Detection method and detection system for ROS2 communication security vulnerabilities and application of detection method and detection system

Abstract

The invention discloses a detection method for ROS2 communication security vulnerabilities. The method comprises the following steps of: obtaining all UDP (User Datagram Protocol) ports needing to be scanned according to a DDS Discovery protocol, then scanning the UDP ports in a target local area network, and obtaining a communication domain ID (Identity) where an ROS2 application program is located; performing ROS2 basic information scanning on the communication domain according to the obtained communication domain ID to obtain basic information of ROS2 application program communication; step 2, according to the basic information obtained in the step 2, performing vulnerability detection on all scanned topics, services and actions, analyzing the security of the topics, services and actions, and generating a detection report; and combining the obtained safety detection reports of the topics and / or the services and / or the actions to generate a complete safety report of the ROS2. The invention also discloses a detection system for realizing the detection method, and application of the detection method or the detection system in the aspect of ROS2 communication security vulnerability detection.

Description

Technical Field

[0001] The present invention belongs to the technical field of Robot Operating System (ROS), and in particular relates to a detection method and a detection system for ROS2 communication security vulnerabilities and applications thereof. Background Art

[0002] In the context of the Industry 4.0 era, which is known as the "fourth industrial revolution", more and more industrial fields have greater demands for automation, which has increased people's development and use of robots. All robots need to be controlled by software, and the most widely used one is the Robot Operating System (ROS). As one of the most mainstream robot application development frameworks, ROS is widely used in various fields, and its communication security has gradually received widespread attention from industry and academia.

[0003] The first generation of robot operating system ROS1 did not fully consider its security when it was first designed. It adopted a centralized idea to design the master node as the management node of the entire network. This means that once the master node is attacked, other nodes in ROS1 may be threatened. Therefore, as a new generation of robot operating system, ROS2 not only abandons the centralized idea of ​​ROS1, adopts the DDS protocol (Data Distribution Service Protocol) as the basic framework of its distributed communication, but also uses the DDS security extension module to further enhance the security of its communication. However, although ROS2 has significantly improved its security compared to ROS1, it does not mean that ROS2 is absolutely safe. On the one hand, some security vulnerabilities in ROS1 may still exist in ROS2. On the other hand, due to the adoption of a new underlying design, ROS2 itself may also have potential new security issues.

[0004] As a new generation of robot operating system, ROS2 is gradually becoming the most important robot communication framework in various fields. The security of ROS2 itself directly affects the security of all ROS2-based applications. Therefore, the detection and protection of ROS2 communication security is particularly important.

[0005] The existing technologies for vulnerability detection of ROS1 and ROS2 mainly include static code analysis, dynamic testing, security auditing and network scanning. Among them, static code analysis and dynamic testing focus on the detection of functional safety of the system, and it is difficult to effectively detect vulnerabilities in communication security. Security auditing requires review of the system source code, requiring testers to have an in-depth understanding of the internal implementation of ROS1 or ROS2. In contrast, specialized scanning tools designed and developed using network scanning technology are more feasible and effective for scanning communication security vulnerabilities in ROS1 or ROS2. However, existing related tools such as ROSPeNTo and ROSploit currently only support ROS1, not ROS2. Summary of the invention

[0006] In order to solve the deficiencies in the prior art, the present invention proposes a detection method, a detection system and its application for ROS2 communication security vulnerabilities, which can realize network scanning and simulated attacks on the ROS2 system, thereby achieving the goal of detecting its vulnerabilities.

[0007] The present invention detects communication security vulnerabilities in the three major communication mechanisms of ROS2 and its applications, namely, topics, services and actions, proposes several possible vulnerabilities of ROS2, and proposes a set of detailed vulnerability detection methods and processes to detect potential communication security vulnerabilities of ROS2.

