the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client from step 3120 by means of the RSA method and subsequent storage of the message decrypted in this way in a temporary buffer of the computer (here the exemplary micro-integrated circuit 2) of the client by the first processor 10-1 of the computer (here the example microintegrated circuit 2) of the client;

3170 Closing the open connection to the socket by the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client and terminating the communication with the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server by the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client;

3200 Generation of two different prime numbers p and q and the product n=p*q and the result of Euler's phi function phi = (p-l)(q-l) by the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server by means of the function KeyExchangeServer();

3210 Generation of a number e that is coprime to phi by calling the function setE() by the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server, where the number phi is the one from step 3200 and where coprime in the sense of the present Document means that there is no natural number other than the number one that simultaneously divides the number e and the number phi by integers;

3220 Calculating the multiplicative inverse of the number e by means of the first processor 10-1 of the computer (here the exemplary microintegrated circuit 2) of the server using the function findD(), such that (e*d)mod phi = 1;

3230 Waiting for an incoming message from the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client, which should typically include the public key of the client, by the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server and reading the incoming data from a socket descriptor, in this case the socket descriptor of the client, by the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server and storing the read data preferably in a temporary buffer of the computer (here the exemplary micro-integrated circuit 2) by the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server;

3240 Sending the public key (d,n) of the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server from steps 3200 and 3220 by the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server to the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client via a socket descriptor, in this case the socket descriptor of the client from step 3030;

3245 Exit of the function KeyExchangeServer() by the first processor 10-1 of the computer (here the exemplary microintegrated circuit 2) of the server;

3250 Generating the prime number p and generating the prime number q different from q and generating the product n=p*q and generating the Euler phi function phi = (p-l)(q-l), each by the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client by means of the function KexExchangeClient();

3260 Generate an integer e that is relatively prime to the number phi from step 3250 by the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client by means of the function setE(), where coprime in the sense of this document means that there is no natural number other than the number one that simultaneously divides the number e and the phi without a remainder;

3270 Calculating the multiplicative inverse of the number e by the first processor

10-1 of the client's computer (here the exemplary micro-integrated circuit 2) using the function findD(), so that (e*d)mod phi = 1;

3280 Sending the public key (d,n) of the first processor 10-1 of the

computer (here the exemplary micro-integrated circuit 2) of the client from steps 3250 and 3270 to the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server by the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client, wherein the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client sends data via a socket descriptor, in this case the socket descriptor of the client from step 3100, using the send() function;

3290 Waiting for an incoming message from the first processor 10-1 of the

Computer (here the exemplary micro-integrated circuit 2) of the server with the public key of the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server by the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client and reading incoming data of the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server from a socket descriptor, in this case from the socket descriptor of the client from step 3100, by the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client using the recv() function and storing this data in a temporary buffer of the computer (here the exemplary micro-integrated circuit 2) of the client by the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) the client;

3295 Exit of the function KeyExchangeClient() by the first processor 10-1 of the computer (here the exemplary microintegrated circuit 2) of the client; 3300 Generating a random number by means of a quantum random number generator 28 QRNG by the calling first processor 10-1 and determining a prime number as a function of this random number by the calling first processor 10-1 and storing this prime number as a variable p in the memory of the computer (here the exemplary microintegrated circuit 2), of which the calling first processor 10-1 is a part;

3110 Generating a second random number by means of a quantum random number generator 28 QRNG by the calling first processor 10-1 and determining a prime number as a function of this random number by the calling first processor 10-1 and storing this prime number as a variable q in the memory of the computer (here the exemplary microintegrated circuit 2), of which the calling first processor 10-1 is a part;

3320 Checking whether the logical statement q==p holds by the calling first processor 10-1 and repeating the steps from step 3310 by the calling processor 10-1 if this statement holds;

3330 Calculating the product n= p * q by the calling processor location 10-1;

3340 Calculating Euler's phi function phi = (q-1) * (p-1) by the calling processor location 10-1;

3350 Calling processor exits setPrimes() function 10-1;

3400 Sequence of the SetE() function. When the setE() function is called in step 3400, the caller, in the case of the present document the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server or the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client, generates a random number e which is coprime to the number phi. Coprime in the sense of the present document means that there is no natural number other than the number one that divides the number e and phi at the same time. The calling processor 10-1 can generate the number e using a random number from the quantum random number generator 28 QRNG, a pseudo-random number generator PRNG, or by iterating up an integer number starting with 2. However, generation using the quantum random number generator 18 QRNG is preferred;

3410 Check whether the logical statement gcd(e,phi) 1= 1 is satisfied by the calling processor 10-1 and repeat step 3400 by the calling processor 10-1 if the logical statement is fulfilled. The calling processor 10-1 calculates the greatest common divisor of the transfer parameters a, b using this function gcd(a,b) and returns the result to the calling processor 10-1;

3420 Exiting the function setE() and returning the current value of e as a return value to the calling processor 10-1 by the calling processor 10-1 if the logical statement gcd(e,phi) 1= 1 is not satisfied;

3500 Initializing a variable d with 0 by the calling processor 10-1, here the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client or the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server;

3510 Adding the number 1 to the number d by the calling processor 10-1;

3520 Checking whether the logical statement (e*d) (mod phi) == 1 is satisfied by the calling processor 10-1 and repeating the steps from step 3510 if the logical statement (e*d) (mod phi) == 1 is not satisfied;

3530 Exiting the function findD() by the calling processor 10-1 when the logical statement (e*d) (mod phi) == 1 is satisfied and returning the current value of d as a return value to the calling processor 10-1, in the case of the present document the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server or the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client;

3600 servers;

3610 Clients;

3620 Sending the first quantum random number of the

Quantum random number generator 28 Q.RNG of the computer (here the exemplary micro-integrated circuit 2) of the server 3600 based public key of the server 3600 via a non-tap-proof channel to the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client 3610 by the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server 3600;

3630 Generating a pseudorandom number PZ or another random number by the first processor 10-1 of the computer (here the exemplary microintegrated circuit 2) of the client 3610 and storing the Pseudorandom number PZ or the otherwise generated random number in a memory of the computer (here the exemplary micro-integrated circuit 2) of the client 3610, the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client 3610 and generating a first private key of the client 3610 and a first public key of the client 3610 using this pseudorandom number PZ or this otherwise generated random number by the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client 3610 and encrypting this first public key of the client 3610 using the public key of the server 3600 by the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client 3610 and sending the encrypted first public key of the client 3610 to the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server 3600 by the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client 3610;

3640 Decrypting the message of the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client 3610 with the first private key of the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client 3610, so that the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server 3600 has the first public key of the client 3610 without this being known to third parties, and generating a further, second quantum random number QZ2 by the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server 3600 by means of the quantum random number generator 28 QRNG, wherein the bit width of this second quantum random number is preferably equal to the bit width of the random number PZ of the client 3610 and encrypting the second quantum random number QZ2 with the first public key of the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client 3610 to an encrypted second quantum random number QZ2' by the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server 3600, wherein, for example, the first public key of the client 3610 can be the random number PZ of the client and wherein in this case the first processor 10-1 of the Computer (here the exemplary micro-integrated circuit 2) of the server 3600 can encrypt the second quantum random number QZ2, for example by bitwise XORing the second quantum random number QZ2 with PZ to form an encrypted second quantum random number QZ2', and sending the encrypted second quantum random number QZ2' to the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client 3610 by the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server 3600.

