Drahtlose ad-hoc Netzwerke zwischen Fahrzeugen, sog. Vehicular ad-hoc Networks (VANETs), bilden einen Ansatz zur Verbesserung der Verkehrssicherheit, indem sie zukünftige kooperative Fahrerassistenzsysteme ermöglichen. Diese Netzwerke erfordern ein hohes Sicherheitsniveau, sowohl in Bezug auf Datenintegrität und -authentizität als auch im Bereich Datenschutz. Aktuell verfügbare Technologien können diese Anforderungen nicht vollständig erfüllen. Etliche Nachteile aktueller VANET-Ansätze werden in dieser Arbeit aufgezeigt. In dieser Arbeit werden drei Schachpunkte von ETSI ITS bzw. WAVE basierten VANETs identifiziert, welche Angriffe auf Teilnehmer dieser Netzwerke ermöglichen. Diese ergeben sich aus 1. konstanten und für Teilnehmer charakteristischen Datensätzen innerhalb der zyklisch versandten Statusnachrichten, welche den Datenschutz der Fahrzeuge und damit auch ihrer Fahrer gefährden, 2. die Strategie zur Verteilung von digitalen Zertifikaten von Zertifizierungsstellen erlaubt es selbst Angreifern mit minimalen Fähigkeiten (einzelner, statischer Angreifer von außerhalb des Netzwerkes) die Kanallast in einem großen Teilgebiet des Netzwerkes massiv zu erhöhen, 3. GNSS Manipulation durch sog. spoofing erlaubt Angriffe auf zeit- und ortsbasiere Informationen in Fahrzeugen, wodurch sich folgende Gefährdungen ergeben: a. Der Grundanforderung Teilnehmer durch Nichtabstreitbarkeit der gesendeten Daten für ihr Verhalten zur Rechenschaft ziehen zu können wird die Grundlage entzogen, da der Zeitpunkt des Sendens der Daten nicht mehr sicher festgestellt werden kann. b. Die Zugangskontrolle zum System wird gefährdet, da angegriffene Teilnehmer veraltete Nachrichten und digitale Zertifikate akzeptieren. c. Angreifer können einen sog. Sybil Angriff durchführen. Es ist notwendig die identifizierten Sicherheitsprobleme zu beheben um eine sichere Verwendung von VANETs für zukünftige kooperative Fahrerassistenzsysteme zu ermöglichen. Weiterhin werden einige Designprobleme in ETSI ITS Protokollen identifiziert. Die bisherige Art der Nachrichtenzusammensetzung auf den einzelnen Protokollschichten führt häufig zu Gesamtnachrichten, welche die zulässige maximale Gesamtlänge auf niedrigen Protokollschichten überschreitet. Da solche Nachrichten nicht versandt werden könne, können diverse wichtige Datensätze nicht im Netzwerk verteilt werden. Außerdem ist keine verschlüsselte Ende-zu-Ende Kommunikation über eine Multi-Hop Verbindung möglich, da die notwendigen Routing-Informationen den weiterleitenden Teilnehmern nicht zur Verfügung stehen. Es werden Vorschläge diskutiert, wie diese Probleme gelöst werden können. Zur Adressierung der genannten Probleme werden u.a. folgende Maßnahmen vorgeschlagen: 1. Eine sichere Zeitsynchronisierung in VANETs ist notwendig. 2. Das Speichern von mehreren Fahrzeug-Zertifikaten mit gleicher Laufzeit ist zu vermeiden. 3. Das Speichern von Fahrzeug-Zertifikaten mit zukünftiger Laufzeit ist auf ein Minimum zu begrenzen. 4. Konstante und gleichzeitig für Teilnehmer charakteristische Datensätze sind nicht zu versenden. 5. Weitere Mechanismen zur Minimierung der Kanallast durch Zertifikatsverteilung sind notwendig, u.a. a. nach einem Pseudonymwechsel sollte dieser explizit signalisiert werden um das Versenden aller Zertifikate in der Umgebung durch die Detektion eines neuen Nachbarn zu verhindern. b. es sollte keine Verteilung von Zertifikatsketten erfolgen, da einzelne Zertifikate ausreichen. c. die Anzahl der Übermittlungen von Zertifikaten von Zertifizierungsstellen ist zu minimieren. Die Anwendung der genannten Verbesserungen überwindet die meisten Sicherheitsprobleme (1,2, und 3c). Für die weiteren Probleme kann der notwendige Aufwand für einen erfolgreichen Angriff deutlich erhöht werden. / Vehicular ad-hoc networks (VANETs) are an important approach to increase future safety of driving by enabling cooperative advanced driver assistance systems. However, rigid security and privacy requirements employed to conducted wireless data exchange still pose significant challenges for VANET approaches. Several weaknesses of the current state of the art of VANET approaches from ETSI ITS as well as WAVE standard frameworks have been identified in this work. Three main attack surfaces of ETSI ITS or WAVE based VANETs are identified in this thesis, which are 1. constant and distinctive content in data fields within frequently sent VANET messages highly endanger privacy of vehicles, and thereby also their drivers, 2. the distribution strategy of certificate authority (CA) certificates allows even a simple static outsider attacker to massively increase the channel load within a large area around the attacker, which significantly exceeds his own communication range, and 3. GNSS spoofing modifying time and position information inside nodes a. endangers the basic system requirement of accountability by circumventing the nonrepudiation feature of the employed digital signature scheme, b. endangers the access control system by forcing the acceptance of outdated messages and certificates, and c. enables an attacker to perform a Sybil attack. The identified security problems need to be overcome to re-enable secure usage of VANETs and ADASs, which are based on the information obtained via VANETs. Several protocol design weaknesses of the ETSI ITS approach have been identified. It is found that the standardized way of cross layer message assembly leads to frequent violation of low layers’ maximum packet size restrictions. This causes inabilities to distribute important data sets from the application layer. Furthermore, confidential end-to-end encrypted communication over a multi-hop connection is impossible, as forwarders cannot access required routing information. This is caused by incorrect data encryption rules. Approaches to overcome the found shortcomings are proposed and evaluated. To overcome the outlined security issues, several improvements have been proposed. These include, 1. secure time synchronization among nodes, but current mechanisms can hardly provide it, 2. caching of multiple pseudonym certificates being valid during the same time span is to be avoided, 3. pre-caching of pseudonym certificates valid in the future is to be limited to a minimum, 4. presence of constant but distinctive data sets within VANET messages has to be avoided to enable privacy conserving pseudonym changes, 5. mechanisms for limiting the channel load caused by certificate distribution are required, especially a. after a pseudonym change the number of superficial pseudonym certificate distributions due to new neighbor detection should be limited by using explicit signaling of the change, b. sending of certificate chains should be removed altogether, instead individual dissemination should be used for CA certificates, and c. the number of CA certificate deliveries after a request for such a kind of certificate should be limited to a minimum by using targeted requests. By employing the given improvements most of the found security weaknesses can be overcome (issues 1, 2 and 3c). For the remaining weaknesses the required capabilities for a successful attack can be made significantly more challenging.

