I am a Lecturer (~Assistant Professor) in Computer Science at Newcastle University, United Kingdom, based within the Secure and Resilient Systems group. Prior to this, I was a Senior Research Fellow at the Smart Card Centre (SCC) within the Information Security Group (ISG) at Royal Holloway, University of London.
My expertise lies in the areas of trusted execution environments (TEEs) and hardware-assisted security; side-channel and fault injection attacks; and smart cards, secure elements (e.g. SIM cards) and their applications. I'm also an active member of the Linux and RISC-V communities.
If you are interested in pursuing a project, Ph.D. etc. on the above topics, then please reach out at carlton.shepherd@ncl.ac.uk.
I hold a Ph.D. in Information Security from the Information Security Group at Royal Holloway, University of London, and a B.Sc. in Computer Science from Newcastle University.
My technical publications can be found on my Publications page or on Google Scholar.
I'm pleased announce the release of our book, Trusted Execution Environments, published by Springer. We take a holistic view of TEEs, looking at operating system-level controls, smart cards and secure elements, efforts based on the Trusted Platform Module (TPM), and modern technologies such as Arm TrustZone, AMD SEV, and Intel SGX and TDX. Available from various retailers, including:
Our project, Chameleon, has been funded by EPSRC. Here, we're tying CPU execution to environmental attributes, developing methods to prevent physical attacks that 'brick' the device when it's (physically) perturbed post-deployment.
I've been provided hardware prototypes through the UK Digital Security by Design (DSBD) initiative and ARM Morello programme to evaluate the CHERI architecture. I'm happy to hear from prospective students who wish to join these efforts and work on some interesting CHERI projects.
Our work on new firmware-level side-channel attacks on Android devices has been published in IEEE Transactions on Dependable and Secure Computing. We show that methods for sensor measurement distribution to multiple applications can expose some quite nasty attacks which are difficult to rectify. Namely, we show how attackers can create covert channels that completely bypass the Android permissions system, as well as identifying types of sensor-enabled applications.
Our work on recognising black-box functions using hardware performance counters (HPCs) was accepted to IEEE Transactions on Computers. We show that HPCs on mainstream processors can be used as a side-channel for vulnerability detection (using OpenSSL as a use case), interrogating trusted execution environments (using OP-TEE and ARM TrustZone), and general function fingerprinting with high accuracy.The paper can be viewed here.
We comprehensively show that combining modalities, e.g. L1 cache hits, TLB misses, branch mis-predictions and more, is far more powerful than using individual ones explored up to this point. Personally, it's reasonable to expect that multi-modal micro-architectural attacks will be a source of major security problems; far more than, say, Spectre-style speculative execution or cache attacks alone.
I am serving on the Programme Committee of IFIP SEC 2024 and ACM TAS 2024.
I am also a regularly invited reviewer for many leading journals on the topics of TEEs and hardware and mobile security, including: