Office Hours

For reliable meetings, please arrange an appointment via mail.

Echo Meißner

Echo Meißner has received a Master diploma cum laude in Computer Science from Ulm University in 2017. They then joined the Institute of Distributed Systems and are currently employed as a research assistant.

Research Interests

  • Practical and usable privacy
    • Privacy-enhancing technologies
    • Trusted computing & trusted execution environments
    • Privacy in empirical research
  • Distributed systems & architectures
    • Event-driven architectures
    • Event sourcing & CQRS
    • Retroaction in event-sourced systems
    • Scalability of architectures
  • Other topics
    • Web technologies & web architectures
    • Programming languages and concepts
    • Open data & open educational resources

Publications

2025

Meißner, E., Kargl, F., Benjamin, E. and Engelmann, F. 2025. PrePaMS: Privacy-Preserving Participant Management System for Studies with Rewards and Prerequisites. Proceedings on Privacy Enhancing Technologies. 2025, 1 (2025). [accepted for publication]
Taking part in surveys, experiments, and studies is often compensated by rewards to increase the number of participants and encourage attendance. While privacy requirements are usually considered for participation, privacy aspects of the reward procedure are mostly ignored. To this end, we introduce PrePaMS, an efficient participation management system that supports prerequisite checks and participation rewards in a privacy-preserving way. Our system organizes participations with potential (dis-)qualifying dependencies and enables secure reward payoffs. By leveraging a set of proven cryptographic primitives and mechanisms such as anonymous credentials and zero-knowledge proofs, participations are protected so that service providers and organizers cannot derive the identity of participants even within the reward process. In this paper, we have designed and implemented a prototype of PrePaMS to show its effectiveness and evaluated its performance under realistic workloads. PrePaMS covers the information whether subjects have participated in surveys, experiments, or studies. When combined with other secure solutions for the actual data collection within these events, PrePaMS can represent a cornerstone for more privacy-preserving empirical research.

2024

Heß, A., Hauck, F.J. and Meißner, E. 2024. Consensus-agnostic state-machine replication. 25th ACM/IFIP Int. Middleware Conf. (Dec. 2024). [accepted for publication]
Schillings, C., Meißner, E., Erb, B., Bendig, E., Schultchen, D., Pollatos, O. and others 2024. Effects of a Chatbot-Based Intervention on Stress and Health-Related Parameters in a Stressed Sample: Randomized Controlled Trial. JMIR Mental Health. 11, 1 (May 2024), e50454.

2023

Schillings, C., Meißner, E., Erb, B., Schultchen, D., Bendig, E. and Pollatos, O. 2023. A chatbot-based intervention with ELME to improve stress and health-related parameters in a stressed sample: Study protocol of a randomised controlled trial. Frontiers in Digital Health. 5, (Mar. 2023), 14.
Background: Stress levels in the general population had already been increasing in recent years, and have subsequently been exacerbated by the global pandemic. One approach for innovative online-based interventions are “chatbots” – computer programs that can simulate a text-based interaction with human users via a conversational interface. Research on the efficacy of chatbot-based interventions in the context of mental health is sparse. The present study is designed to investigate the effects of a three-week chatbot-based intervention with the chatbot ELME, aiming to reduce stress and to improve various health-related parameters in a stressed sample. Methods: In this multicenter, two-armed randomised controlled trial with a parallel design, a three-week chatbot-based intervention group including two daily interactive intervention sessions via smartphone (á 10-20 min.) is compared to a treatment-as-usual control group. A total of 130 adult participants with a medium to high stress levels will be recruited in Germany. Assessments will take place pre-intervention, post-intervention (after three weeks), and follow-up (after six weeks). The primary outcome is perceived stress. Secondary outcomes include self-reported interoceptive accuracy, mindfulness, anxiety, depression, personality, emotion regulation, psychological well-being, stress mindset, intervention credibility and expectancies, affinity for technology, and attitudes towards artificial intelligence. During the intervention, participants undergo ecological momentary assessments. Furthermore, satisfaction with the intervention, the usability of the chatbot, potential negative effects of the intervention, adherence, potential dropout reasons, and open feedback questions regarding the chatbot are assessed post-intervention. Discussion: To the best of our knowledge, this is the first chatbot-based intervention addressing interoception, as well as in the context with the target variables stress and mindfulness. The design of the present study and the usability of the chatbot were successfully tested in a previous feasibility study. To counteract a low adherence of the chatbot-based intervention, a high guidance by the chatbot, short sessions, individual and flexible time points of the intervention units and the ecological momentary assessments, reminder messages, and the opportunity to postpone single units were implemented.

