Hardware security vulnerability knowledge graph assisted Verilog security code generation method and device

Abstract

The invention discloses a hardware security vulnerability knowledge graph-assisted Verilog security code generation method and device, and the method comprises the steps: firstly decomposing a hardware code generation task into a plurality of subtasks according to the natural language description of the hardware code generation task inputted by a user, and extracting signals, state conversion and circuit code examples; secondly, acquiring hardware security vulnerability data, and constructing a hardware vulnerability security knowledge graph from top to bottom; and then generating Verilog codes according to natural language description, signals, state transition and circuit code examples of the subtasks. And finally, based on the hardware vulnerability security knowledge graph, performing security vulnerability detection on the Verilog code and repairing security vulnerabilities to generate a secure Verilog code. According to the method, the hardware code generation efficiency and safety are improved, meanwhile, flexibility and expansibility are achieved, and implementation complexity is reduced.

Description

Technical Field

[0001] The present invention belongs to the fields of hardware security technology and code generation technology, and specifically relates to a Verilog security code generation method and device assisted by a hardware security vulnerability knowledge graph. Background Art

[0002] Designing modern integrated circuits requires designers to write code using hardware description languages ​​such as Verilog to specify the hardware architecture and model the behavior of digital systems. Due to the increasing complexity of very large scale integrated circuit (VLSI) designs, writing Verilog becomes time-consuming and error-prone, forcing designers to perform multiple iterations to debug syntax, functional correctness, and safety. Therefore, reducing the design cost and the effort required for designers to complete hardware specifications has become a pressing need. Large language models (LLMs) have shown significant capabilities in understanding and generating natural language and are able to process on a large scale, bringing many potential applications and benefits in various fields. In the field of code generation, LLMs can assist developers by suggesting code snippets, providing solutions to fix errors, and generating code with explanations. Currently, hardware generation in large language models can be divided into fine-tuning optimization-based and machine learning-based methods.

[0003] Methods based on fine-tuning optimization have the risk of overfitting, especially when the data set is small; they have high requirements for computing resources; they may introduce data bias and affect the generalization ability of the model; they have the risk of catastrophic forgetting, causing the model to forget the pre-training knowledge; the hyperparameter tuning is complex, which increases the difficulty of training; and they are highly dependent on the domain. When the pre-training task is very different from the target task, the effect may not be good.

[0004] Machine learning-based methods focus on the grammatical and functional correctness of the generated code, but lack a mechanism to fix errors, making it difficult to ensure the comprehensive correctness of the generated code in terms of syntax, functionality, and security. Summary of the invention

[0005] In view of the above problems, the present invention proposes a Verilog security code generation method and device assisted by a hardware security vulnerability knowledge graph, aiming to solve the problem of lack of comprehensiveness and security assurance in existing hardware code generation methods. The method utilizes a multi-agent system and a large language model, combined with a hardware security vulnerability knowledge graph and a special vulnerability detection and repair mechanism, to achieve the automatic generation, detection and repair of Verilog code. This solution not only improves the efficiency and quality of hardware code generation, but also solves the problems of lack of error repair, strong dependence on data and domain, and high training complexity in existing technical methods.

[0006] The technical solution adopted by the present invention to solve the above technical problems is:

[0007] A Verilog security code generation method assisted by a hardware security vulnerability knowledge graph comprises the following steps:

[0008] S1. Decompose the hardware code generation task into several subtasks according to the natural language description of the hardware code generation task input by the user.

[0009] S2. Extract signals, state transitions, and circuit code examples from the natural language description of the hardware generation subtask.

[0010] S3. Obtain hardware security vulnerability data and build a hardware vulnerability security knowledge graph from top to bottom.

[0011] S4. Generate Verilog code based on the natural language description of the subtask, the subtask signal, the subtask state transition, and the subtask circuit code example.

[0012] S5. Based on the hardware vulnerability security knowledge graph, perform security vulnerability detection and repair on the Verilog code to generate secure Verilog code.

[0013] Furthermore, step S1 is specifically that the large language model understands the natural language description of the hardware code generation task input by the user, plans the complex hardware generation task according to the functional modules, and decomposes the hardware generation task into several hardware generation subtasks.

[0014] Furthermore, step S2 is specifically that the large language model generates a natural language description of the subtask according to the hardware, and extracts the signal, state transition and circuit code example information of the hardware subtask.