The system code TRACE is the latest development of the U.S. Nuclear Regulatory Commission (US NRC). TRACE, developed for the analysis of operational conditions, transients and accidents of light water reactors (LWR), is a best-estimate code with two fluid, six equation models for mass, energy, and momentum conservation, and related closure models. Since TRACE is mainly applied to LWR specific issues, the validation process related to innovative nuclear systems (liquid metal cooled systems, systems operated with supercritical water, etc.) is very limited, almost not existing. In this work, essential contribution to the validation of TRACE related to lead and lead alloy cooled systems as well as systems operated with supercritical water is provided in a consistent and corporate way. In a first step, model discrepancies of the TRACE source code were removed. This inconsistencies caused the wrong prediction of the thermo physical properties of supercritical water and lead bismuth eutectic, and hence the incorrect prediction of heat transfer relevant characteristic numbers like Reynolds or Prandtl number. In addition to the correction of the models to predict these quantities, models describing the thermo physical properties of lead and Diphyl THT (synthetic heat transfer medium) were implemented. Several experiments and numerical benchmarks were used to validate the modified TRACE version. These experiments, mainly focused on wall-to-fluid heat transfer, revealed that not only the thermo physical properties are afflicted with inconsistencies but also the heat transfer models. The models for the heat transfer to liquid metals were enhanced in a way that the code can now distinguish between pipe and bundle flow by using the right correlation. The heat transfer to supercritical water was not existing in TRACE up to now. Completely new routines were implemented to overcome that issue. The comparison of the calculations to the experiments showed, on one hand, the necessity of these changes and, on the other hand, the success of the new implemented routines and functions. The predictions using the modified TRACE version were close to the experimental data. After validating the modified TRACE version, two design studies related to the Generation IV International Forum (GIF) were investigated. In the first one, a core of a lead-cooled fast reactor (LFR) was analyzed. To include the interaction between the thermal hydraulic and the neutron kinetic due to temperature and density changes, the TRACE code was coupled to the program system ERANOS2.1. The results gained with that coupled system are in accordance with theory and helped to identify sub-assemblies with the highest loads concerning fuel and cladding temperature. The second design which was investigated was the High Performance Light Water Reactor (HPLWR). Since the design of the HPLWR is not finalized, optimization of vital parameters (power, mass flow rate, etc.) are still ongoing. Since most of the parameters are affecting each other, an uncertainty and sensitivity analysis was performed. The uncertainty analysis showed the upper and lower boundaries of selected parameters, which are of importance from the safety point of view (e.g., fuel and cladding temperature, moderator temperature). The sensitivity study identified the most relevant parameters and their influence on the whole system.

