Research

Cloud-Native Authorization and Policy Security

We investigate authorization and access-control challenges in cloud-native applications, focusing on Kubernetes workloads, serverless computing, and service interactions. We develop techniques to enforce least-privilege access, prevent permission abuse, and automate security policy generation and verification across dynamic environments.

• • Kubernetes workload identity and resource authorization

  • Serverless function-chain security and least-privilege enforcement

  • Automated security policy generation, analysis, and verification

POLARIS(JCC'26), ALPS(IEEE INFOCOM'26), KubeTeus(IEEE INFOCOM'25)

Infrastructure and Runtime Security

We develop security mechanisms to protect operating systems, networks, and computing infrastructure against runtime threats and isolation failures. Using kernel-level enforcement, confidential computing, and GPU virtualization, we enhance runtime protection, evaluate isolation guarantees, and identify infrastructure vulnerabilities.

• • Kernel-level enforcement and runtime isolation

  • Confidential computing and runtime attestation

  • GPU isolation, fault testing, and programmable network security

Beyond Seccomp(Black Hat USA'26), BASTION(USENIX ATC'20), DELTA(NDSS'17)

Autonomous and Cyber-Physical Systems Security

We secure autonomous software and cyber-physical systems, including AI agents, robotic platforms, and extended reality environments. We develop techniques to prevent unauthorized actions, verify permission consistency across execution layers, and preserve intended behavior from high-level decisions to physical actuation.

• • AI-agent action authorization and execution control

  • ROS 2 callback security and cross-layer permission verification

  • End-to-end intent integrity and physical actuation security