Leveraging Secure
Discovery Server in ROS 2Speaker:● Eduardo Ponz Segrelles, Project Manager @ eProsima

eduardoponz@eprosima.com

October 20th, 2023

Agenda01

Motivation

02

ROS 2 Discovery Server● Out-of-the-box discovery caveats● Secure deployments● Overview● Configuration options● Network bandwidth performance

03

SROS 2 Security capabilities

04

Deployment example● Security plugins● Configuration options● SROS 2 tooling●●Introduction
Demo2

Motivation
Why using ROS 2 Discovery Server & SROS 2

ROS 2 discovery
scalability
Avoid using multicast based
discovery and drastically reducethe discovery related traffic byleveraging Discovery Server

3Motivation
Why using ROS 2 Discovery Server & SROS 2Secureproduction
deployments
Properly isolated robots andprevent ill-intentioned external
actions on ROS 2 distributed
applications

4

ROS 2Discovery Server
A Fast DDS powered unicast
based & centralized discovery
mechanism for ROS 25

ROS 2 Discovery Server
Out-of-the-box discovery (SDP)

6

ROS 2 Discovery Server
Out-of-the-box discovery (SDP)

1No configuration
ROS 2 Nodes discover each otherautomatically7

ROS 2 Discovery ServerOut-of-the-box discovery (SDP)

1No configuration
ROS 2 Nodes discover each otherautomatically2

Traffic heavy
Number of packets increases
exponentially with number of ROS 2contexts

8

ROS 2 Discovery Server
Out-of-the-box discovery (SDP)1

No configuration
ROS 2 Nodes discover each otherautomatically2

Traffic heavy
Number of packets increases
exponentially with number of ROS 2contexts

3

Multicast based
PDP is based on multicast, which may
bring problems on WiFi or managed
networks
9

ROS 2 Discovery ServerDiscovery Server mechanism

ClientNode1Client
Node3Discovery Server

Client
Node2

ClientNode410ROS 2 Discovery Server
Discovery Server mechanism

Client
Node1

Client
Node3

Pub1

Discovery Server

Client
Node2

ClientNode411ROS 2 Discovery Server
Discovery Server mechanism

Topic1

Client
Node1

Client
Node3

Pub1

Sub1

Discovery Server

Client
Node2

ClientNode412ROS 2 Discovery Server
Discovery Server mechanism

Topic1

Client
Node1

Sub1

Client
Node3

Pub1

Pub1

Sub1

Discovery Server

Client
Node2

ClientNode413

ROS 2 Discovery Server
Discovery Server mechanism

Topic1

Client
Node1

Sub1

Client
Node3

Pub1

Pub1

Sub1

Discovery Server
Sub2
Pub2

Client
Node2

ClientNode4Topic214ROS 2 Discovery Server
Discovery Server mechanism

Topic1

Client
Node1

Sub1

Client
Node3

Pub1

Pub1

Sub1

Discovery Server
Sub2

Sub2
Pub2

Pub2

Client
Node2

Client
Node4
Topic215

ROS 2 Discovery Server
Discovery Server mechanism

Topic1

Client
Node1

Sub1

Client
Node3

Pub1

Pub1

1

Minimal configuration
Clients only need to know where theDiscovery Server is located.

Sub1

Discovery Server
Sub2

Sub2
Pub2

Pub2

Client
Node2

Client
Node4
Topic2

16

ROS 2 Discovery Server
Discovery Server mechanism

Topic1

Client
Node1

Sub1

Client
Node3

Pub1

Pub1

2

Traffic reduction
Benchmarks show up to a 85% traffic
reduction when compared to SDP

Sub1Discovery Server
Sub2

1

Minimal configuration
Clients only need to know where theDiscovery Server is located.

Sub2
Pub2

Pub2

Client
Node2

Client
Node4
Topic2

17

ROS 2 Discovery Server
Discovery Server mechanism

Topic1

Client
Node1

Sub1

Client
Node3

Pub1

Pub1

2

Traffic reduction
Benchmarks show up to a 85% traffic
reduction when compared to SDP

3Unicast based
Works out-of-the-box in WiFi andmanaged networks as it does not require
multicast

Sub1

Discovery Server
Sub2

1

Minimal configuration
Clients only need to know where theDiscovery Server is located.

Sub2Pub2

Pub2Client
Node2Client
Node4
Topic218ROS 2 Discovery Server
Discovery Server deployment and configuration

Server redundancy

Client
NodeDiscovery Server

ClientNodeClient
Node

Discovery Server

19

ROS 2 Discovery Server
Discovery Server deployment and configuration

Server redundancy

Client
Node

Discovery Server

ClientNodeLAN Segmentation

ClientNodeClient
NodeClient
Node

Discovery Server

Discovery Server

ClientNodeClient
Node

Discovery Server20

ROS 2 Discovery Server
Discovery Server deployment and configuration

Server redundancy

Client
NodeDiscovery Server

Client
NodeBridging segments

ClientNodeClient
NodeClientNodeDiscovery Server

Discovery ServerClient
NodeClient
NodeDiscovery Server21

ROS 2 Discovery Server
Discovery Server deployment and configuration

1Deploy a Discovery Server
Instantiating a Discover Server is assimple as running one CLI command$ fastdds discovery -i 022

ROS 2 Discovery ServerDiscovery Server deployment and configuration1

Deploy a Discovery Server
Instantiating a Discover Server is assimple as running one CLI command$ fastdds discovery -i 02

