True Random Number Generator Based on RRAM-Bias Current Starved Ring Oscillator

This work presents a resistive random access memory (RRAM)-bias current-starved ring oscillator (CSRO) as true random number generator (TRNG), where the cycle-to-cycle variability of an RRAM device is exploited as source of randomness. A simple voltage divider composed of this RRAM and a resistor is considered to bias the gate terminal of the extra transistor of every current starved (CS) inverter of the ring oscillator (RO). In this way, the delay of the inverters is modified, deriving an unpredictable oscillation frequency every time the RRAM switches to the high resistance state (HRS). The oscillation frequency is finally leveraged to extract the sequence of random bits. The design is simple and adds low area overhead. Experimental measurements are performed to analyze the cycle-to-cycle variability in the HRS. The very same measurements are subsequently used to validate the TRNG by means of electrical simulations. The obtained results passed all the National Institute of Standards and Technology randomness tests (NIST) tests without the need for postprocessing.


I. INTRODUCTION
Random number generators (RNGs) are commonly utilized in different application fields, such as engineering problem solving, statistical sampling, industrial simulations, gaming, communications, or cryptography [1].In some of these applications sensitive data is managed, i.e., communication and cryptographic applications, where the use of PRNGs (pseudo-RNGs) is not recommended.In these applications, the generated random numbers must be truly random, fulfilling several statistical test requirements [2].Thus, there is a deep interest in developing devices capable of harvesting entropy from physical phenomena so that the extracted random numbers fulfill such requirements.RNGs based on these physical sources of entropy are called true random number generators (TRNGs) [3].TRNGs have become essential due to the growing security concern in the era of the Internet of Things (IoT).Different TRNGs have been proposed based on physical phenomena including thermal noise [4], random telegraph noise (RTN) [5], metastable elements [6], or current fluctuations [7].In this article, resistive random access memory (RRAM) have also attracted the interest in the development of TRNGs.RRAMs present excellent properties in terms of switching speed, power consumption, scalability, endurance, and CMOS compatibility [10].These properties together with the inherent nonvolatility of these devices motivated their initial use as memory devices [8], [9].Furthermore, RRAMs have already been demonstrated for other applications such as neural networks [11] and digital logic [12].However, massive production of RRAMs has been limited by their inherent stochastic features, such as probabilistic switching, inter-and intradevice variabilities [13], [14], RTN [15], and limited endurance.Significant research effort is currently devoted to overcome these limitations [16], [17], [18].Nevertheless, these very same challenges provide interesting features for the development of hardware security applications [19], including physical unclonable functions (PUFs) and the mentioned TRNGs.
This article presents an RRAM-bias current starved ring oscillator (CSRO) as TRNG.The cycle-to-cycle variability of an RRAM device is exploited as a source of randomness.A voltage divider composed of a single RRAM and a resistor is considered to bias the gate terminal of the extra pMOS transistor of every current starved (CS) inverter of the ring oscillator (RO).Before enabling the RO, the RRAM is forced to switch from low resistance state (LRS) to HRS.The cycleto-cycle variability causes the RRAM to have a different equivalent resistance value in every switch from LRS to HRS, deriving thus a different oscillation frequency of the RO.This unpredictable oscillation frequency is exploited to extract a random bit by including a one-bit counter to the design.The circuit is simple, adding a low area overhead.Results based on experimental measurements confirm the feasibility of the proposal.

