Ehsan Toreini
About.
:: 1303 Words

I am a Senior Research Engineer (Web Standards Technologist) at Samsung Research UK and an Associate in the W3C Technical Architecture Group (TAG). My career bridges academic cryptography, applied software engineering, and Web standardisation.

Career Timeline

  • 2025–Present: Senior Research Engineer (Web Standards Technologist) · Samsung Research UK
  • 2025–Present: Associate · W3C Technical Architecture Group
  • 2019–2025: Academic Research & Leadership · Trustworthy ML, privacy, fairness, and socio-technical security (University of Surrey / Durham University / Newcastle University)
  • 2018–2025: Invited Expert · W3C Device & Sensors Working Group.
  • 2016–2019: Applied Researcher · Mobile/browser security and sensor privacy, influencing browser engine and W3C security changes.
  • 2011–2017: Early Security Research · Authentication, cryptography, physical security, and side-channels.

Research Leadership & Cross-Institutional Collaboration

Bridging theoretical security and real-world deployment requires significant ecosystem collaboration. During my academic tenure, I served as a Principal Investigator (PI), Co-Investigator (Co-I), and collaborative lead on consortia focusing on privacy-enhancing technologies, trustworthy AI, and platform security.

I have contributed to securing over £4.2 million in grant funding across collaborative programmes, including direct responsibility for a £1 million local budget within AGENCY.

  • EPSRC AGENCY (£3.2M): Co-Investigator for a major UKRI consortium assuring citizen agency against complex online harms. As Project Local Lead in Durham University, I managed £1M of the total fund and led a cross-disciplinary team of five academics to develop adaptive Privacy-Enhancing Technologies (PETs).
  • Trustworthy AI / KTPs (£780k): Co-Investigator on two Knowledge Transfer Partnerships applying verifiable machine learning frameworks to commercial environments (a £500k healthcare system and a £280k investment management solution).
  • Apple Security Research Device Program: Secured collaborative access to specialised Apple hardware alongside Royal Holloway University of London to conduct mobile-security threat modelling.
  • PETRAS CyFer (£220k): Co-Investigator researching cybersecurity, privacy, and bias vulnerabilities in female-oriented health technologies.
  • W3C Standardisation (StandICT): Secured European Commission funding to collaborate directly with the W3C, focused on the mitigation of hardware sensor API privacy leakages within browser engines.

Doctoral Supervision & Team Building

As a research leader, I secured three fully funded home-student PhD scholarships (at the University of Surrey and Durham University) to direct active research into:

  1. Trustworthy physical fraud detection with machine learning (2024).
  2. Security and privacy of accessibility technologies (2023).
  3. Privacy-preserving, fair machine learning (2022).

Selected Technical Work

Beyond theoretical research and standardisation, I develop the systems and proofs-of-concept required to validate threat models and test cryptographic primitives.

  • DOMtegrity: Proposed and developed a cryptographic architecture to protect the Document Object Model (DOM) against manipulation by malicious or overly permissive browser extensions.
  • PINlogger.js (Sensor Side-Channel Exploit): Demonstrated how mobile browser orientation and motion APIs leak user input, contributed to subsequent changes in W3C sensor permission gating.
  • Acoustic Attacks: Proved the practicality of acoustic side-channel attacks on physical keyboards using deep learning and standard smartphone microphones, highlighting new vectors for data leakage.
  • Cryptographic Physical Authentication (Texture to the Rescue): Developed a physical-object authentication mechanism that derives a compact fingerprint from the internal texture of paper and uses error-correction techniques to support privacy-preserving authentication.
  • Verifiable E-Voting: Worked on electronic voting systems using homomorphic encryption and zero-knowledge proofs, designed to support voter privacy and publicly verifiable tallying.

Public Engagements (Selected)

Selected Media Coverage

Awards & Recognition

Patents

  • US Patent (10,841,098): describes a method for preventing counterfeiting by capturing an image of an object’s partially transparent internal structure, encoding its texture features, and recording the resulting code for later authentication.
  • US Patent (10,680,825): this patent covers methods and apparatus for encoding features of an object’s internal structure and using the resulting code to help authenticate the object.

Exhibitions

  • Co-organiser of the Cyfer art exhibition: artworks and designs that respond to scientific research on the privacy, security, and ethics of female-oriented technology. Some artefacts were later exhibited at the Victoria and Albert Museum for two weeks.

Academic Services