Configure nodes as Clients
Nodes are configured as Clients using anenvironment variable$ export ROS_DISCOVERY_SERVER="192.168.1.54"

23ROS 2 Discovery ServerDiscovery Server deployment and configuration

1Deploy a Discovery Server
Instantiating a Discover Server is assimple as running one CLI command$ fastdds discovery -i 0

2Configure nodes as Clients
Nodes are configured as Clients using anenvironment variable$ export ROS_DISCOVERY_SERVER="192.168.1.54"

3

Advanced configurations
Update list of Server in run-time, Super
Client, etc.
24

SROS 2ROS

2leverageinfrastructure
DDStoSecurity

capabilities and protect yourROS 2 applications

25

DDS Security
Several levels of protection

Authentication(DDS:Auth:PKI-DH)
Authenticate a new Participant
when joining the network

26

DDS Security
Several levels of protection

Authentication

Access Control(DDS:Auth:PKI-DH)(DDS:Access:Permissions)

Authenticate a new Participant

Limit the access andwhen joining the network

permissions for theParticipants in the network

27

DDS Security
Several levels of protection

Authentication

Access Control

Encryption(DDS:Auth:PKI-DH)(DDS:Access:Permissions)(DDS:Crypto:AES-GCM-GMAC)

Authenticate a new Participant

Limit the access andEncrypt the messages between

permissions for theEndpoints

when joining the network

Participants in the network

28

DDS Security
Understanding the security infrastructure

Root CA- private key- certificate

29

DDS Security
Understanding the security infrastructure

Identity CA- private key- certificate
Root CA- private key- certificate

30

DDS Security
Understanding the security infrastructure

Identity CA- private key- certificate

App Identity- private key- certificate

Root CA- private key- certificate

31

DDS Security
Understanding the security infrastructure

Identity CA- private key- certificate

App Identity- private key- certificateUsed by nodes forauthentication &encryption/decryption

Root CA- private key- certificate

32

DDS Security
Understanding the security infrastructure

Identity CA- private key- certificate

App Identity- private key- certificate

Used by nodes forauthentication &encryption/decryption

Root CA- private key- certificate
Permissions CA- private key- certificate

33

DDS Security
Understanding the security infrastructure

Identity CA- private key- certificate

App Identity- private key- certificate

Used by nodes forauthentication &encryption/decryption

Root CA- private key- certificate
Permissions CA- private key- certificate

Governancepolicy34

DDS Security
Understanding the security infrastructure

Identity CA- private key- certificate

App Identity- private key- certificate

Used by nodes forauthentication &encryption/decryption

GovernancepolicyEncryption policies &Domain-wide rules

Root CA- private key- certificate
Permissions CA- private key- certificate

35

DDS Security
Understanding the security infrastructure

Identity CA- private key- certificate

App Identity- private key- certificate

Used by nodes forauthentication &encryption/decryption

GovernancepolicyEncryption policies &Domain-wide rules

Root CA- private key- certificate
Permissions CA- private key- certificate

Permissions
policy36

DDS Security
Understanding the security infrastructure

Identity CA- private key- certificate

App Identity- private key- certificate

Used by nodes forauthentication &encryption/decryption

GovernancepolicyEncryption policies &Domain-wide rules

Permissions
policyNode-specific topic
access control policies
37

Root CA- private key- certificate
Permissions CA- private key- certificate

SROS 2 tooling
SROS 2 CLI for easily enable security in ROS 2

1

Create a keystore
Contains public and private
certificates and keys, as well as
enclaves$ ros2 security create_keystore <store>

38

SROS 2 tooling
SROS 2 CLI for easily enable security in ROS 2

1

2

Create a keystore
Contains public and private
certificates and keys, as well as
enclaves
Create enclaves
Enclave specific certificates and keys,
and CA’s public certificates$ ros2 security create_keystore <store>$ ros2 security create_enclave <store> <enclave>39

SROS 2 tooling
SROS 2 CLI for easily enable security in ROS 2

1Create a keystore
Contains public and private
certificates and keys, as well asenclaves$ ros2 security create_keystore <store>

2Create enclaves
Enclave specific certificates and keys,
and CA’s public certificates$ ros2 security create_enclave <store> <enclave>3

Configure nodes for SROS 2
Command ROS 2 nodes to use
specific enclaves for authentication,access control, and encryption$ export ROS_SECURITY_KEYSTORE=<store>$ export ROS_SECURITY_ENABLE=true$ export ROS_SECURITY_STRATEGY=Enforce$ ros2 run <pkg> <node> --ros-args --enclave <enclave>40

SROS 2 &Discovery Server
Secure Discovery Server
configuration & demonstration

41

SROS 2 Discovery Server
Secure Discovery Server deployment and configuration# secure_discovery_server.xml-Discovery Server IP address andport (i.e.: 0.0.0.0:11811)
Identity CA certificate
Identity certificate
Identity private key
Permissions certificate
Governance file (signed)
Permission file (signed)$ fastdds discovery -i 0 -x <config_xml>

XML42

SROS 2 Discovery ServerDemonstration

43

ROS 2 Record & Replay
ROS 2 Record & Replay documentation and GitHub repository

Discovery Server

SROS 2www.eProsima.com

Linkedin.com/company/eProsima

Twitter.com/EProsima