Security Architectures for Resource-Constrained Embedded Systems:
- Control-flow Integrity: Designing an active root-of-trust architecture, unlike TinyCFA above, that actively prevents control-flow attacks by enforcing fine-grained control-flow integrity on MSP430.
- Verified Attestation on seL4: Designing and formally verifying a static remote attestation architecture on seL4, a formally verified microkernel, to be deployed on ARM Cortex-A microcontrollers, e.g., SabreLite platforms.
- Attestation on ARM Platforms: Designing remote attestation architectures on off-the-shelf ARM Cortex-M microcontrollers using Memory Protection Unit and/or TrustZone as the sole hardware support.
- [past] Secure Updates: Designed and formally verified an active root-of-trust architecture, CASU [ICCAD’22], that obviates the need for attestation, by only allowing secure authorized updates to modify the software, on MSP430.
- [past] Sensor Data Privacy: Designed and formally verified a privacy architecture, PfB [S&P’22], that prevents sensitive data leakage on MPS430 using hardware-enforced access control, implemented with 13% additional hardware.
- [past] Runtime Integrity Attestation: Proposed two architectures, TinyCFA [DATE’21] and DAILED [DAC’21], to detect control-flow and data-only attacks (e.g. ROP, JOP attacks) with less than 50% runtime overhead.
- [past] Remote Attestation: Designed and formally verified a remote attestation architecture, RATA [CCS’21], that can detect transient malware on MSP430 with O(1) time complexity and only 5% hardware overhead.
Privacy-Preserving Computation:
- Secure Face Authentication: Designed a privacy-preserving biometric (face) authentication scheme that does not require users to store keys; observed 98.4% accuracy on the LFW face dataset with 91 bits of security.
- Private Signaling: Designing and implementing an efficient anonymous messaging system based on blockchain/bulletin board using PathORAM and TEE (Intel SGX).
- Multiparty Time-lock Puzzles: Designed two MPC protocols to construct distributed time-lock puzzles where the outputs of the computation are locked and revealed to the parties only after a predetermined period of time.
- [past] Privacy-preserving Ads Measurement: Designed and implemented two privacy-preserving protocols, based on MPC and TEE (AWS Nitro Enclaves), to measure the effectiveness of ads displayed on Meta platforms.
- [past] Verifiable Structure Enforcing Graphs: Proposed a verifiable distributed graph construction protocol that builds and maintains a graph with good edge expansion even in presence of adaptive adversaries decomposing it.
- [past] Oblivious Dropbox: Designed a distributed oblivious storage platform using proactive MPC techniques secure against both semi-honest and malicious adversaries; average read/write time for 104 rows and 3 servers is < 4s.