TY - CHAP A1 - Jahn, Sabrina A1 - Kaul, Nicolas A1 - Mottok, Jürgen T1 - Using or Misusing? Introducing Misuse Cases in a Software Engineering Course for Undergraduate Engineering Students T2 - ITiCSE '22 : Proceedings of the 27th ACM Conference on on Innovation and Technology in Computer Science Education, Vol 1: July 8 - 13, 2022, Dublin Ireland N2 - Today's cyberphysical systems are increasingly prone to misuse. To secure existing and future software systems, introducing concepts of IT-Security and Secure Software Engineering (SecSE) in Software Engineering (SE) courses is essential for academic education of future software engineers. This is not only important for computer science students, but also for engineering students studying topics of computing and SE. However, only little research exists on integrating these topics into traditional SE courses, especially for engineering students in non-computer science majors. To narrow this gap, this paper contributes with the design and evaluation of an exercise on modeling misuse cases alongside use cases, based on the inductive teaching method problem-based learning (PBL). The exercise is part of an educational design research investigating which learning content and teaching methods are suitable for integrating IT-Security and SecSE topics into traditional SE education of engineering students to convey factual knowledge as well as raise awareness and interest for both topics during software development. We present the integration of the exercise design into a traditional SE course for engineering students and its evaluation to examine its suitability. We evaluated the exercise design regarding the suitability of the design components, the learning content of misuse cases and the intended learning goals as well as its impact on students' motivation, and their interest in IT-security. The paper then presents indications on the feasibility and success of the exercise design for teaching misuse cases to engineering students and sparking their interest in IT-Security. KW - educational design research KW - mis-use case KW - problem-based learning KW - inductive teaching KW - engineering students KW - higher education KW - secure software engineering KW - IT-Security Y1 - 2022 U6 - https://doi.org/10.1145/3502718.3524823 SP - 491 EP - 497 PB - Association for Computing Machinery CY - New York, NY ER - TY - JOUR A1 - Schmid, Michael A1 - Fritz, Florian A1 - Mottok, Jürgen T1 - Fine-grained parallelism framework with predictable work-stealing for real-time multiprocessor systems JF - Journal of Systems Architecture N2 - Lately, parallel task models have received much attention in the development of real-time multiprocessor systems, as they allow highly compute-intensive tasks to have shorter deadlines which is very much required in modern reactive systems. However, missing modularity and portability can make parallel programming a cumbersome endeavor. As a consequence, compute-intensive sectors in the desktop and server segment have relied on parallelism frameworks such as Intel Threading Building Blocks, Cilk and OpenMP. These parallelism frameworks, however, are optimized for decent average case performance and consequently, do not meet the strict requirements imposed by real-time systems. In this paper, we present a proof-of-concept parallelism framework which was implemented in particular for soft real-time systems and having tight timing and safety requirements of such critical systems in mind. The proposed runtime system implements static memory allocation in a work-stealing environment that conforms to the strict space and tight probabilistic time bounds of work-stealing schedulers. Furthermore, we evaluate the performance of this framework by conducting multiprogrammed benchmarks on a real-time embedded multicore architecture. Y1 - 2022 U6 - https://doi.org/10.1016/j.sysarc.2022.102393 N1 - Corrigendum: https://www.sciencedirect.com/science/article/pii/S1383762123000528?via%3Dihub VL - 124 IS - March PB - Elsevier ER - TY - CHAP A1 - Pozzobon, Enrico A1 - Renner, Sebastian A1 - Mottok, Jürgen A1 - Matoušek, Václav T1 - An optimized Bitsliced Masked Adder for ARM Thumb-2 Controllers T2 - 27th International Conference on Applied Electronics (AE): Sep 6, 2022 - Sep 7, 2022, Pilsen, Czech Republic N2 - The modular addition is used as a non-linear operation in ARX ciphers because it achieves the requirement of introducing non-linearity in a cryptographic primitive while only taking one clock cycle to execute on most modern architectures. This makes ARX ciphers especially fast in software implementations, but comes at the cost of making it harder to protect against side-channel information leakages using Boolean masking: the best known 2-shares masked adder for ARM Thumb micro-controllers takes 83 instructions to add two 32-bit numbers together. Our approach is to operate in bitsliced mode, performing 32 additions in parallel on a 32-bit microcontroller. We show that, even after taking into account the cost of bitslicing before and after the encryption, it is possible to achieve a higher throughput on the tested ciphers (CRAX and ChaCha20) when operating in bitsliced mode. Furthermore, we prove that no first-order information leakage is happening in either simulated power traces and