Description:DESCRIPTION:
Field of the invention:
[0001] The present disclosure relates to the technical field of cryptographic random number generation for distributed and resource-constrained computing environments, and more particularly, to a hybrid entropy-harvesting and pseudo-random number generation system for Internet of Things (IoT) and edge devices, where network round-trip time (RTT) measurements are utilized as an external entropy source to seed and periodically reseed a high-throughput pseudo-random number generator. The disclosure further pertains to a controlled batch-reseeding architecture integrated with cryptographic hash-based conditioning to enable secure key generation, nonce generation, and authentication operations without reliance on dedicated hardware-based true random number generators.
Background of the invention:
[0002] The proliferation of distributed computing systems, including Internet of Things (IoT) devices, embedded controllers, and edge communication gateways, has significantly increased the demand for robust and scalable cryptographic infrastructures. Secure communication protocols, device authentication mechanisms, encrypted data transmission, and session management frameworks fundamentally depend on the availability of high-quality random numbers for generating cryptographic keys, initialization vectors, nonces, and challenge-response parameters. The security strength of such mechanisms is directly correlated with the entropy quality and unpredictability of the underlying random number generation architecture.
[0003] Conventional approaches for generating cryptographically secure random numbers primarily rely on hardware-based True Random Number Generators (TRNGs), which extract entropy from physical phenomena such as thermal noise, ring oscillator jitter, or semiconductor metastability. Although such hardware entropy sources provide high unpredictability, they increase system complexity, silicon area, manufacturing cost, and power consumption, thereby limiting their suitability for lightweight, battery-operated IoT devices and cost-sensitive embedded platforms.
[0004] To address hardware constraints, deterministic pseudo-random number generators (PRNGs) and deterministic random bit generators (DRBGs) have been widely adopted. For instance, U.S. Patent No. US10313109B2 discloses a SHA-512-based deterministic random number generation mechanism involving instantiation and reseeding operations within a secure hash-driven architecture. While such approaches enhance cryptographic strength through hash-based mixing, they introduce considerable computational overhead due to repeated cryptographic operations, which may adversely impact throughput and energy efficiency in resource-constrained environments.
[0005] Similarly, U.S. Patent No. US8682948B2 describes scalable random number generation systems that collect entropy from various sources, including network-related timing events, and combine such entropy within one or more entropy pools before seeding a root PRNG. Although such systems improve entropy aggregation, they often depend on continuous entropy accumulation or time-based reseeding policies without specifically addressing high-throughput expansion requirements or state predictability vulnerabilities associated with certain fast statistical generators.
[0006] High-speed statistical generators, such as the Mersenne Twister (MT19937), provide excellent performance characteristics and long periodicity, making them attractive for large-scale random number expansion. However, such generators are known to exhibit state recovery vulnerabilities when a sufficient number of outputs are observed, thereby rendering them unsuitable as standalone cryptographic generators without carefully engineered entropy refresh mechanisms.
[0007] Accordingly, there exists a technical need for an enhanced random number generation architecture that efficiently utilizes externally measurable network timing variations as high-entropy seed material, while decoupling entropy acquisition from high-speed random expansion through controlled reseeding mechanisms, thereby mitigating state predictability vulnerabilities and achieving secure, low-latency operation without increasing computational complexity, energy consumption, or hardware dependency in resource-constrained IoT and embedded communication platforms.
Objectives of the invention:
[0008] The primary objective of the invention is to provide a secure random number generation system for resource-constrained Internet of Things (IoT) and embedded communication devices that does not rely on dedicated hardware-based true random number generators.
[0009] Another objective of the invention is to provide a system that utilizes externally observable network timing variations, including round-trip time (RTT) measurements, as a high-entropy seed source for cryptographic applications.
[0010] The other objective of the invention is to provide a system that decouples entropy harvesting from high-speed random number expansion through a controlled batch-reseeding architecture, thereby improving throughput and reducing latency associated with continuous network interactions.
[0011] The other objective of the invention is to provide a system that mitigates state predictability vulnerabilities associated with high-speed pseudo-random generators by periodically refreshing the internal state prior to reaching statistical exposure thresholds.
[0012] The other objective of the invention is to provide a system that provides cryptographically hardened random outputs using secure hash-based post-processing to enhance non-linearity, diffusion, and resistance to classical and quantum-assisted attacks.