3650 Decryption of the encrypted second quantum random number QZ2' using the first private key of the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server 3600 to the second quantum random number QZ2 by the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client 3610. If the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) has determined the second encrypted quantum random number QZ2' by bitwise XORing the random number PZ with the second quantum random number QZ2, the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client 3610 can, for example, by bitwise XORing the encrypted second quantum random number QZ2' with the known Decrypt the random number PZ to the second quantum random number QZ2. Preferably, the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client 3610 uses the second quantum random number QZ2 that it now has as the basis for generating a second private key and a second public key according to an asymmetric encryption method. The asymmetric encryption method can be, for example, the RSA method (APPENDIX). The first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client 3610 now sends its second public key to the server 3600 via the non-tap-proof channel. In doing so, it preferably encrypts this second public key of the client 3610 with the public key of the server 3600. The server 3600 decrypts the encrypted second public key of the client 3610 and then uses this second public key of the client to encrypt further messages. to the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client 3610. Preferably, the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server 3600 generates and sends a new public key based on a new quantum random number of its quantum random number generator 28 QRNG encrypted with the second public key of the client 3610 after a predetermined time or after sending a predetermined amount of data to the processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client 3610. Preferably, the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the server 3600 and the first processor 10-1 of the computer (here the exemplary micro-integrated circuit 2) of the client then carry out the previously described method again, so that change the keys permanently. This makes it impossible for a quantum computer to break the keys;

3700 Method for generating a quantum random number QZ 418 with m quantum random bits 411;

3710 Generation of a random single photon stream (57, 58, 59, 44) by means of one or more photon sources 54 and/or one or more silicon LEDs 54 and/or one or more first SPAD diodes (54), wherein preferably the photon sources 54 and/or the silicon LEDs 54 and/or the first SPAD diodes (54) are manufactured in one piece in a common semiconductor substrate 49;

3720 Transmission of the random single photon stream (57, 58, 59, 44) by means of the semiconductor substrate (49, 48) and/or by means of an optical waveguide 44 different from the semiconductor substrate (49, 48) and/or directly between the components to one or more photon detectors 55 and/or one or more second SPAD diodes (55);

3730 Conversion of the random single photon stream (57, 58, 59, 44) into a detection signal in the form of a voltage signal 405 of the entropy source 401, which preferably comprises photon sources 54 and/or one or more silicon LEDs 54 and/or one or more first SPAD diodes (54) and the means for light transmission, such as the semiconductor substrate (49, 48) and/or the optical waveguide 44, and the photon detectors 55 and/or the second SPAD diodes 55; 3740 Processing, in particular amplifying and/or filtering and/or analog-to-digital converting, the detection signal into a processed detection signal, in particular a digital 14-bit value 407 of the analog-to-digital converter 403 or a 1-bit analog-to-digital converter 403;

3750 optionally separating the pulses of the conditioned detection signal generated by optical coupling of the emissions of a photon source 54 and/or a silicon LED 54 and/or a first SPAD diode 54 on the one hand and a photon detector 55 and/or a second SPAD diode 55 on the other hand from the pulses of the conditioned detection signal generated by spontaneous emission by comparing the conditioned detection signal with a threshold value, in particular in a comparator 404.2 and generating a corresponding output signal 409, in particular of the comparator 404.2. If necessary, the analog-to-digital converter 403 can generate the output signal 409 directly if it is a 1-bit analog-to-digital converter 403. In this respect, this step 3750 is optional and is therefore only shown in dashed lines;

3760 Determination 3760 of a first pseudorandom number as a function of a first time interval between the first pulse and the second pulse of a first pair of two consecutive pulses generated by optical coupling of the emissions of a photon source 54 or a silicon LED

54 or a first SPAD diode 54 on the one hand and a photon detector

55 or a second SPAD diode 55 on the other hand, as the first value of the output 410 of the time-to-pseudo-random number converter 404.3;

3765 Determination 3760 of a second pseudorandom number depending on a second time interval between the third pulse and the fourth pulse of a first pair of two consecutive pulses generated by optical coupling of the emissions of a photon source 54 or a silicon LED

54 or a first SPAD diode 54 on the one hand and a photon detector

55 or a second SPAD diode 55 on the other hand, as the first value of the output 410 of the time-to-pseudo-random number converter 404.3. The third pulse can be identical to the second pulse (see step 3760).; 3670 Determining the bit value of a quantum random bit 411 by comparing the value of the first pseudorandom number and the value of the second pseudorandom number;

3680 Check 3680. In the check 3680, the first processor 10-1 of the computer (here of the exemplary micro-integrated circuit 2) and/or a finite state machine 404.8 check whether the number n of the determined quantum random bits 411 is still smaller than the desired number m of the random bits of the desired quantum random number 418. If this is not the case, the first processor 10-1 of the computer (here of the exemplary micro-integrated circuit 2) and/or finite state machine 404.8 repeat the above steps 3710 to 3770. Otherwise, the processor 10-1 of the computer (here of the exemplary micro-integrated circuit 2) or the finite state machine 404.8 terminate the process for generating a quantum random number. If necessary, the finite state machine 404.8 makes the quantum random number available to the processor 10-1 and preferably signals this availability to the processor 10-1, for example by means of an interrupt or by setting a flag.

15152 Electronic sampling means 25152 ("electronic sampling means");

25154 means for electronic post-processing 25154 of the photons 55 in the prior art;

26122 Cathode 26122;

26(27022) 124 Anode 26124;

26132 Cathode 26132;

26134 Anode 26134;

27022 first area 27022 (e.g. NBL) of the first line type (negative for NBL);

27032 second area 27032 (e.g. PBL) of the second conduction type (positive for PBL);

27050 p-n junction 27050 located in the epitaxial layer 48;

27052 pn junction 27052;

27110 BCD substrate 27110;

28010 high-voltage p-type well 28010 (English: high-voltage p-type well);

28020 Observation diode 28020;

29010 weakly n-doped or (approximately) intrinsic epitaxial region 29010;

Non-numeric reference symbols

GND reference potential line GND to reference potential; O surface 0 of the semiconductor substrate 49;

R axis of symmetry R of the structure of Figure 26;

S surface S of the carrier substrate 49;

S2 Reading a loading program from the EEPROM 6;

S4 Verifying the digital signature of the boot ROM code using the public key stored in the first OTP 20;

S6 Reading subsequent data records using the loader program

S8 checking the signature of the data record newly read from the EEPROM 6 using a public key embedded in a data record previously loaded or stored in the OTP-I memory 20 by the loading code;

520 Reading a data record from the EEPROM 6;

521 Storing at least part of the data of the set in the TCM 14;

522 Calculating a hash value for each word of the remaining data;

S24 storing the calculated hash value in the DRAM 8 at a location associated with the stored word by means of cooperation between the processor 10-1 or the processors 10-1, 10-2 on the one hand and the hash engine 18 on the other hand;

S26 Recalculation of the hash value when a word is read from the DRAM 8 by the processor 10-1, 10-2 and the hash engine 18;