[0015] Furthermore, step S3 specifically obtains semi-structured and unstructured data of hardware vulnerability knowledge from hardware security vulnerability documents, removes HTML tags, special characters, stop words, etc. in the text of the obtained data, and retains the text content. The text is segmented and stemmed, the text is converted into a unified format, and a data set is obtained by combining; a hardware vulnerability security knowledge graph is constructed from top to bottom, and the top-level ontology in the field of hardware security vulnerabilities is determined, including multiple entities, which are designed to represent the relationship between these entities and the attributes required by the entities. Entities, relationships, and attributes are clearly defined, and an ontology layer model is established. Entities, relationships, and attributes are extracted from the data using a large language model. Entity, relationship, and attribute data in the hardware security vulnerability data are obtained, added to the data layer, and a knowledge graph is generated. Entities, relationships, and attributes are stored in the graph database in the form of triples.

[0016] Further, step S4 is specifically to generate Verilog code based on the natural language description of the subtask and the extracted subtask circuit signal, state transition and circuit code example information by the large language model. Based on the generated Verilog code, the large language model calls the syntax check and function check tool iverilog, compiles and starts the Verilog simulation. If the Verilog code has syntax errors or is inconsistent with the subtask function description, the tool will report the number of lines where these errors occur and the simulation results, and provide the compilation message and the number of mismatches between the output signal and the time point of the first mismatch as feedback for the calling tool. The large language model repairs syntax errors and function errors based on the syntax and function error information returned by the called tool. Repeat the above steps until the generated Verilog code has no syntax errors and is consistent with the subtask description or the set number of iterations is reached. Integrate the subtasks to generate Verilog code to obtain Verilog code with correct syntax and function.

[0017] Furthermore, step S5 specifically detects grammatically and functionally correct Verilog code through the code detection method CWEAT to obtain the type of hardware security vulnerability and the location information of the vulnerability in the Verilog code. The large language model calls the graph retrieval tool according to the CWEAT feedback information. The large language model repairs the vulnerability according to the feedback information obtained by the graph retrieval tool from the hardware security vulnerability knowledge graph. The above steps are repeated until the generated code passes the CWEAT method detection or reaches the set number of iterations, and a safe, grammatically correct and functionally correct Verilog code is generated.

[0018] Furthermore, in step S5, the graph retrieval tool is a large language model that generates a Cypher language to retrieve all nodes within 2 hops of a specific hardware vulnerability security code type node, and uses the Cypher language to retrieve the hardware security vulnerability knowledge graph, and returns all subgraph node information within 2 hops of the corresponding hardware vulnerability security code type entity. The subgraph node information includes a natural language description of the hardware security vulnerability, a normative guide for correction, and a vulnerability error repair code case.

[0019] Further, in step S5, the CWEAT method uses a heuristic detection algorithm to traverse the rules of hardware security vulnerabilities, constructs a Verilog abstract syntax tree, and uses keywords to traverse the abstract syntax tree. Keyword matching rules include matching rules and exclusion rules. Security-related features in the Verilog code are located through keyword matching. If the code snippet keyword does not match the security keyword, the code snippet is marked as unsafe, otherwise the code snippet is marked as safe.

[0020] Further, in step S5, the method for constructing the Verilog abstract syntax tree is to traverse the Verilog source code and interpret the compilation instructions. This is done using the lexical analyzer flex, which identifies supported keywords and literals, and records the current code position through global variables to mark the source position of each abstract syntax tree node. This is done using the parsing generator bison, which generates an abstract syntax tree, each abstract syntax tree node is marked with the source position in the code, and supports different types of Verilog syntax and structures, such as modules, functions, tasks, parameters, arrays, operators, logic blocks, etc.

[0021] In a second aspect, the present invention further provides a Verilog security code generation device assisted by a hardware security vulnerability knowledge graph, wherein the device comprises:

[0022] The task planning module is used to decompose the hardware code generation task input by the user into several subtasks.

[0023] The circuit signal information extraction module is used to extract the signal, state transition and circuit example information of the subtask through the large language model.

[0024] The knowledge graph construction module builds a hardware security vulnerability knowledge graph based on hardware security vulnerability data.

[0025] The Verilog code generation module generates Verilog code through a large language model based on the natural language description of the subtask and the extracted subtask circuit signals, state transitions and circuit code examples.

[0026] The detection and repair module is used to detect and repair hardware security vulnerabilities in the generated Verilog code and generate secure Verilog code.

