Joshua Serratelli Schiffman, PhD

Vita

Washington, DC, United States of America
josh@joshschiffman.org | joshschiffman.org

Pennsylvania State University, University Park, PA — Ph.D., Computer Science and Engineering (August 2012)

Thesis: Practical System Integrity Verification in Cloud Computing Environments
Advisor: Trent Jaeger

Pennsylvania State University, University Park, PA — M.S., Computer Science and Engineering (May 2009)

Pennsylvania State University, University Park, PA — B.S., Computer Science and Engineering with Honors and High Distinction (May 2006)

Research Director, Distinguished Technologist — HP Inc., HP Labs, Washington, DC, USA. May 2023 – Present

Research Director and Strategist for HP Labs' Security Lab. Provide technical leadership for HP's supply chain security and lifecycle device management research. In my role as Distinguished Technologist, I offer guidance in navigating strategic engagements with partners, technologies, and global trends in systems security, trusted computing, supply chain security, and secure protocols. I am also focused on building research initiatives between HP and public entities, governments, and researchers.

Master Technologist, Senior Security Researcher — HP Inc., HP Labs, Bristol, England. May 2015 – Present

Senior security researcher at HP Labs Security Lab. Technical leader for endpoint and infrastructure security innovation and research agenda covering supply chain security, application of trusted computing technology to endpoint device security, user-centric authentication and authorization frameworks, and edge compute infrastructure security. I also lead the HP-wide Security and Privacy Affinity Group to drive excellence and competence in security and privacy at HP.

Member of Technical Staff, Security Architect — Advanced Micro Devices, Inc., Austin, TX. Sept 2012 – May 2015

Design and implementation of hardware and software IP to improve the security and capabilities of AMD products.
Publish research and submit patents on new security architectures, threats, and mitigations, participate in academic and industry committees, and give talks on AMD security architecture.
Represent AMD in the Trusted Computing Group (Co-Chair of Mobile Platform Working Group, alternate on Technical Committee), Global Platform, and Cyber Security Research Alliance.
Aided porting TPM 2.0 reference code to AMD's firmware implementation.

Research Intern — Microsoft Research, Redmond, WA. Summer 2011

Designed and implemented a platform for privacy preserving services. Leveraged Infineon SLE secure hardware, modified Microsoft Hyper-V and designed a Windows Phone 7 application to maintain user privacy in personalized queries. Helped design and evaluate a new multi-client oblivious RAM protocol to protect user privacy in personalized data center services.

Research Intern — Samsung Electronics R&D, San Jose, CA. Summer 2009

Researched distributed cloud computing application security for mobile devices. Designed and implemented an access control manager for sub-delegation of the OAuth web authorization protocol in consumer electronics.

Research Co-op — IBM T. J. Watson Research Center, Hawthorne, NY. Summer 2008

Researched access control policies in virtual machine security and stream computing platforms.

Research Assistant to Trent Jaeger — Pennsylvania State University, University Park, PA. 2006 – 2012

Designed, implemented and evaluated a method for installing via CD-ROM network-boot to enable simple verification of the installed filesystem's integrity by leveraging the TPM and late-launch (Intel and AMD) CPU features.
Designed a secure execution monitor for the Linux kernel in Qtopia on OpenMoko (Neo1973 phone and evaluation board) that prevents untrusted binaries from running under critical SELinux labeled processes.
Built a runtime integrity monitor for both Xen and Linux KVM that verifies remote client specified integrity policies through a service local to the VM's host. Developed a hardware-based VM introspection mechanism to detect integrity violations in hosted VMs. Evaluated architecture on Eucalyptus and OpenStack cloud platforms.

Technical Intern — Lockheed Martin, King of Prussia, PA. Summer 2005, 2006

Developed web application prototypes for the Coast Guard's Deepwater program. Improved corporate web application for internal requisitions. Automated data entry for the Pennsylvania State Police ArcGIS services.

27 peer-reviewed publications across journals, conferences, and workshops. Full list with links on the Publications page.

Thalia Laing, Eduard Marin, Mark D. Ryan, Joshua Schiffman, Gaëtan Wattiau. Symbolon: Enabling Flexible Multi-device-based User Authentication. 2022 IEEE Conference on Dependable and Secure Computing (DSC), June 2022. [Link]
Yuqiong Sun, Giuseppe Petracca, Trent Jaeger, Hayawardh Vijayakumar and Joshua Schiffman. CloudArmor: Protecting Cloud Commands from Compromised Cloud Services. 8th IEEE International Conference on Cloud Computing (IEEE CLOUD'15), June 2015. [Link]
Joshua Schiffman, Yuqiong Sun, Hayawardh Vijayakumar, and Trent Jaeger. Cloud Verifier: Verifiable Auditing Service for IaaS Clouds. 2013 IEEE Ninth World Congress on Services (SERVICES '13), June 2013. [Link]
Joshua Schiffman, Trent Jaeger, and Patrick McDaniel. Network-based Root of Trust for Installation. IEEE Security & Privacy, Volume 9, Issue 1, pp 40–48, Jan.–Feb. 2011. [Link]
Joshua Schiffman, Thomas Moyer, Christopher Shal, Trent Jaeger, and Patrick McDaniel. Justifying Integrity Using a Virtual Machine Verifier. ACSAC '09: 25th Annual Computer Security Applications Conference, December 2009. Honolulu, HI. (19% acceptance rate) [Link]

Co-inventor on 32 issued U.S. patents in computer and systems security. Full list with links on the Patents page.

Verifying System Integrity by Proxy, Imperial College London, September 15, 2014. London, UK.
Practical Verification of System Integrity In Cloud Computing Environments, Trusted Infrastructure Workshop (TIW '13), June 5, 2013.
Towards Practical Attestation: Challenges and Opportunities, Trusted Infrastructure Workshop (TIW '12), June 10, 2010. Pittsburgh, PA.

ACM Symposium on Information, Computer and Communications Security (ASIACCS) — 2014, 2015
Annual Computer Security Applications Conference (ACSAC) — 2013, 2014
International Workshop on Emerging Cyberthreats and Countermeasures (ECTCM) — 2015
ACM Workshop on Scalable Trusted Computing (STC) — 2012
International Workshop on Security (IWSEC) — 2012