SROS2 Tutorial | IROS 2018

Securing Robotics with SROS2

This tutorial will provide a formal introduction to SROS2 for roboticists as an effort towards advancing the state of security in the robotics community. The objectives of this session will be multifaceted; primary hands-on instruction in setup and use of newer security features and tooling within ROS2, while secondary and tertiary objective include insighting more contributors to join the the project as well as soliciting further feedback.


Monday, 1st October 2018 (14:30-18:00)

Given that ROSCon 2018 will proceed iROS during September 29th-30th, we would like to accommodate as many developer and industry attendees traveling to Madrid for ROSCon to extend their stay. By scheduling this half-day afternoon tutorial towards the start of iROS and thus closer to the conclusion of ROSCon, we hope to entice more of the robotic developer community, those who are underlying drivers in bring the research presented at iROS to market, to join us at iROS as well.

As ROSCon is only single track, outside of keynotes and presentations the community is given only brief informal birds-of-a-feather sessions over breaks to gather and ask questions. We feel a dedication session for instructional walkthrough and Q&A would be valuable for any next generation Robotic Operating System user wishing to learn how to use and deploy secure robotic applications for commercial or industrial sectors. By allocating time for an in-person exchange of lessons and ideas, we hope the accompanying dialogue will help foster and accelerate more constructive solutions than would otherwise be possible from remote or isolated community discussions.


Madrid Municipal Conference Centre Room: 4.R4 | MoC19 Tutorial

For further Venue info, please visit the official IROS website:



  • Lunch Break | 13:30 - 14:30
    • Break between morning and afternoon tutorials
  • Introduction | 14:30 - 14:45 | Gianluca + Ruffin
    • Session overview
    • Gauging the audience
    • Logistics and reminders
    • Slides
  • Motivation | 14:45 - 15:30 | Bernhard
    • Cyber threats in Robotics
    • Existing attacks on ROS
    • Available pentesting tools
    • Slides
  • Background | 15:30 - 16:30 | Gerardo
    • Secure DDS spec from OMG
    • Feature and performance analysis
    • Hands on classic Shapes Demo
    • Slides
  • Coffee Break | 16:30 - 17:00
    • A chance for folks to catch up and mingle
  • SROS2 Basics | 17:00 - 18:00 | Mikael
    • Implementation details
    • Installation setup and runtime
    • Simple test examples
    • Slides
  • SROS2 Demos | 18:00 - 18:30 | Ruffin
    • Hands on demos and best practices
    • Using Comarmor and Keymint
    • Debugging and monitoring
    • Slides
  • Concluding Remarks | 18:30 - 19:00 | Ruffin + Mikael
    • Future initiatives (e.g. user tooling)
    • Design challenges (e.g. DDS mapping)
    • Q&A and Open Discussion
    • Slides




ROSCon 2018 Madrid: Leveraging DDS Security in ROS2

The ROS2 Middleware Interface (rmw) uses OMG Data-Distribution Service (DDS) standard middleware and the DDS-RTPS protocol. One key aspect of DDS is the support for secure communications defined by the DDS-Security standard. This presentation describes the main characteristics of DDS-Security: How applications are identified and authenticated, access control mechanisms, and dataflow protection options (e.g., encryption, authentication, origin authentication). We will describe interesting scenarios and how they would impact the deployment of secure ROS2 systems that leverage DDS-Security. We also include benchmarks showing the expected performance impact resulting from each of these choices.



Procedurally Provisioned Access Control for Robotic Systems

Security of robotics systems, as well as of the related middleware infrastructures, is a critical issue for industrial and domestic IoT, and it needs to be continuously assessed throughout the whole development lifecycle. The next generation open source robotic software stack, ROS2, is now targeting support for Secure DDS, providing the community with valuable tools for secure real world robotic deployments. In this work, we introduce a framework for procedural provisioning access control policies for robotic software, as well as for verifying the compliance of generated transport artifacts and decision point implementations.

author="White, Ruffin and Caiazza, Gianluca and Christensen, Henrik and Cortesi, Agostino",
booktitle={2018 IEEE/RSJ International Conference on Intelligent Robots and Systems (IROS)},
title={Procedurally Provisioned Access Control for Robotic Systems},
keywords={Cryptobotics;Cybersecurity;Networked Robots;Industrial Robots;Robot Safety;Middleware;ROS2;Secure DDS},

Penetration testing ROS

ROS is the most popular framework in robotics research and it also grows in terms of industrial use. This makes ROS a worthwhile target for attackers especially since security is not addressed by the core framework itself. Its open architecture and flexibility are also the reasons why ROS suffers from security issues. For example, in ROS it is possible to isolate single nodes from the rest of the application without the ROS master, the other nodes or even the node itself (i.e., its business code) noticing it. This is true for publishers, subscribers and services alike. This makes attacks very difficult to spot at runtime. Penetration testing is the most common security testing practice. The goal is to test an application for possible security flaws. To better facilitate penetration testing for ROS, we introduce ROSPenTo and Roschaos, tools that make use of the vulnerabilities of ROS and demonstrate how ROS applications can be sabotaged by an attacker. In this tutorial you will learn about the ROS XML-RPC API, which is our main attack point. You will see, how API attacks on ROS work in depth. You will get to know Roschaos and ROSPentTo, two tools, which can be used to manipulate running ROS applications.