2021

Herbert, C., Marschin, V., Erb, B., Meißner, E., Aufheimer, M. and Boesch, C. 2021. Are you willing to self-disclose for science? Effects of Privacy Awareness (PA) and Trust in Privacy (TIP) on self-disclosure of personal and health data in online scientific studies -an experimental study. Frontiers in Big Data. (Dec. 2021). [accepted for publication]
Digital interactions via the internet have become the norm rather than the exception in our global society. Concerns have been raised about human-centered privacy and the often unreflected self-disclosure behavior of internet users. This study on human-centered privacy follows two major aims: first, investigate the willingness of university students as digital natives to self-disclose private data and information from psychological domains including their person, social and academic life, their mental health as well as their health behavior habits when taking part as a volunteer in a scientific online survey. Second, examine to what extent the participants’ self-disclosure behavior can be modulated by experimental induction of Privacy Awareness (PA) or Trust in Privacy (TIP) or a combination of both (PA and TIP). In addition, the role of human factors such as personality traits, gender or mental health (e.g., self-reported depressive symptoms) on self-disclosure behavior was explored and the influence of PA and TIP induction were considered. Participants were randomly assigned to four experimental groups. In group A (n = 50, 7 males), privacy awareness (PA) was induced implicitly by the inclusion of privacy concern items. In group B (n = 43, 6 males), trust in privacy (TIP) was experimentally induced by buzzwords and by visual TIP primes promising safe data storage. Group C (n = 79, 12 males) received both, PA and TIP induction, while group D (n = 55, 9 males) served as control group. Participants had the choice to answer the survey items by agreeing to one of a number of possible answers including the options to refrain from self-disclosure by choosing the response options “don’t know” or “no answer”. Self-disclosure among participants was high irrespective of experimental group and irrespective of psychological domains of the information provided. The results of this study suggest that willingness of volunteers to self-disclose private data in a scientific online study cannot simply be overruled or changed by any of the chosen experimental privacy manipulations. The present results extend the previous literature on human-centered privacy and despite limitations can give important insights into self-disclosure behavior of young people and the privacy paradox.
Meißner, E., Kargl, F. and Erb, B. 2021. WAIT: Protecting the Integrity of Web Applications with Binary-Equivalent Transparency. Proceedings of the 36th Annual ACM Symposium on Applied Computing (Virtual Event, Republic of Korea, 2021), 1950–1953. (acceptance rate: 29%)
Modern single page web applications require client-side executions of application logic, including critical functionality such as client-side cryptography. Existing mechanisms such as TLS and Subresource Integrity secure the communication and provide external resource integrity. However, the browser is unaware of modifications to the client-side application as provided by the server and the user remains vulnerable against malicious modifications carried out on the server side. Our solution makes such modifications transparent and empowers the browser to validate the integrity of a web application based on a publicly verifiable log. Our Web Application Integrity Transparency (WAIT) approach requires (1) an extension for browsers for local integrity validations, (2) a custom HTTP header for web servers that host the application, and (3) public log servers that serve the verifiable logs. With WAIT, the browser can disallow the execution of undisclosed application changes. Also, web application providers cannot dispute their authorship for published modifications anymore. Although our approach cannot prevent every conceivable attack on client-side web application integrity, it introduces a novel sense of transparency for users and an increased level of accountability for application providers particularly effective against targeted insider attacks.
Meißner, E., Engelmann, F., Kargl, F. and Erb, B. 2021. PeQES: A Platform for Privacy-Enhanced Quantitative Empirical Studies. Proceedings of the 36th Annual ACM Symposium on Applied Computing (Virtual Event, Republic of Korea, 2021), 1226–1234. (acceptance rate: 29%)
Empirical sciences and in particular psychology suffer a methodological crisis due to the non-reproducibility of results, and in rare cases, questionable research practices. Pre-registered studies and the publication of raw data sets have emerged as effective countermeasures. However, this approach represents only a conceptual procedure and may in some cases exacerbate privacy issues associated with data publications. We establish a novel, privacy-enhanced workflow for pre-registered studies. We also introduce PeQES, a corresponding platform that technically enforces the appropriate execution while at the same time protecting the participants' data from unauthorized use or data repurposing. Our PeQES prototype proves the overall feasibility of our privacy-enhanced workflow while introducing only a negligible performance overhead for data acquisition and data analysis of an actual study. Using trusted computing mechanisms, PeQES is the first platform to enable privacy-enhanced studies, to ensure the integrity of study protocols, and to safeguard the confidentiality of participants' data at the same time.
Bendig, E., Erb, B., Meißner, E., Bauereiß, N. and Baumeister, H. 2021. Feasibility of a Software agent providing a brief Intervention for Self-help to Uplift psychological wellbeing (“SISU”). A single-group pretest-posttest trial investigating the potential of SISU to act as therapeutic agent. Internet Interventions. 24, (2021), 100377.
Background: Software agents are computer-programs that conduct conversations with a human. The present study evaluates the feasibility of the software agent “SISU” aiming to uplift psychological wellbeing. Methods: Within a one-group pretest-posttest trial, N = 30 German-speaking participants were recruited. Assessments took place before (t1), during (t2) and after (t3) the intervention. The ability of SISU to guide participants through the intervention, acceptability, and negative effects were investigated. Data analyses are based on intention-to-treat principles. Linear mixed models will be used to investigate short-term changes over time in mood, depression, anxiety. Intervention: The intervention consists of two sessions. Each session comprises writing tasks on autobiographical negative life events and an Acceptance- and Commitment Therapy-based exercise respectively. Participants interact with the software agent on two consecutive days for about 30 min each. Results: All participants completed all sessions within two days. User experience was positive, with all subscales of the user experience questionnaire (UEQ) M > 0.8. Participants experienced their writings as highly self-relevant and personal. However, 57% of the participants reported at least one negative effect attributed to the intervention. Results on linear mixed models indicate an increase in anxiety over time (β = 1.33, p = .001). Qualitative User Feedback revealed that the best thing about SISU was its innovativeness (13%) and anonymity (13%). As worst thing about SISU participants indicated that the conversational style of SISU often felt unnatural (73%). Conclusion: SISU successfully guided participants through the two-day intervention. Moreover, SISU has the potential to enter the inner world of participants. However, intervention contents have the potential to evoke negative effects in individuals. Expectable short-term symptom deterioration due to writing about negative autobiographical life events could not be prevented by acceptance and commitment therapy-based exercises. Hence, results suggest a revision of intervention contents as well as of the conversational style of SISU. The good adherence rate indicates the useful and acceptable format of SISU as a mental health chatbot. Overall, little is known about the effectiveness of software agents in the context of psychological wellbeing. Results of the present trial underline that the innovative technology bears the potential of SISU to act as therapeutic agent but should not be used with its current intervention content. Trial-registration: The Trial is registered at the WHO International Clinical Trials Registry Platform via the German Clinical Studies Register (DRKS): DRKS00014933 (date of registration: 20.06.2018). Link: https://www.drks.de/drks_web/navigate.do?navigationId=trial.HTML&TRIAL_ID=DRKS00014933.

