2026
KS-CFA: Control-Flow Attestation via Symbolic Replay Against Control-Flow Bending Attacks
Zhanyu Sha, Konstantinos Markantonakis, Carlton Shepherd, Amir Rafi
Preprint
Professor of Information Security at Royal Holloway, University of London, and Director of the Trustworthy, Embedded and Autonomous Systems Centre (TASC).
Approach
Information Security systems that are sound in theory still fail in practice, because an adversary will target the weakest and most accessible part of a system — ordinarily the implementation rather than the proof.
Bridging that gap has been a central focus of my work since 1998: smart cards and RFIDs, IoT and embedded platforms, mobile handsets, trusted execution environments, smart contracts, avionics and drones, cyber-physical interfaces, and cloud execution environments. More recently my group has worked on memory-controller and micro-architectural attacks, automated fuzzing for ARM IoT devices, control-flow attestation, mobile phone forensics, and the protection of AI models and data on embedded and distributed platforms.
Research
Research themes
My research explores how trusted computing and secure system architectures can protect connected, embedded and AI-enabled systems.
Trusted and confidential computing
Trusted execution environments, platform attestation and hardware-supported protection for sensitive applications, data and AI workloads — smart cards, Intel SGX, ARM TrustZone, AMD SEV and Trusted Platform Modules.
Security and trustworthiness of AI-enabled systems
Protecting AI models, data and decision-making in embedded, autonomous and distributed environments, including trusted execution, secure deployment and privacy-preserving collaborative learning.
Embedded and automotive security
Security architectures for embedded, connected and autonomous platforms, including AI-enabled intrusion detection, in-vehicle networks, ECU security and over-the-air update integrity.
Security of autonomous systems
Trustworthy operation of systems that use AI to sense, decide and act — integrity, resilience and verifiable execution across vehicles, unmanned aircraft and industrial control.
Platform attestation
Verifying that a platform is in a known state before anything sensitive happens — including control-flow attestation, which checks runtime behaviour rather than just the boot image.
Avionics and drone security
Flight controller integrity, ground station security, GPS spoofing and jamming countermeasures, and attestation built to the constraints of airborne embedded hardware.
Mobile device and media security
Android and iOS security architectures, secure element integration, sensor-based covert channels, and the DRM systems that protect commercial media on five billion handsets.
Payment and transport systems
EMV and contactless payment protocols, tokenisation, relay-attack detection using ambient sensors, and the ticketing infrastructure that moves cities.
Profiles
Publications and research profiles
Royal Holloway Pure
The institutional record of record, with full metadata and open-access files.
pure.royalholloway.ac.uk
Google Scholar
Citation counts, h-index and the papers that cite this work.
scholar.google.com
DBLP
The computer science bibliography, with co-author graph and BibTeX export.
dblp.org
Recent publications
Selected publications
The most recent work.
2026
W3C Encrypted Media Extensions in Practice: A Closer Look at Security and Privacy Risks
Amir Rafi, Konstantinos Markantonakis, Hamza Rafi, Carlton Shepherd, Zhanyu Sha
8th IEEE International Conference on Signal Processing and Information Security (ICSPIS 2025)
2025
Control-Flow Attestation: Concepts, Solutions, and Open Challenges
Zhanyu Sha, Carlton Shepherd, Amir Rafi, Konstantinos Markantonakis
Computers & Security, vol. 150, art. 104254
2024
A Side-Channel Analysis of Sensor Multiplexing for Covert Channels and Application Fingerprinting on Mobile Devices
Carlton Shepherd, Jan Kalbantner, Benjamin Semal, Konstantinos Markantonakis
IEEE Transactions on Dependable and Secure Computing, vol. 21, no. 4
2024
CO-TSM: A Flexible Model for Secure Embedded Device Ownership and Management
Konstantinos Markantonakis, Ghada Arfaoui, Sarah Abu Ghazalah, Carlton Shepherd, Raja Naeem Akram, Damien Sauveron
Smart Cities, vol. 7, no. 5, pp. 2887–2909
2023
A First Look at Digital Rights Management Systems for Secure Mobile Content Delivery
Amir Rafi, Carlton Shepherd, Konstantinos Markantonakis
22nd IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom 2023)
Books
Books
A body of work spanning nearly two decades, charting the evolution of secure computing from multi-application smart cards to today’s trusted execution environments.
2024
Trusted Execution Environments
Carlton Shepherd and Konstantinos Markantonakis
ISBN 978-3-031-55560-2
Springer
2017
Smart Cards, Tokens, Security and Applications
Keith Mayes and Konstantinos Markantonakis (eds.) — second edition
ISBN 978-3-319-50498-8
Springer
2014
Secure Smart Embedded Devices, Platforms and Applications
Konstantinos Markantonakis and Keith Mayes (eds.)
ISBN 978-1-4614-7914-7
Springer
2008
Smart Cards, Tokens, Security and Applications
Keith E. Mayes and Konstantinos Markantonakis (eds.) — first edition
ISBN 978-0-387-72197-2
SpringerSupervision
Doctoral supervision
I supervise doctoral students on trusted execution environments, payment system security, automotive and embedded systems security, resilient embedded sensors, AI and cloud execution attacks and countermeasures. This work increasingly turns on protecting AI models, data and decisions on the devices and platforms where they run. I have supervised more than 17 doctorates through to completion since 2004.
I am always interested in hearing from strong candidates with a background in computer science, information security, electronic engineering or computer engineering. Practical competence — particularly in software development — is especially valued, alongside a strong interest in systems security and trusted computing.
Current doctoral students
- Nicola BatesCyber deterrence
- Amir RafiMedia and DRM security
- Zhanyu ShaControl-flow attestation
- Makarand KaranjalkarThreat intelligence
News
Latest news
Papers, awards, disclosures and appointments.
October 2026The centre is renamed TASCAfter more than twenty years, the Smart Card and IoT Security Centre was renamed the Trustworthy, Embedded and Autonomous Systems…July 2026Control-flow attestation via symbolic replayZhanyu Sha, with Dr Carlton Shepherd and Amir Rafi, released KS-CFA, which performs control-flow attestation by symbolic replay in…January 2026Security and privacy risks in W3C Encrypted Media ExtensionsAmir Rafi presented the group’s analysis of the W3C Encrypted Media Extensions standard at IEEE ICSPIS. EME underpins protected…March 2025First comprehensive survey of control-flow attestationZhanyu Sha, Dr Carlton Shepherd, Amir Rafi and I published a survey of control-flow attestation in Computers & Security. It…January 2025A secret sharing approach to packet-based cheating in online gamesYaqi Cai, Dr Carlton Shepherd and I released work on network packet-based cheats in multiplayer online games, proposing a secret…June 2024Trusted Execution Environments published by SpringerDr Carlton Shepherd and I published Trusted Execution Environments, the first book-length treatment of modern TEEs. It runs from…2024Covert channels in Android sensor multiplexingWork with Dr Carlton Shepherd, Dr Jan Kalbantner and Benjamin Semal, published in IEEE Transactions on Dependable and Secure…2024Ambient sensors for relay attack detection, reproducedA reproducibility study in IEEE Access revisited whether ambient sensors can reliably establish proximity in NFC transactions — a…November 2023First security evaluation of mobile DRM systemsAmir Rafi presented the first domain-specific security evaluation of mobile Digital Rights Management systems at IEEE TrustCom. The…