Upgradable Runtime Monitoring for SoC

Instructors 

Dr. Farimah Farahmandi is the Wally Rhines Endowed Professor in Hardware Security in the Department of Electrical and Computer Engineering (ECE) at the University of Florida and Dr. Mark Tehranipoor is the Intel Charles E. Young Preeminence Endowed Chair Professor in Cybersecurity and the Chair of the Department of Electrical and Computer Engineering (ECE) at the University of Florida

Learning Objectives

In this certificate course, students will learn how runtime monitoring can provide continuous and upgradable security protection for modern System-on-Chip (SoC) designs. The course covers security assets, threat models, runtime security policies, distributed Security Status Monitors (SSMs), and eFPGA-based policy enforcement. Students will apply these concepts to AES denial-of-service and information-leakage vulnerabilities and learn how reconfigurable eFPGA resources enable security policies to be updated after deployment. The course also introduces Large Language Model (LLM)-based automation for generating security policies, mapping those policies to Common Weakness Enumeration (CWE) entries, and translating high-level policies into hardware-observable monitoring events that can be implemented using SSM and eFPGA monitoring logic.

The Upgradable Runtime Monitoring of SoC micro-certificate introduces students to the principles, architectures, implementation techniques, and emerging AI-assisted methodologies used to continuously monitor System-on-Chip (SoC) designs for security violations during operation. Modern SoCs integrate processors, accelerators, memories, cryptographic components, peripherals, and third-party IPs into increasingly complex architectures. While conventional design-time verification and fixed security mechanisms can address known vulnerabilities before fabrication, they cannot easily respond to vulnerabilities or adversarial behaviors discovered after deployment. Hardware runtime monitoring addresses this limitation by continuously observing system behavior, enforcing security policies, and identifying violations such as unauthorized access, information leakage, malicious configuration, and denial-of-service conditions during actual operation.

This course emphasizes upgradable runtime monitoring, where security monitoring logic can evolve after fabrication to address newly discovered threats. Students learn how embedded FPGA (eFPGA) resources can provide reconfigurable security enforcement and how lightweight Security Status Monitors (SSMs) can observe security-relevant signals inside individual IP blocks that are not visible at the system bus. The combination of distributed SSMs and reconfigurable eFPGA-based enforcement provides local observability while allowing new policies and detection mechanisms to be deployed through updated eFPGA bitstreams without redesigning the physical SoC.

The micro-certificate is organized into the following four units:

• Unit 1: Fundamentals of Hardware Runtime Monitoring: This unit establishes the theoretical foundation for runtime security monitoring in modern SoCs. Students examine why static, design-time security mechanisms are insufficient against zero-day vulnerabilities and evolving attacks, and learn how security assets, threat models, and security policies form the basis of runtime protection. The unit introduces major policy categories, including access restriction, data/control-flow restriction, HALT/Denial-of-Service, and secure-sequence policies. Students also examine the characteristics required of practical monitoring architectures, including scalability, sustainability, adaptability, observability, and distributability.
  The unit then compares different runtime-monitoring approaches and introduces an eFPGA/SSM-based architecture. Students learn why static synthesizable assertion monitors cannot be updated after fabrication and why purely centralized monitoring can suffer from routing congestion, timing-closure problems, and limited visibility into IP-internal activity. They examine how distributed SSMs provide local observability while a reconfigurable eFPGA performs policy enforcement, enabling security monitoring to evolve throughout the operational lifetime of the SoC.
• Unit 2: Security Policy Definition and Upgradable eFPGA Implementation: This unit translates runtime-monitoring concepts into a practical implementation workflow using an AES cryptographic design containing deliberately introduced security vulnerabilities. Students examine a denial-of-service Trojan that prevents or delays the expected valid_out behavior and an information-leakage Trojan that exposes cipher-key information through the ciphertext output. These examples illustrate attacks against availability and confidentiality, respectively.
  Students define security policies that capture expected AES behavior, implement those policies in RTL, and use simulation and waveform analysis to determine whether violations occur. For the DoS example, the expected behavior requires valid_out to assert after the defined AES processing latency; the tutorial specifically demonstrates a 41-clock-cycle timing requirement.
  The unit then demonstrates how a security-policy implementation can be mapped into an eFPGA fabric. Using OpenFPGA, students work through eFPGA fabric and bitstream generation and learn why reconfigurable logic is valuable for runtime security: security policies can be modified after deployment as new vulnerabilities emerge rather than requiring a silicon redesign.
• Unit 3: LLM-Assisted Automated Security Policy Generation and CWE Mapping: This unit introduces Large Language Models (LLMs) as automation tools for building runtime-monitoring specifications. Students learn how an LLM can combine SoC RTL, threat models, security-asset information, example policies, security-monitoring literature, and the Common Weakness Enumeration (CWE) database to automatically generate structured and implementable runtime security policies. Each policy can be assigned a policy category, associated with an observability mechanism, and mapped to relevant CWE identifiers.
  Students also learn the importance of prompt engineering and design grounding. The LLM examines actual RTL to understand interfaces and observability, while threat models and asset tables constrain the security scope. The generated structured output is parsed into a security-policy database that can feed subsequent runtime-enforcement workflows.
• Unit 4: LLM-Assisted Automated Security Monitoring Event Generation:In this final unit, students extend this automation process by translating high-level security policies into hardware-observable monitoring events. A monitoring event specifies the signal values, patterns, or temporal sequences that indicate a likely policy violation. These events convert natural-language policy intent into implementation-ready conditions that can be realized using comparators, counters, and finite-state machines within SSMs and eFPGA policy checkers.
  Students learn to determine whether an event should be monitored at the system-bus level, inside an IP through an SSM, or in both locations. They also learn how RTL grounding resolves actual signal names and hierarchical paths and how observable proxies can be used when a desired internal signal is unavailable. The completed workflow connects security assets → security policies → monitoring events → runtime enforcement, providing an automated and upgradable approach to SoC security monitoring.