2018

Meißner, E. 2018. Towards Time Travel in Distributed Event-Sourced Systems. Proceedings of the 12th ACM International Conference on Distributed and Event-Based Systems (Hamilton, New Zealand, 2018), 266–269. Doctoral Symposium
Stateful applications are based on the state they hold and how it changes over time. This history of state changes is usually discarded as the application progresses. By building on concepts from event processing and storing the application history we envision a novel programming paradigm that supports retroaction. Retroactive computing introduces new opportunities for a developer to access and even modify an application timeline. By enabling the exploration of alternative scenarios, retroactive computing establishes powerful new ways to debug systems and introduces new approaches to solve problems. Initial work has shown the practicality and possibilities of this new programming paradigm and introduces further research questions and challenges.
Meißner, E., Erb, B., Kargl, F. and Tichy, M. 2018. retro-λ: An Event-sourced Platform for Serverless Applications with Retroactive Computing Support. Proceedings of the 12th ACM International Conference on Distributed and Event-based Systems (Hamilton, New Zealand, 2018), 76–87. (acceptance rate: 39%)
State changes over time are inherent characteristics of stateful applications. So far, there are almost no attempts to make the past application history programmatically accessible or even modifiable. This is primarily due to the complexity of temporal changes and a difficult alignment with prevalent programming primitives and persistence strategies. Retroactive computing enables powerful capabilities though, including computations and predictions of alternate application timelines, post-hoc bug fixes, or retroactive state explorations. We propose an event-driven programming model that is oriented towards serverless computing and applies retroaction to the event sourcing paradigm. Our model is deliberately restrictive, but therefore keeps the complexity of retroactive operations in check. We introduce retro-λ, a runtime platform that implements the model and provides retroactive capabilites to its applications. While retro-λ only shows negligible performance overheads compared to similar solutions for running regular applications, it enables its users to execute retroactive computations on the application histories as part of its programming model.
Meißner, E., Erb, B. and Kargl, F. 2018. Performance Engineering in Distributed Event-sourced Systems. Proceedings of the 12th ACM International Conference on Distributed and Event-based Systems (Hamilton, New Zealand, 2018), 242–245. (acceptance rate: 39%)
Distributed event-sourced systems adopt a fairly new architectural style for data-intensive applications that maintains the full history of the application state. However, the performance implications of such systems are not yet well explored, let alone how the performance of these systems can be improved. A central issue is the lack of systematic performance engineering approaches that take into account the specific characteristics of these systems. To address this problem, we suggest a methodology for performance engineering and performance analysis of distributed event-sourced systems based on specific measurements and subsequent, targeted optimizations. The methodology blends in well into existing software engineering processes and helps developers to identify bottlenecks and to resolve performance issues. Using our structured approach, we improved an existing event-sourced system prototype and increased its performance considerably.
Erb, B., Meißner, E., Ogger, F. and Kargl, F. 2018. Log Pruning in Distributed Event-sourced Systems. Proceedings of the 12th ACM International Conference on Distributed and Event-based Systems (Hamilton, New Zealand, 2018), 230–233. (acceptance rate: 39%)
Event sourcing is increasingly used and implemented in event-based systems for maintaining the evolution of application state. However, unbounded event logs are impracticable for many systems, as it is difficult to align scalability requirements and long-term runtime behavior with the corresponding storage requirements. To this end, we explore the design space of log pruning approaches suitable for event-sourced systems. Furthermore, we survey specific log pruning mechanisms for event-sourced logs. In a brief evaluation, we point out the trade-offs when applying pruning to event logs and highlight the applicability of log pruning to event-sourced systems.
Erb, B., Meißner, E., Kargl, F., Steer, B.A., Cuadrado, F., Margan, D. and Pietzuch, P. 2018. Graphtides: A Framework for Evaluating Stream-Based Graph Processing Platforms. Proceedings of the 1st ACM SIGMOD Joint International Workshop on Graph Data Management Experiences & Systems (GRADES) and Network Data Analytics (NDA) (Houston, Texas, 2018). (acceptance rate: 38%)
Stream-based graph systems continuously ingest graph-changing events via an established input stream, performing the required computation on the corresponding graph. While there are various benchmarking and evaluation approaches for traditional, batch-oriented graph processing systems, there are no common procedures for evaluating stream-based graph systems. We, therefore, present GraphTides, a generic framework which includes the definition of an appropriate system model, an exploration of the parameter space, suitable workloads, and computations required for evaluating such systems. Furthermore, we propose a methodology and provide an architecture for running experimental evaluations. With our framework, we hope to systematically support system development, performance measurements, engineering, and comparisons of stream-based graph systems.