[0013] Yet another objective of the invention is to provide a system that generates block-wise mid-level primitive components using kernel aggregation-based computation to obtain compact and discriminative feature representations.
[0014] Further, the objective of the invention is to provide a system that achieves improved energy efficiency and computational optimization in secure key generation, nonce generation, and session establishment operations for low-power IoT and edge platforms.
Summary of the invention:
[0015] The present disclosure proposes a system for secure random number generation in resource-constrained IoT devices and method thereof. The following presents a simplified summary in order to provide a basic understanding of some aspects of the claimed subject matter. This summary is not an extensive overview. It is not intended to identify key/critical elements or to delineate the scope of the claimed subject matter. Its sole purpose is to present some concepts in a simplified form as a prelude to the more detailed description that is presented later.
[0016] In order to overcome the above deficiencies of the prior art, the present disclosure is to solve the technical problem to provide a system and method for secure random number generation in a resource-constrained Internet of Things (IoT) device. The system comprises a computing device including a processor, memory, communication interface, and timing module. The computing device is operably connected to one or more remote servers via a network. The processor executes instructions stored in memory to implement multiple functional modules that collectively enable secure entropy harvesting, high-throughput random number expansion, cryptographic hardening, and controlled reseeding.
[0017] In one embodiment herein, the system includes a network interface module configured to establish communication with remote servers and measure network round-trip time (RTT) values using the communication interface and timing module. An entropy harvesting module generates seed data from the measured RTT values using arithmetic accumulation techniques, including rolling hash computation with multiplication by a predetermined prime number, followed by bitwise XOR and shift operations to enhance entropy mixing.
[0018] In one embodiment herein, the generated seed data is provided to a pseudo-random expansion module comprising a Mersenne Twister generator, such as MT19937, which generates batches of pseudo-random numbers at high throughput. A cryptographic hardening module applies a secure hash function, such as SHA-512, to the generated pseudo-random numbers to produce cryptographically secure random bits suitable for secure communication operations.
[0019] In one embodiment herein, a reseeding control module intermittently acquires fresh RTT values and reinitializes the pseudo-random expansion module after generation of a predetermined number of outputs. The predetermined number is selected to be lower than the state reconstruction threshold of the Mersenne Twister generator, and in one embodiment comprises approximately 500 outputs, thereby preventing internal state predictability while maintaining high performance. Entropy acquisition is decoupled from each random number generation cycle to reduce network latency and computational overhead.
[0020] In one embodiment herein, the cryptographically secure random bits generated by the system are usable for cryptographic key generation, nonces, initialization vectors, and session parameters in IoT communication protocols, thereby enabling secure, hardware-independent, and energy-efficient random number generation without reliance on dedicated true random number generator circuitry.
[0021] In one embodiment herein, the invention further provides a method implemented by the computing device for secure random number generation in a resource-constrained Internet of Things (IoT) device. At one step, establish communication with one or more remote servers via the network using the communication interface and measure round-trip time (RTT) values using the timing module. At another step, generate seed data from the RTT values using arithmetic accumulation and bitwise transformation operations. At another step, initializes a Mersenne Twister pseudo-random number generator using the seed data.
[0022] At another step, generating a batch of pseudo-random numbers using the initialized generator. At another step, apply a secure hash function to the generated pseudo-random numbers to produce cryptographically secure random bits. Further, at another step, periodically reinitialize the Mersenne Twister generator using newly measured RTT values after generation of a predetermined number of outputs selected to be lower than a state reconstruction threshold of the generator.
[0023] Further, objects and advantages of the present invention will be apparent from a study of the following portion of the specification, the claims, and the attached drawings.
Detailed description of drawings:
[0024] The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate an embodiment of the invention, and, together with the description, explain the principles of the invention.
[0025] FIG. 1 illustrates a block diagram of a system for secure random number generation in a resource-constrained Internet of Things (IoT) device, in accordance to an exemplary embodiment of the invention.
[0026] FIG. 2 illustrates a flow diagram of the system with a high-resolution time-triggered mersenne twister pseudorandom number generator (HRTT-MT PRNG) scheme, in accordance to an exemplary embodiment of the invention.
[0027] FIG. 3 illustrates a flowchart of a method for secure random number generation in the resource-constrained Internet of Things (IoT), in accordance to an exemplary embodiment of the invention.
