3-Part, 6-Session Intensive Course from Silicon Roots of Trust to System-Level Assurance
Alpinum’s Hardware & Software Security Verification Training is a 3-part, 6-session intensive course for engineering teams working at the boundary between hardware security, firmware security, software assurance and system-level verification.
The course is designed to help engineers understand how security mechanisms are architected, implemented, attacked and verified across modern semiconductor systems. It covers silicon roots of trust, secure boot, cryptography, CPU privilege, microarchitectural security, SoC interconnect protection, lifecycle management, runtime monitoring, formal information-flow verification and security verification closure.
Unlike software-only security training or hardware-only verification training, this course teaches hardware and software security side by side. Participants learn how a security mechanism behaves in hardware, how it is used or misused by software, and how verification teams can prove that the intended security property holds across the full system.
Course-at-a-Glance
Each session runs from 12:00–16:00 UK time and covers four 45-minute modules, two 20-minute demos, two 5-minute quizzes and a 10-minute break.
| Session | Part | Focus | Modules (UK Time) |
|---|---|---|---|
| Session 1 | Security Foundations: Building Trust from Hardware to Software | Trust, Boot & Cryptography | 12:00 – 16:00 |
| Session 2 | Security Foundations: Building Trust from Hardware to Software | Access Control, Physical Attacks & Verification | 12:00 – 16:00 |
| Session 3 | CPU Hardware & Software Security | CPU Architecture, Privilege & Boot | 12:00 – 16:00 |
| Session 4 | CPU Hardware & Software Security | Microarchitecture, TEEs & Case Studies | 12:00 – 16:00 |
| Session 5 | SoC Hardware & Software Security | SoC Architecture, Interconnect & Lifecycle | 12:00 – 16:00 |
| Session 6 | SoC Hardware & Software Security | Monitoring, Data Protection & Future Directions | 12:00 – 16:00 |
| SESSION 1 Trust, Boot & Cryptography Part 1 – Security Foundations: Building Trust from Hardware to Software |
Session Schedule
| Time (UK) | Session |
|---|---|
| 12:00 – 12:45 | Module 1 – Security Fundamentals & Threat Landscape |
| 12:45 – 13:05 | Demo 1 – Hands-on Walkthrough |
| 13:05 – 13:10 | Quiz 1 – Knowledge Check |
| 13:10 – 13:55 | Module 2 – Hardware Roots of Trust, Secure Boot & Security IP Architecture |
| 13:55 – 14:05 | Break |
| 14:05 – 14:50 | Module 3 – Cryptography, Secure Key Management & Crypto Hardware |
| 14:50 – 15:10 | Demo 2 – Hands-on Walkthrough |
| 15:10 – 15:15 | Quiz 2 – Knowledge Check |
| 15:15 – 16:00 | Module 4 – Memory Protection, Secure Execution & Access Control |
Module Details
| Module | Hardware Focus | Software Focus |
|---|---|---|
| Module 1- Security Fundamentals & Threat Landscape | CIA triad, trust boundaries, attack surfaces, attack taxonomies (side-channel, fault injection, probing, logical), and the HW/SW security relationship. | Threat modeling (STRIDE/DREAD), adversary models, asset identification, and security standards survey (ISO 21434, FIPS 140-3, Common Criteria). |
| Module 2 – Hardware Roots of Trust, Secure Boot & Security IP Architecture | Boot ROM, PUF (SRAM/RO/Arbiter), OTP/eFuse lifecycle states, Secure DMA, RNG pipeline (TRNG → health tests → DRBG), Key Manager, Key Vault, and lifecycle controller. | Chain of trust (ROM → BL1 → BL2 → OS), firmware authentication, X.509 certificate verification, measured vs. verified boot, key derivation/wrapping, and secure provisioning flow. Reference: OpenTitan. |
| Module 3 – Cryptography, Secure Key Management & Crypto Hardware | AES engine (pipelining, S-box, key expansion), SHA-2/SHA-3, HMAC/CMAC, RSA/ECC accelerators, TLS hardware offload, and side-channel resistant implementations (masking, constant-time). | Secure crypto APIs (PKCS#11, PSA Crypto), key lifecycle management (generate → activate → destroy), key derivation (HKDF, SP 800-108), key wrapping (AES-KW), zeroization, and post-quantum cryptography (CRYSTALS-Kyber/Dilithium) introduction. |
