Research

Attack-tolerant trusted execution environments

PDF — 2021

This is my Master's thesis, completed at Aalto University and KTH Royal Institute of Technology in the Spring semester of 2021. I worked in the Secure Systems Group at Aalto University, together with an amazing group of other researchers. My thesis explores the effects of confidentiality compromise of trusted execution environments (think about Intel SGX and Arm TrustZone) and how to still perform remote attestation while guaranteeing integrity protection. Start by reading the abstract below.

In recent years, trusted execution environments (TEEs) have seen increasing deployment in computing devices to protect security-critical software from run-time attacks and provide isolation from an untrustworthy operating system (OS). A trusted party verifies the software that runs in a TEE using remote attestation procedures. However, the publication of transient execution attacks such as Spectre and Meltdown revealed fundamental weaknesses in many TEE architectures, including Intel SGX and Arm TrustZone. These attacks can extract cryptographic secrets, thereby compromising the integrity of the remote attestation procedure. In this work, we design and develop a TEE architecture that provides remote attestation integrity protection even when confidentiality of the TEE is compromised. We use the formally verified seL4 microkernel to build the TEE, which ensures strong isolation and integrity. We offload cryptographic operations to a secure co-processor that does not share any vulnerable microarchitectural hardware units with the main processor, to protect against transient execution attacks. Our design guarantees integrity of the remote attestation procedure. It can be extended to leverage co-processors from Google and Apple, for wide-scale deployment on mobile devices.

Multi-core flow classification methods for load balancing

PDF — 2021

This document is the product of a semester-long group project with the Network Systems lab at KTH, Stockholm. We implemented flow tables that scale to multiple cores, and thoroughly evaluated their performance. The report provides the results as a detailed comparison.

I worked with the FastClick framework for composing network functions, and used the Data Plane Development Kit (DPDK) underneath for packet processing in user space. Traffic generation was built using TRex.

Adoptability of secure BGP routing proposals

PDF — 2021

This article stems from a research seminar on the insecurity of BGP routing and the proposed solutions to secure the infrastructure. The current internet's routing system is unauthenticated, which has lead to large BGP hijacking, interception, and AS path forgery attacks. I investigated the different approaches to securing BGP routing, and tried to identify concrete metrics to predict their adoptability. This area is a fascinating intersection of technology and distributed policy, by the unique nature of the internet.

Protocols for issuing and managing digital certificates

PDF — 2020

Digital certificates have become an essential part of secure communication. Besides the internet, certificates are used in industrial and Internet of Things settings. The increase in usage of certificates calls for effective ways to manage them. This paper overviews three standardized certificate management protocols and discusses the extent of their deployment and use. In addition, the paper addresses extensions to these protocols and their role in the Internet of Things.

An analysis of the YouTube CDN

PDF — 2019

This report is a research into the video distribution and caching strategies employed by YouTube. We collect data from multiple continents for a multitude of videos. Our analyses find geolocations of cache servers used by YouTube, measure their performance and interpret the cache host names. Our data did not support any clear strategy based on time of the week or region, with the exception of the case for uploading a video, in which the region of upload had a clear advantage for the first hour after publishing compared to other regions. We conclude by formulating our expectation that the distribution and caching in YouTube’s infrastructure is currently largely governed by machine learning models and therefore our research could not find a clearly discernible strategy

This research was conducted together with Jack Henschel.

Investigations into adaptive streaming and live streaming performance

This work was again written together with Jack Henschel, and consists of two separate papers.

Adaptive streaming

PDF — 2019

In this report we investigate the behaviour of Adaptive Bitrate Streaming with the DASH protocol under different network conditions with regard to video quality and fairness between clients. We found that the adaption to static and changing network conditions works quite well to always provide clients with the highest possible video quality while minimizing buffering delays.

Live streaming latency

PDF — 2019

In this report we set up a live streaming server using a combination of stateless and stateful protocols, based on which we evaluate the performance of these different protocols with regards to latency. As expected, we find that a stateful protocol like RTMP has the lowest latency while suffering from scalability limitations. Stateless protocols, such as HLS and DASH, exhibit a higher latency but are easier to scale, e.g. by using a CDN which we also analyzed. Specific fine-tuning of the streaming parameters for the stateless protocols is found to bring down their end-to-end-latency.