S30 Comparison of the newly calculated hash value with the corresponding one in the

DRAM 8 stored hash value, by means of the processor 10-1, 10-2 and the hash engine 18;

S34 Checking whether the hash values have a predetermined relationship, e.g. are equal;

S36 Interrupting processing and/or generating an error message and/or ignoring data/code if they do not have the specified relationship;

S38 Processing of the read data by the processor(s)

10-1, 10-2, if the hash values have a predetermined relationship, e.g. are equal;

RKNi first feedback network RKNi of the time-to-pseudo-random number converter

404.3 (TPRC), which typically consists of the logical data word that appears on the shift register bus 2101 of the time-to-pseudo-random number converter 404.3 (TPRC) is present, generates the logical feedback value that the first shift register bit SBi

1. when selecting the first feedback network RKNi of the time-to-

Pseudorandom number converter 404.3 (TPRC) through the feedback multiplexer 2102 and

2. when the serial shift mode is set by the shift register controller 2103 via parallel-to-serial shift register mode switching line 2107, a parallel-to-serial shift register mode switching line 2107 and

3. when the shift register bit activation line of the first shift register bit SBi of the shift register bit activation bus 2109 is activated to activate the data transfer of the first shift register bit SBi at the next clock edge of the clock edge direction signal used, selects the next serial reload value for the first shift register bit SBi of the time-to-pseudo-random number converter 404.3 (TPRC). The first shift register bit SBi then loads this next serial reload value into the first shift register bit SBi of the time-to-pseudo-random number converter 404.3 (TPRC) with the next clock of the system clock 2106. The first feedback network RKNi of the time-to-pseudo-random number converter 404.3 (TPRC) is preferably different from the other feedback networks of the time-to-pseudo-random number converter 404.3 (TPRC). Preferably, the first feedback network RKNi of the time-to-pseudo-random number converter 404.3 (TPRC) implements a logical connection of the logical content of the shift register bus 2101 of the time-to-pseudo-random number converter 404.3 (TPRC) to the logical value of the shift register reload value line 2104 of the time-to-pseudo-random number converter 404.3 (TPRC), which is the next reload value under the above conditions. Preferably, the logical connection of the first feedback network RKNi of the time-to-pseudo-random number converter 404.3 (TPRC) implements a simple primitive polynomial;

RKN ₂ second feedback network RKN ₂ of the time-to-pseudo-random number converter 404.3 (TPRC), which typically generates the logical feedback value from the logical data word present on the shift register bus 2101 of the time-to-pseudo-random number converter 404.3 (TPRC), which the first shift register bit SBi 1. when selecting the second feedback network RKN ₂ of the time-to-

3. when the shift register bit activation line of the first shift register bit SBi of the shift register bit activation bus 2109 is activated to activate the data transfer of the first shift register bit SBi at the next clock edge of the clock edge direction signal used, selects the next serial reload value for the first shift register bit SBi of the time-to-pseudo-random number converter 404.3 (TPRC). The first shift register bit SBi then loads this next serial reload value into the first shift register bit SBi of the time-to-pseudo-random number converter 404.3 (TPRC) with the next clock of the system clock 2106. The second feedback network RKN ₂ of the time-to-pseudo-random number converter 404.3 (TPRC) is preferably different from the other feedback networks of the time-to-pseudo-random number converter 404.3 (TPRC). Preferably, the second feedback network RKN ₂ of the time-to-pseudo-random number converter 404.3 (TPRC) implements a logical connection of the logical content of the shift register bus 2101 of the time-to-pseudo-random number converter 404.3 (TPRC) to the logical value of the shift register reload value line 2104 of the time-to-pseudo-random number converter 404.3 (TPRC), which is the next reload value under the above conditions. Preferably, the logical connection of the second feedback network RKN ₂ of the time-to-pseudo-random number converter 404.3 (TPRC) implements a simple primitive polynomial, which is preferably different from the simple primitive polynomials of the logical connections of the other feedback networks of the time-to-pseudo-random number converter 404.3 (TPRC);

RKN ₃ third feedback network RKN ₃ of the time-to-pseudo-random number converter 404.3 (TPRC), which typically generates the logical feedback value from the logical data word present on the shift register bus 2101 of the time-to-pseudo-random number converter 404.3 (TPRC), which the first shift register bit SBi 1. when selecting the third feedback network RKN ₃ of the time-to-

3. when the shift register bit activation line of the first shift register bit SBi of the shift register bit activation bus 2109 is activated to activate the data transfer of the first shift register bit SBi at the next clock edge of the clock edge direction signal used, selects the next serial reload value for the first shift register bit SBi of the time-to-pseudo-random number converter 404.3 (TPRC). The first shift register bit SBi then loads this next serial reload value into the first shift register bit SBi of the time-to-pseudo-random number converter 404.3 (TPRC) with the next clock of the system clock 2106. The third feedback network RKN ₃ of the time-to-pseudo-random number converter 404.3 (TPRC) is preferably different from the other feedback networks of the time-to-pseudo-random number converter 404.3 (TPRC). Preferably, the third feedback network RKN ₃ of the time-to-pseudo-random number converter 404.3 (TPRC) implements a logical connection of the logical content of the shift register bus 2101 of the time-to-pseudo-random number converter 404.3 (TPRC) to the logical value of the shift register reload value line 2104 of the time-to-pseudo-random number converter 404.3 (TPRC), which is the next reload value under the above conditions. Preferably, the logical connection of the third feedback network RKN ₃ of the time-to-pseudo-random number converter 404.3 (TPRC) implements a simple primitive polynomial, which is preferably different from the simple primitive polynomials of the logical connections of the other feedback networks of the time-to-pseudo-random number converter 404.3 (TPRC);

RKN _m m-th feedback network RKN _m of the time-to-pseudo-random number converter 404.3 (TPRC), which typically generates the logical feedback value that the first shift register bit SBi 1. when selecting the m-th feedback network RKN _m of the time-to-

3. when the shift register bit activation line of the first shift register bit SBi of the shift register bit activation bus 2109 is activated to activate the data transfer of the first shift register bit SBi at the next clock edge of the clock edge direction signal used, selects the next serial reload value for the first shift register bit SBi of the time-to-pseudo-random number converter 404.3 (TPRC). The first shift register bit SBi then loads this next serial reload value into the first shift register bit SBi of the time-to-pseudo-random number converter 404.3 (TPRC) with the next clock of the system clock 2106. The m-th feedback network RKN _m of the time-to-pseudo-random number converter 404.3 (TPRC) is preferably different from the other feedback networks of the time-to-pseudo-random number converter 404.3 (TPRC). Preferably, the m-th feedback network RKN _m of the time-to-pseudo-random number converter 404.3 (TPRC) implements a logical connection of the logical content of the shift register bus 2101 of the time-to-pseudo-random number converter 404.3 (TPRC) to the logical value of the shift register reload value line 2104 of the time-to-pseudo-random number converter 404.3 (TPRC), which is the next reload value under the above conditions. Preferably, the logical connection of the m-th feedback network RKN _m of the time-to-pseudo-random number converter 404.3 (TPRC) implements a simple primitive polynomial, which is preferably different from the simple primitive polynomials of the logical connections of the other feedback networks of the time-to-pseudo-random number converter 404.3 (TPRC);

