Fraunhofer Institute for Applied and Integrated Security AISEC | Annual Report 2023

Annual Report 2023

Innovating with security#innovatingwithsecurity﻿2

Annual Report 2023
Fraunhofer Institute for Appliedand Integrated Security AISEC

3

Annual Report 2023

4

Prof. Dr. Claudia Eckert,

Prof. Dr. Georg Sigl,

Executive Director of the institute

Institute Director

Welcome to Fraunhofer AISEC

Welcome to
Fraunhofer AISEC!
Dear reader,Threats in cyberspace reached new peaks in 2023, with vulnerabilities in software and hardware products being
more widely exploited than ever before, attack methods becoming more sophisticated and the threat posedby ransomware continuing to be a cause for concern. Despite this, we have made significant progress in defense
and protection. Fraunhofer AISEC’s mission is and remains translating excellence in IT security research into applied
solutions for greater dependability, trustworthiness and tamper protection in IT-based systems and products.
With this in mind, in 2023 Fraunhofer AISEC developed new solutions for a secure digital transformation —covering everything from the secure use of key technologies such as artificial intelligence, secure autonomous
driving, platform security, trustworthy data processing and cloud monitoring to secure, future-proof networks
and cryptographic protocols for quantum-secure digital identity verification.
Our work has been primarily centered around pre-competitive research in the areas of trusted hardware, generative
AI, the cloud, digital identity and embedded security. We have been focusing on expanding established solutions
and skills — by creating security concepts and risk analyses, for example, and performing offensive tests. We haveshared our current research findings with practitioners and numerous professional groups through research projects
with companies, public authorities and institutions, as well as through the training we offer at the Cybersecurity
Training Lab. In order to address the challenges found in cybersecurity, it is, after all, essential to engage as many
stakeholders as possible to establish a strong culture of security.
In this Annual Report, we hope to give you an insight into our activities in 2023 and illustrate how we can participate
securely in pioneering technologies.
We hope you enjoy reading it!
Best regards,
Prof. Dr. Claudia Eckert 		Prof. Dr. Georg Sigl

5

6

Contents

Contents

Welcome to Fraunhofer AISEC ����������������������������������������������������������������������������������������������� 5
Areas of Expertise at Fraunhofer AISEC ��������������������������������������������������������������������������������� 8
Automotive Security | Autonomous Truck Takes to the Highway ������������������������������������������� 8
Cloud Monitoring | Security With Approval for the Future ��������������������������������������������������� 10
Cognitive Security Technologies | Artificial Intelligence and IT Security ��������������������������������� 12
Hardware Security | The Achilles Heel of the Internet of Things ������������������������������������������� 14
Post-Quantum Cryptography | Quantum-Secure Passports ��������������������������������������������������� 16
Secure Operating Systems | GyroidOS: A Secure Platform for Data ��������������������������������������� 18
Zero Trust | Greater Data Security With Zero-Trust Access Control ��������������������������������������� 20
Cybersecurity Training Lab | Security Comes From Expertise ��������������������������������������������� 22
In Brief ������������������������������������������������������������������������������������������������������������������������������������� 24
About Fraunhofer AISEC��������������������������������������������������������������������������������������������������������� 26
Our Mission | Facts and Figures ������������������������������������������������������������������������������������������� 26
Our Research Departments ������������������������������������������������������������������������������������������������� 27
The World of Labs at Fraunhofer AISEC��������������������������������������������������������������������������������� 28
Our Journey Toward Climate Neutrality ������������������������������������������������������������������������������� 30
Continuous Quality Management Ensures Adaptability ������������������������������������������������������� 31
Our Advisory Board ������������������������������������������������������������������������������������������������������������� 32
Fraunhofer CCIT — From Sensor to Cloud and Back Again ����������������������������������������������� 34
Fraunhofer AISEC — A Great Place to Work ����������������������������������������������������������������������� 36
People of Fraunhofer AISEC ������������������������������������������������������������������������������������������������� 38
Nisha Jacob Kabakci������������������������������������������������������������������������������������������������������������� 38
Ferdinand Jarisch������������������������������������������������������������������������������������������������������������������� 40
Barbora Hrdá������������������������������������������������������������������������������������������������������������������������� 42
Martin Seiffert����������������������������������������������������������������������������������������������������������������������� 44
Publications ��������������������������������������������������������������������������������������������������������������������������� 46
Publishing Notes ������������������������������������������������������������������������������������������������������������������� 50

7

Automotive Security | Autonomous Truck Takes to the Highway

Autonomous Truck Takes
to the Highway
Driverless trucks transporting goods autonomously from one
logistics yard to another is a scenario that has great potential,
but comes with cybersecurity risks in the form of unauthorizedparties commandeering the autonomous vehicle and forcing it
to make life-threatening decisions. Fraunhofer AISEC is harnessing
its cybersecurity expertise and testing capabilities in the development of future mobility solutions to ensure that the logistics sector
adopts secure automation concepts.
Named ATLAS-L4 (Automatisierter Transport zwischen
Logistikzentren auf Schnellstrassen im Level 4, meaning
Automated Transport Between Logistics Centers on
Highways, Level 4), the research and development
project is drawing on expertise from science, industry
and infrastructure operators to form the basis for innovative transport concepts. The aim is to introduce autonomous trucks onto the highway for the first time by the
middle of this decade.
In a joint research project funded by the German Federal
Ministry for Economic Affairs and Climate Action (BMWK),
Fraunhofer AISEC is working with MAN Truck & Bus,
Knorr-Bremse, Leoni, Bosch, Fernride, BTC Embedded
Systems, the Technical Universities of Munich andBraunschweig, TÜV SÜD, Autobahn GmbH and WIVWGmbH to develop an industry-ready concept for putting
Level 4 automated trucks on the highway. Level 4 is thestage preceding fully autonomous driving, in which thevehicle’s system is able to take over most of the control.
The project partners have been designing and testing thesubsystems, sensors, vehicle electrical system, steeringand braking system since January 2022. The control
center in charge of technical supervision is also up andrunning. In 2023, the prototype vehicle successfully
traveled its first few kilometers, starting on the test track
and then moving to the highway.

End-to-end protection against cyber attacks
With ATLAS-L4, Fraunhofer AISEC is ensuring that comprehensive, traceable security requirements can be met.

8

The security experts from the Product Protection andIndustrial Security department carried out the risk analysis
for the autonomous driving system in collaboration with
MAN. For this purpose, they broadened their methods
for security risk analyses to encompass automatedtrucks. The next stage involved defining security
measures such as authentic and encrypted communication, plus functional security measures such as redundancy and degradation concepts, for the autonomous
driving system. These measures are crucial for responding
to cyber attacks with resilience, maintaining system
integrity and ensuring road safety.

Safe operation on highways
Also in the process of being created are comprehensive
security management concepts that take into accountother aspects of the vehicle’s life cycle besides its development — for example, production and operation.
These will be refined as the project progresses and implemented in t he form of a toolbox. Researchers will beable to use them as a means of identifying and addressing cybersecurity risks and requirements throughout theentire life cycle of the vehicle. Fraunhofer AISEC is also
creating the risk analysis and protection concept for thecontrol center as part of ATLAS-L4. This will cover all
aspects of cybersecurity for Level 4 automated trucks
and establish an industry-ready standard for operatingthem safely on highways.

Automotive Security at Fraunhofer AISEC
Fraunhofer AISEC is using its extensive expertise and analysis capabilities to assess and protect
the security of vehicles and their communication systems. Dealing with everything from developing
secure control units, vehicle electrical system architectures and Car-to-X (C2X) systems throughto security measures for vehicle electronics and procedures for secure remote software updates,
the Product Protection and Industrial Security department is advancing the state of the art in automotive security through its research. It is also supporting the development, implementation andintegration of secure vehicle functions, applications and value-added services.

Contact

Further information

Bartol Filipovic
Head of the Product Protection
and Industrial Security department
Phone +49 89 3229986-128
bartol.filipovic@aisec.fraunhofer.de

ATLAS-L4 project

Product Protection andIndustrial Security department

9

Cloud Monitoring | Security With Approval for the Future

Cloud Security With Approval
for the Future
Clouds are scalable, cost-effective and flexible — but are they
secure? Cloud providers have been prioritizing security at least
since the EU Cybersecurity Act came into force. The law sets out
the EU Cybersecurity Certification Scheme for Cloud Services (EUCS)
in the form of a European security criteria catalog.
Achieving cloud certification with MEDINA
Fraunhofer AISEC has been contributing its expertiseto the EU-funded MEDINA project to make it easier for
Infrastructure-as-a-Service (IaaS), Platform-as-a-Service(PaaS) and Software-as-a-Service (SaaS) cloud providers
to obtain EUCS certification in the future. The project’s
international consortium, drawn from science andindustry, has developed a modular kit to make compliance with future EUCS requirements — and, consequently, the security of clouds — continuously andautomatically quantifiable. “The tools and processes
developed in the MEDINA project enable cloud providers
to check whether they meet all compliance requirements — and, if necessary, to make improvements —without having to perform lengthy and cost-intensive
manual searches to find evidence,” explains Christian
Banse, Head of the Service and Application Security
department at Fraunhofer AISEC.

Collecting and evaluating evidencewith Clouditor
The assurance tool Clouditor from Fraunhofer AISEC
is an open-source tool that automatically and continuously checks that cloud-based services and applications
are securely configured, specifically with regard tosecurity aspects such as encryption, identity and accessmanagement, and logging. The research team at Fraunhofer AISEC has expanded the evaluation to include
EUCS-relevant data sources, such as internal company
compliance requirements, policies and software applications, to ensure that evidence of compliance with EUCS
requirements is collected and evaluated automatically.

10

The researchers translated the EUCS regulations into
technical rules that Clouditor can use to automaticallyevaluate evidence and assign a certification status.
This allows cloud providers to identify whether theymeet all requirements or whether they need to takefurther action to obtain EUCS certification.

EUCS-compliant software with Codyze
Fraunhofer AISEC uses the AISEC analysis tool Codyze
in the MEDINA project to assess software compliance.
Codyze automatically identifies violations of EUCS
requirements in software source code. It uses static codeanalysis in C, C++ and Java to ensure that the softwarein the cloud system correctly implements cryptographic
protocols such as TLS and data encryption. As wellas this, it ensures that APIs comply with the defined
standards and that only trustworthy code is used.
This means that compliance violations and vulnerabilities
can be identified and rectified early on. “It is our goal
to provide companies and institutions with the right tools
for checking and strengthening their security efficiently, based on what works for their specific scenarios,”
explains Angelika Schneider, research scientist in theService and Application Security department. “The technologies developed as part of the MEDINA project are
helping industry and the public sector make their cloudservices more secure and prepare for future challenges.”
Fraunhofer AISEC is using the results from the MEDINA
project in the EU-funded follow-up projects EMERALD
and COBALT. EMERALD is focusing on Certificationas-a-Service (CaaS) solutions in cloud environments,
while COBALT is establishing a cross-domain certification model.

Automated Evaluation of Security
and Privacy
Data sovereignty is a fundamental attribute in an industrial sector
that is focused on the future. Fraunhofer AISEC’s open-source tools
enable companies and public institutions to establish secure dataexchange and resilient, distributed systems based on automatedsecurity analyses and evaluations.

MEDINA project

Clouditor website

Contact

Christian Banse
Head of Department
Service and Application Security
Phone +49 89 3229986-119
Codyze website

Service and Application

christian.banse@aisec.fraunhofer.de

Security department

11

Reliably Exposing Audio Deepfakes
The Deepfake Total platform developed by Fraunhofer AISEC uses artificial
intelligence to identify audio deepfakes. The platform also provides informationand materials to raise awareness of deepfakes alongside data sets for training
and evaluating AI-based audio deepfake identification models.
Deepfake Total platform

Cybersecurity in the Generative AI Era
In the AlgenCY project, leading experts from science and industry are researching
the implications that generative artificial intelligence (AI) has for cybersecurity.
The feasibility of generative AI technologies is tested in real-world scenariosin the Fraunhofer AISEC experimental lab.

AlgenCY project

Cognitive Security
Technologies department

12

Contact

Contact

Dr. Philip Sperl

Dr. Konstantin Böttinger

Head of Department

Head of Department

Cognitive Security Technologies

Cognitive Security Technologies

Phone +49 89 3229986-141

Phone +49 89 3229986-163

philip.sperl@aisec.fraunhofer.dekonstantin.boettinger@aisec.fraunhofer.deCognitive Security Technologies | Artificial Intelligence and IT Security

Artificial Intelligence and IT Security
Artificial intelligence is becoming increasingly powerful, somethingthat presents cybersecurity with opportunities and risks. Researchers
at Fraunhofer AISEC are closely scrutinizing the technology involved
in artificial intelligence, investigating how AI can be used in cybersecurity and how to protect AI systems from attacks. One particularfocus is on new developments in the field of generative AI.
In 2023, the astounding capabilities of generative
AI dominated discussions on digital technology.
Large language models (LLMs) such as generative
pre-trained transformers (GPTs) stood out in particular.
These language models identify statistical correlations
from text documents in a computationally intensive
training process and then generate new texts independently. The AIgenCY project, launched in 2023,
is exploring the opportunities and risks that generative AI presents for cybersecurity by devising forecasts
relating to the use of generative AI over the next three
years. AI and cybersecurity experts from Fraunhofer
AISEC, CISPA, TU Berlin, FU Berlin and the Heidelberg-based AI start-up Aleph Alpha came together
to work on this project in 2023. It is being fundedby the German Federal Ministry of Education andResearch (BMBF).

Defending against AI attacks on vehicles
There has been a rise in the popularity of AI among
cybersecurity experts, and not just since the advancesin generative AI. It is bringing about a number of majorchanges in IT security. While AI can be used to improve
IT security — through anomaly detection using automated analysis of large data sets, for example — it isalso vulnerable to attack. Algorithms can be tricked byentering incorrect data, known as adversarial examples.
Vehicles, which are increasingly being equipped with AI,
are a prime real-world example of this, as attackers candeliberately try to deceive systems in order to gain controlof the vehicles. This can lead to risks that have serious
safety ramifications. The Cognitive Security Technologies
department has developed a tool that can be used toassess the risk of new attacks and prioritize defense strategies, with the aim of establishing a quick and reliable
overview of new attack vectors and methods.

Detecting deepfakes with AI
The ambivalence surrounding AI in cybersecurity is
mirrored in the topic of deepfakes — deceptively
realistic video and audio simulations that are generatedusing deep neural networks. “The risks and challenges
posed by deepfakes are considerable, not just for the
media, but also for companies and individuals,” says
Konstantin Böttinger, Co-Head of the Cognitive Security
Technologies department. Luckily, AI also offers a way
to reliably expose deepfakes. In 2023, Fraunhofer AISEC
launched the Deepfake Total platform, which uses AI
to recognize audio deepfakes.
The performance of AI is always heavily reliant on thequality of the training data. In response to this challenge,
the Cognitive Security Technologies department conducted research into the integrity and reliability of AI data
sets for the companies Bundesdruckerei and Logsight
throughout 2023 as part of the Datenatlas project.
The team developed concepts for maintaining, analyzing
and cleansing data to ensure that AI training data is
high-quality and meets ethical and safety requirements.

13

Hardware Security | Vulnerable Hardware: The Achilles Heel of the Internet of Things

Vulnerable Hardware: The Achilles
Heel of the Internet of Things
Microelectronics are at the very core of smart devices — fromindustrial and consumer products to critical infrastructures.
Manufacturers of IoT products often resort to standard hardware
due to costs and a lack of risk awareness, with little thought
given to security during product development. This makes themeasy targets for attackers.
Putting the security of microcontrollers underthe microscope
Hardware security researchers at Fraunhofer AISEC
have demonstrated the vulnerability of IoT devices
in the study “Hardware Attacks against Microcontrollers,” commissioned by the German Federal Officefor Information Security (BSI). Almost all of the microcontrollers examined in the study were susceptible
to hardware-based attacks, such as:•	Fault attacks on internal processes caused byvoltage and clock glitching (i.e., interruptionsin the execution of machine commands) orelectromagnetic fault injection•	Side-channel attacks based on energy consumption
or electromagnetic emissions•	Bypass attacks on read-out protection via weak points
in communication interfaces
The researchers at Fraunhofer AISEC have not only
provided proof of the vulnerability of chips to attacks —in their study, they have also recommended targeted
protective measures to prevent these attacks.
One possible approach is to use simulations as a wayof identifying the vulnerability of the code to fault
attacks and automatically inserting countermeasuresat the vulnerable points. The protective measures canbe implemented using software, without the need forany changes to the hardware.

14

Turning a vulnerability into a security solution
The research results highlight the need to focus moreon hardware security. This is why Dr. Matthias Hiller,
Head of the Hardware Security research department,
is focusing his attention on security analyses in the laboratory, the protection and integration of microcontrollers
and secure elements, and the secure use of systemon-chips and hardware interfaces such as field-programmable gate arrays (FPGAs). The expertise and experienceof his team, plus specially developed analysis and test
tools, are supplemented by Fraunhofer AISEC’s Common
Criteria EAL7-certified Hardware Security Lab, whichmeets the requirements for developing trustworthy
hardware. There, Fraunhofer AISEC researchers extensively examine complex system-on-chip systems forvulnerabilities, design individual security solutions
and test the effectiveness of these directly on the chip.
Hiller explains: “As research and application are tightlyinterwoven, our findings are fed directly into practice.
This enables us to work with our partners to systematically evaluate, design and maintain the security of
hardware throughout the entire product life cycle —something that is absolutely essential, especially within
the context of the EU Cyber Resilience Act.”

