Shahrzad Pour

Daniel Balouek
email: daniel.balouek@inria.fr

Amir Masoumi
email: masoomi.am@gmail.com

Martin Brynskov

An urgent computing oriented architecture for dynamic climate risk management framework

The Computing Continuum drives holistic system integration, especially in the road sector, where there's a growing need for comprehensive Decision Support Systems in operation and maintenance strategies based on sensor data. These systems offer dynamic assessments, critical for managing road assets vulnerable to climate change and extreme weather events. The resulting data uncertainties, including variations in data veracity and variability require timely decision-making for coordination and adaptiveness of the system as a whole. We introduce an urgent computing architecture for a dynamic risk management framework, discussing its related challenges and software design patterns.

INTRODUCTION

The impact of climate change heavily influences operation and maintenance activities of critical infrastructure at strategic, tactical, and operational decision levels [START_REF] Christopher | Climate change 2014-Impacts, adaptation and vulnerability: Regional aspects[END_REF], [START_REF] Qiao | Flexible pavements and climate change: A comprehensive review and implications[END_REF]. Extreme weather events impact transportation systems, including roads, rails, and electrical lines, to a significant degree. An illustration of this can be seen in the trends of economic losses caused by climate-related events in EEA member states from 1980 to 2020, which total over 500 million euros. A substantial 80% of this sum is attributable to severe weather phenomena, whereas insured losses comprised a mere 25% to 33% of the total losses [START_REF]Economic Losses and Fatalities from Weather-and Climate-Related Events in Europe[END_REF]. Although the financial implications of climate change are well understood, there is still a lack of information concerning its operational implications, particularly with regard to precautionary measures against the inevitable changes that arise.

Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from permissions@acm.org. The Internet of Things has been one of the enablers of smart services across various domains. At a higher level of abstraction, it encourages a holistic approach to software design by fostering the integration of multiple isolated systems. In practice, the physical division of these systems into distinct sub-units systems results in the management of separate silos, to the detriments of crossdomain decision making. At the same time, modern applications are moving in the direction of the Continuum Computing, a distributed approach where Cloud, Edge and IoT aim to collaborate for publishing, cleaning and computing data while managing aspects of performance, security and QoS [START_REF] Victor Casamayor Pujol | Fundamental research challenges for distributed computing continuum systems[END_REF][START_REF] Balouek-Thomert | Towards a computing continuum: Enabling edgeto-cloud integration for data-driven workflows[END_REF].

A class of time-sensitive systems and applications known as Urgent Computing makes use of distributed data sources to speed up the making of important decisions [START_REF] Balouek-Thomert | Harnessing the Computing Continuum for Urgent Science[END_REF]. Similar requirements apply to risk assessment for road infrastructure, specifically for predictive models, reactive/adaptive planning, and KPI monitoring, as outlined in [START_REF] Lasi | Industry 4.0[END_REF]. In order to avoid or mitigate the adverse effects of climate change on road infrastructure, there is an opportunity to use distributed resources throughout the Computing Continuum and leverage urgent computing principles to predict the outcomes of scenarios [START_REF] Balouek-Thomert | Harnessing the Computing Continuum for Urgent Science[END_REF]. In the context of road safety, the wide array of system capacities and varying service capabilities, alongside the significant uncertainty stemming from disparities in data quality and availability, present the primary challenges in constructing an adaptive Decision Support System (DSS) [START_REF] Pour | Towards a Technology-Driven Adaptive Decision Support System for Integrated Pavement and Maintenance strategies (TDADSS-IPM): focus on risk assessment framework for climate change adaptation[END_REF]. Addressing the vulnerability of road assets to weather conditions, the authors have incorporated a climate risk management framework in line with the definition provided in [START_REF] Jean P Palutikof | Decision support platforms for climate change adaptation: an overview and introduction[END_REF]. This comprehensive risk management framework is typically recognized as either an independent module or an essential component within a DSS, often implemented through iterative processes as outlined in [START_REF] Jean P Palutikof | Decision support platforms for climate change adaptation: an overview and introduction[END_REF].

In this paper, we propose a proactive, holistic architecture for risk management and road safety. This is a major shift in the way transport networks function, and it requires the ability to effectively estimate road conditions risk as a function of operating conditions and information technology. By integrating IoT and climate risk data into all decision-making levels, we move away from current approaches. Our method combines an architecture for data-driven workflows across systems with the needs of a big data pipeline for a risk management framework. The goal is to address the uncertainty surrounding climate data (veracity) and the demanding time and quality constraints when making decisions based on significant variations in data patterns (variability).

The remainder of the paper is organized as follows. Section 2 discusses the motivation, background, and challenges for this work. Section 3 proposes an architectural vision for the risk management framework. Finally, in Section 4, we summarize this paper and discuss future works.

MOTIVATION, BACKGROUND AND CHALLENGES 2.1 Motivating Use Case

During severe weather events, there's a significant surge in data from diverse sensors and weather stations, especially upon surpassing specific thresholds. Urgent data preprocessing becomes crucial due to immediate actions required during these events and uncertainties regarding the number of interoperable subsystems necessitating data exchanges. This surge affects operation and maintenance activities, presenting two primary challenges: insufficient coordination and adaptiveness among agencies.

Background

Holistic Decision Support Systems in road sector The integration of decision-making processes within road domain literature has been relatively underexplored. Early studies, like [START_REF] Greenstein | Integrated Pavement and Maintenance Management for Jamaica[END_REF], focused on integrating maintenance into Pavement Management Systems. Recent research, such as [START_REF] Kachwalla | Real time pavement asset management and integration with work order management[END_REF], delves into real-time GPS and GIS technology integration. While [START_REF] Siva | Pavement asset management systems and technologies: A review[END_REF] offers a comprehensive survey of advancements in the road sector, rarely studies [START_REF] Pour | Towards a Technology-Driven Adaptive Decision Support System for Integrated Pavement and Maintenance strategies (TDADSS-IPM): focus on risk assessment framework for climate change adaptation[END_REF] explicitly addresses the vital requirement for adaptation mechanisms to handle uncertainties within Decision Support Systems (DSSs).

Architecture-oriented approaches for addressing the Continuum. Architectural approaches are vital for managing the Computing Continuum, introducing unique challenges concerning subcomponent control and adaptation. The aggregation of architectural and algorithmic challenges within individual components [START_REF] Victor Casamayor Pujol | Fundamental research challenges for distributed computing continuum systems[END_REF][START_REF] Balouek-Thomert | Towards a computing continuum: Enabling edgeto-cloud integration for data-driven workflows[END_REF] poses complexities as these subcomponents inherently influence each other while conducting urgent analytics [START_REF] Russell L Ackoff | Towards a system of systems concepts[END_REF]. Predicting infrastructure volatility and meeting the demands of urgent analytics is challenging due to their unpredictable ature [START_REF] Beckman | Harnessing the computing continuum for programming our world[END_REF].To best of our knowledge, leveraging the Computing Continuum for this application constitutes a novel direction in the field.

Dynamic Risk Management framework A dynamic risk management framework involves five iterative steps: context establishment, risk assessment using various techniques and algorithms, exploration of mitigation strategies (often in consultation with stakeholders), implementation of these measures, and continuous monitoring and review through KPI dashboards. This comprehensive definition is part of an overview paper on adaptive decision support systems in the context of climate change [START_REF] Jean P Palutikof | Decision support platforms for climate change adaptation: an overview and introduction[END_REF] and is depicted in Figure 1. Bayesian Believe Network (BBN) as a bottom-up approach [START_REF] Jean P Palutikof | Decision support platforms for climate change adaptation: an overview and introduction[END_REF] has been the chosen approach [START_REF] Pour | Towards a Technology-Driven Adaptive Decision Support System for Integrated Pavement and Maintenance strategies (TDADSS-IPM): focus on risk assessment framework for climate change adaptation[END_REF]. However, the details of risk assessment model is not the focus this paper,the risk assessment model can continually mature over time using the BBN model, integrating stakeholders' beliefs or new inputs whenever necessary.

Challenges

Urgent data-driven workflows must be efficiently coordinated by developers and service providers in order to construct time-sensitive decision-making pipelines. Accommodating the considerable infrastructure heterogeneity, this coordination must address uncertainties related to data source dependability and availability [START_REF] Sergey | Deadline-driven Resource Management within Urgent Computing Cyberinfrastructure[END_REF]. In the realm of road safety, three specific challenges stand out: Automated data collection Currently, operational technologies in this domain are functionally silo applications [START_REF] Pour | Towards a Technology-Driven Adaptive Decision Support System for Integrated Pavement and Maintenance strategies (TDADSS-IPM): focus on risk assessment framework for climate change adaptation[END_REF]. Edge technologies can provide incentives to sanitize data and respect the privacy of individual systems while allowing for the sharing of information to make the system unbiased and flexible. Autonomics Programming abstractions that allow the specification of application behaviors that can react to unforeseen events during runtime are therefore critical to the overall performance of applications deployed throughout the continuum [START_REF] Renart | An edge-based framework for enabling data-driven pipelines for iot systems[END_REF][START_REF] Gibb | The Technologies Required for Fusing HPC and Real-Time Data to Support Urgent Computing[END_REF]. Furthermore, to enable resource and execution path adaptability across the continuum, autonomic runtime techniques are required [START_REF] Ioan | Autonomics at the Edge: Resource Orchestration for Edge Native Applications[END_REF]. Integration of Smart Solvers: Decision Systems are essentially alike to solving combinatorial problems. Constraint programming (CP), particularly in the form of Constraint Satisfaction Problem (CSP), is well-suited for generating feasible planning solutions and strategies swiftly in scenarios involving real-time uncertainties across various resource classes. Additionally, Constraint Optimization Problem (COP) is a viable option when time and resources permit for plan optimization. Online/Real-time Communication: Modern data services and messaging protocols allows and simplifies the development of a holistic DSS [START_REF]Investigating messaging protocols for the Internet of Things (IoT)[END_REF]. The current state of the management systems used in the road sector (PMSs & MMSs) do not utilize direct data exchange and communication between the systems. Introducing online and real-time communication between systems in a unified architecture that includes both management components, will allow for knowledge-oriented communication.