SBi first shift register cell with the first shift register bit SBi. The first shift register bit SBi preferably feeds its logical content into the first shift register bus line of the shift register bus 2101 of the time-to-pseudo-random number converter 404.3 (TPRC). Depending on the logical Value of the parallel-to-serial shift register mode switching line 2107 preferably reloads the first shift register bit SBi, for example a) at a first logical value of the parallel-to-serial I shift register mode switching line 2107, the serial shift register operating mode, for example with the next rising clock edge of the system clock 2106 of the quantum random number generator 28 and the time-to-pseudo-random number converter 404.3 (TPRC) of the quantum random number generator 28, the logical value of the shift register reload value line 2104 of the time-to-pseudo-random number converter 404.3 (TPRC) as its next logical value and b) at a second logical value of the parallel-to-serial I shift register mode switching line 2107, the parallel shift register operating mode, for example with the next rising clock edge of the system clock 2106 of the quantum random number generator 28 and the time-to-pseudo-random number converter 404.3 (TPRC) of the quantum random number generator 28 follow the logic value of the first bit of the TPRG data bus 2110 as their next logic value if at the same time the first shift register bit activation line of the shift register bit activation bus 2109 is active (e.g. high).

SB ₂ second shift register cell with the second shift register bit SB ₂ . The second shift register bit SB ₂ feeds its logical content into the second shift register bus line of the shift register bus 2101 of the time-to-pseudorandom number converter 404.3 (TPRC). Depending on the logic value of the parallel-to-serial shift register mode switching line 2107, the second shift register bit SB ₂ preferably loads, for example, a) at a first logic value of the parallel-to-serial I shift register mode switching line 2107, the serial shift register operating mode, for example with the next rising clock edge of the system clock 2106 of the quantum random number generator 28 and the time-to-pseudo-random number converter 404.3 (TPRC) of the quantum random number generator 28, the logic value of the first shift register bit SB 2 of the time-to-pseudo-random number converter 404.3 (TPRC) as its next logic value and b) at a second logic value of the parallel-to-serial I shift register mode switching line 2107, the parallel Shift register operating mode, for example with the next rising clock edge of the system clock 2106 of the quantum random number generator 28 and the time-to-pseudo-random number converter 404.3 (TPRC) of the quantum random number generator 28, the logic value of the second bit of the TPRG data bus 2110 as their next logic value if at the same time the first shift register bit activation line of the shift register bit activation bus 2109 is active (eg high);

SB3 third shift register cell with the third shift register bit SB ₃ . The third

Shift register bit SB ₃ feeds its logical content into the third shift register bus line of the shift register bus 2101 of the time-to-pseudorandom number converter 404.3 (TPRC). Depending on the logic value of the parallel-to-serial shift register mode switching line 2107, the third shift register bit SB ₃ preferably loads, for example, a) at a first logic value of the parallel-to-serial I shift register mode switching line 2107, the serial shift register operating mode, for example with the next rising clock edge of the system clock 2106 of the quantum random number generator 28 and the time-to-pseudo-random number converter 404.3 (TPRC) of the quantum random number generator 28, the logic value of the second shift register bit SB ₂ of the time-to-pseudo-random number converter 404.3 (TPRC) as its next logic value and b) at a second logic value of the parallel-to-serial I shift register mode switching line 2107, the parallel shift register operating mode, for example with the next rising clock edge of the system clock 2106 of the quantum random number generator 28 and the time-to-pseudo-random number converter 404.3 (TPRC) of the quantum random number generator 28 follow the logic value of the third bit of the TPRG data bus 2110 as their next logic value if at the same time the first shift register bit activation line of the shift register bit activation bus 2109 is active (e.g. high);

SB4 fourth shift register cell with the fourth shift register bit SB4. The fourth

Shift register bit SB4 feeds its logical content into the fourth shift register bus line of the shift register bus 2101 of the time-to-pseudo-random number converter 404.3 (TPRC). Depending on the logical Value of the parallel-to-serial shift register mode switching line 2107, the fourth shift register bit SB4 preferably loads, for example, a) at a first logic value of the parallel-to-serial I shift register mode switching line 2107, the serial shift register operating mode, for example with the next rising clock edge of the system clock 2106 of the quantum random number generator 28 and the time-to-pseudo-random number converter 404.3 (TPRC) of the quantum random number generator 28, the logic value of the third shift register bit SB ₃ of the time-to-pseudo-random number converter 404.3 (TPRC) as its next logic value and b) at a second logic value of the parallel-to-serial I shift register mode switching line 2107, the parallel shift register operating mode, for example with the next rising clock edge of the system clock 2106 of the quantum random number generator 28 and the time-to-pseudo-random number converter 404.3 (TPRC) of the quantum random number generator 28, the logic value of the fourth bit of the TPRG data bus 2110 as their next logic value if at the same time the first shift register bit activation line of the shift register bit activation bus 2109 is active (e.g. high);

SBg fifth shift register cell with the fifth shift register bit SB ₅ . The fifth shift register bit SB ₅ feeds its logical content into the fifth shift register bus line of the shift register bus 2101 of the time-to-pseudorandom number converter 404.3 (TPRC). Depending on the logic value of the parallel-to-serial shift register mode switching line 2107, the fifth shift register bit SBs preferably loads, for example, a) at a first logic value of the parallel-to-serial I shift register mode switching line 2107, the serial shift register operating mode, for example with the next rising clock edge of the system clock 2106 of the quantum random number generator 28 and the time-to-pseudo-random number converter 404.3 (TPRC) of the quantum random number generator 28, the logic value of the fourth shift register bit SB of the time-to-pseudo-random number converter 404.3 (TPRC) as its next logic value and b) at a second logic value of the parallel-to-serial I shift register mode switching line 2107, the parallel Shift register operating mode, for example with the next rising clock edge of the system clock 2106 of the quantum random number generator 28 and the time-to-pseudo-random number converter 404.3 (TPRC) of the quantum random number generator 28, the logic value of the fifth bit of the TPRG data bus 2110 as their next logic value if at the same time the first shift register bit activation line of the shift register bit activation bus 2109 is active (eg high);

SBs sixth shift register cell with the sixth shift register bit SBe. The sixth shift register bit SB ₆ feeds its logical content into the sixth shift register bus line of the shift register bus 2101 of the time-to-pseudo-random number converter 404.3 (TPRC). Depending on the logical value of the parallel-to-serial shift register mode switching line 2107, the sixth shift register bit SBe preferably loads, for example, a) at a first logical value of the parallel-to-serial shift register mode switching line 2107, the serial shift register operating mode, for example with the next rising clock edge of the system clock 2106 of the quantum random number generator 28 and the time-to-pseudo-random number converter 404.3 (TPRC) of the quantum random number generator 28, the logical value of the fifth shift register bit SB ₅ of the time-to-pseudo-random number converter 404.3 (TPRC) as its next logical value and b) at a second logical value of the parallel-to-serial I shift register mode switching line 2107, the parallel shift register operating mode, for example with the next rising clock edge of the system clock 2106 of the quantum random number generator 28 and the time-to-pseudo-random number converter 404.3 (TPRC) of the quantum random number generator 28, the logical value of the sixth bit of the TPRG data bus 2110 as its next logical value if at the same time the first shift register bit activation line of the shift register bit activation bus 2109 is active (eg high);