2017

Erb, B., Meißner, E., Habiger, G., Pietron, J. and Kargl, F. 2017. Consistent Retrospective Snapshots in Distributed Event-sourced Systems. Conference on Networked Systems (NetSys’17) (Göttingen, Germany, Mar. 2017).
An increasing number of distributed, event-based systems adopt an architectural style called event sourcing, in which entities keep their entire history in an event log. Event sourcing enables data lineage and allows entities to rebuild any previous state. Restoring previous application states is a straight-forward task in event-sourced systems with a global and totally ordered event log. However, the extraction of causally consistent snapshots from distributed, individual event logs is rendered non-trivial due to causal relationships between communicating entities. High dynamicity of entities increases the complexity of such reconstructions even more. We present approaches for retrospective and global state extraction of event-sourced applications based on distributed event logs. We provide an overview on historical approaches towards distributed debugging and breakpointing, which are closely related to event log-based state reconstruction. We then introduce and evaluate our approach for non-local state extraction from distributed event logs, which is specifically adapted for dynamic and asynchronous event-sourced systems.
Erb, B., Meißner, E., Pietron, J. and Kargl, F. 2017. Chronograph: A Distributed Processing Platform for Online and Batch Computations on Event-sourced Graphs. Proceedings of the 11th ACM International Conference on Distributed and Event-Based Systems (Barcelona, Spain, 2017), 78–87. (acceptance rate: 37%)
Several data-intensive applications take streams of events as a continuous input and internally map events onto a dynamic, graph-based data model which is then used for processing. The differences between event processing, graph computing, as well as batch processing and near-realtime processing yield a number of specific requirements for computing platforms that try to unify theses approaches. By combining an altered actor model, an event-sourced persistence layer, and a vertex-based, asynchronous programming model, we propose a distributed computing platform that supports event-driven, graph-based applications in a single platform. Our Chronograph platform concept enables online and offline computations on event-driven, history-aware graphs and supports different processing models on the evolving graph.

2016

Meißner, E., Erb, B., van der Heijden, R., Lange, K. and Kargl, F. 2016. Mobile triage management in disaster area networks using decentralized replication. Proceedings of the Eleventh ACM Workshop on Challenged Networks (2016), 7–12. (acceptance rate: 52%)
In large-scale disaster scenarios, efficient triage management is a major challenge for emergency services. Rescue forces traditionally respond to such incidents with a paper-based triage system, but technical solutions can potentially achieve improved usability and data availability. We develop a triage management system based on commodity hardware and software components to verify this claim. We use a single-hop, ad-hoc network architecture with multi-master replication, a tablet-based device setup, and a mobile application for emergency services. We study our system in cooperation with regional emergency services and report on experiences from a field exercise. We show that state-of-the-art commodity technology provides the means necessary to implement a triage management system compatible with existing emergency service procedures, while introducing additional benefits. This work highlights that powerful real-world ad-hoc networking applications do not require unreasonable development effort, as existing tools from distributed systems, such as replicating NoSQL databases, can be used successfully.

Bachelor/Master Theses

The section lists open and finished topics for theses. More topics for Bachelor/Master theses are available on the thesis website of the institute.

I am also accepting own topics that relate to my fields of interests. Please get in touch for suggestions.

Master Projects

I provide a number of  individual master projects that are related to my field of research. Several student thesis topics can also be worked on as part of a master project.

Most projects can be conducted as 8 LP or 16 LP projects, depending on the focus and extent of the topic.

For more details, please get in touch with me.

Office Hours

For reliable meetings, please arrange an appointment via mail.

