Apply now
Postgraduate DiplomaElectronics, Embedded Systems & Telecom Applications open

Diploma in TrustZone/TPM and Secure Boot Chain

Online postgraduate diploma of 800 hours in TrustZone/TPM and secure boot chain. 8 modules covering hardware roots of trust, Arm TrustZone, trusted execution environments, TPM 2.0, secure boot, remote attestation and secure provisioning with ISO/IEC 11889 (TPM 2.0), GlobalPlatform TEE and Arm PSA Certified, with an assigned technical tutor.

Duration800 hours · 6–8 months
ModeOnline
LanguageEnglish
Start datesSet by the faculty
AwardSEIUM Institute diploma
Enrol now View syllabus Ask an advisor
Virtual lab · try it before you enrol

Take the controls.

Run a real engineering trade-off from this field. Move the sliders, watch the model react in real time and beat the challenge.

SIM · LIVE ●
Learning outcomes

What you will be able to do

01

Identify hardware roots of trust and their threat models.

02

Configure world separation with Arm TrustZone.

03

Develop trusted applications in TEE environments.

04

Use TPM 2.0 for measurement, sealing and secure storage.

05

Implement a secure boot chain with Trusted Firmware-A.

06

Deploy remote attestation across device fleets.

07

Manage secure provisioning throughout the life cycle.

Profile

Who it's for

  • Platform security engineers in semiconductors and IoT.
  • Secure firmware engineers working on bootloaders and TF-A.
  • Embedded security architects defining roots of trust.
  • TEE engineers developing Trusted Applications.
  • Hardware security engineers assessing physical threats.
  • Security certification consultants working with PSA Certified, Common Criteria or IEC 62443.
  • Engineering or science graduates looking to enter the semiconductor sector.
Standards & tools

What you'll work with

  • ISO/IEC 11889:2015 (TPM 2.0) (Trusted Platform Module library)
  • GlobalPlatform TEE System Architecture (trusted execution environment architecture)
  • Arm PSA Certified (Platform Security Architecture certification)
  • TCG PC Client Platform Firmware Profile (measured boot and event log)
  • ISO/IEC 15408 (Common Criteria) (IT security evaluation)
  • NIST SP 800-193 (platform firmware resiliency)
  • IETF RFC 9334 (Remote ATtestation procedureS architecture)
  • IEC 62443-4-2:2019 (security requirements for IACS components)
  • Trusted Firmware-A
  • OP-TEE
  • Trusted Firmware-M
  • tpm2-tools
  • Keylime
Syllabus