[0027] Compared with the prior art, the present invention has the following beneficial effects:

[0028] The present invention improves the efficiency and safety of hardware code generation through the collaborative work of modules such as task planning, signal extraction, code generation and safety detection, while also having flexibility and scalability to facilitate subsequent updates and function additions.

[0029] The present invention integrates the hardware security vulnerability knowledge graph and iterative optimization mechanism, so that the code can reach high standards in the process of generation, detection and repair, overcomes the shortcomings of the current method, improves the accuracy of code generation, and reduces the implementation complexity, providing a reliable solution for hardware designers. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 A schematic diagram of the overall process provided by the present invention;

[0031] Figure 2 A schematic diagram of the task planning agent module flow of the present invention;

[0032] Figure 3 A schematic diagram of the flow chart of the circuit signal, conversion and case extraction agent module of the present invention;

[0033] Figure 4 A schematic diagram of the process of constructing an intelligent agent module for the hardware security vulnerability knowledge graph of the present invention;

[0034] Figure 5 A schematic diagram of the code generation process of the intelligent agent module of the present invention;

[0035] Figure 6 It is a flowchart of the hardware security detection and repair intelligent agent module of the present invention. DETAILED DESCRIPTION

[0036] In order to make the purpose, technical solution and effect of the present invention clearer and more specific, the present invention is further described in detail with reference to the accompanying drawings and examples. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0037] This example provides a Verilog security code generation method and device assisted by a hardware security vulnerability knowledge graph. Based on the method of this embodiment, the large language model can more accurately understand the requirements and generate functional, grammatically correct and secure hardware code. In specific applications, this example first uses a large language model to decompose the hardware generation task into hardware security generation subtasks; based on the hardware security generation subtasks, circuit signals, state transitions and circuit examples are extracted. Then, a hardware security vulnerability knowledge graph is constructed based on the hardware security vulnerability data. Based on the subtask description and circuit generation dependency information, the large language model is input into the large language model. The large language model is not only responsible for generating code, but also can use grammar, function checking tools, hardware security vulnerability knowledge graphs and CWEAT feedback to automatically identify and repair grammar, function errors and security vulnerabilities. Finally, a Verilog code with correct syntax, function and security after multiple rounds of iterations is obtained. The large language model performs well in the field of natural language processing. In this example, this advantage is effectively transformed and applied in hardware code generation. This automation capability significantly reduces the need for manual intervention and reduces errors caused by human negligence, thereby improving the efficiency, accuracy and security of code generation.

[0038] Embodiment: A Verilog security code generation method assisted by a hardware security vulnerability knowledge graph, comprising:

[0039] Step 1: Obtain the natural language description of the hardware generation task input by the user. Figure 2As shown, this example first obtains the user input hardware natural language description, and the hardware generates a natural language description to implement the following Moore state machine, whose input is 3-bit user_input, clock signal clk and reset signal rst_n, and the output is 3-bit out. When the reset signal is low, state is initialized to 2'h0; at the rising edge of the clock, according to the value of user_input, at the rising edge of the clock (posedgeclk), when the value of user_input is 3'h0 to 3'h5, state is set according to the predetermined mapping rule: 3'h0 corresponds to state = 2'h0, 3'h1 corresponds to state = 2'h1, 3'h2 corresponds to state = 2'h2, 3'h3 corresponds to state = 2'h3, 3'h4 corresponds to state = 2'h2, 3'h5 corresponds to state = 2'h1, and outputs a 3-bit out signal by splicing constant 1 and state. The state machine supports 6 different user_input input values, and the default output is 2'h0 when user_input exceeds these ranges. Decompose complex hardware tasks into hardware generation subtasks. Hardware generation subtasks include

[0040] 1. Define the input and output ports of the module: The module should have input: 3-bit 'user_input', clock signal 'clk', reset signal 'rst_n', and output: 3-bit 'out'.

[0041] 2. Define and initialize the status register: The status should be a 2-bit register, which is initialized to 2'h0 when the reset signal 'rst_n' is low.

[0042] 3. State transition logic: Define the state transition based on the value of 'user_input' at the rising edge of the clock.

[0043] 4. Output logic: concatenate the constant value '1' with the current 'state' to generate a 3-bit output 'out'.

[0044] 5. Handle out of range 'user_input' values. If 'user_input' is outside the defined 6 value range, the 'out' signal should default to output 2'h0.