Detailed invention disclosure:
[0028] Various embodiments of the present invention will be described in reference to the accompanying drawings. Wherever possible, same or similar reference numerals are used in the drawings and the description to refer to the same or like parts or steps.
[0029] The present disclosure has been made with a view towards solving the problem with the prior art described above, and it is an object of the present invention to provide a hybrid entropy-harvesting and pseudo-random number generation system for Internet of Things (IoT) and edge devices, where network round-trip time (RTT) measurements are utilized as an external entropy source to seed and periodically reseed a high-throughput pseudo-random number generator.
[0030] According to one example embodiment of the invention, FIG. 1 refers to a block diagram of the system 100 for secure random number generation in a resource-constrained Internet of Things (IoT) device. In one embodiment herein, the system 100 generates block-wise mid-level primitive components using kernel aggregation-based computation to obtain compact and discriminative feature representations. The system 100 achieves improved energy efficiency and computational optimization in secure key generation, nonce generation, and session establishment operations for low-power IoT and edge platforms. In one embodiment herein, the system 100 is implemented within an Internet of Things (IoT)-enabled cloud computing environment for processing. The system 100 provides a technical effect of reducing network latency dependency in entropy acquisition while preventing state reconstruction vulnerabilities of high-throughput pseudo-random generators, thereby improving secure communication performance in resource-constrained IoT hardware.
[0031] In one embodiment herein, the system 100 comprises a computing device 102, which may be implemented as a microcontroller-based IoT endpoint, embedded communication gateway, smart sensor node, edge processing device, Raspberry-Pi-class controller, desktop computing platform, or server-class computing system capable of executing software instructions and communicating over a network. The system 100 may operate across a wide range of platforms, ranging from resource-constrained IoT devices to higher-performance computing systems.
[0032] In one embodiment herein, the computing device 102 includes at least one processor 104 and a memory 106. The processor 104 may comprise a central processing unit (CPU), microcontroller core, digital signal processor (DSP), system-on-chip (SoC), or equivalent hardware logic unit capable of executing programmed instructions. The memory (106) may include volatile memory (e.g., RAM), non-volatile memory (e.g., Flash, EEPROM), or a combination thereof, and stores executable instructions and operational data structures. The processor 104, upon execution of instructions stored in the memory (106), implements a plurality of modules 107. Additionally, the plurality of modules 107 cooperate to perform entropy acquisition, entropy conditioning, pseudo-random expansion, cryptographic hardening, and periodic reseeding control.
[0033] In one embodiment herein, the plurality of modules 107 includes a network interface module 108, an entropy harvesting module 110, a pseudo-random expansion module 112, a cryptographic hardening module 114, a reseeding control module 116, a communication interface 118, and a timing module 120. Each module is logically distinct but may be implemented as software routines, firmware components, hardware accelerators, or combinations thereof.
[0034] In one embodiment herein, the computing device 102 is operably connected to one or more remote servers 122 via a network 124. The network 124 may include wired or wireless communication infrastructure, such as local area network (LAN), wide area network (WAN), cellular networks, Wi-Fi, ethernet, and internet-based routing systems. In one embodiment herein, the servers 122 are external systems capable of responding to communication requests initiated by the computing device 102. The servers 122 need not provide specialized entropy services and may be ordinary publicly accessible network servers.
[0035] In one embodiment herein, the communication interface 118 provides the physical and protocol-level connectivity between the computing device 102 and the network 124. The communication interface 118 may include TCP/IP stack implementation, network transceiver circuitry, wireless radio modules, and Ethernet controllers. The communication interface 118 transmits outbound communication packets to the servers 122 and receives inbound response packets necessary for round-trip time (RTT) measurement.
[0036] In one embodiment herein, the network interface module 108 is configured to coordinate communication exchanges with the servers 122. The network interface module 108 initiates communication sessions and may establish TCP handshake exchanges or equivalent protocol-level interactions. The network interface module 108 works in conjunction with the communication interface 118 and the timing module 120 to enable precise measurement of network round-trip times. The system 100 assumes that the local network environment hosting the computing device is secure and that the computing device 102 supports TCP/IP communication and timing measurement capabilities.
