Selected work

Systems and security projects across architecture, kernels, speculative execution, and embedded systems.

A cross-section of research and engineering projects from EPFL and beyond, from secure application compartmentalization to speculative side channels and hardware and software systems work.

SecureCells illustration
2022 - 2024 Architecture RISC-V

SecureCells

SecureCells is a novel mechanism supporting application compartmentalization. It presents a virtual memory architecture with native support for compartments, where each processor core can track and enforce isolation between compartments within an application.

For SecureCells, we worked on defining the right architectural model for compartments and implemented the design on a RISC-V RocketChip FPGA. We also ported the seL4 operating system and built example applications for the architecture.

Paper Website
2021 - 2022 Linux Kernel Systems Security

Midas

Midas fundamentally mitigates a common class of data-race bugs in the Linux kernel. It leverages existing kernel interfaces for accessing userspace data, together with features ubiquitous in off-the-shelf processors, to build a multiversioning system for user data.

That approach prevents userspace from modifying data while the kernel is accessing it, thereby eliminating a broad class of Time-of-Check-to-Time-of-Use bugs. It also makes it possible for wrappers such as SecComp to validate system call arguments passed by reference.

Paper Website
Midas graphic
SpecROP graphic
2020 Speculation Binary Analysis

SpecROP

SpecROP goes deeper into speculative execution attacks by showing how chained speculative gadgets can supercharge them. The core idea is to exploit the CPU's existing prediction structures to chain together multiple gadgets, allowing more expressive computation during the speculation window.

The project demonstrated the first attack able to leak part of an AES key during encryption, opening up previously impossible leakage scenarios for speculative execution attacks.

Paper Code
2019 Microarchitecture Side Channels

SMoTherSpectre

My first EPFL project focused on characterizing and exploiting port contention as a side channel. The work showed how speculative execution and port contention can be combined to leak information across protection boundaries.

We built proof-of-concept attacks that could leak an SSH server's private key and plaintext bits during AES encryption using OpenSSL, turning a low-level microarchitectural effect into a practical exploit path.

Paper Blog Post Code
SMoTherSpectre graphic
DE1-SoC board
2016 - 2018 Embedded Systems Audio Streaming

Realtime Embedded Systems

For the final project in the Realtime Embedded Systems course, I partnered with Antoine Albertelli to build an audio streaming system. The setup takes analog sound input, converts it to digital values, compresses the audio, and broadcasts it over the internet.

We used a DE1 board with a dual-core ARM Cortex-A9 and FPGA logic, implementing a NIOS soft core for audio capture while the server ran on the hard ARM processor.

Report
2016 - 2018 Embedded Systems FPGA SoC

Embedded Systems

In the Embedded Systems course, again with Antoine Albertelli, we designed and implemented a system on a DE0-nano FPGA SoC that acquires images from a TRDM-D5M camera module and sends them to an LT24 LCD for display.

The frames are stored in external RAM and moved between the camera and screen without CPU intervention using DMA, giving the project a strong hardware and systems flavor.

Report
Camera and screen setup