Software vulnerabilities due to memory management errors are among the easiest to exploit. To prevent an attacker from injecting its own arbitrary code (shellcode), modern systems commonly enforce a Data Execution Prevention (DEP), often implemented as segment permissions (Write xor Execute – W^E). Yet, Code-Reuse Attacks have emerged to circumvent the DEP protections. Thanks to...

Learn more Apply

Providing assurances that autonomous systems will operate in a safe and secure manner is a prerequisite for their deployment in mission-critical and safety-critical application domains. Typically, assurances are provided in the form of assurance cases, which are auditable and reasoned arguments that a high-level claim (usually concerning safety or other critical properties) is satisfied given...

Learn more Apply

With a strong context of regulation of AI at the European scale, several requirements have been proposed for the quot;cybersecurity of AIquot; and more particularly to increase the security of complex modern AI systems. Indeed, we are experience an impressive development of large models (so-called “Foundation” models) that are deployed at large-scale to be adapted...

Learn more Apply

The first worldwide deployment of a blockchain dates back to 2010 with Bitcoin, which introduced a completely digital monetary system and a crypto-currency, bitcoin. Within Bitcoin, all transactions are publicly accessible and traceable, which should generate trust between stakeholders. However, the traceability of transactions, and ultimately of the crypto-currency, does not imply the traceability of...

Learn more Apply

The cybersecurity of our infrastructures is at the very heart in the digital transition on-going, and security must be ensured throughout the entire chain. At the root of trust lies the hardware, integrated circuits providing essential functions for the integrity, confidentiality and availability of processed information. But hardware is vulnerable to physical attacks, and defence...

Learn more Apply

The blockchain is based on a consensus protocol, the aim of which is to share and replicate ordered data between peers in a distributed network. The protocol stack, embedded in the network's peer devices, relies on a proof mechanism that certifies the timestamp and ensures a degree of fairness within the network. The consensus protocols...

Learn more Apply

Side-channel attacks, such as analyzing a processorapos;s electrical consumption or electromagnetic emissions, allow for the recovery of sensitive information, including cryptographic keys. These attacks are particularly effective and pose a serious threat to the security of embedded systems. This thesis focuses on combining low-impact software countermeasures to strengthen security against side-channel attacks, an idea that...

Learn more Apply

The design of integrated circuits requires, at the end of the chain, circuit editing and failure analysis tools. One of these tools is the probing of electrical potential levels using an electron beam available in a SEM (Scanning Electron Microscope) to determine the electrical signal present in an area of the circuit, which may be...

Learn more Apply

Riceapos;s theorem stating that no method can automatically tell whether a property of a program is true or not has led to the separation of verification tools into two groups: sound tools operating by over-approximation, such as abstract interpretation, are able to automatically prove that certain properties are true, but are sometimes unable to conclude...

Learn more Apply

CHERI (Capability Hardware Enhanced RISC Instructions) is a solution for securing the processor against spatial and temporal memory leaks by transforming any pointer into a capability that clearly defines the access limits to the data or instructions addressed. In this thesis, we propose to enrich CHERI and its control-flow integrity capabilities on a RISC-V application...

Learn more Apply

Products secured by embedded cryptographic mechanisms may be vulnerable to side-channel attacks. Such attacks are based on the observation of some physique quantities measured during the device activity, whose variation may provoke information leakage and lead to a security flaw. Today, such attacks are improved, even in presence of specific countermeasures, by deep learning based...

Learn more Apply

Fully Homomorphic Encryption (FHE) is a corpus of cryptographic techniques that allow to compute directly over encrypted data. Since its inception around 15 years ago, FHE has been the subject of a lot of research towards more efficiency and better practicality. From a security perspective, however, FHE still raises a number of questions and challenges....

Learn more Apply

This thesis focuses on the cybersecurity of embedded systems, particularly the vulnerability of processors and programs to fault injection attacks. These attacks disrupt the normal functioning of systems, allowing attackers to exploit weaknesses to access sensitive information. Although formal methods have been developed to analyze the robustness of systems, they often limit their analyses to...

Learn more Apply

Work carried out within CEA-Leti has shown that physical attacks can be a threat to the security mechanisms of SoCs (System on Chips). Indeed, fault injections by electromagnetic disturbance have already led to an escalation of privileges by authenticating with an illegitimate password, or more recently have made it possible to bypass one of the...

Learn more Apply

In many applications, scene analysis modules such as object detection and recognition, or pose recognition, are required. Deep neural networks are nowadays among the most efficient models to perform a large number of vision tasks, sometimes simultaneously in case of multitask learning. However, it has been shown that they are vulnerable to adversarial attacks: Indeed,...

Learn more Apply

Cryptography plays a fundamental role in securing modern communication systems by ensuring confidentiality, integrity, and authenticity. Public-key cryptography, in particular, has become indispensable for secure data exchange and authentication processes. However, the advent of quantum computing poses an existential threat to many of the traditional public-key cryptographic algorithms, such as RSA, DSA, and ECC, which...

Learn more Apply

Memories play a critical role for the security of cyber-physical systems. They manage sensitive data such as cryptographic keys and proprietary codes. With the increasing threat of hardware attacks, understanding and manipulating memory organization has become essential. The thesis aims to explore the application of laser attack techniques, specifically Thermal Laser Stimulation (TLS) and laser...

Learn more Apply