[0045] Step 2: Combine Figure 3 As shown, a subtask description is generated based on the hardware, and circuit signals, state transitions, and circuit sample code information are extracted. Subtask description: Define a state transition based on the value of 'user_input' at the rising edge of the clock.

[0046] -clk: clock signal, triggering the update of the state machine (rising edge trigger) (type: signal)

[0047] -rst_n: reset signal, low level activates reset, and initializes the state register state to 2'h0 (type: signal)

[0048] -user_input: 3-bit input signal, the value of which determines the state transition of the state machine (type: signal)

[0049] -State()--user_input=3'h0-->State0 (type: state transition)

[0050] -State()--user_input=3'h1-->State1 (Type: state transition)

[0051] -State()--user_input=3'h2-->State2 (type: state transition)

[0052] -State()--user_input=3'h3-->State3 (Type: state transition)

[0053] -State()--user_input=3'h4-->State2 (Type: state transition)

[0054] -State()--user_input=3'h5-->State1 (Type: state transition)

[0055] -When the value of user_input is 3'h0 to 3'h5, 3'h0 corresponds to state = 2'h0, 3'h1 corresponds to state = 2'h1, 3'h2 corresponds to state = 2'h2, 3'h3 corresponds to state = 2'h3, 3'h4 corresponds to state = 2'h2, and 3'h5 corresponds to state = 2'h1. (Type: Signal Example)

[0056] Step 3: Combination Figure 4As shown, data from the hardware security vulnerability MITRE_CWE document (an open source weakness classification document that helps developers and security experts identify security vulnerabilities in software and hardware) is obtained, and the obtained semi-structured and unstructured data is cleaned, standardized, and labeled to obtain a data set. A hardware vulnerability security knowledge graph is constructed from top to bottom to determine the top-level ontology in the field of hardware security vulnerabilities, including multiple entities designed to represent the relationships between these entities and the attributes required by the entities. Entities, relationships, and attributes are clearly defined, and an ontology layer model is established. A large language model is used to extract entities, relationships, and attributes from the data. Entity, relationship, and attribute data in the hardware security vulnerability data are obtained, added to the data layer, and a knowledge graph is generated. Entities, relationships, and attributes are stored in the form of triples in a graph database; exemplary:

[0057] Semi-structured and unstructured data cleaning, standardization and data annotation:

[0058] Data cleaning:

[0059] Text cleaning: remove HTML tags, special characters, stop words, etc. from the text and retain the text content.

[0060] Data format conversion: Convert unstructured data into structured data, such as converting text data into a CSV format suitable for large language model processing.

[0061] Data Standardization:

[0062] Text standardization: Perform word segmentation, stem extraction, part-of-speech tagging and other processing on the text to convert the text into a unified format.

[0063] The main body layer model is shown in Table 1:

[0064] Table 1

[0065]

[0066] Step 4: Combination Figure 5 As shown, Verilog code is generated based on the subtask description and circuit signal, state transition and circuit example code information:

[0067]

[0068]

[0069] Calling the functional syntax detection tool iverilog returns the result:

[0070] [Function Check Failed]

[0071] ==Report start==

[0072] VCD info:dumpfile wave.vcd

[0073] opened for output.

[0074] VCD warning:$dumpvars:Package

[0075] ($unit)is not dumpable with VCD.

[0076] . / Verilog_tool_tmp / / test.sv:21:

[0077] $finish called at 996(1ps)

[0078] Hint:Output'state'has 1mismatches.

[0079] First mismatch occurred at time 5.

[0080] Hint:Total mismatched samples is

[0081] 1out of 199samples

[0082] The large language model generates code based on the results returned by the feedback tool:

[0083]

[0084] The large language model calls the Iverilog tool again and returns the [Compiled Success] and [Function CheckSuccess] information to complete the generation of syntactically and functionally correct Verilog code.