IT systems for healthcare are a complex and exciting field. One the one hand, there is a vast number of improvements and work alleviations that computers can bring to everyday healthcare. Some ways of treatment, diagnoses and organisational tasks were even made possible by computer usage in the first place. On the other hand, there are many factors that encumber computer usage and make development of IT systems for healthcare a challenging, sometimes even frustrating task. These factors are not solely technology-related, but just as well social or economical conditions. This report describes some of the idiosyncrasies of IT systems in the healthcare domain, with a special focus on legal regulations, standards and security. / IT Systeme für Medizin und Gesundheitswesen sind ein komplexes und spannendes Feld. Auf der einen Seite stehen eine Vielzahl an Verbesserungen und Arbeitserleichterungen, die Computer zum medizinischen Alltag beitragen können. Einige Behandlungen, Diagnoseverfahren und organisatorische Aufgaben wurden durch Computer überhaupt erst möglich. Auf der anderen Seite gibt es eine Vielzahl an Fakturen, die Computerbenutzung im Gesundheitswesen erschweren und ihre Entwicklung zu einer herausfordernden, sogar frustrierenden Aufgabe machen können. Diese Faktoren sind nicht ausschließlich technischer Natur, sondern auch auf soziale und ökonomische Gegebenheiten zurückzuführen. Dieser Report beschreibt einige Besondenderheiten von IT Systemen im Gesundheitswesen, mit speziellem Fokus auf gesetzliche Rahmenbedingungen, Standards und Sicherheit.

.... Das Wissen über die Baustoffe allein reicht nicht aus, um sichere Bauwerke zu errichten. Auch das Wissen über das Verhalten von Baustrukturen unter Einwirkungen ist dafür notwendig. Der Lehrstuhl für Statik, der sich hauptsächlich dieser Thematik widmet, darf mit Recht als Vorreiter an der Fakultät Bauingenieurwesen bei der Untersuchung von Sicherheitsfragen für Bauwerke gelten.... (aus dem Vorwort)