ARCHITECTURE 3.1 Architecture Goals: Functionality and Interoperability Design

The design goals of this architecture are as follows:

3.1.1 Functional Requirement: The architecture should consider the required data sources, end-to-end process, actors, and deployment: Data sources: Various static and dynamic data sources are involved in the use case, including the meteorological and hydrological data, flood-sensitive areas (blue spot data model [START_REF] Axelsen | Blue spot analysis: a key component in the climate adaptation of major Danish[END_REF]), and road infrastructure condition data.

End-to-end Process: The pipeline should address the data collection, orchestrating operations, and demanded data operations i.e. modules of the risk management framework in uncertainty situations, including extreme weather events and climate changes.

Actors: Actors include infrastructure owners or maintainers, with road authorities and municipalities being predominant in the former category and consulting companies in the latter. Additional actors could include citizens, particularly if the system is used as an early warning system to notify them about extreme weather events. Deployment: The system as an infrastructure as code per stakeholder or per region, while most subsystems are partly autonomous on the device edges or fog but able to receive the task upon decision by the system. The architecture should address the necessary services required for fulfilling urgent tasks, including identifying available computing resources and data sources within the computing environment as well as ensuring that resources are allocated efficiently to meet the immediate computation demand.

Proposed Architecture

Figure 3 depicts our software architecture, responsible for gathering data from diverse sources such as road asset conditions, floodsensitive areas, and various climatological data including precipitation, zero-crossing (indicating fluctuations around zero degrees), and sea-level rise. This data is fed into the pipeline, triggering an 'event receiver' for extreme weather events and data changes. Orchestration manages essential services, communicating through a message broker. The resulting information is utilized by applications.

3.2.1

Addressing Functional requirements. We endorse an event-driven microservice architecture as our chosen architectural style, wherein 'event-driven' characterizes our coordination/communication model, and 'microservices' define the pattern for allocating responsibilities.

Microservice architecture for allocation of responsibilities:

The module of orchestration service, and all the modules of Interaction, Discovery, and Optimization as part of urgent computing modules plus the modules of dynamic risk assessment are developed each as one separate microservice.

Event-Driven Architecture as coordination/communication model: Event-driven architecture utilizes a message broker to reduce coupling between producers and consumers. This intermediary element effectively handles high volumes of data at different speeds by storing data or notifications in a queue until resources are available for processing.

3.2.2 Interoperability tactics. Among two main categories of interoperability tactics i.e. locate and manage interfaces [START_REF] Bass | Software architecture in practice[END_REF], we use below tactics: Urgent Discovery Service: a locate tactic: When it comes to addressing urgent requirements for processing extreme weather events, the initial step involves activating a discovery service. This service is tasked with identifying and pinpointing accessible data sources residing in edge, fog, or cloud as data spaces.

Interaction Service: an Interface tactic This service acts as an interface to interact with multiple external subsystems and various actors. A RESTful API is designed for minimal interdependency between clients and servers. It is worth mentioning the efforts made to establish minimal interoperability standards and tools for enhancing data, system, and service interoperability between cities and supplier stakeholders [START_REF]Redefining smart city platforms: Setting the stage for Minimal Interoperability Mechanisms[END_REF].

Orchestration Service: an interface tactic The orchestrator acts as a middleware enabling the composition of services based on specific goals and content, rather than directly engaging with devices or names. In this scenario, the architecture becomes domainagnostic, and interoperability is enhanced through the use of discovery services and optimization services to address resource uncertainty and data availability.

Optimization Service: a locate tactic: This service plays a crucial role in efficiently and effectively managing computational resources to meet the urgent demands of tasks in the whole data space environment to make sure all the systems and subsystems are interoperable resource-wise towards a common goal. The service is modeled as CSP, in case of urgency and is run as a COP upon having enough resources time-wise.

CONCLUSION AND FUTURE WORKS

In this study, we've integrated an urgent computing architecture into a dynamic risk management framework to manage time-sensitive tasks during extreme weather events. This approach addresses big data challenges posed by variability and reliability across IoT-Edge-Cloud resources. The architecture's implementation and evaluation will be based on real data from the Danish Meteorological and Hydrological Institutes (DMI, and DHI), coupled with road condition data from authorities. Furthermore, our plan includes enhancing the risk assessment model by integrating pavement bearing capacity data to evaluate pavement structure functionality.

Figure 1 :

 1 Figure 1: Dynamic Risk Management Framework

3. 1 . 2 Figure 2 :

 122 Figure 2: Horizontal and Vertical Interoperability of the Dynamic Risk Assessment Domain

Figure 3 :

 3 Figure 3: Proposed Urgent Computing Architecture for Dynamic Risk Management Framework

ACKNOWLEDGMENTS

Thanks to CitCom.ai TEF (Digital Europe grant no. 101100728), ELEXIA (Horizon Europe No. 101075656), IEA EBC -Annex 81 -Data-Driven Smart Buildings (EUDP Project No. 64019-0539), and the NSF under OAC 2238064 which in part supported this research.


domain: info spi

text:
David Lubicz
email: david.lubicz@univ-rennes1.fr

Viktor Fischer
email: fischer@univ-st-etienne.fr

Recommendations for Design and Validation of a Physical True Random Number Generator Integrated in an Electronic Device Version 1.0

In this Recommendations, we describe essential elements of the design of a secure physical true random number generator (PTRNG) integrated in an electronic device. On the basis of these elements, we describe and justify requirements for the PTRNG design, validation and testing, which are intended to ensure security of the generator aimed at cryptographic applications.

Introduction

Random number generators (RNGs) represent essential part of each cryptographic equipment. In particular, they are used to generate keys, key identifiers, initialization vectors, nonces, but also to protect cryptographic equipment against attacks using side channels like power consumption, electromagnetic emanation, sound, etc. Random number generators are important because they are the only source of diversity in cryptographic algorithms, a diversity whose combinatorial richness characterized by entropy (Shannon entropy or min entropy) constitutes the only protection against brute force attacks. In general, most of the state-of-the-art RNGs are hybrid: they consist of a true random number generator (TRNG) and a preudo-random number generator (PRNG). A TRNG, which exploits some physical random phenomena to guarantee unpredictability, reseeds periodically a deterministic PRNG, which must be cryptographically secure, i.e. it must exploit a cryptographic mode with a proven security (see [START_REF] Killmann | A proposal for: Functionality classes for random number generators[END_REF]) or use an approved cryptographic algorithm (see [START_REF] Barker | Recommendation for Random Number Generation Using Deterministic Random Bit Generators[END_REF]). The PRNG ensures security of the generator based on computational assumptions if the source of randomness in the generator fails to operate correctly. However, this is accepted only for some short time interval depending on targeted security level and quantity of entropy accumulated in the PRNG (the PRNG must contain enough entropy, which was accumulated before the failure of the physical source of entropy). This document concerns only the TRNG part of an RNG. We define and describe essential elements of a TRNG design approach that ensures security of the generator and takes the most recent advances of a RNG design into account. Indeed, it may be possible to design a generator for which it would be difficult to construct a real attack, even without adopting the recommended approach. However, we think that for devices such as random number generators which guarantee security in cryptographic applications, the developer has to provide a security demonstration, and we believe the proposed approach provides the strongest assurance together the less possible constraints on the design. Similarly to cryptographic applications, in which the designer has to prove security of protocols on widely accepted computational assumptions, we want to prove unpredictability of generated numbers by estimating a lower bound of the entropy rate of the TRNG upon well established assumptions about the randomness of some identified physical phenomenons. For this, we consider an attacker which may have full knowledge of the TRNG design and can observe its output. We make no assumption on its computational power, i.e. it can be theoretically unlimited. Unidentified phenomena may contribute to the random nature of the operation of the TRNG. This is evidenced for example by the statistical tests of the generator output bits which may show that the output bits have higher entropy rate than could have been predicted taking into account only identified physical noises. However, in the framework of our approach, we do not take into account these unidentified noises because it is not possible to evaluate their contribution to the security of the generator. In the following, in order to distinguish the entropy rate produced by identified phenomena from the rest of the entropy, we will call it the proven entropy.

