Yinqian Zhang's Homepage

[Security'23] Reusable Enclaves for Confidential Serverless Computing

Yinqian Zhang

USENIX Security Symposium

[Security'23] Panda: Security Analysis of Algorand Smart Contracts

Yinqian Zhang

USENIX Security Symposium

[Security'23] Controlled Data Races in Enclaves: Attacks and Detection

Yinqian Zhang

USENIX Security Symposium

[Security'23] CipherH: Automated Detection of Ciphertext Side-channel Vulnerabilities in Cryptographic Implementations

Yinqian Zhang

USENIX Security Symposium

[ISCA'23] TEESec: Pre-Silicon Vulnerability Discovery for Trusted Execution Environments

Yinqian Zhang

International Symposium on Computer Architecture

[DIMVA'23] PWRLEAK: Exploiting Power Reporting Interface for Side-channel Attacks on AMD SEV

Yinqian Zhang

Conference on Detection of Intrusions and Malware & Vulnerability Assessment

[TCAD] SPECWANDS: An Efficient Priority-based Scheduler Against Speculation Contention Attacks

Yinqian Zhang

IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems

[TDSC] VERITRAIN: Validating MLaaS Training Efforts via Anomaly Detection

Yinqian Zhang

Transactions on Dependable and Secure Computing

[TCC] SvTPM: SGX-based Virtual Trusted Platform Modules for Cloud Computing

Yinqian Zhang

Transactions on Cloud Computing

2022

[CCS'22] Narrator: Secure and Practical State Continuity for Trusted Execution in the Cloud

Yinqian Zhang

ACM Conference on Computer and Communications Security

[CCS'22] ENGRAFT: Enclave-guarded Raft on Byzantine Faulty Nodes

Yinqian Zhang

ACM Conference on Computer and Communications Security

[CCS'22] CETIS: Retrofitting Intel CET for Generic and Efficient Intra-process Memory Isolation

Yinqian Zhang

ACM Conference on Computer and Communications Security

Best Paper Award Honorable Mention

[S&P'22] A Systematic Look at Ciphertext Side Channels on AMD SEV-SNP

Yinqian Zhang

IEEE Symposium on Security and Privacy

Top 10 Finalists of CSAW Best Applied Research Paper Award

[S&P'22] vSGX: Virtualizing SGX Enclaves on AMD SEV

Yinqian Zhang

IEEE Symposium on Security and Privacy

[Source Code]

[NDSS'22] Multi-Certificate Attacks against Proof-of-Elapsed-Time And Their Countermeasures

Yinqian Zhang

Network and Distributed System Security Symposium

[Security'22] MAGE: Mutual Attestation for a Group of Enclaves without Trusted Third Parties

Yinqian Zhang

USENIX Security Symposium

[Source Code]

[SEED'22] ENCLYZER: Automated Analysis of Transient Data Leaks on Intel SGX

Yinqian Zhang

IEEE International Symposium on Secure and Private Execution Environment Design

[book] Cloud Computing Security: Foundations and Research Directions

Yinqian Zhang

Foundations and Trends® in Privacy and Security: Vol. 3: No. 2

[CC'22] Cape: Compiler-Aided Program Transformation for HTM-Based Cache Side-Channel Defense

Yinqian Zhang

ACM International Conference on Compiler Construction

[CAL] A Pre-Silicon Approach to Discovering Microarchitectural Vulnerabilities in Security Critical Applications

Yinqian Zhang

IEEE Computer Architecture Letters

Best of CAL Award

[TDSC] Crystal: Enhancing Blockchain Mining Transparency with Quorum Certificate

Yinqian Zhang

Transactions on Dependable and Secure Computing

[TDSC] Securing TEEs with Verifiable Execution Contracts

Yinqian Zhang

Transactions on Dependable and Secure Computing

[TDSC] Dancing with Wolves: An Intra-process Isolation Technique with Privileged Hardware

Yinqian Zhang

Transactions on Dependable and Secure Computing

[TDSC] SPECBOX: A Label-Based Transparent Speculation Scheme Against Transient Execution Attacks

Yinqian Zhang

Transactions on Dependable and Secure Computing

[IJIS] Defeating Traffic Analysis via Differential Privacy: A Case Study on Streaming Traffic

Yinqian Zhang

International Journal of Information Security

2021

[ACSAC'21] TLB Poisoning Attacks on AMD Secure Encrypted Virtualization

Yinqian Zhang

Annual Computer Security Applications Conference

[Security'21] Towards Formal Verification of State Continuity for Enclave Programs

Yinqian Zhang

USENIX Security Symposium

[Security'21] CIPHERLEAKS: Breaking Constant-time Cryptography on AMD SEV via the Ciphertext Side Channel

Yinqian Zhang

USENIX Security Symposium

[Project Homepage]

[Security'21] SelectiveTaint: Efficient Data Flow Tracking With Static Binary Rewriting

Yinqian Zhang

USENIX Security Symposium

[Source Code]

[ISCA'21] INTROSPECTRE: A Pre-Silicon Framework for Discovery and Analysis of Transient ExecutionVulnerabilities