[0037] In one embodiment herein, the timing module 120 is operatively coupled with the network interface module 108. The timing module 120 records a start time upon transmission of a communication request. The timing module 120 records a stop time upon receipt of the corresponding response from the server 122. The difference between the start and stop times yields a measured round-trip time (RTT) value. Because RTT values are influenced by dynamic network conditions such as congestion, routing variability, queuing delays, and hardware processing fluctuations, these values exhibit stochastic behavior and serve as a source of environmental entropy external to the IoT device. Additionally, the timing module 120 is configured to measure transmission start and response receipt times associated with communication exchanges with the servers 122. The timing module 120 may be implemented as a software timer executed by the processor 104 or as a hardware timer depending on the implementation platform.
[0038] In one embodiment herein, the entropy harvesting module 110 receives one or more RTT values from the timing module 120. The entropy harvesting module 110 performs iterative arithmetic accumulation operations to transform the RTT measurements into seed data. In another embodiment, the entropy harvesting module 110 multiplies accumulated seed values by a predetermined prime number, adds new RTT values to the accumulated result, applies bitwise exclusive-OR (XOR) operations, and applies left and right bit-shift transformations. These operations improve entropy mixing and increase non-linearity, thereby reducing correlation between successive RTT measurements and enhancing unpredictability of the resulting seed. Additionally, the entropy harvesting module 110 converts externally observed network variability into structured seed material suitable for initializing a pseudo-random generator.
[0039] In one embodiment herein, the pseudo-random expansion module 112 comprises a high-throughput pseudo-random number generator, such as a Mersenne Twister (MT19937) engine. The pseudo-random expansion module 112 is initialized using the seed data generated by the entropy harvesting module 110. Once initialized, the pseudo-random expansion module 112 generates a batch of pseudo-random numbers at high computational speed. Importantly, the architecture decouples entropy acquisition from random number expansion. Instead of requiring a fresh network interaction for each random number, the pseudo-random expansion module 112 expands a single entropy-derived seed into multiple outputs. This significantly reduces network latency overhead and improves computational efficiency in resource-constrained environments.
[0040] In one embodiment herein, the cryptographic hardening module 114 receives pseudo-random outputs from the pseudo-random expansion module 112. The cryptographic hardening module 114 applies a secure hash function, such as SHA-512, to transform the pseudo-random outputs into cryptographically secure random bits. The hash-based conditioning introduces strong non-linearity, diffusion of input bits, avalanche effect, and resistance to internal state inference. Additionally, the cryptographic hardening module 114 ensures that even if the underlying statistical generator exhibits theoretical predictability under extended exposure, the final output bits remain computationally infeasible to reverse-engineer.
[0041] In one embodiment herein, the reseeding control module 116 monitors the number of pseudo-random outputs generated by the pseudo-random expansion module 112. The reseeding control module 116 maintains a counter to track output generation. When the number of generated outputs reaches a predetermined threshold, the reseeding control module 116 triggers re-acquisition of fresh RTT measurements through the network interface module 108. The predetermined threshold is selected to be lower than a known state reconstruction threshold associated with the pseudo-random generator (e.g., below 624 outputs for MT19937). By limiting output exposure below this threshold, the system 100 mitigates internal state predictability vulnerabilities. Upon reseeding, the entropy harvesting module 110 generates new seed data, and the pseudo-random expansion module 112 is reinitialized accordingly. This controlled batch-reseeding architecture ensures forward security while maintaining high throughput.
[0042] In one embodiment herein, the proposed HRTT-MT PRNG system was implemented using a computing platform comprising an Intel Core i3 processor operating at 3.6 GHz with 16 GB RAM running a Windows 10 operating system. RTT measurements were collected from four geographically distributed publicly accessible servers. The seed generation algorithm utilized a prime number value of 31 together with XOR and bit-shift operations, and the pseudo-random expansion module utilized the MT19937 Mersenne Twister generator. The reseeding control module 116 refreshed the generator state after generation of 500 pseudo-random numbers, which is selected to remain below the 624-output state reconstruction threshold of MT19937.
[0043] In one embodiment herein, the computing device 102 is implemented as a hardware-based electronic device capable of performing image processing and neural network computations. The computing device 102 includes, but is not limited to, a server, cloud server, workstation, desktop computer, GPU-enabled processing unit, medical imaging workstation, or a combination thereof. The processor 104 comprises, but is not limited to, one or more hardware processing units selected from a central processing unit (CPU), graphics processing unit (GPU), digital signal processor (DSP), field programmable gate array (FPGA), application-specific integrated circuit (ASIC), microcontroller, or any combination thereof, are configured to execute parallel and matrix-based computations associated with convolutional neural network operations.
