Kerberos-Based Secure Discovery Protocol for Software-Defined Robots Using ROS 2

The Robot Operating System 2 (ROS 2) utilises the Data Distribution Service (DDS) middleware for publish/subscribe communications between nodes. The interoperable DDS Simple Discovery Protocol and standardised built-in security plugins are used to enable secure, peer-to-peer discovery using public key infrastructure. The peer-to-peer nature of this protocol has many benefits. However, there can be a delay every time an application joins the network because it needs to perform computationally expensive asymmetric-key operations multiple times to authenticate each remote participant before exchanging information. The increasing adaptation of software-defined robotics means that it is not necessarily the case that software modules can trust one another simply because they are running on the same hardware, increasing the number of nodes which must be authenticated and exacerbating the problems of long discovery times. We propose novel DDS Authentication and AccessControl security plugins based on the Kerberos protocol and a key distribution center. A discovery protocol is presented which enables applications to join the DDS domain using only symmetric cryptography, instead of asymmetric, without affecting the run-time functionality of ROS 2. This is beneficial in use cases where there are many DDS Domain participants in the domain and reliance on a trusted key distribution center is acceptable.