Fault-Tolerance in Cloud Computing Environments  – English only

Cloud computing has emerged as a cost-effective solution for acquiring scalable computing resources.
In order to ensure high availability and reliability, cloud providers rely on fault-tolerance mechanisms to cope with hardware failures, software errors, or interrupted network connections.
The goal of this seminar is to examine different fault-tolerance mechanisms used by established cloud computing providers such as AWS or Microsoft Azure.

Alexander Heß

Post-Quantum Cryptography  – English only

The security of most of today's asymmetric cryptographic schemes is based on the assumption that the discrete logarithmic problem is hard to compute.
However, with the advent of quantum computing, the security of these schemes is at risk in the indeterminate future.
The goal of this seminar is to discuss the implications of the ongoing progress in quantum computing, and explore cryptographic systems that will resist powerful quantum computers in the future.

Alexander Heß

Data Consistency in Distributed Systems  – English only

Consistency models allow to reason about the state of a distributed system, where data is stored and processed across multiple nodes.
A given consistency model defines rules for the order of arrival and appearance of updates, while the strictness of the rule set always provides a trade-off between consistency guarantees and implementation effort.
The goal of this seminar is to examine different consistency models and discuss their applications in real-world systems.

Alexander Heß

Request-level deterministic multithreading: How to solve the problem? – English only

For state-machine replication, a fault-tolerance approach, a deterministic execution of client requests is mandatory. This can be easily achieved by sticking to strict sequential execution. As this is not very efficient under high load, some research was done how to achieve deterministic multithreading (DMT), i.e. allowing concurrent client requests to be processed in concurrent threads, but still achieving determinism. Request-level DMT is one category of approaches. The student is expected to look at some of the many approaches and also give own thoughts about how the problem could be solved.

Franz J. Hauck

Egalitarian consensus protocols – English only

Classic multi-consensus protocols are used to deliver client request in a deterministic order to replicas of a replicated state machine. Typically a leader acts as a sequencer and proposes the order of requests. However, the protocol is robust to tolerate a faulty leader and elect a new one without compromising the delivery order. Egalitarian multi-consensus protocols allow multiple leaders at the same time and do not provide a total order but a partial one so that independent requests could be executed in different order or even concurrently in replicas. The student is supposed to present one of the egalitarian algorithms with a focus on the dependency tracking and its correctness so that the partial order is achieved in every replica under all circumstances.

Franz J. Hauck

Gamification vs. Privacy: Identifying and Analysing the Major Concerns  – English only

Education gamification refers to the use of game design elements and mechanics in educational contexts to enhance learning experiences and outcomes. It involves incorporating elements like points, levels, badges, challenges, and leaderboards into educational activities to make them more engaging, interactive, and motivating for students. It often involves digital platforms or applications that gather information about students' interactions, performance, and progress within the gamified environment. This data may include personal information, such as student names, ages, and learning preferences, as well as behavioural data related to their gameplay. The handling of such sensitive data raises concerns about privacy, data security, and potential misuse or unauthorized access.
Initial reading list:

• www.mdpi.com/1999-5903/11/3/67
• link.springer.com/chapter/10.1007/978-3-030-27813-7_8
• www.intechopen.com/chapters/71045
• www.intechopen.com/chapters/76455
• dl.acm.org/doi/10.1145/3503823.3503857

Mostafa Yehia

Privacy Preservation in eLearning: Exploration and Analysis  – English only

eLearning, short for electronic learning, refers to the process of using technologies to deliver educational content and facilitate learning outside of traditional classroom settings. It encompasses a wide range of activities and resources, including online courses, virtual classrooms, educational websites, multimedia presentations, and interactive simulations. Privacy concerns in eLearning stems from the extensive collection and storage of learner data, and extends to the sharing of this data with third parties, risks to anonymity and identification, limited consent and control over data usage, potential profiling and targeting practices, and the need for legal and regulatory compliance.
Initial reading list:

• ieeexplore.ieee.org/document/10031904
• ieeexplore.ieee.org/document/5359353
• link.springer.com/chapter/10.1007/978-0-387-73655-6_15
• doi.org/10.55630/STEM.2023.0512

Mostafa Yehia

Privacy-Preserving Learning Analytics: Challenges and Techniques – English only

Learning analytics (LA) refers to the process of collecting, analysing, and interpreting data from educational activities. It involves using this data to understand and optimize learning and the environments in which it occurs. Privacy-preserving learning analytics (PPLA) is a field aimed at balancing the benefits of LA with the protection of individuals' privacy in educational settings.
Initial reading list:

• ieeexplore.ieee.org/document/7563858
• bera-journals.onlinelibrary.wiley.com/doi/10.1111/bjet.13234
• link.springer.com/chapter/10.1007/978-981-16-0882-7_53
• dl.acm.org/doi/10.1145/2567574.2567613
• dl.acm.org/doi/10.1145/3027385.3027414

Mostafa Yehia

Smartphone Theft Protection  – English only

Goal of this work is to detail modern smartphone theft protection mechanisms. These should be compared. Can attacker bypass these protections?

Leonard Bradatsch

Google Dorking  – English only

Goal of this work is to give an overview of useful Google dorks. Additionally, up-to-date examples of actually working Google dorks should be given (picked from GHDB). During the presentation, a live demonstration should be given.

Leonard Bradatsch

Network Security Breaches  – English only

The goal of this seminar is the outlining of popular network security breaches (1-3 examples). Subsequently, state-of-the-art protection or detection approaches against these presented breaches should be explained.

Leonard Bradatsch

Vehicle Platooning  – English only

Vehicle Platooning is one of the most promising applications that can be realized with Vehicular ad hoc networks (VANETs). It is a method for driving in a group of vehicles with a small distance between the them. This offers many benefits such as increasing road capacity and reducing fuel consumption. Despite the benefits, Vehicle Platooning also has limitations and challenges. In this seminar, you will analyze vehicle platooning by describing its limitations and challenges. Furthermore, approaches to overcome these limitations and challenges are explained.

Artur Hermann

Misbehavior Detection in VANETs  – English only

Vehicular ad hoc networks (VANETs) enable vehicles to communicate with each other and with infrastructure. In this way, vehicles can send messages, e.g., that there is a traffic jam ahead, which increases safety and efficiency. For the correct and safe operation of applications, it is important that the information sent by other vehicles is trustworthy or can be verified. In this seminar you will describe several approaches to detect misbehavior of vehicles in VANETs.

Artur Hermann

Security mechanisms in in-vehicle networks  – English only

Modern vehicles contain many ECUs that are responsible for various functions of the vehicle. These ECUs are interconnected through in-vehicle networks, such as CAN-bus. Important components of the vehicle, such as brakes or airbags, are controlled via the ECUs. Therefore, ensuring the integrity of in-vehicle communication and ECUs is crucial for safety. In this seminar, you will provide an overview of threat in in-vehicle networks and ECUs. In addition, protection mechanisms for these threats will be described.

Artur Hermann

Current Trends in Automatic Log Parsing  – English only

Logs contain rich information about the internal state of applications and are thus regularly used for anomaly detection.
However, logs need to be brought into a structured format before they can be processed.
While this can be done by manually writing Regexes, automatic approaches for this task are preferable.
With the advent of Large Language Models like ChatGPT, research in the field of automatic log parsing has shifted towards combining artificial intelligence with classical algorithms and produced promising results.
This topic's aim is to give an overview on the latest developments in automatic log parsing and to compare AI-assisted algorithms to their classical, established counterparts.

Juri Dispan

WebAssembly – English only

Web Assembly (WASM) is an emerging technology in web development that provides high-performance execution of code in web browsers. WASM allows developers to compile code from many languages, such as C/C++ and Rust, into a portable binary code format that can run efficiently alongside JavaScript in web browsers. In this seminar, you will explore the fundamental concepts behind WASM, including its design principles, execution model, and integration with existing Web technologies. In addition, this topic should explore the practical applications of WASM in various domains, such as gaming, multimedia, and computational tasks traditionally reserved for native applications. Finally, this seminar should analyze the ecosystem surrounding WASM, including the tools, libraries, and frameworks available to developers for building and optimizing WASM modules.

Echo Meißner

Algorithms and Data Structures for Streaming Data  – English only

In modern distributed systems, the management of streaming data has gained widespread prominence, especially in the context of delivering near-realtime capabilities. This seminar delves into the intricate realm of algorithms and data structures that are necessary for the efficient and scalable handling and processing of such data streams.

Benjamin Erb

Fooling GPT: Prompt-based adversarial attacks against and defenses for large language models  – English only

Becoming the core of the business logic of applications, large language models (LLMs) like GPT also start to attract the attention of malicious actors. Even without access to the model's internals, prompt-based adversarial attacks also called prompt injection attacks pose a threat to the reliability of such systems. This seminar topic shall collect examples for prompt injection attacks, investigate how these attacks succeed to fool a LLM and describe a selection of options to defend against these attacks.