8 modules

  1. 1.1Root of Trust for measurement, storage and reporting
  2. 1.2Immutable boot ROM
  3. 1.3eFuses and device keys
  4. 1.4Secure elements and secure enclaves
  5. 1.5PUF and key derivation
  6. 1.6Arm PSA architecture
  7. 1.7Physical threat models
  8. 1.8PSA Certified and Common Criteria certification
  9. 1.9Comparison between TPM, SE and TEE
  10. 1.10Case study: root of trust for a gateway
  1. 2.1Secure and normal worlds
  2. 2.2Exception levels EL0 to EL3
  3. 2.3Secure Monitor and world switching
  4. 2.4TZASC, TZPC and memory partitioning
  5. 2.5Secure interrupts and the GIC
  6. 2.6TrustZone for Armv8-M
  7. 2.7SAU and IDAU in microcontrollers
  8. 2.8Non-secure calls to secure functions
  9. 2.9Limitations and known attacks
  10. 2.10Lab: TrustZone application on a Cortex-M33
  1. 3.1GlobalPlatform TEE and its APIs
  2. 3.2OP-TEE: architecture and Trusted Applications
  3. 3.3Communication between client and TA
  4. 3.4Secure storage in the TEE
  5. 3.5Trusted Firmware-M and PSA services
  6. 3.6Key management in the TEE
  7. 3.7Updating Trusted Applications
  8. 3.8Isolation and attack surface
  9. 3.9Debugging in the secure world
  10. 3.10Practical exercise: Trusted Application in OP-TEE
  1. 4.1Internal architecture of TPM 2.0
  2. 4.2Hierarchies and primary keys
  3. 4.3PCR registers and measurement extension
  4. 4.4Sealing secrets to PCRs
  5. 4.5NV indices and counters
  6. 4.6Sessions and policy-based authorisation
  7. 4.7Discrete, firmware and fTPM
  8. 4.8tpm2-tools and the TSS stack
  9. 4.9TPM integration in Linux
  10. 4.10Lab: sealing a disk key to PCRs
  1. 5.1BL1, BL2, BL31, BL32 and BL33 stages
  2. 5.2Trusted Firmware-A and Trusted Board Boot
  3. 5.3Certificate chain and chain of trust
  4. 5.4Measured boot versus verified boot
  5. 5.5TCG event log
  6. 5.6U-Boot and UEFI integration
  7. 5.7Passing measurements to the operating system
  8. 5.8Recovery from a corrupted image
  9. 5.9Impact of verification on boot time
  10. 5.10Workshop: Trusted Board Boot with TF-A on QEMU
  1. 6.1RATS architecture according to IETF RFC 9334
  2. 6.2TPM quotes and verification
  3. 6.3Reference policies and expected values
  4. 6.4Keylime for continuous attestation
  5. 6.5PSA attestation with EAT tokens
  6. 6.6Privacy and attestation keys
  7. 6.7Integration with provisioning
  8. 6.8Revocation of compromised devices
  9. 6.9Scaling to device fleets
  10. 6.10Practical exercise: remote attestation with Keylime
  1. 7.1Key injection in the factory
  2. 7.2Personalisation and life-cycle states
  3. 7.3Debug and JTAG lockdown
  4. 7.4Device ownership transfer
  5. 7.5Certificate management in the field
  6. 7.6Decommissioning and end of life
  7. 7.7Supply chain auditing
  8. 7.8Assessment according to IEC 62443-4-2
  9. 7.9Documentation for certification
  10. 7.10Case study: provisioning a batch of devices
  1. 8.1Platform threat analysis
  2. 8.2Root of trust selection
  3. 8.3TrustZone and TEE configuration
  4. 8.4Boot chain with TF-A
  5. 8.5TPM integration and measured boot
  6. 8.6Remote device attestation
  7. 8.7Security assessment
  8. 8.8Provisioning plan
  9. 8.9Report and presentation
  10. 8.10Final project: final review with the tutor
Methodology, software & labs

How you'll learn

100% online training on the SEIUM campus, with downloadable material, recorded classes and an assigned technical tutor. No fixed timetables: you progress at your own pace within the intake, so it can be combined with work.

Each module combines theory, guided reading of the original standard and applied exercises. The working software is Trusted Firmware-A, OP-TEE, Trusted Firmware-M, tpm2-tools and Keylime, in free, academic or evaluation versions. Testing is studied on real procedures: measured boot with a TPM on Arm boards, remote device attestation and development of trusted applications in OP-TEE. Assessment is continuous by module plus the final project.

Standards covered: ISO/IEC 11889:2015 (TPM 2.0), GlobalPlatform TEE System Architecture, Arm PSA Certified, TCG PC Client Platform Firmware Profile, ISO/IEC 15408 (Common Criteria), NIST SP 800-193, IETF RFC 9334, IEC 62443-4-2:2019.

Assigned technical tutor:every module ends with a deliverable that your tutor marks individually.
Standards-based learning:guided reading of ISO/IEC 11889:2015 (TPM 2.0), GlobalPlatform TEE System Architecture and Arm PSA Certified applied to real cases, not as a theoretical annex.
Industry software:Trusted Firmware-A, OP-TEE, Trusted Firmware-M, tpm2-tools and Keylime, in free, academic or evaluation versions.
Final project:a complete secure boot platform with root of trust, TrustZone and TEE configuration, TF-A boot chain, measured boot and remote attestation, reviewed by your tutor.
Flexible format:100% online, no fixed timetables, compatible with full-time work.
Capstone project

Build it end to end

Your final project follows the real engineering workflow, step by step, reviewed by your tutor.