Open Topics

Supervised Topics

“Exploring the Current State-of-the-Art and Best Practices in Web Accessibility,” Bachelor or Master's thesis, E. Meißner (Supervisor), F. Kargl (Examiner), Inst. of Distr. Sys., Ulm Univ., 2023 – Taken.
Web accessibility refers to the practice of designing and developing websites and web-based applications to be inclusive and usable for all individuals, regardless of their physical and cognitive abilities and the way they access the web. Over the years, various standards and guidelines have been established to enhance the capabilities of assistive technologies, such as screen readers. This thesis aims to provide an in-depth overview and survey of the current state-of-the-art and best practices in web accessibility. Additionally, the thesis will evaluate the effects of adhering to web accessibility guidelines, such as WCAG 2.0 and WAI-ARIA, by exploring how they impact the most widely-used assistive technologies. Optionally, a practical evaluation using an example website, such as the university website, can be included to demonstrate the implementation of these guidelines in real-world scenarios.
“Evaluation and Comparison of Cryptographic Key Recovery Mechanisms,” Bachelor or Master's thesis, E. Meißner (Supervisor), F. Kargl (Examiner), Inst. of Distr. Sys., Ulm Univ., 2023 – Taken.
In traditional password-based authentication schemes, users can typically recover a forgotten password using their email address or remembered security questions. This only works because a centralized service provider has the authority to simply overwrite the user's password. However, traditional recovery techniques are impractical for decentralized and privacy-preserving protocols, which often rely on the user having a private key that is unknown to the service. Various approaches have been proposed in the past to address this challenge, such as physically printing the key and storing it in a secure location (e.g., the user's sock drawer), or deriving the key from a user-defined password or generated mnemonic phrase. This thesis should provide an overview of key recovery mechanisms and compare them to each other. To evaluate the practicality of these mechanisms and their suitability for different user demographics, a user study should be designed and conducted.
“Migrating a Vue-based Chat-Bot Web Application to React Native/Apache Cordova,” Project, E. Meißner (Supervisor), F. Kargl (Examiner), Inst. of Distr. Sys., Ulm Univ., 2022 – Taken.
We developed a web-based platform for automated psychological interventions as part of an ongoing cooperation with the department for Clinical and Health Psychology. The goal of this project is to migrate this prototypical application to an extensible cross platform application using React Native or Apache Cordova.
“Evaluation and Comparison of Current Confidential Computing Frameworks,” Project, E. Meißner (Supervisor), F. Kargl (Examiner), Inst. of Distr. Sys., Ulm Univ., 2022 – Taken.
Trusted computing and trusted execution environments are an approach to perform computations on confidential data. Over the years there have been various developments of research and production-ready frameworks to make development of applications utilizing these technologies easier. While most of these frameworks still target one specific TEE, some even provide backend abstraction (e.g., Google Asylo / Enarx). The goal of this topic is to look into these frameworks, compare, and evaluate them by implementing a demo application for a selection of candidate frameworks.
“Confidential Computing via Multiparty Computation and Trusted Computing,” Project or Master's thesis, E. Meißner (Supervisor), F. Kargl (Examiner), Inst. of Distr. Sys., Ulm Univ., 2022 – Taken.
Secure multiparty computation and trusted computing are two very different approaches to perform computations on confidential data. MPC relies on provably secure but costly cryptography whereas trusted computing relies on somewhat trustworthy hardware. This difference also affects to the underlying attacker models. Simply put MPC requires non-colluding parties and trusted computer requires uncompromised hardware that was correctly manufactured. The goal of this topic is to explore a combination of both approaches to mitigate each others weaknesses for a specific use case where the computing parties are disjunct from data subjects.
“State of Event Sourcing Application Development,” Master's thesis VS-2023-04M, B. Erb and E. Meißner (Supervisor), F. Kargl and F. J. Hauck (Examiner), Inst. of Distr. Sys., Ulm Univ., 2023 – Completed.
The event sourcing storage architecture is increasingly used for developing applications. However, previous work shows that developers encounter a couple of challenges when applying the pattern. One such challenge is the lack of mature tools and solutions, which help developers in implementing event-sourced applications. No detailed and methodological comparison of the tools already available on the market existed at the time of writing. This thesis introduces a methodology on how to compare and categorize such tools and applies it to three solutions (EventStoreDB, Axon, and Akka), which are selected according to a set of requirements. To remove subjective opinions from the assessment of the qualitative aspects, quality gates are defined, in addition to benchmarks, which are used to evaluate some quantitative aspects. Two example applications which cover a selection of event sourcing features are defined and implemented using the three selected tools, providing insight into how they aid in the development process. In the end, a detailed comparison of the capabilities of the evaluated tools is given and recommendations for when to use each tool are provided.
“Security Mechanisms for Multi-Tenancy Event-Sourced Graphs,” Master's thesis VS-2023-13M, B. Erb and E. Meißner (Supervisor), F. Kargl (Examiner), Inst. of Distr. Sys., Ulm Univ., 2023 – Completed.
This thesis aims to investigate and address the security challenges that arise when applying multi-tenancy to a graph-based processing platform that is characterized by computational entities that exchange messages and whose behavior depends on user-defined code. Using threat modeling techniques, we enumerate relevant threats and discuss adequate security mechanisms. The more promising ones are then deployed on a prototype platform. We compare the performance costs of access control using an attribute based policy language implementation (XACML, Authzforce) against extending the computational entities with this functionality and find that, in our case, the former is slower but may provide other benefits. We also measure the performance costs introduced by using a strategy against denial-of-service attacks through user-submitted code on the application level and determine that this introduces significant overhead. The general considerations in this thesis and the results obtained from the evaluations may prove useful when implementing a system that is similar to ours. It will aid in detecting threats and help in the selection of an adequate access control method.