| Module 4 – Memory Protection, Secure Execution & Access Control | MPU/MMU architecture, inline memory encryption, ECC/SECDED, cache protection (way locking, partitioning, flush-on-context-switch), secure identities, hardware keys, and secure peripheral access control. | Process isolation, virtual memory security, stack protection (canaries, shadow stacks), ASLR, DEP/NX, ROP gadget chains, CFI (Intel CET), RBAC policy enforcement, and memory-safe programming patterns. |
| SESSION 2 Access Control, Physical Attacks & Verification Part 1 – Security Foundations: Building Trust from Hardware to Software |
Session Schedule
| Time (UK) | Session |
|---|---|
| 12:00 – 12:45 | Module 5 – Physical Security, Side-Channel Attacks & Countermeasures |
| 12:45 – 13:05 | Demo 1 – Hands-on Walkthrough |
| 13:05 – 13:10 | Quiz 1 – Knowledge Check |
| 13:10 – 13:55 | Module 6 – Hardware Security Verification Methodology |
| 13:55 – 14:05 | Break |
| 14:05 – 14:50 | Module 7 – Verifying Individual Security Blocks |
| 14:50 – 15:10 | Demo 2 – Hands-on Walkthrough |
| 15:10 – 15:15 | Quiz 2 – Knowledge Check |
| 15:15 – 16:00 | Module 8 – Advanced Block-Level Techniques, Secure SW Development & Vulnerability Assessment |
Module Details
| Module | Hardware Focus | Software Focus |
|---|---|---|
| Module 5 – Physical Security, Side-Channel Attacks & Countermeasures | SPA, DPA, CPA, EM analysis, timing attacks, voltage/clock/laser/EM fault injection, physical probing, active shields, voltage/temperature/clock sensors, dual-rail redundancy, and DPA-resistant masking/hiding techniques. | Constant-time algorithm implementation, redundant security checks, fault-detection coding patterns, runtime anomaly detection, and canary monitoring. |
| Module 6 – Hardware Security Verification Methodology | Security requirement extraction from threat models, security coverage models (permission transitions, error conditions), SVA for security FSMs and key leakage prevention, structured error injection, formal verification with JasperGold/VC Formal, and UVM testbench architecture for security IP. | Abuse-case identification, negative testing strategy, verification sign-off criteria, CI/CD regression integration, and documentation traceability from threats to test results. |
| Module 7 – Verifying Individual Security Blocks | AES core (CAVP directed tests, key-leakage prevention assertions, timing verification), TRNG (entropy validation, health test injection, formal output-gating proof), Key Manager (generation/zeroization/permission/FSM verification), and Debug Authentication (lock-state enforcement, formal proof of no-debug-in-locked-state). | Cross-block integration testing, UVM testbench architecture with security scoreboards, debugging security failures in Verdi waveforms. |
| Module 8 – Advanced Block-Level Techniques, Secure SW Development & Vulnerability Assessment | Advanced SVA (multi-cycle properties, illegal state detection, FSM mutation testing), lightweight RTL fault injection, formal debugging (counterexample analysis, abstraction refinement), and Part 1 verification closure (coverage summary, sign-off criteria). | Secure coding principles (least privilege, fail-secure defaults), buffer overflow/integer overflow prevention, correct crypto API usage, SAST (Coverity, clang-tidy), DAST (ASan, Valgrind), embedded fuzzing (AFL, LibFuzzer), and penetration testing methodology. |
| SESSION 3 CPU Architecture, Privilege & Boot Part 2 – CPU Hardware & Software Security |
Session Schedule
| Time (UK) | Session |
|---|---|
| 12:00 – 12:45 | Module 1 – CPU Security Architecture & Privilege Levels |
| 12:45 – 13:05 | Demo 1 – Hands-on Walkthrough |
| 13:05 – 13:10 | Quiz 1 – Knowledge Check |
| 13:10 – 13:55 | Module 2 – Privilege Management, OS Security & Firmware-Driven Verification |
| 13:55 – 14:05 | Break |
| 14:05 – 14:50 | Module 3 – Secure Firmware, Trusted Boot & Boot Verification |
| 14:50 – 15:10 | Demo 2 – Hands-on Walkthrough |
| 15:10 – 15:15 | Quiz 2 – Knowledge Check |
| 15:15 – 16:00 | Module 4 – CPU Memory Security & Memory Protection Verification |
Module Details
| Module | Hardware Focus | Software Focus |
|---|---|---|
