Master Thesis Student - Security Contracts for Compositional Assurance

Security Contracts for Compositional Assurance 

Introduction 
How can we reason about the cybersecurity of a complex system when its components are developed independently? This thesis offers an opportunity to explore a fundamental challenge in cybersecurity architecture: understanding how security properties of individual components relate to the security of the system as a whole. Working alongside TRATON's cybersecurity architecture team, you will investigate concepts that could contribute to future approaches for reasoning about secure systems. 

Background 
Distributed cyber-physical systems consist of interacting hardware and software components. Security contracts express assumptions about a component's environment and guarantees it provides. An open question is when such local statements can meaningfully support claims about system-level security, and what limitations remain. 

Objective 

Investigate how assumption-guarantee security contracts can support reasoning about a small composition of components. Compare two existing approaches and identify their assumptions, capabilities and limitations without developing a production solution. 

Job description 

The thesis student will investigate how security contracts based on assumptions and guarantees can support reasoning about the security of composed systems. 
 

The work will include: 
• Studying the fundamental concepts of security contracts and compositional assurance. 
• Identifying and comparing two relevant existing approaches, focusing on their assumptions, capabilities and limitations. 
• Applying the concepts to a small, illustrative system consisting of interacting components. 
• Analyzing the findings and discussing their potential relevance to security architecture. 
 

The work will focus on fundamental understanding and conceptual evaluation rather than the development of a production-ready solution. 
Depending on the student's interests and progress, additional aspects such as formal modelling or automated verification may be explored. 
The expected outcome is a master's thesis presenting the investigation, comparison, illustrative example and conclusions. 

Education/program/focus 

Master's student in Computer Science, Computer Engineering, Cybersecurity, Software Engineering or similar. Interest in system architecture and security is welcome; advanced formal-methods expertise is not required. 

Number of students: 1 

Start date for the thesis work: [to be agreed] 

Estimated time required: 20 weeks full-time (30 hp, subject to university confirmation)

Contact persons and supervisors

Marcus Lindner  marcus.lindner@scania.com

Application: 

Your application must include a CV, personal letter and transcript of grades

A background check might be conducted for this position. We are conducting interviews continuously and may close the recruitment earlier than the date specified.