[0085] Step 5: Combine Figure 6 As shown in the figure, based on the Verilog code with correct syntax and function, the CWEAT method is used to detect that the following code has CWE1245 vulnerability:

[0086] case(user_input)

[0087] 3'h0:state=2'h0;

[0088] 3'h1:state=2'h1;

[0089] 3'h2:state=2'h2;

[0090] 3'h3:state=2'h3;

[0091] 3'h4:state=2'h2;

[0092] 3'h5:state=2'h1;

[0093] endcase

[0094] Based on the feedback information, the large language model calls the graph retrieval tool, matches the CWE1245 entity node, and returns the subgraph information:

[0095] / / BUG: Incorrect finite state machines (FSMs) in hardware logic

[0096] / / Fix: The case statement does not include a default value to handle the scenario where the user provides 3'h6 and 3'h7 inputs. These inputs push the system into an undefined state and may cause a crash (denial of service) or any other unexpected results. Adding a default statement to handle undefined inputs may alleviate this issue.

[0097] The large language model fixes the CWE1234 vulnerability based on the feedback from the graph retrieval tool:

[0098] case(user_input)

[0099] 3'h0:state=2'h0;

[0100] 3'h1:state=2'h1;

[0101] 3'h2:state=2'h2;

[0102] 3'h3:state=2'h3;

[0103] 3'h4:state=2'h2;

[0104] 3'h5:state=2'h1;

[0105] default:state=2'h0;

[0106] endcase

[0107] After the large model is repaired, the CWEAT method is called again to detect the code, feedback information [no Vulnerability] is given, and safe Verilog code is output:

[0108]

[0109]

[0110] In the process of generating hardware code, this embodiment ensures that the generated Verilog code functions correctly and meets security requirements through multi-step task decomposition and security vulnerability detection. First, the natural language description of the hardware task input by the user is obtained, and the hardware task is decomposed into multiple subtasks according to the description, such as defining module input and output, initializing state registers, designing state transition logic, etc. Then, by extracting circuit signals and state transition information, the corresponding Verilog code is generated, and the correctness of the code is verified using a functional syntax detection tool. Based on the code that passes the functional syntax detection tool, the CWEAT method is used to discover potential hardware security vulnerabilities (CWE-1245 vulnerabilities), and the corresponding vulnerability repair suggestions are matched by the call graph retrieval tool, and the defects in the code are further repaired to ensure the security of the code. Finally, the code after the vulnerability repair is detected by the CWEAT method, confirmed to be free of vulnerabilities, and outputs safe Verilog code.

[0111] Furthermore, in order to improve the generation capability of the large language model, this embodiment decomposes the hardware task into multiple subtasks and provides three key information including hardware task description, subtask description and security vulnerability information. This information helps the large language model to understand user needs more accurately and generate safe code that meets the needs. In this way, not only the accuracy of code generation is improved, but also the security of the generated code is enhanced, and the subsequent debugging and vulnerability repair work is reduced, thereby effectively improving development efficiency.

[0112] Compared with the prior art, this embodiment overcomes the shortcomings of current hardware code generation methods, including the risk of overfitting during fine-tuning optimization and the lack of effective error repair mechanisms in machine learning methods. Through the collaborative work of multiple agents and the powerful generation and repair capabilities of large language models, the present invention achieves efficient automatic generation of hardware code and vulnerability repair. This method significantly improves the efficiency and security of code generation, while reducing the complexity of the implementation process, providing hardware designers with an efficient and reliable solution.

[0113] Table 2

[0114]

[0115] The design represents the name of the hardware to be generated, provides the corresponding natural language description, and provides a reference design Verilog written by human designers. By comparing with the reference design, the design quality of the automatically generated design Verilog can be quantitatively evaluated. The quantitative evaluation of the large language model using a hardware security vulnerability knowledge graph-assisted Verilog security code generation method in terms of syntax and functional correctness is summarized. The correctness part counts the number of correct functions and syntax in the generated design Verilog in five experiments. The security part counts that as long as one generated RTL successfully passes the test benchmark, it can be counted as a success, provided that the RTL has the correct function and syntax. According to Table 2, the most advanced commercial LLM GPT-4.0 performs best in terms of functional syntax, achieving 92% correctness and 64% security. In contrast, the performance of GPT-3.5 alone drops to 72% correctness and 42% functional correctness. After combining a hardware security vulnerability knowledge graph-assisted Verilog security code generation method, the performance of GPT-3.5 rebounds to 88% and 64%, close to the performance of GPT-4. This clearly verifies the effectiveness of a hardware security vulnerability knowledge graph-assisted Verilog secure code generation method. In general, the performance ranking is GPT-4+a hardware security vulnerability knowledge graph-assisted Verilog secure code generation method>GPT-4>GPT-3.5+a hardware security vulnerability knowledge graph-assisted Verilog secure code generation method>GPT-3.5>.