| Module 1 – CPU Security Architecture & Privilege Levels | RISC-V privilege levels (M/S/U), TrustZone-style secure/non-secure split, CSR architecture and attack surface, exception/interrupt handling security, PLIC/CLINT secure routing, and RISC-V security extensions (ePMP, H-extension, Smepmp, Zkr). | CPU as foundation for OS kernel isolation and user-mode sandboxing, secure system call gate, ARM vs. RISC-V security architecture comparison, and CPU verification scope definition. |
| Module 2 – Privilege Management, OS Security & Firmware-Driven Verification | Per-CSR access rules (WARL fields, illegal write handling), interrupt/exception delegation security, trap table protection, and SVA assertion overlays monitoring CPU bus during firmware execution. | Kernel-only pages, SMEP/SMAP concepts, kernel CFI, OS-level RBAC, firmware-driven test structure (embedded C: setup → stimulus → check), RISC-V GCC toolchain integration, privilege escalation test, illegal memory access test, and secure system call verification. |
| Module 3 – Secure Firmware, Trusted Boot & Boot Verification | Boot ROM immutability, RSA/ECDSA signature verification engine, X.509 certificate engine, anti-rollback OTP version counter, and boot policy manager. Verification covers six boot scenarios using formal properties (“CPU cannot reach entry unless sig_valid AND ver_ok”) and temporal SVA assertions. | Firmware development best practices, A/B secure update flow, boot integrity measurement (TPM PCR equivalents), attestation reports, and firmware signing infrastructure (HSM, key hierarchy). |
| Module 4 – CPU Memory Security & Memory Protection Verification | RISC-V PMP/ePMP (TOR/NA4/NAPOT, lock bit, mseccfg), Sv32/Sv39/Sv48 MMU (page table walk, ASID, TLB), ARM MPU (background region, privilege vs. user), inline memory encryption, secure cache (way locking, flush), and pointer authentication (ARMv8.3-A PAC, CHERI concepts). | Process isolation verification, secure allocators, memory corruption defenses, firmware-driven tests for illegal U-mode access and PMP reconfiguration attacks, and formal proofs of cross-process isolation. |
| SESSION 4 Microarchitecture, TEEs & Case Studies Part 2 – CPU Hardware & Software Security |
Session Schedule
| Time (UK) | Session |
|---|---|
| 12:00 – 12:45 | Module 5 – Microarchitectural Security & Speculative Execution |
| 12:45 – 13:05 | Demo 1 – Hands-on Walkthrough |
| 13:05 – 13:10 | Quiz 1 – Knowledge Check |
| 13:10 – 13:55 | Module 6 – TEE, Secure Runtime & Attestation |
| 13:55 – 14:05 | Break |
| 14:05 – 14:50 | Module 7 – CPU Security Verification & SW Testing |
| 14:50 – 15:10 | Demo 2 – Hands-on Walkthrough |
| 15:10 – 15:15 | Quiz 2 – Knowledge Check |
| 15:15 – 16:00 | Module 8 – CPU Security Case Studies & Applied Verification |
Module Details
| Module | Hardware Focus | Software Focus |
|---|---|---|
| Module 5 – Microarchitectural Security & Speculative Execution | Cache timing side-channels, speculative execution vulnerabilities (Spectre/Meltdown), branch predictor poisoning, out-of-order execution hazards, RTL-level mitigations (speculation barriers, cache partitioning), and verification of microarchitectural isolation. | Compiler-based mitigations (retpoline, speculative load hardening), kernel patches (KPTI, IBRS), runtime defenses, and microarchitectural fuzzing approaches. |
| Module 6 – TEE, Secure Runtime & Attestation | ARM TrustZone architecture, RISC-V PMP-based TEE design, secure enclave memory isolation, secure interrupt routing, world-switch hardware enforcement, and attestation hardware (device identity, measurement). | Trusted services (secure storage, crypto, attestation), secure context switching, TA (Trusted Application) lifecycle, runtime attestation report generation, and TEE entry/exit verification. |
| Module 7 – CPU Security Verification & SW Testing | SVA on privilege FSMs, formal privilege isolation proofs, hardware abuse-case testing (illegal CSR access, privilege escalation attempts), riscv-arch-test compliance integration, and debugging failures with Verdi PC trace + CSR log. | Firmware-driven abuse cases, coverage-guided fuzzing for CPU security bugs, security-focused regression methodology, and CI/CD pipeline integration. |