power traces acquired from real hardware, after sufficient countermeasures are put into place to guard against pipeline leakages. KW - ARM Thumb KW - bitsliced KW - side-channel KW - Boolean masking Y1 - 2022 U6 - https://doi.org/10.1109/AE54730.2022.9919884 PB - IEEE ER - TY - CHAP A1 - Lalo, Erjola A1 - Sailer, Andreas A1 - Mottok, Jürgen A1 - Siemers, Christian T1 - Overhead-Aware Schedule Synthesis for Logical Execution Time (LET) in Automotive Systems T2 - 2022 IEEE 35th International System-on-Chip Conference (SOCC): 05-08 September 2022, Belfast, United Kingdom N2 - The Logical Execution Time (LET) has recently been integrated in multi-core automotive systems to ensure timing and dataflow determinism. Although buffering mechanisms are introduced to incorporate LET semantics, they do not guarantee that tasks are executed within their LET frames. In fact, LET and buffering semantics are violated if scheduling is not designed to execute all tasks within their LET frames and in a specific order. In this paper, we describe a scheduling synthesis technique for Fixed-Priority Scheduling (FPS) to achieve resource-efficient execution of LET systems. The proposed approach considers LET semantics, scheduling overheads, and delays caused by operating system operations and provides the possibility to optimize the schedule with respect to aspects like scheduling overheads. Our performance and feasibility evaluation shows that the proposed algorithm provides results in a reasonable amount of time for models of complex industrial applications. Thus, the integration of the proposed algorithm into an automated process is of high benefit to accelerate the development of vehicle applications. Y1 - 2022 SN - 978-1-6654-5985-3 U6 - https://doi.org/10.1109/SOCC56010.2022.9908103 SP - 1 EP - 6 PB - IEEE ER - TY - CHAP A1 - Frauenschläger, Tobias A1 - Mottok, Jürgen T1 - Security-Gateway for SCADA-Systems in Critical Infrastructures T2 - 27th International Conference on Applied Electronics (AE): 06-07 September 2022, Pilsen, CZ N2 - Supervisory Control and Data Acquisition (SCADA) systems are used to control and monitor components within the energy grid, playing a significant role in the stability of the system. As a part of critical infrastructures, components in these systems have to fulfill a variety of different requirements regarding their dependability and must also undergo strict audit procedures in order to comply with all relevant standards. This results in a slow adoption of new functionalities. Due to the emerged threat of cyberattacks against critical infrastructures, extensive security measures are needed within these systems to protect them from adversaries and ensure a stable operation. In this work, a solution is proposed to integrate extensive security measures into current systems. By deploying additional security-gateways into the communication path between two nodes, security features can be integrated transparently for the existing components. The developed security-gateway is compliant to all regulatory requirements and features an internal architecture based on the separation-of-concerns principle to increase its security and longevity. The viability of the proposed solution has been verified in different scenarios, consisting of realistic field tests, security penetration tests and various performance evaluations. KW - Critical Infrastructure KW - Certification KW - Supervisory Control and Data Acquisition KW - Security KW - Dependability Y1 - 2022 U6 - https://doi.org/10.1109/AE54730.2022.9920070 PB - IEEE ER - TY - CHAP A1 - Schmid, Michael A1 - Mottok, Jürgen T1 - Investigation of Scheduling Algorithms for DAG. Tasks through Simulations T2 - ERTS 2022, 11th European Congress Embedded Real Time Systems: 1-2 June, Toulouse, France N2 - In the real-time systems sector, various task models and corresponding tests exist to model and verify the schedulability of task sets on the system at hand. While those models and schedulability tests have intensively been studied from a theoretical point of view, it is hard to ma e use of them to compare the actual execution behavior of scheduling algorithms on a real system. In contrast to schedulability tests, simulators can help to investigate the performance of specific scheduling algorithms. One of the most generalized task models to describe parallel tasks is the Directed Acyclic Graph model that allows to represent tasks as a series of subtasks that depict the potentially parallel computations and precedence constraints that denote the order in which the subtasks are allowed to execute. In this paper, we investigate various scheduling algorithms for the Directed Acyclic Graph model. For that, we first recapitulate the examined scheduling algorithms in detail and point out relevant differences. Subsequently, we present the evaluation of different global and federated scheduling algorithms using fine-grained parallel tasks. To this end, we generate random Directed Acyclic Graph tasks and simulate their execution on multiprocessor systems using scheduling algorithms such as global rate-monotonic and semi-federated scheduling as well as global scheduling policies using the thread pool model. KW - real-time KW - scheduling KW - task models KW - simulation Y1 - 2022 UR - https://hal.archives-ouvertes.fr/hal-03700472/document ER - TY - CHAP A1 - Grabinger, Lisa A1 - Hauser, Florian A1 - Mottok, Jürgen T1 - Accessing the Presentation of Causal Graphs and an Application of Gestalt Principles with Eye Tracking T2 - 2022 IEEE International Conference on Software Analysis, Evolution and Reengineering (SANER 2022), 1st Workshop on Advances in Human-Centric Experiments in Software Engineering (HUMAN 2022): 15-18 March 2022, Honolulu, HI, USA N2 - The discipline of causal inference uses so-called causal graphs to model cause and effect relations of random variables. As those graphs only encode a relation structure there is no hard rule concerning their alignment. The present paper presents a study with the aim of working out the optimal alignment of causal graphs with respect to comprehensibility and interestingness. In addition, the study examines whether the central gestalt principles of psychology apply for causal graphs. Data from 29 participants is acquired by triangulating eye tracking with a questionnaire. The results of the study suggest that causal graphs should be aligned downwards. Moreover, the gestalt principles proximity, similarity and closure are shown to hold true for causal graphs. KW - causal graphs KW - gestalt principles KW - eye tracking Y1 - 2022 U6 - https://doi.org/10.1109/SANER53432.2022.00153 SP - 1278 EP - 1285 PB - IEEE ER - TY - GEN A1 - Renner, Sebastian A1 - Pozzobon, Enrico A1 - Mottok, Jürgen T1 - 3rd Round Ciphers Evaluation on Microcontrollers T2 - Lightweight Cryptography Workshop (virtual): May 9-11 2022 Y1 - 2022 UR - https://www.nist.gov/video/day-1-part-2-lightweight-cryptography-workshop-2022 PB - National Institute of Standards and Technology (NIST) CY - Gaithersburg ER - TY - CHAP A1 - Renner, Sebastian A1 - Pozzobon, Enrico A1 - Mottok, Jürgen ED - Li, Wenjuan ED - Furnell, Steven ED - Meng, Weizhi T1 - The Final Round: Benchmarking NIST LWC Ciphers on Microcontrollers T2 - Attacks and Defenses for the Internet-of-Things, 5th International Workshop, ADIoT 2022: Copenhagen, Denmark, September 30, 2022, Revised Selected Papers N2 - In this work, we present our benchmarking results for the ten finalist ciphers of the Lightweight Cryptography (LWC) project initiated by National Institute of Standards and Technology (NIST). We evaluate the speed and code size of various software implementations on five different platforms featuring four different architectures. Moreover, we benchmark the dynamic memory utilization of the remaining NIST LWC algorithms on one 32-bit ARM controller. We describe our test cases and methodology and provide some information regarding the design and properties of the finalists before showing and discussing our results. Altogether, we evaluated almost 300 implementations of the 3rd round candidates and pick the most appropriate and best (primary) implementation of each cipher for our comparisons. We include a variant of AES-GCM in our benchmarking in order to be able to compare the state-of-the-art to the novel LWC ciphers. Our research gives an overview over the performance of the latest software implementations of the NIST LWC finalists and shows under which circumstances which candidate is performing the best in our individual test cases. Additionally, we make all benchmarking results, the code for our test framework and every tested implementation available to the public to ensure a transparent testing process. Y1 - 2022 SN - 978-3-031-21311-3 U6 - https://doi.org/10.1007/978-3-031-21311-3_1 SP - 1 EP - 20 PB - Springer Nature CY - Cham ER - TY - CHAP A1 - Renner, Sebastian A1 - Pozzobon, Enrico A1 - Mottok, Jürgen ED - Li, Wenjuan ED - Furnell, Steven ED - Meng, Weizhi T1 - Evolving a Boolean Masked Adder Using Neuroevolution T2 - Attacks and Defenses for the Internet-of-Things, 5th International Workshop, ADIoT 2022: Copenhagen, Denmark, September 30, 2022, Revised Selected Papers N2 - The modular addition is a popular building block when designing lightweight ciphers. While algorithms mainly based on the addition can reach very high performance, masking their implementations results in a huge penalty. Since efficient protection against side-channel attacks is a requirement in lots of use cases, we focus on optimizing the Boolean masking of the modular addition. Contrary to recent related work, we target evolving a masked full adder instead of parts of a parallel prefix adder. We study how techniques typically found in neural network evolution and genetic algorithms can be adapted in order to help in evolving an efficiently masked adder. We customize a well-known neuroevolution algorithm, develop an optimized masked adder with our new approach and implement the ChaCha20 cipher on an ARM Cortex-M3 controller. We compare the performance of the protected neuroevolved implementation to solutions found by traditional search methods. Moreover, the leakage of our new solution is validated by a t-test conducted with a leakage simulator. We present under which circumstances our masked implementation outperforms related work and prove the feasibility of successfully using neuroevolution when searching for complex Boolean networks. Y1 - 2022 SN - 978-3-031-21310-6 U6 - https://doi.org/10.1007/978-3-031-21311-3_2 SP - 21 EP - 40 PB - Springer Nature CY - Cham ER -