[0116] Based on the above embodiments, the present invention also provides a Verilog security code generation device assisted by a hardware security vulnerability knowledge graph, such as Figure 1 As shown, the device includes: a task planning module, a circuit signal information extraction module, a knowledge graph construction module, a Verilog code generation module and a detection and repair module. The device forms a closed-loop system through the collaborative work of multiple intelligent agent modules, aiming to automatically generate highly secure Verilog code.

[0117] In one implementation, the task planning module includes:

[0118] It is used to receive natural language descriptions of hardware modules input by users and decompose complex hardware tasks into specific hardware generation subtasks.

[0119] In one implementation, the circuit signal information extraction module includes:

[0120] It is used to generate subtask descriptions based on the hardware generated by the task planning agent module and extract the required circuit signals and state transition information.

[0121] In one implementation, the knowledge graph construction module includes:

[0122] Obtain hardware security vulnerability data, perform preprocessing such as text cleaning, word segmentation, and stem extraction, convert the hardware security vulnerability data into a unified format, and then build a hardware security vulnerability knowledge graph. This graph includes a top-level ontology design, clarifies entities, relationships, and attributes, and is stored in the form of triples in a graph database.

[0123] In one implementation, the Verilog code generation module includes:

[0124] According to the subtasks of the task planning agent module and the signal dependency information of the circuit signal extraction module, the Verilog code is generated using the large language model and verified by syntax and function checking tools (such as iverilog). If there are errors in the generated code, the tool will report the error location and simulation results. The generated error feedback will be used by the large language model to repair the generated code to ensure that the generated code is grammatically correct and functionally complete.

[0125] In one implementation, the detection and repair module includes:

[0126] The CWEAT method is used to detect security vulnerabilities in the generated Verilog code. If there are vulnerabilities, the system will use graph retrieval tools to query the knowledge graph, obtain relevant vulnerability descriptions and repair code information, assist the large language model to repair the vulnerabilities, and finally generate secure and functionally correct Verilog code.

[0127] The working principles of each module in a Verilog security code generation device assisted by a hardware security vulnerability knowledge graph in this embodiment are the same as the principles of each step in the above method embodiment, and will not be repeated here.

[0128] The above is an exemplary description of the present invention in combination with the accompanying drawings. It is obvious that the specific implementation of the present invention is not limited to the above-mentioned method. As long as such non-substantial improvements are made by adopting the method concept and technical solution of the present invention, or the concept and technical solution of the present invention are directly applied to other occasions without improvement, they are all within the protection scope of the present invention.

Claims

1. A Verilog security code generation method assisted by a hardware security vulnerability knowledge graph, characterized in that: The steps include: S1. Decomposing the hardware code generation task into several subtasks according to the natural language description of the hardware code generation task input by the user; S2, extract signals, state transitions, and circuit code examples from the natural language description of the subtask; S3, obtain hardware security vulnerability data and build a hardware vulnerability security knowledge graph from top to bottom; S4, generating Verilog code based on the natural language description of the subtask, signals, state transitions, and circuit code examples; S5. Based on the hardware vulnerability security knowledge graph, perform security vulnerability detection and repair on the Verilog code to generate secure Verilog code.

2. The method for generating Verilog security code assisted by a hardware security vulnerability knowledge graph according to claim 1, characterized in that: The specific implementation process of step S1 is: understanding the natural language description of the hardware code generation task input by the user through the large language model, planning the hardware code generation task according to the functional modules, and decomposing the hardware generation task into several hardware generation subtasks.

3. The method for generating Verilog secure code assisted by a hardware security vulnerability knowledge graph according to claim 2, characterized in that: The specific implementation process of step S2 is: extracting the signal, state transition and circuit code examples of the subtask according to the natural language description of the subtask through the large language model.

4. The method for generating Verilog secure code assisted by a hardware security vulnerability knowledge graph according to claim 3, characterized in that: The specific implementation process of step S3 is as follows: Obtain hardware vulnerability knowledge semi-structured and unstructured data from hardware security vulnerability documents, remove HTML tags, special characters, and stop words from the obtained data, and retain the text content; perform word segmentation and stem extraction on the text, convert the text into a unified format, and combine them to obtain a data set; construct a hardware vulnerability security knowledge graph from top to bottom, determine the top-level ontology in the field of hardware security vulnerabilities, including multiple entities, designed to represent the relationship between entities and the attributes required by entities; clearly define entities, relationships, and attributes, and establish an ontology layer model; use a large language model to extract entities, relationships, and attributes from the data; Obtain the entity, relationship and attribute data in the hardware security vulnerability data, add it to the data layer, and generate a knowledge graph; store the entities, relationships and attributes in the form of triples in the graph database.