X. Li, “Eine Proof-of-Concept-Studie über Service Mesh,” Bachelor's thesis VS-2023-06B, E. Meißner (Supervisor), F. J. Hauck (Examiner), Inst. of Distr. Sys., Ulm Univ., 2023 – Completed.
“Confidential Computing via Multiparty Computation and Trusted Computing,” Master's thesis VS-2023-05M, E. Meißner and B. Erb (Supervisor), F. Kargl and F. J. Hauck (Examiner), Inst. of Distr. Sys., Ulm Univ., 2023 – Completed.
In the wake of the social sciences’ so-called replication crisis, researches increasingly strive to adopt methods preventing questionable research practices in empirical studies, e. g., study preregistration and full publication of survey datasets. However, publication of survey responses poses a serious threat to the privacy of study participants. Previous work has addressed this issue while maintaining protection against questionable research practices, but either relies on Trusted Execution Environments (TEEs), which have been shown to be susceptible to various kinds of attacks, or on Secure Multiparty Computation (SMPC), requiring a honest majority of participating parties. In this work, we combine TEEs with SMPC in a platform for conducting empirical studies that provides strong guarantees for the privacy of participants. Survey responses are split into secret shares, which are distributed among a number of TEE-protected computation parties. Statistical analysis of responses is performed as an SMPC. The platform is secure against a wider range of attackers than related work, i. e., against attackers either able to circumvent the utilised TEE or controlling a majority of the computation parties. We implement a prototype of this platform and evaluate its computational performance against alternative approaches. We show that it is suitable for conducting real-world privacy-preserving empirical studies, placing only minimal computational load on survey participants. Its performance in conducting statistical analysis is inferior to its alternatives, requiring ca. 10 min for performing one two-sample t-test. However, we argue that this is sufficient for real-world settings. Additionally, we list several approaches with which performance can be enhanced.
“PsyArXiv Data Analyzer,” individual lab project VS-2022-16P, B. Erb and E. Meißner (Supervisor), F. Kargl (Examiner), Inst. f. Vert. Sys., Univ. Ulm, 2022 – Completed.
This project focuses on practical anonymity in the publication of psychological study material by using software to detect data sets that are likely to contain identifying information. Under HIPAA and GDPR, health-related information is considered highly sensitive and should not be disclosed to the public under normal circumstances. In 2000, Latanya Sweeney pointed out that simple demographics often identify people uniquely, noting that 87% of the U.S. population could be uniquely identified with the combination of age, gender, and zip code alone, and that about half of the U.S. population would be identifiable with the combination of age, gender, and location. A manual ex- amination of study material revealed, that some studies still contain quasi-identifiers, which are sets of attributes that in combination can be used in combination to uniquely identify an individual under certain assumptions (e.g. the attacker must have access to a voter list, health records, or data sets on individuals acquired from a data broker). To address the issue of privacy in the publication of psychological study materials, we have developed a software that helps finding data sets in study materials of psychological studies that are likely to contain identifying information using the keywords or patterns configured by the user, providing per default the most predominant column headers we discovered by manually analyzing the study material. With our software, we are able to automatically prepare and analyze large amounts of data crawled from PsyArXiv prior to this project, and evaluate and score the results, focusing on files in CSV format and formats that can be converted to CSV. We hope that our work will bring more attention on the problem of anonymity in the release of study material, or even be used to identify privacy issues before the material is published.
“Test-based Validation of Network Programming Tasks,” Project, E. Meißner (Supervisor), F. Kargl (Examiner), Inst. of Distr. Sys., Ulm Univ., 2021 – Completed.
We have a collection of Java programming tasks as part of our introduction to computer networks course. In these programming tasks students are instructed to implement network applications matching a strict set of rules. The goal of this project is to implement a rule-based testing framework to aid the grading of such programming tasks and providing immediate feedback to students whether their implementation is correct or not.
M. Glumann, “Modern Deployment Approaches for Web Applications,” Project, E. Meißner (Supervisor), F. Kargl (Examiner), Inst. of Distr. Sys., Ulm Univ., 2021 – Completed.
The deployment process of web applications has changed a lot over the recent years. Manual administration of infrastructure has been streamlined by provisioning tools, such as Ansible, and application deployment has been revolutionized by DevOps practices and orchestration systems, such as Kubernetes. However, these advances often hide a lot of complexity and require a lot of expertise to apply correctly. As part of this work, you should research and compare different approaches to deploy a typical modern three-tier web application (e.g., Vue, Node.js, PostgreSQL). Furthermore, a demo application should be deployed using the researched continuous integration and continuous delivery methods, with special consideration of monitoring, backups, and application upgrades.
“Impact of HTTP/3 on Microservice Architectures,” Master's thesis VS-2021-16M, B. Erb and E. Meißner (Supervisor), F. Kargl (Examiner), Inst. of Distr. Sys., Ulm Univ., 2021 – Completed.
S. Merkel, “Web Content Integrity Protection,” Master's thesis VS-2020-13M, E. Meißner (Supervisor), F. Kargl and F. J. Hauck (Examiner), Inst. of Distr. Sys., Ulm Univ., 2020 – Completed.
Web clients can not determine whether they have been delivered the same version of a web application as the rest of the world, which allows a web server to deliver manipulated content to specific users, allowing them to bypass implemented functionality or inject other malicious behavior. For example, a malicious web application provider who offers a web application with end-to-end encryption functionality can deliver a manipulated implementation of the encryption mechanism to targeted users and obtain access to otherwise unreadable messages or secret keys. The thesis introduces a concept to authenticate web applications and thus prevent covert attacks by web application providers through different resource versions on individual users. Previous work has created more transparency in resource management, but still allows the use of different resource versions, violates privacy, or is based on a trust model without verification possibilities. The developed concept is based on a verifiable trust model, where all users accept only the same resource version, forcing web application providers to offer the correct web application or increasing the risk for malicious web operators of detecting their manipulated resources. Two different approaches for the verifiable trust model were designed based on available mechanisms and implemented and evaluated in proof-of-concept prototypes. By using the developed concept, web application providers are able to deliver an authenticated web application and thus provide functionality to all users in a trustworthy manner, while at the same time increasing the probability to catch malicious web application providers.