Yinqian Zhang

International Symposium on Computer Architecture

[CCS'21] CROSSLINE: Breaking "Security-by-Crash" based Memory Isolation in AMD SEV

Yinqian Zhang

ACM Conference on Computer and Communications Security

Best Paper Award Runner-up

[DIMVA'21] SPECULARIZER: Detecting Speculative Execution Attacks via Performance Tracing

Yinqian Zhang

Conference on Detection of Intrusions and Malware & Vulnerability Assessment

[AsiaCCS'21] See through Walls: Detecting Malware in SGX Enclaves with SGX-Bouncer

Yinqian Zhang

ACM ASIA Conference on Information, Computer and Communications Security

[TDSC] Making Information Hiding Effective Again

Yinqian Zhang

Transactions on Dependable and Secure Computing

[CSUR] A Survey of Microarchitectural Side-channel Vulnerabilities, Attacks and Defenses in Cryptography

Yinqian Zhang

ACM Computer Surveys

2020

[CCS'20] FirmXRay: Detecting Bluetooth Link Layer Vulnerabilities From Bare-Metal Firmware

Yinqian Zhang

ACM Conference on Computer and Communications Security

[Security'20] TXSPECTOR: Uncovering Attacks in Ethereum from Transactions

Yinqian Zhang

USENIX Security Symposium

[S&P'20] SEIMI: Efficient and Secure SMAP-Enabled Intra-process Memory Isolation

Yinqian Zhang

IEEE Symposium on Security and Privacy

[NDSS'20] SPEECHMINER: A Framework for Investigating and Measuring Speculative Execution Vulnerabilities

Yinqian Zhang

Network and Distributed System Security Symposium

[IEEE Secur & Priv] SgxPectre: Stealing Intel Secrets From SGX Enclaves via Speculative Execution

Yinqian Zhang

IEEE Secur. Priv.

2019

[DSC'19] Defeating Speculative-Execution Attacks on SGX with HyperRace

Yinqian Zhang

IEEE Conference on Dependable and Secure Computing

[CCS'19] OPERA: Open Remote Attestation for Intel’s Secure Enclaves

Yinqian Zhang

ACM Conference on Computer and Communications Security

[CCS'19] Automatic Fingerprinting of Vulnerable BLE IoT Devices with Static UUIDs from Mobile Apps

Yinqian Zhang

ACM Conference on Computer and Communications Security

[PACT'19] SpecShield: Shielding Speculative Data from Microarchitectural Covert Channels

Yinqian Zhang

International Conference on Parallel Architectures and Compilation Techniques

[RAID'19] Time and Order: Towards Automatically Identifying Side-Channel Vulnerabilities in Enclave Binaries

Yinqian Zhang

International Symposium on Research in Attacks, Intrusions and Defenses

[Security'19] Exploiting Unprotected I/O Operations in AMD’s Secure Encrypted Virtualization

Yinqian Zhang

USENIX Security Symposium

[Presentation]

[Security'19] SafeHidden: An Efficient and Secure Information Hiding Technique Using Re-randomization

Yinqian Zhang

USENIX Security Symposium

[CAL] Isolating Speculative Data to Prevent Transient Execution Attacks

Yinqian Zhang

IEEE Computer Architecture Letters (CAL)

[AsiaCCS'19] Running Language Interpreters Inside SGX: A Lightweight Legacy-Compatible Script Code Hardening Approach

Yinqian Zhang

(Short Paper)

ACM ASIA Conference on Information, Computer and Communications Security

[DSN'19] Your IoTs Are (Not) Mine: On the Remote Binding Between IoT Devices and Users

Yinqian Zhang

IEEE/IFIP International Conference on Dependable Systems and Networks

[EuroS&P'19] SGXPECTRE: Stealing Intel Secrets from SGX Enclaves via Speculative Execution

Yinqian Zhang

(The EuroS&P version of this paper supersedes an earlier Arxiv version "SgxPectre Attacks: Leaking Enclave Secrets via Speculative Execution")

Arxiv pre-print version

[Project Homepage]

[NDSS'19] Statistical Privacy for Streaming Traffic

Yinqian Zhang

Network and Distributed System Security Symposium

[NDSS'19] OBFUSCURO: A Commodity Obfuscation Engine on Intel SGX

Yinqian Zhang

Network and Distributed System Security Symposium

[S&P'19] Why Does Your Data Leak? Uncovering the Data Leakage in Cloud From Mobile Apps

Yinqian Zhang

IEEE Symposium on Security and Privacy

2018

[ACSAC'18] Analyzing Cache Side Channels Using Deep Neural Networks

Yinqian Zhang

Annual Computer Security Applications Conference

[ACSAC'18] A Measurement Study of Authentication Rate-Limiting Mechanisms of Modern Websites