Certified Hardware Security Lab

Certified Hardware Security Lab
In the Hardware Security Lab, security researchers at Fraunhofer AISEC expose security
flaws in hardware and develop appropriate protective measures.
Hardware

The Hardware Security Lab has achieved Common Criteria site certification at the

Security Lab flyer

highest security level, EAL (Evaluation Assurance Level) 7. This certification confirmsthat the test laboratory and the infrastructure fulfill all the requirements of various
standards: ISO/IEC 15408-1:2009, -2:2008, -3:2008 and the Common Criteria for
Information Technology Security Evaluation (CC).

Contact

Further information

Dr. Matthias Hiller
Head of Department
Hardware Security
Phone +49 89 3229986-162
matthias.hiller@aisec.fraunhofer.de“Hardware Attacks against

Hardware Security

Microcontrollers” study

department

15

Post-Quantum Cryptography | Quantum-Secure Passports

Cryptographic Protocol
for Quantum-Secure Passports
The security chips found on personal identity cards and passports
are under threat from quantum computing. In 2023, as part of its
PoQuID research project, Fraunhofer AISEC’s Competence Center
for Post-Quantum Cryptography developed cryptographic protocols
that are tough enough to withstand attacks waged by quantum
computers. The companies Infineon and Bundesdruckerei werepartners in the project.
Electronic chips have been providing security for
Germany’s EU passports since 2005 and for thecountry’s personal identity cards since 2010. German
citizens can use the latter to authenticate themselves
online (using what is known as the online ID function).
A chip stores personal data and biometric features
including a person’s passport photo and two of theirfingerprints, and also features proof of its own authenticity. However, the cryptography that chips currently
include will not be able to stand up to the attacks fromthe powerful quantum computers that are expected
over the next ten to fifteen years — it is believedthat these computers will have the ability to solve
the mathematical problems underpinning this cryptography much quicker than today’s computers can. In this
scenario, chips would no longer serve as an effective
security feature.

“Our research work showed that the new protocoldelivers the same security functions as its predecessor.
It takes just two seconds of calculation time to checkthe security feature, making it suitable for both electronic
passports at border controls and the online ID function.”“The research project has laid the foundations for
ensuring that the security of electronic ID documents
is fit for the quantum computer age. Now, the raceis on to get the technology to market,” says Margraf.
The researcher believes that the international standardization process will take at least five years. “Additionally, authorities responsible for ID documents andsecurity chip manufacturers have to bear in mind that
ID documents can be valid for as much as ten years,
but the first powerful quantum computers are expected
to come onto the scene by the mid-2030s.”

A two-second security check
With this in mind, the Fraunhofer AISEC CompetenceCenter for Post-Quantum Cryptography set out todevelop a quantum-secure chip in its PoQuID research
project. The companies Infineon and Bundesdruckerei
were partners in the project, which was funded by
the German Federal Ministry for Economic Affairs andClimate Action (BMWK). “We adapted and refined
Extended Access Control (EAC), the standard cryptographic protocol used in passports, in a way that ensured
it would be quantum-resistant and still able to perform
well with the limited resources available from a security
chip,” explains Prof. Dr. Marian Margraf, co-head of theCompetence Center for Post-Quantum Cryptography.

16

Contact

Prof. Dr. Marian Margraf
Head of Department
Secure Systems Engineering
Phone +49 89 3229986-152
marian.margraf@aisec.fraunhofer.deCompetence Center for Post-Quantum
Cryptography
The Competence Center for Post-Quantum Cryptography offers bespoke consultation services and assistance with migration to quantum-resistant architecture
designs, security analyses of PQC implementations and an information portal onCompetence Center forpost-quantum cryptography.

Post-Quantum Cryptography“Post-Quantum Security” Seminar
At the in-person “Post-Quantum Security” seminar at the Cybersecurity Training Lab,
participants will acquire in-depth knowledge of how a quantum computer works andan overview of the challenges facing IT security.
“Post-Quantum
Security” Seminar

Contact

Further information

Prof. Daniel Loebenberger
Head of Department
Secure Infrastructure
Phone +49 89 3229986-139
daniel.loebenberger@aisec.fraunhofer.de

PoQuID project17

Security for Operating Systems and HardwareFacing Software
The Secure Operating Systems department analyzes and develops secure softwarearchitectures and methods for protecting system integrity, ensuring resilience andisolating critical components and data.
Its research focuses on the evaluation and development of secure embedded
systems. This includes confidential computing, software security and hardening,fuzz testing and code analysis, plus developing security measures and core technologies as open-source software for the mobile, embedded systems, edge computing,server and cloud domains.

Contact

Further information

Sascha Wessel
Head of Department
Secure Operating Systems
Phone +49 89 3229986-155
sascha.wessel@aisec.fraunhofer.deGyroidOS website

Secure Operating
Systems department

18

Secure Operating Systems | GyroidOS: a secure platform for data

GyroidOS: A Secure Virtualization
Solution for Data Storage, Processing
and Communication
Whether it involves edge computing, artificial intelligence or
the IoT, storing, sharing and processing data are essential partsof the digital value chain. Companies are facing the challengeof protecting the integrity, confidentiality and availability of data.
This is where GyroidOS comes in.

Developed by Fraunhofer AISEC, GyroidOS is a virtualization solution at operating system level that has a special
emphasis on IT security. The underlying Linux operating
system kernel gives GyroidOS independence with regard
to processor architectures. The solution is based on hardware functions that enable secure container isolation andthe creation of lightweight, flexible execution environments that are also suitable for processing classified data.

Secure and confidential data collection,
processing and communication
Complete hard disk encryption, secure booting withremote attestation, signing of components such as guest
operating systems, kernels and modules, secure element
support for two-factor authentication, and other security
functions all help to protect data storage, processing andcommunication.

Protecting data by isolating user contexts
Data is also protected by the special system architectureof GyroidOS. Especially sensitive applications and data
are deployed in execution environments that are isolated
from the core container and are therefore privileged.
In addition to critical components such as remote maintenance and update functionalities, the core containerhouses the administrator system, which is exposed toattacks (including hacker attacks). Separating unprivileged application containers from the core container
achieves a very high level of security. At this point,
the core container is also unprivileged, but it has
a defined interface for controlling the privileged
virtualization layer.

The open-source software can be used on numerous x86
and ARM platforms. GyroidOS also supports certification processes in accordance with the DIN SPEC 27070
and IEC 62443-4-2 industry standards. GyroidOS has
been awarded the IDS-ready label as part of the Trusted
Connector in the context of International Data Spaces.
For Common Criteria certification, GyroidOS can be usedas part of the product to be certified or as a Target of
Evaluation (TOE). The security features of the softwareare suitable for implementing TOE Security Functions.
GyroidOS is a secure, highly configurable and flexible
solution for executing isolated applications and services.
Fraunhofer AISEC can provide support for implementing
the open-source software and with customer-specificextensions to GyroidOS.

19

Security for Future-Proof Infrastructures
The Secure Infrastructure department at Fraunhofer AISEC in Weiden supports
customers in applied cryptography, in migrating to quantum-secure architecture
designs and in investigating and designing secure network protocols.
Secure Infrastructure department

Secure and User-Friendly Digital Systems
The research conducted by the Secure Systems Engineering department at the
Fraunhofer AISEC site in Berlin focuses on the development of digital systems
with security, data protection and user-friendliness in mind. The security architectures it develops support companies with certification in accordance with eIDAS,
BSI-TR, ISO 27000 or Common Criteria.

Secure Systems Engi-

Telematics infrastructureneering departmentpress release

Contact

20

Prof. Daniel Loebenberger

Martin Seiffert

Head of Department

Senior Scientist

Secure Infrastructure

Secure Systems Engineering

Phone +49 89 3229986-139

Phone +49 89 3229986-231

daniel.loebenberger@aisec.fraunhofer.demartin.seiffert@aisec.fraunhofer.deZero Trust | Greater Data Security With Zero-Trust Access Control

Greater Data Security With Zero-Trust
Access Control
Successful cyber attacks or the accidental disclosure of confidential
data by internal users can have serious consequences for companies.
The zero-trust concept is a data-centric approach that scrutinizes
every data access request.
“Zero trust” denotes a security concept that does
not have an internal trustworthy area or any default
assumptions of trust where users, devices and networks
are concerned. Every attempt to access resources
is verified. Resource authentications and authorizations
are based on a dynamic set of rules that are enforced
before data is accessed. This allows users to establish
communication without being restricted by their locationor company network. By closely scrutinizing and monitoring all data access requests, companies can adhere
to compliance requirements more easily and improvetheir own security levels.
Implementing zero trust requires consideration of thecompany’s existing IT infrastructure as well as carefulplanning and execution. By developing application-led
security solutions based on the zero-trust concept,
Fraunhofer AISEC is encouraging its adoption in practice.
Designing a zero-trust-based secure communication
system in the healthcare sector and evaluating zero-trust
strategies in the Bavarian government network are examples of this research being applied in the real world.

