Leveraging DDS Security in ROS2
Gerardo Pardo, Ph.D., RTI,
gerardo __at__ rti.com
Ruffin White, UC San Diego, rwhitema __at__ eng.ucsd.edu

About RTI
Real-Time Innovations (RTI) is the Industrial
Internet of Things (IIoT) connectivity company
RTI Offers Free Connext DDS Pro
Licenses with Tools to ROS2
University & Research users

To enable and realize the potential of smart machines to serve mankind

Outline• Intro to DDS Security• Performance Impact• How ROS2 maps DDS• Using DDS Security with ROS

Data Distribution Service (DDS)DDS Specification family

DDS-SECURITY

IDL 4.

DDS-XTYPES

DDS-RPC

DDS-XRCE

DDS-WEB

DDS-OPC UA

Application
DDS-C++DDS-JAVA

DDS-IDL-C

DDS-IDL-C#

DDS v 1.4

RTPS v2.2
HTTP

OPC/
TCP

TCP

UDP

DTLS

IP
Ethernet

TLS

TSN

SHARED-MEMORY

Timeline

2004 2005 2006 2007 2008 2009 2010 2011 2012 2013 2014 2015 2016 2017 2018

Copyright © 2018 RTI. All rights reserved.

Shared Global Dataspace
Shared Global Dataspace (Domain)
Source (Key)

Speed

Power

Position

CAR1

37.4

122.0

(37.41, -122.01)

CAR2

10.7

74.0

(36.95, -122.05)

CAR3

50.2

150.07(37.42, -122.17)

QoS

QoS

Topic D

Topic DDATABUS

Persistence
Service

RecordingService
Copyright © 2018 RTI. All rights reserved.

Data-Centric Communications Model
Writer“Alarm”

New
subscriber!

DomainParticipant

Reader“Alarm”

Got new
data

Requested

OfferedListener

QoS

DomainParticipant

Listener

QoS“Alarm” Topic
Topic2
Topic2• DomainParticipant connects to the global data space (domain)• Topics define the data-objects (collections of subjects)• DataWriters publish data on Topics. Publishers are used to group DataWriters.
• DataReaders subscribe to data on Topics. Subscribers are used to group DataReaders• QoS Policies are used configure the system• Listeners are used to notify the application of events
Copyright © 2018 RTI. All rights reserved.

DDS Partitions• Provide a “scope” or “namespace” to data published/subscribed• DataWriters & DataReaders belong to one or More Partitions• DataWriters/Readers on the same Topic match only if they have acommon Partition
DataWriter1
“A”

1
1

Partition “A”

2
DataWriter2“B”

DataWriter3“A”, “B”, “C”

2

3

3

3

Partition “B”

Partition “C”

1
DataReader1“A”
1, 2
DataWriter2“A”, “B”
1, 2, 3
DataWriter3“*”
Copyright © 2018 RTI. All rights reserved.

Quality of Service (QoS) Policies
QoS Policy

Resources
Delivery

DURABILITY

USER DATAHISTORY

TOPIC DATALIFESPAN

GROUP DATAWRITER DATA LIFECYCLE

PARTITION

READER DATA LIFECYCLEPRESENTATIONENTITY FACTORYDESTINATION ORDERRESOURCE LIMITSOWNERSHIPRELIABILITYOWNERSHIP STRENGTH

TIME BASED FILTERLIVELINESSDEADLINE

LATENCY BUDGETCONTENT FILTERS

TRANSPORT PRIORITY

Availability
User QoS
Presentation
Transport

Cache

QoS Policy

DDS Security

Security Must Protect Dataflow, Too
1.
2.
3.

4.

System Boundary
Host
Network Transport

1
2

3–Media access (layer 2)–Network (layer 3) security–Session/Endpoint (layer 4/5) security
Data & Information flows

4

Copyright © 2018 RTI. All rights reserved.