II. TRNG PROPOSAL
An RO is a well-known circuit composed of an odd number of regular inverters, whose outputs alternate between high and low voltage levels.The output of every inverter is in turn the input of the next one.The output of the last inverter is fed back to the first inverter.An example is illustrated in Fig. 1.One of the inverters is commonly replaced by a nand gate so that the extra input (EN) can enable/disable the RO.Due to the delay in every inverting stage, the RO spontaneously oscillates at a given frequency.Hence, ROs are exploited for a wide variety of applications, including hardware security primitives, such as PUFs and TRNGs.
By adding transistors to the regular inverter [Fig.2(a)], a CS inverter is obtained.The extra transistors are used to control the drain current.The CS inverter in Fig. 2(b) includes an extra pMOS transistor.The one in Fig. 2(c) includes an extra nMOS transistor, whereas the CS inverter in Fig. 2(d) includes both pMOS and nMOS transistors.Concerning ROs, the delay of CS inverters can be controlled to adjust the frequency of oscillation.This adjustment can be obtained by the gate voltage of the additional transistors stacked in nMOS and/or pMOS networks.In the field of hardware security, CS inverters in ROs have been already proposed to counteract the effect of temperature in TRNGs [30] and to enhance the reliability against temperature and supply voltage variations in PUFs [31].
The proposed TRNG is based on CSRO where only an extra pMOS transistor has been included in every inverter, as shown in Fig. 3.This option has been selected to simplify the bias circuit to control the gate voltage of the extra transistors.The bias circuit is a voltage divider composed of an RRAM and a resistor (R p ), as illustrated in Fig. 4. The top electrode (TE) of the RRAM is connected to one of the terminals of the resistor (V p ′ ).The transmission gate isolates the voltage divider from the RO during the programming   mode.When enabled (EN = 1), the transmission gate passes the voltage V p ′ -V p , which is in turn the gate terminal of the CS pMOS transistor of every inverter, as shown in Fig. 3.The voltage V p depends on the HRS resistance value of the RRAM.Due to cycle-to-cycle variability, the equivalent resistance is unpredictable after every switch from LRS to HRS, inducing different frequencies of oscillation.The 1-bit counter allows the extraction of a random bit at the output of the circuit, as shown in Fig. 3.Although CSROs were proposed in [28] for TRNGs, that simulation work exploited RTN as the source of randomness.
The operation of the proposed TRNG is detailed next.An illustrative timing diagram summarizing the behavior of the TRNG is presented in Fig. 5.
1) Initially, the RRAM is in the HRS and the CSRO remains disabled (EN = 0).2) V READ1 is applied to the voltage divider (V BE ).Then, the CSRO is enabled during a certain period of time (PW).The unpredictable oscillation frequency of the CSRO depends on the particular (high) resistance value of the RRAM.The output of the flip-flop (1-bit counter) switches with every rising edge of the clock signal (CLK).3) Once EN is low (CSRO disabled), a random 0/1 is obtained at the output of the TRNG (random bit).
A logic 1 is obtained in the example in Fig. 5. 4) For a new random bit, an SET operation followed by a RESET operation is applied to the RRAM.(For simplicity, these operations have been omitted in Fig. 5.) Therefore, after applying this programming sequence the device is again in the HRS but with a different (high) resistance value due to the cycle-to-cycle variability.5) The previous steps are then repeated to obtain the next random bit.The CSRO must be enabled for a long time (PW) in comparison to the period of oscillation to ensure the randomness of the extracted sequence of bits.However, as the frequency of oscillation is high, PW can still be low enough to ensure a high throughput.During the normal operation of the RO, the voltage on the bottom electrode (BE) of the RRAM (V READ1 ) must be appropriately selected to guarantee that the resistance state of the RRAM is not degraded, regardless the particular resistance value of the device.This issue is addressed in Section IV.

III. RRAM DEVICES AND MEASUREMENT SETUP
The RRAM devices considered throughout this work are TiN/Ti/HfO 2 /W structures.The oxide thickness is 10 nm, and the area is 15 × 15 µm 2 .More information about the fabrication process is given in [20].The electrical characterization of the devices was performed using a Keysight B2912A Precision source/measure unit (SMU) and a Tektronix Arbitrary Function Generator (AFG3102).The experimental setup is shown in Fig. 6.The experiments were performed based on an equivalent configuration to the voltage divider proposed for the TRNG (Fig. 4).For the automation of the measurements, the instruments were connected to a computer via general purpose interface bus (GPIB) and controlled using MATLAB.Before carrying out the experiments to obtain the cycleto-cycle variability of the RRAM, the device was assessed in dc and pulse mode.During this characterization, the HRS median was reported to be around 2.5 k , while the LRS median was around 130 .Therefore, there was around one order of magnitude between LRS and HRS.