Stephan Kleber (Mercedes-Benz Tech Innovation)

Sorted by Topics

• Automotive Computing and Automotive Security
  • Security mechanisms in in-vehicle networks
  • Vehicle Platooning
  • Misbehavior Detection in VANETs
• Privacy
  • Gamification vs. Privacy: Identifying and Analysing the Major Concerns (English only)
  • Privacy Preservation in eLearning: Exploration and Analysis (English only)
  • Privacy-Preserving Learning Analytics: Challenges and Techniques (English only)
• IT-Security
  • Network Security Breaches
  • Smartphone Theft Protection
  • Google Dorking
• Distributed Systems, AI and Beyond
  • Fooling GPT: Prompt-based adversarial attacks against and defenses for large language models
  • Current Trends in Automatic Log Parsing
  • Post-Quantum Cryptography
  • WebAssembly
  • Algorithms and Data Structures for Streaming Data
• Fault-Tolerance and Consensus
  • Fault-Tolerance in Cloud Computing Environments
  • Data Consistency in Distributed Systems
  • Request-level deterministic multithreading: How to solve the problem?
  • Egalitarian consensus protocols

The FLP Impossibility in Practice  – English only

The FLP impossibility theorem has been named after its contributing authors Fischer, Lynch, and Paterson. It states that it is impossible to deterministically reach consensus in an asynchronous system in case there is a single faulty node. Although this theorem has been proposed and proven multiple decades ago, a variety of consensus protocols were introduced in the meantime that seem to solve the problem in practical applications like distributed data stores. The task of this seminar is to provide a comprehensible introduction to the FLP impossibility theorem, and discuss its implications in practice.

Alexander Heß

ChatGPT - uses and limitations  – English only

This seminar paper's goal is to examine ChatGPT, a language model developed by OpenAI which utilizes the GPT-3.5 architecture to generate human-like responses in conversational contexts. Aside from explaining the inner workings of ChatGPT, the paper ought to present its wide range of applications, as well as its inherent limitations. By analyzing its uses and limitations, we can gain a deeper understanding of the potential and challenges associated with this advanced AI technology.

Natasa Trkulja

Comparative Analysis of CV2X and DSR  – English only

This seminar paper aims to delve into the key differences between two prominent vehicular communication technologies, namely CV2X (Cellular Vehicle-to-Everything) and DSRC (Dedicated Short-Range Communication). As the automotive industry embraces the era of connected vehicles, it is crucial to understand the unique characteristics, functionalities, and potential applications of these technologies. By examining the fundamental dissimilarities between CV2X and DSRC, this paper intends to shed light on their respective advantages, limitations, and implications for the future of intelligent transportation systems.

Natasa Trkulja

Trusted Execution Environments  – English only

The concept of trusted execution environments (TEEs) has gained significant attention in the field of computer security. TEEs provide a secure and isolated environment within a computer system, offering protection for sensitive data and enabling the execution of trusted code. This seminar paper explores the fundamental aspects, key technologies, applications, and challenges associated with trusted execution environments.

Natasa Trkulja

Public Key Authentication vs Password Authentication  – English only

For this topic, the goal is to comprehensively analyze password authentication and public key authentication.The outcome of the work should be a profound statement about the procs and cons of each authentication method.

Leonard Bradatsch

State of Cloud (End-to-End) Encryption  – English only

Goal of this seminar is to analyze which cloud provider provide which encryption methods. Which cloud provider actually does support end-to-end encryption for the user data? A profound answer to this question should be exactly the outcome of this seminar work.

Leonard Bradatsch

Network Security Breaches  – English only

The goal of this seminar is the outlining of popular network security breaches (1-3 examples). Subsequently, state-of-the-art protection or detection approaches against these presented breaches should be explained.

Leonard Bradatsch

Vehicle Platooning  – English only

Vehicle Platooning is one of the most promising applications that can be realized with Vehicular ad hoc networks (VANETs). It is a method for driving in a group of vehicles with a small distance between the them. This offers many benefits such as increasing road capacity and reducing fuel consumption. Despite the benefits, Vehicle Platooning also has limitations and challenges. In this seminar, you will analyze vehicle platooning by describing its limitations and challenges. Furthermore, approaches to overcome these limitations and challenges are explained.

Artur Hermann

Misbehavior Detection in VANETs  – English only

Vehicular ad hoc networks (VANETs) enable vehicles to communicate with each other and with infrastructure. In this way, vehicles can send messages, e.g., that there is a traffic jam ahead, which increases safety and efficiency. For the correct and safe operation of applications, it is important that the information sent by other vehicles is trustworthy or can be verified. In this seminar you will describe several approaches to detect misbehavior of vehicles in VANETs.

Artur Hermann

Security mechanisms in in-vehicle networks  – English only

Modern vehicles contain many ECUs that are responsible for various functions of the vehicle. These ECUs are interconnected through in-vehicle networks, such as CAN-bus. Important components of the vehicle, such as brakes or airbags, are controlled via the ECUs. Therefore, ensuring the integrity of in-vehicle communication and ECUs is crucial for safety. In this seminar, you will provide an overview of threat in in-vehicle networks and ECUs. In addition, protection mechanisms for these threats will be described.

Artur Hermann

Automatic Log Parsing  – English only

Logs contain rich information about the internal state of applications and are thus regularly used for anomaly detection. However, logs need to be brought into a structured format before they can be processed. While this can be done by manually writing Regexes, automatic approaches for this task are preferable. This seminar topic's aim is to give an overview on common approaches for automatic log parsing and to compare their respective strenghts and weaknesses.

Juri Dispan

Self-Destructing Data  – English only

The internet never forgets – or does it? The concept of self-destructing data was made popular by services like Snapchat and Instagram and promises to give back control of personal data to users. However, users have to trust these services to actually delete data once expired. Fortunately, there are other, decentralised methods for realising self-destructing data which do not depend on a trusted third party. The goal of this topic is to investigate these approaches and discuss their strengths as well as their limitations.

Juri Dispan

Secure Multiparty Computation  – English only

Secure Multiparty Computation (MPC) allows parties to perform computations on private data without ever knowing these data. It plays an important role in solving security and privacy issues and has been deployed in numerous real-world settings. The goal of this seminar topic is to investigate MPC, describe one protocol for realising it and critically reflect on theoretical and practical aspects.

Juri Dispan

Hardware Security Modules  – English only

A hardware security module (HSM) is a physical computing system that safeguards and administers digital keys, performs digital signatures, encryption and decryption functions, authentication, and other cryptographic functions. Traditionally such modules come in the form of a plug-in card, an external unit that is directly connected to a computer or network server, an extra chip close to the CPU, or even build into a processor, but also cloud based HSM exists. Your task is explain a HSM in detail, how it is used, how it protects the keys from tampering, why it performs so well, etc...

Michael Wolf (Mercedes-Benz Tech Innovation)

Mitigating evasion attacks on machine learning models for image recognition  – English only

Evasion attacks aim to mislead a machine learning model, often such ones used for image recognition, to prevent an object from being detected or classified. This seminar topic shall collect existing mitigations for evasion attacks against image recognition models. A selection of at least three conceptually different mitigations shall be compared with each other with focus on the effect the mitigations may have to protect cyber-physical systems against the threat that evasion attacks may pose.

Stephan Kleber (Mercedes-Benz Tech Innovation)

Sorted by Topics

• Automotive Computing and Automotive Security
  • Security mechanisms in in-vehicle networks
  • Vehicle Platooning
  • Misbehavior Detection in VANETs
  • Comparative Analysis of CV2X and DSRC
• IT Security
  • Network Security Breaches
  • Mitigating evasion attacks on machine learning models for image recognition
  • State of Cloud (End-to-End) Encryption
  • Public Key Authentication vs Password Authentication
• Distributed Systems, AI and Beyond
  • The FLP Impossibility in Practice
  • ChatGPT - uses and limitations
  • Automatic Log Parsing
  • Self-Destructing Data
• Trusted and Secure Computing
  • Secure Multiparty Computation
  • Trusted Execution Environments
  • Hardware Security Modules

Multi-factor Authentication and WebAuthn  – English only

Multi-factor authentication is a part of modern authentication architectures where a user has to present more than one type of evidence to authenticate themselves. In recent years, this has also become commonplace for web applications, and in the case of online banking, has even been mandated by law. Using multiple authentication factors can significantly improve security, as weak or stolen passwords are the most common way user accounts are compromised. Common implementations of additional factors include generated one-time passwords via mobile apps (e.g., Google Authenticator), biometric data (e.g., smartphone fingerprint sensors), and hardware tokens (e.g., YubiKey). Recently the world wide web consortium standardized the WebAuthn standard to provide a standardized authentication interface within web applications. This seminar should explore the authentication design space and explore the authentication paths that the Web Authentication standard provides.

Echo Meißner

Zero-knowledge Proofs – English only

In cryptography zero-knowledge proofs are protocols for two parties where on party can proof a statement to a verifying party without revealing additional information to the verifier except that the statement is true. This cryptographic building block is used within a variety of applications and other cryptographic protocols, such as authentication, distributed ledgers, and online voting. This topic should introduce zero-knowledge proofs and provide an overview of different types of zero-knowledge proofs as well as how proofs for different statements can be constructed.

