LAsset: An LLM-assisted Security Asset Identification Framework for System-on-Chip (SoC) Verification

1. Problem Statement

Modern System-on-Chip (SoC) and Intellectual Property (IP) designs have become increasingly complex, significantly expanding the attack surface and making pre-silicon security verification difficult.

• The Bottleneck: A fundamental step in security verification is Security Asset Identification (determining which hardware components or data elements require protection to ensure Confidentiality, Integrity, and Availability). Currently, this is a manual process performed by security experts, which is time-consuming, error-prone, and difficult to scale.
• Limitations of Existing Tools: Previous automated approaches (e.g., SAIF, LASHED) often rely on analyzing vulnerabilities after they are identified or depend heavily on specific naming conventions in Register-Transfer Level (RTL) code. These methods fail to generalize across diverse designs and lack the reasoning capabilities to explain why an element is a security asset.
• Research Gap: There is a need for an end-to-end, automated methodology that can identify assets from both high-level specifications and RTL code, reason about design semantics, and provide verifiable justifications aligned with industry standards.

2. Methodology: The LAsset Framework

The authors propose LAsset, a novel agentic framework leveraging Large Language Models (LLMs) to automate security asset identification. The framework aligns with the Security Annotation for Electronic Design Integration (SA-EDI) standard and IEEE P3164 guidelines.

The framework operates through three sequential agents:

A. Input Pre-processing

This stage prepares the design data for the LLM to ensure context retention and reduce hallucinations.

1. Module Extraction: The LLM prunes non-relevant modules from the RTL repository and selects security-critical modules (e.g., keeping a CPU PMP module while excluding a generic application image).
2. Modular Specification Summarization: Using Retrieval-Augmented Generation (RAG), the system generates concise technical summaries of security-relevant modules based on high-level design specifications.
3. Modular RTL Parsing: Two specialized parsers extract I/O ports and internal signals/registers, ensuring no design elements are overlooked.

B. Asset Generation

Using the pre-processed inputs, the framework employs few-shot in-context learning to identify assets.

• Conceptual to Structural Mapping: The LLM identifies Conceptual Assets (high-level data like encryption keys) based on CIA objectives and maps them to Structural Assets (physical RTL elements like registers or buffers).
• Primary vs. Secondary Classification:
  • Primary Assets: Direct targets of attacks (e.g., the encryption key itself).
  • Secondary Assets: Components that facilitate exposure of primary assets (e.g., buses, output buffers).
• Context: The LLM is guided by hardware security contexts and Q/A pairs regarding CIA objectives.

C. Asset Refinement

To ensure high fidelity and answer the research question of "How to validate an asset?", a three-stage refinement process filters false positives:

1. Attack Scenario Analysis: The LLM generates plausible attack scenarios (e.g., side-channel, fault injection, hardware Trojans) for each candidate. Assets without plausible attack scenarios are discarded.
2. CWE Mapping: Candidates are cross-referenced with the MITRE Common Weakness Enumeration (CWE) database. Assets that cannot be mapped to relevant CWEs are removed.
3. Self-Critique Revision: A self-critique prompt re-evaluates the asset list for relevance, RTL reference correctness, and attack scenario coherence.
4. Degree of Influence (DoI) Calculation: For secondary assets, the framework calculates a quantitative metric (DoI) based on the bit-level connectivity between secondary and primary assets to measure how much a compromise in a secondary asset influences the primary asset.

3. Key Contributions

• First LLM-Assisted Framework: LAsset is the first framework to utilize LLMs for the automated identification of security assets from both SoC and IP designs.
• Robustness and Versatility: It supports multiple input configurations (Specification + RTL, or RTL only) and handles various hardware description languages (Verilog, SystemVerilog, VHDL).
• Comprehensive Context: Unlike previous tools, LAsset associates identified assets with threat modeling details, attack vectors, and specific CWEs, providing actionable context for downstream verification.
• Trustworthiness: The inclusion of a rigorous refinement stage (CWE mapping and self-critique) ensures high-fidelity results.

4. Experimental Results

The framework was evaluated on the NEORV32 RISC-V SoC and 21 open-source IP blocks (including AES, SHA-3, and GPIO from OpenTitan and OpenCores).

• Performance Metrics:
  • SoC Design (NEORV32): Achieved a 90.67% recall rate using the Spec + RTL approach.
  • IP Designs: Achieved a 93.21% recall rate using the Spec + RTL approach.
  • Comparison: LAsset outperformed the state-of-the-art tool by Nath et al. [18], which achieved an 83.33% recall rate. The authors note that LAsset identified critical assets (e.g., round constants in SHA-3) that were missing from the "golden" reference list used by the competing tool, suggesting LAsset's higher recall is due to better generalization rather than false positives.
• Input Configuration: The combination of Specification + RTL consistently outperformed using RTL alone, as natural language specifications help the LLM understand operational behavior and interconnectivity.
• Model Efficiency: Experiments with different LLM models (GPT-4o, GPT-5 variants) showed that GPT-5-nano offered the best trade-off between recall, runtime, and cost when prioritizing performance.

5. Significance

• Scalability: LAsset addresses the scalability crisis in hardware security by automating a task that previously required significant manual expertise, making it feasible to secure large, complex SoCs.
• Shift-Left Security: By automating asset identification early in the design cycle, the framework enables earlier threat modeling and countermeasure development, reducing the cost and risk of post-silicon fixes.
• Standardization: The framework aligns with emerging industry standards (SA-EDI, IEEE P3164), promoting a unified approach to documenting security-critical assets.
• Actionable Insights: By providing not just a list of assets but also their associated attack scenarios, CWEs, and influence metrics, LAsset empowers verification engineers to prioritize testing and mitigation efforts effectively.