Document version 1.0

We believe that a TRNG which could not, by design, be suited to such an analysis, should be considered as improper to be used in high security cryptographic applications. Unfortunately, the security analysis of numerous constructions published in the literature is based on dubious arguments if analyzed as recommended in this report. Our approach is described in a series of requirements that are well-founded and argued 1 . We provide definitions that appear important and are perhaps insufficiently clarified in the literature: for example, that of the stochastic model of the physical noise that we distinguish from the stochastic model of the entire generator. We specify in what testing conditions the statistical tests can be used (essentially when a stochastic model of the generator is available). If these conditions are not fulfilled, the statistical tests are not useful and can even lead to incorrect conclusions. Each requirement or concept is illustrated with the particular case of a ring oscillator based elementary random number generator. Such an elementary generator, which is described in Appendix A, has the advantage of being easy to describe and implement on all types of supports (FPGA and ASIC, including all CMOS technologies) as well as a structure that is among the most studied and best understood among those described in the literature (see [START_REF] Fischer | Ring oscillators and self-timed rings in true random number generators[END_REF] for an overview of TRNGs using free running oscillators as a source of randomness). Presented example of application of ring oscillators confirms rigorosity of the chosen approach, which remains compatible with the production requirements of a data security device including random number generator. The document has the following structure. In Section 2 we give the general objectives of the evaluation process described in the document and we introduce basic definitions and requirements regarding the TRNG design. Section 3 regroups definitions and requirements for the model of the source of randomness. Section 4 gives definitions and requirements for fitting of the model with the generator. In Section 5 we specify objectives and kinds of required embedded tests. The proposed PTRNG design and evaluation approach is compared with methodologies required by German AIS20/31 and American NIST SP 800-90B standards in Section 6. We conclude the document in Section 7.

TRNG design -definitions and requirements

In most cases, the design of a physical true random number generator and its security evaluation are performed by independent institutions and companies.

The certification bodies give a limited number of licenses to laboratories that are empowered to perform security evaluations. In order to simplify the evaluation process, the TRNG designer, the evaluation laboratory and the certification body should use the same vocabulary and identical definitions and terms. The design and certification process should ensure the highest level of confidence in the design and security of the TRNG aimed at cryptographic applications while giving the designers the maximum freedom to conceive a TRNG, which fitts in with the particular constraints of their projects. Since the security proof we want to achieve is based on a mathematical model of the TRNG, one of the main difficulties of the security evaluation process is to guarantee accordance of the model with respect to the reality. To achieve this objective, it is very important to be able to verify how the main building blocks of the model of the TRNG fit with the structure of the TRNG itself. To make this task easier, we regroup our definitions and requirements in four categories:

• [Design] which deals with the principle of the TRNG itself;

• [Model] which deals with the stochastic model of the TRNG;

• [Model fitting] which deals with the verification of the model fitting in with the generator;

• [Tests] which deals with embedded testing strategies of the generator.

It is quite clear that the operation of a TRNG, whose essential characteristic is to produce a series of unpredictable bits or binary numbers, must necessarily rely on unpredictable physical phenomena, that we call in the following the physical noises, the outcome of which must be converted into a series of bits or numbers.

This motivates the following general definitions:

Definition 1. ([Design] Source of randomness)
The source of randomness is an uncontrollable physical random phenomenon (or random phenomena), which is (are) transformed to electric signals featuring some random analog components -amplitude and/or phase.

Definition 2. ([Design]

Core of randomness) The core of randomness is a physical area, i.e. an electronic or opto-electronic device (or its part), featuring the source (or sources) of randomness, which is delimited by a well defined security boundary. It is characterized by its internal state E(t), which evolves depending on physical random phenomena appearing inside this area (physical noises).

Remark 1. As stated in the definition, the physical core of randomness is a device or its part, in which some random phenomenon or random phenomena appear.

The security boundary of this area must be well defined by the designer. At first glance, it could seem that this boundary can be chosen arbitrarily. For instance, it is always possible to consider that several cores of randomness constitute a unique bigger core. Nonetheless, we will see that the interpretation of many requirements will depend on the choice of the boundaries of the cores, which include sources of randomness. These requirements will be, most of the time, easier to fulfill by choosing the smallest possible security boundary for the physical cores even if it means splitting a big core into smaller and more elementary ones. Nevertheless, the designer can chose freely the boundary of the core of randomness as long as he can fulfill all the requirements.

Example 1. The TRNG from Appendix A features two physical cores of randomness: the oscillators Osc i (i = 0, 1), which produce clock signals

s i (t) = f (ϕ i (t)).
The internal state of the oscillator Osc i at time t is characterized by its current phase ϕ i (t). The phase ϕ i (t) of Osc i is affected by different noise sources (thermal noise, flicker noise etc.) producing the phase jitter. The source of randomness in the cores of randomness Osc i are the phase jitters depending on ϕ i (t).

Definition 3. ([Design] Physical true random number generator)

In the context of this document, a physical true random number generator (PTRNG) is a device using one or several core of randomness to generate random numbers.

Document version 1.0 Remark 2. We assume that the PTRNG output value can be computed by an attacker, assuming that he can know the internal state of the cores of randomness (see Definition 7 of the PTRNG security model). It means that the security of the PTRNG (and therefore its unpredictability) relies solely on the sources of randomness affecting the core of randomness. As a consequence, in the security assessment of a PTRNG, only a specified list of sources of randomness shall be considered and contribution of all other sources must be neglected.

It should be noted that this assumption does not imply that the output of the PTRNG is guessable from the internal states of the cores of randomness also for the designer. In other words, we assume that the attacker can have more computational power than the designer. So the best possible TRNG design is the one, for which the attacker and the designer have the same (unlimited) knowledge, i.e. for which the output bit is guessable from the internal states of the cores of randomness.

General TRNG structure and its basic parts

In the vast majority of cases, the physical random phenomena used in PTRNGs are analog. The mechanism performing analog-to-digital conversion is thus an integral part of the generator. Accordingly, we distinguish four basic PTRNG blocks (entities) as presented in Fig. 1:

• Core(s) of randomness, which include source(s) of randomness,

• Analog-to-digital converter (ADC),

• Post-processor,

• Embedded tests.

The PTRNG contains in general N cores of randomness that produce electric signals featuring some random component (amplitude and/or phase). These signals are converted into a stream of digits (bits or vectors of bits) by an analog-to-digital converter (ADC). Note that this conversion can be made intrinsically inside the core of randomness. In that case, the ADC block is represented by an identity function, in order to maintain the general structure of the PTRNG.

The ADC outputs a stream of random numbers (bits or multi-bit values), which can feature low statistical quality (e.g. low entropy). In particular, it can feature some deterministic pattern. This low statistical quality can be enhanced, if necessary, by an algorithmic post-processor to obtain a high-quality digital noise. The four main entities of the generator shall be clearly identified.

Example 2. Two cores of randomness appear in the elementary oscillator-based TRNG (EOTRNG) presented in Appendix A: two oscillators generating jittery clocks. The ADC is composed of two parts: the frequency divider and the sampler. The division factor of the frequency divider can be chosen so that a post-processing is not needed (enough entropy is accumulated during each sampling period). The parametric embedded tests scrutinize two generated clock signals and the generator output. They measure TRNG parameters, which are used as input parameters of the stochastic model: the phase jitter drift and volatility and the duty cycle of the sampled oscillator.

Requirement 2. ([Design] Identification of sources of randomness)

All the sources of randomness exploited in the RNG shall be identified and the security boundary of the cores of randomness featuring the sources shall be clearly determined.

Requirement 3. ([Design]

Security boundary of the core of randomness) It shall be ensured that it is impossible for an attacker to breach the security boundary of each core of randomness.

Requirement 4. ([Design]

Unmanipulability of the source(s) of randomness) It shall be proved that the physical random phenomena, which affect the evolution of the internal state of the core of randomness can not be influenced from outside of the security boundary or at least that any tentative manipulation would be detected by embedded tests. In particular, the physical part of the generator ensuring randomness (the core of randomness) shall not have any inputs affecting the source of randomness.

Example 3. In the EOTRNG from Appendix A, the jitter of the two clock signals is composed of both deterministic and non-deterministic (random) component. The global deterministic component is reduced to a negligible size by using a differential principle: two identical oscillators are influenced in the same way by global deterministic signals. We assume that in normal operating conditions of semiconductor devices, the thermal noise is always present. The entropy shall then be estimated in the corner operating conditions, in which the contribution of the thermal noise to the clock jitter is minimal and cannot be further reduced during attacks. Oscillators do not have any inputs.

Remark 3. Requirement 4 implies in particular that the robustness of all sources of randomness shall be thoroughly analyzed and evaluated.

Example 4. In the EOTRNG from Appendix A, the randomness in the generator output depends on the relative phase jitter of the two oscillators. In general, the two oscillators are not fully independent since for instance they may share the same power supply and are subject to cross talks. Nonetheless, it is widely accepted that sources of thermal noises are independent so that if we only consider the thermal noise component of the phase jitter, the two sources of randomness in the EOTRNG can be considered to be independent. The conversion of analog signal components to digital signals (numbers) is supposed to be guessable by an attacker.

Requirement 5. ([Design] Specification of the ADC)

The ADC block shall be clearly identified and its behavior shall be described mathematically.