Telematics infrastructure 2.0: secure communication in the healthcare sector
The telematics infrastructure (TI) is the central methodof communication in healthcare contexts. Working
together with Bundesdruckerei, CompuGroup Medical,
genua GmbH and D-Trust GmbH in a project commissioned by gematik, Fraunhofer AISEC has developed
the conceptual basis for TI 2.0 in order to make the
TI secure and future-proof. A demonstrator has beendeveloped for the new security architecture, alongside
an architecture concept based on zero-trust principles
and a migration plan. The feasibility of the architecture

has been verified with a proof of concept. Uniform
access mechanisms for all user groups ensure equal
integration of all stakeholders and extend the usergroup to include insured persons and service providers
without a fixed location. The key criterion for authorizing individual data access requests is that the end
devices meet the necessary security requirements.

Evaluation of zero trust in a government
networkCommissioned by the Bavarian State Office for Information Security (LSI), Fraunhofer AISEC has been
investigating the extent to which zero trust has been
implemented in the Bavarian government networkand how the concept can help improve the security
infrastructure. Tools have been developed to deriverequirements and recommendations for zero-trust
security. The evaluation of three use cases demonstrated that a zero-trust security concept provides
resilient solutions for improving network security ingovernment networks. The challenge is to ensure thatthe new zero-trust approach does not weaken highly
segmented networks. For this reason, the project has
identified the challenges involved in migration andintegration into the existing network. The recommendations show how the zero-trust concept can be implemented in the network infrastructure in stages so thatthe advantages of zero trust can be fully leveraged
in the future.

21

Transferring Knowledge From Research to Practice
As digitalization becomes more commonplace, the potential threat of cyberattacks is steadily on the rise. The Cybersecurity Training Lab is part of the
Fraunhofer Academy training facility and helps companies and public authorities
develop specific skills in IT security.
The Cybersecurity Training Lab at Fraunhofer AISEC specializes in the areasof embedded systems, the internet of things and mobile security. The training
courses present current research outcomes and IT security methods in a concise
and practical manner, and can be adapted to specific interests and needs.

Contact

Further information

Vivija Čeprkalo-Simić
Project Manager
Cybersecurity Training Lab
Phone +49 89 3229986-138
vivija.ceprkalo@aisec.fraunhofer.deFraunhofer AISEC Cybersecurity Training Lab

22

Fraunhofer ACADEMY

Cybersecurity Training Lab | Security Comes From Expertise

Security Comes From Expertise
As soon as one gap in security is closed, another one immediately
appears. With the protection of IT systems constantly evolving
in different ways, and the protection of data, knowledge andproducts along with it, companies and public authorities haveno choice but to keep pace with developments in cybersecurity.
But how do you stay one step ahead when specialists are in
short supply?
Direct access to applied research findings
Researchers from Fraunhofer AISEC share current scientific findings and practical experiences in the Cybersecurity Training Lab, which is part of the Fraunhofer
Academy. “Initial contact with the training facility
is often established through research and development
projects between Fraunhofer AISEC and partners fromindustry and the public sector,” says Vivija ČeprkaloSimić, Project Manager at the Fraunhofer AISEC Cybersecurity Training Lab. It also receives inquiries from newcontacts about risk analysis, post-quantum cryptography(PQC), blockchain technologies, hardware security andmachine learning (ML). “When it comes to topics suchas advanced ML or PQC, we are asked to provide training that simply no one else can offer at such a technicallevel,” explains Čeprkalo-Simić.
She establishes the learning objectives during the initialconsultation — in other words, who needs to know
what, whether certain subjects need to be addressed,
whether practical security knowledge or a strategic
understanding of a technology is required, and whether
there is a need for a customized training concept.
When developing the learning content, researchers
and trainers work closely with teachers and experts
in digital learning content. This ensures that appliedresearch findings are presented in a way that is understandable and memorable.

IT security for specific challenges

quantum-secure cryptography for financial service
providers, secure FPGA-based systems for the transport
sector and machine learning for telecommunications.
The latest research findings are presented in virtual
seminars, web-based training courses, in-house training
sessions or the security labs at Fraunhofer AISEC,
then put directly into practice in practical simulations,training hardware or hacking sessions in which participants assume the role of the attacker.
The concept works, and many customers are interested
in long-term collaborations. Every day is a school day, as
they say, and that is certainly the case at the Training Lab.

Moving into the future with cyber resilience
In view of recent technological advances in AI andquantum computing, for example, experts need to be
trained not only to make IT systems more resistant to
attacks, but also to make them more resilient in theevent that an attack is actually successful. Fraunhofer
AISEC is involved in developing assessments and further
training on cyber resilience in the cross-Fraunhofer
project CyRille. Researchers are helping companies tofurther develop their products with the aim of recognizing and overcoming attacks. Companies need tolearn how to remain operational even during an attack,how to maintain control of processes and products,
and how to recover quickly from an attack. As ČeprkaloSimić says, the Cybersecurity Training Lab is making
it possible to transfer cyber resilience knowledge, tools
and practices to companies and public administration.

The trainers teach what they are researching in the
Cybersecurity Training Lab: for example, risk analyses forautomotive manufacturers and mechanical engineers,23Trusted
In
Brief electronics | Inaugural Cybersecurity Day — Research Meets Industry

Inaugural Cybersecurity Day — Research
Meets Industry
A Cybersecurity Day was held at Fraunhofer AISEC for the first time in November. Our cybersecurity experts used demonstrators to present results and solutions derived from research andindustry projects. Customers had the opportunity to visit our cybersecurity labs and learn about
key IT security issues in short expert sessions.
To the event website

TU Munich Awards Heinz Maier-Leibnitz
Medal to Prof. Dr. Eckert

Read the press release

At TUM’s Dies Academicus ceremony, Prof. Dr. Claudia Eckert, Head of Fraunhofer AISEC,
received the Heinz Maier-Leibnitz medal — TUM’s most prestigious award — in recognitionof her outstanding work on system and application security and on embedded systems. In her
Chair of IT Security position at TUM, she specializes in the protection of IT systems. As a memberof various national and international industrial advisory boards and scientific committees,
she advises companies, trade associations and the public sector on issues relating to IT security.

“Türen auf mit der Maus” Open Day 2023

To the event website

24

At the “Türen auf mit der Maus” open day at Fraunhofer AISEC, children between the agesof eight and fourteen were introduced to the world of cybersecurity for the first time.
Across three stations, around a hundred guests in total had the opportunity to identify images
and sounds created by artificial intelligence, crack a safe and learn the basics of quantum
computers in a computer game called Charlie and the Quantum Factory.

COSADE 2023 at Fraunhofer AISECThe International Workshop on Constructive Side-Channel Analysis and Secure Design (COSADE)
has been providing science and industry with a platform for presenting current research findings
since 2010. In 2023, TUM and Fraunhofer AISEC organized the 14th edition of this workshop
series. Topics ranged from implementation attacks to efficient and secure HW/SW implementations, even touching on hardware-intrinsic security and automated tools.
To the event website

Fraunhofer AISEC Welcomes
Singapore’s Deputy Prime Minister
The issue of cybersecurity extends beyond national borders. Fraunhofer AISEC works closelywith research institutions in Singapore to promote the exchange of information and open up
new markets in Asia. The visit from high-ranking representatives of the Singaporean governmentand research community to the Garching site in June highlighted the importance of international
cooperation and provided fresh impetus for joint research projects. The guests of honor fromthe spheres of government and research included the Singaporean Deputy Prime Minister andCoordinating Minister for Economic Policies, Heng Swee Keat, and CEO of the National Research
Foundation Singapore, Beh Kian Teik.

Read the press release

Awareness of IT Security
The human element is a key factor in IT security. Fraunhofer AISEC has designed a poster
campaign outlining the basic rules of IT security, with the aim of raising awareness of how to
use IT systems responsibly. The information posters will help increase people’s understandingof cybersecurity and are available to download free of charge.
To the download

25

Trusted
Our
Mission:electronics
To Evaluate,| OurDesign
Mission:and
ToSafeguard
Evaluate, Design
Cybersecurity
and Safeguard Cybersecurity

Our Mission:
To Evaluate, Design and Safeguard Cybersecurity
Fraunhofer AISEC translates excellence in IT security research into applied
solutions for greater dependability, trustworthiness and tamper protectionin IT-based systems and products.