[0008] Before performing vulnerability detection on the ROS2 system, the present invention realizes scanning of the ROS2 system running in the local area network. Since ROS2 uses DDS as middleware, its communication architecture is different from the centralized architecture of ROS1, and there is no master node as the management node of the entire system. Therefore, the existing scanning method for ROS1 based on the master node port is not suitable for ROS2. In order to solve this problem, the present invention obtains the corresponding relationship between the ROS2 communication domain ID (ROS_DOMAIN_ID) and the UDP broadcast port in the communication domain according to the DDS Discovery protocol (the specific relationship is shown in Formula 1), and discovers the communication domain of ROS2 by scanning the UDP port. Such a design ensures that each different ROS domain has a unique UDP port, thereby realizing data communication and discovery between different domains.

[0009] According to the DDS Discovery protocol, the relationship between ROS_DOMAIN_ID and its corresponding broadcast UDP port is as shown in the following formula 1:

[0010] UDP port DiscoveryMulticastPort = PB + DG * ROS_DOMAIN_ID (1)

[0011] Wherein, PB is a constant value of 7400, indicating the starting port number, that is, the discovery broadcast port of the domain whose DomainID is 0; DG is a constant value of 250, indicating the maximum number of ports that can be included in a domain. The present invention calculates the UDP port to be scanned according to the formula.

[0012] Most of the existing research on network security attacks on ROS is also aimed at ROS1, and various attacks are carried out by controlling the master node of ROS1, so it is also not applicable to ROS2. In order to test whether ROS2 can resist the original attacks in ROS1, the present invention redesigns and implements the attacks originally aimed at ROS1, and expands them to ROS2, such as unauthorized message publishing and unauthorized message subscription, and further strengthens the attacks against SROS2, so that it can simulate attack tests on the ROS2 system under the protection of SROS2.

[0013] SROS2 (Secure Robot Operating System 2) is a security extension of ROS2 (Robot Operating System 2). ROS2 is an open source robot operating system framework designed to support the development and operation of robotic systems. SROS2 provides security enhancements to ROS2, including authentication, data encryption, and access control to protect the security and integrity of ROS2 communications and data.

[0014] The method for detecting ROS2 communication security vulnerabilities of the present invention comprises the following steps:

[0015] Step 1: According to the DDS Discovery protocol, obtain all the UDP ports that need to be scanned, and then perform UDP port scanning in the target LAN to obtain the communication domain ID where the ROS2 application is located;

[0016] A UDP port is a digital identifier that identifies an application or service that sends and receives UDP packets. The UDP protocol uses port numbers to distinguish different applications or services, thereby enabling the transmission and exchange of data packets.

[0017] The DDS Discovery protocol is a distributed protocol used to discover and connect nodes in a DDS network. The protocol allows nodes to discover each other and establish connections by exchanging information. It achieves discovery and connection between nodes through broadcast, multicast, and unicast. ROS2 uses this protocol to connect between nodes. When a ROS2 node starts, it uses the DDS Discovery protocol to discover and connect to other nodes, and uses ROS_DOMAIN_ID to identify the domain to which it belongs. The relationship between ROS_DOMAIN_ID and its corresponding broadcast UDP port is shown in Formula 1.

[0018] Step 2: According to the communication domain ID obtained in step 1, perform ROS2 basic information scanning on the communication domain to obtain basic information of ROS2 application communication; the basic information includes: node basic information, topic basic information, service basic information and action basic information;

[0019] Step 3: Based on the basic information of the topic obtained in step 2, perform vulnerability detection on all scanned topics, test their security, and generate a detection report;

[0020] and / or,

[0021] Based on the basic service information obtained in step 2, perform vulnerability detection on all scanned services, test their security, and generate a detection report;

[0022] and / or

[0023] Based on the basic action information obtained in step 2, perform vulnerability detection on all scanned actions, test their security, and generate a detection report;

[0024] Step 4: Merge the security detection reports of topics and / or services and / or actions obtained in step 3 to generate a complete ROS2 security report.