Echo Meißner

Secure In-Vehicle Communication – English only

Modern vehicles contain many ECUs that are responsible for various functionalities of the vehicle. These ECUs are interconnected with each other through bus communication systems. Such in-vehicle networks have access to crucial components of the vehicle, such as breaks or airbags. Assuring the integrity and authenticity of in-vehicle communication is therefore critical to safety. In this seminar, an overview of in-vehicle communication systems will be provided. In addition, possible attacks on in-vehicle networks and possible countermeasures / security mechanisms will be described.

Artur Hermann

Opportunities and challenges of vehicular edge computing – English only

Many vehicular applications, such as autonomous driving, will require a lot of computing and storage capacities in the future. In addition, these applications will have stringent performance requirements in terms of response time and network bandwidth. One way to meet these requirements is vehicle edge computing, which places computing and storage capacity at the edge of the network. This offers many opportunities. On the other hand, it also results in many challenges. In this seminar, these opportunities and challenges of vehicular edge computing will be identified and possible solutions will be described.

Artur Hermann

Network Security Breaches – English only

The goal of this seminar is the outlining of popular network security breaches (1-3 examples). Subsequently, state-of-the-art protection or detection approaches against these presented breaches should be explained.

Leonard Bradatsch

Perimeter Security and why it is no longer sufficient – English only

Perimeter security is still the dominant network security architecture in 2022. In this paper, the basic principle of perimeter security will be presented. Above all, however, the weak points are to be pointed out.

Leonard Bradatsch

Automotive Cybersecurity – English only

The goal of this seminar paper is to conduct a survey of the latest cybersecurity attacks in the automotive domain while explaining the functionality of each attack and its effectiveness. In addition, the paper should explore any defense mechanisms implemented to protect against these attacks.

Natasa Trkulja

The Edge of Artificial Intelligence – English only

This seminar paper is meant to explore the limits that the field of artificial intelligence had reached in terms of computer vision (seeing), speech recognition (hearing), chat and voicebots (speaking), and machine learning (analyzing and predicting). How close/far are the capabilities of artificial intelligence to those of humans?

Natasa Trkulja

Trust in Computing – English only

The goal of this seminar paper is to first investigate how trust is defined in computing systems and what some of the properties of this trust are. Secondly, the paper should explore different mechanisms of establishing trust in such systems. Finally, the paper should analyze and compare various mathematical methods for assessing levels of trust between any two computing devices.

Natasa Trkulja

(Topic still available, contact B. Erb if interested) Privacy-preserving Machine Learning in healthcare domain – English only

Hospitals, other public institutions or companies are using medical information to perform computations and use the results for their own analysis. However, the data being collected or shared, might be sensitive and leak critical information about the data source. Therefore, Privacy-Preserving Machine Learning (PPML) plays an essential role, enabling machine learning process without compromising the private data. The goal of this seminar is to give an overview of PPML approaches applied in the healthcare domain, while explaining their role in protecting health data.

Migena Ymeraj

(Topic still available, contact B. Erb if interested) Federated Learning – English only

Federated Learning (FL) is a privacy-preserving machine learning technique, enabling parties to train their own model, using their own data on the device. An important aspect of FL is that this data never leaves the device. Your task in this seminar is to investigate the role of FL in supporting privacy-sensitive applications, while analyzing its advantages and core challenges.

Migena Ymeraj

Distributed Machine Learning – English only

Due to the poor scalability and efficiency of learning algorithms, Machine Learning cannot handle large-scale data. This issue gave rise to Distributed Machine Learning. Even though it is a promising line of research, it still faces a lot of challenges. The goal of this seminar is to discover the importance of Distributed Machine Learning, while comparing it with traditional Machine Learning environments and investigating its challenges.

Migena Ymeraj

Secure Multi-Party Computation – English only

The goal of Secure Multi-Party Computation (MPC) is to enable parties to work together without ever knowing one another's confidential information. It plays an important role in solving security and privacy issues and there are many examples of where it can be helpful. The aim of this seminar is to investigate MPC with respect to both theoretical and practical aspects.

Migena Ymeraj

Hacking the Switch Console – English only

The first version of the Switch had a structural flaw which made it possible to hack the device and gain root control withouth Nintendo being able to patch it via a software update. The only solution was a change in the hardware. In this seminar you describe the attack in detail, how it was fixed and give a statement if this kind of attack is possible in other (older) consoles. Additionally you describe the area of hacking consoles in general.

Michael Wolf (Mercedes-Benz Tech Innovation)

Feasibility of real-world evasion attacks against machine learning for image recognition – English only

This seminar topic shall compare existing machine learning evasion attacks on image recognition models to estimate their feasibility under the assumption of a limited attacker. Thus, the most recent attacks that propose to work with a physical patch or object–forged to manipulate the recognition outcome without direct access to the software or hardware (e. g., digital camera image)–should be identified from literature. A selection of three of these attacks should be compared with each other with focus on the qualitative discussion how likely the attack may be a threat to a deployed cyber physical system.

Stephan Kleber (Mercedes-Benz Tech Innovation)

Consensus in Distributed Data Stores – English only

Distributed data stores are able to provide fault tolerance by distributing the stored data over multiple nodes. Hereby, it is important to ensure consistency among those nodes if write-operations are performed. These operations have to be propagated and ordered on all nodes, which is typically achieved with the use of a consensus protocol. The task of this seminar is to provide insights into the internal consensus mechanisms of different distributed data stores such as etcd, Zookeeper or LogDevice.

Alexander Heß

(Topic still available, contact B. Erb if interested) The FLP Impossibility in Practice – English only

The FLP theorem has been named after its contributing authors Fischer, Lynch, and Paterson. It states that it is impossible to deterministically reach consensus in an asynchronous system in case there is a single faulty node. This theorem has been proposed and proven multiple decades ago and yet, a large number of different consensus protocols were introduced in the meantime that seem to solve the problem in practice. The task of this seminar is to provide a comprehensible introduction to the impossibility theorem, and discuss its implications in practice.

Alexander Heß

TPMs in Cloud Computing – English only

A Trusted Platform Module is a cryptographic coprocessor that provides secure key storage and a variety of cryptographic functionality. Although these modules have already been embedded in a variety of laptops and desktop computers over the last decade, their presence remained quite unnoticed up until the introduction of Windows 11. However, TPMs are in extensive use in the cloud computing domain for quite a while now. The task of this seminar is to provide an overview of the TPM functionality set and its use in state-of-the-art cloud computing infrastructure.

Alexander Heß

Request-level deterministic execution: an overview – English only

For fault-tolerant services, e.g. replicated state machines, a deterministic execution is required. Sequential execution combined with the same input in all replicas is a simple but inefficient way to do so. Request-level approaches need knowledge about conflicting and non-conflicting requests, and execute conflicting requests sequentially whereas non-conflicting concurrently. The seminar student is supposed to give an overview over the various existing request-level approaches and their pros and cons.

Franz J. Hauck

Github Copilot and others: AI techniques for automatic code generation – English only

AI models are already used to support software development by generating code snippets from paraphrased task descriptions. The seminar student is supposed to investigate current and practically available approaches, focus on the most interesting tools, and introduce their capabilities based on examples. The investigation part is also expected to include personal and practical trials of the tools. The seminar report could also contain own conclusions from experiences with the tools. The scope of the seminar work is also to show current limits and to compare features.

Franz J. Hauck

Sorted by Topics

• Artificial Intelligence
  • The Edge of Artificial Intelligence
  • Github Copilot and others: AI techniques for automatic code generation
• Automotive Computing and Automotive Security
  • Automotive Cybersecurity
  • Secure In-Vehicle Communication
  • Opportunities and challenges of vehicular edge computing
• Cloud & Web
  • Consensus in Distributed Data Stores
  • TPMs in Cloud Computing
  • Request-level deterministic execution: an overview
  • Multi-factor Authentication and WebAuthn
• IT Security
  • Network Security Breaches
  • Perimeter Security and why it is no longer sufficient
  • Hacking the Switch Console
• Machine Learning
  • Distributed Machine Learning
  • Federated Learning
  • Privacy-preserving Machine Learning in healthcare domain
  • Feasibility of real-world evasion attacks against machine learning for image recognition
• Theoretical Aspepcts of Security, Privacy and Distributed Systems
  • Trust in Computing
  • Secure Multi-Party Computation
  • Zero-knowledge Proofs
  • The FLP Impossibility in Practice

IPFS and Dat – English only

The world wide web and the internet are designed as decentralized and heterogeneous networks and play an important role in our every day. However, data is often only stored at a single point or a website is only served by one web server. Once the data is deleted or a server goes offline it might be unavailable for everyone else. The InterPlanetary File System (IPFS) and the Dat project are two similar ideas to address this type of centralization using a content-addressable distributed file system. This seminar should introduce and explain IPFS and Dat, discuss use cases, and explore real world applications of these technologies.

