SecureROS:: Secure ROS Imposing secure communication in a ROS system Aravind Sundaresan and Leonard Gerard [email protected], [email protected] SRIInternational,MenloPark,CA94025 AbundantRobotics September 21, 2017 AravindSundaresan::SecureROS::Slide1of13 SecureROS::ROSisinsecure ROS is insecure ROS was built as an open robust, general-purpose robotics platform to encourage collaborative development. As such, ROS has no security. Any node on the network can publish or subscribe to any topic. Any process on the network can kill any node. Any new process with nodename will supersede existing node. AravindSundaresan::SecureROS::Slide2of13 SecureROS::ROSisinsecure An example ROS system Publisher Subscriber sensor Hardware device /sensor ROS topic driver1 ROS node /sensor /actuator /goal VM1 VM2 VM3 Computer rosmaster driver1 pathplanner ocu driver2 sensor actuator joystick Joystick controlled robot with a planner AravindSundaresan::SecureROS::Slide3of13 SecureROS::ROSisinsecure An example ROS system: malicious attack Publisher Subscriber sensor Hardware device /sensor ROS topic driver1 ROS node /sensor /actuator /goal VM1 VM2 VM3 Computer Malicious computer rosmaster driver1 pathplanner ocu ocu driver2 sensor actuator joystick hacker Joystick controlled robot with a planner AravindSundaresan::SecureROS::Slide4of13 SecureROS::SecureROS Secure ROS Secure ROS is an overlay ”package” that enables secure communication between ROS nodes. ROS public API is the same so that existing nodes can be re-used. A security configuration file can be used to specify authorized publishers, subscribers, node names, etc based on IP address. (If no file is specified, Secure ROS behaves like regular ROS.) Modified ROS master and client libraries (C++, Python) to enforce security rules. IPSec is used to ensure that IP packets are encrypted and authenticated. AravindSundaresan::SecureROS::Slide5of13 SecureROS::SecureROS Authorization configuration example aliases: vm2: [192.168.10.202] vm3: [192.168.10.203] topics: /chatter: publishers: [vm2] subscribers: [vm3] /counter: publishers: [vm2] subscribers: [vm3] nodes: /talker: [vm2] /listener: [vm3] AravindSundaresan::SecureROS::Slide6of13 SecureROS::SecureROS Secure publish-subscribe example Authorized Publisher Authorized Subscriber Failed Publisher /chatter /counter Failed Subscriber VM1 VM2 VM3 VM4 mal1 rosmaster talker mal2 listener AravindSundaresan::SecureROS::Slide7of13 SecureROS::SecureROS Secure publish-subscribe steps 1) registerS3u)b pscurbibliesrh(e“r/Uchpad4tat)et err”e(,“q /1uc9eh2sat.tT1te6or8p”.,i1 c10(9“.22/c0.1h36a:18tt2.e13r0”4.,52 p)0r2o:t2o2c3o4l5s)), rReOtuSrn sm TaCsPteRrOS://192.126) 8r.e1g0is.2te0r2P:u3b3l3is4h5er(“/chatter”, 192.168.10.202:22345) listener talker 192.168.10.203 192.168.10.202 5) make socket connection to TCPROS://192.168.10.202:33345 1 Master: Is 192.168.10.203 allowed to subscribe to /chatter? 2 Master: Is 192.168.10.202 allowed to publish to /chatter? 3 Client: Is publisherUpdate() coming from Master? 4 Client: Is 192.168.10.203 allowed to requestTopic(/chatter)? 5 Client: Is 192.168.10.203 allowed to make socket connection to tcpros://192.168.10.202:33345? AravindSundaresan::SecureROS::Slide8of13 SecureROS::SecureROS More Secure ROS features You can also specify parameters and services in authorization file. parameters: /param/a: setters: [vm2] getters: [vm3] services: /service/b: providers: [vm2] requesters: [vm3] Only “master” node can kill nodes. Each machine can only get information that it needs (rostopic, rosparam, etc.). AravindSundaresan::SecureROS::Slide9of13 SecureROS::Status Secure ROS status Secure ROS can be merged into ROS. Pull request 1080 being reviewed. https://github.com/ros/ros comm/pull/1080 Secure ROS deb packages available for download. secure-ros-lunar-secure-ros 0.9.3-1 amd64.deb secure-ros-kinetic-secure-ros 0.9.3-1 amd64.deb Install as overlay. /opt/secure ros/lunar/ AravindSundaresan::SecureROS::Slide10of13