[0025] In the detection method for ROS2 communication security vulnerabilities proposed by the present invention, the step 1 further includes the following steps:

[0026] Step A1: The correspondence between the ROS2 communication domain specified in the DDS Discovery protocol and its UDP broadcast port is shown in Formula 1. According to Formula 1, input ROS_DOMAIN_ID (ranging from 0 to 232), and output the UDP port list to be scanned.

[0027] Step A2: Use the network port scanning tool Nmap to scan the ports in the UDP port list calculated in step A1 in the target LAN in sequence, and return the communication domain ID corresponding to the open port; the open port corresponds to the communication domain where the ROS2 application is located.

[0028] In the ROS2 communication security vulnerability detection method proposed by the present invention, the step 2 further includes the following steps:

[0029] Step B1: According to the communication domain ID returned in step 1, use the ROS2 API to scan the node information in the communication domain corresponding to the returned communication domain ID. If no node is scanned, it means that the port is not the port corresponding to the ROS2 communication domain. Otherwise, proceed to the next step.

[0030] The scanning of ROS2 nodes is divided into default mode and enhanced mode according to whether the security enhancement module of ROS2 is turned on. When the security enhancement module is not turned on, the default mode is used, and when the security enhancement mode is turned on, the enhanced mode is used to ensure that all ROS2 nodes can be scanned.

[0031] Step B2: Use the ROS2 API to scan the basic information of the ROS2 nodes scanned in step B1, such as nodes, topics, services, and actions, and return the scan results.

[0032] In ROS2, a node is an executable file that can communicate with other nodes (data exchange) using the ROS2 communication network. Each node in ROS is generally responsible for a single, modular purpose. Each node can send and receive data to other nodes through topics, services, actions, or parameters. A complete ROS2 consists of many nodes working together;

[0033] Topics are an important element in ROS2 communication, acting as a bus for nodes to exchange information. Nodes can use topics to achieve one-to-many, many-to-one, and many-to-many communication modes.

[0034] In the ROS2 communication network, service is another way for nodes to communicate. Service communication is based on the C / S model and is only provided when the client calls it.

[0035] Action is a type of communication in ROS2, used for long-running tasks, mainly composed of three parts: goal, feedback, and result. Action communication is built on topics and services, and the client can cancel the action at any time. Actions also provide stable feedback instead of returning a single response service.

[0036] Among them, the basic information of the node includes: node name, node type, whether the node is an authorized node; the basic information of the topic includes: topic name, topic type, whether the topic is protected by SROS2; the basic information of the service includes: service name, service type, whether the service is protected by SROS2; the basic information of the action includes: action name, action type, whether the action is protected by SROS2.

[0037] SROS2 is a security extension in ROS2 that provides ROS2 applications with security features such as encryption, authentication, and access control to protect ROS2 applications from attacks. SROS2 is an important component of ROS2 and can help developers build more secure ROS2 applications.

[0038] In the ROS2 communication security vulnerability detection method proposed by the present invention, vulnerability detection and analysis is performed on the scanned topic in step 3, further comprising the following steps:

[0039] Step C1: Find the target topic in the topic basic information list returned in step 2, and use the corresponding ROS2 API to further obtain the topic's message interface type according to the name and type of the target topic; among them, the topic's message interface type is mainly divided into basic data types, string types, array types, custom message types, time types, and Header types. In addition, developers can flexibly define the topic's message interface type as needed.

[0040] Step C2: Create an intruder node in the communication domain where the target topic is located, and decide whether to authorize the intruder node based on whether the target topic is protected by SROS2 security; if the target topic is protected by SROS2 security, authorize the intruder node; if the target topic is not protected by SROS2 security, do not authorize the intruder node;

[0041] Step C3: According to the message interface type obtained in step C1, create a subscriber and publisher of the target topic in the intruder node created in step C2, perform "unauthorized message subscription" and "unauthorized message publishing" vulnerability detection on the target topic, and generate a detection report.