Remark 4. If the analog-to-digital conversion is fully deterministic, it can be easily described by a mathematical function. If its behavior is partially random (e.g. its less significant bits), at least a statistical description should be provided for instance by a stochastic function.

Example 5. In the case of the elementary generator from Appendix A, the ADC, which transforms the random phase of the clock signal to a random binary value, is composed of the frequency divider and the sampler. The ADC output is post-processed in order to enhance the statistical properties of the generated binary signal, e.g. to increase its entropy rate per bit. The post-processing of the ADC output is not mandatory. Indeed, if the entropy rate per bit is sufficient, a post-processing is not needed.

Requirement 6. ([Design] Specification of the post-processing algorithm)

The post-processing algorithm and its objective shall be clearly identified. The designer shall show that the selected post-processing algorithm does not decrease the entropy rate per bit.

3 Stochastic model -definitions and requirements

Model of the source of randomness

A very important design requirement for a PTRNG suitable for a provable security approach is the ability to identify and distinguish the sources of randomness from the rest of the PTRNG, since sources of randomness and the whole generator should be analyzed in a different manner. This motivates the following definition which represents the main design assumption in our approach: We consider an attacker, which has the full knowledge of the PTRNG design and can freely observe its output. We make no assumption regarding his computational power, which can be even unlimited. The attacker tries to predict output bits of the PTRNG. We measure his effectiveness with the entropy rate of the PTRNG, which is the average amount of information one has to give to the attacker so that it can predict the generator's output bits. We assume that the output bit produced at time t can be perfectly determined by the attacker from the knowledge of the internal state E(t).

The knowledge of the attacker regarding the state of the PTRNG can be described by a statistical distribution p t (x) on the space of states V . The evolution of p t (x) in time depends on two things:

• The physical noises which tend to decrease the attacker's knowledge regarding the state of the generator;

• Output bits which allow the attacker to get some information about the internal state of the generator.

As the incertitude the attacker has on the bits produced by the PTRNG comes necessarily from the incertitude on E(t), in order to be able to compute the entropy rate at the PTRNG output, it is necessary to:

• have a law describing the effect of the physical noise on the evolution of p t (x);

• ensure that this law is stable with respect to time and environmental conditions and be able to follow continuously fluctuations of its parameters;

• have a precise description of the effect of sampling on p t (x);

• be able to compute the probability distribution of bit b(t) from the knowledge of p t (x).

These very general assumptions should encompass most of possible PTRNG designs. In order to fulfill these assumptions, we give first the following definition. Remark 5. Distribution p C t (x) represents all the knowledge that an attacker can have (independently from his computation power) concerning the internal state of the generator core at time t, based on his knowledge of the initial state of the generator at time t 0 . So the stochastic model of the physical source of randomness can be viewed as a law of evolution of the knowledge an attacker can get regarding the internal state of the PTRNG. However, this knowledge tends to decrease in time due to different noise phenomena.

Parameters p 1 , . . . , p n can correspond to a description of the physical environment of the generator (temperature and supply voltage) or a description of the physical properties of the underlying technology. Below, they are termed parameters of the physical noise model. The parameters and the preconditions are assumed to be known by the attacker. The parameters are assumed to be manipulable by the attacker, but only within certain limits. The condition that the statistical model contains all the information accessible to an attacker must be well understood and justified because it has important methodological implications. Example 6. To illustrate importance of the stochastic model, we take a somewhat artificial example of a random number generator G AES built using an AES cipher in counter mode. This kind of generator produces a stream of bits by concatenating 128-bit blocks of the form AES K (Cnt) where AES K is the AES function with the key K and Cnt is the counter. Using such a generator, any distribution that one could call "natural" can be simulated with arbitrary accuracy as it is often found in the domain of exploitation of random phenomena (e.g., [START_REF] Knuth | The Art of Computer Programming[END_REF]). For example, it is possible to approximate a Gaussian distribution G(x, σ) of mean x and standard deviation σ by a binomial law that is very easy to formulate using the outputs of G AES .

Document version 1.0

For any attacker with a limited calculation power, without any knowledge of the key K, this distribution will be entirely indistinguishable, for example using statistical tests, from a distribution generated by a completely unpredictable phenomenon. However, in the context of an analysis of unconditional security that concerns us here, the samples drawn from G AES following the distribution G(x, σ) leak certain information regarding the key K. The attacker can recover this information (since it has an infinite computational power) and then G AES becomes completely deterministic. This example justifies the necessity that the stochastic model of the noise contains all the information that the attacker can gain regarding the source of randomness. If the noise model does not satisfy this condition, the model could be based on the statistical distributions which in reality (perhaps necessitating very complicated calculations) could be described by more accurate statistical laws than those given by the model or even could be fully deterministic. This would result in overestimating the quality of random numbers produced by the generator.

Example 7. In the case of the elementary generator from Appendix A, it should be remarked that even if the elementary generator would not be affected by physical noises, the output bit stream would feature a pseudo-random component (a pattern) depending on the ratio of frequencies ω 1 /ω 0 . In a real implementation of oscillator based TRNG, the TRNG is made of several elementary generators the output of which is gathered for instance by the way of an XOR operator. In this case, the pseudorandom behavior is even more complex and difficult to distinguish from the really random component, which determines the entropy rate of the output bit sequence. Moreover, from one run of the TRNG to another, as the ratio of frequencies may vary due to variations in the physical environment of the TRNG (temperature, supply voltage etc.), the pseudorandom component of the output bits may be difficult to predict and model. This is not a problem in our approach since we do not take the eventuel pattern into account in the estimation of the entropy rate of the TRNG. On the contrary, if we would follow the definition of a stochastic model from [START_REF] Killmann | A proposal for: Functionality classes for random number generators[END_REF] as a family of distribution which contains the real distribution, the stochastic model would necessirely take into account the pseudorandom component affecting the output bits and causing entropy overestimation.

The previous discussion illustrates the following important remark: Document version 1.0 Remark 6. A stochastic model of the physical noise can only be deduced from a detailed description of the source of randomness and from a physical modeling of phenomena that alone can ensure that the deduced law contains all the information concerning the system. The stochastic model of a random phenomenon contributing to the entropy rate at the TRNG output is a family of distributions of really random output values. These distributions may not correspond to the observed distribution, which can be affected by pseudorandom phenomena and which may be difficult to model. A statistical analysis of the output bits, e.g. using statistical tests, is insufficient since it cannot alone distinguish between the random and the pseudorandom component of the noise affecting output bits.

With Definition 8, the following requirement can be required:

Requirement 7. ([Model]
Availability of the stochastic model of the core of randomness) The statistical model M (t, p 1 , . . . , p n ) of each core of randomness exploited by the generator for the production of the proven entropy shall be available.

Example 8. The entropy at the output of the elementary generator from Appendix A depends on several parameters. One of them is the duty cycle α of the sampled clock signal. Besides the duty cycle, the entropy depends on the phase noise, which is caused by different phenomena such as random thermal noise or flicker noise. The thermal noise is known to be independent of other noises. The contribution of the thermal noise to the jitter can be modeled using a one-dimensional Wiener process given by, for i = 0, 1:

P{ξ i (t 0 + ∆t) -x 0 ≤ x|ξ i (t 0 ) = x 0 } = G(µ i ∆t, √ ∆tσ i ),
i.e. it depends on the drift µ i , volatility σ i and accumulation time ∆t. The elements of the two pairs (µ i , σ i ) are the parameters of the physical model. Article [START_REF] Baudet | On the security of oscillator-based random number generators[END_REF] shows that α and (µ i , σ i ) form a complete set of physical parameters for the phase jitter caused by the thermal noise: using these parameters it is possible to simulate perfectly the distribution of output TRNG values due to the thermal noise. The statistical models of the flicker noise are currently not available.

Document version 1.0

Analog-to-digital converter

If the space of states of the PTRNG is continuous, an ADC must be used to produce series of bits or series of binary samples. The ADC can behave fully deterministically, but it can sometimes feature a partially random behavior. In the first case, it can be described by a deterministic function (which can be also the identity function). In the second case, its description can include a random variable. 2We call this function the model of the ADC. In order to take into account its possible probabilistic nature, we suppose that it is of the form:

f 0 : V × S → {0, 1} * ,
where S is a probability space.

Requirement 8. ([Model] Mathematical description of the ADC)

The ADC transforms elements of V × S into a series of bits. The model of the ADC f 0 : V × S → {0, 1} * describing this transformation shall be identified.

Remark 7. In the following, we suppose that for all x ∈ V × S, f 0 (x) has the same bit length that we denote by l f 0 .

Example 9. In the case of an elementary generator, the k th bit is generated at the instant t k that respects (ω

0 (t k + ξ 0 (t k ))) = k. The value of the k th bit is f α (ω 1 (t k + ξ 1 (t k ))
) so that in this case the model of the ADC is just f α . The design of an elementary generator can be easily modified to make the ADC nondeterministic. For instance, we can take for S the set {0, 1} with the equidistributed probability and the function:

f 0 : V × S → {0, 1}, (x, s) → s ⊕ f α (ω 1 (t k + ξ 1 (t k )))
where ⊕ represent the XOR operation.

