# A Cryptography-Powered Infrastructure to Ensure the Integrity of Robot Workflows
## 1 Introduction  
Robots have found more and broader fields of applications in recent years. As this trend is expected to increase in the coming years, more and more requirements for the widespread use of robots have emerged as well. While future robots will gain in autonomy, for the foreseeable future, robots will still be pre-programmed to fulfill a limited albeit arbitrarily complex set of tasks. No matter where a robot is used or how it was programmed, it is important that it actually executes the program that its developer has implemented. This is a key issue, especially since robots have strong safety implications in most of their fields of applications. However, also in general, we expect our technical systems to behave the way they were intended to and not be intentionally or unintentionally modified by unauthorized entities [1]. This expectation raises the requirement of program integrity which must be ensured from the finalization of a robot program until the end of its execution on the machine itself. Furthermore, legal or safety requirements must be considered. While there are established mechanisms to perform verification and validation of applications, there are currently hardly any mechanisms to protect an accepted application before its execution. This integrity however is key to make sure that the robot behaves in a way compliant to the specified requirements. Also the most relevant securitystandard in this area, IEC62443 defines in its part 4-2 the component requirement CR 3.4 that requires a component to provide methods to ensure software and information integrity [2]. We assume a (simplified) process of how a robot application is developed as shown in Figure 1 (leaving out elements that are out of scope here such as iterations in the development or adaptations after deployment). The general requirements of the application are dictated by the end-user and are enhanced with regulatory requirements, standards and other inputs such as societal requirements or ethical considerations. From those requirements, a robot application is developed which is then verified and validated (V&V) by the end-user as well as potential regulatory bodies (e.g., in safety certification). In general, such a process should be accompanied by measures to track each step of the process to ensure compliance, traceability, and accountability. While today this is typically covered by conventional means such as measures from the ISO-9000 family, we will also present an outlook of how this can be integrated into the development process itself in Section 5. As part of this larger endeavour, we focus this work on preserving the integrity of the robot program after it has been developed and accepted. The basic idea is to seal the program after it has been accepted and prevent further intentional or unintentional modifications. This step is primarily assumed to happen offline i.e., temporally decoupled from the execution. As described below, there may be an arbitrarily long time gap between the acceptance and the execution. Thus, our approach ensures the integrity during this time gap. An authorized entity such as the program developer or manager shall be responsible to trigger the integrity preservation mechanism as described in the following sections but in general, this can be determined according to regulations or processes. However, in case automated program generation methods such as planners are used, also on-the-fly use of our approach is possible. There are various ways of programming robots ranging from text-based to visual programming methods [3]. However, from an abstract point of view, we typically look at a pre-defined program in a certain form that has a central point of execution (we will discuss systems where this is different such as ROS later in this manuscript). Independent of the method of programming the robot, at some point the application is deemed finished and verification and validation checks for the compliance to regulations and requirements are done at this point.