Master Thesis: In-Process Isolation and Recovery for WebAssembly Runtimes
Ericsson ABSammanfattning
Ericsson Research Security is seeking a master's student to conduct a thesis project focused on enhancing security in WebAssembly (Wasm) runtimes. The role involves investigating in-process isolation and recovery mechanisms to protect against vulnerabilities in Wasm components. The position is based in Stockholm, Sweden, and offers an opportunity to work on cutting-edge security solutions in a collaborative environment.Det här erbjuder vi
Opportunity to work on innovative security solutions.Collaborative environment with diverse innovators.Chance to push the boundaries of technology and solve complex problems.
Ansök senast: Öppet tillsvidare
Publicerad: 2026-11-04
Beskrivning
Join our Team
About this opportunity:
Ericsson Research Security provides security expertise, architectures, and solutions for platforms, networks, and services. Its research spans areas such as cryptography, secure networking, AI/ML security, application security, identity management, privacy, and methods for developing and evaluating secure systems.
WebAssembly (Wasm) provides a sandbox for running untrusted modules. However, a Wasm runtime also includes components outside the sandbox, such as WASI implementations, host functions, third-party libraries, and support for multiple concurrent workloads. Faults or vulnerabilities in these components may compromise the runtime process and affect other workloads running within it.This thesis will investigate whether fine-grained, in-process isolation and recovery can add a protection boundary within Wasm runtimes, complementing the Wasm sandbox. The project will use Secure Domain Rewind and Discard (SDRaD), a prototype mechanism for creating isolated memory domains and recovering from faults by discarding or rolling back affected domains.You will develop a threat and fault model to identify suitable isolation boundaries in a Wasm runtime, then integrate SDRaD with a selected runtime, such as Wasmtime. The work may focus on isolating runtime services, co-located Wasm instances, or both. You will evaluate fault containment, recovery, and performance overhead, including whether faults or compromises can be handled without restarting the entire runtime or disrupting unrelated workloads.
What you will do:
The skills you bring:
Application:
Please submit a brief cover letter and CV. Technical reports or other work you have written, such as coursework or blog posts, are welcome. Include relevant projects and describe your contributions. Applications will be reviewed as they arrive, and suitable candidates may be interviewed on a rolling basis.
Why join Ericsson?At Ericsson, you'll have an outstanding opportunity. The chance to use your skills and imagination to push the boundaries of what's possible. To build solutions never seen before to some of the world's toughest problems. You'll be challenged, but you won't be alone. You'll be joining a team of diverse innovators, all driven to go beyond the status quo to craft what comes next.
What happens once you apply? Click Here to find all you need to know about what our typical hiring process looks like.Encouraging a diverse and inclusive organization is core to our values at Ericsson, that's why we champion it in everything we do. We truly believe that by collaborating with people with different experiences we drive innovation, which is essential for our future growth. We encourage people from all backgrounds to apply and realize their full potential as part of our Ericsson team. Ericsson is proud to be an Equal Opportunity Employer. learn more.
Primary country and city: Sweden (SE) || Stockholm
Req ID: 793512
About this opportunity:
Ericsson Research Security provides security expertise, architectures, and solutions for platforms, networks, and services. Its research spans areas such as cryptography, secure networking, AI/ML security, application security, identity management, privacy, and methods for developing and evaluating secure systems.
WebAssembly (Wasm) provides a sandbox for running untrusted modules. However, a Wasm runtime also includes components outside the sandbox, such as WASI implementations, host functions, third-party libraries, and support for multiple concurrent workloads. Faults or vulnerabilities in these components may compromise the runtime process and affect other workloads running within it.This thesis will investigate whether fine-grained, in-process isolation and recovery can add a protection boundary within Wasm runtimes, complementing the Wasm sandbox. The project will use Secure Domain Rewind and Discard (SDRaD), a prototype mechanism for creating isolated memory domains and recovering from faults by discarding or rolling back affected domains.You will develop a threat and fault model to identify suitable isolation boundaries in a Wasm runtime, then integrate SDRaD with a selected runtime, such as Wasmtime. The work may focus on isolating runtime services, co-located Wasm instances, or both. You will evaluate fault containment, recovery, and performance overhead, including whether faults or compromises can be handled without restarting the entire runtime or disrupting unrelated workloads.
What you will do:
- Review research and existing Wasm runtimes, focusing on multiple-instance support and in-process isolation.
- Define and prioritize a threat and fault model, and identify appropriate isolation boundaries.
- Design and implement a prototype integrating a selected Wasm runtime with the SDRaD library.
- Run experiments and benchmark the prototype in realistic use cases, assessing security, dependability, recovery, and performance.
- Present interim findings and document the results in a final thesis.
The skills you bring:
- Currently pursuing a master's degree in Computer Science, Electrical or Computer Engineering, or a related field.
- Strong knowledge of Linux systems.Programming experience in C and Python.
- Knowledge of computer security, in-process isolation, or WebAssembly is an advantage.
Application:
Please submit a brief cover letter and CV. Technical reports or other work you have written, such as coursework or blog posts, are welcome. Include relevant projects and describe your contributions. Applications will be reviewed as they arrive, and suitable candidates may be interviewed on a rolling basis.
Why join Ericsson?At Ericsson, you'll have an outstanding opportunity. The chance to use your skills and imagination to push the boundaries of what's possible. To build solutions never seen before to some of the world's toughest problems. You'll be challenged, but you won't be alone. You'll be joining a team of diverse innovators, all driven to go beyond the status quo to craft what comes next.
What happens once you apply? Click Here to find all you need to know about what our typical hiring process looks like.Encouraging a diverse and inclusive organization is core to our values at Ericsson, that's why we champion it in everything we do. We truly believe that by collaborating with people with different experiences we drive innovation, which is essential for our future growth. We encourage people from all backgrounds to apply and realize their full potential as part of our Ericsson team. Ericsson is proud to be an Equal Opportunity Employer. learn more.
Primary country and city: Sweden (SE) || Stockholm
Req ID: 793512
Ansök till tjänsten
Master Thesis: In-Process Isolation and Recovery for WebAssembly Runtimes
OM FÖRETAGET
Ericsson AB
