Projects

Master's thesis at the TUM Associate Professorship of Embedded Systems and Internet of Things, supervised by Dr.-Ing. Mohammad Hamad and examined by Prof. Dr. Sebastian Steinhorst. Both are co-authors of the accompanying poster.

The security of optical inter-satellite links (OISLs) rests on secret keys. That is a single point of failure once those keys leak. The thesis asks what authentication anchor remains, and answers with the orbit itself. Reading, injecting, or rewriting a laser crosslink requires physical presence inside a small attack zone, and every such “seat” lies off all natural orbits, so holding one burns propellant at a fixed rate.

Every attack can therefore be priced in Δv, the velocity change a maneuver requires. A history-chained protocol turns that rate into a bill that grows with time. A year of persistent impersonation costs 4–12 km/s of Δv, more than any spacecraft carries, while the defender spends a fraction of a percent of bandwidth. Authentication then rests on orbital mechanics rather than secret keys.

Founded in 2018 with two friends (Birkel, Herberg, Thai GbR) out of frustration as competitive players. Brackets lived on one site, rules on another, communication on Discord. OPL puts everything in one place.

We first made a name as a tournament organiser in the German-speaking Rainbow Six Siege scene, then pivoted to building the platform itself. It now offers the OPL Tournament Engine (inheritance-based tournament setup), Production Tools (broadcast-ready OBS overlays from a URL), and Instant Graphics (auto-generated social media graphics).

Today the platform counts 50,000+ players, 63,000+ matches, and 1,800+ organisers across 17 game titles. I ran it full-time from 2019 to 2023 and have maintained it alongside research since.

An infrastructure project for 2026, currently in progress. I am deploying a balcony solar power plant at home, in German a Balkonkraftwerk. These are small plug-in photovoltaic systems that feed into a regular household circuit.

The target load is my homelab. The goal is to run its servers on self-produced green energy.

Built at Fraunhofer AISEC (2024–2025) as a tool and testbed for vehicle penetration tests. The low- and high-frequency relay kit performs man-in-the-middle attacks on car locking systems. It relays the unlock signal between key and vehicle over distance, which is the technique behind real-world keyless car theft.

The work covered the full stack of such an attack. I reverse engineered the LF and HF signal path of the locking systems, designed the relay boards in KiCad, and assembled the result into a kit usable in real penetration tests.

Demonstrator built at Fraunhofer AISEC (2024–2025) showing post-quantum-secure communication in a remote-safety scenario in the AISEC industrial lab. It included a remote-operator GUI, Docker containers for the different post-quantum crypto endpoints, and the integration of OpenTitan. The point was to bridge upcoming crypto standards and physical machinery.

Rebuilt the website of TUMfast (TUM Finance and Accounting Selected Talents) together with two fellow Informatics master's students as an Interdisciplinary Project (IDP). The three of us were honored with a lifelong honorary membership in the TUMfast network for the result.

Bachelor's thesis at the TUM Chair for IT Security, supervised by Dr. Fabian Franzen and examined by Prof. Dr. Claudia Eckert. Submitted January 2025 and graded 1.3.

Enforcing compliance is hard when nobody is in the room. Physical inspections and on-site audits do not work for online esports competitions or remote exams, so tournaments rely on monitoring tools that report on user activity and system state. Moss is the established standard for esports.

I first reverse-engineered Moss. That analysis let me circumvent its integrity proofs, which makes its attestations worthless. Building on those findings I designed BASTION (Behavior Audit and Systematic Tracking for Inspection and Operational Needs), a hardened monitoring tool that closes the weaknesses I found.

The thesis also compares candidate trust anchors, from a server-side anchor to hardware options such as a TPM or a trusted execution environment, and weighs their guarantees against their weaknesses. BASTION cannot offer total security, because it runs on a computer its owner controls. The goal is narrower and achievable: raise the cost for cheat developers enough that they have to notice and defeat it.

The topic let me combine a long-held interest in esports with IT security.

A small side venture I tried out in 2024. I 3D printed little relief models on demand and sold them through an Etsy shop. Each piece was printed after the order came in and then shipped out.

The additive manufacturing process chain later turned into a research topic. My first paper, “Securing the Additive Manufacturing Process Chain” (ARES 2025), examines the security of exactly this kind of digitalized manufacturing.

Two research projects at the SAP University Competence Center, TUM Chair of Information Systems (2016–2018), alongside first-level support for academic partners running SAP systems.

Analysing online job advertisements with SAP HANA. I extended and operated a web crawler feeding a SAP HANA application, migrated the data and the analysis application to a new SAP HANA release, and wrote the SQL analytics behind the study.

A curriculum for Industry 4.0. I did the website design and development (HTML, CMS) plus server-side administration of the application.

Along the way I earned the SAP Certified Application Associate (TERP10) certification.