[0044] In one embodiment herein, the computing device 102 is operably connected to the and the server 122 via the network 124. The network 124 comprises, but is not limited to, wired or wireless communication networks include, but are not limited to, Local Area Networks (LAN), Wide Area Networks (WAN), cellular networks, Wi-Fi, Ethernet, or other communication technologies capable of transmitting medical image data and classification results.
[0045] According to another example embodiment of the present invention, FIG. 2 refers to a flow diagram 200 of the system 100 with a high-resolution time-triggered mersenne twister pseudorandom number generator (HRTT-MT PRNG) scheme. At step 202, the computing device 102 retrieves server addresses from the secure server address list 122. The server 122 contains one or more publicly accessible servers that are geographically distributed and preferably belong to different autonomous systems in order to maximize network variability. The number of selected servers 122, may vary according to implementation requirements; however, in one embodiment, four servers are selected to enhance entropy diversity. At step 204, a generation counter N is initialized to 1, where N represents the number of pseudo-random outputs generated since the last reseeding event.
[0046] At decision block 206, the system 100 determines whether additional servers remain for network round-trip time (RTT) measurement. If the condition at decision block 206 evaluates to “Yes,” the process proceeds to step 214, where the time required to establish a TCP connection with the selected server is measured. Specifically, a timer records a start time (tstart) when a communication packet is transmitted and records a stop time (tstop) when the corresponding response is received, and the RTT value is calculated as:
RTTmeasured = tstop − tstart

[0047] The RTT value captures stochastic variations caused by network congestion, routing path diversity, queuing delays, wireless channel variations, and processing latency, thereby providing an external entropy source. At step 216, the measured RTT value is added to an RTT list for accumulation. The process returns to decision block 206 until RTT values have been collected from all selected servers. When the decision at block 206 evaluates to “No,” indicating that RTT acquisition from all servers has been completed, the system 100 process proceeds to step 208, where a seed value is calculated using the collected list of RTT values. In one embodiment, the seed generation is performed using a rolling hash accumulation defined by:
si′ = (si−1 · p) + ri,
where si′ represents an intermediate seed value, si−1 represents the previously accumulated seed value, ri represents a measured RTT value, and p represents a predetermined prime number, such as 31. For example 31 in a preferred embodiment, although other prime values may also be used depending on implementation requirements.
[0048] The intermediate seed si′ is then transformed using bitwise mixing operations defined as:
si = si′ ⊕ ((si′ ≪ 13) ∨ (si′ ≫ 19)),
where ⊕ denotes bitwise exclusive-OR, ≪13 denotes a left shift by 13 bits, ≫19 denotes a right shift by 19 bits, and ∨ denotes bitwise OR. After iterating through all RTT values, the final seed S is computed as the absolute value of the last accumulated seed.
[0049] At step 210, the final seed S is provided to initialize a Mersenne Twister pseudo-random number generator. The Mersenne Twister engine is configured to generate high-throughput pseudo-random outputs while maintaining statistical quality. At step 212, the pseudo-random number is generated using a uniform integer distribution driven by the initialized Mersenne Twister generator. This high-speed expansion decouples entropy acquisition from number generation, thereby significantly reducing network dependency.
[0050] At step 220, the generated pseudo-random number is processed through a secure hash function, such as SHA-512, to produce cryptographically secure random bits. The application of SHA-512 enhances diffusion, non-linearity, and resistance to reverse engineering, thereby providing resilience against classical cryptanalysis and quantum-assisted attacks. At step 222, the generation counter is incremented such that N = N + 1.
[0051] At decision block 218, the system 100 determines whether the counter satisfies the condition N % 500 == 0. If the condition at block 218 evaluates to “No,” the random bits are used as pseudo-random output, and the process returns to step 212 to generate additional numbers without reacquiring new RTT values. If the condition at block 218 evaluates to “Yes,” indicating that 500 pseudo-random numbers have been generated since the last reseeding event, the process proceeds to step 224, the counter N is reset to 1. The process then returns to step 206 to acquire fresh RTT measurements and regenerate new seed data.
