Biography
Research Scientist with a focus on memory management architectures for security.
Interests
- Formal specification and verification
- Compiler-based security hardening
- Anti-malware techniques
- Computer architecture
- Operating systems and virtualization
Education
MS, PhD, and Postdoc in Computer Science, 2012
University of Illinois at Urbana-Champaign
BS in Computer Science, 2005
University of Wisconsin-Eau Claire
Experience
Senior Staff Research Scientist
I define and evaluate innovative security architectures for mitigating exploits and malware. I draw on my expertise in architecture, compilers, operating systems, virtualization, HW/SW co-design, and formal methods to effectively devise solutions that are well-adapted to workload requirements.
Principal Investigator for Intel’s project in the DARPA HARDEN program.
Served as Intel lead liaison for the SRC JUMP CONIX research center.
PhD Student and Postdoc
Advisor: Carl A. Gunter
National Defense Science and Engineering Graduate (NDSEG) Fellow
PhD Dissertation: Compact Integrity-Aware Architectures
MS Thesis: Dependable Emergency-Response Networking Based on Retaskable Network Infrastructures
TA for Advanced Computer Security (Instructor: Carl A. Gunter)
TA for Advanced Operating Systems (Instructor: Samuel T. King)
Featured Publications
Other Publications
Quickly discover relevant content by filtering publications.
(2021).
Isolation Without Taxation: Near Zero Cost Transitions for SFI.
Foundations of Computer Security (FCS).
(2014).
Power-Based Diagnosis of Node Silence in Remote High-End Sensing Systems.
ACM Transactions on Sensor Networks (ToSN).
(2014).
Protecting Sensor Data from Malware Attacks (pages 178-197).
Intel Technology Journal (ITJ).
(2011).
Reliable telemetry in white spaces using remote attestation.
Annual Computer Security Applications Conference (ACSAC).
(2010).
Diagnostic Powertracing for Sensor Node Failure Analysis.
Information Processing in Sensor Networks (IPSN).
(2009).
Sh@re: Negotiated audit in social networks.
Systems, Man and Cybernetics (SMC).
(2009).
Cumulative Attestation Kernels for Embedded Systems.
European Symposium on Research in Computer Security (ESORICS).
(2009).
Collaborative Recommender Systems for Building Automation.
Hawaii International Conference on System Sciences (HICSS).
(2007).
Supporting Emergency-Response by Retasking Network Infrastructures.
HotNets.
(2007).
PolicyMorph: interactive policy transformations for a logical attribute-based access control framework.
Symposium on Access Control Models and Technologies (SACMAT).
(2007).
Unified Architecture for Large-Scale Attested Metering.
Hawaii International Conference on System Sciences (HICSS).
(2006).
Acoustic Surveillance of Physically Unmodified PCs.
Security and Management (SAM).
(2004).
Comprehensive message control and assurance with the secure email transport protocol.
Electro/Information Technology (EIT).
(2004).
Abstracting Low-Level Network Programming With ACE, a Pattern-Oriented Network Programming Framework.
Software Engineering Research and Practice (SERP).
Patents
Issued patents:
- 11,768,931 (2023): Technologies for object-oriented memory management with extended segmentation
- 11,741,018 (2023): Apparatus and method for efficient process-based compartmentalization
- 11,734,199 (2023): Enforcing memory operand types using protection keys
- 11,711,201 (2023): Encoded stack pointers
- 11,704,297 (2023): Collision-free hashing for accessing cryptographic computing metadata and for cache expansion
- 11,681,793 (2023): Technologies for object-oriented memory management with extended segmentation
- 11,669,625 (2023): Data type based cryptographic computing
- 11,630,920 (2023): Memory tagging for side-channel defense, memory safety, and sandboxing
- 11,620,391 (2023): Data encryption based on immutable pointers
- 11,580,035 (2023): Fine-grained stack protection using cryptographic computing
- 11,575,504 (2023): Cryptographic computing engine for memory load and store units of a microarchitecture pipeline
- 11,562,063 (2023): Encoded inline capabilities
- 11,531,750 (2022): Installing and manipulating a secure virtual machine image through an untrusted hypervisor
- 11,436,161 (2022): System for address mapping and translation protection
- 11,429,580 (2022): Collision-free hashing for accessing cryptographic computing metadata and for cache expansion
- 11,416,624 (2022): Cryptographic computing using encrypted base addresses and used in multi-tenant environments
- 11,416,414 (2022): Technologies for execute only transactional memory
- 11,409,662 (2022): Apparatus and method for efficient process-based compartmentalization
- 11,403,234 (2022): Cryptographic computing using encrypted base addresses and used in multi-tenant environments