Let us denote by s(t) the output of the PTRNG at time t, representing the output sample value of the ADC (which can consist of several bits depending on the value of l f 0 ). Recall that we denote by p t (x) the probability distribution P(E(t)|p 1 , . . . , p n , E(t 0 ) = . . .). Let b be a sample of l f 0 bits, the conditional probability p t (x|s(t) = b) is in general different from p t (x). This is due to the fact that the output values s(t) convey some information about the state of the PTRNG, which can be used by the attacker to enlarge his knowledge regarding the PTRNG and to enhance his capacity to guess subsequent bits. In fact, the more the output bits are unpredictable (i.e. the higher their entropy rate is), the more information about the state of the PTRNG they give. This justifies the need for the following requirement:

Requirement 9. ([Model]
Effect of the analog-to-digital conversion) For all t, b, the conditional distribution of probability p t (x|s(t) = b) should be either computed or at least a conservative approximation of it should be obtained. By the conservative approximation, we mean a distribution of probability p * t (x) which gives more information about the actual state of the PTRNG than the value of p t (x|s(t) = b) that is such that for all x such that p * t (x) > 0, we have

p * t (x) ≥ p t (x|s(t) = b).
It is clear that the use of a conservative approximation of p t (x|s(t) = b) gives more power to the outside attacker in his ability to predict the output bits produced by the TRNG. So the proposed approach allows to compute a lower bound of the entropy rate per bit of the TRNG, which can be used to guarantee its security at the expense of its throughput.

Example 10. In the case of the elementary generator, suppose that at time t the knowledge of the attacker regarding the state of the PTRNG is represented by the distribution p t (x) depicted in Fig. 2. It is clear that if s(t) = 1 then the attacker knows that the actual state is inside the red zone, otherwise it is inside the blue zone. So the probability distribution p t (x|s(t) = 1) (resp. p t (x|s(t) = 0)) is precisely given by the relative surface of the red and blue zones. Therefore, in this case, a convenient conservative approximation of the distribution p t (x|s(t) = b) would mean that by knowing the TRNG output at time t, the observer knows also the internal state of the PTRNG. A stochastic model of the PTRNG is a mathematical description of the process of data generation, which is written in a simplified form depending on the statistical assumptions: knowledge of the stochastic model of the physical noise M (t, p 1 , . . . , p n ), the way the physical noise is converted to numerical values in discrete time instants (t 1 , . . . , t k ). The stochastic model specifies the distribution D(k, q 1 , . . . , q m , p 1 , . . . , p n ) of the set of k output values, each composed of l f 0 bits. The model depends on parameters p 1 , . . . , p n of the source of randomness, but also on parameters q 1 , . . . , q m , which are the parameters of the TRNG.

Document version 1.0 x y s(t) p t (x) 1 0
Certain parameters q 1 , . . . , q m may be adjustable during the design of the generator, but must not be manipulable by the attacker.

Example 11. In the case of an elementary PTRNG, the parameters of the model of the source of randomness (the phase noise of oscillator Osc i , i = 0, 1 coming from the thermal noise) are the two pairs (µ i , σ i ) specifying the drift and volatility of a Wiener process. The distribution of PTRNG output values depends also on the duty cycle α 1 of the sampled clock and on an additional parameter, the value of the frequency divisor K D , which is the only tunable parameter of the PTRNG. This assumes that all the previous requirements given in Sec. 3 (and in particular the requirement of availability of a stochastic model of the physical source of randomness) shall be fulfilled.

Requirement 11. ([Model]

Consistency of the statistical model of the PTRNG) The stochastic model of the PTRNG shall be obtained:

• by respecting Requirement 7 to specify the law of p t (x) depending continuously on the time;

• by respecting Requirement 9 to specify the effect of sampling of p t (x) in discrete time intervals.

4 Fitting the model with the generator -definitions and requirements

Requirement 12. ([Model fitting] Identification of physical random sources contributing to random number generation) The physical phenomena responsible for the unpredictable nature of generator operation shall be clearly identified.

Example 12. In the case of the elementary random number generator, the analog electric noises are transformed to the instability of delays in logic gates, which cause the phase jitter of the clock signal generated by the ring oscillator. The phase jitter is a complex phenomenon since it appears to be caused of different noise sources: thermal noise, flicker noise, etc. In our estimation of the proven entropy, we only take into account the thermal noise.

Requirement 13. ([Model fitting] Evaluation of parameters of the physical noises) One shall be able to evaluate experimentally the parameters p 1 , . . . , p n of the statistical model for physical noise M (t, p 1 , . . . , p n ).

One shall be able to evaluate the measurement errors of these parameters.

Example 13. In the case of ring oscillator-based PTRNGs, several techniques can be exploited to measure parameters associated with the phase noise model based on the thermal noise (µ, σ).

They can be broken down into two main groups:

• external measurement techniques, which consist in reading the generator internal signals and analyzing them with an external measurement equipment (e.g. an oscilloscope);

• internal measurement techniques, which consist in analyzing the internal signals inside the device, in order to determine the values of input parameters of the model.

The main advantage of external measurement techniques is that precise measurement equipment and advanced signal processing techniques such as advanced differential input/output techniques, high quality probes, and low noise oscilloscopes can be used. However, these techniques bring a number of disadvantages:

• Input/output circuitry, transmission cables and input noise of the measurement equipment result in fairly inaccurate measurements (which can be improved for example by using differential probes and high quality devices);

• they are difficult to be performed on a production line;

• testing of each individual circuit can be very long and thus impractical.

In any case, one of the main difficulties in satisfying Requirement 13 results from the need to filter various types of noises which, since they are described by different statistical laws, must undergo specific analysis. In particular, it is important to filter out the global deterministic noises which have very high amplitude and do not contribute to the unpredictable nature of the generator Document version 1.0 (see for example [START_REF] Baudet | On the security of oscillator-based random number generators[END_REF]). One approach is to perform differential measurements on a device containing only a PTRNG, in the measurement campaign with a carefully prepared experimental setup [START_REF] Noumon Allini | Evaluation and monitoring of free running oscillators serving as source of randomness[END_REF] (stabilized power supply, controlled electromagnetic environment, controlled temperature, etc.).

Remark 8. To fulfill Requirement 13, the use of statistical tests is perfectly legitimate, since they can help to evaluate the fitting of the stochastic model with the observed probability distribution and the theory of tests of assumptions and parametric tests provide tools that are well adapted to this type of situation.

It is often difficult to evaluate a priori the measurement errors in Requirement 13. One possible approach is to repeat several measurements, while ensuring that the experimental conditions are maintained stable and to calculate an estimator of the standard deviation of different measurements. To compensate the uncertainties of the different methods, it may be interesting to corroborate the results with different experimental equipment (for example to combine some external measurement with various types of internal measurements).

Requirement 14. ([Model fitting] Stability of parameters of the statistical models of the physical noises) The stability of parameters p 1 , . . . , p n of the stochastic model shall be evaluated for the physical noise with regard to

• physical environmental operating conditions of the RNG: temperature, supply voltage, electromagnetic environment;

• operation of the RNG inside the system: operation of surrounding circuits (e.g. a cipher) and their impact on the generation of random numbers;

• variations of production parameters depending on the target technology.

Aging tests could also be performed.

The purpose is to evaluate the stability of parameters of the physical phenomena guaranteeing unpredictability of generated numbers from one device to another and throughout the operating domain of the circuit to verify that the security of the generator is ensured in the worst conditions.

Example 14. The frequency of the clock signals generated by ring oscillators depends significantly on the temperature (the frequency decreases with the temperature), the supply voltage (the frequency increases with the power supply voltage), as well as the integration of other functional blocks in the device (this depends of course on the placement-and-routing of the oscillators and surrounding blocks).

Verification of Requirements 13 and 14 can be called the technology qualification stage. This qualification could require some additional dedicated circuitry (e.g. differential inputs/outputs) to ensure that:

• the measurements are as accurate as possible;

• the circuit can be tested in the most unfavorable environmental conditions possible.

Example 15. For the last point, in the case of an elementary generator, its operation could be tested and compared with other oscillators generating clocks with frequencies close to those of ring oscillators.

Remark 9. Verification of suitability of the stochastic model of sources of randomness is not straightforward. It is possible that the designer has only a partial knowledge of how to model physical noises. When considering the elementary RNG, according to the recent state of the art, only the thermal noise is known to be modeled. It is very difficult to take into account the impact of global deterministic noises on generated numbers. Thus, if care is not taken, predictions given by the PTRNG stochastic model will in general be rather conservative comparing to experimental results.

Requirement 15. ([Model fitting] Management of the PTRNG entropy rate) Using the stochastic model of the TRNG, it shall be possible to adjust parameters q 1 , . . . , q n to obtain required entropy rate.

Remark 10. To verify the previous requirement, the use of statistical tests is once again entirely legitimate since the theoretical corpus of the theories of tests of assumptions can be used for example. A parametric test of a PTRNG, which is described by a stochastic model d(k, q 1 , . . . , q m , p 1 , . . . , p n ), is a test that verifies that parameters p 1 , . . . , p n and q 1 , . . . , q n are permanently inside the bounds that ensure sufficient entropy rate at generator output.