[0052] The predetermined reseeding threshold of 500 outputs is selected to be lower than the known state reconstruction threshold of the Mersenne Twister generator, which is 624 consecutive outputs. By performing reseeding prior to reaching this exposure limit, the scheme mitigates internal state predictability vulnerabilities while maintaining high computational throughput. The reseeding threshold is selected to be strictly lower than a known state exposure threshold of the Mersenne Twister generator, thereby preventing internal state reconstruction while maintaining batch-based high throughput expansion.
[0053] Additionally, the reseeding threshold is selected as approximately 500 outputs. This value is intentionally chosen to remain below the 624-output state reconstruction threshold of the MT19937 generator, thereby preventing adversaries from reconstructing the internal generator state while maintaining high throughput.
[0054] In one embodiment, the system 100 retrieves server addresses from a secure list stored in local memory. The list may include publicly accessible servers 122 belonging to different autonomous systems and geographically distributed network locations in order to maximize network variability. Although four servers 122 are used in one preferred embodiment, other numbers of servers may be used depending on system’s requirements.
[0055] In one example embodiment herein, the proposed PRNG algorithm based on round-trip time (RTT) measurements is implemented in the Java programming language and executed on a Desktop PC comprising an Intel Core i3 processor operating at 3.6 GHz, 16 GB of RAM, and a Windows 10 operating system. The program accesses a secure server list stored in local memory containing publicly accessible server IP addresses that may be periodically updated and selectively utilized according to implementation requirements, and the algorithm is executed using two, three, and four servers respectively, with observations indicating that inclusion of more than four servers increases execution time without providing additional performance benefit, and where for each execution one million random bits are generated and stored in an output file.
[0056] After which the generated bit sequences are subjected to statistical evaluation using established randomness testing tools including ENT and the NIST Statistical Test Suite (NIST SP 800-22), and the results are validated and comparatively analyzed against outputs produced by the Java SecureRandom class, which serves as a benchmark cryptographically secure pseudo-random number generator (CSPRNG), with the comparative ENT analysis results presented in table. 1.
[0057] Table. 1:
Entropy Compression (%) Chi-square Mean Serial Coefficient Method Used
7.998633 0 237.06 127.2855 -0.000086 SecureRandom
7.998797 0 208.8 127.0988 0.000631 Two servers
7.998705 0 224.12 127.6666 0.002131 Three servers
7.998490 0 262.07 127.9097 -0.002259 Four servers
[0058] The statistical evaluation results demonstrate that the random bits generated using RTT measurements collected from four servers exhibit randomness characteristics substantially comparable to those produced by the Java SecureRandom class, and further analysis using the NIST Statistical Test Suite (NIST STS) conducted with default global parameters and a significance level (alpha) set to 0.01 confirms that the one million generated bits were subjected to all 15 standard statistical tests, with the comparative outcomes presented in Table 2. The results indicate that the bit sequence generated using four-server RTT collection successfully passed 13 out of the 15 NIST STS tests, matching the number of tests passed by the SecureRandom benchmark, the test is considered passed if the corresponding p-value exceeds the alpha threshold of 0.01 and the failed tests are identified in bold within Table 2, thereby establishing that the use of at least four servers provides an optimal balance between entropy quality and performance for the proposed HRTT-MT PRNG scheme.
[0059] Table. 2:
NIST STS Test Name P-value
Secure Random Two Servers Three Servers Four Servers
Frequency 0.213309 0.090936 0.798139 0.699313
Block Frequency 0.911413 0.637119 0.867692 0.759756
Cumulative Sums 0.224821 0.202268 0.289667 0.759756
Runs 0.419021 0.137282 0.699313 0.181557
Longest Run 0.275709 0.911413 0.657933 0.616305
[0060] The integration of the Mersenne Twister PRNG algorithm into the proposed scheme significantly enhances throughput, as demonstrated by experimental evaluation where one million bits were generated using the previously described setup both with and without incorporation of the Mersenne Twister algorithm, the time required for generation in each case was measured and recorded, and the results presented in Table 3 and illustrated in Figure 2 indicate that the HRTT-MT configuration achieves approximately 123 times higher throughput compared to the configuration without the Mersenne Twister algorithm.
[0061] Table. 3:
Method Used Seeds Generated (32-bit) Bits Generated Time Taken (sec) Bits/Sec
Without Mersenne-Twister 1954 1000448 123 8134
With Mersenne-Twister 1954 1000448 0.8729 1000448
[0062] The RTT values are suitable as a source of random data because they are inherently influenced by dynamic and unpredictable network conditions, including congestion, routing variations, processing delays, and hardware performance fluctuations, which introduce variability and uncertainty that are difficult to predict or replicate, thereby providing entropy for secure random number generation, particularly when multiple RTT samples are collected from different servers and processed through cryptographic conditioning such as SHA-512.