Facts and Figures
Number of employees

Research revenues (in millions of euros)
Base funding / institutional funding

0.45

Industrial revenue
Employees

Student research

Public-sector revenue

assistants

Other revenue incl. EU

2.88

2023:
2023

154

85

20.63 million
euros in total
9.75
7.07

2022

141

90
1.05

0.77
2.88

2.9

2021

130

88

5.76

4.54
6.25

26

5.63

2022:

2021:

15.66 million

14.12 million

euros in total

euros in total

Trusted electronics | Our Research Departments

Our Research
Departments
Security from hardware
to the cloud
COGNITIVE SECURITYTECHNOLOGIES
Security for, with andthrough AI

SECURE SYSTEMSENGINEERING
Secure anduser-friendly
digital systems

SECURE OPERATINGSYSTEMS
Security of hardwarerelated software andoperating systems

SERVICE AND
APPLICATIONSECURITY
Cloud security of
infrastructures,
secure distributed
applications

SECUREINFRASTRUCTURE
Application of cryptographic methods, secure
network protocols

PRODUCTPROTECTION AND
INDUSTRIAL SECURITY
Product protection,
automotive security,
IoT, industrial security,
smart buildings

HARDWARE
SECURITY
Trustworthy
electronics and secure
embedded systems
27

The World of Labs
at Fraunhofer AISEC
Tailor-made solutions based on research excellence

INDUSTRIAL SECURITY LABS
The spectrum of services offered by theIndustrial Security Labs ranges from analyses
for industry 4.0, the internet of things andnetworked production right up to investigating security in building automation.
• Risk analysis and penetration testing• Realistic simulation environments using
actual components• Increased computing capacity for further
simulations (AR and VR)

28

Cybersecurity Training Lab | The World of Labs at Fraunhofer AISECHARDWARE SECURITY LAB
The Hardware Security Lab offersa spectrum of hardware security
analyses, ranging from penetration
testing and side-channel analyses
to attacks on security implementations.
• High-precision EM measurements
for side-channel analysis• Evaluating the security of embedded
systems against hardware-based
attack vectors• Multiple laser stations for front- andbackside fault injection• Common Criteria site certification
for EAL (Evaluation Assurance Level) 7

AUTOMOTIVE SECURITY LAB
The Automotive Security Lab enables
security testing of complete vehicles
and multiple, interacting components
in a secure, trusted environment.
• Risk analysis and penetration testing• Security engineering and vehicle
development methods• Development and testing of security
measures• Environment certified according
to TISAX AL 3

29

The highest quality standards

Our Journey Toward
Climate Neutrality
Fraunhofer AISEC is aiming to be climate-neutral by 2045.
With this ambitious goal in mind, Iris Karabelas is pushing ahead
with sustainability management in her role as Climate Neutrality
and Sustainability Officer.
How close is Fraunhofer AISEC to becoming
climate-neutral?
Iris Karabelas: We are on the right track. Our climate
protection strategy requires us to record our greenhouse gas emissions annually. In 2022, we generated
911 tonnes of CO2 equivalents. That’s 4.03 tonnes of CO2
per capita — which is low compared to companies ofthe same size and in the same industry. We are pleased
with this figure, but the balance sheet also shows that
our heat and electricity consumption and our hardware
are responsible for the majority of our emissions.

In other words, it’s clear where improvements
could be made. What do you plan to do withthese results?
Iris Karabelas: We have identified measures to reduce
our carbon footprint and are now gradually putting
them into practice. For example, we are now using
100% green electricity like the other Fraunhofer
institutes. However, in the future, we also want
to reduce our dependence on suppliers and produce
our own green electricity via a photovoltaic system,
as well as integrate district heating into our energy mix.

We are also committed to incorporating sustainability
into our day-to-day operations. Since 2023, our dedicatedemployees in the AISEC Zero CO2 Club have beenlaunching climate-friendly initiatives such as switching
to recycled paper and securely sharing the use of
hardware. They are also raising awareness among theircolleagues with campaign days on sustainable nutrition
and mobility, for example, and taking other measures
to promote the conservation of resources.

How does this commitment to climate
neutrality affect customers?
Iris Karabelas: We are increasingly finding thatsustainability is a key factor that our customers andpartners consider in project applications and award
processes. Our sustainability management systemprovides evidence that we can meet our customers’
environmental requirements — for example, within
the framework of the German Supply Chain Act (LkSG)
or the globally recognized sustainability standardof the automotive industry (Sustainability Assessment
Questionnaire, SAQ 5.0). This allows us to remain
an attractive research partner and employer.

Apart from electricity and heating, what else
is being done to offset emissions?
Contact
Iris Karabelas: Since emissions are generated evenduring our commutes to work, Fraunhofer AISEC
encourages remote working, subsidizes public transport and supports the use of electric cars by providing
its own charging stations. Sustainability standards
are now an integral part of Fraunhofer’s suppliercontracts in order to reduce carbon emissions fromoutsourced services.

30

Dr. Iris Karabelas
Climate Neutrality and Sustainability Officer
Phone +49 89 3229986-1047
iris.karabelas@aisec.fraunhofer.deThe highest quality standards

Continuous Quality Management
Ensures Adaptability
Scientific excellence, systematic improvement of processes
and appropriate responses to changes and requests fromour customers and partners are crucial factors in our success.
They form the basis for continuous and effective quality
management at Fraunhofer AISEC.
TISAX® (Trusted Information Security
Assessment Exchange)
The automotive industry has defined standards for the confidentiality, availability
and integrity of information. With TISAX®, the ENX Association is working on
behalf of the German Association of the Automotive Industry (VDA) to provide
support for the common acceptance of Information Security Assessments in theautomotive industry. Working with the VDA’s Information Security Assessment
catalog, Fraunhofer AISEC has taken extensive measures in accordance with
TISAX Assessment Level 3 to safeguard information with strict protection requirements, prototype components, parts and vehicles that require protection, andimages of objects that require protection. It has received the TISAX Assessment
Level 3 certificate.

Common Criteria site certification
The Common Criteria site certification is an international IT security standard fortrustworthy software and hardware. Since 2024, Fraunhofer AISEC’s Garching site
has been one of a select number of laboratory infrastructures officially certified toperform assessments of hardware and software based on the Common Criteria
standard. Fraunhofer AISEC has achieved Common Criteria site certification at thehighest security level, EAL (Evaluation Assurance Level) 7. This certification confirmsthat the test laboratory and the infrastructure fulfill all the requirements of various
standards: ISO/IEC 15408-1:2009, -2:2008, -3:2008 and the Common Criteria for
Information Technology Security Evaluation (CC).

ISO 9001:2015
Fraunhofer AISEC has been certified in accordance with the international quality
management standard ISO 9001:2015 since December 2018. This demonstrates
our performance abilities, efficiency and focus on service to our partners andcustomers in Germany and elsewhere. The high standard established in our
approach to quality management is reflected in the excellent results achievedin past certifications awarded by TÜV SÜD Management Service GmbH.

31

Our Advisory Board

Our Advisory Board

Prof. Dr.-Ing. Georg CarleDr. Astrid Elbe

Dr.-Ing. Stefan Hofschen

Chair of Network Architectures andVice President Product Development,

Spokesperson for theServices, School of Computation,

Aviat Networks

advisory board and CEO,
Bundesdruckerei GmbH

Information and Technology,
Technical University of Munich

Dr. Bettina Horster

Dr. Andreas Kind

Andreas Könen

Executive board

Vice President Cybersecurity & Trust,

Former Director-General of Cyber

VIVAI Software AG

Head of Technology SiGREEN,

and Information Security,

Siemens AG

German Federal Ministry of theInterior and Community (BMI)32

Our Advisory Board

Prof. Dr. Dr. h.c. Mira Mezini

Dr. Manfred Paeschke

Dr.-Ing. Heike Prasse

Head of Software Technology Group,

Chief Visionary Officer,

Head of the Security and Networking

Department of Computer Science,

Bundesdruckerei GmbHof Digital Systems department,

Technical University of Darmstadt

German Federal Ministry of Education
and Research (BMBF)

Thomas Rosteck

Vera Schneevoigt

Dr. Stefan Wimbauer

Division President Connected SecureManaging Partner,

Deputy Head of the Applied Research

Systems, Infineon Technologies AG

Guiding for Future GmbHand Cluster Policy department,
Bavarian Ministry of Economic Affairs,
Regional Development and Energy

33

Use case: state-of-the-art
condition monitoring
Fraunhofer CCIT is demonstrating the added value that the edge-cloud continuum
can bring to system monitoring through its AIQ-Bo (AI enhanced Intelligent Bolt)
research project. A smart sensor detects vibrations on mechanical components
in wind turbines or overhead cranes and reports anomalies to prevent damage
and failures.
AI evaluates vibration data directly on the sensor at a local level, autonomously
detects deviations from normal operation and reports these to the cloud.
Computationally intensive tasks such as training the AI algorithm or adapting themodel are carried out in the cloud, and the AI at the edge is updated from there.
Pre-processing data directly in the edge device drastically reduces data transfer
and makes the system extremely energy-efficient. The cloud has a proven trackrecord of scalability and cost efficiency.

34

AIQ-Bo projectFraunhofer CCIT | From Sensor to Cloud and Back Again

From Sensor to Cloud and Back
Again: Technologies for the Digital
Transformation

The internet of things (IoT) is fundamentally changing
the demands being placed on technology. Relying
exclusively on either decentralized data processing
or network computing in remote data centers is notenough. New technologies that merge edge and cloudcomputing into one continuous data space are neededin order to leverage the full potential of the digitaltransformation. This will ensure that computing capacity
can be used dynamically wherever it is most efficient.

Seamless data flow in the edge-cloudcontinuum
When processes need to be performed within a fractionof a second, computing power and storage spaceat the edge are used (i.e., in local sensors, machines
or end devices). Data is analyzed, filtered or compressedin real time where it is generated. This minimizes delays,
reduces the load on the network and ensures functionality even without an internet connection. On theother hand, tasks that are not dependent on time or arecomputationally intensive — such as simulations or AI
algorithm training — are performed in the cloud, wherestorage space and computing power can be scaled andcosts are manageable. This dynamic use of the edge andcloud takes place automatically, working on the basis ofdata volumes and requirements. Data space connectors,
such as the Eclipse Dataspace Connector (EDC), are key

to maintaining a dynamic flow of data within the edgecloud continuum. They make it possible for data to beprocessed, retrieved and distributed sustainably in orderto generate new knowledge.

