TLDR: SecFSM is a novel method that guides Large Language Models (LLMs) in generating more secure Verilog code for Finite State Machines (FSMs) in Systems-on-Chip (SoCs). It addresses the common issue of LLMs overlooking security vulnerabilities by constructing a dedicated FSM Security Knowledge Graph (FSKG), performing a pre-analysis of user requirements to identify structural and potential vulnerabilities, and then retrieving relevant security knowledge to create security-enhanced prompts for code generation. Experiments demonstrate that SecFSM significantly improves the security pass rate of generated Verilog code compared to traditional LLM and RAG-based approaches.
Finite State Machines (FSMs) are fundamental components in modern Systems-on-Chip (SoCs), acting as the control logic for various modules like peripheral controllers and power management units. Traditionally, hardware engineers manually write Verilog code for FSMs, a process that is not only time-consuming but also prone to introducing security vulnerabilities, especially as chip designs become more complex.
With the rapid advancements in Large Language Models (LLMs) and their growing application in code generation, there’s been a push to automate Verilog code creation. However, a significant challenge arises: LLM-generated Verilog code often lacks crucial security considerations, making it unsuitable for sensitive FSM implementations. This gap in security awareness stems from the inherent limitations in the general knowledge base of LLMs regarding domain-specific hardware security.
Introducing SecFSM: A Knowledge-Guided Approach
To tackle these critical security issues, researchers have proposed a novel method called SecFSM. This innovative approach guides LLMs in generating more secure Verilog code by leveraging a specialized, security-oriented knowledge graph. SecFSM aims to bridge the security knowledge gap in LLMs, ensuring that the generated FSM designs are robust against common vulnerabilities.
The core of SecFSM lies in its structured workflow, which involves several key steps:
-
FSM Security Knowledge Graph (FSKG) Construction: First, a dedicated FSM Security Knowledge Graph (FSKG) is built. This external knowledge base serves as a comprehensive repository of FSM security information, including vulnerability types, code examples, and mitigation strategies. Unlike general LLM knowledge, the FSKG is tailored specifically for hardware security, ensuring consistency and reliability.
-
Vulnerability Pre-analysis: Before code generation, SecFSM analyzes the user’s design requirements. It extracts FSM state information and constructs a security state transition graph. Using this, it identifies both structural vulnerabilities (inherent flaws in the FSM’s design, like ‘Dead States’ where a state has no outgoing transitions) and potential vulnerabilities (issues that might arise from specific operations or data handling, such as those related to ‘CWE-190’ for integer overflows).
-
Intelligent Knowledge Retrieval: Based on the identified vulnerabilities from the pre-analysis, SecFSM intelligently retrieves relevant security knowledge from the FSKG. This process involves confirming potential vulnerabilities and then gathering specific security recommendations. Some of this knowledge is compiled into a security report for the user, offering guidance on design flaws. Other parts, particularly knowledge about vulnerabilities preventable through rigorous coding, are integrated directly into the prompts for the LLM.
-
Secure Prompt Generation and Code Execution: Finally, SecFSM constructs a ‘security prompt’ by combining a foundational prompt template (defining the module interface, state encoding, transition logic, etc.) with the retrieved security knowledge. This enriched prompt guides the LLM to generate Verilog code that is not only functionally correct but also secure. The generated code then undergoes both functionality and security verification.
Also Read:
- AI-Assisted Rule Generation for Verilog Hardware Security
- AI-Powered Tool Uncovers Hidden Crypto Flaws
Performance and Impact
Extensive experiments were conducted to evaluate SecFSM’s effectiveness across various datasets, including academic, artificial, and industrial cases. The results are compelling: SecFSM significantly outperforms state-of-the-art baselines in generating secure Verilog code. For instance, on a benchmark of 25 security test cases evaluated by DeepSeek-R1, SecFSM achieved an impressive pass rate of 21/25, far surpassing the 10/25 achieved by a standard Retrieval-Augmented Generation (RAG) approach.
Ablation studies further highlighted the crucial role of both the pre-analysis and knowledge retrieval modules. The knowledge retrieval module proved vital for mitigating coding vulnerabilities, while the pre-analysis module was essential for detecting structural vulnerabilities that LLMs struggle to identify through text analysis alone. The research also noted that while the LLM backbone significantly impacts the functional correctness of the generated Verilog code, SecFSM’s security enhancements are largely independent of the specific LLM used, demonstrating the robustness of its knowledge-guided approach.
In conclusion, SecFSM represents a significant step forward in automating the generation of secure hardware designs. By integrating a specialized knowledge graph and a sophisticated vulnerability pre-analysis, it empowers LLMs to produce Verilog code for FSMs that meets both functional and security requirements, addressing a critical need in the development of secure Systems-on-Chip. You can read the full research paper here.