author="Dieber, Bernhard and White, Ruffin and Taurer, Sebastian and Breiling, Benjamin and Caiazza, Gianluca and Christensen, Henrik and Cortesi, Agostino",
editor="Koubaa, Anis",
title="Penetration testing ROS",
bookTitle="Robot Operating System (ROS): The Complete Reference (Volume 4)",
publisher="Springer International Publishing",

SROS1: Using and Developing Secure ROS1 Systems

SROS1 is a proposed addition to the ROS1 API and ecosystem to support modern cryptography and security measures. An overview of current progress will be presented, explaining each major advancement, including: over-the-wire cryptography for all data transport, namespaced access control enforcing graph policies/restrictions, and finally process profiles using Linux Security Modules to harden a node’s resource access. This chapter not only seeks to raise community awareness of the vulnerabilities in ROS1, but to provide clear instruction along designed patterns of development for using proposed solutions provided by SROS1 to advance the state of security for open source robotics subsystems.

author="White, Ruffin and Caiazza, Gianluca and Christensen, Henrik and Cortesi, Agostino",
editor="Koubaa, Anis",
title="SROS1: Using and Developing Secure ROS1 Systems",
bookTitle="Robot Operating System (ROS): The Complete Reference (Volume 3)",
publisher="Springer International Publishing",

External Links



Ruffin White | UCSD

Ruffin White is a Ph.D. student in the Contextual Robotics Institute at University of California San Diego, under the direction of Dr. Henrik Christensen. Having earned his Masters of Computer Science at the Institute for Robotics \& Intelligent Machines, Georgia Institute of Technology, he remains an active contributor to ROS and a collaborator with the Open Source Robotics Foundation. His research interests include mobile robotics, with an focus on secure sub-systems design, as well as advancing repeatable and reproducible research in the field of robotics by improving development tools and standards for robotic software.

Gianluca Caiazza | UNIVE

Gianluca Caiazza is a Ph.D. student in the Advances in Autonomous, Distributed and Pervasive systems (ACADIA) in security studies at Ca’ Foscari University under the supervision of Professor Agostino Cortesi. His research interests include logical analysis of APIs, analysis of complex systems and reverse engineering, always along the line of cybersecurity. He is also passionate about connected and smart devices/infrastructure, specifically within the Consumer and Industrial IoT field.

Mikael Arguedas | OSRF

Mikael received his joint MSc from GeorgiaTech and ENSEA (France) in 2015 with a major in Electronics and Computer Engineering and a minor in Computer Science. He worked as a research assistant at GTRI and developed Computer Vision algorithms for detection of rigid and deformable objects. Before that, Mikael received a BS in Embedded Systems, Robotics and RTOS from IUT Cachan in 2011. He has been working on various ROS projects during the last few years. He joined OSRF as an intern in 2015 when he worked on developing a new generation of open hardware/firmware/software sensors for mobile robots. He joined the team full-time in January 2016.

Gerardo Pardo | RTI

Gerardo Pardo is the CTO at RTI, he has been with the company since it was founded, held various position in research, development, consulting, and became the CTO in 1998. Gerardo was the main developer of the original versions of the RTI Connext DDS product line. He started this work while still working on his Ph.D. at Stanford and carried on the product at RTI. Gerardo leads RTI’s standardization efforts and he is the main author of the OMG Data Distribution Service Standard (DDS), the OMG Real-Time Publish Subscribe (RTPS) Protocol standard, the DDS Security Standard, and many of the other (currently 7) DDS-related standards. He also chairs the OMG revision task forces for these standards.

Bernhard Dieber | JOANNEUM

Bernhard Dieber is the head of the Robotic Systems research group at the Institute for Robotics and Mechatronics of JOANNEUM RESEARCH. He received his master’s degree in applied computer science and PhD in information technology from the Alpen-Adria Universität Klagenfurt. His research interests include robotics software, security and dependability of robotic systems, visual sensor networks and middleware.

Additional Organizers

Henrik Christensen | UCSD

Dr. Henrik I. Christensen is a Professor of Computer Science at the Department of Computer Science and Engineering University of California San Diego. He is also Director of the Institute for Contextual Robotics. Prior to his coming to the University of California San Diego he was the founding director of the Institute for Robotics and Intelligent machines (IRIM) at Georgia Institute of Technology (2006-2016). Dr. Christensen does research on systems integration, human-robot interaction, mapping and robot vision. He has published more than 300 contributions across AI, robotics and vision. His research has a strong emphasis on “real problems with real solutions.” A problem needs a theoretical model, implementation, evaluation, and translation to the real world.

Agostino Cortesi | UNIVE

Professor Agostino Cortesi is a Full Professor at Ca’ Foscari University of Venice. Recently, he served as Dean of the Computer Science program, and as Department Chair. He also served 8 years as Vice-Rector of Ca’ Foscari University, taking care of quality assessment and institutional affairs. His main research interests concern programming languages theory and static analysis techniques, with particular emphasis on security applications. He is also interested in investigating the impact of ICT on different social and economic fields (from Tourism to E-Government to Social Sciences). He has published more than 100 papers in high level international journals and proceedings of international conferences. He served as member of several program committees for international conferences (e.g., SAS, VMCAI, CSF) and on editorial boards of scientific journals (Computer Languages, Systems and Structures, Journal of Universal Computer Science).