Analyse threats
Run the platform threat analysis and select the root of trust.
Configure TrustZone and TEE
Set up world separation and a Trusted Application in OP-TEE.
Build the boot chain
Implement Trusted Board Boot with TF-A and measured boot with the TPM.
Attest the device
Deploy remote attestation with Keylime and assess platform security.
Final project
A complete secure boot platform, from threat analysis to provisioning plan, reviewed by your tutor.
Career opportunities

Where this takes you

Platform security engineerSecure firmware engineerEmbedded security architectTEE engineerHardware security engineerSecurity certification consultant
Admissions & scholarships

Requirements

  • Prior technical training or professional experience in the sector. No university degree is required.
  • Internet connection and a computer able to run the programme software.
  • English sufficient to read technical standards.

Ready to start?

Send your application today. Our admissions team replies within 72 hours with your study plan and funding options.

Apply now Scholarships
FAQ

Frequently asked questions

The programme totals 800 hours over 6–8 months. You set your own pace within each intake, and your tutor helps you plan the workload around your job.

You work with Trusted Firmware-A, OP-TEE, Trusted Firmware-M, tpm2-tools and Keylime, using free, academic or evaluation versions. Your tutor indicates the free alternative wherever one exists.

A SEIUM Institute diploma, awarded on passing the continuous assessment and the final project. It is SEIUM's own qualification, not an official state degree; its recognition depends on the programme completed and the regulations of each country.

Yes. Modules passed are recognised in a higher programme in the same area (postgraduate diploma or master's). Ask about the recognition policy when you enrol.

Prior technical training or professional experience in the sector (no university degree required), a computer able to run the software and English sufficient to read technical standards.

Start dates are set by SEIUM's faculty for each intake. Our admissions team will confirm the next available date when you apply.

Keep exploring

Related programmes

See all in Electronics, Embedded Systems & Telecom
Postgraduate Diploma2,000 $

Postgraduate Diploma in Edge/VEC and Cooperative Perception

Online 800 h Postgraduate Diploma in Edge/VEC and Cooperative Perception. 8 modules with ETSI TS 103 324, SAE J3224 and CARLA. Assigned tutor and enrolment open.

800 hOnlineElectronics, Embedded Systems & Telecom
Postgraduate Diploma1,440 $

Postgraduate Diploma in PdM Integration with CMMS/EAM

Online 800-hour Postgraduate Diploma in PdM integration with CMMS/EAM. 8 modules covering ISO 13374-1, ISO 14224 and IBM Maximo Application Suite. Assigned tutor and enrolment open.

800 hOnlineElectronics, Embedded Systems & Telecom
Postgraduate Diploma1,220 $

Diploma in Safety Islands and Real-Time Monitoring

Online postgraduate diploma of 800 hours in safety islands and real-time monitoring. 8 modules covering SoC functional safety architectures, hardware fault analysis, hardware detection mechanisms, real-time…

800 hours · 6–8 monthsOnlineElectronics, Embedded Systems & Telecom
Diploma in TrustZone/TPM and Secure Boot ChainEnrol
Related programmes

More in Electronics, Embedded Systems & Telecom

Diploma in Safety of Drives (SIL/PL) and STO/SS1View programme →Postgraduate Diploma in PdM Deployment and ROI in the FactoryView programme →Diploma in Materials, Losses and BH CurvesView programme →Diploma in Prototyping, Validation and ReliabilityView programme →Diploma in RF/IF Front-Ends for High-SpeedView programme →Postgraduate Diploma in Design for Compliance and Pre-testsView programme →

All Electronics, Embedded Systems & Telecom programmes → · How to apply · Fees & financing · Scholarships

Scroll to Top
SEIUM – Institute of Advanced Engineering
Powered by  GDPR Cookie Compliance
Privacy Overview

This website uses cookies so that we can provide you with the best user experience possible. Cookie information is stored in your browser and performs functions such as recognising you when you return to our website and helping our team to understand which sections of the website you find most interesting and useful.