Secure the Data, Not the Connection
Shared Global Dataspace
Topic
Line
Flight
Dest
Arv
Line
FlightDest
Arv
UALine567
Flight SFO
Dest 7:32Arv
UA
567
SFO
7:32
AA UA
432567 LAXSFO 9:157:32
AA
432
LAX
9:15
AA
432
LAX
9:15
Squawk Line
FlightSquawk Line
Flight
1234
UA
567
1234
UA
567
7654
AA
432
7654
AA
432
SquawkLong
Lat
Alt
Squawk
Long
Lat
Alt
1234
Squawk 37.4Long -122.0Lat 500.0Alt
1234
37.4
-122.0 500.076541234 40.737.4 -74.0-122.0250.0
500.0
7654
40.7
-74.0
250.0
7654
40.7
-74.0
250.0

DDS Domain

Copyright © 2018 RTI. All rights reserved.

Fine-Grained, DDS Security
Application

Data Flow Security, by Topic
Authentication
Access Control
Encryption
Data Tagging

Secure DDS
Library

Logging

Any Transport(e.g., TCP, UDP, multicast,shared memory, )Copyright © 2018 RTI. All rights reserved.

DDS Security Configuration
Shared By All Participants

Identity
Certificate
Authority (CA)Permissions
Certificate
Authority (CA)SecureParticipant1
Identity1

Permissions1

SecureParticipant
Line
Flight
Dest
Arv
Line
FlightDest
Arv
UALine567
Flight SFO
Dest 7:32Arv
UA
567
SFO
7:32
AA UA
432567 LAXSFO 9:157:32
AA
432
LAX
9:15
AA
432
LAX
9:15

Identity1

Permissions1

Governance

Copyright © 2018 RTI. All rights reserved.

Authentication and Authorization Steps
Create DP

Access OK?

DP Creation Fails

Create End-Points

Permissions OK?

End-Point Creation Fails
PKI Mutual Authentication witha challenge-response protocol

Discover Remote DP

Authenticate
Remote DP

Ignore Remote DP

Permissions OK?

Ignore Remote End-Point

Learn permissions, establish DH
shared secret and KxKeys
Discover Remote EndPoints

DP = Domain Participant
Endpoint = Reader / Writer

Granular Message Security

Share Granular (per-Datawriter)
Keys using KxKeys
Copyright © 2018 RTI. All rights reserved.

Governance• What Topics are
Secure?
• Which Topics use
Secure Discovery?
• What Kind ofprotection is used?
–Data Encrypt or MAC–Protocol Encrypt or
MAC

Copyright © 2018 RTI. All rights reserved.

Permissions
For each Participant• Allowed Domains(domain ID)• Topics it can read
and/or write• Partitions it can Join
• DataTags it can use

Copyright © 2018 RTI. All rights reserved.

Understanding DataTags• Immutable name-value
pairs that can beassociated with a DDS
DataWriter or DataReader• Matadata propagated by
DDS Discovery• Enforced by Access-Control• Per-sample remote tags
accessible using DDS API

Identity: IB-A320-123456<allow_rule>…
<publish>…
<topics><topic>FlightData</topic></topics><data_tags><tag><name>CarrierName</name><value>IB</value></tag><tag><name>AircraftModel</name><value>A320</value></tag></data_tags></publish></allow_rule>(anything else, denied)

Copyright © 2018 RTI. All rights reserved.

Security: Data Tagging
CarrierName:IB
AirportName:MUC
AircraftModel:A320

DR
DW

Identity: IB-A320-123456<allow_rule>…
<publish>…
<topics><topic>FlightData</topic></topics><data_tags><tag><name>CarrierName</name><value>IB</value></tag><tag><name>AircraftModel</name><value>A320</value></tag></data_tags></publish></allow_rule>

Identity: ATC-MUC-2442<allow_rule>…
<subscribe>…
<topics><topic>FlightData</topic></topics><data_tags><tag><name>AirportName</name><value>MUC</value></tag></data_tags></subscribe></allow_rule>(anything else, denied)(anything else, denied)DDS Databus

FlightData

Copyright © 2018 RTI. All rights reserved.

