SLIDE 1
SROS2
- What is ROS 2
- Interfacing DDS-Security to the ROS 2 stack
- Use the sros2 command line interface
- Run some basic examples
SROS 2 Mikael Arguedas IROS 2018, Madrid SROS2 What is ROS 2 - - PowerPoint PPT Presentation
SROS 2 Mikael Arguedas IROS 2018, Madrid SROS2 What is ROS 2 - - PowerPoint PPT Presentation
SROS 2 Mikael Arguedas IROS 2018, Madrid SROS2 What is ROS 2 Interfacing DDS-Security to the ROS 2 stack Use the sros2 command line interface Run some basic examples ROS as we know it 3 Characteristics of systems
SLIDE 2
SLIDE 3
ROS as we know it
3
SLIDE 4
- Research applications
- High-volume sensors
- Complex kinematics
- Lots of computation power
- Ideal network connectivity
Characteristics of systems initially targeted by ROS in 2007
4
SLIDE 5
- Multi-robot system
- Distributed system
- Small processors
- Battery power
- Unreliable network
connectivity
Characteristics of small robotic systems today
5
SLIDE 6
Goals of ROS 2
6 http://design.ros2.org/articles/why_ros2.html
SLIDE 7
ROS 2
7
SLIDE 8
ROS 2
+ ROS usability less time spent here means more time to spend here
8
SLIDE 9
ROS 2 Releases
December 2017 June 2018
9
SLIDE 10
Architectural overview
User code ROS client library API
10
SLIDE 11
Architectural overview
User code ROS client library API DDS implementation = discovery + serialization + transport
11
SLIDE 12
Architectural overview
User code ROS client library API DDS impl A DDS impl B . . .
- r
- r
12
SLIDE 13
Architectural overview
User code ROS client library API DDS impl A DDS impl B . . .
- r
- r
DDS agnostic ROS agnostic ROS middleware API
13
SLIDE 14
Architectural overview
User code ROS client library API DDS agnostic ROS agnostic ROS middleware API . . .
- r
- r
DDS impl A DDS impl B
14
SLIDE 15
Architectural overview
User code ROS client library API . . .
- r
- r
ROS middleware API DDS impl A DDS impl B RMW impl B RMW impl A . . . DDS agnostic ROS agnostic
15
SLIDE 16
16
“Hour Glass” Pattern
{client libraries} rmw {DDS vendor}
API size LOC
{rmw impl} rcl impl rcl
SLIDE 17
17
“Hour Glass” Pattern
rmw {DDS vendor} {rmw impl} rcl impl rcl rclpy rclcpp rclcs rcljava
SLIDE 18
18
“Hour Glass” Pattern
rmw rcl impl rcl rclpy rclcpp rclcs rcljava eProsima Fast-RTPS RTI Connext rmw_fastrtps_cpp rmw_connext_cpp
SLIDE 19
19
rmw rcl impl rcl rclpy rclcpp eProsima Fast-RTPS RTI Connext rmw_fastrtps_cpp rmw_connext_cpp Plugin instantiation User code should not change DDS-Security implementation
Where does SROS 2 live?
SLIDE 20
20
rcl impl rcl rclpy rclcpp Environment variables checking
ROS_SECURITY_ENABLE Should we look for security artifacts ? ROS_SECURITY_STRATEGY ROS_SECURITY_ROOT_DIRECTORY Should we prevent unauthenticated nodes from being created ? Where to look for artifacts
Where does SROS 2 live?
SLIDE 21
21
rcl impl rcl rclpy rclcpp Environment variables checking
ROS_SECURITY_ENABLE true/false ROS_SECURITY_STRATEGY ROS_SECURITY_ROOT_DIRECTORY Permissive/Enforce <path/to/keystore>
Where does SROS 2 live?
SLIDE 22
22
rcl impl rcl rclpy rclcpp Environment variables checking + Keystore node structure checking Extract node security directory path
Where does SROS 2 live?
SLIDE 23
23
Where does SROS 2 live?
rmw rcl impl rcl rclpy rclcpp eProsima Fast-RTPS RTI Connext rmw_fastrtps_cpp rmw_connext_cpp Retrieve security artifacts + Instantiate plugins accordingly
SLIDE 24
24
Where does SROS 2 live?
rmw rmw_fastrtps_cpp rmw_connext_cpp Retrieve security artifacts
SLIDE 25
25
Where does SROS 2 live?
rmw rmw_fastrtps_cpp rmw_connext_cpp Instantiate security plugins
SLIDE 26
26
How to generate SROS 2 artifacts?
- Setting up your environment:
○ $ source /opt/ros/bouncy/setup.bash
- Create a keystore:
○ $ ros2 security create_keystore my_keystore
SLIDE 27
27
How to generate SROS 2 artifacts?
- Create key and wildcard permissions for a node:
○ $ ros2 security create_key my_keystore my_node
SLIDE 28
28
How to generate SROS 2 artifacts?
- Create policies files for a node:
SLIDE 29
29
How to generate SROS 2 artifacts?
- Create permission files for a nodes:
○ $ ros2 security create_permissions \ my_keystore my_node ./my_node_policies.yaml
SLIDE 30
30
Let’s try it!
$ docker run -it --rm osrf/ros2:bouncy-desktop # source /opt/ros/bouncy/setup.bash # mkdir ~/my_ros2_ws && cd ~/my_ros2_ws # ros2 security create_keystore demo_keys # ros2 security create_key demo_keys talker # ros2 security create_key demo_keys listener Now let’s run our secure nodes: # export ROS_SECURITY_ROOT_DIRECTORY=~/my_ros2_ws/demo_keys # export ROS_SECURITY_ENABLE=true # export ROS_SECURITY_STRATEGY=Enforce # ros2 run demo_nodes_cpp talker & # ros2 run demo_nodes_py listener
SLIDE 31
31
Let’s try it!
Access Control: Create ~/my_ros2_ws/pub_sub_policies.yaml with:
nodes: listener: topics: chatter: allow: s # can subscribe to chatter talker: topics: chatter: allow: p # can publish on chatter
SLIDE 32
32
Let’s try it!
Create the permissions: # ros2 security create_permission demo_keys talker pub_sub_policies.yaml # ros2 security create_permission demo_keys listener pub_sub_policies.yaml # ros2 run demo_nodes_cpp talker & # ros2 run demo_nodes_py listener
SLIDE 33
33
Let’s try it!
Let’s remap the topic on which talker publishes: # ros2 run demo_nodes_cpp talker chatter:=my_chatter
SLIDE 34
34
Seeing in wireshark (clear text)
SLIDE 35
35