[0042] In the detection method for ROS2 communication security vulnerabilities proposed by the present invention, vulnerability detection and analysis is performed on the scanned services in step three, further comprising the following steps:

[0043] Step D1: Find the target service in the service basic information list returned in step 2, and use the corresponding ROS2 API to further obtain the service interface type according to the name and type of the target service; among them, the service interface type includes common types such as Empty.srv, SetBool.srv, AddTwoInts.srv and GetString.srv. Developers can also define the interface type as needed.

[0044] Step D2: Create an intruder node in the communication domain where the target service is located, and decide whether to perform identity authorization for the intruder node based on whether the target service is protected by SROS2 security; if the target service is protected by SROS2 security, the intruder node is authorized; if the target service is not protected by SROS2 security, the intruder node is not authorized;

[0045] Step D3: Based on the service interface type obtained in step D1, a client of the target service is created in the intruder node created in step D2, an "unauthorized service call" vulnerability detection is performed on the target topic, and a detection report is generated.

[0046] In the ROS2 communication security vulnerability detection method proposed by the present invention, vulnerability detection and analysis is performed on the scanned action in step 3, further comprising the following steps:

[0047] Step E1: Find the target action in the action basic information list returned in step 2, and use the corresponding ROS2 API to further obtain the action interface type according to the name and type of the target action; among them, in addition to the commonly used types such as Fibonacci.action, FollowJointTrajectory.action and NavigateToPose.action, the developer can also define the interface type as needed.

[0048] Step E2: Create an intruder node in the communication domain where the target action is located, and decide whether to perform identity authorization for the intruder node according to whether the target action is protected by SROS2 security; if the target action is protected by SROS2 security, the intruder node is authorized; if the target action is not protected by SROS2 security, the intruder node is not authorized;

[0049] Step E3: According to the action interface type obtained in step E1, a client of the target action is created in the intruder node created in step E2, an "unauthorized action call" vulnerability detection is performed on the target topic, and a detection report is generated.

[0050] The present invention also provides a detection system for implementing the above communication security vulnerability detection method, the system comprising: a communication domain scanning module and a vulnerability detection module.

[0051] The communication domain scanning module is used to scan the ROS2 system running in the local area network and pass the communication domain ID to the vulnerability detection module. This module can be further divided into a port scanning module and a ROS2 node scanning module.

[0052] The port scanning module is used to implement UDP port scanning in the local area network. First, the communication domain ID range of ROS2 is 0 to 232. By inputting it into formula 1, all the UDP ports required to be scanned can be obtained to form a pre-scan port list; then, the ports in the pre-scan port list are scanned in the host of the local area network one by one, and all the ports in the open state are returned.

[0053] The ROS2 node scanning module is used to further filter the ports scanned by the port scanning module to determine whether the port is a broadcast port of the ROS2 communication domain. First, according to Formula 1, the ROS_DOMAIN_ID corresponding to the scanned UDP port can be calculated; then, an intruder node is added to the communication domain corresponding to the ROS_DOMAIN_ID, and other ROS2 nodes in the communication domain are scanned through the intruder node. If a ROS2 node exists, the communication domain ID is returned, otherwise the ROS2 node scan continues for the next port.

[0054] The vulnerability detection module is used to simulate an intruder and conduct a network attack on the ROS2 application discovered by the port scanning module to achieve the purpose of testing its security. This module can be further divided into a topic vulnerability detection module, a service vulnerability detection module, and an action vulnerability detection module.

[0055] The topic vulnerability detection module is used to detect vulnerabilities in topic communication in the ROS2 system. It mainly detects vulnerabilities in the target system through unauthorized subscription and unauthorized publishing. If the attack is successful, it means that there are corresponding vulnerabilities in the target system and a corresponding security report is generated. The specific process of this module is as follows Figure 3 As shown, first, the target communication domain is obtained through the communication domain scanning module; then, a daemon node is created in the target communication domain to obtain the basic data of the target topic, such as the topic name and topic type; finally, subscribers and publishers are created respectively according to the obtained basic data to subscribe to and publish the target topic without authorization.