[0063] The security of the generated pseudo-random numbers primarily depends on the unpredictability of the measured RTTs and the cryptographic strength of SHA-512, under the assumptions that the local network is secure, the IoT device supports TCP/IP communication and includes a timing mechanism, and that potential adversaries operating outside the IoT network cannot reliably distinguish or replicate RTT measurements, while the seed generation process further enhances randomness by multiplying accumulated RTT values by a prime number, applying XOR and bit-shift transformations, and subsequently hashing the derived seed using SHA-512 to achieve strong diffusion, high sensitivity to input variations, resistance to reverse engineering, and overall cryptographic robustness suitable for key generation and related security applications.
[0064] In one embodiment herein, the system 100 utilizes the round-trip time (RTT) values may be utilized as a source of random data because they are inherently affected by dynamic and unpredictable network conditions, including congestion levels, routing variations, packet queuing delays, processing latency, and fluctuating hardware performance across intermediate nodes. These continuously changing conditions introduce measurable variability and uncertainty into the RTT values, making them difficult to deterministically predict or precisely reproduce. When RTT measurements are collected from multiple geographically distributed servers and aggregated over time, the cumulative variability provides sufficient entropy for secure random data generation. Processing these measurements through cryptographic conditioning mechanisms enables the derivation of seed values suitable for cryptographic applications.
[0065] The security of the pseudo-random numbers generated by the proposed scheme primarily depends upon the unpredictability of the measured RTT values and the robustness of the cryptographic hash function applied thereafter. The operational assumptions of the scheme are minimal, requiring only that the local network environment remains uncompromised, that the IoT device supports standard TCP/IP communication, and that a reliable timing mechanism is available, which are standard features in most contemporary IoT controllers. Potential attack vectors are largely external to the device, and even if an adversary passively observes network traffic, exact RTT replication is impractical due to path asymmetry and environmental variability.
[0066] The seed generation process strengthens entropy by applying structured mathematical transformations to the collected RTT values. Each new seed component is derived by multiplying the previously accumulated seed by a predetermined prime number and adding the current RTT measurement, followed by XOR and bit-shift operations to enhance diffusion and non-linearity. The resulting seed is then processed using the SHA-512 cryptographic hash function, which produces a highly sensitive output where minor input variations cause substantial output divergence. This layered transformation ensures uniform distribution, resistance to reverse engineering, and strong cryptographic suitability of the generated random bits.
[0067] According to another example embodiment of the present invention, FIG. 3 refers to a flowchart 300 of a method for secure random number generation in a resource-constrained Internet of Things (IoT) device implemented by the computing device 102 comprising the processor 104, the memory 106, the communication interface 118, and the timing module. At step 302, establish communication with one or more remote servers via the network 124 using the communication interface 118 and measure round-trip time (RTT) values using the timing module 120. At step 304, generate seed data from the RTT values using arithmetic accumulation and bitwise transformation operations.
[0068] At step 306, initialize a Mersenne Twister pseudo-random number generator using the seed data. At step 308, generate a batch of pseudo-random numbers using the initialized generator. At step 310, apply a secure hash function to the generated pseudo-random numbers to produce cryptographically secure random bits. Further, at step 312, periodically reinitializes the Mersenne Twister generator using newly measured RTT values after generation of a predetermined number of outputs selected to be lower than a state reconstruction threshold of the generator
[0069] Numerous advantages of the present disclosure may be apparent from the discussion above. In accordance with the present disclosure, a system 100 for secure random number generation in a resource-constrained Internet of Things (IoT) device is disclosed. The proposed system 100 utilizes externally observable network timing variations, including round-trip time (RTT) measurements, as a high-entropy seed source for cryptographic applications. The system 100 decouples entropy harvesting from high-speed random number expansion through a controlled batch-reseeding architecture, thereby improving throughput and reducing latency associated with continuous network interactions.