SB? seventh shift register cell with the seventh shift register bit SB?. The seventh

Shift register bit SB? feeds its logical content into the seventh shift register bus line of the shift register bus 2101 of the time-to-pseudo-random number converter 404.3 (TPRC). Depending on the logical Value of parallel to serial shift register mode switch line 2107 preferentially loads the seventh shift register bit SB? for example, a) at a first logic value of the parallel-to-serial I shift register mode switching line 2107, the serial shift register operating mode, for example with the next rising clock edge of the system clock 2106 of the quantum random number generator 28 and the time-to-pseudo-random number converter 404.3 (TPRC) of the quantum random number generator 28, the logic value of the sixth shift register bit SB ₆ of the time-to-pseudo-random number converter 404.3 (TPRC) as its next logic value after and b) at a second logic value of the parallel-to-serial I shift register mode switching line 2107, the parallel shift register operating mode, for example with the next rising clock edge of the system clock 2106 of the quantum random number generator 28 and the time-to-pseudo-random number converter 404.3 (TPRC) of the quantum random number generator 28 follows the logic value of the seventh bit of the TPRG data bus 2110 as its next logic value if at the same time the first shift register bit activation line of the shift register bit activation bus 2109 is active (e.g. high);

SB ₈ eighth shift register cell with the eighth shift register bit SB ₈ . The eighth shift register bit SB ₈ feeds its logical content into the eighth shift register bus line of the shift register bus 2101 of the time-to-pseudorandom number converter 404.3 (TPRC). Depending on the logical value of the parallel-to-serial shift register mode switching line 2107, the eighth shift register bit SB ₈ preferably loads, for example a) at a first logical value of the parallel-to-serial shift register mode switching line 2107, the serial shift register operating mode, for example with the next rising clock edge of the system clock 2106 of the quantum random number generator 28 and the time-to-pseudorandom number converter 404.3 (TPRC) of the quantum random number generator 28, the logical value of the seventh shift register bit SB? of the time-to-pseudo-random number converter 404.3 (TPRC) as its next logical value and b) at a second logical value of the parallel-to-serial I shift register mode switching line 2107, the parallel Shift register operating mode, for example with the next rising clock edge of the system clock 2106 of the quantum random number generator 28 and the time-to-pseudo-random number converter 404.3 (TPRC) of the quantum random number generator 28, the logic value of the eighth bit of the TPRG data bus 2110 as their next logic value if at the same time the first shift register bit enable line of the shift register bit enable bus 2109 is active (eg high);

SB(ns) (n-6)-th shift register cell with the (n-6)-th shift register bit SB( _n -6). The

(n-6)-th shift register bit SB( _n -6) feeds its logical content into the (n-6)-th shift register bus line of the shift register bus 2101 of the time-to-pseudorandom number converter 404.3 (TPRC). Depending on the logic value of the parallel-to-serial shift register mode switching line 2107, the (n-6)th shift register bit SB( _n -6), for example, a) at a first logic value of the parallel-to-serial I shift register mode switching line 2107, the serial shift register operating mode, for example with the next rising clock edge of the system clock 2106 of the quantum random number generator 28 and the time-to-pseudo-random number converter 404.3 (TPRC) of the quantum random number generator 28, preferably reloads the logic value of the (n-7)th shift register bit SB( _n -7) of the time-to-pseudo-random number converter 404.3 (TPRC) as its next logic value and b) at a second logic value of the parallel-to-serial I shift register mode switching line 2107, the parallel Shift register operating mode, for example with the next rising clock edge of the system clock 2106 of the quantum random number generator 28 and the time-to-pseudo-random number converter 404.3 (TPRC) of the quantum random number generator 28, the logic value of the (n-6)-th bit of the TPRG data bus 2110 as their next logic value if at the same time the first shift register bit enable line of the shift register bit enable bus 2109 is active (eg high);

SB(ns) (n-5)-th shift register cell with the (n-5)-th shift register bit SB( _n -s). The

(n-5)-th shift register bit SB( _n -s) feeds its logical content into the (n-5)-th shift register bus line of the shift register bus 2101 of the time-to-pseudo-random number converter 404.3 (TPRC). Depending on the logical Value of the parallel-to-serial shift register mode switching line 2107 preferably loads the (n-5)th shift register bit SB( _n -6) for example a) at a first logic value of the parallel-to-serial I shift register mode switching line 2107, the serial shift register operating mode, for example with the next rising clock edge of the system clock 2106 of the quantum random number generator 28 and the time-to-pseudo-random number converter 404.3 (TPRC) of the quantum random number generator 28 the logic value of the (n-6)th shift register bit SB( _n -7) of the time-to-pseudo-random number converter 404.3 (TPRC) as its next logic value and b) at a second logic value of the parallel-to-serial I shift register mode switching line 2107, the parallel Shift register operating mode, for example with the next rising clock edge of the system clock 2106 of the quantum random number generator 28 and the time-to-pseudo-random number converter 404.3 (TPRC) of the quantum random number generator 28, the logical value of the (n-5)-th bit of the

TPRG data bus 2110 as its next logic value if simultaneously the first shift register bit enable line of the shift register bit enable bus 2109 is active (e.g. high);

SB( _n -4) (n-4)th shift register cell with the (n-4)th shift register bit SB( _n -4). The (n-4)th shift register bit SB( _n -4) feeds its logical content into the (n-4)th shift register bus line of the shift register bus 2101 of the time-to-pseudorandom number converter 404.3 (TPRC). Depending on the logic value of the parallel-to-serial shift register mode switching line 2107, the (n-4)th shift register bit SB( _n -6) preferably loads, for example, a) at a first logic value of the parallel-to-serial shift register mode switching line 2107, the serial shift register operating mode, for example with the next rising clock edge of the system clock 2106 of the quantum random number generator 28 and the time-to-pseudo-random number converter 404.3 (TPRC) of the quantum random number generator 28, the logic value of the (n-5)th

Shift register bits SB( _n -7) of the time-to-pseudo-random number converter 404.3 (TPRC) as their next logical value and b) at a second logical value of the parallel-to-serial I shift register mode switching line 2107, the parallel Shift register operating mode, for example with the next rising clock edge of the system clock 2106 of the quantum random number generator 28 and the time-to-pseudo-random number converter 404.3 (TPRC) of the quantum random number generator 28, the logic value of the (n-4)th bit of the TPRG data bus 2110 as their next logic value if at the same time the first shift register bit activation line of the shift register bit activation bus 2109 is active (eg high);

SB( _n -3) (n-3)-th shift register cell with the (n-3)-th shift register bit SB( _n -3). The