| Module 8 – CPU Security Case Studies & Applied Verification | RTL-level root cause analysis of Spectre, Meltdown, and privilege escalation exploits; RTL mitigations and their verification; and lessons for microarchitectural design. | Firmware exploit analysis (secure boot bypasses, firmware attacks), software mitigations, firmware hardening techniques, and how verification methodologies must evolve in response to emerging microarchitectural threats. |
| SESSION 5 SoC Architecture, Interconnect & Lifecycle Part 3 – SoC Hardware & Software Security |
Session Schedule
| Time (UK) | Session |
|---|---|
| 12:00 – 12:45 | Module 1 – Secure SoC Architecture & System Trust |
| 12:45 – 13:05 | Demo 1 – Hands-on Walkthrough |
| 13:05 – 13:10 | Quiz 1 – Knowledge Check |
| 13:10 – 13:55 | Module 2 – Interconnect Security, Bus Protection & DMA |
| 13:55 – 14:05 | Break |
| 14:05 – 14:50 | Module 3 – Debug Security & Device Lifecycle Management |
| 14:50 – 15:10 | Demo 2 – Hands-on Walkthrough |
| 15:10 – 15:15 | Quiz 2 – Knowledge Check |
| 15:15 – 16:00 | Module 4 – Virtualization, Co-Verification & Platform Isolation |
Module Details
| Module | Hardware Focus | Software Focus |
|---|---|---|
| Module 1 – Secure SoC Architecture & System Trust | SoC trust boundaries, security domains, NoC/fabric security architecture, secure island design, power domain isolation, clock domain crossing security, and hardware lifecycle integration. | Software security policy enforcement across domains, platform-wide security assurance strategy, and integration of hardware security features into the software stack. |
| Module 2 – Interconnect Security, Bus Protection & DMA | AXI/AHB/NoC security attributes (AxPROT, AxSECURE), bus firewall architecture, DMA channel isolation and security descriptors, secure peripheral access control, and verification of firewall policies and DMA permission checks. | Secure communication stacks (TLS 1.3, IPsec, mTLS), certificate management, software-side bus access policies, and cross-domain access control enforcement. |
| Module 3 – Debug Security & Device Lifecycle Management | JTAG authentication module, debug access control (lock-state enforcement), lifecycle state machine (blank → provisioned → locked → RMA transitions), manufacturing security, and formal verification of lifecycle state transitions and debug isolation. | Secure firmware OTA update flows, certificate lifecycle management, software-side provisioning tools, and device management policies across the full device lifecycle. |
| Module 4 – Virtualization, Co-Verification & Platform Isolation | RISC-V H-extension, SMMU/IOMMU for DMA isolation, secure hypervisor hardware support, VM memory isolation enforcement, and hardware/software co-verification (co-simulation of hypervisor + RTL). | Secure hypervisor architecture, VM lifecycle management, software isolation strategies for multi-tenant platforms, and guest OS security considerations. |
| SESSION 6 Monitoring, Data Protection & Future Directions Part 3 – SoC Hardware & Software Security |
Session Schedule
| Time (UK) | Session |
|---|---|
| 12:00 – 12:45 | Module 5 – Runtime Security Monitoring & Tamper Detection |
| 12:45 – 13:05 | Demo 1 – Hands-on Walkthrough |
| 13:05 – 13:10 | Quiz 1 – Knowledge Check |
| 13:10 – 13:55 | Module 6 – Secure Communications, Data Protection & System Validation |
| 13:55 – 14:05 | Break |
| 14:05 – 14:50 | Module 7 – Formal Information Flow Verification & AI-Assisted Verification |
| 14:50 – 15:10 | Demo 2 – Hands-on Walkthrough |
| 15:10 – 15:15 | Quiz 2 – Knowledge Check |
| 15:15 – 16:00 | Module 8 – Security Verification Closure & Future Directions |
Module Details
| Module | Hardware Focus | Software Focus |
|---|---|---|
| Module 5 – Runtime Security Monitoring & Tamper Detection | Hardware security monitors, alert handler architecture (sensor → alert → zeroization pipeline), tamper sensor integration, power/voltage/temperature/clock anomaly detection, active tamper response latency verification, and OpenTitan Alert Handler design. | Software-side security telemetry collection, intrusion detection systems, runtime anomaly detection, security event logging, and incident response workflows. |