Echo Meißner

Zero-knowledge Proofs – English only

In cryptography zero-knowledge proofs are protocols for two parties where on party can proof a statement to a verifying party without revealing additional information to the verifier except that the statement is true. This cryptographic building block is used within a variety of applications and other cryptographic protocols, such as authentication, distributed ledgers, and online voting. This topic should introduce zero-knowledge proofs and provide an overview of different types of zero-knowledge proofs as well as how proofs for different statements can be constructed.

Echo Meißner

Security and privacy problems of electric vehicle charging systems – English only

Due to the limited range of electric vehicles, they rely on electric vehicle charging stations to travel further distances. During the charging process of an electric vehicle, many components communicate with each other. This can lead to security and privacy problems if this communication is not properly secured. In this seminar, some security and privacy problems will be identified. In the next step, possible countermeasures to these problems will be determined.

Artur Hermann

Attacks in vehicular ad hoc networks – English only

Vehicular ad hoc networks (VANETs) enable vehicles to communicate with each other, but also with other components. This allows various applications to be realized that increase the safety and efficiency of vehicles. However, without protection mechanisms, attacks are possible, which can lead to safety and privacy problems. In this seminar, some well known attacks in VANETS and possible countermeasures will be identified and analyzed.

Artur Hermann

Opportunities and challenges of vehicular edge computing – English only

Many vehicular applications, such as autonomous driving, will require a lot of computing and storage capacities in the future. In addition, these applications will have stringent performance requirements in terms of response time and network bandwidth. One way to meet these requirements is vehicle edge computing, which places computing and storage capacity at the edge of the network. This offers many opportunities. On the other hand, it also results in many challenges. In this seminar, these opportunities and challenges of vehicular edge computing will be identified and possible solutions will be described.

Artur Hermann

The Edge of Artificial Intelligence – English only

This seminar paper is meant to explore the limits that the field of artificial intelligence had reached in terms of computer vision (seeing), speech recognition (hearing), chat and voicebots (speaking), and machine learning (analyzing and predicting). How close/far are the capabilities of artificial intelligence to those of humans?

Natasa Trkulja

Trading in Our Privacy – English only

The goal of this seminar paper is to investigate the types of data that is being collected through our usage of various electronic devices (smart phones, desktops, laptops, wearables, smart home devices, etc.), as well as its use. Moreover, this paper should also aim to research the technologies that are being implemented to protect our privacy and analyze their effectiveness.

Natasa Trkulja

Automotive Cybersecurity – English only

The goal of this seminar paper is to conduct a survey of the latest cybersecurity attacks in the automotive domain while explaining the functionality of each attack and its effectiveness. In addition, the paper should explore any defense mechanisms implemented to protect against these attacks.

Natasa Trkulja

Perimeter Security and why it is no longer sufficient – English only

Perimeter security is still the dominant network security architecture in 2022. In this paper, the basic principle of perimeter security will be presented. Above all, however, the weak points are to be pointed out.

Leonard Bradatsch

Attacks on WPA3 – English only

The purpose of this seminar paper is to evaluate which weaknesses WPA3 has. It will also show what went wrong (once again) during the development of the standard.

Leonard Bradatsch

Network Security Breaches – English only

The goal of this seminar is the outlining of popular network security breaches (1-3 examples). Subsequently, state-of-the-art protection or detection approaches against these presented breaches should be explained.

Leonard Bradatsch

Federated Learning – English only

Federated Learning (FL) is a privacy-preserving machine learning technique, enabling parties to train their own model, using their own data on the device. An important aspect of FL is that this data never leaves the device. Your task in this seminar is to investigate the role of FL in supporting privacy-sensitive applications, while analyzing its advantages and core challenges.

Migena Ymeraj

Distributed Machine Learning – English only

Due to the poor scalability and efficiency of learning algorithms, Machine Learning cannot handle large-scale data. This issue gave rise to Distributed Machine Learning. Even though it is a promising line of research, it still faces a lot of challenges. The goal of this seminar is to discover the importance of Distributed Machine Learning, while comparing it with traditional Machine Learning environments and investigating its challenges.

Migena Ymeraj

Secure Multi-Party Computation – English only

The goal of Secure Multi-Party Computation (MPC) is to enable parties to work together without ever knowing one another's confidential information. It plays an important role in solving security and privacy issues and there are many examples of where it can be helpful. The aim of this seminar is to investigate MPC with respect to both theoretical and practical aspects.

Migena Ymeraj

CRDTs in the Wild – English only

Conflict-free replicated data types are a concept to ensure consistency among replicated nodes even when update operations are performed concurrently. Up until now, there are two established architectures for CRDTs, accompanied by a multitude of different implementations. CRDT's achieve strong eventual consistency, which means that all replicated nodes will have the same state after they've received the same set of updates. Since this is a useful consistency model for certain applications, they are already used in various production systems. The goal of this seminar is to provide an overview of the internal mechanisms of CRDTs, and how their used in real-world applications.

Alexander Heß

Checkpoint Strategies for State-Machine Replication – English only

State-machine Replication is a well-established technique for building fault-tolerant services. With this approach, multiple replicated servers are operated that process the same sequence of requests. In a production system, replicas periodically create a checkpoint by writing their internal state to disk. This is required to rapidly recover from a crash and to garbage-collect the request log. In general, however, this requires to halt the replica's execution in order to ensure a consistent checkpoint. This in turn affects the performance of the overall system, if executed by all replica's at the same point in time. Recently, more efficient approaches have been proposed that produce comparable checkpoints, but have less of an impact on the system's performance. The task of this seminar is to elaborate the challenges of efficient checkpoint generation, and to provide an overview of different approaches that address those challenges.

Alexander Heß

Persistent Memory for State-Machine Replication – English only

State-machine Replication is a well-established technique for building fault-tolerant services. With this approach, multiple replicated servers are operated that process the same sequence of requests. In case one of these replicas suffers from a power outage, it may loose state updates that have not yet been written to disk. After a reboot, such a replica has to recover by querying other replicas for the missing data. Persistent memory modules provide a non-volatile alternative to DRAM modules. Their integration would allow to circumvent this extra step, since the replica's state can be recovered locally. However, these modules come with a performance penalty compared to DRAM modules. As a consequence, simply replacing DRAM with persistent memory modules, would drastically reduce the system's performance. In recent years, different strategies have been proposed to mitigate this performance penalty, while still achieving efficient recovery. The task of this seminar is to outline the challenges of integrating persistent memory in SMR-based system.

Alexander Heß

Linearizability in Concurrent Systems – English only

Linearizability is a strong consistency model for concurrent systems, which requires concurrent operations on shared objects to appear instantaneously. This can be achieved by defining a linearization point for operations where all modifications have to take place atomically, and which is placed somewhere between the operation's invocation and its response. Ensuring this property facilitates to reason about the internal's of a concurrent system. The goal of this seminar is to elaborate the core concepts of Linearizability and support those with illustrative examples.

Franz J. Hauck

Software Transactional Memory – English only

Software transactional memory (STM) is an abstraction mechanism that allows to make a series of modifications in memory appear as a single atomic operation. There are different design philosophies that tend to build on either pessimistic or optimistic transactional processing. While some STM implementations rely on locks, others make use of atomic instructions when accessing memory locations. Nonetheless, practical approaches have to manage multiple versions of the data that is kept in memory, and have to perform some form of dependency tracking to avoid data inconsistencies. The task of this seminar is to provide an introduction to STM, and an overview of different approaches proposed in literature.

Franz J. Hauck

Feasibility of real-world evasion attacks against machine learning for image recognition – English only

This seminar topic shall compare existing machine learning evasion attacks on image recognition models to estimate their feasibility under the assumption of a limited attacker. Thus, the most recent attacks that propose to work with a physical patch or object–forged to manipulate the recognition outcome without direct access to the software or hardware (e. g., digital camera image)–should be identified from literature. A selection of three of these attacks should be compared with each other with focus on the qualitative discussion how likely the attack may be a threat to a deployed cyber physical system.