(n-3)-th shift register bit SB( _n -3) feeds its logical content into the (n-3)-th shift register bus line of the shift register bus 2101 of the time-to-pseudorandom number converter 404.3 (TPRC). Depending on the logic value of the parallel-to-serial shift register mode switching line 2107, the (n-3)th shift register bit SB( _n -6), for example, a) at a first logic value of the parallel-to-serial I shift register mode switching line 2107, the serial shift register operating mode, for example with the next rising clock edge of the system clock 2106 of the quantum random number generator 28 and the time-to-pseudo-random number converter 404.3 (TPRC) of the quantum random number generator 28, preferably reloads the logic value of the (n-4)th shift register bit SB( _n -7) of the time-to-pseudo-random number converter 404.3 (TPRC) as its next logic value and b) at a second logic value of the parallel-to-serial I shift register mode switching line 2107, the parallel Shift register operating mode, for example with the next rising clock edge of the system clock 2106 of the quantum random number generator 28 and the time-to-pseudo-random number converter 404.3 (TPRC) of the quantum random number generator 28, the logic value of the (n-3)th bit of the TPRG data bus 2110 as its next logic value if at the same time the first shift register bit activation line of the shift register bit activation bus 2109 is active (eg high);

SB( _n -2) (n-2)-th shift register cell with the (n-2)-th shift register bit SB( _n -2). The

(n-2)-th shift register bit SB( _n -2) feeds its logical content into the (n-2)-th shift register bus line of the shift register bus 2101 of the time-to-pseudo-random number converter 404.3 (TPRC). Depending on the logical Value of the parallel-to-serial shift register mode switching line 2107 preferably loads the (n-2)th shift register bit SB( _n -6) for example a) at a first logic value of the parallel-to-serial I shift register mode switching line 2107, the serial shift register operating mode, for example with the next rising clock edge of the system clock 2106 of the quantum random number generator 28 and the time-to-pseudo-random number converter 404.3 (TPRC) of the quantum random number generator 28 the logic value of the (n-3)th shift register bit SB( _n -7) of the time-to-pseudo-random number converter 404.3 (TPRC) as its next logic value and b) at a second logic value of the parallel-to-serial I shift register mode switching line 2107, the parallel Shift register operating mode, for example with the next rising clock edge of the system clock 2106 of the quantum random number generator 28 and the time-to-pseudo-random number converter 404.3 (TPRC) of the quantum random number generator 28, the logical value of the (n-2)-th bit of the

SB(nl) (nl)-th shift register cell with the (nl)-th shift register bit SB( _n -i). The (nl)-th shift register bit SB( _n -i) feeds its logical content into the (nl)-th shift register bus line of the shift register bus 2101 of the time-to-pseudo-random number converter 404.3 (TPRC). Depending on the logical value of the parallel-to-serial shift register mode switching line 2107, the (nl)-th shift register bit SB( _n -6) preferably loads, for example a) at a first logical value of the parallel-to-serial shift register mode switching line 2107, the serial shift register operating mode, for example with the next rising clock edge of the system clock 2106 of the quantum random number generator 28 and the time-to-pseudo-random number converter 404.3 (TPRC) of the quantum random number generator 28, the logical value of the (n-2)-th

Shift register bits SB( _n -7) of the time-to-pseudo-random number converter 404.3 (TPRC) as their next logical value and b) at a second logical value of the parallel-to-serial I shift register mode switching line 2107, the parallel Shift register operating mode, for example with the next rising clock edge of the system clock 2106 of the quantum random number generator 28 and the time-to-pseudo-random number converter 404.3 (TPRC) of the quantum random number generator 28, the logic value of the (nl)-th bit of the TPRG data bus 2110 as its next logic value if at the same time the first shift register bit activation line of the shift register bit activation bus 2109 is active (eg high);

SB _n n-th shift register cell with the n-th shift register bit SB _n . The n-th

Shift register bit SB _n feeds its logical content into the n-th shift register bus line of the shift register bus 2101 of the time-to-pseudorandom number converter 404.3 (TPRC). Depending on the logic value of the parallel-to-serial shift register mode switching line 2107, the n-th shift register bit SB( _n -6), for example, a) at a first logic value of the parallel-to-serial I shift register mode switching line 2107, the serial shift register operating mode, for example with the next rising clock edge of the system clock 2106 of the quantum random number generator 28 and the time-to-pseudo-random number converter 404.3 (TPRC) of the quantum random number generator 28, preferably loads the logic value of the (nl)-th shift register bit SB( _n -7) of the time-to-pseudo-random number converter 404.3 (TPRC) as its next logic value and b) at a second logic value of the parallel-to-serial I shift register mode switching line 2107, the parallel Shift register operating mode, for example with the next rising clock edge of the system clock 2106 of the quantum random number generator 28 and the time-to-pseudo-random number converter 404.3 (TPRC) of the quantum random number generator 28, the logic value of the n-th bit of the TPRG data bus 2110 as their next logic value if at the same time the first shift register bit activation line of the shift register bit activation bus 2109 is active (eg high);

VDD positive supply voltage line VDD on a positive electrical

Potential compared to the reference potential of the reference potential line GND;

VENT positive supply voltage line VEXT of the entropy source 411; Relevant writings

R. L. Rivest, A. Shamir, and L. Adleman, “A Method for Obtaining Digital Signatures and Public-Key

Cryptosystems" Communications of the ACM, February 1978, Vol. 21, No. 2, pages 120 to 126

Claims

Expectations

1. Quantum process-based generator (28) for true random numbers (411, 418) (English: Quantum Random Number Generator: QRNG), wherein the quantum process-based generator (28) for true random numbers (411, 418) has an entropy source (401) and wherein the quantum process-based generator (28) for true random numbers (411, 418) is configured to evaluate a signal (405) of the entropy source (401) by means of at least one time-to-pseudo-random number converter (TPRC) (404.3) and wherein the quantum process-based generator (28) is further configured to generate one or more random bits (411) depending on the signal (405) of the entropy source (401).

2. Quantum process-based generator (28) for true random numbers (411, 418) (English: Quantum Random Number Generator: QRNG), wherein the quantum process-based generator (28) for true random numbers (411, 418) is integrally formed on a semiconductor substrate (49) having a surface (O), and wherein the quantum process-based generator (28) for true random numbers (411, 418) has a vertical entropy source (401), and wherein the vertical entropy source (401) has a photon source (54), and wherein the vertical entropy source (401) has a photon detector (55), and wherein the surface (O) of the semiconductor substrate (49) defines a horizontal plane with a first direction in the plane (1st plane vector) and a second direction in the plane (2nd plane vector) which is different from the first direction in the plane, and wherein the photon source (54) and the photon detector (55) are arranged in a vertical direction to the first and second direction in the plane in the semiconductor substrate (49) relative to the first and second direction in the horizontal plane of the surface (O) of the semiconductor substrate (49), and wherein the quantum process-based generator (28) for true random numbers (411, 418) is configured to generate one or more random bits (411) as a function of a signal (405) from the entropy source (401).

3. Quantum process-based generator (28) for true random numbers (411, 418) (English: Quantum Random Number Generator: QRNG), wherein the quantum process-based generator (28) for true random numbers (411, 418) comprises an entropy source (401) in a semiconductor substrate (49) with a surface (O) and with a back side which lies opposite the surface (O) on the other side of the semiconductor substrate (49), and wherein the quantum process-based generator (28) for true random numbers (411, 418) comprises means for detecting an attack on the entropy source (401) by means of photons, wherein this attack can in particular be an attack from the back side of the semiconductor substrate (49).

4. Quantum process-based generator (28) for true random numbers (411, 418) according to claim 3, wherein said means for detecting an attack on the entropy source (401) by means of photons comprise an observation diode (28020).

