Master Thesis Student - Security Contracts for Compositional Assurance

Security Contracts for Compositional Assurance Introduction How can we reason about the cybersecurity of a complex system when its components are developed independently? This thesis offers an opportunity to explore a fundamental challenge in cybersecurity architecture: understanding how security properties of individual components relate to the security of the system as a whole. Working alongside TRATON's cybersecurity architecture team, you will investigate concepts that could contribute to future approaches for reasoning about secure systems. Background Distributed cyber-physical systems consist of interacting hardware and software components. Security contracts express assumptions about a component's environment and guarantees it provides. An open question is when such local statements can meaningfully support claims about system-level security, and what limitations remain. Objective Investigate how assumption-guarantee security contracts can support reasoning about a small composition of components. Compare two existing approaches and identify their assumptions, capabilities and limitations without developing a production solution. Job description The thesis student will investigate how security contracts based on assumptions and guarantees can support reasoning about the security of composed systems. The work will include: • Studying the fundamental concepts of security contracts and compositional assurance. • Identifying and comparing two relevant existing approaches, focusing on their assumptions, capabilities and limitations. • Applying the concepts to a small, illustrative system consisting of interacting components. • Analyzing the findings and discussing their potential relevance to security architecture. The work will focus on fundamental understanding and conceptual evaluation rather than the development of a production-ready solution. Depending on the student's interests and progress, additional aspects such as formal modelling or automated verification may be explored. The expected outcome is a master's thesis presenting the investigation, comparison, illustrative example and conclusions. Education/program/focus Master's student in Computer Science, Computer Engineering, Cybersecurity, Software Engineering or similar. Interest in system architecture and security is welcome; advanced formal-methods expertise is not required. Number of students: 1 Start date for the thesis work: [to be agreed] Estimated time required: 20 weeks full-time (30 hp, subject to university confirmation) Contact persons and supervisors Marcus Lindner marcus.lindner@scania.com Application: Your application must include a CV, personal letter and transcript of grades A background check might be conducted for this position. We are conducting interviews continuously and may close the recruitment earlier than the date specified.