Learning Outcomes:

Upon successful completion of this micro-certificate, participants will be able to:

1. Explain the need for hardware runtime monitoring and distinguish continuous runtime security enforcement from static, design-time verification approaches.
2. Identify security assets, associated threat models, and appropriate runtime security policies for protecting confidentiality, integrity, and availability in SoC designs.
3. Evaluate runtime-monitoring architectures according to scalability, sustainability, adaptability, observability, and distributability requirements.
4. Define and implement security policies for AES DoS and information-leakage vulnerabilities and verify their operation using RTL simulation and waveform analysis.
5. Explain and apply eFPGA-based upgradable security monitoring, including the generation of reconfigurable fabric and security-policy bitstreams. M60 Tutorial.docxDOCX
6. Explain the role of SSMs in providing local observability for security-relevant IP-internal activity that may not be visible at the system bus.
7. Use LLM-based workflows to generate implementable runtime security policies from RTL, threat models, asset information, reference policies, and other security knowledge.
8. Map generated security policies to appropriate CWE identifiers to connect runtime protection requirements to standardized hardware weakness classifications.
9. Translate high-level security policies into signal-level monitoring events that specify violation conditions and temporal behavior.
10. Determine the appropriate implementation scope for monitoring events—system-bus/eFPGA, IP-internal/SSM, or both—and understand how these events form an implementation-ready runtime-monitoring database.

Prerequisites:

• Basic understanding of digital logic, RTL design, and System-on-Chip (SoC) architecture.
• Introductory knowledge of hardware security concepts, including confidentiality, integrity, availability, security assets, and threat models.
• Basic familiarity with Verilog/SystemVerilog and hardware simulation is recommended.
• Basic Python programming is recommended for the LLM-based automation modules.
• Familiarity with FPGA/eFPGA concepts is helpful but not required.
• Prior exposure to security asset identification is particularly helpful for Units 3 and 4 because the automated policy-generation flow uses an asset table produced by an earlier asset-identification process.

Target Audience

Designed for U.S. citizens working in the Department of War, Government, or Government-affiliated employees, industry, as well as college students and faculty. Must register with your organizational email, and will be notified of acceptance within one week of the course start date

Biography

Dr. Farimah Farahmandi is the Wally Rhines Endowed Professor in Hardware Security in the Department of Electrical and Computer Engineering (ECE) at the University of Florida. She also serves as the Associate Director of the Florida Institute for Cybersecurity (FICS) at the University of Florida. Her research focuses on hardware security verification, formal methods, fault-injection attack analysis, and post-silicon validation and debug, resulting in 7 books and over 140 publications in these fields. Dr. Farahmandi’s research has been sponsored by a variety of leading companies and government agencies. For her contributions, she is a recipient of 7 best paper and nomination awards, and was recognized with the ACM/IEEE DAC Under 40 Innovators Award (2024), the Best Assistant Professor Award at the University of Florida (2024), the Excellence in Service Award (2023), and the Excellence in Research Award (2022) from the ECE department at UF. She also received the prestigious Young Faculty Award from SRC (2022) and the NSF CAREER Award.