5. Quantum process-based generator (28) for true random numbers (411, 418) according to one of claims 1 to 4, wherein the quantum process-based generator (28) comprises a watchdog (404.5).

6. Quantum process-based generator (28) for true random numbers (411, 418) according to one of the

Claims 1 to 5, wherein the quantum process-based generator (28) comprises a voltage monitor (423).

7. Quantum process-based generator (28) for true random numbers (411, 418) according to one of the

Claims 5 to 6, wherein the watchdog (404.5) and/or the voltage monitor (413) are configured to monitor the quantum process-based generator (28) for an attack or a disturbance by means of the means for detecting an attack on the entropy source (401) by means of photons, in particular by means of the observation diode (28020).

8. Quantum process-based generator (28) for true random numbers (411, 418) according to one of claims 1 to 7, wherein the at least two device parts of the quantum process-based generator (28) for true random numbers (411, 418) according to one of the said claims and optionally further circuit parts are designed in one piece on a common semiconductor substrate (49) as a one-piece quantum process-based generator (28), wherein the device parts of the quantum process-based generator (28) for true random numbers (411, 418) and the optionally further circuit parts comprise at least as device parts the entropy source (401) or the vertical entropy source (401) and the time-to-pseudo-random number converter (TPRC) (404.3) or at least the vertical entropy source (401) and the time-to-pseudo-random number converter (TPRC) (404.3) or a time-to-digital converter (TDC) (404.3) instead of the Time-to-pseudorandom number converter (TPRC) (404.3) or at least the entropy source (401) or the vertical entropy source (401) and

Means for detecting an attack on the entropy source (401) by means of photons or at least the time-to-pseudo-random number converter (TPRC) (404.3) or a time-to-digital converter (TDC) (404.3) instead of the time-to-pseudo-random number converter (TPRC) (404.3) and

Means for detecting an attack on the entropy source (401) by means of photons and and wherein the device parts of the quantum process-based generator (28) for true random numbers (411, 418) can additionally comprise the following device parts: an integrated circuit (2) and/or one or more photon sources (54) and/or one or more photon detectors (55) and/or one or more optical functional elements (44) and/or one or more optical waveguides (44) and/or a time-to-pseudo-random number converter (TPRC) (404.3) and/or

Means for detecting an attack on the entropy source (401) by means of photons and/or one or more observation diodes (28020) and/or a watchdog (404.5) and/or one or more voltage monitors (423) and/or one or more voltage converters (91) and/or one or more amplifiers (402) and/or one or more comparators (404.2) and/or an entropy extraction device (404.4) and/or a finite state machine (FSM) (404.8) and/or a signal multiplexer (404.7) and/or one or more RAMs and/or FIFOs (404.9) and/or one or more finish flags (404.10) and/or an internal data bus (419) and/or one or more signal lines and/or one or more interrupt signals (420) and/or a pulse extension circuit (2023) and/or a feedback multiplexer (2102) of the Time-to-pseudorandom number converter

(404.3) (TPRC) and/or a control register (2111) of the feedback multiplexer (2102) and/or one or more feedback polynomial selection registers (2112) and/or a detection circuit (2113) and/or a shift register controller (2103) and/or one or more feedback networks (RKNi to RKN _m ) of the time-to-

Pseudorandom number converter (404.3) (TPRC) and/or one or more shift register bits (SBi to SB _n ) and/or one or more second high-side transistors (2303), in particular in the form of DMOS transistors, and/or one or more transfer transistors (2305), in particular in the form of

DMOS transistors, and/or one or more first energy storage devices (2306) and/or one or more second energy storage devices (2307) and/or one or more control devices (2330) of the voltage converters (91) and/or a pad frame (2401) of the micro-integrated circuit (2) and/or

Means (25145) for electronic post-processing and/or one or more observation diodes (28020) and/or an encapsulation with one or more metal layers (53, 142) and/or one or more silicide layers and vias (140) and/or one or more data bus interfaces (64) and/or a JTAG test interface (12) and/or another test interface and/or a control device (4) and/or one or more non-volatile memories (6) and/or one or more EEPROMs (6) and/or one or more random access memories (8) (volatile read/write memories) and/or one or more processors (10-1, 10-2) and/or one or more tightly coupled memories (TCM) (14) and/or a non-volatile boot memory (boot ROM) (16) and/or a hashing engine (18) and/or one or more one-time programmable memories (OTP) (20, 22) (one-time programmable memories) and/or a deactivation circuit (24) and/or one or more further internal non-volatile memories (30) and/or one or more interfaces (32) to one or more controlled systems (26) and/or one or more clock generators (92) (including any necessary PLLs) and/or one or more voltage converters (91) and/or one or more reset circuits (83) and/or one or more data bus interfaces (64) and/or one or more internal interfaces (81, 63, 301) and/or one or more optical functional elements (44) and/or one or more analog input processing (84) and/or one or more analog-to-digital converters (85) and/or one or more digital signal processing (86) and/or one or more digital-to-analog converters (87) and/or one or more analog output processing (88).

9. Quantum process-based generator (28) for true random numbers (411, 418) according to one of claims 1 to 8, wherein the quantum process-based generator (28) for true random numbers (411, 418) is configured to generate at least one random number (418) from a plurality of random bits (411), and wherein the quantum process-based generator (28) is further configured to provide or use the at least one random number (418).

10. Quantum process-based generator (28) for true random numbers (411, 418) according to claim 1 and claim 9, wherein the logical values in the time sequence of the pseudorandom bits of a time-to-pseudorandom number converter (TPRG) (404.3) of the quantum process-based generator (28) depend on one or more quantum random bits (411) and/or one or more quantum random numbers (418).

11. Quantum process-based generator (28) for true random numbers (411, 418) according to one of claims 5 to 10, wherein the watchdog (404.5) is configured to monitor correct functioning of the quantum process-based generator (28) for true random numbers (411, 418).

12. Quantum process-based generator (28) for true random numbers (411, 418) according to claim 11, wherein the watchdog (404.5) is configured to measure the randomness of the generated quantum random bits (411) in the form of one or more measured values and to compare each with a respective tolerance interval or a respective threshold value, and wherein the watchdog (404.5) is configured to infer a respective error in the case of a respective deviation of the respective measured value from the respective tolerance interval or the respective threshold value.

13. Quantum process-based generator (28) for true random numbers (411, 418) according to one of the

Claims 5 to 12, wherein the watchdog (404.5) is arranged to to monitor a correct function of the time-to-pseudo-random number converter (TPRC) (404.3) of the at least one time-to-pseudo-random number converter (TPRG) (404.3) of the quantum process-based generator (28) and/or to monitor a behavior in the form of the temporal statistics of the logical values in the temporal order of the pseudorandom bits of the time-to-pseudo-random number converter (TPRC) (404.3) and to record them in the form of statistical measured values and, in the event of deviations of the statistical measured values from the expected behavior in the form of a departure from permitted measured value ranges for these measured values, to determine and/or signal an error.