Yinqian Zhang

Annual Computer Security Applications Conference

[ICCD'18] NVCool: When Non-Volatile Caches Meet Cold Boot Attacks

Yinqian Zhang

IEEE International Conference on Computer Design

[CCS'18] HoMonit: Monitoring Smart Home Apps from Encrypted Traffic

Yinqian Zhang

ACM Conference on Computer and Communications Security

[TDSC] CPU Elasticity to Mitigate Cross-VM Runtime Monitoring

Yinqian Zhang

Transactions on Dependable and Secure Computing

[ATC'18] Peeking Behind the Curtains of Serverless Platforms

Yinqian Zhang

Usenix Annual Technical Conference

[AsiaCCS'18] Leveraging Hardware Transactional Memory for Cache Side-Channel Defenses

Yinqian Zhang

(Short Paper)

ACM ASIA Conference on Information, Computer and Communications Security

[S&P'18] Static Evaluation of Noninterference Using Approximate Model Counting

Yinqian Zhang

IEEE Symposium on Security and Privacy

[S&P'18] Racing in Hyperspace: Closing Hyper-Threading Side Channels on SGX with Contrived Data Races

Yinqian Zhang

IEEE Symposium on Security and Privacy

[INFOCOM'18] Differentially Private Access Patterns for Searchable Symmetric Encryption

Yinqian Zhang

IEEE International Conference on Computer Communications

[Source code]

[NDSS'18] OS-level Side Channels without Procfs: Exploring Cross-App Information Leakage on iOS

Yinqian Zhang

Network and Distributed System Security Symposium

Top 10 Finalists of CSAW Best Applied Research Paper Award

[Video]

[NDSS'18] Face Flashing: A Secure Liveness Detection Protocol based on Light Reflections

Yinqian Zhang

Network and Distributed System Security Symposium

2017

[CCS'17] Stacco: Differentially Analyzing Side-Channel Traces for Detecting SSL/TLS Vulnerabilities in Secure Enclaves

Yinqian Zhang

ACM Conference on Computer and Communications Security

(The CCS version of this paper supersedes arxiv 1707.03473.)

[CCS'17] Leaky Cauldron on the Dark Land: Understanding Memory Side-Channel Hazards in SGX

Yinqian Zhang

ACM Conference on Computer and Communications Security

(The CCS version of this paper supersedes arxiv 1705.07289.)

[PETS'17] Personalized Pseudonyms for Servers in the Cloud

Yinqian Zhang

Privacy Enhancing Technologies Symposium

[AsiaCCS'17] Detecting Privileged Side-Channel Attacks in Shielded Execution with DEJA VU

Yinqian Zhang

ACM Asia Conference on Computer and Communications Security

[AsiaCCS'17] DoS Attacks on Your Memory in the Cloud

Yinqian Zhang

ACM Asia Conference on Computer and Communications Security

(The AsiaCCS version of this paper supersedes arxiv 1603.03404.)

[CODASPY'17] Transparent Backward-Edge Control Flow Violation Detection Using Intel Processor Trace

Yinqian Zhang

ACM Conference on Data and Applications Security and Privacy

2016

[CCS'16] Return-Oriented Flush-Reload Side Channels on ARM and Their Implications for Android Devices

Yinqian Zhang

ACM Conference on Computer and Communications Security

[CCS'16] A Software Approach to Defeating Side Channels in Last-Level Caches

Yinqian Zhang

ACM Conference on Computer and Communications Security

(The CCS version of this paper supersedes arxiv 1603.05615.)

[RAID'16] CloudRadar: A Real-Time Side-Channel Attack Detection System in Clouds

Yinqian Zhang

International Symposium on Research in Attacks, Intrusions and Defenses

[Security'16] One Bit Flips, One Cloud Flops: Cross-VM Row Hammer Attacks and Privilege Escalation

Yinqian Zhang

USENIX Security Symposium

Top 10 Finalists of CSAW Best Applied Research Paper Award

2015

[CCS'15] Mitigating Storage Side Channels Using Statistical Privacy Mechanisms

Yinqian Zhang

ACM Conference on Computer and Communications Security

[Security'15] A Placement Vulnerability Study in Multi-Tenant Public Clouds

Yinqian Zhang

USENIX Security Symposium

2014 and before

[CCS'14] Cross-Tenant Side-Channel Attacks in PaaS Clouds

Yinqian Zhang

ACM Conference on Computer and Communications Security

[CCS'13] Düppel: Retrofitting Commodity Operating Systems to Mitigate Cache Side Channels in the Cloud

Yinqian Zhang

ACM Conference on Computer and Communications Security

[CCS'12] Cross-VM Side Channels and Their Use to Extract Private Keys

Yinqian Zhang

ACM Conference on Computer and Communications Security

ACM CCS Test-of-Time Award

[S&P'11] HomeAlone: Co-Residency Detection in the Cloud via Side-Channel Analysis

Yinqian Zhang

IEEE Symposium on Security and Privacy

[CCS'10] The Security of Modern Password Expiration: An Algorithmic Framework and Empirical Analysis

Yinqian Zhang

ACM Conference on Computer and Communications Security

[ACSAC'08] Attack Grammar: A New Approach to Modeling and Analyzing Network Attack Sequences

Yinqian Zhang

Annual Computer Security Applications Conference