Research
19 publications · 6 patents filed
Hardware security of RISC-V microarchitecture: side channels, memory encryption, and formal verification. BibTeX for everything below: research.bib.
Publications
- ARCHER: A Cycle-Accurate RISC-V Emulator for Microarchitectural Side-Channel and Memory-Encryption Research Computers (MDPI), Vol. 15, Issue 8, p. 479, 2026 JCR-Q2 Scopus Q1, ESCI Q2
- PACE: A Page-Adaptive, Cache-Anchored Memory-Encryption Engine for RISC-V with Formally-Verified nth-Order DPA Resistance Chips (MDPI), Vol. 5, Issue 3, p. 25, 2026 Scopus-Q2 Scopus Q2, ESCI
- Novel Microarchitectural Side-Channel Attacks on Open-Source RISC-V Cores Chips (MDPI), Vol. 5, Issue 3, p. 29, 2026 Scopus-Q2 Scopus Q2, ESCI
- A Hardware Security Review of RISC-V Lecture Notes in Networks and Systems (ICT4SD), Vol. 2, pp. 409–422, Springer, 2025 Scopus Scopus
- Cache and Speculative Side-Channel Attacks: A Comprehensive Review Lecture Notes in Networks and Systems (ICT4SD), Vol. 2, pp. 219–233, Springer, 2025 Scopus Scopus
- Memory Security: From Cold Boot Attacks to Side-Channel Defenses Lecture Notes in Networks and Systems (11th ICTIS), Springer, 2026 accepted To appear · LNNS
- Formal Verification of Software-Managed Cache Coherency for RISC-V Heterogeneous Embedded Systems Lecture Notes in Networks and Systems, Vol. 1997, pp. 430–442, Springer, 2026 Scopus Scopus
- RV-JOSH: A Hardened Operating System for RISC-V based on Java Lecture Notes in Networks and Systems (SmartCom), Springer, 2026 accepted To appear · LNNS
- Catching the Set Builder: Hardware Detection of Eviction-Set Construction at the Shared LLC on RISC-V Communications in Computer and Information Science (COCOLE), Springer, 2026 accepted To appear · CCIS
- The Replacement Policy Is a Side Channel: Closing the Reload+Refresh Leak at the Policy Level on RISC-V Communications in Computer and Information Science (COCOLE), Springer, 2026 accepted To appear · CCIS
- The Walk Is the Channel: Page-Table-Walker Cache Partitioning for Deterministic Domain Isolation on Out-of-Order RISC-V ISED 2026 (IEEE), 2026 accepted To appear · IEEE Xplore
- History Is the Channel: Why Index Coloring Cannot Isolate a History-Based Branch Predictor, and a Warm Per-Domain Fix on Open RISC-V RTL ISED 2026 (IEEE), 2026 accepted To appear · IEEE Xplore
- Closing a Spectre-v1 Cache Leak on BOOM with a Per-Domain Guard ISED 2026 (IEEE), 2026 accepted To appear · IEEE Xplore
- No-Op or No Security? A Backward-Compatible, Discoverable, Fail-Closed Contract for Security Directives in the RISC-V HINT Encoding Space ISED 2026 (IEEE), 2026 accepted To appear · IEEE Xplore
Under review
- Near-Miss Retrieval: Contrastive Case Retrieval for Entity Disambiguation in Retrieval-Augmented Generation MIKE 2026 under review
- Surprisal Is a Time Series: Prequential Calibration Auditing of Language Models with Zero-Shot Forecasting Foundation Models MIKE 2026 under review
- Parametric Knowledge Delta: Measuring, Compressing and Retrieving Knowledge Graphs Against a Language Model's Prior MIKE 2026 under review
- Knowledge Certificates: Distribution-Free Guarantees on Which Facts Survive Quantization MIKE 2026 under review
- KRAIT: Kernel Real-Time Attention-Based Intrusion Tracker via Cross-Layer Feature Fusion and In-Kernel Neural Inference with the extended Berkeley Packet Filter Engineering Applications of Artificial Intelligence (Elsevier) under review
Patents
| Application | Title |
|---|---|
| 202631036811 | Hardware Data-Flow Integrity Monitor with Register-File Provenance Tagging for RISC-V IoT Processors |
| 202631036816 | Programmable Instruction Fusion Engine with SRAM-Based Rules Table for RISC-V IoT Processors |
| 202631036812 | Hardware-Accelerated Microarchitectural Event Classifier with Programmable Feature Extraction Pipeline and On-Chip Ensemble Inference Engine for Real-Time Malware Detection in RISC-V Processors |
| 202631036813 | Per-Peripheral Cryptographic Session Engine with Hardware Key Rotation for RISC-V IoT System-on-Chip |
| 202631036815 | RISC-V Processor Architecture with Tiered-Memory ISA Extension, Tier-Aware TLB, and Thunderbolt-Attached External DRAM Expansion with RISC-V Bridge Controller for Linux-Based Heterogeneous Memory Systems |
| 202631036814 | On-Chip Binary Decision Tree Inference Engine Integrated with RISC-V Trace Encoder for Real-Time IoT Security Monitoring |
Current work
- Securing CXL memory fabrics: coherence directory poisoning, protocol-processor boundary attacks, compression side channels, and fabric-amplified Row Hammer
- Security-aware architectural certification testing (SecACT) for RISC-V: PMP bypass via microarchitectural state, vendor extension validation, and the ACT security gap
- Formalizing the Linux kernel shared-page mutation bug class: dirty invariant model, page-cache anti-forensics, zero-copy I/O abuse, and in-place crypto redesign
- Fundamental side channels in LLM serving: SpecLeak, KV cache sharing isolation impossibility, and speculative decoding GPU microarchitectural leakage
- Covert channels beyond cache timing: GPU coherence directory state as a cross-GPU communication primitive