ICT Club, Bahria

Tag: Access Control

  • ROS2 Security – Intermediate ROS2

    As robots transition from controlled environments like factories to our homes, hospitals, and public spaces, securing them is no longer optional—it’s essential. Welcome to a comprehensive 16-week self-study course designed to make you proficient in ROS2 Security. This guide will equip you with the knowledge and hands-on skills needed to build secure robotic systems that can withstand modern cyber threats.

    From foundational cybersecurity principles tailored for robotics to advanced topics such as cryptographic implementation, access control, and proactive threat modeling, this course offers a structured learning path. You’ll gain practical experience through real-world labs, preparing you to architect, develop, and deploy secure ROS2 applications.

    This course is ideal for robotics professionals, students, or enthusiasts who understand that a compromised robot isn’t just a data breach—it’s a potential physical hazard. By the end, you’ll have developed a security-first mindset and the ability to build trustworthy robotic systems for a connected world.

    Primary Learning Objectives

    • Master the core principles of cybersecurity and their application in robotics.
    • Identify and mitigate common security vulnerabilities in ROS2 systems.
    • Implement end-to-end secure communication using DDS-Security, including authentication and encryption.
    • Design and enforce granular access control policies for nodes, topics, and services.
    • Apply industry best practices for developing and deploying secure ROS2 applications.
    • Perform foundational threat modeling to identify and address potential attack vectors.
    • Use the SROS2 toolchain to create, manage, and debug security artifacts.

    Necessary Materials

    • A computer running a recent LTS version of Ubuntu (e.g., 22.04).
    • ROS2 Humble Hawksbill installed.
    • Stable internet access for documentation and package downloads.
    • Basic Linux command-line skills and proficiency in C++ or Python. Familiarity with ROS2 fundamentals (nodes, topics, services) is recommended.
    • A text editor or IDE such as VS Code.
    • (Recommended) A virtual machine (e.g., VirtualBox, VMware) or container (e.g., Docker) for isolated experimentation.

    Course Curriculum

    Week 1: Why Robotics Security Matters & ROS2 Foundations

    Lesson 1: The Modern Threat Landscape for Robotics

    We start by exploring why robotics security is critical. Unlike traditional IT systems, robotic systems—Cyber-Physical Systems (CPS)—can cause real-world physical harm when compromised. This lesson covers attack surfaces and real-world examples like unauthorized access, data theft, and remote hijacking of autonomous systems.

    Hands-on Lab: Research and document three real-world cybersecurity incidents involving robotics or autonomous systems. Analyze the attack vector, exploited vulnerability, and physical-world consequences.

    Lesson 2: ROS2 Architecture Through a Security Lens

    This lesson revisits the core components of ROS2—nodes, topics, services, and actions—with a focus on security. You’ll examine the Data Distribution Service (DDS), the default communication middleware, and understand its vulnerabilities when left unsecured.

    Hands-on Lab: Build a basic ROS2 publisher-subscriber setup. Use Wireshark to capture and inspect network traffic, observing how unencrypted DDS messages are transmitted in plain text.

    Week 2: Implementing ROS2 Security with DDS-Security

    Lesson 3: Introduction to DDS-Security and SROS2

    DDS-Security introduces core protections: authentication, access control, and encryption. You’ll learn how these mechanisms work together and get introduced to the `sros2` command-line tool, your gateway to managing security artifacts in ROS2.

    Hands-on Lab: Install the `sros2` package and explore its command-line interface. Use help commands to understand how to generate keys, certificates, and policies.

    Lesson 4: Building Trust with Public Key Infrastructure (PKI)

    PKI forms the backbone of secure communication. This lesson explains Certificate Authorities (CAs), digital certificates, and key pairs. You’ll learn how to establish a chain of trust and issue identities to ROS2 nodes.

    Hands-on Lab: Use `sros2` to generate a Certificate Authority (CA). Create a private key and CSR for a node, then sign it with your CA to issue a valid digital identity.

    Week 3: Securing Communication Channels

    Lesson 5: Enabling Authentication and Encryption

    Now that you have security artifacts, it’s time to apply them. This lesson walks you through integrating keys and certificates into your ROS2 application, setting environment variables, and modifying launch files to activate security features.

    Hands-on Lab: Secure your publisher-subscriber application using the generated artifacts. Re-launch the nodes and use Wireshark to confirm encrypted communication. Test that unauthorized nodes are blocked.

    Lesson 6: Architecting Access Control Policies

    Encryption alone isn’t enough—you must also control who can do what. This lesson teaches you to define access control policies using XML files, enforcing least-privilege access to topics and services.

    Hands-on Lab: Create a permissions file granting only necessary access to your publisher and subscriber. Attempt to violate the policy and observe access denial in action.