N. Maier, “Privacy In Statistical Computations,” Master's thesis VS-2020-12M, E. Meißner (Supervisor), F. Kargl (Examiner), Inst. of Distr. Sys., Ulm Univ., 2020 – Completed.
In human science research, maintaining the privacy of research participant is of utmost importance as studies often collect highly sensitive data about individuals. However, most universal guidelines such as the APA code of conduct only state very broad requirements such as a "primary obligation [to] take reasonable precautions to protect confidential information". Additionally, the prevalence of other forms of research misconduct such as authorship fraud raises the question whether research participants can trust researchers to properly handle their data. To increase trust and improve the privacy of research participants, we propose a system that enforces rigorous privacy guarantees on research results. In this thesis, we focus on identifying possible privacy mechanisms which could be applied to statistical analyses as part of social science research and yield strong - and ideally easy to understand - privacy guarantees.
J. Klassen, “Porting a Statistics Language Interpreter to Rust,” Project, E. Meißner (Supervisor), Inst. of Distr. Sys., Ulm Univ., 2020 – Completed.
As part of our ongoing research, we are currently building a platform for secure statistical analysis based on SGX. The current prototype relies on a very simple statistics language, which we are planning to extend in the future. The goal of this project is to port an existing statistics language interpreter, such as PSPP, to the Rust programming language. Rust features a rich type system and can guarantee memory-safety and thread-safety during compile time, which makes it a great candidate for building safe and fast programming language interpreters. nom is a parser combinators library written in Rust that allows to build safe parsers without compromising on speed or memory consumption. This library can be used as a starting point to implement the parser.
“Performance Comparison of Chronograph and Actor-Based Platforms,” individual lab project VS-2020-08P, B. Erb and E. Meißner (Supervisor), F. Kargl (Examiner), Inst. f. Vert. Sys., Univ. Ulm, 2020 – Completed.
J. Hutter, “Web-based Interface for a Programmable Chatbot,” Bachelor's thesis, E. Meißner (Supervisor), F. Kargl (Examiner), Inst. of Distr. Sys., Ulm Univ., 2019 – Completed.
Gemeinsam mit Abteilungen aus der Psychologie wird am Institut für Verteilte Systeme ein programmierbarer Chatbot entwickelt, der insbesondere für Studien und Experimente eingesetzt werden soll. Der derzeitige Prototyp erfordert eine Programmierung der Zustandsautomaten des Bots in Java. Dies ist vor allem für Personen ohne Programmierhintergrund eine große Hürde bei der Gestaltung von Dialog-Skripten. In dieser Abschlussarbeit soll hierfür eine webbasierte Oberfläche entwickelt werden, die eine grafische Erstellung von Chatbot-basierten Studien ermöglicht. Im Rahmen der Arbeit soll zunächst ein überblick über bestehende Tools und Formate erarbeitet werden. Anschließend soll der Funktionsumfang des Bots in einer interaktiven Web-Anwendung abgebildet werden. Die so modellierten Dialoge sollen schließlich in code-basierte Zustandsautomaten zur Ausführung in der Bot-Plattform trans-formiert werden.
“Causality-aware Log Pruning in Distributed event-sourced Systems,” individual lab project VS-P21-2019, B. Erb and E. Meißner (Supervisor), F. Kargl (Examiner), Inst. f. Vert. Sys., Univ. Ulm, 2019 – Completed.
“Revisited: A platform architecture for retroactive programming using event sourcing,” individual lab project VS-R07-2018, B. Erb and E. Meißner (Supervisor), F. Kargl (Examiner), Inst. f. Vert. Sys., Univ. Ulm, 2018 – Completed.
“Online Text Processing for Chatting Applications,” Bachelor's thesis VS-B19-2018, E. Meißner and B. Erb (Supervisor), F. Kargl (Examiner), Inst. of Distr. Sys., Ulm Univ., 2018 – Completed.
“Event-Sourced Graph Processing in Internet of Things Scenarios,” Master's thesis VS-M03-2018, B. Erb and E. Meißner (Supervisor), F. Kargl (Examiner), Inst. of Distr. Sys., Ulm Univ., 2018 – Completed.
M. Diemer, “Dependency Tracking in Distributed Retroactive Applications,” Bachelor's thesis, E. Meißner (Supervisor), F. Kargl (Examiner), Inst. of Distr. Sys., Ulm Univ., 2018 – Completed.
Retroactive computing enables programmatical access to the history of an application. This offers a variety of capabilities, such as computations and predictions of alternate application timelines, post-hoc bug fixes, and retroactive state explorations. Reads and writes of the application state have to be tracked and persisted in order to support retroaction. This is fairly simple for a single-writer append-only log, but entails various issues in a distributed setting. This thesis/project should explore different approaches for a distributed dependency tracking, including a prototypical implementation based on an existing platform prototype and an evaluation of the resulting artifacts.
“Bringing Height to the Chronograph Platform,” individual lab project VS-R08-2018, B. Erb and E. Meißner (Supervisor), F. Kargl (Examiner), Inst. f. Vert. Sys., Univ. Ulm, 2018 – Completed.
A. Kononenko, “Blockchain Analysis with Chronograph,” Bachelor's thesis, E. Meißner (Supervisor), F. Kargl (Examiner), Inst. of Distr. Sys., Ulm Univ., 2018 – Completed.
Blockchain technology allows for decentralized, distributed, and secure ledgers that store records (e.g., transactions). Popular blockchain-based systems such as Bitcoin and Etherum have emerged as so-called crypto-currencies. As the ledger maintains the full history of transactions, interactions within the system are always persisted. In this work, the student is asked to design and implement online and offline transaction analyses based on Chronograph, a data processing platform for evolving graphs developed at our Institute. Therefore, different blockchain-based systems should be surveyed and appropriate analysis mechanisms should be conducted.
“A platform architecture for retroactive programming using event sourcing,” individual lab project VS-R23-2017, B. Erb and E. Meißner (Supervisor), F. Kargl (Examiner), Inst. f. Vert. Sys., Univ. Ulm, 2017 – Completed.