Example 16. In the elementary oscillator based RNG, the output entropy rate depends on the size of the jitter and on the mean periods of the two generated clock signals (T 1 and T 0 ). Consequently, embedded test should measure the jitter coming from the thermal noise, for example as presented in [START_REF] Fischer | Embedded evaluation of randomness in oscillator based elementary TRNG[END_REF], and the periods T 1 and T 0 . The measured values should be compared with thresholds obtained from the stochastic model -the parameter values ensuring sufficient entropy rate required by the targeted security level depending on the application.

From Definition 10, the following requirement can be deduced: Example 17. In the case of an elementary PTRNG, the following parametric tests could be used to evaluate the parameters of the clock signal including the jitter coming from the thermal noise:

• the frequency (monobit) test can be used as an estimator of duty cycle α;

• article [START_REF] Fischer | Embedded evaluation of randomness in oscillator based elementary TRNG[END_REF] shows that the auto-correlation test can be used as an estimator of volatility σ;

• an additional method described in [START_REF] Fischer | Embedded evaluation of randomness in oscillator based elementary TRNG[END_REF] can be used to calculate drift µ i for i = 0, 1.

Document version 1.0

Remark 11. A statistical test that cannot be interpreted as a parametric test is useless and even dangerous in certain circumstances.

The following definitions and remarks apply in the case that the ADC is deterministic.

Definition 11. ([Tests] Test of integrity of the PTRNG data path) A test of integrity of the whole PTRNG data path is any test that verifies correct operation of the generator including all the blocks between the randomness core and the generator output and in particular between analogto-digital conversion and post-processing.

With this definition, we can write:

Requirement 17. ([Tests] Verification of integrity of the PTRNG data path) Correct operation of all the blocks between the core of randomness and the generator output shall be verified using the PTRNG integrity tests.

Example 18. We can give here as an example important classic deterministic tests of bonding between the core of the generator and the output.

Comparison of the proposed methodology with existing standards and recommendations

In this section we will compare the proposed methodology of evaluation of the TRNG design with the German document AIS 20/31 [START_REF] Killmann | A proposal for: Functionality classes for random number generators[END_REF] and American standard NIST SP 800-90 [START_REF] Barker | Recommendation for Random Number Generation Using Deterministic Random Bit Generators[END_REF], which has been superseded by three other standards -NIST SP 800-90A [START_REF] Barker | Recommendation for Random Number Generation Using Deterministic Random Bit Generators[END_REF], NIST SP 800-90B [START_REF] Turan | Recommendation for the Entropy Sources Used for Random Document version 1[END_REF], and NIST SP 800-90C [10].

To make comparisons easier, we recall the methodology proposed in this document, which is illustrated in Fig. The second column of blocks presented in Fig. 3 represent embedded tests:

• Total failure test,

• Continuous test(s),

• Integrity test.

The role of the total failure test is to detect as soon as possible a total failure of the source of randomness. Therefore, it should test the signal as close as possible to its source, i.e. even before the analog-to-digital conversion, if this conversion can be separated from the source of randomness. Continuous test(s) shall be parametric stochastic tests, which evaluate continuously the value of input parameters (physical quantities) of the stochastic model. If the size of any of these parameters is smaller that required to gain expected entropy rate, the alarm shall be triggered. The test of integrity verifies correct operation of the whole data path between the randomness core and the generator output, and in particular the analog-todigital converter and the post-processing block. If possible, this test should be executed continuously. If this test is realized as a known answer test (KAT), it shall be executed at least during startup tests and periodically on demand. The startup procedure shall be composed of at least all three above mentioned types of tests. The TRNG output is not allowed until all the tests were successfully finished.

The last column of operations in Fig. 3 As explained before, the TRNGs validated using methodology proposed in this document correspond to security level PTG.2 (i.e. without the cryptographic post-processing). All TRNGs, which will be compliant with the methodology proposed in this document will be compliant with AIS 20/31 for security level PTG.2. However, not all designs compliant with AIS 20/31 at security level PTG.2 would necessarily be compliant with this document. In particular, Method B of evaluation of the PTRNG specified in AIS20/31 is not applicable according to these Recommendations.

The following list of requirements, which are not explicitly specified in AIS 20/31, shall be satisfied according to present document:

• The main differences can be observed by comparing Fig. 3 illustrating the proposed methodology with Fig. 4, which presents the TRNG design, modeling and testing according AIS 20/31 . It can be observed that while the generator structure remains the same, its modeling and testing are different. Unlike the AIS 20/31 procedure, the present document requires models of both main parts of the generator core: the sources of randomness and the ADC. While the embedded online test required by AIS 20/31 can be launched on demand or run continuously or periodically, embedded parametric tests required by the proposed document shall run continuously.

During the TRNG security evaluation using the off-line black-box tests, only Method A can be applied, since this documents requires a good quality raw binary signal to be available for off-line statistical testing. Comparing Fig. 3 and Fig. 4, it can be observed that according to AIS20/31, the post-processing block is not necessarily tested . Since the present document requires (Requirement 17) the whole datapath to be tested, the designer shall propose a method to test also the correct operation of the post-processing block.

Comparison with American NIST SP 800-90B

Comparing with the American approach, we can conclude that the methodology presented in this document is more stringent. While the American approach requires only some analysis of the source of randomness, the proposed methodology requires (as AIS 20/31) the use of a stochastic model to estimate the output entropy rate. Another important difference is that the American standard requires simple black box statistical tests (Repetition count and Adaptive proportion tests) to be applied continuously on the digital noise signal. Consequently, in order to make the TRNG design compatible with the American approach, the required continuous tests should be added. Comparing Fig. 3 and Fig. 5, we can observe that although the structure of the generator remains similar, the naming of blocks is slightly different. SP 800-90B. Although the role of the Conditioning element presented in Fig. 5 is similar to that of the Post-processing block from Fig. 4, (i.e. to increase statistical quality of the output signal), the NIST SP 800-90B document recommends to use one of proposed six vetted functions to do so (see [ [START_REF] Turan | Recommendation for the Entropy Sources Used for Random Document version 1[END_REF]] for more details). The embedded tests defined by the NIST SP 800-90B document, which are called Health tests, can be divided to three categories: start-up tests, continuous tests (primarily on the noise source), and on-demand tests. The same test categories are accepted in the present document. Off-line testing procedures required by NIST SP 800-90B are very different from those required by AIS 20/31 and thus by the present document. Different tests are used for random variables, which are independent and identically distributed (IID) and for those which are not (Non IID). The aim of both tracks is to estimate entropy rate at the output of the digital noise source. This entropy rate must be confirmed by the Restart tests, which should prove that the generator behaves correctly and that it outputs different random numbers from the very beginning. The stochastic model is not required, although its use is recommended. Nevertheless, even if the model was used to estimate the output entropy rate, the certified entropy rate is always the lowest bound of min-entropy given by the Document version 1.0

Definition 4 .

 4 ([Design] Analog-to-digital converter) The analog-todigital converter (ADC) is the entity that transforms noisy analog signal component into a stream of random numbers (e.g. a bit stream).

Definition 5 .

 5 ([Design] Post-processor) The post-processor is a deterministic block aimed at enhancement of statistical parameters of the generator. It shall not reduce the entropy rate per bit. Document version 1.0

Figure 2 :

 2 Figure 2: Effect of the analog-to-digital conversion: example considering the elementary PTRNG

Definition 9

 9 leads to setting up the following requirement: Document version 1.0 Requirement 10. ([Model] Availability of the stochastic model of the PTRNG) A stochastic model for the PTRNG shall be available.

Document version 1. 0

 0 Definition 10. ([Tests] Embedded tests)

Requirement 16 .

 16 ([Tests] Execution of embedded tests) Parametric embedded tests shall run at startup and continuously.

Figure 4 :

 4 Figure 4: TRNG design, modeling and testing according AIS 20/31

Requirement 7 -••

 7 Availability of the stochastic model of the core of randomness • Requirement 8 -Mathematical description of the analog-to-digital conversion • Requirement 9 -Characterization of the effect of the analog-to-digital conversion Document version 1.0 Requirement 11 -Consistency of the stochastic model of the PTRNG • Requirement 13 -Evaluation of parameters of the physical noises • Requirement 14 -Stability of parameters of the stochastic models of physical noises Requirement 17 -Verification of integrity of the whole datapath between outputs of sources of randomness and output of the digital noise.

Figure 5 :

 5 Figure 5: TRNG design and testing according to NIST SP 800-90B

  Definition 8. ([Model] Stochastic model of a core of randomness) A stochastic model of a core of randomness C is a stochastic process of time variable t and space of states V describing the evolution of the internal state E C (t) of C. It may be given by a probability distribution p C t (x) = P(E C (t)|p 1 , . . . , p n , E(t 0 )), with t > t 0 on E C (t), depending on parameters p 1 , . . . , p n and initial state E(t 0 ). Such a stochastic model is denoted M (t, p 1 , . . . , p n ).

Document version 1.0

  3. This figure shows clearly the relationship between the TRNG design, models, embedded tests, and testing procedures performed during security evaluation. We recall that the TRNG hardware is composed of five types of blocks: conversion is included intrinsically in the random signal generation mechanism (i.e. it is performed inside the block containing the source of randomness), the analog-to-digital conversion is replaced by an identity function. The role of the post-processing block is to enhance statistical parameters of the output signal. Usually, it increases entropy rate per bit at generator output at expense of the output bit rate. The output buffer determines output data format of the generator (number and order of bits).