In Verbindung mit eingebetteten Systemen spielte Sicherheit in der Vergangenheit eher eine untergeordnete Rolle. Im Vordergrund standen vorhersagbare Ausführungszeiten und der finanzielle Rahmen. Aufgrund der zunehmenden Vernetzung und der Konzentration mehrerer Anwendungen auf einen Prozessor gewinnt dieser Gesichtspunkt jedoch stärker an Bedeutung. Der Blackfin-Prozessor des Herstellers Analog Devices, welcher die Konzepte von Mikrocontroller und digitalem Signalprozessor in sich vereint, entspricht diesem Trend, indem er die Möglichkeit des Speicherschutzes integriert. Das Betriebssystem uClinux wurde speziell auf die Bedürfnisse von eingebetteten Systemen angepasst, da es im Gegensatz zu Linux keinen virtuellen Speicher unterstützt. Es wurde zwar bereits auf die Architektur des Blackfin Prozessors portiert, verfügte jedoch bisher nicht über nennenswerte Mechanismen zum Schutz des Speichers. Der Hauptteil dieser Diplomarbeit besteht deshalb darin, Linux’ Speicherverwaltung zu analysieren, einen ähnlichen Ansatz in uClinux zu implementieren und schließlich den Einfluss auf die Leistung des Systems zu ermitteln. Die entstandene Realisierung schützt sowohl den Speicher einzelner Prozesse als auch den des Betriebssystemkerns. Obwohl die Lösung im Moment noch prototypischen Charakter besitzt, ist sie bereits voll funktionsfähig. Des Weiteren diskutiert die Arbeit auch den Ansatz des alleinigen Kernel-Schutzes und unterbreitet einen Vorschlag zur Verringerung der Interrupt-Latenzzeit. / In the past, embedded system’s security has been often omitted in order to trade it for system cost and more predictable execution timings. Due to the pressure induced by increased networking and multitasking, this issue is getting more important. Therefore, Analog Devices’ Blackfin processor, which combines capabilities of signal processing and controlling, additionally provides means for memory protection. The operating system uClinux, which is especially suitable for embedded systems because support for Virtual Memory has been removed, has already been ported to the Blackfin architecture, but still lacks support for memory protection. Thus, the main effort of this thesis consists of analysing Linux’s memory management, reimplementing similar approaches into the uClinux kernel, and measuring the resulting overhead. The implemented protection scheme does secure both particular processes and kernel space. Even if it is still in a prototypical state, memory protection is fully functional. In addition, approaches for exclusive kernel protection and reducing interrupt latency are discussed.

One of the challenges for Airbus preparing a new freighter development process was the design of a solid freighter barrier, which separates the courier area from the cargo compartment. The major task of such a barrier is to protect the passengers against all risks caused due to cargo impact by a justifiable design. These risks may result from all kind of survivable incident and accident scenarios. Real aircraft crashes were analyzed to get away from a static book-case and come to a more realistic dynamic crash scenario. A reduced-order simulation model was built up to investigate and simulate the dynamic effects during crash. The simulation model considers the highly nonlinear stiffness and damping characteristics of all critical cargo types and also includes their energy absorption potentials. A series of full scale container crash tests have been performed at accredited car crash facilities. The test campaigns were complemented by numerous component tests to study also general crash principles. The critical simulation parameters were identified and implemented into the simulation model. The subsequent validation process showed a close agreement between simulation and test. The simulation environment has turned out to be a reliable basis to simulate all critical barrier loads with respect to the specific aircraft loading distributions. The essence of this investigation is an adequate understanding of the real crash effects. The proposed dynamic crash approach is more realistic than the static condition and results in an optimized safety barrier wall concept. This dynamic approach provides equivalent safety compared to the existing devices and is accepted by FAA and EASA.

Univ., Diss. 2007--Hamburg, 2007. / Literaturverz. S. [255] - 278.