Cutting-edge applied research from a single
sourceWith Fraunhofer AISEC as the lead institute, the Fraunhofer Cluster of Excellence Cognitive Internet Technologies CCIT brings together cutting-edge appliedresearch from multiple Fraunhofer institutes with theaim of advancing technologies focused on the edgecloud continuum. These range from trustworthy IoTtechnologies for sensors and communication modules
to intelligent and secure data spaces, and even innovative machine learning methods. “Fraunhofer CCIT’s
customized solutions help companies make theirprocesses and products ready for the future and fully
exploit their innovation potential,” explains Michael
Fritz, Head of Fraunhofer CCIT. In addition to technology
development, the researchers at Fraunhofer CCIT provide
comprehensive support for integrating individual components, ensuring smooth interaction between the edge
and the cloud.

Contact

Further information

Michael Fritz
Head of central office,Fraunhofer Cluster of Excellence
Cognitive Internet Technologies CCIT
Phone +49 89 3229986-1026

Fraunhofer CCIT website

michael.fritz@aisec.fraunhofer.deof Fraunhofer AISEC

35

Fraunhofer AISEC —A Great Place to Work

Experience the diversity ofcybersecurity research acrossvarious fields of application.

Work in a research field
that’s only growing
in importance: cybersecurity.

Ten reasons to workat Fraunhofer AISECTranslate the latest
research findings into
practical application.

Gain practical experience
while completing a doctorate
in your chosen field.

36

Bring research andindustry together andconnect both worlds.

Increase the usability andtrustworthiness of digitalapplications.

Find and eliminate security-related vulnerabilities
in both hardware andsoftware.

Conduct research incybersecurity laboratories
equipped with cuttingedge facilities.

Enjoy an excellent work-lifebalance with flexible hours
and remote working.

Work with the latest
cybersecurity technologies,
drive rapid progress in thefield and accelerate yourown personal development.

Awards for Fraunhofer-Gesellschaft as an employer

37

Fraunhofer AISEC — A Great Place to Work38

People of Fraunhofer AISEC | Nisha Jacob Kabakci

Dr.-Ing. Nisha Jacob Kabakci
Head of the Physical Analysis and Countermeasuresresearch group“

I am fascinated by cutting-edge hardware, especially FPGAs. Protecting them means looking beneath the surface, which is something
I do: I scrutinize security properties, and I develop security strategies
and make them safe to use in businesses and wider society.”

In Nisha Jacob Kabakci’s hometown of Bengaluru, a major
Indian city, many women can be found pursuing technicalcareers. On enrolling in the Bachelor’s degree course inElectrical Engineering at Visvesvaraya Technological University,
she received a great deal of support from her extensive family.
After completing the course, her thirst for knowledge andglobal outlook brought her to Switzerland. She studied fora Master’s degree in Embedded Systems at USI Università dellaSvizzera italiana in Lugano, where she became aware of
cryptography in a lecture on IT security. As early as the second
year of her Master’s degree, she went on to complete a oneyear internship at Nanyang Technological University (NTU) in
Singapore, focusing on cryptographic methods and theirimplementation in microcontrollers. This also marked the firsttime she saw IT security in action.
“I saw the direct impact my work was having on protecting
hardware systems — and the significant societal impact it had.
That encouraged me to pursue a career in IT security,” says
Kabakci. She wrote academic papers, attended conferences andbegan actively seeking a job that would allow her to carry out
her own research projects while gaining practical experiencein IT security — and at Fraunhofer AISEC, she found exactly
what she was looking for. She became a research assistantin the Embedded Systems Security department at Fraunhofer
AISEC while working on her doctorate at TUM under Georg
Sigl at the Chair for Security in Information Technology,
which she successfully completed in 2020.

On a tour of discovery in the Hardware Security Lab
In her projects at Fraunhofer AISEC, she examines the securityof embedded systems — especially integrated circuits suchas field-programmable gate arrays (FPGAs) and FPGA systems
on chips, uncovering vulnerabilities and developing measures
to make them more secure and minimize risks. “My work
is very varied, interesting and challenging all at the same time.
I really value our open culture and the mutual support shownby colleagues,” she says. As Head of the Physical Analysis
and Countermeasures group, she advocates diversity, mutual
listening and pursuing common goals.
At the Hardware Security Lab at Fraunhofer AISEC, she andher team investigate physical attacks, subjecting chips that aresupposedly secure to side-channel analysis. This involves a probereading electromagnetic pulses from the chip micrometerby micrometer and extracting its cryptographic key. In fault
injection attacks, lasers are used to tamper with a chip so thatit continues to make calculations based on false conditions.
Glitching attacks that change the supply voltage or clock
frequency by fractions of a second achieve the same results.
Kabakci applies her knowledge of existing vulnerabilities
to support customers and public institutions in the developmentof new security solutions. The Common Criteria certificationof the Hardware Security Lab provides the right environment
for innovative projects requiring a special level of protection.
New workflows and tasks are emerging due to security
measures relating to building technology and personnel.
Kabakci is looking forward to new challenges and acquiring
more insights to make hardware even more secure.

39

People of Fraunhofer AISEC | Ferdinand JarischFerdinand Jarisch
Doctoral student in the Product Protection and Industrial
Security department“

Cybersecurity measures can only succeed if they are tailoredto the system in question. This requires an understandingof the system and knowledge of its weak points, and that’s
exactly what my job at Fraunhofer AISEC involves.”

Ferdinand Jarisch studied physics at TUM. During his
Master’s degree, he specialized in quantum optics andseemed destined for a career in basic research. But thenhe discovered quantum cryptography during a lecture —and was immediately captivated. He was particularlyinterested in the role that quantum physics plays in
the interception-proof exchange of keys as a meansof securing communication. This was an area in which
he was able to combine his passion for solving puzzles
and doing system deep-dives with his interest in
programming and coding. While he was still a student,
he even scripted a program that reserved the bestseats in the movie theater for preview screenings.
As his studies progressed, he frequently participatedin hacking contests such as capture-the-flag (CTF)
events, and counted escape games and geocachingamong his hobbies. Jarisch had found his calling:solving puzzles in the pursuit of cybersecurity.
Next, he wanted to take this skill to a professional level —and that was when he discovered Fraunhofer AISEC.

Cybersecurity for the automotive andindustrial sectors
Jarisch is directly involved in the latest developments
and understands the challenges that customers
in the automotive and industrial sectors are facing.
He is currently researching the automated detectionof vulnerabilities in embedded systems — big brains
on a small scale that are playing an increasingly importantrole in the internet of things (IoT) and are at the heartof many intelligent devices, such as in those found insmart homes and smart factories. During penetration40

tests for the automotive sector, Jarisch and his colleagues
immerse themselves in vehicle IT systems, trying tounderstand them and find weak spots such as the ability
to tamper with the mileage display or bypass digital
payment services. It is also important to consider thatcompanies are constantly having to comply with new
regulations, such as cybersecurity features being incorporated as early as the production phase. Jarisch keeps aneye on these requirements for his customers, tests vehicle
prototypes before release and creates security concepts
that ensure system designs are as secure as possible.
This involves monitoring central digital vehicle technologies — including applications, communication with the
manufacturer’s backend or communication between
vehicles and their environment.
Since 2018, he has been conducting a study on productpiracy for the German Mechanical Engineering Industry
Association (VDMA). This has delivered important insights
into how companies can protect themselves against thetheft of their intellectual property. Alongside his research,
Jarisch represents Fraunhofer AISEC on the Fraunhofer
Scientific and Technical Council (STC), an internal advisory
body to the Fraunhofer executive board. He has also beenlending his fast and confident problem-solving skills to
the German Federal Agency for Technical Relief (THW)
since 2008. As a highly trained member of the THW
team, he has already been deployed to missions abroadin Moldova, Haiti and Guatemala.

Ferdinand Jarisch41

Ferdinand Jarisch42People of Fraunhofer AISEC | Barbora Hrdá

Barbora Hrdá
Doctoral student in the Secure Operating
Systems department
Looking back on her time at a high schoolthat specialized in science, surrounded by
predominantly male teachers and classmates,
Barbora Hrdá describes herself as a reserved
girl from a migrant background. While she
was aware of her talent in mathematics,
she wasn’t sure whether it would be enoughfor her to study for a degree in a technicalsubject.
Born in Prague, she decided to return to her
cultural roots and studied Slavic Studies andTheater Studies at Ludwig Maximilian
University (LMU) of Munich. She completed
her Bachelor’s degree with top grades —but hadn’t found her true calling yet.
While walking the Camino de Santiago from
León to Finisterre, she decided to free herself
from other people’s expectations. “It has to beright for me,” she realized, and shortly after
she enrolled in Computing in the Humanities,
an interdisciplinary computer science course
at the University of Bamberg. Her love of
mathematics, logic, statistics, programmingand developing software systems reassured
her that she was on the right track, and her
Master’s degree gave her a new sense of prideand self-confidence. “I don’t feel I have to hide.
If there’s something I don’t know, I find out
more about it,” is her approach to challenges.
During her time as an IT trainee, she enjoyedtrying out new things and developing her skills
in different areas, but then found that her first
corporate position lacked these opportunities.
She applied to Fraunhofer in the hope ofcontributing her own ideas and creating workthat would have a positive societal impact.