[0056] The service vulnerability detection module is used to detect vulnerabilities in the service communication of the ROS2 system. It mainly detects vulnerabilities in the target system through unauthorized service call attacks. If the attack is successful, it means that there are corresponding vulnerabilities in the target system and a corresponding security report is generated. The specific process of this module is as follows Figure 4 As shown, first, the target communication domain is obtained through the communication domain scanning module; then, a daemon node is created in the target communication domain to obtain the basic data of the target service, such as the service name and service type; finally, a service client is created based on the obtained basic data, and a service request is sent to make an unauthorized call to the target.

[0057] The action vulnerability detection module is used to detect vulnerabilities in the action communication of the ROS2 system. It mainly detects vulnerabilities in the target system through unauthorized action call attacks. If the attack is successful, it means that there are corresponding vulnerabilities in the target system and a corresponding security report is generated. The specific process of this module is as follows Figure 5 As shown, first, the target communication domain is obtained through the communication domain scanning module; then, a daemon node is created in the target communication domain to obtain the basic data of the target action, such as the action name and action type; finally, an action client is created based on the basic data obtained, and an action request is sent to make an unauthorized call to the target action.

[0058] Finally, the security reports obtained by these three detection modules are merged to generate a complete ROS2 security detection report.

[0059] The present invention also provides the above-mentioned security vulnerability detection method, or the application of the above-mentioned security vulnerability detection system in ROS2 communication security vulnerability detection.

[0060] The beneficial effects of the present invention include: in the ROS2 communication security vulnerability detection method proposed by the present invention, the ROS2 application is detected and analyzed according to the principle of penetration detection, and the vulnerability detection is performed on it by constructing a simulated attack. If the attack is successful, it means that there is a corresponding vulnerability in the program, and a detailed detection report is generated; otherwise, it means that there is no corresponding vulnerability in the program. The present invention aims to detect potential communication security issues in ROS2 applications to help improve the security of ROS2 applications.

[0061] Compared with the prior art, the present invention expands the ROS2 communication security vulnerabilities. In existing research, the security analysis of ROS2 mostly focuses on its security module SROS2, while the research on the communication mechanism of ROS2 itself is relatively scarce, and the small amount of related research does not fully cover the three communication mechanisms of ROS2 topics, services and actions. On the basis of existing research and analysis, the present invention expands the communication security vulnerabilities in ROS1, realizes the vulnerability detection of all communication mechanisms of ROS2, and aims to completely analyze the communication security of the ROS2 system. At the same time, for the security module SROS2 of ROS2, the present invention strengthens the vulnerability attack realized, that is, the identity authorization of the intruder node mentioned in the above step description, so that it can effectively attack the ROS2 system under the protection of SROS2, thereby realizing the vulnerability detection of the ROS2 system with and without the SROS2 module turned on. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without paying any creative work.

[0063] Figure 1 The figure is an overall flow chart of the detection method for ROS2 communication security vulnerabilities of the present invention.

[0064] Figure 2 The present invention is a port scanning flow chart of the detection method for ROS2 communication security vulnerabilities.

[0065] Figure 3 This is a flow chart of a topic vulnerability detection module of a detection system for ROS2 communication security vulnerabilities of the present invention.

[0066] Figure 4 This is a flow chart of the service vulnerability detection module of the detection system for ROS2 communication security vulnerabilities of the present invention.

[0067] Figure 5 The present invention is a flow chart of the action vulnerability detection module of the detection system for ROS2 communication security vulnerabilities.

[0068] Figure 6 It is a schematic diagram of an embodiment of a method for detecting ROS2 communication security vulnerabilities according to the present invention. DETAILED DESCRIPTION

[0069] The invention is further described in detail with reference to the following specific embodiments and drawings. The process, conditions, experimental methods, etc. for implementing the present invention, except for the contents specifically mentioned below, are common knowledge and common common sense in the art and are not particularly limited by the present invention.