Stephan Kleber (Mercedes-Benz Tech Innovation)

Sorted by Topics

• Automotive Security
  • Automotive Cybersecurity
  • Security and privacy problems of electric vehicle charging systems
  • Attacks in vehicular ad hoc networks
  • Opportunities and challenges of vehicular edge computing
• Machine Learning & AI
  • The Edge of Artificial Intelligence
  • Feasibility of real-world evasion attacks against machine learning for image recognition
  • Federated Learning
  • Distributed Machine Learning
• Network Security
  • Perimeter Security and why it is no longer sufficient
  • Attacks on WPA3
  • Network Security Breaches
• Concurrent and Distributed Systems
  • CRDTs in the Wild
  • Software Transactional Memory
  • Linearizability in Concurrent Systems
  • IPFS and Dat
• State-Machine Replication
  • Checkpoint Strategies for State-Machine Replication
  • Persistent Memory for State-Machine Replication
• Applied Cryptography and Privacy
  • Zero-knowledge Proofs
  • Secure Multi-Party Computation
  • Trading in Our Privacy

AlphaFold and RoseTTa - Democratizing Microbiology through Software – English only

Proteins are one of the central building blocks of biological life on earth. They perform an unimaginably large collection of tasks within our bodies every nanosecond of our existence, while we breathe and think and write seminar papers for our curriculum. The basic structure and genesis of proteins seems very simple: Proteins are created by simpy linking together molecules from a set of 20 available building blocks (called amino acids), to form long chains of these building blocks. Governed by fundamental molecular forces acting between the links of the chains, they then fold up into complicated shapes to yield a working Protein and fulfil their designated function. Since the discovery of the mechanisms behind the creation of proteins, the prediction of the resulting shape of a protein when only given the input sequence of its building blocks, i.e., how a protein folds up after being created, has been one of the longest standing and hardest problems of computational biology.
Very recently and with great fanfare, AlphaFold and RoseTTAFold, two tools to predict protein structures from an input sequence of amino acids, have been released to the public, putting the potential power of microbiological revolution at the fingertips of millions of interested researches. Being able to predict the shape of proteins allows us to design new medications against a myriad of diseases, engineer organisms to act as bioreactors for new and exciting industries, and understand life at its smallest levels. This seminar paper should provide a short introduction and overview over RoseTTAFold and AlphaFold. It should discuss their inner workings, explore introductory demos the tools provide, write about the relationship between both tools, and show their current shortcomings.

Gerhard Habiger

Authentication in Web Applications – English only

Modern web application development encompasses a variety of approaches to implement authentication and session handling, ranging from traditional password-based authentication and cookie-based session handling to multi-factor authentication and complex authentication protocols, such as OAuth, OpenID, and SAML. Depending on the requirements of the application some approaches are better suited than others. This seminar should explore the authentication design space and compare stateful and stateless session handling approaches.

Echo Meißner

Containerization Technologies – English only

Kubernetes, Docker Swarm, Openshift, Portainer, Apache Mesos and others are in everyones mind. They've been made to revolutionize how to separate several applications and software stacks from each other. But did you ever had a look at the underlying technologies? In this survey the student is asked to examine, compare and summarize the main differences between many (at least five) different OS-level virtualization technologies currently existing in modern desktop and server environments. As a first task, the student needs to introduce the main ideas behind the concepts of such user space instances and its differences to other approaches like hardware-based virtualization. Maybe, also an historical overview can be given as a guide for the reader. In a second step the student has to examine the differences of the proposed technologies and summarize them according to their dis-/advantages. Finally, the student has to conclude which technology might be the best for which use cases, e.g. working in privacy-aware, secure or speed-optimized environments.

Thomas Bläsing

Cybersecurity vulnerabilities and attacks on C-V2X networks – English only

Cellular Vehicle-to-Everything (C-V2X) networks have emerged as an alternative to Dedicated Short Range Communications (DSRC), a 802.11p-based vehicular network. C-V2X networks can operate in the so-called Mode 3, that relies on the cellular base-station to manage the allocation of frequencies for each vehicle to transmit on, as well as Mode 4, that enables the vehicles to allocate transmission frequencies on their own. This seminar aims to identify potential security vulnerabilities in C-V2X networks operating in both Mode 3 and Mode 4 and, subsequently, classify the types of attacks that could be launched on these vehicular networks.

Nataša Trkulja

Distributed Machine Learning – English only

Due to the poor scalability and efficiency of learning algorithms, Machine Learning cannot handle large-scale data. This issue gave rise to Distributed Machine Learning. Even though it is a promising line of research, it still faces a lot of challenges. The goal of this seminar is to discover the importance of Distributed Machine Learning, while comparing it with traditional Machine Learning environments and investigating its challenges.

Migena Ymeraj

Egalitarian Consensus – English only

The majority of consensus protocols require an elected leader for the coordination of the replicas, and the interaction with the clients. However, Egalitarian consensus protocols omit an explicit leader in order to provide better load-balancing throughout all replicas. While such approaches are able to achieve significantly lower latencies, given that certain preconditions are met, they also introduce further challenges in their implementation.
The task of this seminar is to dive into the internals of a few selected Egalitarian consensus protocols, and provide an overview of their architectural characteristics.

Alexander Heß

Failure Recovery from Persistent Memory in SMR – English only

Persistent memory modules provide a non-volatile alternative to DRAM modules. These modules are also accessible through the system's memory bus, however the stored data survives a power outage. While they come with a performance penalty compared to DRAM modules, their access time is still significantly faster in comparison to solid state disks.

A suitable use case for such memory modules, are state-machine replicated systems that achieve fault tolerance by operating multiple replicated servers. In case one of these replicas suffers from a power outage, it may lose state updates that have not yet been written to disk. After a reboot, such a replica has to recover by querying other replicas for the missing data. The use of persistent memory modules would allow to circumvent this extra step, since the updates are still present. However, simply replacing DRAM modules with persistent memory modules would drastically reduce the system's performance. Instead, different techniques have been proposed to mitigate their performance penalty, while still achieving efficient recovery. The task of this seminar is to provide an overview and a comparison of these different strategies.

Alexander Heß

Feasibility of real-world evasion attacks against machine learning for image recognition – English only

This seminar topic shall compare existing machine learning evasion attacks on image recognition models to estimate their feasibility under the assumption of a limited attacker. Thus, the most recent attacks that propose to work with a physical patch or object–forged to manipulate the recognition outcome without direct access to the software or hardware (e. g., digital camera image)–should be identified from literature. A selection of three of these attacks should be compared with each other with focus on the qualitative discussion how likely the attack may be a threat to a deployed cyber physical system.

Stephan Kleber (Daimler TSS)

Federated Learning – English only

Federated Learning (FL) is a privacy-preserving machine learning technique, enabling parties to train their own model, using their own data on the device. An important aspect of FL is that data never leaves the device. Your task in this seminar is to investigate the role of FL in supporting privacy-sensitive applications, while analyzing its advantages and core challenges.

Migena Ymeraj

Machine learning methods for cybersecurity applications – English only

Machine learning has been used in a variety of applications ranging from recommendation engines, medical diagnosis, financial market analysis to self-driving vehicles. The goal of this seminar is to investigate how different machine learning methods have been employed for cybersecurity applications, as well as to analyze the effectiveness of these methods in such applications.

Nataša Trkulja

Network Security Breaches – English only

The goal of this seminar is the outlining of popular network security breaches (1-3 examples). Subsequently, state-of-the-art protection or detection approaches against these presented breaches should be explained.

Leonard Bradatsch

Feasibility of real-world evasion attacks against machine learning for image recognition – English only

Block ciphers only work on inputs that are a multiple of the cipher’s block length in commonly used modes such as CBC. As data usually comes in arbitrary lengths, inputs to these algorithms need to be extended (padded) to a multiple of the block length. This seemingly simple problem lead to quite huge cryptographic problems. Depending on the scenario, it is even possible that an attacker is able to completely decrypt the ciphertext or encrypt data of their choosing. Your paper and presentation should explain the details of how a padding oracle works and how it can be used for decryption and ciphertext forgery. Moreover, you should give an overview of the problems this attack scenario caused as well as how the security community tries to avoid it nowadays.

Martin Lang (BMW)

Perimeter Security and why it is no longer sufficient – English only

Perimeter security is still the dominant network security architecture in 2022. In this paper, the basic principle of perimeter security will be presented. Above all, however, the weak points are to be pointed out.

Leonard Bradatsch

Privacy-Preserving Machine Learning in Healthcare Domain – English only

Hospitals, other public institutions or companies are using medical information to perform computations and use the results for their own analysis. However, the data being collected or shared, might be sensitive and leak critical information about the data source. Therefore, Privacy-Preserving Machine Learning (PPML) plays an essential role, enabling machine learning process without compromising the private data. The goal of this seminar is to give an overview of PPML approaches applied in the healthcare domain, while explaining their role in protecting health data.

Migena Ymeraj

Secure Multi-Party Computation – English only

The goal of Secure Multi-Party Computation (MPC) is to enable parties to work together without ever knowing one another's confidential information. It plays an important role in solving security and privacy issues and there are many examples of where it can be helpful. The aim of this seminar is to investigate MPC with respect to both theoretical and practical aspects.

Migena Ymeraj

Security Vulnerabilities in Video Games – English only

The video game industry is booming, fueled by the Covid crysis, but also driven by eSports where tournaments are held with a price money of up to 45 million dollars. In order to take a good share of this cake, video games are released in faster cycles. As with other software applications, less development times, means more flaws. Latest releases of big publishers showed games with a huge number of bugs, where most of them affect stability or the user experience. But some do also affect the security of the gamers' computer. In this seminar you should gather security vulnerabilities introduced by the gaming industry (including their clients), analyze and categorize them.

Michael Wolf

Smart Contract Security – English only

Distributed ledgers such as Ethereum allow digital ownership of funds and their programmatical transfer via so-called smart contracts. The novel architecture of these distributed state machines poses new security challenges. As smart contracts deal with financial values, each security issue potentially has a financial impact. This seminar should highlight the unique security challenges of smart contracts such as re-entrancy issues, the impossibility of storing private data on-chain, or the dependence on randomness oracles that can be manipulated.