5. The method for generating Verilog secure code assisted by a hardware security vulnerability knowledge graph according to claim 4, characterized in that: The specific implementation process of step S4 is as follows: Based on the natural language description of the subtask and the extracted subtask circuit signals, state transitions, and circuit code sample information, the large language model generates Verilog code. Based on the generated Verilog code, the large language model calls the syntax check and function check tool iverilog to compile and start the Verilog simulation. If the Verilog code has syntax errors or is inconsistent with the subtask function description, the tool will report the number of lines where these errors occur and the simulation results, and provide the number of mismatches between the compilation message and the output signal and the time point of the first mismatch as feedback for the calling tool; The large language model fixes syntax errors and functional errors based on the syntax and functional error information returned by the called tool; Repeat the above process until the generated Verilog code has no syntax errors and is consistent with the subtask description or the set number of iterations is reached; Integrate the subtasks to generate Verilog code and obtain Verilog code with correct syntax and functions.

6. The method for generating Verilog security code assisted by a hardware security vulnerability knowledge graph according to claim 5, characterized in that: The specific implementation process of step S5 is as follows: the Verilog code with correct syntax and function is detected by the code detection method to obtain the type of hardware security vulnerability and the location information of the vulnerability in the Verilog code; the large language model calls the graph retrieval tool according to the feedback information of the code detection method; the large language model repairs the vulnerability according to the feedback information obtained by the graph retrieval tool from the hardware security vulnerability knowledge graph; the above process is repeated until the generated code passes the code detection by the code detection method or reaches the set number of iterations, and a safe, grammatically correct and functionally correct Verilog code is generated.

7. The method for generating Verilog secure code assisted by a hardware security vulnerability knowledge graph according to claim 6, characterized in that: The graph retrieval tool is a Cypher language generated by a large language model to retrieve all nodes within 2 hops of a hardware vulnerability security code type node, and uses the Cypher language to retrieve a hardware security vulnerability knowledge graph, and returns all subgraph node information within 2 hops of a corresponding hardware vulnerability security code type entity; the subgraph node information includes a natural language description of the hardware security vulnerability, normative guidance for correction, and vulnerability error repair code cases.

8. The method for generating Verilog secure code assisted by a hardware security vulnerability knowledge graph according to claim 6, characterized in that: The code detection method adopts a heuristic detection algorithm to traverse the rules according to hardware security vulnerabilities, constructs a Verilog abstract syntax tree, and uses keywords to traverse the abstract syntax tree; the keyword matching rules include matching rules and exclusion rules; the security-related features in the Verilog code are located by keyword matching, if the code fragment keyword does not match the security keyword, the code fragment is marked as unsafe, otherwise the code fragment is marked as safe.

9. The method for generating Verilog secure code assisted by a hardware security vulnerability knowledge graph according to claim 6, characterized in that: The construction of the Verilog abstract syntax tree is specifically implemented as follows: traversing the Verilog source code, interpreting and processing the compilation instructions; using the lexical analyzer flex to complete, identifying supported keywords and literals, and recording the current code position through global variables to mark the source position of each abstract syntax tree node; The parsing generator bison is used to complete the analysis. Bison generates an abstract syntax tree. Each abstract syntax tree node is marked with the source location in the code, supporting different types of Verilog syntax and structures.

10. A Verilog security code generation device assisted by a hardware security vulnerability knowledge graph, used to implement the code generation method described in any one of claims 1 to 9, characterized in that: Includes the following modules: The task planning module is used to decompose the hardware code generation task input by the user into several subtasks; Circuit signal information extraction module, used to extract subtask signal, state transition and circuit example information through a large language model; The knowledge graph construction module builds a hardware security vulnerability knowledge graph based on hardware security vulnerability data; The Verilog code generation module generates Verilog code through a large language model based on the natural language description of the subtask and the extracted subtask circuit signals, state transitions, and circuit code examples; The detection and repair module is used to detect and repair hardware security vulnerabilities in the generated Verilog code and generate secure Verilog code.

Images