Collaborative Research: SaTC 2.0: RES: TTE: Architecting Microarchitectural Side-Channels for Proactive Defense Development in Extended Reality

Augmented and virtual reality systems are increasingly integrated into everyday life, supporting applications in entertainment, education, healthcare, and workforce training. These devices continuously sense their users and surroundings through built-in sensors, capturing detailed data about people's bodies, movements, and environments. This raises the stakes for user privacy while users expect seamless, high-performance interaction. Unlike traditional computing, immersive devices are vulnerable to a subtler class of risk rooted in the hardware itself. An untrusted application that is denied access to sensitive information may still infer private information indirectly by observing how the device's low-level hardware behaves, a weakness known as a hardware side-channel. The project's novelties are a principled framework that systematically identifies and characterizes such hardware side-channels across the components of immersive systems, with practical defenses that mitigate them without degrading the user experience. The project's broader significance and importance are in protecting users of immersive platforms from unprecedented privacy violations, contributing to industry-wide security standards, and cultivating a workforce skilled in securing next-generation computing platforms. This project develops automated methods to discover and characterize how previously underexplored low-level hardware behaviors can give rise to side channels, enabling systematic analysis of threats that conventional software-centric models overlook. This project also demonstrates how an untrusted application can infer sensitive user activity by combining side-channel signals that appear benign in isolation, analyzing the practical severity of these threats on real devices. The research team designs and evaluates a practical hardening toolkit that mitigates these threats with low overhead and remains deployable across the diverse hardware platforms underlying immersive systems. The outcome of this project enhances current security practices for immersive systems, guides the design of future multi-user computing platforms, and be released as open-source tools and datasets to accelerate adoption across the industry. This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.