Appreciation and spacefor development
During her job interview at Fraunhofer AISEC,
she was immediately made to feel valued;
a sense of appreciation that has always stayedwith her. Over her four years at Fraunhofer
AISEC, she has experienced a steep learning
curve and worked on exciting projects. Startingout in mobile security and virtualization technologies, she now specializes in IT security forquantum computing platforms. She is currently
working on protective mechanisms for thisemerging technology, using both classic andquantum mechanical approaches. “It requires
a completely different way of thinking anda lot of creativity,” she says. She analyzes data
streams, develops ideas and designs security
tools that expand the range of security
measures available specifically in the fieldof quantum computing. As an example, she iscurrently investigating options for encryption
between a classic client and a quantum server.
Her endeavors are laying the foundations forthe secure use of quantum computers in bothbusiness environments and wider society.
Curiosity, the joy of learning, creative freedom
and the societal relevance of her work are what
she values most.
Barbora is currently completing her doctoral
project on the integrity and confidentialityof data for Quantum Computing-as-a-Service.
Her research is being applied directly in customer projects, adding real value to the worldof business and society.

“
You should dowhat you love —and that’s also
true for yourchoice of career.
The most rewarding aspects of mywork are quenching my thirstfor knowledge,
contributing myown ideas andhaving a positive
impact on
the economy
and society.”43

People of Fraunhofer AISEC | Martin Seiffert

Martin Seiffert
Senior Scientist in the Secure Systems
Engineering department“

We construct the toolbox and help you choose the righttools for designing and operating digital systems securely.”

Martin Seiffert stores a variety of electronic ID types
on his smartphone and uses them to identify himself
in online services. His digital ID card makes completing
his tax return easier, for example, and the Berlin nativeis also experimenting with health insurance apps,
curious to see what his work looks like in practice.
Since graduating with a degree in IT and working asa research assistant and doctoral student at the Freie
Universität Berlin, Seiffert has been researching information security and secure digital identities in the
Secure Systems Engineering department of Fraunhofer
AISEC since 2018. Working with industry partners
and public institutions — for example, in the Secure
Digital Identities Showcase innovation competition heldby the German Federal Ministry for Economic Affairs
and Climate Action — the computer scientist helps todesign secure eID solutions and digital ecosystems, andevaluates them on the basis of international standards,
national guidelines and European regulations such as
the eIDAS Regulation (governing electronic identificationand trust services). His goal is to provide comprehensive
information security that works in harmony with otherrequirements, such as privacy, usability, interoperability
and scalability.

Digital identities in a trustworthy
environment
In a secure ecosystem, there are other factors besides
digital identities that determine whether access tosensitive data is granted. Seiffert and his team havedeveloped a concept for the future security architectureof the telematics infrastructure with this in mind. In thehealthcare sector information network, only selectedstakeholders, such as practices, hospitals, pharmacies

44

and health insurance companies, are currently able
to access patient data or electronic prescriptions using
proprietary hardware. Ever logic-focused, Seiffert islooking to zero trust as a means of future-proofing
healthcare services: This means that every single accessrequest is checked, authenticated and authorizedusing an eID on a smartphone in combination withother factors such as location and time of access.
Despite this data-hungry approach, Seiffert is highlycommitted to protecting the privacy of users. This isimportant not only to the millions of people whose
highly private data is affected by his work (see page 21
for more information on the telematics infrastructure),
but also to himself.

Finding the best solution with logic
and structure
Seiffert considers his strength to be his understandingof structure. As the analyst states, “If we want to see
progress in major digitalization projects, we need tounderstand which tools can help us make groundbreaking decisions.” His field of research is based on
extensive experience and expertise. He is passionate
about helping his customers overcome the challenging
task of maintaining a clear view when dealing withhighly complex systems. Together with his team,
he develops solution options systematically and clearly,
making them measurable and therefore comparable.
His affinity for methodology enables him to makeinformed decisions in favor of good, feasible solutions — but not perfection, as there is no such thing
as a perfect solution in this dynamic field.

A word from our customers | Martin Seiffert

45

Publications

Publications
Alexander Küchler, Leon Wenning, Florian Wendland: »AbsIntIO: Towards Showing the Absence of Integer Overflows in
ARM Binaries«. In: Proceedings of ACM Asia Conference on Computer and Communications Security. ASIA CCS ’23. 2023.
Anna-Magdalena Krauß, Sandra Kostic, Rachelle A. Sellung: »A more User-Friendly Digital Wallet? User Scenarios of a
Future Wallet«. Open Identity Summit 2023. DOI: 10.18420/OID2023_06. Bonn: Gesellschaft für Informatik e.V. pp. 73-84. Regular Research Papers. Heilbronn, Germany. 15.-16. June 2023.
Anna-Magdalena Krauß, Sandra Kostic, Rachelle A. Sellung: »Ist das die Wallet der Zukunft?« HMD 60, 344–365 (2023).
Bernhard Lippmann, et al.: »VEFIDES: Designing Trustworthy Supply Chains Using Innovative Fingerprinting Implementations«.
In: Design, Automation & Test in Europe Conference & Exhibition (DATE). 2023.
Carl Riehm, Christoph Frisch, Florian Burcea, Matthias Hiller, Michael Pehl, Ralf Brederlow: »Structured Design and Evaluation of a Resistor-Based PUF Robust Against PVT-Variations«. In: International Symposium on Design and Diagnostics of Electronic
Circuits and Systems (DDECS). 2023.
Christian Banse, Immanuel Kunz, Nico Haas, Angelika Schneider: »A Semantic Evidence-based Approach to Continuous
Cloud Service Certification«. In: Proceedings of the 38th ACM/SIGAPP Symposium on Applied Computing. SAC ’23. New York,NY, USA: Association for Computing Machinery, 2023.
Dariush Wahdany, Carlo Schmitt, Jochen L. Cremer: »More than accuracy: end-to-end wind power forecasting that optimises
the energy system«. In: Electric Power Systems Research. 2023.
Felix Oberhansl, Tim Fritzmann, Thomas Pöppelmann, Debapriya Basu Roy, Georg Sigl: »Uniform instruction set extensions for multiplications in contemporary and postquantum cryptography OFP+23«. In: Journal of Cryptographic Engineering(2023).
Hendrik Meyer zum Felde, Jean Luc Reding, Michael Lux: »Decentralized Geolocation and Time Enforcement for Usage
Control«. In: 8th IEEE European Symposium on Security and Privacy Location. Privacy Workshop. 2023.

46

People of Fraunhofer AISEC | Publications

Immanuel Kunz, Konrad Weiss, Angelika Schneider, Christian Banse: »Privacy Property Graph: Towards Automated Privacy
Threat Modeling via Static Graph-based Analysis«. In: Proceedings on Privacy Enhancing Technologies. 2023.
Johannes Geier, Lukas Auer, Daniel Mueller-Gritschneder, Uzair Sharif, Ulf Schlichtmann: »CompaSeC: A Compiler-Assisted Security Countermeasure to Address Instruction Skip Fault Attacks on RISC-V«. In: Proceedings of the 28th Asia and South
Pacific Design Automation Conference. ASPDAC’23. New York, NY, USA: Association for Computing Machinery, pp. 676–682,
2023.
John Morris, Stefan Tatschner, Michael P. Heinl, Patrizia Heinl, Thomas Newe, Sven Plaga: »Cybersecurity as a Service«.
In: Cybersecurity Vigilance and Security Engineering of Internet of Everything. Ed. by Kashif Naseer Qureshi, Thomas Newe,
Gwanggil Jeon, Abdellah Chehri. Cham: Springer Nature Switzerland, 2024, pp. 141–161.
Konrad Hohentanner, Florian Kasten, Lukas Auer: »HWASanIO: Detecting C/C++ Intra-object Overflows with Memory Shading«. In: Proceedings of the 12th ACM SIGPLAN International Workshop on the State Of the Art in Program Analysis. 2023, pp.
27–33.
Konrad Hohentanner, Philipp Zieris, Julian Horsch: »CryptSan: Leveraging ARM Pointer Authentication for Memory Safety in
C/C++«. In: Proceedings of the 38th ACM/SIGAPP Symposium on Applied Computing. SAC ’23. New York, NY, USA: Association
for Computing Machinery, 2023.
Konrad Hohentanner, Philipp Zieris, Julian Horsch: »CryptSan: Leveraging ARM Pointer Authentication for Memory Safety in
C/C++«. In: Proceedings of the 38th ACM/SIGAPP Symposium on Applied Computing. SAC ’23. New York, NY, USA: Association
for Computing Machinery, 2023. ISBN: 9781450395175/23/03.
Konrad Hohentanner, Philipp Zieris, Julian Horsch: »CryptSan: Leveraging ARM Pointer Authentication for Memory Safety in
C/C++ Hohentanner2023 CryptSan«. In: Proceedings of the 38th ACM/SIGAPP Symposium on Applied Computing. SAC ’23. New
York, NY, USA: Association for Computing Machinery, 2023.