IV. EXPERIMENTAL MEASUREMENTS
Once the electrical characteristics of the device were assessed, we conducted an experiment to extract the cycle-to-cycle variability of the device in HRS.We considered the same set-up previously presented in Fig. 6, including the voltage divider composed of an RRAM and a resistor (R p ).In this case, the purpose of the experiment was focused on measuring the cycle-to-cycle variability in HRS and its potential exploitation as a source of randomness.We considered the variability in HRS since it is higher than the one in LRS.In this experiment, we applied a long sequence of SET-READ1-RESET-READ2 pulses to obtain 10 6 resistance states in HRS.The timing diagram of the applied voltages is shown in Fig. 7. SET and RESET operations were required to switch the device from one state to the other (from HRS to LRS and LRS to HRS, respectively).The READ operation after RESET (READ1) was applied to measure the resistance state after the RESET operation.It must be pointed out that it is equivalent to the bias configuration of the voltage divider to be considered during the operation of the TRNG, i.e., when the RO is enabled, see Fig. 5. Finally, the READ operation after SET (READ2) was not strictly necessary and was only included for validation purposes.Therefore, we could read the state in LRS and thus check the behavior of the device along the experiment.According to Fig. 7, V RESET was positive since RESET pulses were applied to the BE (V BE ) of the device by means of the function generator.Nevertheless, V SET was also positive because SET pulses were applied to the TE (V p ) of the device by means of the SMU.
V READ1 was thoughtfully selected, assuming worst-case conditions for voltage drop estimation across RRAM, considering that R p = 4 k .For this purpose, we selected V READ1 = 0.4 V.In this way, the resistance state of the RRAM was not degraded, as we will discuss later.The histogram summarizing the results from the sequence of RESET-READ1-SET-READ2 pulses to obtain 10 6 resistance states in HRS is shown in Fig. 8(a).The plotted resistances are those measured during READ1.The corresponding cumulative probability plot is shown in Fig. 8(b).The resistance variability is slightly higher than one order of magnitude and follows a similar trend as reported in other works for similar devices [32].This variability is exploited as a source of randomness for the proposed TRNG.
Another experiment was also conducted to demonstrate that the resistance state was not degraded during READ1.This experiment assessed the behavior of the device in pulse mode but applying two READ pulses after a RESET operation to measure the equivalent resistance of the device in HRS.These two READ pulses had different voltage amplitudes: the typical READ voltage (0.1 V) was applied first and next the worst-case scenario was applied (V READ1 = 0.4 V).The results are illustrated in Fig. 9.It is observed that the resistance values are very similar in both cases, without noticeable degradation when a higher READ voltage was applied.

V. SIMULATION RESULTS
The proposed TRNG (Fig. 3) was designed for the STMicroelectronics 65-nm CMOS process.Electrical simulations of the circuit were subsequently performed with HSPICE.The RO included seven inverting stages.All the cells were based on transistors with standard V T .nand gate (strength ×2) and D Flip-Flop (strength ×4) were standard cells provided by the hit-kit of the technology.The CS inverters (HS65_LS_CSIVX2) were based on an inverter provided also by the hit-kit (strength ×2), but modified to include the extra pMOS transistor.A summary of the cells considered in the design is shown in Table 1.The RRAM was emulated by a variable resistance so that the particular resistance was set according to the experiments obtained with the real device, as reported in Fig. 8.In fact, the sequence of equivalent resistance values was forced to follow the same order as they were obtained during the experiments.
Throughout the simulations, the operating voltage (V DD ) of the TRNG was 0.7 V.The voltage applied to the voltage divider (V BE ) was V READ1 = 0.4 V, the same value used during the experimental measurements and R P = 4 k .The relationship between the RRAM resistance and the induced frequency of oscillation is illustrated in Fig. 10.As expected, the higher the RRAM resistance, the lower the V P , and as a result, the higher the oscillation frequency.The range of oscillation frequencies is higher than one order of magnitude within the range of RRAM resistances obtained during the experiments (red-shaded area in Fig. 10).The plot also represents the equivalent number of rising edges (N count ) for PW = 900 ns, i.e., the time interval the CSRO was enabled during the simulations.

