Analysing Security Measures/Security Measures for Analyzability

• Applicant: Professor Dr.-Ing. Sebastian Altmeyer
• Subject Area: Security and Dependability, Operating-, Communication- and Distributed Systems
• Term: since 2026
• Project identifier: Deutsche Forschungsgemeinschaft (DFG) - Project number 570584828

Many systems that we consider today to be part of our so-called critical infrastructure are safety-critical embedded real-time systems. Examples of these systems include the power grid and the individual systems that make sure that supply matches demand, water and waste-water treatment systems, autonomous vehicles, surgical robots and many other medical or industrial systems. These systems or subsystems of larger systems are typically resource-constrained and specifically designed to allow analysis of their worst-case behavior to guarantee that results are available latest when the controlled physical system needs them. Unfortunately, as part of our critical infrastructure, these systems are also targets of cyberattacks and require therefore stringent protection. The problem, which this project sets out to address is that the tools and methods, which are at our disposal today to fend-off adversaries and safely operate through cyberattacks are not well suited to ensure the timely operation of these systems. This in turn risks their safety, the safety of the environments in which they operate, or of the humans that reside in their proximity. The reasons for this are twofold: Firstly, the tools we use to analyse the worst-case timing behavior of such systems cannot cope with many of the mentioned security measures and most security measures that can be analyzed either lead to overly pessimistic worst-case behaviors or they have been proven ineffective in providing the security we desire. Secondly, several effective security mechanisms are deemed too costly for embedded systems in terms of resource usage and verification effort. For instance, randomization techniques, which effectively protect against code injection attacks, are not suitable for safety-critical embedded systems due to excessive runtime overheads and because randomized program variants remain untested. In this project, the Embedded Systems group of Universitaet Augsburg and the Critical and Extreme Security and Dependability group at SnT, University of Luxembourg join forces to address these concerns. We do so by researching how analysis tools can be improved to include more security measures in the embedded systems development process and by developing security measures that are tailored towards resource constrained safety-critical systems.

• DFG Programme: Research Grants
• International Connection: Luxembourg
• Cooperation Partner: Professor Dr.-Ing. Marcus Völp