Nektarios Georgios Tsoutsos

Electric vehicle (EV) charging systems increasingly will require a digital protocol for communications over the cable between the EV and its power supply equipment (SE) or attached devices. To design a modern security system, we first analyze all alternating current (AC) use cases for connected EVs, including EV charging, vehicle-to-grid (V2G), building backup power, and EVs powering connected load. Threat analysis for all actual use cases provides the basis for developing a complete and well-targeted security design.Security mechanisms are then designed for each of the use cases. Manufacturers assign a unique, persistent identifier to each EV or SE they produce, including a canonical manufacturer code plus a unique individual EV or SE identity. The key exchange employs SIGMA-I authentication with ECDSA signatures and explicit certificates, using hardware secure elements that generate and trap private keys on-chip within the EV or SE. An M x N direct-trust model enables offline mutual authentication without a central certificate authority, while a post-authentication policy record separates cryptographic outcomes from configurable business decisions. Requirements for each commercial actor to set up and use this authentication and encryption are defined. Local Interconnect Network over Control Pilot (LIN-CP), a new AC protocol, is used as a reference implementation for the security design.The result is that the EV, SE and attached devices each can securely identify the others as needed for each use case. The cost, complexity, startup latency, user effort, power requirements and failure modes are substantially reduced from today's methods.

With concerns about data privacy growing in a connected world, cryptography researchers have focused on fully homomorphic encryption (FHE) for promising machine learning as a service solution. Recent advancements have lowered the computational cost by several orders of magnitude, but the latency of fully homomorphic neural networks remains a barrier to adoption. This work proposes using multi-exit neural networks (MENNs) to accelerate the FHE inference. MENNs are network architectures that provide several exit points along the depth of the network. This approach allows users to employ results from any exit and terminate the computation early, saving both time and power. First, this work weighs the latency, communication, accuracy, and computational resource benefits of running FHE-based MENN inference. We show FHE-MENNs improvement over single-exit networks on the accuracy-latency Pareto frontier, achieving around 7% accuracy boost for similar latencies. Then, we present the TorMENNt attack that can exploit the user’s early termination decision to launch a concrete side-channel on both plaintext and FHE-encrypted MENNs. In particular, we show that this attack leaks less than one bit per image per exit, and we demonstrate that TorMENNt can still infer private classification outputs. Results on a single CIFAR-10 image show that TorMENNt doubles an attacker’s likelihood of correctly predicting the user’s image class compared to random guessing, and on a batch of 100 images can achieve up to 68% prediction accuracy. We discuss possible countermeasures to mitigate the attack and examine their effectiveness. Finally, we tie the privacy risks with a cost-benefit analysis to obtain a practical roadmap for FHE-based MENN adoption.

In recent years, the globalization of the semiconductor supply chain has introduced severe security vulnerabilities related to counterfeit hardware and unauthorized overproduction. This poses serious risks to modern computing infrastructure, creating a pressing need for hardware authentication methodologies that are efficient, reproducible, and publicly verifiable. While Physical Unclonable Functions (PUFs) provide a robust hardware root of trust, existing protocols typically rely on centralized databases of secrets, which create single points of failure and trust. To address these challenges, we propose V-PUF, a novel ephemeral-key architecture that reconciles the stochastic nature of raw silicon physics with the requirements of decentralized public verifiability. Unlike traditional approaches that mask secrets for closed-loop verification, V-PUF architecturally integrates noisy silicon entropy into a rigid cryptographic framework optimized for constrained hardware. We introduce a "Regenerateand-Prove" paradigm, utilizing a lightweight Low-Density Parity Check (LDPC) decoder to derive transient deterministic seeds for Elliptic Curve based (Ed25519) proof generation from noisy PUF data. Our proposed architecture harnesses the intrinsic ephemerality of SRAM PUFs to establish hardware-level protections, ensuring that the VRF private keys are reconstructed only for the very short period required for proof generation. We present a formal security analysis of this Noisy-Input VRF model and evaluate a full stack implementation on a commodity STM32L152RE microcontroller. Experimental results demonstrate that our architecture achieves robust reliability with a False Acceptance Rate (FAR) of 0% and a False Rejection Rate (FRR) of 0% across nominal IoT operating temperatures, while gracefully degrading under extreme thermal stress. The entire protocol stack takes 2.133 seconds and consumes 62.6 mJ per proof, confirming that decentralized, publicly verifiable hardware authentication is viable for low-power edge devices.