Mark M. Tehranipoor is currently the Intel Charles E. Young Preeminence Endowed Chair Professor in Cybersecurity and the Chair of the Department of Electrical and Computer Engineering (ECE) at the University of Florida. He is also currently serving as the Director for Florida Institute for Cybersecurity (FICS) Research, Director for Edaptive Computing Inc. Transition Center (ECI-TC), Co-director for the AFOSR/AFRL Center of Excellence on Enabling Cyber Defense in Analog and Mixed Signal Domain (CYAN), and Co-Director for the National Microelectronic Security Training Center (MEST). He also served as the Associate Chair for Research and Strategic Initiatives for the ECE Department from 2017-2019 and the Program Director of Cybersecurity in the Herbert Wertheim College of Engineering from 2019-2022. His current research projects include: hardware security and trust, electronics supply chain security, IoT security, and reliable and testable VLSI design. Dr. Tehranipoor has published numerous journal articles and refereed conference papers and has delivered more than 220+ invited talks and keynote addresses. In addition, he has 15 patents issued, and has published 13 books of which two are textbooks. His projects have been sponsored by 50+ companies and Government agencies.

Dr. Tehranipoor is a Fellow of IEEE, Fellow of ACM, Golden Core Member of IEEE Computer Society, and Member of ACM SIGDA. He is also a member of the Connecticut Academy of Science and Engineering (CASE). He is a recipient of 14 best paper awards and nominations, the 2009 NSF CAREER award, the 2014 AFOSR MURI award on Nanoscale Security, the 2008 IEEE Computer Society (CS) Meritorious Service award, the 2012 and 2017 IEEE CS Outstanding Contribution, the 2010 and 2016 IEEE TTTC/CS Most Successful Technical Event for co-founding and chairing HOST Symposium, the 2018 IEEE HOST Hall of Fame Member, the 2009 and 2014 UConn ECE Research Excellence award, the 2012 UConn SOE Outstanding Faculty Advisor award, the 2016 UF College of Engineering Excellence in Leadership award, the 2016 UF ECE Research Excellence Award, the 2020 UF’s College of Engineering Teacher/Scholar of the year award, and the 2020 UF Innovation of the Year Award.

He serves on the program committee of more than a dozen leading conferences and workshops. Prof. Tehranipoor served as the guest editor for JETTA, IEEE Design and Test of Computers, ACM JETC, and IEEE Computer Society Computing Now. He served as Program Chair of the 2019 International Test Conference (ITC), Vice-program Chair of the 2018 ITC, Program Chair of the 2007 IEEE Defect-Based Testing (DBT) workshop, 2016 IEEE International Verification and Security Workshop (IVSW), Program Chair of the 2008 IEEE Defect and Data Driven Testing (D3T) workshop, Co-program Chair of the 2008 International Symposium on Defect and Fault Tolerance in VLSI Systems (DFTS), General Chair for D3T-2009 and DFTS-2009, and Vice-general Chair for NATW-2011, General Chair for 2008-2009, and 2021 IEEE HOST, and General Chair for 2019-2021 IEEE PAINE Conference.

Over the years, he has led a number of major initiatives in the domain of microelectronics security and trust. He co-founded the IEEE International Symposium on Hardware-Oriented Security and Trust (HOST) and served as HOST-2008 and HOST-2009 General Chair and continue to serve as Chair of the Steering Committee for HOST. He also co-founded IEEE Asian-HOST and the IEEE International Conference of Physical Assurance and Inspection of Electronics (PAINE). Further, he co-founded the Journal on Hardware and Systems Security (HaSS) and currently serving as EIC for HaSS. He is also led development of Trust-Hub sponsored by the National Science Foundation (NSF). He served as associate Editor-in-Chief (EIC) for IEEE Design and Test of Computers from 2012-2014. He is currently serving as an Associate Editor for IEEE Design and Test of Computers, JETTA, Journal of Low Power Electronics (JOLPE), ACM Transactions for Design Automation of Electronic Systems (TODAES), IEEE Transactions on Computers, and IEEE Transactions on VLSI (TVLSI). He has served as an IEEE Distinguished Speaker and an ACM Distinguished Speaker from 2010-2013. Further, he served as an ambassador of cybersecurity for IEEE from 2016-2020.

Prior to joining University of Florida, Dr. Tehranipoor served as the founding director of the Center for Hardware Assurance, Security, and Engineering (CHASE) and the Comcast Center of Excellence in Security Innovation (CSI) at the University of Connecticut.