- 11,392,492 (2022): Memory management apparatus and method for compartmentalization using linear address metadata
- 11,360,876 (2022): Apparatus and method for pausing processor trace for efficient analysis
- 11,354,423 (2022): Cryptographic isolation of memory compartments in a computing environment
- 11,321,469 (2022): Microprocessor pipeline circuitry to support cryptographic computing
- 11,250,165 (2022): Binding of cryptographic operations to context or speculative execution restrictions
- 11,222,127 (2022): Processor hardware and instructions for SHA3 cryptographic operations
- 11,216,366 (2022): Security check systems and methods for memory allocations
- 11,188,639 (2021): System, method and apparatus for automatic program compartmentalization
- 11,171,983 (2021): Techniques to provide function-level isolation with capability-based security
- 11,163,569 (2021): Hardware apparatuses, methods, and systems for individually revocable capabilities for enforcing temporal memory safety
- 11,144,479 (2021): System for address mapping and translation protection
- 11,080,401 (2021): Memory scanning methods and apparatus
- 11,036,850 (2021): Technologies for object-oriented memory management with extended segmentation
- 11,030,113 (2021): Apparatus and method for efficient process-based compartmentalization
- 10,884,952 (2021): Enforcing memory operand types using protection keys
- 10,860,709 (2020): Encoded inline capabilities
- 10,795,997 (2020): Hardened safe stack for return oriented programming attack mitigation
- 10,785,028 (2020): Protection of keys and sensitive data from attack within microprocessor architecture
- 10,769,272 (2020): Technology to protect virtual machines from malicious virtual machine managers
- 10,706,164 (2020): Crypto-enforced capabilities for isolation
- 10,642,752 (2020): Auxiliary processor resources
- 10,558,582 (2020): Technologies for execute only transactional memory
- 10,515,023 (2019): System for address mapping and translation protection
- 10,503,664 (2019): Virtual machine manager for address mapping and translation protection
- 10,453,114 (2019): Selective sharing of user information based on contextual relationship information, such as to crowd-source gifts of interest to a recipient
- 10,452,848 (2019): Memory scanning methods and apparatus
- 10,324,863 (2019): Protected memory view for nested page table access by virtual machine guests
- 10,318,733 (2019): Techniques for detecting malware with minimal performance degradation
- 10,235,301 (2019): Dynamic page table edit control
- 10,216,522 (2019): Technologies for indirect branch target security
- 10,157,277 (2018): Technologies for object-oriented memory management with extended segmentation
- 10,152,612 (2018): Cryptographic operations for secure page mapping in a virtual machine environment
- 10,104,122 (2018): Verified sensor data processing
- 10,061,918 (2018): System, apparatus and method for filtering memory access logging in a processor
- 10,007,784 (2018): Technologies for control flow exploit mitigation using processor trace
- 9,954,950 (2018): Attestable information flow control in computer systems
- 9,858,411 (2018): Execution profiling mechanism
- 9,830,162 (2017): Technologies for indirect branch target security
- 9,817,976 (2017): Techniques for detecting malware with minimal performance degradation
- 9,805,194 (2017): Memory scanning methods and apparatus
- 9,792,222 (2017): Validating virtual address translation by virtual machine monitor utilizing address validation structure to validate tentative guest physical address and aborting based on flag in extended page table requiring an expected guest physical address in the address validation structure
- 9,710,393 (2017): Dynamic page table edit control
- 9,703,703 (2017): Control of entry into protected memory views
- 9,665,373 (2017): Protecting confidential data with transactional processing in execute-only memory
- 9,501,637 (2016): Hardware shadow stack support for legacy guests
- 9,335,943 (2016): Method and apparatus for fine grain memory protection
- 9,124,635 (2015): Verified sensor data processing
- 8,458,791 (2013): Hardware-implemented hypervisor for root-of-trust monitoring and control of computer system
- 7,774,411 (2010): Secure electronic message transport protocol
Published patent applications:
- 17/791,000: CRYPTOGRAPHIC COMPUTING IN MULTITENANT ENVIRONMENTS
- 17/947,072: UPDATING ENCRYPTED SECURITY CONTEXT IN STACK POINTERS FOR EXCEPTION HANDLING AND TIGHT BOUNDING OF ON-STACK ARGUMENTS
- 17/357,951: ZERO-REDUNDANCY TAG STORAGE FOR BUCKETED ALLOCATORS
- 17/855,261: STATELESS AND LOW-OVERHEAD DOMAIN ISOLATION USING CRYPTOGRAPHIC COMPUTING
- 17/854,814: CRYPTOGRAPHIC COMPUTING ISOLATION FOR MULTI-TENANCY AND SECURE SOFTWARE COMPONENTS
