ReTruSt

Sprecherin: Prof. Dr. Claudia Eckert, (IT-Sicherheit)

Koordinator: Lukas Gehrke, (IT-Sicherheit)

Promovierende

• Lukas Gehrke, IT-Sicherheit
• Marcel Kempf, Lehrstuhl für Netzarchitekturen und Netzdienste
• Martin Fink, Distributed Systems and Operating Systems
• Utku Budak, Sicherheit in der Informationstechnik

"The Linux kernel architecture faces inherent limitations in its security design, primarily due to constraints imposed by the underlying hardware. The Linux kernel must not only isolate user-space processes but also protect itself from unauthorized access—a task made increasingly challenging by the presence of vulnerabilities. Since modern security mechanisms rely on the Linux kernel's integrity, their effectiveness collapses as soon as the kernel is compromised. Therefore, the kernel's resilience is crucial to the security of the entire system, raising the fundamental question: how can we maintain robust security despite the presence of kernel vulnerabilities?

In this presentation, we introduce a virtualization-assisted security architecture for the Linux kernel to address these challenges. Our solution provides a lightweight virtualization layer comprising a thin, formally-verifiable virtual machine monitor on top of the open-source NOVA microhypervisor. Acting as a security support layer, this architecture enables the Linux kernel to effectively leverage the system's virtualization extensions to fortify its defenses. In-line with virtualization-based state-of-the-art security mechanisms, our solution enforces Linux kernel code integrity and protects selected data structures from being abused by malicious actors. Beyond these capabilities, it enables advanced security features, such as isolating selected security-critical subsystems within the Linux kernel itself and providing a versatile event monitoring facility targeting the activity of applications and containers in user space. Overall, by bridging the traditional separation between the OS and system virtualization technologies, our open source implementation integrates both to create a more robust and resilient security foundation. We present our implementation as a promising approach to mitigating the risks posed by kernel vulnerabilities while significantly enhancing the security posture of modern systems."

Sergej Proskurin works as a Senior Staff Security Engineer at BlueRock Security, specializing in virtualization-assisted operating system security. He received his Ph.D. in Computer Science from the Technical University of Munich. His research interests cover a wide range of low-level topics. In particular, he is passionate about operating system design and leveraging virtualization technology for dynamic binary analysis and operating system security. In the past, Sergej actively contributed to open source projects, including the Xen Project hypervisor and the black-box binary analysis system DRAKVUF.

Chunyang Chen: Brief Introduction to the Chair of Software Engineering & AI at TUM Heilbronn

Zhen Tao: Research talk on “Automated AI Compliance: Assessing EU AI Act Compliance Checkers”

Abstract: AI systems are now part of everyday life, and people have become concerned about the privacy issues raised by AI. Regulations (e.g. GDPR and the EU AI Act) commonly mandate AI products to be safe, transparent, and respectful of users’ data rights. Ensuring compliance under AI regulations is a challenge for companies and developers. This talk discusses AI privacy compliance from two angles. First, we review how mainstream providers of foundational LLMs disclose their data practices in privacy policies. Second, we focus on citizen developers of AI products. They often lack legal knowledge and struggle to meet regulatory requirements. In response to this challenge, automated EU AI Act compliance checkers have emerged to help citizen developers verify the compliance of their AI products. However, little is known about these checkers. By examining how they operate, what they cover, and where they leave gaps, we aim to reveal the current state of EU AI Act compliance checkers and help enhance the usability of compliance support tools.