Henning Kopp (Code White)

Software-transactional Memory – English only

Software-transactional memory, or STM for short, is a concept to change content within main memory with a single atomic action. This can be used to implement atomic operations, or even transactions as known from database management systems. To implement classic transactions multiple versions of data may be kept in memory, and some tracking of dependencies is necessary to finally avoid inconsistent transactional semantics. Some implementation avoid any form of locking, but rely on atomic memory-access instructions like swapping one or two to memory words. Others add locking to avoid retries. For this topic, the student shall introduce the idea of STM and consider some of the techniques how to use and/or implement it. The approach could be more theory oriented or more implementation oriented, e.g. by also considering implementations for Java.

Franz J. Hauck

The Raft Consensus Algorithm and its Applications – English only

Raft is a Crash-Fault Tolerant consensus algorithm, which was developed with the motivation of providing a more comprehensible alternative to the Paxos algorithm. The Raft algorithm was proposed in 2014, and has been heavily adopted by different orchestration and database management tools by now.
The task of this seminar is to provide an overview of the Raft algorithm's internals and its application in fault-tolerant systems.

Alexander Heß

Zero-knowledge Proofs – English only

In cryptography zero-knowledge proofs are protocols for two parties where on party can proof a statement to a verifying party without revealing additional information to the verifier except that the statement is true. This cryptographic building block is used within a variety of applications and other cryptographic protocols, such as authentication, distributed ledgers, and online voting. This topic should introduce zero-knowledge proofs and provide an overview of different types of zero-knowledge proofs as well as how proofs for different statements can be constructed.

Echo Meißner

Sorted by Topics

• Machine Learning
  • Distributed Machine Learning
  • Federated Learning
  • Feasibility of real-world evasion attacks against machine learning for image recognition
  • Machine learning methods for cybersecurity applications
  • Privacy-Preserving Machine Learning in Healthcare Domain
• Cryptography
  • Padding Oracles
  • Secure Multi-Party Computation
  • Zero-knowledge Proofs
• IT Security in the Wild
  • Authentication in Web Applications
  • Cybersecurity vulnerabilities and attacks on C-V2X networks
  • Network Security Breaches
  • Perimeter Security and why it is no longer sufficient
  • Smart Contract Security
• Fault Tolerance in Distributed Systems
  • Egalitarian Consensus
  • Failure Recovery from Persistent Memory in SMR
  • The Raft Consensus Algorithm and its Applications
• Systems, Technologies, and Beyond
  • AlphaFold and RoseTTa - Democratizing Microbiology through Software
  • Containerization Technologies
  • Software-transactional Memory

• Your own topic – English only

You have the possibility until the beginning of the semester to come up with your own topic and find a supervisor who is willing to mentor more students.

• Location privacy – English only

Location-based services (LBSs) have become an essential part of our daily lives. In such services, users offer their (precise) locations to service providers in return of benefiting from the service. However, offering location data to service providers put users' privacy at huge risk. Often these locations are associated with points of interest (POIs) of the users. Therefore, service providers are able to infer users' private behavior by knowing these POIs with a relatively high degree of certainty. For this reason, the adoption and deployment of location privacy protection mechanisms (LPPMs) are essential to protect users' privacy.
In this seminar, you will investigate and discuss the existing LPPMs as well as the privacy metrics that reflect how much privacy a user gains when applying a protection mechanism.

• Network Security Breaches – English only

The goal of this seminar is the outlining of popular network security breaches (2-3 examples).  Subsequently, state-of-the-art protection or detection approaches against these presented breaches should be explained.

Leonard Bradatsch

• First Packet Authentication – English only

All three of the above stated techniques describe an authentication process that starts with the very first packet a client sends to an network entry node when entering a network or accesing a service. This kind of authentication can be performed without having the communication parties any messages exchanged before the authentication happened.
The seminar paper should describe these techqniues and should outline the different existing approaches to perform such a first packet authentication.

Leonard Bradatsch

• Accessibility in Modern Web Applications – English only

Due to "Statistisches Bundesamt" 9.52% of germany's population had a severe disability in 2019. Many of various disabilities e.g. visual impairement influence the user interaction with web applications. Although most of the impact of a disability can be compensated with accessible tools like special input devices and client-software, such tools are heavily relying on extra information from the application itself.
This seminar paper should summarize and describe current concepts, tools and frameworks for development of an accessible modern web application.

• State of the art in biological molecular dynamics simulation software – English only

Parallel molecular dynamics (MD) simulations are critical to researching the interactions of hundreds of millions of atoms
and molecules in biomolecular systems like DNA transcription, protein assembly and many more.
MD simulations are used in molecular medicine and drug research or to create visualizations of biological systems,
which further our understanding of life's secrets.
MD frameworks such as NAMD and GENESIS are highly parallelized, high-performance software packages
which can scale up to hundreds or even many thousands of CPU and GPU cores.
This seminar should give an overview of the basic operating principles of molecular dynamics simulation software,
including examples and state of the art research on the topic.

Gerhard Habiger

• CheapBFT: a resource-efficient replication approach – English only

State-machine replication is a technique to deploy mulitple server replicas at once and let them do the same on behalf of client requests. In case of faults the service is still available. Even more, the service can tolerate arbitrarily misbehaving replicas (up to a certain number) by forming a quorum of votes. This needs typically 3f+1 replicas if we want to tolerate up to f faulty replicas. CheapBFT is another approach that needs less resources and still provides fault tolerance against arbitrarily misbehaviour, so called Byzantine failures. This seminar work is supposed to characterise CheapBFT in comparison to traditional approaches against Byzantine faults by state-machine replication.

There is only a single scientific paper describing CheapBFT. However, the candidate student is requested to introduce state-machine replication by having a look at papers about fundamental aspects and related traditional approaches.

Franz J. Hauck

• BFT Consensus Protocols: An Overview – English only

Byzantine fault tolerant (BFT) consensus protocols enable a set of distributed nodes to agree on a series of values, even if a minority of the nodes is faulty or malicious.
Originally developed as a fundamental mechanism for state machine replication (SMR), they have gained a lot of attentation from blockchain researchers recently, because they provide an efficient alternative to PoW mechanisms in (permissioned) blockchains.
However, since blockchains are operated in different network environments compared to SMR systems, a new generation of consensus protocols has evolved in recent years.
The task of this seminar is to provide a gentle introduction to the underlying consensus problem and a comparison of different BFT consensus protocols.

Alexander Heß

• Attacks on Automotive Systems – English only

Over the last 12 years, a large number of security attacks on automotive systems were discovered and published.
This Seminar topic should provide an overview over these attacks, identify common structures, present particularly noteworthy examples and conclude with some lessons learned. A survey article on automotive attacks is provided as a starting point.

Frank Kargl

• Secure over-the-air updates for vehicles – English only

Modern vehicles have become complex software products that need to be maintained for several decades in order to ensure their safe operation on the road. Typically, software is updated much more frequently than a car is taken to the shop for maintainance and therefore other ways to deploy software updates need to be considered. Over-the-air updates allow quick and cheap deployment of new or updated software to a large vehicle fleet, but security aspects need to be considered very carefully for obvious reasons.
In this seminar, you will identify and compare different proposals for implementing over-the-air updates for vehicles from a security perspective.

Dominik Mauksch

• Concepts and techniques in Library Isolation – English only

Different applications are isolated in modern operating systems so that they can only exchange information via predefined interfaces, e.g. shared memory. However, libraries used in applications usually run in the application context and thus with the same privileges and address space as the main application. They therefore increase the attack surface of an application, e.g. in the case of return-oriented programming attacks.
In this seminar, you should have a look into different approaches of in-application and library isolation techniques and compare them, e.g. with respect to their performance impacts and security assumptions.

Dominik Mauksch

• Evolution of the Hypertext Transfer Protocol – English only

Since HTTP was first developed at CERN in 1989 it has seen many changes. While it still serves its original purpose, HTTP also became a ubiquitous application protocol with a variety of uses that go far beyond the transportation of hypertext documents. But not only the applications of HTTP have changed drastically in the last 32 years, the protocol stack has also evolved. Nowadays more than 90% of the HTTP traffic is encrypted using TLS and while the adoption of HTTP/2 is steadily increasing, the IETF is in the process of finalizing the HTTP/3 protocol with 71% of running web browsers already supporting it.
This seminar should explore the history and evolution of HTTP and discuss old and new challenges and issues of the protocol and how newer HTTP versions address previous issues.

• Authentication in Web Applications – English only

Modern web application development encompasses a variety of approaches to implement authentication and session handling, ranging from traditional password-based authentication and cookie-based session handling to multi-factor authentication and complex authentication protocols, such as OAuth, OpenID, and SAML. Depending on the requirements of the application some approaches are better suited than others. This seminar should explore the authentication design space and compare stateful and stateless session handling approaches.

