Fwd: [security-lunch] Nov 5 | Charly Castes on "Securing Systems Foundations: The Design and Verification of a Virtual Firmware Monitor"

[Alan Karp]

--------------
Alan Karp

---------- Forwarded message ---------
From: Michael Leo Paper <mpa...@stanford.edu>
Date: Mon, Nov 3, 2025 at 11:16 AM
Subject: [security-lunch] Nov 5 | Charly Castes on "Securing Systems Foundations: The Design and Verification of a Virtual Firmware Monitor"
To: securit...@lists.stanford.edu <securit...@lists.stanford.edu>

Note that for this week's exceptional speaker, we will be in an exceptional room: CoDa E201!

Looking forward to seeing many of you there 🙂

Security Lunch 🍂 Ed. — Wednesday,  Nov 5th, 2025, 12:00 pm @ CoDa E201

Securing Systems Foundations: The Design and Verification of a Virtual Firmware Monitor

Charly Castes

Can't make it in person? Join us on zoom.

See our past & upcoming events on our website! 

Abstract: 

To accommodate ever-increasing multi-tenancy and security constraints, computer systems have evolved toward greater isolation between software components, from early time-sharing systems to virtualization and the emergence of confidential computing. Yet, even today, firmware remains all-powerful and completely unchecked. By executing with the highest privilege on the CPU, firmware can bypass hypervisor and confidential computing isolation, breaking any existing security guarantees in case of a compromise.

In this talk, we will explore how to secure the highest privilege level of the CPU, where the firmware runs. We will present the design, implementation, and verification of Miralis, a new kind of system we call a Virtual Firmware Monitor. We will explain how Miralis can safely and efficiently de-privilege unmodified vendor firmware on RISC-V platforms by revisiting classic virtualization ideas. Finally, we will explain how we verified core Miralis subsystems, from virtualization logic to assembly, by leveraging existing exhaustive ISA specifications.

Bio:

Charly Castes is a final-year PhD candidate at EPFL in the Data Center Systems Laboratory. His research focuses on building secure systems foundations, with an emphasis on virtualization, confidential computing, and low-level system security. He is currently a visiting PhD student in the Software Systems Laboratory at Columbia University, was a visiting researcher in the Systems Research group at Google, and is a graduate of École Polytechnique.

_______________________________________________
security-lunch mailing list
securit...@lists.stanford.edu
https://mailman.stanford.edu/mailman/listinfo/security-lunch