| Module 6 – Secure Communications, Data Protection & System Validation | Flash controller security (encrypted storage, read/write protection), OTP controller access policy, hardware-backed data protection, memory encryption at rest, and OpenTitan flash_ctrl/otp_ctrl security property verification. | Secure key-value stores, TLS session management, certificate lifecycle and revocation, mTLS mutual authentication, secure file systems, and encrypted software service layers. |
| Module 7 – Formal Information Flow Verification & AI-Assisted Verification | Information flow security theory (non-interference, taint tracking), formal IFV with JasperGold/VC Formal (iflow assertions: “key =/=> data_o”), simulation IFV with VCS T-Prop, production-scale IFV (10,000+ NCAs, 20,000+ NCPs), and proofs for JTAG, DMA, and bus interconnect isolation. | AI-assisted verification — ML-based coverage gap prediction, LLM-generated SVA and iflow properties from natural language requirements, and automated counterexample triage and regression failure classification. |
| Module 8 – Security Verification Closure & Future Directions | Security verification closure (threat coverage mapping, security coverage metrics, IFV source/destination pair coverage, hierarchical regression strategy, sign-off criteria), post-silicon security validation, and future hardware security challenges (AI accelerator security, weight encryption, confidential computing, chiplets/UCIe, CXL). | Verification sign-off review process, post-quantum cryptography migration planning (CRYSTALS-Dilithium), Zero Trust architecture, open-source hardware security, and AI model authentication and secure inference. |
FAQs
What is Hardware & Software Security Verification Training?
Hardware & Software Security Verification Training is a technical course that teaches engineers how to understand, implement and verify security mechanisms across hardware, firmware, CPU, SoC and software layers.
Who should attend this course?
This course is suitable for hardware verification engineers, SoC designers, CPU verification teams, firmware engineers, embedded software engineers, security engineers and technical managers building security verification capability.
How long is the course?
The course is designed as a 6-session intensive training programme, with each session running for 4 hours and covering four technical modules, practical demos and knowledge checks.
What does the course cover?
The course covers roots of trust, secure boot, cryptography, memory protection, side-channel attacks, CPU privilege, TEEs, SoC interconnect security, lifecycle management, runtime monitoring, formal verification, information-flow verification and security closure.
Does the course include hardware security verification?
Yes. The course includes hardware security verification methodology, security coverage models, SVA, formal verification, UVM testbench architecture and verification of security blocks such as AES, TRNG, Key Manager and debug authentication.
Does the course include software security topics?
Yes. The course includes threat modelling, secure firmware, secure crypto APIs, memory-safe programming, secure coding principles, SAST, DAST, fuzzing, penetration testing methodology, software telemetry and incident response workflows.
Is this course relevant for CPU and SoC teams?
Yes. The course includes CPU privilege architecture, memory protection, secure boot, speculative execution, TEEs, SoC trust boundaries, interconnect security, DMA isolation, debug security and lifecycle management.
Does the course cover RISC-V security?
Yes. The course includes RISC-V privilege levels, PMP/ePMP, RISC-V security extensions, firmware-driven verification, riscv-arch-test integration and RISC-V PMP-based TEE concepts.
Does the course cover formal security verification?
Yes. The course covers formal security verification, SVA, privilege isolation proofs, information-flow verification, non-interference, taint tracking and formal sign-off concepts.
Can Alpinum customise the course for our engineering team?
Yes. Alpinum can adapt the training for hardware verification teams, software teams, firmware teams, SoC groups, CPU projects or internal security assurance programmes.