Echo Meißner

• Differential Privacy – English only

Differential Privacy (DP) is a privacy enhancing technology (PET) which should help to increase the privacy of users submitting data. Very simply spoken, during the data gathering phase noise is added to the value of each user in such a way that the individual user cannot be distinguished of others, and in the evaluation phase, the noise is taken into consideration to calculate certain analytics over the whole dataset. This oversimplified example was only used to explain the basics of the idea behind this PET, which has more specifics and potential.
In this seminar, you will take a deeper look into differential privacy, explain it with the help of an example, and present a simple framework using DP in a current application.

Michael Wolf

• The Boring Loop - a critical analysis – English only

Elon Musk opened recently the Las Vegas Convention Center Loop which was build by his company "The Boring Company". This project was created to speed up travel time in cities between specific locations, but also show that the cost of tunnel drilling can be reduced drastically. With the Loop in Vegas now finished, theses promises can be examined critically, as well as the concept of individual transport through tunnels.
In this seminar, you will have to compare the cost and performance of the Vegas Center Loop with other tunnel projects in the USA, Germany and other countries. Additionally you have to compare this concept with other transportation methods, like subway, bus, E-Scooter, etc...

Michael Wolf

• Secure Multi-Party Computation – English only

The goal of Secure Multi-Party Computation (MPC) is to enable parties to work together without ever knowing one another's confidential information. It plays an important role in solving security and privacy issues and there are many examples of where it can be helpful.
The aim of this seminar is to investigate MPC with respect to both theoretical and practical aspects and look at uses in real world applications.

Migena Ymeraj

• Distributed Machine Learning – English only

Due to the poor scalability and efficiency of learning algorithms, Machine Learning cannot handle large-scale data. This issue gave rise to Distributed Machine Learning. Even though it is a promising line of research, it still faces a lot of challenges.
The goal of this seminar is to discover the importance of Distributed Machine Learning, while comparing it with traditional Machine Learning environments and investigating its challenges.

Migena Ymeraj

• Containerization Technologies – English only

Kubernetes, Docker Swarm, Openshift, Portainer, Apache Mesos and others are in everyones mind. They've been made to revolutionize how to separate several applications and software stacks from each other. But did you ever had a look at the underlying technologies?
In this survey the student is asked to examine, compare and summarize the main differences between many (at least five) different OS-level virtualization technologies currently existing in modern desktop and server environments. As a first task, the student needs to introduce the main ideas behind the concepts of such user space instances and its differences to other approaches like hardware-based virtualization. Maybe, also an historical overview can be given as a guide for the reader. In a second step the student has to examine the differences of the proposed technologies and summarize them according to their dis-/advantages. Finally, the student has to conclude which technology might be the best for which use cases, e.g. working in privacy-aware, secure or speed-optimized environments.

Thomas Bläsing

• Timing Attacks - An Overview – English only

Classical cryptographic research deals with adversaries of polynomially bounded computational power. However, this attack model is not always realistic. In particular, an attacker may be able to measure the time it takes to run cryptographic algorithms. As often the running time of an algorithm depends on its input, this can be used to gather various information about the inputs to the algorithm or its internal workings. In a security context, sensitive data such as encryption keys and passwords may be recoverable by measuring the run time of programs. Examples are the run time of multiplications in the RSA algorithm, the POODLE and Lucky Thirteen Attack on TLS, as well as various  forms of Cache timing attacks (PRIME+PROBE, EVICT+TIME).
In this seminar, the student should give an overview of timing attacks, thereby explaining at least one example in depth. Further, some mitigations against timing attacks  should be discussed.

Henning Kopp (Schutzwerk GmbH)

• Padding Oracles – English only

Block ciphers only work on inputs that are a multiple of the cipher’s block length in commonly used modes such as CBC. As data usually comes in arbitrary lengths, inputs to these algorithms need to be extended (padded) to a multiple of the block length. This seemingly simple problem lead to quite huge cryptographic problems. Depending on the scenario, it is even possible that an attacker is able to completely decrypt the ciphertext or encrypt data of their choosing.
Your paper and presentation should explain the details of how a padding oracle works and how it can be used for decryption and ciphertext forgery. Moreover, you should give an overview of the problems this attack scenario caused as well as how the security community tries to avoid it nowadays.

Martin Lang (BMW Car IT)

• Secure In-Car Communication – English only - Master only (RTDS)

Modern cars contain an abundance of different ECUs controlling different aspects of the car's functionality. Along with an ever rising number of sensors and actuators, more and more control of the car is handed over to digital equipment. The rising complexity of these systems also leads to an increasingly large attack surface. Assuring the integrity and authenticity of in-car communication is therefore critical for the safety of driver, passengers, and other road users.
The target of this seminar is to analyse the current state of ECU communication security of different in-car protocols and bus systems and collecting and documenting potential challenges for the design of a secure ECU platform.

Thomas Lukaseder (Escrypt)

Sorted by Topics

Automotive
- Attacks on Automotive Systems (Frank  Kargl)
- Secure over-the-air updates for vehicles (Dominik Mauksch)
- Concepts and techniques in Library Isolation  (Dominik Mauksch)
- Secure In-Car Communication (Thomas Lukaseder)
- The Boring Loop - a critical analysis (Michael Wolf)

Cryptography
- Secure Multi-Party Computation (Migena Ymeraj)
- Padding Oracles (Martin Lang BMW)
- Timing Attacks - An Overview (Henning Kopp Schutzwerk)

Distributed Systems
- State of the art in biological molecular dynamics simulation software (Gerhard Habiger)
- CheapBFT: a resource-efficient replication approach (Franz J. Hauck)
- BFT Consensus Protocols: An Overview (Alexander Heß)

Network Security
- Network Security Breaches (Leonard Bradatsch)
- First Packet Authentication (Leonard Bradatsch)

Privacy
- Location privacy (Ala'a Al-Momani)
- Differential privacy (Michael Wolf)
- Distributed Machine Learning (Migena Ymeraj)

Software Engineering
- Accessibility in Modern Web Applications (Eugen Frasch)
- Evolution of the Hypertext Transfer Protocol (Echo Meißner)
- Authentication in Web Applications (Echo Meißner)
- Containerization Technologies (Thomas Bläsing)

• Your own topic – English only

You have the possibility until the beginning of the semester to come up with your own topic and find a supervisor who is willing to mentor more students.

• Differential privacy – English only

Statistics about user data are used heavily for improving services, performing marketing studies, and many other purposes. The acquisition and processing of potentially sensitive information poses serious privacy threats to individuals participating in, e.g., surveys. Such information might include birthdate, gender, religion, and nationality, from which identifying an individual becomes a trivial task. Moreover, inferring more sensitive information about a specific individual becomes also possible. To solve issue, many service providers, e.g., Apple and Google, started using the so-called “Differential Privacy” to preserve their users’ privacy.
In this seminar, you will investigate differential privacy with respect to both theoretical and practical aspects. In addition to addressing the privacy guarantees of differential privacy, your task will then be addressing how major tech companies are implementing differential privacy nowadays.

• Location privacy – English only

Location-based services (LBSs) have become an essential part of our daily lives. In such services, users offer their (precise) locations to service providers in return of benefiting from the service. However, offering location data to service providers put users' privacy at huge risk. Often these locations are associated with points of interest (POIs) of the users. Therefore, service providers are able to infer users' private behavior by knowing these POIs with a relatively high degree of certainty. For this reason, the adoption and deployment of location privacy protection mechanisms (LPPMs) are essential to protect users' privacy.
In this seminar, you will investigate and discuss the existing LPPMs as well as the privacy metrics that reflect how much privacy a user gains when applying a protection mechanism.

• Network Security Breaches – English only

The goal of this seminar is the outlining of popular network security breaches (2-3 examples).  Subsequently, state-of-the-art protection or detection approaches against these presented breaches should be explained.

Leonard Bradatsch

• First Packet Authentication – English only

All three of the above stated techniques describe an authentication process that starts with the very first packet a client sends to an network entry node when entering a network or accesing a service. This kind of authentication can be performed without having the communication parties any messages exchanged before the authentication happened.
The seminar paper should describe these techqniues and should outline the different existing approaches to perform such a first packet authentication.

Leonard Bradatsch

• Accelerating Techniques for 3D Ray Tracing – English only

Although 3D ray tracing was already used in the 70s to render simple animations, it got popular due to the gaming industry the past 10 years.
One of the reasons for its slow development as rendering technique is that ray tracing needs much more computational power than other rendering techniques to provide results in real-time.
The goal of this seminar is to look on the multiple algorithms, techniques and strategies that have been developed in the past to accelerate ray tracing.

Eugen Frasch

• The Elixir Programming Language – English only

Elixir is a functional and concurrent programming languague for developing highly scalable and reliable applications.
The goal of this seminar is to provide an introduction to Elixir, describe its main features and provide an example to demonstrate its fault tolerant characteristics.

Eugen Frasch

• State Machine Replication in the Libra Blockchain – English only

In 2021, Facebook wants to start a cryptocurrency called Diem, former Libra. This topic is supposed to summarise the underlying blockchain operations and present details in the seminar report and presentation. Starting from a given article the student should investigate how the blockchain works. As it has a closed group of participants, a technique called state-machine replication is used. Here all participants have to agree how to build the next block of the blockchain. The agreement protocol will be one aspect of this topic.
Beside technical aspects, which clearly have the main focus, the student may also want to deal with social and economic aspects of the new currency.