Security: Data Tagging
CarrierName:IB
AirportName:MUC
AircraftModel:A320

DRDW

DDS Databus

FlightData

DW

Identity: IB-A320-123456
Identity: ATC-MUC-2442<allow_rule><allow_rule>…
…
<publish><subscribe>…
…
<topics><topics><topic>FlightData</topic><topic>FlightData</topic></topics></topics><data_tags><data_tags>
<tag>
<tag>
<name>CarrierName</name><name>AirportName</name><value>IB</value><value>MUC</value></tag></tag><tag>
Identity: AF-A320-9696 </data_tags><name>AircraftModel</name><allow_rule></subscribe><value>A320</value>…
</allow_rule></tag><publish></data_tags>…
(anything else, denied)</publish><topics></allow_rule><topic>FlightData</topic></topics>(anything else, denied) <data_tags><tag><name>CarrierName</name><value>AF</value></tag><tag><name>AircraftModel</name><value>A320</value></tag></data_tags></publish>
CarrierName:IB</allow_rule>

AircraftModel:A320(anything else, denied)

Copyright © 2018 RTI. All rights reserved.

DDS Security Performance

DDS : How the data is cryptographically protected

DDS

Application

Application
Data Protection
Protocol(RTPS/submessage)
Protection

TCP/UDP/IP
Copyright © 2018 RTI. All rights reserved.

RTPS & Payload Protection Kinds
RTPS content + relevant header info
RTPS
Protection
Kinds

RTPS Hdr

RTPS Hdr

Data
Protection
Kinds

SubmsgSRTPS
PrefixSubmsgSubmsgSRTPS
Postfix

SRTPS Body

RTPS Hdr

Submsg

RTPS Hdr

SubmsgSHdr

Metadata

Serialized Payload

RTPS Hdr

SubmsgSHdr

Metadata

CHdr

Data Submsg

Enc. Payload

CFoot
Copyright © 2018 RTI. All rights reserved.

Origin Authentication Protection Kinds• Enforce Permission to Read vs Write• Prevent Insider Attacks
RTPS Hdr

SRTPS
PrefixSRTPS Body

Sender Common MAC

Receiver A MAC

SRTPS Postfix

Receiver B MAC

Receiver C MAC

Copyright © 2018 RTI. All rights reserved.

Transport Security (e.g. TLS) vs DDS Security
DR
DW

DDS +
RTPS

DTLS

UDP

DR

DTLS /
Unicast

DR
DR
DW

DDS
Security

UDP

DR
DR

DDS
Security /UnicastDR
DW

DDS
Security

UDP

DR

DDS
Security /MulticastDR
Copyright © 2018 RTI. All rights reserved.

Performance Impact of enabling Security in DDS
DDS Relative Performance only (without RCL/RWM layers)
Using rtiperftest: https://github.com/rticommunity/rtiperftest
Testing platform:• CPU: Intel i7 6-core CPU
3.33GHz, 12 GB RAM• NIC: Intel I350, 1 Gb/s
• CentOS Linux 7.1• C++ API

1 to 1 latency (50 percentile) in milli seconds
Data
Size

No
Security

Sign
Message

Sign Message+ Encrypt Data

Sign Message+ Encrypt Data
+ Origin Auth

32 B

0.037

0.046

0.050

0.052

256 B

0.041

0.051

0.055

0.057

2 KB

0.068

0.079

0.086

0.088

16 KB

0.195

0.221

0.250

0.253

128 KB

1.12

1.27

1.51

1.52

1 MB

8.76

8.82

10.92

10.94

Overhead

1% - 24%

25% - 35%

25% - 41%
Copyright © 2018 RTI. All rights reserved.

Performance Impact of enabling Security in DDS
DDS Performance only (without RCL/RWM layers)

Using rtiperftest: https://github.com/rticommunity/rtiperftest

1 to 1 throughput (Mbps)
Testing platform:• CPU: Intel i7 6-core CPU
3.33GHz, 12 GB RAM• NIC: Intel I350, 1 Gb/s
• CentOS Linux 7.1• C++ API

Data
Size

No
Security

Sign
Message

Sign Message+ Encrypt Data

Sign Message+ Encrypt Data
+ Origin Auth

32 B

22

18

16

15.5

256 B

177

132

122

120

2 KB

939

895

803

779

16 KB

988

984

981

980

128 KB

991

990

953

957

1 MB

980

985

887

888

Overhead

0% - 25%

1% - 31%

1% - 32 %Copyright © 2018 RTI. All rights reserved.