VI. EVALUATION AND DISCUSSION
To assess the performance of the proposal, the National Institute of Standards and Technology randomness tests (NIST) (SP800-22) were used to evaluate the stochasticity of the bitstream [33].The 1-bit bitstream was composed of 10 6 bits obtained from the simulations of the TRNG based on the resistance values extracted from the experimental results presented in Section IV.For each randomness test, a probability value (P-value) was returned and compared to the significance level to check whether the bitstream was random.A specific test was passed only when the resulting P-value was larger than the significance level (0.01), otherwise, it failed.The results are summarized in Table 2, including also the P-value.The obtained bitstream provided high randomness performance and passed all the NIST randomness tests.It is worth mentioning that no postprocessing was required to pass the tests.
The effect of temperature was also considered.The circuit was simulated for T = 5 • C and T = 125 • C. The RRAM measurements were obtained at room temperature.The obtained bitstreams reported similar randomness properties and passed all the tests.
The pulse parameter (PW) was carefully chosen to ensure the randomness of the generated bits.PW should be kept low since it has a negative impact on throughput.Moreover, the time required to apply an SET and an RESET operation to  the RRAM must also be considered to estimate the speed of the TRNG.In this article, the present implementation with the current experimental setup provides low throughput, but it is still sufficient for some encryption applications [27].Nevertheless, speed is limited by the setup rather than the circuit proposal itself.In fact, RRAM devices have been proven to switch at a much faster speed (<10 ns) [34].Furthermore, ROs implemented in lower technology nodes will result in higher oscillation frequencies, which in turn will allow decreasing PW.Hence, in an overall implementation, the proposed TRNG could easily provide a throughput in the order of Mbps.
In terms of area, the proposed circuit is simple and does not lead to significant area overhead.However, the area of the circuit (Table 1) will decrease with an implementation in a lower technology node.A similar reasoning can be applied to the bias generator circuit.The targeted RRAM, intended for research purposes, could be replaced by a smaller device (nm range instead of µm) in a final implementation of the TRNG so that it would not be the limiting component in terms of area.
During the enabling of the RO, RRAM is biased with a low voltage value, which could boost the appearance of RTN.Charge trapping and detrapping are typically in the order of µs-ms, similar to the order of magnitude (or higher) than the target PW.RTN is a multilevel low-frequency noise, exploited by other proposals as source of randomness.Hence, in a potential context RTN might the of the proposed TRNG, it would add an extra source of variability in the oscillation frequency, which would be beneficial from the randomness point of view.
Regarding power consumption, the simplicity of the proposal makes it suitable for low-power applications within Internet of Things (IoT).However, in the present work, the energy related to the programming of the RRAM is much higher than recommended.This is due to the target devices, intended for research purposes since the resistance states are low (from hundreds of s in LRS to a few kilo-ohms in HRs).This issue is not to be a limiting factor, since it has been demonstrated that RRAMs can consume only 0.1 pJ/bit during a write operation [35].This limitation can be solved in a final implementation by selecting an RRAM device with higher resistance state values.On the other hand, the energy consumed during the bit generation is 3.64 pJ/bit, which is a competitive result in comparison with other RRAM-based TRNGs.
Device-to-device variability is not expected to influence the behavior of the proposed TRNG as as such variability is not significantly higher than the corresponding cycle-to-cycle variability.Otherwise, R p should be adjusted accordingly.
A further comparison with existing RRAM-based TRNGs can be found from Table 3.The column referred to as ''NIST passed'' reports the number of passed tests related to the number of applied tests.In some cases, it was not possible to apply all the NIST tests (15).Our proposed TRNG reports promising results according to the comparison presented in Table 3.

VII. CONCLUSION
This article exploits the cycle-to-cycle variability of an RRAM in HRS as the source of randomness for a TRNG.A voltage divider composed of a single RRAM device a resistor is used to bias the gate terminal of the extra pMOS transistor of CS inverters of an RO.When the RRAM switches to the HRS it induces a different (random) oscillation frequency in the RO.A 1-bit counter is included in the design to extract the sequence of random bits.
Experimental measurements were performed to derive the cycle-to-cycle variability of a real device.These measurements were subsequently included in electrical simulations to validate the behavior of the TRNG.NIST tests were applied to assess the stochasticity of the random bits.The obtained bitstream passed all the NIST tests without the need for postprocessing.The proposed TRNG is simple, adds low area overhead, and could easily provide a throughput in the order of Mb/s in a final implementation.

FIGURE 5 .
FIGURE 5. Timing diagram for the TRNG during the random bit generation stage.

FIGURE 9 .
FIGURE 9. Equivalent resistance during successive pulsed SET and RESET operations.The resistance after RESET is measured at two consecutive READ voltages, first V READ = 0.1 V, and then V READ = 0.4 V.

FIGURE 10 .
FIGURE 10.Oscillation frequency as a function of the RRAM resistance.The number of counts (N count ) is also shown considering PW = 900 ns.