Franz J. Hauck

• Evolution of the Paxos Algorithm – English only

The Paxos algorithm enables a group of nodes to agree on a single value, even if the network communication or individual nodes temporarily drop out. While the original algorithm was layed out multiple decades ago, several modified and extended versions have been proposed over the years.
The goal of this seminar is to outline the core aspects of the Paxos algorithm, and discuss the modifications of a few of the more recent versions.

Alexander Heß

• The Hyperledger Project – English only

Hyperledger is an open-source project that comprises a set of tools and frameworks for building open-source blockchains.
The goal of this seminar is to provide an overview of the project's scope, capabilities, and discuss it's relevance for real-world applications.

Alexander Heß

• Secure over-the-air updates for vehicles – English only

Modern vehicles have become complex software products that need to be maintained for several decades in order to ensure their safe operation on the road. Typically, software is updated much more frequently than a car is taken to the shop for maintainance and therefore other ways to deploy software updates need to be considered. Over-the-air updates allow quick and cheap deployment of new or updated software to a large vehicle fleet, but security aspects need to be considered very carefully for obvious reasons.
In this seminar, you will identify and compare different proposals for implementing over-the-air updates for vehicles from a security perspective.

Dominik Mauksch

• Securing CAN bus – English only

Controller Area Network (CAN) – despite its age and bandwith limitations – is still a widely used bus standard to distribute safety-critical signals in modern vehicles. Research has shown that CAN does not have sufficient security measures to ensure basic security goals and therefore can be used by attackers to compromise the safety of a car and its passengers.
In this seminar, you should have a look into different approaches that make CAN more secure and compare them regarding e.g. their effectiveness, efficiency and real-time capability.

Dominik Mauksch

• State of the Art of Web Application Security – English only

The field of web applications is constantly and rapidly evolving, but so are attacks targeting them. For this reason the World Wide Web Consortium (W3C) assembled a working group to develop technical and policy mechanisms to improve the security for applications on the Web. In recent years, this Web Application Security Group proposed various drafts for mechanisms of which some have been refined into W3C recommendations and are now implemented in all major browsers (such as CSP and SRI). The establishment of Let's Encrypt laid the ground stone of a widespread adoption of TLS, which was further refined in TLS 1.3 and supplemented by new technologies, such as certificate transparency (CT).
This seminar should give an overview of current web application security techniques, discuss W3C recommendations and other developments in the area of web application security, and practical implications for current web applications.

• DevOps Monitoring using Grafana and Prometheus – English only

An important aspect of modern continuous delivery lifecycles is the constant monitoring of deployed applications.
This is not only used to assess the health of applications, but can also provide an overview of user activity and reveal performance issues in a production environment.
Nowadays, developers can rely on established and ready-to-use solutions instead of developing their own monitoring software.
This seminar should introduce the aspects of modern DevOps monitoring and give an overview of a typical monitoring stack (e.g., the open source software Prometheus and Grafana).
This overview should highlight the challenges that arise when monitoring different layers of an application deployment (such as hardware, network, database, and application metrics).

Echo Meißner

• Password Managers – English only

In the current time, users have multiple accounts on different platforms. To abide security guidelines, they should have a different password for each account resulting in a many passwords to remember. Password managers help with this task by storing this sensitive information in an encrypted database, protected by a master password. However, once in a while security issues about password managers make the news.
In this seminar, password managers (also theoretical ones) should be compared to each other by the security they provide and if security breaches have been reported. Based on this, the advantages of password managers need to be evaluated to the disadvantages they have.

Michael Wolf

• Secure Multi-Party Computation – English only

The goal of Secure Multi-Party Computation (MPC) is to enable parties to work together without ever knowing one another's confidential information. It plays an important role in solving security and privacy issues and there are many examples of where it can be helpful.
The aim of this seminar is to investigate MPC with respect to both theoretical and practical aspects and look at uses in real world applications.

Migena Ymeraj

• Distributed Machine Learning – English only

Due to the poor scalability and efficiency of learning algorithms, Machine Learning cannot handle large-scale data. This issue gave rise to Distributed Machine Learning. Even though it is a promising line of research, it still faces a lot of challenges.
The goal of this seminar is to discover the importance of Distributed Machine Learning, while comparing it with traditional Machine Learning environments and investigating its challenges.

Migena Ymeraj

• Containerization Technologies – English only

Kubernetes, Docker Swarm, Openshift, Portainer, Apache Mesos and others are in everyones mind. They've been made to revolutionize how to separate several applications and software stacks from each other. But did you ever had a look at the underlying technologies?
In this survey the student is asked to examine, compare and summarize the main differences between many (at least five) different OS-level virtualization technologies currently existing in modern desktop and server environments. As a first task, the student needs to introduce the main ideas behind the concepts of such user space instances and its differences to other approaches like hardware-based virtualization. Maybe, also an historical overview can be given as a guide for the reader. In a second step the student has to examine the differences of the proposed technologies and summarize them according to their dis-/advantages. Finally, the student has to conclude which technology might be the best for which use cases, e.g. working in privacy-aware, secure or speed-optimized environments.

Thomas Bläsing

• State of the Art in Attacking Hash Functions – English only

Hash functions such as MD5 or SHA1/2/3 are usually employed to ensure the integrity of a file by computing a fingerprint of the data. Common applications include  white/blacklists, signatures, as well as data bases for forensic analysis.
One major requirement of a secure hash function is that it should be hard to compute collisions, i.e., to find two files with the same hash value. The notion of hardness can be further formalized, but intuitively means that there should not be an algorithm which computes collisions faster than brute-force.
For some hash functions, such as SHA1 or MD5, computing collisions can be done faster than brute-force. These hash functions are considered insecure, but are still in use. As an example, SHA1 is used in git. Still, exploitation of hash collisions is only rarely seen in the wild. One reason is that the output of fast algorithms for finding collisions are usually bytes of high entropy and do not conform to valid file formats.
The goal of this seminar is to give an overview of the current attacks against hash functions (fastcoll, unicoll, hashclash, ...) as well as their constraints (e.g., identical/chosen prefix collision). Depending on the personal interest and previous knowledge of the participant, these attacks can be explored in more depth, or alternatively the exploitation of hash collisions can be described.

Henning Kopp (Schutzwerk GmbH)

• Padding Oracles – English only

Block ciphers only work on inputs that are a multiple of the cipher’s block length in commonly used modes such as CBC. As data usually comes in arbitrary lengths, inputs to these algorithms need to be extended (padded) to a multiple of the block length. This seemingly simple problem lead to quite huge cryptographic problems. Depending on the scenario, it is even possible that an attacker is able to completely decrypt the ciphertext or encrypt data of their choosing.
Your paper and presentation should explain the details of how a padding oracle works and how it can be used for decryption and ciphertext forgery. Moreover, you should give an overview of the problems this attack scenario caused as well as how the security community tries to avoid it nowadays.

Martin Lang (BMW Car IT)

• Secure In-Car Communication – English only

Modern cars contain an abundance of different ECUs controlling different aspects of the car's functionality. Along with an ever rising number of sensors and actuators, more and more control of the car is handed over to digital equipment. The rising complexity of these systems also leads to an increasingly large attack surface. Assuring the integrity and authenticity of in-car communication is therefore critical for the safety of driver, passengers, and other road users.
The target of this seminar is to analyse the current state of ECU communication security of different in-car protocols and bus systems and collecting and documenting potential challenges for the design of a secure ECU platform.

Thomas Lukaseder (Escrypt)

Sorted by Topics

Blockchain
- State Machine Replication in the Libra Blockchain (Franz J. Hauck)
- Evolution of the Paxos Algorithm (Alexander Heß)
- The Hyperledger Project (Alexander Heß)

Automotive
- Secure over-the-air updates for vehicles (Dominik Mauksch)
- Securing CAN bus (Dominik Mauksch)
- Secure In-Car Communication (Thomas Lukaseder)

Privacy
- Differential privacy (Ala'a Al-Momani)
- Location privacy (Ala'a Al-Momani)
- Password Managers (Michael Wolf)
- Distributed Machine Learning (Migena Ymeraj)

Cryptography
- Secure Multi-Party Computation (Migena Ymeraj)
- Padding Oracles (Martin Lang BMW)
- State of the Art in Attacking Hash Functions (Henning Kopp Schutzwerk)

Software Engineering
- State of the Art of Web Application Security (Echo Meißner)
- DevOps Monitoring using Grafana and Prometheus (Echo Meißner)
- Containerization Technologies (Thomas Bläsing)
- The Elixir Programming Language  (Eugen Frasch)
- Accelerating Techniques for 3D Ray Tracing (Eugen Frasch)

Network Security
- Network Security Breaches (Leonard Bradatsch)
- First Packet Authentication (Leonard Bradatsch)