Impact of Security on Scalability
1:N Latency (micro seconds)
For 32 Bytes, Multicast

1:N Latency (micro seconds)
For 2 KB, Multicast

1:N Latency (micro seconds)
For 128 KB, Multicast

Num
No Security Sign Message Sign Message Sign Message
Subscribers+ Encrypt Data + Encrypt Data
+ Origin Auth

1
2
4

38
35
37

47
44
48

51
48
51

54
50
55

Num
No Security Sign Message Sign Message Sign Message
Subscribers+ Encrypt Data + Encrypt Data
+ Origin Auth

1
2
4

69
67
69

80
79
80

87
86
87

89
88
90

Num
No Security Sign Message Sign Message Sign Message
Subscribers+ Encrypt Data + Encrypt Data
+ Origin Auth

1
2
4

1209
1205
1203

1279
1286
1282

1522
1526
1530

1525
1525
1534
Copyright © 2018 RTI. All rights reserved.

Impact of Security on Scalability
1:N Throughput (Mbps)
For 32 Bytes, Multicast

1:N Throughput (Mbps)
For 2 KB, Multicast

1:N Throughput (Mbps)
For 128 KB, Multicast

Num
Subscribers

No
Security

1
2
4
Num
Subscribers

22.5
20.1
18.4
No
Security

1
2
4
Num
Subscribers

17.2
15.8
11.9

15.5
14.5
11.9

14.8
13.3
9.6

Sign Message Sign Message Sign Message+ Encrypt Data + Encrypt Data
+ Origin Auth

939.0
938.9
938.9
No
Security1
24

Sign Message Sign Message Sign Message+ Encrypt Data + Encrypt Data
+ Origin Auth

893.4
877.7
742.6

796.3
747.3
655.1

761.7
660.0
531.1

Sign Message Sign Message Sign Message+ Encrypt Data + Encrypt Data
+ Origin Auth

991.5
991.5
991.5

990.4
990.4
990.3

954.7
970.7
984.3

955.8
964.6
982.0
Copyright © 2018 RTI. All rights reserved.

ROS2 on DDS

ROS2 on DDSROS Concept
Node

DDS Concept
Participant

Node Namespace
Topic
Publisher
Subscriber
Service
Qos Profile
ActionParameter<none>
Topic
Publisher + DataWriter
Subscriber + DataReader
Service(*) or Request/Reply Topic pair
Qos Profile
Not implemented yet
ROS-defined DDS Services to read/write/list parameters
Copyright © 2018 RTI. All rights reserved.

ROS2 on DDS mapping
ROS Concept

DDS Concept

TopicName:
rosTopicName

TopicName:
ddsTopicName = “rt/” + rosNamespace + rosTopicName

Qos Policies/Profiles (3):rmw_qos_history_policy_t
rmw_qos_reliability_policy_t
rmw_qos_durability_policy_t;

DDS Qos Policies/Profiles (22):
HISTORYRELIABILITY
DURABILITY (kinds VOLATILE, TRANSIENT_LOCAL)
Remaining 19 DDS Policies (e.g. PARTITION, OWNERSHIP) are not mapped

ServiceName:
rosServiceName

With DDS-RPC -> DDS Service (RequesTopic, ReplyTopic):
ddsServiceName = “rs/” + rosServiceName
With no DDS-RPC support -> user RequesTopic, ReplyTopic) pair:
ddsRequestTopic = “rq/” + rosServiceName
ddsReplyTopic = “rr/” + rosServiceName

Parameter

ROS-defined DDS Services to read/write/list parameters
Copyright © 2018 RTI. All rights reserved.