[0070] The present invention proposes a detection method, a detection system and an application thereof for communication security vulnerabilities of open source ROS2 (second generation robot operating system). The method first calculates all UDP ports that need to be scanned according to the DDS Discovery protocol, then uses the Nmap network scanning tool to scan the ports in the pre-scan port list in the target local area network, and further screens the scanning results through ROS2 node scanning to determine whether there are ROS2 nodes in the communication domain. Then, the present invention performs ROS2 basic information scanning to obtain the basic structure and composition of ROS2 applications. Finally, according to the ROS2 communication mechanism, topic, service and action vulnerability detection are performed respectively to determine whether there are vulnerability threats in the ROS2 application, and a corresponding detection report is generated. The present invention is applicable to the specific implementation of ROS2 including two nodes that communicate with each other, and detects the security of ROS2 and its application in the three major communication mechanisms of topic, service and action through vulnerability detection.

[0071] The present invention proposes a detection method for ROS2 communication security vulnerabilities. It mainly analyzes the three communication mechanisms of ROS2, proposes potential security vulnerabilities in each communication mechanism, and uses penetration detection to detect and analyze these vulnerabilities. Finally, the detection results are returned and a detection report is generated.

[0072] The present invention expands the analysis of ROS2 communication security vulnerabilities in existing research. In existing research, the security analysis of ROS2 mostly focuses on its security module SROS2, while the research on the communication mechanism of ROS2 itself is relatively scarce. The small amount of related research does not fully cover the three communication mechanisms of ROS2 topics, services and actions. Based on the existing research and analysis, the present invention expands the communication security vulnerabilities in ROS1, realizes the vulnerability detection of all communication mechanisms of ROS2, and aims to completely analyze the communication security of the ROS2 system.

[0073] like Figure 1 As shown, the application of the present invention in the ROS2 Foxy version includes the following steps:

[0074] Step 1: According to the DDS Discovery protocol, obtain all the UDP ports that need to be scanned, and then use the network port scanning tool Nmap to scan the UDP ports in the target LAN. Scan the UDP ports with the status of "open" and return the communication domain ID corresponding to the port, which is the communication domain ID where the ROS2 application is located.

[0075] Step 2: Create an intruder node in the corresponding communication domain according to the communication domain ID obtained in step 1, and scan the basic information of ROS2 through the node to obtain the basic information of ROS2 application, including node, topic, service, and action. If the return value is empty, it is considered that there is no running ROS2 application in the communication domain.

[0076] Among them, the basic information of the node includes: node name, node type, whether the node is an authorized node; the basic information of the topic includes: topic name, topic type, whether the topic is protected by SROS2; the basic information of the service includes: service name, service type, whether the service is protected by SROS2; the basic information of the action includes: action name, action type, whether the action is protected by SROS2.

[0077] The ROS2 basic information scan is divided into two modes according to whether the intruder node is a node that obtains identity authorization: default mode and enhanced mode. The intruder node in the default mode is an ordinary ROS2 node, which can only communicate with ordinary ROS2 nodes and cannot communicate with nodes with identity authorization; while the intruder node in the enhanced mode is a node that obtains identity authorization, which can only communicate with nodes with identity authorization and cannot communicate with ordinary nodes. The identity authorization refers to the identity authorization mechanism of SROS2.

[0078] Step 3: According to the topic name and topic type obtained in step 2, perform vulnerability detection on the target topic, test its security, and generate a detection report. First, create an intruder node of the same type based on whether the subscriber / publisher node of the target topic in step 2 is an identity-authorized node; then, according to the name and type of the target topic in step 2, use the corresponding ROSAPI to obtain the message type of the target topic; finally, according to the obtained target topic message type, establish a subscriber or publisher of the target topic in the created intruder node, and detect the two vulnerabilities of "unauthorized message publishing" and "unauthorized message subscription". Repeat the above operations for all scanned topics, record the vulnerability detection results of each topic, and generate a detection report.

