Collaborative research: satc 2.0: RES: TTE: architecting microarchitectural side-channels for proactive defense development in extended reality

The National Science Foundation Division of Computer and Network Systems awarded Iowa State University of Science and Technology $648,169 on October 1, 2026, under the Computer and Information Science and Engineering program (CFDA 47.070) to develop automated methods for identifying and characterizing hardware side-channel vulnerabilities in augmented and virtual reality systems.

The project addresses privacy risks in immersive devices that capture detailed sensor data on users' bodies, movements, and environments. Untrusted applications can infer private information by observing low-level hardware behavior, even when denied direct access to sensitive data. The research team will create a principled framework to systematically identify such hardware side-channels across immersive system components and design practical defenses that mitigate threats without degrading user experience. The work includes developing automated discovery methods for previously underexplored hardware behaviors, demonstrating how an untrusted application can combine seemingly benign side-channel signals to infer sensitive user activity, and evaluating a practical hardening toolkit on real devices.

Performance occurs in Ames, Iowa through September 30, 2029. The award supports workforce development in securing next-generation computing platforms and contributes to industry-wide security standards for immersive technologies.

Abstract

Augmented and virtual reality systems are increasingly integrated into everyday life, supporting applications in entertainment, education, healthcare, and workforce training. These devices continuously sense their users and surroundings through built-in sensors, capturing detailed data about people's bodies, movements, and environments. This raises the stakes for user privacy while users expect seamless, high-performance interaction. Unlike traditional computing, immersive devices are vulnerable to a subtler class of risk rooted in the hardware itself. An untrusted application that is denied access to sensitive information may still infer private information indirectly by observing how the device's low-level hardware behaves, a weakness known as a hardware side-channel. The project's novelties are a principled framework that systematically identifies and characterizes such hardware side-channels across the components of immersive systems, with practical defenses that mitigate them without degrading the user experience. The project's broader significance and importance are in protecting users of immersive platforms from unprecedented privacy violations, contributing to industry-wide security standards, and cultivating a workforce skilled in securing next-generation computing platforms. This project develops automated methods to discover and characterize how previously underexplored low-level hardware behaviors can give rise to side channels, enabling systematic analysis of threats that conventional software-centric models overlook. This project also demonstrates how an untrusted application can infer sensitive user activity by combining side-channel signals that appear benign in isolation, analyzing the practical severity of these threats on real devices. The research team designs and evaluates a practical hardening toolkit that mitigates these threats with low overhead and remains deployable across the diverse hardware platforms underlying immersive systems. The outcome of this project enhances current security practices for immersive systems, guides the design of future multi-user computing platforms, and be released as open-source tools and datasets to accelerate adoption across the industry. This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the foundation's intellectual merit and broader impacts review criteria.- subawards are not planned for this award.