  Robot apps are becoming more automated, complex and diverse. An app usually
consists of many functions, interacting with each other and the environment.
This allows robots to conduct various tasks. However, it also opens a new door
for cyber attacks: adversaries can leverage these interactions to threaten the
safety of robot operations. Unfortunately, this issue is rarely explored in
past works.
  We present the first systematic investigation about the function interactions
in common robot apps. First, we disclose the potential risks and damages caused
by malicious interactions. We introduce a comprehensive graph to model the
function interactions in robot apps by analyzing 3,100 packages from the Robot
Operating System (ROS) platform. From this graph, we identify and categorize
three types of interaction risks. Second, we propose RTron, a novel system to
detect and mitigate these risks and protect the operations of robot apps. We
introduce security policies for each type of risks, and design coordination
nodes to enforce the policies and regulate the interactions. We conduct
extensive experiments on 110 robot apps from the ROS platform and two complex
apps (Baidu Apollo and Autoware) widely adopted in industry. Evaluation results
indicated RTron can correctly identify and mitigate all potential risks with
negligible performance cost. To validate the practicality of the risks and
solutions, we implement and evaluate RTron on a physical UGV (Turtlebot) with
real-word apps and environments.