Using DDS Secure in ROS2

Tools• SROS offers command-line tools that simply configuration anddeployment of DDS Security with ROS2.
• These tools also manage the Topic/Service name mappings to DDS$ ros2 security <command>create_key
create_keystore
create_permission
distribute_key
list_keys

Create key
Create keystore
Create permission
Distribute key
List key$ keymint <command>
keystore

Come to the SROS tutorial @IROS. Monday 14:30-18:00. Room 4.R4
https://ruffsl.github.io/IROS2018_SROS2_Tutorial/
Copyright © 2018 RTI. All rights reserved.

How to use it?
Secure Talker/Listener
Minimal talker profile

nodes:
talker:topics:chatter:allow: p # can publish on chatterclock:
allow: s # can subscribe on clockparameter_events:
allow: psservices:talker/describe_parameters:
allow: x # can execute/host service
talker/get_parameter_types:
allow: xtalker/get_parameters:
allow: xtalker/list_parameters:
allow: xtalker/set_parameters:
allow: xtalker/set_parameters_atomically:
allow: x
Copyright © 2018 RTI. All rights reserved.

.rule.

Secure Talker/Listener
Minimal talker profile.profile.

How to use it?

nodes:
talker:topics:..allowed...
chatter: .permission.
allow: p # can publish on chatterclock:
allow: s # can subscribe on clockparameter_events:
allow: ps.nested.
services:talker/describe_parameters: .import.
allow: x # can execute/host service
talker/get_parameter_types:
allow: xtalker/get_parameters:
allow: xtalker/list_parameters:
allow: xtalker/set_parameters:
allow: xtalker/set_parameters_atomically:
allow: x
Copyright © 2018 RTI. All rights reserved.

How to use it?
Secure Talker/Listener
Minimal talker profile<profile name="My Talker Profile"><attachments><attachment>*/talker</attachment></attachments><xi:include href="common/node.xml"/><ros_topic qualifier="ALLOW"><attachments><attachment>{namespace}/chatter</attachment></attachments><permissions><ros_publish/></permissions></ros_topic></profile>
Copyright © 2018 RTI. All rights reserved.

How to use it?

<attachments><attachment>*/talker</attachment>.nested.
</attachments>.import.
<xi:include href="common/node.xml"/><ros_topic qualifier="ALLOW"><attachments><attachment>{namespace}/chatter</attachment></attachments><permissions><ros_publish/>..allowed...
</permissions>.permission.
</ros_topic></profile>.rule.

.profile.

Secure Talker/Listener
Minimal talker profile<profile name="My Talker Profile">

Copyright © 2018 RTI. All rights reserved.

DDS Secure features available in SROS
• Node (Participant) Authentication• Access control to Domains• Access Control to Topics (Node & Topic)• Access Control to Services (Node & Service granularity)• Access Control to Parameter (Node granularity)• Encryption of RTPS Messages and application Data

Copyright © 2018 RTI. All rights reserved.

DDS Secure features currently “not exposed” in SROS
• Access Control to Partitions• Securing Data Tags
• Fine-grained control of secure discovery• Fine grain control of Encryption vs Authentication (MAC)• Use of Origin Authentication–Protection against privilege escalation (Read -> Write)

Copyright © 2018 RTI. All rights reserved.

DDS Security provides excellent support to secure ROS• Standard & Interoperable• Performant and Scalable–Best-of-class cryptography (Elliptic Curve, Diffie Hellman, AES)–Single payload encryption multiple destinations, multicast support• Fine-grained:–Access Control at the Node/Topic/Service level• Flexible:–Choice of Encryption vs Authentication vs Origin Authentication–Build your own plugins• Infrastructure-independent:–Works over any Transport with any Qos–Does not depend on IPSEC, Trusted Routers, Pre-Shared Keys,…

• Transparent: No changes to Application Code!
• Tools being developed to facilitate config and deployment
Copyright © 2018 RTI. All rights reserved.

References• http://portals.omg.org/dds• https://www.omg.org/spec/category/data-distribution-service• https://www.omg.org/spec/DDS-SECURITY• http://community.rti.com• http://www.rti.com• https://github.com/rticommunity• https://www.slideshare.net/GerardoPardo/presentations• https://ruffsl.github.io/IROS2018_SROS2_Tutorial
Copyright © 2018 RTI. All rights reserved.

Thank you!
Questions?