	TRNG
	Stochastic
	model
	randomness ADC Raw random analog signal Post-processing Raw random binary signal Output buffer Internal ran-dom numbers Stochastic model of the source(s) Model of the digitizer Figure 3: TRNG design, modeling and testing according to this document Total failure test Continuos tests Embedded tests Procedure B Testing procedures during evaluation Method A of AIS 20/31 Procedure A Integrity test 1. Block(s) containing source(s) of randomness, 2. Analog-to-digital converter (ADC), 3. Post-processing block, 4. Output buffer, 5. Embedded tests. The stochastic model of the generator of the raw random digital signal (digital noise) is based on two underlying models: • Stochastic model(s) of source(s) of randomness, Document version 1.0 Source(s) of • Model of the analog-to-digital conversion.

Hardware block(s) containing source(s) of randomness define security boundaries of the sources of randomness. Analog-to-digital converter converts targeted analog signal components (e.g. the analog timings) to digital values. If this Document version 1.0

  Namely, the Source of randomness from AIS 20/31 is called the Analog noise source in NIST Document version 1.0

	Analog noise source	Health tests	Testing procedures during evaluation
				Two branches:
	Digitization		Non IID & IID
	Digital noise
	source
	Raw data				Determine
	(optional)	Continuos tests	Non IID	the track	IID
	Conditioning		Non IID test	IID test
				track		track
		Output
		random	Alarm
	Entropy source	numbers			Restart
					tests

As widely accepted, the requirements of these Recommendations are indicated in the rest of the document by the word "shall". Document version 1.0

Document version 1.0

Note that in any case the function of the analog-to-digital converter is assumed to be computable by the attacker. Document version 1.0

Conclusions

In this document, we presented recommendations for the design and security validation of a physical true random number generator implemented in an electronic device. We started the document with a specification of general objectives of the security evaluation process and we introduced basic definitions and requirements concerning the PTRNG design. We explained, why availability of the stochastic model of the physical phenomena used as sources of randomness is important for security evaluation of the generator. The stochastic model of a complete PTRNG can be thus constructed as an ensemble of two models: model of sources of randomness and model of the analog-to-digital conversion process. Moreover, we explained that to further increase security of the system, the embedded test must be adapted to the PTRNG stochastic model by testing continuously the values of input parameters of the model and comparing them with the thresholds guaranteeing sufficient entropy rate at generator output. Final comparison with existing security standards show clearly advantages of the proposed approach. Document version 1.0

Bit Generation, NIST Special Publication 800-90B. [online] Available at https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90B.pdf, 2018.

[10] E. Barker, J. Kelsey, K. McKay, A. Roginsky, and M.S. Turan. Recommendation for Random Bit Generator (RBG) Constructions, NIST Special Publication 800-90C (Third Public Draft). [online] Available at https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90C.3pd.pdf, 2022. Document version 1.0

Appendix A Elementary oscillator-based TRNG

This appendix describes simple TRNG on which we illustrate our approach throughout the document. An elementary oscillator-based TRNG is composed of two oscillators Osc i for i = 0, 1, a frequency divider and a sampler (see Figure 6). The output of one of the oscillators determines sampling times of the output of the second oscillator via a sampling unit that includes a D-type flip-flop. The frequency of the sampling oscillator is divided by a factor K D . Division ratio K D determines the time interval required to accumulate sufficient phase jitter which determines statistical bias of the bits of the TRNG output. In what follows, it is supposed that Osc 1 is the oscillator that generates the sampled signal and Osc 0 produces the sampling clock signal. For i = 0, 1, the output of the signal of Osc i is given by a periodic function of time t of the form

where f can be any real function of period 1. In our case, we can assume that we are dealing with the integration of a TRNG on a logic device and thus for α ∈ [0, 1), we define f α as the function of real value of period 1 such that f α (x) = 1 for 0 < x < α and f α (x) = 0 for α < x < 1, and f α (0) = f α (α) = 1/2. We use f α as a suitable model for a clock signal produced by clock generators and ring oscillators in particular. The clock edge is not necessarily centered on the half-period, since the oscillators often have unbalanced half-periods.

In practice, the frequencies of the two signals s i (t), i = 0, 1, fluctuate due to phase jitter. Thus ω i is the average frequency of the signal s i (t), (ω i (t + ξ i (t))) Document version 1.0 is the phase of the oscillator and function ξ i (t) represents the absolute phase drift.

Document version 1.0


domain: scco scco

text:
"It is, first, extremely difficult to outChomsky Chomsky"

Un cas de transitivité contrainte : les OUTVERBS à valeur comparativo-résultative

En tant que préfixe verbal, OUT peut prendre plusieurs valeurs. Par exemple :

• Spatiale: He outstretched his hand.

• Notionnelle: A solution is to outcross a member of one breed with another.

• Aspectuel: The morning sun outburned the fog.

• …

• Comparativo-résultative : This star will outburn the sun.

Cette communication se penche sur la dernière valeur. Notons que cette valeur, qui émerge aux alentours du 16e siècle, est très productive en anglais contemporain : ainsi, 85% de l'ensemble des 213 OUTVERBS retenus par le Merriam-Webster sont des emplois de ce type.

Les OUTVERBs comparativo-résultatifs n'ont pas de dénomination spécifique. Les auteurs réfèrent au phénomène par le biais de la préfixation, souvent sans précision de valeur. Eg.:

• Rather than arriving at one hard-and-fast rule regarding the interpretation of outprefixed verbs, generalizations will have to accommodate a sort of interpretational cline [ … ]. (Kotowski 2020: 73 ; c'est moi qui souligne)

+ comparatif  + résultatif
They always outstay their welcome.

Soon I'm sure the student will outdo the master.

? Their welcome is always outstayed. The master will soon be outdone.

I. Etat des lieux

Considérations sémantiques

Kotowski 2021 propose un état de l'art et identifie à propos des OUTVERBS deux axes sémantiques.

Broadly speaking, two different kinds of analysis have been proposed for the semantics of out-prefixation: while most authors opt for a comparative approach, the minority view stresses the construction's resultative nature. (Kotowski 2021: 64 Par ailleurs, dans une résultative, l'état résultant concerne un argument de la small clause, et non le sujet du verbe: Sarah alibied the main suspect out. The main suspect was alibied out.

He beat the 10 commandments into his kids.

His kids memorized the 10 commandments.

Avec les OUTVERBS, l'état resultant peut concerner l'objet et/ou le sujet: He had outstayed his welcome.

He had become undesirable. Her eyes outblazed the moon.

The moon was outblazed. Rosa went for his gun and Cantrell outdrew him in self-defense. Cantrell won/ Rosa was defeated.

II. Invariance opérationnelle L'invariance se joue en amont des instanciations lexicales

On partira de l'hypothèse que l'invariance repose sur un métaprocès (cf.

  Irube 1984 : « out-prefixation » • Talmy 2001 : « prefixal satellite out-» • McIntyre 2003: « out-prefixed verbs » • Kotowski 2021 : « out-(prefixation) in its scalar comparative sense » Afin de faciliter la présentation, nous parlerons juste de OUTVERB, étant entendu qu'il s'agit des emplois à valeurs comparativo-résultatives. L'objet de l'analyse de Kotowski 2021, à laquelle nous souscrivons, est que cette distinction constitue en réalité deux pôles d'un continuum avec une zone d'équipondération fréquente et même majoritaire (voir exemple précédent avec outfart).

