Sitemap
A list of all the posts and pages found on the site. For you robots out there, there is an XML version available for digesting as well.
Pages
Posts
portfolio
Portfolio item number 1
Short description of portfolio item number 1
Portfolio item number 2
Short description of portfolio item number 2
publications
An Isolation Framework for Security Services on TrustZone
Under review at the 63rd Annual Design Automation Conference (DAC'26), 2025
Arm TrustZone is the most widely used Trusted Execution Environment (TEE) in mobile and embedded devices, but vulnerabilities in the TrustZone can lead to complete system compromise. This paper presents an isolation framework that secures TrustZone even if the Trusted OS is compromised. We repurposes hardware watchpoints to monitor page table modifications by the Trusted OS and carves out protected memory regions for security services. We also introduce targeted optimizations to minimize performance overhead. We implement the prototype on a Raspberry Pi 3B+, and the evaluation shows that prototype maintains protection with modest performance impact (-3.2%–2.87%). Our case study of two security services shows that the prototype provides a practical and secure foundation despite Trusted OS vulnerabilities.
Decoupling Confidential VMs from the Hypervisor via Secure Domain Resource Management
Under review at 47th IEEE Symposium on Security and Privacy (S&P'26), 2025
The Confidential Virtual Machine (CVM) provides an isolation framework that enables cloud tenants to securely access cloud services, even when the hypervisor is untrusted or potentially compromised. However, the hypervisor can introduce attack primitives such as interrupt injection or abuse of address-space identifiers (ASID), since runtime resources remain under its control.
Building Confidential Accelerator Computing Environment for Arm CCA
To Appear In IEEE Transactions on Dependable and Secure Computing (TDSC'25), 2025., 2025
Confidential computing is an emerging technique that provides users and third-party developers with an isolated and transparent execution environment. To support this technique, Arm introduced the Confidential Computing Architecture (CCA), which creates multiple isolated regions, known as realms, to ensure data confidentiality and integrity in security-sensitive tasks. However, hardware and firmware supporting confidential accelerator workloads remain unavailable. Moreover, due to incompatible hardware or large trusted computing base (TCB) size, existing studies for protecting acceleration are unsuitable for CCA’s realm-style architecture. Thus, there is a need to complement existing Arm CCA capabilities with accelerator support. We present CAGE to support confidential accelerator computing for Arm CCA, ensuring data security with CCA’s existing security features. To adapt the accelerator workflow to CCA’s realm-style architecture, CAGE proposes a novel shadow task mechanism to manage confidential accelerator applications flexibly. Additionally, CAGE leverages the memory isolation mechanism in Arm CCA to protect data confidentiality and integrity from the strong adversary. CAGE also optimizes security operations in memory isolation to mitigate performance overhead. Without hardware changes, we design and implement CAGE on two types of accelerators: Unified-memory GPU and generic FPGA. Our evaluation shows that CAGE effectively provides confidential accelerator support for Arm CCA with moderate overhead.
talks
Talk 1 on Relevant Topic in Your Field
Published:
This is a description of your talk, which is a markdown file that can be all markdown-ified like any other post. Yay markdown!
Conference Proceeding talk 3 on Relevant Topic in Your Field
Published:
This is a description of your conference proceedings talk, note the different field in type. You can put anything in this field.
teaching
CS315 Computer Security
Undergraduate course, SUSTech, Computer Science and Engineering, 2023
This course aims help students to learn the principles of computer security and understand how various security attacks and countermeasures work. It provides hands-on experience in playing with security software and network systems in a live laboratory environment, with the purpose of understating real-world threats. The course will take both offensive and defense methods to help student explore security tools and attacks in practice. It will focus on attacks (e.g., buffer overflow, dirty COW, format-string, XSS, and return oriented programming), hacking fundamentals (e.g., scanning and reconnaissance), defenses (e.g., intrusion detection systems and firewalls). Students are expected to finish intensive lab assignments that use real-world malware, exploits, and defenses.