© Fraunhofer
APPLIED AND INTEGRATED SECURITY
Directors:
Claudia Eckert (Managing) Georg Sigl
© Fraunhofer
SECURITY RESEARCH IN MUNICH
2
Fraunhofer Institution for
Applied and Integrated Security
Claudia Eckert Georg Sigl
TU München
Computer
Science
Claudia Eckert
TU München
Electrical
Engineering
© Fraunhofer
AISEC MISSION:
MIT SICHERHEIT INNOVATIV!
Development of innovative Security Technologies
to improve Robustness, Dependability and Security of IT-based Systems and Infrastructures
Development of innovative, new Applications
to improve existing (IT-based) Workflows and to enable new Business Models
Development of Test Methods and Tools
to improve the Quality of Products, Designs, Applications, … to minimize Risks and reduce Damages
© Fraunhofer
AISEC KEY FIGURES
Employees: 2013: current status: 98 (incl. 62 FTEs) Plans for further growth
2014 > 110
2015 > 150 Financing (Fraunhofer Model)
© Fraunhofer
AISEC
FIELDS OF EXPERTISE
Embedded Security
Smartcard & RFID Security
Product Protection
Cloud Security
Network Security
Automotive Security
Smart Grid
Security Evaluation
Mobile Security
© Fraunhofer
© Fraunhofer
EMBEDDED SECURITY
RESEARCH & DEVELOPMENT AREAS
Secure (wireless) Transaction Systems
e.g. Remote Keyless Entry (RKE) based on elliptic curves
Concepts for Component Identification/Authentication
using Physical Unclonable Functions (PUF)
Hardware Security Modules (HSM)
as hardware trust anchor
Mechanism for Product and Piracy Protection
to prevent cloning and IP theft
Trustworthy Platforms and Virtualization
as a secure software environment
Methods and Tools
to support designers in secure software design and verification
© Fraunhofer
SECURE SERVICES
RESEARCH & DEVELOPMENT AREAS
Cloud Security:
Security-Monitoring-Framework
TapnDrop: Secure Data
Exchange (e.g. in meeting) using Cloud Backend Storage
Secure Distributed Storage
Mobile Security:
Security Analysis Framework for Android
Vulnerability Assessments
AppRay: App-Security Checks
to be integrated e.g. in »Company App Store«
Development Monitoring Testbed
Cloud
Portfolio
Penetration TestTest-Frameworks Compliance &
Interoper- ability Analysis Interoperability Whitepapers Knowledge Security as a
© Fraunhofer
NETWORK SECURITY
RESEARCH & DEVELOPMENT AREAS
Network Security:
Security Architectures for Secure Cloud-Networking
Software Defined Networking (SDN): Security Analysis, new Security Protocols & Applications
Cyber Security:
New and improved attack detection techniques
Collaborative information exchange between e.g. operators, information exchange w/o loss of reputation
System & Network Evaluation and Test
PRIvacy VIolation DetectOR: Tool to support website analysis
© Fraunhofer
AISEC Security Analysis Labs: Examples
Hardware Security Lab
Analysis and validation of HW components & security modules
NFC Lab
Analysis of NFC solutions, e.g., mobile payment
Smart Meter Lab
Vulnerability assessment of Smart Meter and Gateways
Network-Lab
Malware Analysis, SDN-Lab, HIP („IPSec2.0“)
Cloud-Lab
Interoperability tests on OpenSource Stacks, Security as a Service
Mobile Lab
© Fraunhofer
Hardware Security Lab
Attacks and Analysis
(Differential) Power analysis (SPA, DPA)
Template attacks
Electromagnetic Radiation Analysis (EMA)
Fault Attacks
Temperature Attacks
Offerings
Security Analysis (Black Box, White Box)
Design Verification
© Fraunhofer
SMART GRID
Secure Smart Meter
Problem
Attacks on Control Systems
Fraud
Privacy Protection
Innovative Solutions
Security Concepts for Smart Meterand Gateways
Adapted Hardware Security Modules andEfficient (Cryptographic) Protocols
Concepts for Anonymity and Pseudonyms
Advantage
Development of Smart Grid Reference© Fraunhofer
TAPNDROP: SECURE FILESHARING
THROUGH THE CLOUD
Data Exchange via Cloud
Spontaneous Data sharing in
a Meeting between present People
Client-side Encryption
no Trust in Cloud Provider required
Key Exchange through NFC: AES256 Session Key
Session-Management: Limited Key Validity
13
© Fraunhofer
APP-RAY: AUTOMATIC APP SECURITY CHECK
Automated Check of Android-Apps for Security Weaknesses
Privacy Violations
User defined Catalogue of Criteria 14
© Fraunhofer
AISEC PARTNERS*
© Fraunhofer
NETWORKING
Cloud security Alliance WWR ETSI Organisations Embedded AllianceCollaborative Work: e.g. ILT, IIS, EMFT, IWES, Fraunhofer Computer Science Electrical engineering TU Munich BICCnet (Security cluster) Eurosmart TCG Car2Car AISEC Associations Cloud Alliance Kantara Münchner Kreis TeleTrust GFFT CAST eV GESA VDE/ITG BITKOM Safetrans Other Research Institutions
© Fraunhofer
Technische Universität München
SICHERHEITS-CLUSTER MÜNCHEN
© Fraunhofer
Mobile Security
Secure Cyber Physical Systems Security Evaluation CC Cyber- Security CC Test & Simulation CC Cloud & eID Cyber Security Center
Industry & Appilcation Partners Research Partners Ulm Passau Erlangen fortiss
THE FUTURE
© Fraunhofer
AISEC SERVICES AND OFFERINGS
Studies
risk analyses, evaluation of technologies and concepts Tests
vulnerability analyses, technical pre-auditing Development
concepts, proofs-of-concepts, implementation, integration Modeling
security concepts, optimization of infrastructures & solutions Training & Consulting
© Fraunhofer
OUR STRENGTHS
Our labs provide ideal environment for evaluations. Security analysis and testing
Interoperability testing, conformance testing
We have the right competences, environment and labs to design prototypes demonstrating tailored solutions,
develop proof-of-concepts demonstrating improved solutions
Our knowledge about all layers: Hardware, Embedded,
Networking,
Services, Cloud, Processes
allows us to provide holistic security solutions.
© Fraunhofer
THANK YOU
Contact:
Georg Sigl: [email protected]
Claudia Eckert: [email protected] [email protected]
