# A Cryptography-Powered Infrastructure to Ensure the Integrity of Robot Workflows
## 1 Introduction
At some time after the V&V step, the application is executed. Preserving the integrity of the verified application is hardly addressed up to now but it must also be ensured that the application as designed by a developer is actually executed by the robot in an unmodified manner i.e., the application integrity is ensured from end of development until end  
Figure 1: The simplified flow of robot application development from user requirements to execution. of execution. As an example, a safety certification of a robot application is also bound to the unvaried program running on the robot. Sealing an application at some point in time is not a function typically provided by a robot. Concerns for the integrity of the application come from accidental or intentional modifications on the shop floor but also from a security-side. As discussed in the next sections, severe security problems exist in modern robots leading to potentials for program manipulation. Also, it should not be possible for anyone close to a robot to modify its programming as it is currently the case with most robotic systems. We consider robot programs that have a central execution entity in this work. As discussed later-on, approaches that require distributed emergent behaviour such as ROS are more difficult--but not impossible--to secure. In general industrial use, the central execution entity approach is more common. Our approach considers externally controlled robots but--as sketched later--can easily be simplified for robots where programs are stored on the controller. We will further view robot applications as workflows that consist of individual actions (workflow steps) that instruct the robot to perform a certain task. The totality of a workflow then achieves a desired goal of the robot application. As an example, a pick-and-place application can be modeled as a workflow consisting of one or more move steps, a grip action, further movements and a release action. This generalization allows abstracting robot programming from vendor-specific approaches. Workflows are a more general way of looking at robot programs making it possible to transfer our approach to various robot environments. Note, that also the programming of autonomous robots and flexible systems can be abstracted this way since intelligent building blocks of a workflow (such as SLAM navigation or object detection) can be encapsulated in workflows or workflow steps. Based on this workflow abstraction, we want to look at integrity preservation of verified workflows. In this work, we present an approach to ensuring the integrity of robot workflows using cryptographic means. The concept is presented separately from its implementation because it is generally applicable to robot applications. We use a cryptographic infrastructure where an authorized entity signs a given certified workflow and its parameters. The robot will verify the cryptographic signature before executing the program. We demonstrate the efficacy of our approach in a real application using a mobile manipulator where we implemented a verification component on top of our workflow engine. The results show that the added integrity checks do not cause significant overheads which would prevent a robot in fulfilling its task. In the remainder of this publication we present relevant related work in Section 2, elaborate the requirements for workflow verification and introduce our concept for verifiable workflows in Section 3, present an evaluation in Section 4 and discuss the bigger picture of accountable robot application development in Section 5.