Virtualization is a mature technology in server and desktop environments where multiple systems are consolidate onto a single physical hardware platform, increasing the utilization of todays multi-core systems as well as saving resources such as energy, space and costs compared to multiple single systems. Looking at embedded environments reveals that many systems use multiple separate computing systems inside, including requirements for real-time and isolation properties. For example, modern high-comfort cars use up to a hundred embedded computing systems. Consolidating such diverse configurations promises to save resources such as energy and weight. In my work I propose a secure software architecture that allows consolidating multiple embedded software systems with timing constraints. The base of the architecture builds a microkernel-based operating system that supports a variety of different virtualization approaches through a generic interface, supporting hardware-assisted virtualization and paravirtualization as well as multiple architectures. Studying guest systems with latency constraints with regards to virtualization showed that standard techniques such as high-frequency time-slicing are not a viable approach. Generally, guest systems are a combination of best-effort and real-time work and thus form a mixed-criticality system. Further analysis showed that such systems need to export relevant internal scheduling information to the hypervisor to support multiple guests with latency constraints. I propose a mechanism to export those relevant events that is secure, flexible, has good performance and is easy to use. The thesis concludes with an evaluation covering the virtualization approach on the ARM and x86 architectures and two guest operating systems, Linux and FreeRTOS, as well as evaluating the export mechanism.

Users’ trust in online situations is influenced by various characteristics of human-computer interaction. Looking at the increasing scope of services online, it remains an up-to-date issue, expanding its meaning for both informational and transactional websites. In this work, the Scale for Online Users’ Trust (SCOUT) was developed to assess the trustworthiness of both types of websites. Based on the scale, the effects of user experience on users’ trust were examined in several studies. For informational websites, hedonic qualities appeared to be significant predictors of trustworthiness in addition to usability. The effects could be confirmed for transactional websites. Furthermore, perceptions of security aspects were investigated in a set of studies. The effects of customer ratings, fictitious graphical elements, web assurance seals and interactive security-related feedback on users’ trust were analyzed. Findings from all together 11 studies of this work allow for inferences for website design that could support academics and practitioners in designing for trustworthy web environments. / Nutzervertrauen in Websites ist sowohl auf informationalen als auch auf transaktionalen Websites nach wie vor ein entscheidender Faktor für erfolgreiche Online-Situationen. In dieser Arbeit wird die Entwicklung des Fragebogens SCOUT (Scale for Online Users’ Trust) beschrieben, mit dem die Vertrauenswürdigkeit von Websites beider Kategorien gleichermaßen erfasst werden kann. Darauf aufbauend wurde die Wirkung des Nutzererlebens auf Vertrauen in mehreren Studien untersucht. Für informationale Websites ergaben sich hedonische Merkmale und Usability als signifikante Prädiktoren von Vertrauenswürdigkeit. Diese Effekte konnten für transaktionale Websites bestätigt werden. Zusätzliche wurde geprüft, wie Kundenbewertungen, fiktive grafische Elemente, Gütesiegel und interaktive sicherheitsrelevante Rückmeldungen auf Nutzervertrauen wirken. Aus insgesamt elf Studien lassen sich Empfehlungen für eine vertrauensförderliche Website-Gestaltung ableiten.

Desktop and mobile computing devices increasingly store critical data, both personal and professional in nature. Yet, the enormous code bases of their monolithic operating systems (hundreds of thousands to millions of lines of code) are likely to contain exploitable weaknesses that jeopardize the security of this data in the file system. Using a highly componentized system architecture based on a microkernel (or a very small hypervisor) can significantly improve security. The individual operating system components have smaller code bases running in isolated address spaces so as to provide better fault containment. Their isolation also allows for smaller trusted computing bases (TCBs) of applications that comprise only a subset of all components. In my thesis, I built VPFS, a virtual private file system that is designed for such a componentized system architecture. It aims at reducing the amount of code and complexity that a file system implementation adds to the TCB of an application. The basic idea behind VPFS is similar to that of a VPN, which securely reuses an untrusted network: The core component of VPFS implements all functionality and cryptographic algorithms that an application needs to rely upon for confidentiality and integrity of file system contents. These security-critical cores reuse a much more complex and therefore untrusted file system stack for non-critical functionality and access to the storage device. Additional trusted components ensure recoverability.