14. Quantum process-based generator (28) for true random numbers (411, 418) according to one of claims 1 to 13, wherein the quantum process-based generator (28) for true random numbers (411, 418) with its at least two device parts is manufactured in one piece as part of an integrated circuit (2) and wherein the device parts of the quantum process-based generator (28) for true random numbers (411, 418) and the optionally further circuit parts comprise at least as device parts one or the entropy source (401) or one or the vertical entropy source (401) and one or the time-to-pseudo-random number converter (TPRC) (404.3) or at least one or the vertical entropy source (401) and one or the time-to-pseudo-random number converter (TPRC) (404.3) or in the case of Claims 2 or 3 comprise a time-to-digital converter (TDC) (404.3) instead of the time-to-pseudo-random number converter (TPRC) (404.3) or at least one or the entropy source (401) or one or the vertical entropy source (401) and

Means for detecting an attack on the entropy source (401) by means of photons or at least a time-to-pseudo-random number converter (TPRC) (404.3) or, in the case of claims 2 or 3, a time-to-digital converter (TDC) (404.3) instead of the time-to-pseudo-random number converter (TPRC) (404.3) and

Means for detecting an attack on the entropy source (401) by means of photons and wherein the device parts of the quantum process-based generator (28) for true random numbers (411, 418) can additionally comprise the following device parts: an integrated circuit (2) and/or one or more photon sources (54) and/or one or more photon detectors (55) and/or one or more optical functional elements (44) and/or one or more optical waveguides (44) and/or a time-to-pseudo-random number converter (TPRC) (404.3) and/or

Means for detecting an attack on the entropy source (401) by means of photons and/or one or more observation diodes (28020) and/or a watchdog (404.5) and/or one or more voltage monitors (423) and/or one or more voltage converters (91) and/or one or more amplifiers (402) and/or one or more comparators (404.2) and/or an entropy extraction device (404.4) and/or a finite state machine (FSM) (404.8) and/or a signal multiplexer (404.7) and/or one or more RAMs and/or FIFOs (404.9) and/or one or more finish flags (404.10) and/or an internal data bus (419) and/or one or more signal lines and/or one or more interrupt signals (420) and/or a pulse extension circuit (2023) and/or a feedback multiplexer (2102) of the time-to-pseudo-random number converter

Means (25145) for electronic post-processing and/or one or more observation diodes (28020) and/or an encapsulation with one or more metal layers (53, 142) and/or one or more silicide layers and vias (140) and/or one or more data bus interfaces (64) and/or a JTAG test interface (12) and/or another test interface and/or a control device (4) and/or one or more non-volatile memories (6) and/or one or more

EEPROMs (6) and/or one or more random access memories (8) (volatile read/write memories) and/or one or more processors (10-1, 10-2) and/or one or more tightly coupled memories (TCM) (14) and/or a non-volatile boot memory (boot ROM) (16) and/or a hashing engine (18) and/or one or more one-time programmable memories (OTP) (20, 22) (one-

Time-Programmable Memory) and/or a deactivation circuit (24) and/or one or more further internal non-volatile memories (30) and/or one or more interfaces (32) to one or more controlled

Systems (26) and/or one or more clock generators (92) (including any necessary PLLs) and/or one or more voltage converters (91) and/or one or more reset circuits (83) and/or one or more data bus interfaces (64) and/or one or more internal interfaces (81, 63, 301) and/or one or more optical functional elements (44) and/or one or more analog input processing (84) and/or one or more analog-to-digital converters (85) and/or one or more digital signal processing (86) and/or one or more digital-to-analog converters (87) and/or one or more analog output processing (88).

15. Quantum process-based generator (28) for true random numbers (411, 418) according to claim 14, wherein the integrated circuit (2) is manufactured using a BCD technology.

16. A quantum process-based true random number generator (28) according to claim 14 or claim 15, wherein the integrated circuit (2) comprises a voltage converter (91) for supplying the entropy source (401) of the quantum process-based true random number generator (28) (411, 418), and wherein the voltage converter (91) comprises one or more DMOS transistors.

17. Quantum process-based generator (28) for true random numbers (411, 418) according to one of claims 14 to 16, wherein the integrated circuit (2) is one of the following circuits or comprises one of the following circuits: a microcontroller, a microprocessor, a memory, a DRAM, an SRAM, a RAM, a volatile memory, an OTP storage,

- an EEPROM, a flash memory, an MRAM, an FRAM, a sensor evaluation circuit, a control circuit for an automotive control circuit, a graphics controller, an evaluation circuit for a biometric sensor or an input device, a control circuit, a chip card circuit, an RFID circuit; a circuit of a mobile phone or a smartphone, a circuit of an access control system, a circuit with a coded recording of operating parameters, a circuit of an access control system, a circuit of a security system for electronic security, a radio system circuit, a communication circuit, a circuit of an encryption and/or decryption system, a circuit of an individualization system, a circuit of a gaming device, a circuit of a simulation system, a circuit of a computer system, a circuit of a noise source, a circuit with a device for generating and/or using a spreading code, a circuit with a device for generating and/or using a random number for individualizing the circuit, a circuit with a device for generating and/or using a random number for testing purposes, in particular for self-testing purposes and/or for the purposes of testing an application circuit of which the circuit is a part.

18. Quantum process-based generator (28) for true random numbers (411, 418) according to one of claims 14 to 17, wherein the integrated circuit (2) has internal interfaces (63, 301, 32 and 81) as special circuits at a cryptographic boundary between a control device (4) and other parts (8, 30, 6) of the integrated microelectronic circuit (2) which are classified as not secure or less secure, and wherein the quantum process-based generator (28) for true random numbers

(411, 418) is arranged within the cryptographic boundary between the control device (4) and the other parts (8, 30, 6) of the integrated microelectronic circuit (2).

19. Quantum process-based generator (28) for true random numbers (411, 418) according to one of claims 1 to 18, wherein the entropy source (401) comprises a photon source (54) and wherein the entropy source (401) comprises a photon detector (55) and wherein the photon source (54) is configured to emit photons as a quantum signal (57) when supplied with electrical energy and wherein the photon source (54) is optically coupled to the photon detector (55) and wherein the photon detector (55) is configured to at least partially receive the quantum signal (57) of the photon source (54) and to generate an output signal (405) of the entropy source (401) or a precursor signal thereof.

20. Quantum process-based generator (28) for true random numbers (411, 418) according to claim 19 and claim 2, wherein the photon source (54) comprises a silicon LED, in particular a Zener avLED.

21. A quantum process based true random number generator (28) according to claim 19 or 20, wherein the photon source (55) comprises a SPAD diode.

22. Quantum process-based generator (28) for true random numbers (411, 418) according to one of claims 1 to 21, wherein the quantum process-based generator (28) is placed entirely or in part in a pad frame (2403) between connection pads (2402) of an integrated circuit (2) on a die (2401) of this integrated circuit (2), and wherein at least the entropy source (401) is placed in the pad frame (2403) between the connection pads (2402) of the integrated circuit (2) on the die (2401) of this integrated circuit (2).

23. Quantum process-based generator (28) for true random numbers (411, 418) according to one of the

Claims 5 to 24, wherein the entropy source (401) of the quantum process-based generator (28), in particular by means of metal layers (53, 142) and/or silicide layers and vias (140), except for signal feedthroughs through this encapsulation from at least one side, better at least from two sides, better at least from three

sides, preferably at least four sides, preferably at least five sides.