[0079] According to the service information obtained in step 2, perform vulnerability detection on all scanned services, test their security, and generate a detection report. First, create an intruder node of the same type based on whether the target service server node in step 2 is an identity-authorized node; then, according to the name and type of the target service in step 2, use the corresponding ROS API to obtain the service interface type of the target service; finally, according to the obtained target service interface type, establish a client of the target service in the created intruder node and detect the "unauthorized service call" vulnerability. Repeat the above operations for all scanned services, record the vulnerability detection results of each service, and generate a detection report.

[0080] According to the action information obtained in step 2, perform vulnerability detection on all scanned actions, detect their security, and generate a detection report. First, create an intruder node of the same type based on whether the server node of the target action in step 2 is an identity-authorized node; then, according to the name and type of the target action in step 2, use the corresponding ROS API to obtain the action interface type of the target action; finally, according to the obtained target action interface type, establish the client of the target action in the created intruder node and detect the "unauthorized action call" vulnerability. Repeat the above operations for all scanned actions, record the vulnerability detection results of each service, and generate a detection report.

[0081] Step 4: Merge the security detection reports of topics and / or services and / or actions obtained in step 3 to generate a complete ROS2 security report.

[0082] Example

[0083] This embodiment uses Figure 6 Taking the communication network composed of two ROS2 nodes communicating with each other as an example, security vulnerabilities are detected.

[0084] In this embodiment, Figure 6As shown, the communication domain ID of the ROS2 application is 0, and node A and node B perform three types of communication: topic, service and action. In topic communication, node A and node B transmit messages through topic, node A is the publisher node of topic, and node B is the subscriber node; in service communication, node A and node B communicate through service, node A is the client node of service, responsible for issuing service requests and waiting for responses, node B is the server node of service, responsible for receiving and processing service requests; in action communication, node A and node B communicate through action, node A is the client node of action, responsible for issuing action requests and waiting for responses, node B is the server node, responsible for receiving and processing requests.

[0085] In this embodiment, a network port scan is first performed to scan the ROS2 communication domain in the local area network. Figure 2 As shown in the figure, firstly, the UDP port scan is performed on the host in the LAN, and then the scanned ports are filtered through the ROS2 node scan, and the ports containing the ROS2 nodes are returned as the final scan results. After the port scan is completed, according to the principle of penetration testing, the intruder is simulated to attack the vulnerability and the final detection result is returned. The specific steps are as follows:

[0086] Step 1: According to the DDS Discovery protocol, obtain all the UDP ports that need to be scanned, and then use the network port scanning tool Nmap to perform UDP port scanning in the target LAN, scan the UDP port with port number 7400, and return the communication domain ID corresponding to the port (ID=0 in this embodiment), which is the communication domain ID where the ROS2 application is located.

[0087] Step 2: According to the communication domain ID obtained in step 1, create an intruder node in the corresponding communication domain, scan the basic information of ROS2 through the node, obtain the basic information of ROS2 application, and obtain the basic information of node A, node B, topic topic, service service and action action.

[0088] Step 3: According to the name and type of the topic obtained in step 2, the topic is tested for two vulnerabilities, "unauthorized message publishing" and "unauthorized message subscription", and a test report is generated. The results show that the intruder can successfully attack the topic with the above two vulnerabilities, that is, the topic has two vulnerabilities, "unauthorized message publishing" and "unauthorized message subscription", and there is a risk of data theft or false data injection.

[0089] According to the service name and interface type obtained in step 2, all scanned services are tested for "unauthorized service calls" vulnerabilities and a test report is generated. The results show that an intruder can successfully make "unauthorized service calls" to the service, that is, the service has this vulnerability, which may cause the command to be maliciously called or the result data to be stolen.

[0090] According to the action information obtained in step 2, all scanned actions are tested for the "unauthorized action call" vulnerability and a test report is generated. The results show that an intruder can successfully perform "unauthorized action call" on the action, that is, the action has this security vulnerability, which may lead to the risk of malicious command calls or malicious theft of feedback information.