- 17/839,877: TECHNOLOGIES FOR MEMORY TAGGING
- 17/833,515: CRYPTOGRAPHIC ISOLATION OF MEMORY COMPARTMENTS IN A COMPUTING ENVIRONMENT
- 17/357,963: REGION-BASED DETERMINISTIC MEMORY SAFETY
- 17/704,771: TAGLESS IMPLICIT INTEGRITY WITH MULTI-PERSPECTIVE PATTERN SEARCH
- 17/696,330: RATCHET POINTERS TO ENFORCE BYTE-GRANULAR BOUNDS CHECKS ON MULTIPLE VIEWS OF AN OBJECT
- 17/699,593: CRYPTOGRAPHIC DATA OBJECTS PAGE CONVERSION
- 17/696,153: CRYPTOGRAPHIC ENFORCEMENT OF BORROW CHECKING
- 17/692,464: COMPARTMENT ISOLATION FOR LOAD STORE FORWARDING
- 17/693,748: GENERATING ENCRYPTED CAPABILITIES WITHIN BOUNDS
- 17/682,997: COMPILER-DIRECTED SELECTION OF OBJECTS FOR CAPABILITY PROTECTION
- 17/561,828: PROCESS OBJECT RE-KEYING DURING PROCESS CREATION IN CRYPTOGRAPHIC COMPUTING
- 17/485,213: OBJECT AND CACHELINE GRANULARITY CRYPTOGRAPHIC MEMORY INTEGRITY
- 17/559,385: DATA OBLIVIOUS CRYPTOGRAPHIC COMPUTING
- 17/561,817: TYPED STORE BUFFERS FOR HARDENING STORE FORWARDING
- 17/485,213: OBJECT AND CACHELINE GRANULARITY CRYPTOGRAPHIC MEMORY INTEGRITY
- 17/314,349: TECHNOLOGY TO CONTROL SYSTEM CALL INVOCATIONS WITHIN A SINGLE ADDRESS SPACE
- 17/255,588: FUNCTION AS A SERVICE (FAAS) SYSTEM ENHANCEMENTS
- 16/998,913: PROTECTION OF KEYS AND SENSITIVE DATA FROM ATTACK WITHIN MICROPROCESSOR ARCHITECTURE
- 16/862,022: MEMORY WRITE FOR OWNERSHIP ACCESS IN A CORE
- 16/722,342: POINTER BASED DATA ENCRYPTION
- WO2020096639: Function as a Service (FaaS) System Enhancements
- 15/721,553: Installing and manipulating a secure virtual machine image through an untrusted hypervisor
- 15/713,573: Methods and arrangements to determine physical resource assignments
- 16/040,193: System, method and apparatus for automatic program compartmentalization
- 15/273,286: Access control
- 15/201,018: Regulating control transfers for execute-only code execution
Skills
C/C++
App, kernel, and hypervisor development for Linux, Windows, and embedded systems with Boost and generics experience
Rust
Go
SMT-LIB / Z3
SAT/SMT solver (completed Coursera course)
X86 Assembly
Somewhat familiar with assembly language for other architectures as well
LLVM/Clang
Compiler framework
Bluespec SystemVerilog
High-Level Synthesis (HLS) language based on Term-Rewriting Systems
Maude
Model checker based on Term-Rewriting Systems and Linear-Temporal Logic
Isabelle/HOL
Interactive theorem prover
Python
Java
Verilog/VHDL
Experience using Intel Quartus and Xilinx Vivado FPGA toolchains. Experience using Synopsys VCS and Mentor Graphics Modelsim simulators. Experience extending and maintaining an in-house Verilog simulator during an internship with Cray, Inc.
Prolog
Logic programming language
Professional Service and Volunteering
Professional society memberships:
- Senior Member of the Association for Computing Machinery (ACM)
- Senior Member of IEEE
PC member:
- TRUST 2010 & 2011
Journal reviews:
- 2019 IEEE Transactions on Networking
- 2013 IEEE Transactions on Information Forensics & Security (TIFS)
- 2009 Journal of Computer Security (JCS)
- 2009 IEEE Transactions on Industrial Electronics (TIE)
- 2007 ACM Transactions on the Web (TWEB)
- 2005 ACM Transactions on Information and System Security (TISSEC)
Conference and workshop reviews:
- 2021 Design Automation Conference (DAC)
- 2013 IEEE PowerTech
- 2009 International Conference on Distributed Computing Systems (ICDCS)
- 2009 IEEE Symposium on Security and Privacy (Oakland)
- 2008 IEEE Workshop on Policies for Distributed Systems and Networks (POLICY)
- 2008 Hawaiian International Conference on System Sciences (HICSS)
- 2007 IEEE Computer Security Foundations Symposium (CSF)
- 2007 ACM Workshop on Privacy in the Electronic Society (WPES)
- 2006 IEEE International Conference on Network Protocols (ICNP)
- 2006 IFIP International Conference on Critical Infrastructure Protection (ICCIP)
- 2006 ACM Workshop on Privacy in the Electronic Society (WPES)
Selected Mentoring Experiences:
- Summer 2021: Two mentees within inaugural Princeton/Intel Research Experience for Undergraduates (REU) summer program.
- 2020-present: High schooler and author of introductory book on cryptography.
- 2018-present: Multiple mentees within official intra-Intel mentoring program.
Volunteering:
- Computer Science Category Judge at 2020-2022 NWSE Beaverton Hillsboro Science Expo
Hobbies
- Run commuting
- Commuting by Onewheel
- Gardening
- Camping, hiking, and backpacking
Contact
For messages related to my work at Intel, please contact me at michael dot lemay at intel dot com.
For other messages, please contact me at m at lemays dot org.
Recent Posts
I post a mix of professional content and personal content on my website, and I categorize my posts accordingly. Separate RSS/Atom feeds are generated for each of those categories, and there is also a combined feed:
