Materials

Examples

• Turtlebot3 Session:
  • github.com/ruffsl/IROS2018_SROS2_Tutorial
• Demos
  • github.com/ruffsl/ros2_docker_demos

Supplemental

ROSCon 2018 Madrid: Leveraging DDS Security in ROS2

The ROS2 Middleware Interface (rmw) uses OMG Data-Distribution Service (DDS) standard middleware and the DDS-RTPS protocol. One key aspect of DDS is the support for secure communications defined by the DDS-Security standard. This presentation describes the main characteristics of DDS-Security: How applications are identified and authenticated, access control mechanisms, and dataflow protection options (e.g., encryption, authentication, origin authentication). We will describe interesting scenarios and how they would impact the deployment of secure ROS2 systems that leverage DDS-Security. We also include benchmarks showing the expected performance impact resulting from each of these choices.

References

Publications

Procedurally Provisioned Access Control for Robotic Systems

Security of robotics systems, as well as of the related middleware infrastructures, is a critical issue for industrial and domestic IoT, and it needs to be continuously assessed throughout the whole development lifecycle. The next generation open source robotic software stack, ROS2, is now targeting support for Secure DDS, providing the community with valuable tools for secure real world robotic deployments. In this work, we introduce a framework for procedural provisioning access control policies for robotic software, as well as for verifying the compliance of generated transport artifacts and decision point implementations.

  
@Inproceedings{White2018Procedurally,
author="White, Ruffin and Caiazza, Gianluca and Christensen, Henrik and Cortesi, Agostino",
booktitle={2018 IEEE/RSJ International Conference on Intelligent Robots and Systems (IROS)},
title={Procedurally Provisioned Access Control for Robotic Systems},
year={2018},
volume={},
number={},
keywords={Cryptobotics;Cybersecurity;Networked Robots;Industrial Robots;Robot Safety;Middleware;ROS2;Secure DDS},
month={October},
}

Penetration testing ROS

ROS is the most popular framework in robotics research and it also grows in terms of industrial use. This makes ROS a worthwhile target for attackers especially since security is not addressed by the core framework itself. Its open architecture and flexibility are also the reasons why ROS suffers from security issues. For example, in ROS it is possible to isolate single nodes from the rest of the application without the ROS master, the other nodes or even the node itself (i.e., its business code) noticing it. This is true for publishers, subscribers and services alike. This makes attacks very difficult to spot at runtime. Penetration testing is the most common security testing practice. The goal is to test an application for possible security flaws. To better facilitate penetration testing for ROS, we introduce ROSPenTo and Roschaos, tools that make use of the vulnerabilities of ROS and demonstrate how ROS applications can be sabotaged by an attacker. In this tutorial you will learn about the ROS XML-RPC API, which is our main attack point. You will see, how API attacks on ROS work in depth. You will get to know Roschaos and ROSPentTo, two tools, which can be used to manipulate running ROS applications.

  
@Inbook{Dieber2019Penetration,
author="Dieber, Bernhard and White, Ruffin and Taurer, Sebastian and Breiling, Benjamin and Caiazza, Gianluca and Christensen, Henrik and Cortesi, Agostino",
editor="Koubaa, Anis",
title="Penetration testing ROS",
bookTitle="Robot Operating System (ROS): The Complete Reference (Volume 4)",
year="2019",
publisher="Springer International Publishing",
address="Cham",
}

SROS1: Using and Developing Secure ROS1 Systems

SROS1 is a proposed addition to the ROS1 API and ecosystem to support modern cryptography and security measures. An overview of current progress will be presented, explaining each major advancement, including: over-the-wire cryptography for all data transport, namespaced access control enforcing graph policies/restrictions, and finally process profiles using Linux Security Modules to harden a node’s resource access. This chapter not only seeks to raise community awareness of the vulnerabilities in ROS1, but to provide clear instruction along designed patterns of development for using proposed solutions provided by SROS1 to advance the state of security for open source robotics subsystems.

  
@Inbook{White2019SROS1,
author="White, Ruffin and Caiazza, Gianluca and Christensen, Henrik and Cortesi, Agostino",
editor="Koubaa, Anis",
title="SROS1: Using and Developing Secure ROS1 Systems",
bookTitle="Robot Operating System (ROS): The Complete Reference (Volume 3)",
year="2019",
publisher="Springer International Publishing",
address="Cham",
pages="373--405",
isbn="978-3-319-91590-6",
doi="10.1007/978-3-319-91590-6_11",
url="https://doi.org/10.1007/978-3-319-91590-6_11"
}

External Links

• ROS2
  • github.com/ros2/ros2/wiki
• SROS2
  • github.com/ros2/sros2
• ROS Docker Images
  • github.com/osrf/docker_images
• Keymint
  • github.com/keymint/keymint_tools
• ComArmor
  • github.com/ComArmor/comarmor