Generative AI, a significant technological disruptor in recent years, has impacted domains such as augmented reality, coding assistance, and text generation. However, the use of these models requires users to trust the model owners with sensitive data given to prompt the model. Fully Homomorphic Encryption (FHE) offers a promising solution, and many earlier works have investigated the use of this technology for machine learning as a service (MLaaS) inference applications. Still, these efforts do not cater to generative models that operate probabilistically, allowing for diverse and creative outputs. In this work, we introduce three novel probabilistic selection algorithms for encrypted autoregressive generative AI using the TFHE cryptosystem at 128 bits of security: multiplication-scaled cumulative sum, heuristic cumulative sum, and the random-multiplication argmax. Each of these approaches presents distinctive challenges in optimizing the tradeoff between precision and timing performance, a balance intricately tied to the specific characteristics of the data under consideration. Our results show that the loss function of the argmax-based random multiplication method scales better than the cumulative sum methods, highlighting the importance of developing efficient encrypted argmax functions.

Fully homomorphic encryption (FHE) enables arbitrary computation on encrypted data, but certain applications remain prohibitively expensive in the encrypted domain. As a case in point, comparing two encrypted sets of data is extremely computationally expensive due to the large number of comparison operators required. In this work, we propose a novel methodology for encrypted set similarity inspired by the MinHash algorithm and the CGGI FHE scheme. Doing comparisons in FHE requires comparators and multiplexers or an expensive approximation, which further increases the latency, especially when the goal is to compare two sets of data. The MinHash algorithm can significantly reduce the number of comparisons required by employing a special Carter-Wegman (CW) hash function as a key building block. However, the modulus operation in the CW hash becomes another key bottleneck because the encrypted sub-circuits required to perform the modular reduction are very large and inefficient in an FHE setting. Towards that end, we introduce an efficient bitwise FHE-friendly digest function (FFD) to employ as the cornerstone of our proposed encrypted set-similarity. In a Boolean FHE scheme like CGGI, the bitwise operations can be implemented efficiently with Boolean gates, which allows for faster evaluation times relative to standard Carter-Wegman constructions. Overall, our approach drastically reduces the number of comparisons required relative to the baseline approach of directly computing the Jaccard similarity coefficients, and is inherently parallelizable, allowing for efficient encrypted computation on multi-CPU and GPU-based cloud servers. We validate our approach by performing a privacy-preserving plagiarism detection across encrypted documents.

Homomorphic encryption is a powerful privacy-preserving technology that is notoriously difficult to configure and use, even for experts. The key difficulties include restrictive programming models of homomorphic schemes and choosing suitable parameters for an application. In this tutorial, we outline methodologies to solve these issues and allow for conversion of any application to the encrypted domain using both leveled and fully homomorphic encryption. The first approach, called Walrus, is suitable for arithmetic-intensive applications with limited depth and applications with high throughput requirements. Walrus provides an intuitive programming interface and handles parameterization automatically by analyzing the application and gathering statistics such as homomorphic noise growth to derive a parameter set tuned specifically for the application. We provide an in-depth example of this approach in the form of a neural network inference as well as guidelines for using Walrus effectively. Conversely, the second approach (HELM) takes existing HDL designs and converts them to the encrypted domain for secure outsourcing on powerful cloud servers. Unlike Walrus, HELM supports FHE backends and is well-suited for complex applications. At a high level, HELM consumes netlists and is capable of performing logic gate operations homomorphically on encryptions of individual bits. HELM incorporates both CPU and GPU acceleration by taking advantage of the inherent parallelism provided by Boolean circuits. As a case study, we walk through the process of taking an off-the-shelf HDL design in the form of AES-128 decryption and running it in the encrypted domain with HELM.