Teaching

Current Teaching
  • Networked Systems (VNS)
  • Introduction to Computer Networks (GRN)
  • Architectures for Distributed Internet Services (ADIS)
  • Security and Privacy in Mobile Systems (SPMS)
  • Privacy in the Internet (PRIV)
  • Selected Topics in Distributed Systems (ATVS)
  • Research Trends in Distributed Systems (RTDS)
  • Computer Networks and IT-Security (RNSEC)

Lab Courses

Seminars and Student Projects

Seminars

Currently Supervised Seminar Courses
  • Privacy in the Internet (PRIV)
  • Selected Topics in Distributed Systems (ATVS)
  • Research Trends in Distributed Systems (RTDS)
Office Hours

For reliable meetings, please arrange an appointment via mail.

Current Topics

  • WebAssembly (Seminar ATVS/RTDS; Summer Term 2024)

Previous Topics

  • Privacy von Online-Dating Plattformen (Proseminar PRIV; Summer Term 2023)
  • Privacy in Instant Messaging Anwendungen (Proseminar PRIV; Summer Term 2023)
  • Multi-factor Authentication and WebAuthn (Seminar ATVS/RTDS; Summer Term 2023)
  • Zero-knowledge Proofs (Seminar ATVS/RTDS; Summer Term 2023)
  • IPFS and Dat (Seminar ATVS/RTDS; Winter Term 2022/2023)
  • Zero-knowledge Proofs (Seminar ATVS/RTDS; Winter Term 2022/2023)
  • Authentication in Web Applications (Seminar ATVS/RTDS; Summer Term 2022)
  • Privacy von Kontaktverfolgung-Apps (Proseminar PRIV; Summer Term 2022)
  • Privacy von digitalen Impfzertifikaten (Proseminar PRIV; Summer Term 2022)
  • Privacy in Instant Messaging Anwendungen (Proseminar PRIV; Summer Term 2022)
  • Authentication in Web Applications  (Seminar ATVS/RTDS; Winter Term 2021/2022)
  • Evolution of the Hypertext Transfer Protocol (Seminar ATVS/RTDS; Winter Term 2021/2022)
  • State of the Art of Web Application Security (Seminar ATVS/RTDS; Summer Term 2021)
  • DevOps Monitoring using Grafana and Prometheus (Seminar ATVS/RTDS; Summer Term 2021)
  • State of the Art of Web Application Security (Seminar ATVS/RTDS; Winter Term 2020/2021)
  • Trusted Execution Environments (Seminar ATVS/RTDS; Winter Term 2020/2021)
  • State of the Art of Web Application Security (Seminar ATVS/RTDS; Summer Term 2020)
  • Trusted Execution Environments (Seminar ATVS/RTDS; Summer Term 2020)
  • Doxxing als Angriff auf die Privacy (Proseminar PRIV; Summer Term 2020)
  • Trusted Execution Environments (Seminar ATVS/RTDS; Winter Term 2019/2020)
  • Serverless Computing (Seminar ATVS/RTDS; Summer Term 2019)
  • Distributed Causality Tracking (Seminar ATVS/RTDS; Winter Term 2018/2019)
  • GDPR: Theorie und Praxis (Proseminar PRIV; Winter Term 2018/2019)
  • Machine Learning on Event Streams (Seminar ATVS; Summer Term 2018)
  • Networking in Online Multiplayer Games (Seminar ATVS; Winter Term 2017/2018)
  • Privacy in Instant Messaging Anwendungen (Proseminar PRIV; Winter Term 2017/2018)