The working group Protection deals with the topic of cryptographic engineering, a relatively young, multidisciplinary field. This deals with the secure implementation of cryptographic procedures. The correct development, implementation and validation of state-of-the-art cryptographic methods in hardware and software requires the cooperation of experts in mathematics, electrical engineering and computer sciences. As is so often the case, however, the devil is in the detail. Apparently small changes can have serious effects on the security of the overall system.

Increasing digitalisation and networking, driven for example by the Internet of Things and Big Data, result in a much larger attack surface today. Furthermore, attacks are constantly evolving (keyword Advanced Persistent Threats, APT). Firewalls and purely signature-based methods quickly reach their limits and are not sufficient for holistic protection in future communication networks.

The Detection working group has set itself the goal of developing network intrusion detection systems together with industry partners that enable a systemic IT security strategy through a hybrid approach. Part of this hybrid approach are, on the one hand, classical methods, e.g. rule-based anomaly detection with Snort, and, on the other hand, modern machine learning methods that are specially optimised for use in the area of embedded systems, e.g. Isolation Forest, LODA. Target sectors are the industrial sector (e.g. Industry 4.0) and the automotive sector (e.g. Car-to-X).

An important point in an overall IT security concept is the reaction to a detected incident. We work with companies to develop suitable concepts for them on how to react quickly to an incident. For this purpose, we develop suitable visualizations and suitable reporting and evaluation tools. However, measures are also developed, such as a relapse level in which the most important functions in the network can be maintained in order to be able to operate machines and plants in a protected manner in an emergency operation. Trusted Computing approaches are used that have been transferred to the embedded world.

In addition, we deal with systems that react semi-autonomously or fully autonomously and that can react independently in the event of a detected incident. For this purpose, suitable algorithms for the aggregation and correlation of alarm messages are being researched. The aim is to develop systems that can harden themselves, for example by creating suitable filters. Current research focuses on the use of Software Defined Networking (SDN) in industrial and automotive networks, which allows the reconfiguration of network components during operation. Using state-of-the-art technologies, such as P4, reaction mechanisms for real-time networks are also being researched.