  macro eventstructure,[START_REF] Talmy | Toward a cognitive semantics[END_REF], dont OUT est le support (et dont la dimension lexicale sera instanciée au minimum par le pantonyme DO): r a OUT[DID] b Ce métaprocès constitue la dimension invariante à partir de laquelle des déclinaisons envisageables par l'instanciation des arguments et du prédicat:He OUT-danced / -priced/ -shone/ -maneuvered… the competition. que soient les valeurs instanciées, la structure a out[DID] b, la lecture prend une valeur scalaire ascendante : John outdid Mary comporte 3 arguments neutres mais suppose John did better than Mary. Par ailleurs, même lorsque le procès lexical (ici price) est associé à une valeur scalaire descendante, le métaprocès (OUT_) exprime une valeur scalaire ascendante : Large conglomerates [sell] "loss-leader" products to outprice the competition.-James Chilton  They do better than the competition as they lower their prices.PROBLEMATIQUE : de quelle propriété formelle dérive la propriété scalaire ascendante, sachant qu'aucun marqueur type comparatif n'intervient dans une structure type John outdid Mary ?Autrement dit, la forme schématique suppose que l'invariance se joue au niveau de la structure, en amont de toute instanciation lexicale.L'objet est associé à une fermeture qui sert de repère Partons de: Aston Villa fans outsang the home fans. La dimension scalaire ascendante = Aston Villa fans sang louder than the home fans. b (i.e. the home fans) est associé au seuil sonore que a (i.e. Aston Villa fans) franchit : on donc un fermé, à partir duquel on engendre un Extérieur (i.e. le niveau sonore auquel b n'a pas accès). Comme dans Dufaye 2008 et 2012, je défends ici que l'argument objet est associé à la fermeture du domaine We will consider that the SVO structure parallels the bounded interval, with a one-toone mapping between: -S and the opening boundary; -O and the closing boundary. A consequence of this is that intransitive predicates with no Objects will lack a closing boundary and hence will not be compatible with a telic reading." (2012: 37-38) The sun melted the snow. < a r b > / The snow melted away. < b r > TELIQUE *Someone laughed the kids. / The kids laughed away. < a r > ATELIQUE I chopped down the tree. / *They chopped down. TELIQUE *I chopped the tree on. / I chopped on. ATELIQUE Le sujet entre dans une relation bivalente vis-à-vis du repère b Le niveau sonore de a va au-delà du point de fermeture associé à b. OUT est la trace de cette sortie du domaine défini par b L'argument a se trouve alors dans une situation bivalente: -a se trouve dans l'Intérieur du domaine de validation a se trouve dans l'Extérieur du domaine relatif à b. -Le sujet est repéré en différenciation QLT vis-à-vis de l'objet PROBLEMATIQUE : de quelle propriété formelle dérive la propriété scalaire croissante, sachant qu'aucun marqueur type comparatif n'intervient dans une structure type John outdid Mary ? HYPOTHESE : L'argument b définit un fermé engendrant un Extérieur, c'est-à-dire un point de sortie du domaine, ce qui va normalement de pair avec valeur négative : The candle burnt out. Or a valide un point au-delà du fermé mais reste dans l'intérieur du domaine de validation. Ainsi découle une valeur croissante, dont on tire une différenciation Qualitative entre a et b. Selon que l'on prend l'angle du sujet ou de l'objet  cf. PLUS en français: • Angle de de l'objet b : on pose un point de sortie du domaine (par un discordantiel par exemple) : c'est le PLUS forclusif, à comparer au OUT de sortie dans l'extérieur strict : au-delà il n'y a pas un point de PLUS. Angle du sujet a : on pose qu'un point est validée au-delà d'une borne Intérieur au domaine et PLUS est augmentatif, à comparer au OUT qui pose que a sort de la zone de validation de b sans pour autant sortir du domaine : au-delà il y a PLUS à valider. Si l'on met ceci en regard de l'opération comparative MORE THAN, il est intéressant de noter que la notion d'au-delà, d'après cela semble jouer un rôle direct dans les opérations épilinguistiques qui ont pu présider à la mise en place du comparatif: Than (conj.) : Old English þan, (…) from þanne, þaenne, þonne "then" (see then). Developed from the adverb then, and not distinguished from it by spelling until c. 1700. (…), which suggests a semantic development from the demonstrative sense of then: A is bigger than B, evolving from A is bigger, then ("after that") B. (www.etymonline.com; my emphasis) Comparant  différentiation QLT Résultatif  identification QNT Nous remarquions plus haut que toute relation comparante n'est pas compatible avec une version en OUTVERB : Igor Bogdanoff lived longer than his twin brother Grichka. (relation purement QLT) Igor Bogdanoff outlived his twin brother Grichka. (relation QLT + QNT) Shakespeare lived longer than Keats and Chatterton combined. * Shakespeare outlived Keats and Chatterton. Ainsi, alors que les deux valeurs associées à a et b sont qualitativement différenciée, le passage de zone à zone de a et la borne définie par b doivent partager une délimitation quantitative commune. Comparant  différentiation QLT Résultatif  identification QNT Anthony Eden outlived Churchill. N'implique pas (forcément) : Anthony Eden lived longer than Churchill.

  He tried to outwit the FBI. dénominal propre : Noone can out-Einstein Einstein. Ainsi présenté, sujet et objet sont co-agents du procès (Talmy parle de agent pour le sujet et agency pour l'objet): You don't have to outswim the shark. You just have to outswim the guy you're scuba-diving with. De fait, les OUTVERBS sont compatibles avec la réciprocité agentive: Coworkers often try to outshine each other. They both wanted to outrun one another. Cependant, si, dans cas comme The gazelle outran the lion, on peut effectivement faire valoir une « coagentivité », la notion d'agent se heurte à quatre cas de figure: 1. l'objet n'est pas interprétable comme un agent du verbe : He outstayed his welcome / his visa. 2. Le sujet n'est pas interprétable comme un agent du verbe : The tortoise outran the hare. 3. Le verbe ne sélectionne pas d'« agents » : The festival-goers outpopulated the villagers. 4. La nature dénominale ou déadjectivale du verbe brouille la question: He outfoxed the spy.

	Considérations morphologiques
	o Le noyau peut être :
	verbal :	The tortoise eventually outruns the hare.
	déadjectival : Will Artificial Intelligence. outsmart us all?
	dénominal : Considérations syntaxiques
	o Quel que soit le scénario morphologique, la construction est transitive, y compris si le
	noyau est par défaut intransitif :
	*Lance Armstrong outclimbed.
	*The hare outran.
	*AI will outsmart.
	Etc.
	Considérations syntactico-sémantiques
	o Même lorsque le verbe est par nature transitif (e.g. build, climb, draw…),
	l'objet ne correspond pas au rôle sémantique sélectionné par ses emplois non-préfixés :
	Lance Armstrong climbed the hill.
	*Lance Armstrong outclimbed the hill.
	Lance Armstrong outclimbed his rivals.
	*Lance Armstrong climbed his rivals.
	OUTVERBs illustrate « the phenomenon of unselected objects, i.e. objects of complex verbs
	which do not correspond to the selection restrictions of the simplex verb. » (McIntyre 2003)
	Talmy (2000: 253 sqq.) évoque cette structure parmi les cas de co-activité (coactivity), qui supposent
	que les deux arguments (sujet et objet en l'occurrence) soient impliqués dans le procès:
	I met John / *the mannequin. (ibid.: 254)
	Talmy (2000: 256) identifie quatre cas (la différence entre 1 et 2 est subtile):
	1. Concert : I jog together with him.
	2. Accompaniment : I jog along with him.
	3. Imitation : I played the melody in imitation of him.
	4. Surpassment : I outplayed him. ('I surpassed him in playing the
	melody')

  La forme schématique devra donc proposer une représentation plus abstraite qu'une relation comparative. 2. Toute relation comparante n'est pas compatible avec une version en OUTVERB, quand bien même l'alternance (eg. live longer than <=> outlive) est par ailleurs envisageable: Igor Bogdanoff lived longer than his twin brother Grichka. Igor Bogdanoff outlived his twin brother Grichka. Shakespeare lived longer than Keats and Chatterton combined. * Shakespeare outlived Keats and Chatterton. 'appuyant sur Stiebels 1996 et Spencer and Zaretskaya 1998, McIntyre 2003 justifie le rapprochement avec les structures résultatives par deux arguments : La présence d'un argument objet obligatoire non sélectionné par le verbe, lequel objet est le lieu d'un sous-procès qu'il note OUTDONE: Fred outdrank Stan DO (FRED,DRINK) &CAUSE OUTDONE (STAN) (McIntyre 2003: 3) Un autre parallèle avec les structures résultatives concerne l'instanciation du verbe lexical. Dans les deux cas, le procès peut être dénominal, déadjectival, … : Dr. Floyd no-commented his way through the crowd. They outblitzkrieged the Germans.Dans les deux cas, on peut considérer que le noyau lexical est projeté sur une place glosable par un verbe léger.

	We	[CAUSE]	our troubles [TO GO] away.
		DANCE
	We	OUT[DO]	them all.
	Il existe cependant une différence fondamentales entre les OUTVERBS et les résultatives :
	1. Sarah outalibied the main suspect.	TRAJECTOR = Sarah
	2. Sarah alibied the main suspect out.	TRAJECTOR = The main suspect
	Avec le OUTVERB, la particule concerne le sujet, ou à tout le moins la relation sujet / objet.
	Avec la résultative, la particule concerne l'objet.
	La dimension résultative
	La dimension comparante
	Une valeur comparante est interprétable dans tous les emplois des OUTVERBS.
	En revanche, la sémantique de la dimension scalaire ne dépend pas du OUTVERB, mais varie
	selon l'énoncé. OUTSING : (transitive) to sing better or louder than Le rôle analogue de OUT à celui du deuxième argument de la small clause: *Fred drank Stan. (https://www.collinsdictionary.com/dictionary/english/outsing) Fred drank Stan under the table.
		Fred outdrank Stan. (Ibid.)

; c'est moi qui souligne) Par exemple : She beat the whole lot and outfarted them all. Dimension comparative de outfart (sur dimensions scalaires): To outperform another in the context of one's level of flatulent noise level, gaseous volume, odor, frequency and/or melodic creativity. (Urban Dictionary.com) Dimension résultative (cf. She beat the whole lot): To outperform another in the context of one's level of flatulent noise level, gaseous volume, odor, frequency and/or melodic creativity. (Urban Dictionary.com) BETTER : Orpheus outsang the seductive songs of the Sirens. LOUDER : Aston Villa fans outsang the home fans.

OUTSMOKE : (transitive) to smoke more than (https://www.collinsdictionary.com/dictionary/english/outsmoke) + quantitatif + résultatif 1. Le terme « comparatif » est un raccourci dans la mesure où certains emplois ne n'impliquent pas à proprement parler une comparaison: She had outstayed her visa's expiration date. She had stayed beyond her visa's expiration date. S