[0070] The system 100 mitigates state predictability vulnerabilities associated with high-speed pseudo-random generators by periodically refreshing the internal state prior to reaching statistical exposure thresholds. The system 100 provides cryptographically hardened random outputs using secure hash-based post-processing to enhance non-linearity, diffusion, and resistance to classical and quantum-assisted attacks. The system 100 generates block-wise mid-level primitive components using kernel aggregation-based computation to obtain compact and discriminative feature representations. The system 100 achieves improved energy efficiency and computational optimization in secure key generation, nonce generation, and session establishment operations for low-power IoT and edge platforms.
[0071] It will readily be apparent that numerous modifications and alterations can be made to the processes described in the foregoing examples without departing from the principles underlying the invention, and all such modifications and alterations are intended to be embraced by this application.
, Claims:CLAIMS:
I/We Claim:
1. A system (100) for secure random number generation in a resource-constrained Internet of Things (IoT) device, comprising:
a computing device (102) comprises a processor (104) and a memory (106) for storing executable instructions, wherein the computing device (102) is configured,
wherein the computing device (102) is operably connected, via a network (124), to servers (122),
wherein the processor (104) executes the executable instructions stored in the memory (106), wherein the executable instructions implement plurality of modules (107) for performing,
wherein the plurality of modules (107) comprises:
a network interface module (108) configured to establish communication with the servers (122) via a communication interface (118) and measure network round-trip time (RTT) values exchanged over the network (124) using a timing module (120),
wherein the timing module (120) is configured to measure transmission start and response receipt times associated with communication exchanges with the servers (122), and implemented as a software timer executed by the processor (104);
an entropy harvesting module (110) configured to generate seed data from the measured RTT values using iterative arithmetic accumulation and bitwise transformation operations;
a pseudo-random expansion module (112) comprising a Mersenne Twister generator configured to be initialized using the seed data and generate a batch of pseudo-random numbers at high throughput;
a cryptographic hardening module (114) configured to process the generated pseudo-random numbers using a secure hash function to produce cryptographically secure random bits; and
a reseeding control module (116) configured to intermittently acquire fresh RTT values and reinitialize the pseudo-random expansion module (112) after generation of a predetermined number of outputs,
wherein the predetermined number of outputs is selected to be lower than a state reconstruction threshold of the Mersenne Twister generator such that internal state predictability is mitigated, and wherein entropy acquisition by the entropy harvesting module (110) is decoupled from each random number generation cycle to reduce network latency and computational overhead.
2. The system (100) as claimed in claim 1, wherein the network interface module (108) measures RTT values during Transmission Control Protocol (TCP) handshake exchanges.
3. The system (100) as claimed in claim 1, wherein the entropy harvesting module (110) generates the seed data using a rolling hash computation that multiplies accumulated RTT values by a predetermined prime number, wherein the RTT values are collected from at least four geographically distributed servers.
4. The system (100) as claimed in claim 3, wherein the entropy harvesting module (110) further applies XOR and bit-shift operations to the accumulated seed data.
5. The system (100) as claimed in claim 1, wherein the pseudo-random expansion module (112) comprises an MT19937 Mersenne Twister generator.
6. The system (100) as claimed in claim 1, wherein the cryptographic hardening module (114) utilizes a SHA-512 hash function, wherein SHA-512 hash function produces a 512-bit conditioned output resistant to classical and quantum-assisted brute-force attacks.
7. The system (100) as claimed in claim 1, wherein the predetermined number of outputs comprises approximately 500 pseudo-random numbers.
8. The system (100) as claimed in claim 1, wherein the predetermined number of outputs is fewer than 624 consecutive outputs.
9. The system (100) as claimed in claim 1, wherein the cryptographically secure random bits are used for generation of cryptographic keys, nonces, initialization vectors, or session parameters in IoT communication protocols.
10. A method for secure random number generation in a resource-constrained Internet of Things (IoT) device implemented by a computing device (102) comprising a processor (104), a memory (106), a communication interface (118), and a timing module (120), the method comprising:
establishing communication with one or more remote servers via a network (124) using the communication interface (118) and measuring round-trip time (RTT) values using the timing module (120);
generating seed data from the RTT values using arithmetic accumulation and bitwise transformation operations;
initializing a Mersenne Twister pseudo-random number generator using the seed data;
generating a batch of pseudo-random numbers using the initialized generator;
applying a secure hash function to the generated pseudo-random numbers to produce cryptographically secure random bits; and
periodically reinitializing the Mersenne Twister generator using newly measured RTT values after generation of a predetermined number of outputs selected to be lower than a state reconstruction threshold of the generator.