Master Thesis: In-Process Isolation and Recovery for WebAssembly Runtimes

Join our Team

About this opportunity:

Ericsson Research Security provides security expertise, architectures, and solutions for platforms, networks, and services. Its research spans areas such as cryptography, secure networking, AI/ML security, application security, identity management, privacy, and methods for developing and evaluating secure systems.
WebAssembly (Wasm) provides a sandbox for running untrusted modules. However, a Wasm runtime also includes components outside the sandbox, such as WASI implementations, host functions, third-party libraries, and support for multiple concurrent workloads. Faults or vulnerabilities in these components may compromise the runtime process and affect other workloads running within it.This thesis will investigate whether fine-grained, in-process isolation and recovery can add a protection boundary within Wasm runtimes, complementing the Wasm sandbox. The project will use Secure Domain Rewind and Discard (SDRaD), a prototype mechanism for creating isolated memory domains and recovering from faults by discarding or rolling back affected domains.You will develop a threat and fault model to identify suitable isolation boundaries in a Wasm runtime, then integrate SDRaD with a selected runtime, such as Wasmtime. The work may focus on isolating runtime services, co-located Wasm instances, or both. You will evaluate fault containment, recovery, and performance overhead, including whether faults or compromises can be handled without restarting the entire runtime or disrupting unrelated workloads. 

What you will do:

• Review research and existing Wasm runtimes, focusing on multiple-instance support and in-process isolation.
• Define and prioritize a threat and fault model, and identify appropriate isolation boundaries.
• Design and implement a prototype integrating a selected Wasm runtime with the SDRaD library.
• Run experiments and benchmark the prototype in realistic use cases, assessing security, dependability, recovery, and performance.
• Present interim findings and document the results in a final thesis.

The skills you bring:

• Currently pursuing a master’s degree in Computer Science, Electrical or Computer Engineering, or a related field.
• Strong knowledge of Linux systems.Programming experience in C and Python.
• Knowledge of computer security, in-process isolation, or WebAssembly is an advantage.

Application:

Please submit a brief cover letter and CV. Technical reports or other work you have written, such as coursework or blog posts, are welcome. Include relevant projects and describe your contributions. Applications will be reviewed as they arrive, and suitable candidates may be interviewed on a rolling basis.