As cloud computing continues to gain widespread adoption, safeguarding the confidentiality of data entrusted to third-party cloud service providers becomes a critical concern. While traditional encryption methods offer protection for data at rest and in transit, they fall short when it comes to where it matters the most, i.e., during data processing. To address this limitation, we present HELM, a framework for privacy-preserving data processing using homomorphic encryption. HELM automatically transforms arbitrary programs expressed in a Hardware Description Language (HDL), such as Verilog, into equivalent homomorphic circuits, which can then be efficiently evaluated using encrypted inputs. HELM features three modes of encrypted evaluation: a) a gate mode that consists of Boolean gates, b) a small-precision lookup table mode which significantly reduces the size of the circuit by combining multiple gates into lookup tables, and c) a high-precision lookup table mode tuned for multibit arithmetic evaluations. Finally, HELM introduces a scheduler that leverages the parallelism inherent in arithmetic and Boolean circuits to efficiently evaluate encrypted programs. We evaluate HELM with the ISCAS’85 and ISCAS’89 benchmark suites, as well as real-world applications such as image filtering and neural network inference. In our experimental results, we report that HELM can outperform prior works by up to 65×.

In crowd-sourced data aggregation over the Internet, participants share their data points with curators. However, a lack of strong privacy guarantees may discourage participation, which motivates the need for privacy-preserving aggregation protocols. Moreover, existing solutions remain limited with respect to public auditing without revealing the participants’ data. In realistic applications, however, there is an increasing need for public verifiability (i.e., verifying the protocol correctness) while preserving the privacy of the participants’ inputs, since the participants do not always trust the data curators. At the same time, while publicly distributed ledgers may provide public auditing, these schemes are not designed to protect sensitive information. In this work, we introduce two protocols, dubbed Masquerade and zk-Masquerade, for computing private statistics, such as sum, average, and histograms, without revealing anything about participants’ data. We propose a tailored multiplicative commitment scheme to ensure the integrity of data aggregations and publish all the participants’ commitments on a ledger to provide public verifiability. zk-Masquerade detects malicious participants who attempt to poison the aggregation results by adopting two zero-knowledge proof protocols that ensure the validity of shared data points before being aggregated and enable a broad range of numerical and categorical studies. In our experiments, we use homomorphic ciphertexts and commitments for a variable number of participants and evaluate the runtime and the communication cost of our protocols.

Insight into user experience and behavior is critical to the success of large software systems and web services. Gaining such insights, while preserving user privacy, is a significant challenge. Recent advancements in multi-party computation have made it practical to securely compute aggregates over secret shared data. Two such protocols have emerged as candidates for standardization at IETF: Prio (NSDI 2017) for general-purpose statistics; and Poplar (IEEE S&P 2021) for heavy hitters, where the goal is to compute the most popular inputs held by users without learning the inputs themselves. While each of these protocols is well-suited to certain applications, there remain a number of use cases identified by IETF for which neither Prio nor Poplar is practical. We introduce Mastic, a protocol for the following functionality: each of a large number of clients holds an input (e.g., a URL) and its corresponding weight (e.g., page load time); for a given candidate input (or prefix), a small number of non-colluding servers wish to securely aggregate the weights of clients that hold that input (or some input with that prefix), without learning the weights or which client holds which input. This functionality makes two new classes of applications possible. The first is a natural generalization of heavy hitters we call weighted heavy-hitters. The second is an enhancement of Prio-style metrics we call attribute-based metrics in which aggregates are grouped by hierarchical user attributes (e.g., their geographic location or software version). We demonstrate Mastic's practicality for these applications with a real-world example of each. We also compare our protocol with Prio and Poplar on a wide area network. Overall, we report over one order of magnitude performance improvement over Poplar for plain heavy-hitters and 1.5-2x improvement over Prio for attribute-based metrics.