47

Publications

Marc Fischlin, Jonas von der Heyden, Marian Margraf, Frank Morgner, Andreas Wallner, Holger Bock: »Post-Quantum
Security for the Extended Access Control Protocol«. In: 8th Security Standardisation Research Conference, SSR 2023, Lyon, France.
2023.
Martin Schanzenbach, Christian Grothoff, Bernd Fix: »The GNU Name System« RFC 9498. Nov. 2023.
Maximilian Richter, Magdalena Bertram, Jasper Seidensticker, Marian Margraf: »Cryptographic Requirements of Verifiable Credentials for Digital Identification Documents«. SDIM/COMPSAC 2023.
Maximilian Kaul, Alexander Küchler, Christian Banse: »A Uniform Representation of Classical and Quantum Source Codefor Static Code Analysis«. In: 2023 IEEE International Conference on Quantum Computing and Engineering. QCE ’23. 2023, pp.
1013–1019.
Michael P. Heinl, Simon Gölz, Christoph Bösch: »Remote Electronic Voting in Uncontrolled Environments: A Classifying
Survey«. In: ACM Comput. Surv., 2023.
Michael P. Heinl, Maximilian Pursche, Nikolai Puch, Sebastian Peters, Alexander Giehl: »From Standard to Practice:
Towards ISA/IEC 62443conform Public Key Infrastructures«. In: SAFECOMP 2023: 42nd International Conference on Computer
Safety, Reliability and Security. Toulouse, France: Springer International Publishing, 2023, pp. 196–210.
Nicolas Müller, Jochen Jakobs, Jennifer Williams, Philip Sperl, Konstantin Böttinger: »Localized Shortcut Removal«. In:
The 2nd XAI4CV Workshop at CVPR 2023 (2023).
Nicolas Müller, Jochen Jochen, Jennifer Williams, Konstantin Böttinger: »Localized Shortcut Removal«. In: 2nd XAI4CV
Workshop at CVPR. 2023.
Nicolas Müller, Philip Sperl, Konstantin Böttinger: »Complex valued neural networks for antispoofing«. In: Interspeech 2023
(2023).
Philipp Fuxen, Rudolf Hackenberg, Michael P. Heinl, Mirko Ross, Heiko Roßnagel, Christian H. Schunck, Raphael Yahalom: »Lock-in Thermography for the Localization of Security Hard Blocks on SoC Devices«. In: Open Identity Summit 2023. Ed. by
Heiko Roßnagel, Christian H. Schunck, Jochen Günther. Gesellschaft für Informatik e.V., 2023.
Philipp Fuxen, Rudolf Hackenberg, Michael P. Heinl, Mirko Ross, Heiko Roßnagel, Christian H. Schunck, Raphael Yahalom: »MANTRA: A Graphbased Unified Information Aggregation Foundation for Enhancing Cybersecurity Management in Critical
Infrastructures«. In: Open Identity Summit 2023. Ed. by Heiko Roßnagel, Christian H. Schunck, Jochen Günther. Gesellschaft fürInformatik e.V., 2023.
Sandra Kostic, Maija Poikela: »Der Wandel von Vertrauen in eine digitale Identität? – Einblicke in eine Nutzerstudie«. HMD 60,
322–343 (2023).
Sandra Kostic, Maija Poikela: »The State or Private Enterprise? — The Shift in Users’ Preference for the Provider of an Identity
Wallet”. SOUPS 2023 - Symposium on Usable Privacy and Security. 7. Aug. 2023
Stefan Tatschner, Sebastian Peters, David Emeis, John Morris, Thomas Newe: »A Quic(k) Security Overview: A Literature
Research on Implemented Security Recommendations«. In: ARES 2023. Benevento, Italy: ACM, 2023.
Stefan-Lukas Gazdag, Sophia Grundner Culemann, Tobias Heider, Daniel Herzinger, Felix Schärtl, Joo Yeon Cho, Tobias
Guggemos, Daniel Loebenberger: »Quantumresistant MACsec and IPsec for Virtual Private Networks«. In: Günther, F., Hesse, J.
(eds) Security Standardisation Research. SSR 2023. Lecture Notes in Computer Science, vol 13895. Springer, Cham.

48

Publications

Stefan-Lukas Gazdag, Sophia Grundner Culemann, Tobias Heider, Daniel Herzinger, Felix Schärtl, Joo Yeon Cho, Tobias
Guggemos, Daniel Loebenberger: »8th Security Standardisation Research Conference, SSR 2023, Lyon, France, April 2023«. In:
Security Standardisation Research. Ed. by F. Günther, J. Hesse. Vol. 13895. Lecture Notes in Computer Science. Berlin, Heidelberg,
2023, pp. 1–21.
Sebastian Sitaru, Georg Bramm, Alexander Zink, Matthias Hiller: »Cybersecurity in digital healthcare – challenges andpotential solutions«. In: Die Dermatologie (2023).
Stefan-Lukas Gazdag, Sophia Grundner-Culemann, Tobias Heider, Daniel Herzinger, Felix Schärtl, Joo Y. Cho, Tobias
Guggemos, Daniel Loebenberger: »Quantum-resistant MACsec and IPsec for Virtual Private Networks«. In: 8th Security Standardisation Research Conference, SSR 2023, Lyon, France. 13895, 1–21. 2023
Simon Ott, Monika Kamhuber, Joana Pecholt, Sascha Wessel: »Universal Remote Attestation for Cloud and Edge Platforms«.
In: Proceedings of the 18th International Conference on Availability, Reliability and Security. ARES ’23. Benevento, Italy: Association for Computing Machinery, 2023.ISB N: 9798400707728.
Tobias Holl, Katharina Bogad, Michael Gruber: »Whiteboxgrind – Automated Analysis of Whitebox Cyptography«. In:
Constructive Side-Channel Analysis and Secure Design. Ed. by E. B. Kavun, M. Pehl. COSADE 2023. Springer Nature Switzerland,
221–240, 2023.
Tudor Soroceanu, Nicolas Buchmann, Marian Margraf: »On Multiple Encryption for Public-Key Cryptography«. Cryptography.
2023; 7(4):49.

49

Publishing Notes

Publishing Notes
Published by
Fraunhofer Institute for Applied and Integrated Security AISEC
Prof. Dr. Claudia Eckert
Prof. Dr. Georg Sigl
Lichtenbergstr. 1185748 Garching bei München, Germany
Phone +49 89 3229986-0
www.aisec.fraunhofer.de/en.html

Page 33: Werner Bartsch; Bavarian Ministry of Economic
Affairs, Regional Development and Energy; Hessian.AI
Page 34: Fraunhofer CCIT
Page 35: Fraunhofer-Gesellschaft
Page 38: Oliver Bodmer
Page 41: Oliver Bodmer
Page 42: Oliver Bodmer
Page 45: Gene Glover
All other photos: © Fraunhofer AISEC

Editorial teamMaria Schwab-Kloe, Wiebke Ramm, Pia Kinzler,
Tobias Steinhäusser (lead editor)

All rights reserved.
Reproduction and distribution only with the editorial
team’s approval.

LayoutMaria Schwab-Kloe© Fraunhofer Institute for Appliedand Integrated Security AISEC
Garching bei München, May 2024

Graphics
Daniela MiedanerPrinted byZimmermann GmbH Druck & Verlag
Contact
Fraunhofer Institute for Applied and Integrated Security AISEC
Lichtenbergstr. 1185748 Garching bei München, Germany
Phone +49 89 3229986-170
marketing@aisec.fraunhofer.de
CoverTargeted electromagnetic measurements on an exposed chipin the Fraunhofer AISEC Hardware Lab.
Photo acknowledgments
Cover: Oliver Bodmer
Page 4: Bernd Müller, Andreas Heddergott
Page 9: MAN, Andreas Heddergott
Page 10: Freepik, Fraunhofer AISEC
Page 13: Oliver Bodmer
Page 14: Freepik, Fraunhofer AISEC
Page 17: Andreas Heddergott, Creative Commons/TECNALIA
Page 18: Gene Glover, AllEyesOnYou.de, Freepik
Page 21: Adobe Stock, AllEyesOnYou.de, Oliver Bodmer
Page 22: Oliver Bodmer, Andreas Heddergott
Page 24: Oliver Bodmer
Page 26: HGEsch
Page 32: Andreas Heddergott/TUM, Oliver Rösler,
Adam Bacher, Bundesdruckerei GmbH, Rene Bertrand,
Bundesdruckerei GmbH50

Follow us!

Fraunhofer AISEC
cybersecurity blog

LinkedIn

XING

X

51