[0091] Step 4: Merge the security detection reports of topics and / or services and / or actions obtained in step 3 to generate a complete ROS2 security report.

[0092] In this embodiment, the ROS2 communication security vulnerability detection method of the present invention is used to successfully detect vulnerabilities in the program in the embodiment, and the security issues therein are discovered, which helps developers or maintenance personnel to enhance protection against specific security vulnerabilities and further improve the security of ROS2 applications, making them more secure and reliable.

[0093] The protection content of the present invention is not limited to the above embodiments. Without departing from the spirit and scope of the inventive concept, changes and advantages that can be thought of by those skilled in the art are included in the present invention and are protected by the attached claims.

Claims

1. A detection method for ROS2 communication security vulnerabilities, characterized in that: The following steps are involved: Step 1: According to the DDSDiscovery protocol, obtain all the UDP ports that need to be scanned, and then perform UDP port scanning in the target LAN to obtain the communication domain ID where the ROS2 application is located; Step 2: According to the communication domain ID obtained in step 1, scan the communication domain for ROS2 basic information to obtain the basic information of ROS2 application communication; The basic information includes: node basic information, topic basic information, service basic information and action basic information; Step 3: Based on the basic information of the topic obtained in step 2, perform vulnerability detection on all scanned topics, analyze their security, and generate a detection report; and / or, Based on the basic service information obtained in step 2, perform vulnerability detection on all scanned services, analyze their security, and generate a detection report; and / or, Based on the basic action information obtained in step 2, perform vulnerability detection on all scanned actions, analyze their security, and generate a detection report; Step 4: Merge the security detection reports of topics and / or services and / or actions obtained in step 3 to generate a complete ROS2 security report.

2. The method for detecting ROS2 communication security vulnerabilities as claimed in claim 1, characterized in that: The ROS2 communication domain scan performed in step 1 includes the following steps: Step A1: According to the correspondence between ROS2 communication domain ID and UDP port specified in the DDSDiscovery protocol, calculate and obtain the UDP port list to be scanned; Step A2: Use a network port scanning tool to scan the ports in the UDP port list calculated in step A1 in the target LAN in sequence, and return the communication domain ID corresponding to the open port; the open port corresponds to the communication domain where the ROS2 application is located.

3. The method for detecting ROS2 communication security vulnerabilities as claimed in claim 2, characterized in that: The relationship between the ROS2 communication domain ROS_DOMAIN_ID and the UDP port DiscoveryMulticastPort specified in DDSDiscovery is as follows: DiscoveryMulticastPort=PB+DG*ROS_DOMAIN_ID, Among them, PB represents the starting port number, that is, the discovery broadcast port of the domain with DomainID 0; DG represents the maximum number of ports that can be contained in a domain, and ROS_DOMAIN_ID represents the ROS2 communication domain ID.

4. The method for detecting ROS2 communication security vulnerabilities as claimed in claim 1, characterized in that: The ROS2 basic information scan performed in step 2 includes the following steps: Step B1: According to the communication domain ID returned in step 1, use ROS2API to scan the node information in the communication domain corresponding to the returned communication domain ID. If no node is scanned, it means that the scanned UDP port is not the port corresponding to the ROS2 communication domain. If the node is scanned, continue with the subsequent steps; Step B2: Use ROS2API to scan the basic information of the ROS2 communication domain including nodes, topics, services and actions, and return the scan results.

5. The method for detecting ROS2 communication security vulnerabilities as claimed in claim 4, characterized in that: The scanning of ROS2 nodes is divided into default mode and enhanced mode according to whether the security enhancement module of ROS2 is turned on. When the security enhancement module is not turned on, the default mode is used, and when the security enhancement mode is turned on, the enhanced mode is used to ensure that all ROS2 nodes can be scanned; The basic information of the node includes: node name, node type, whether the node is an authorized node; the basic information of the topic includes: topic name, topic type, whether the topic is protected by SROS2; the basic information of the service includes: service name, service type, whether the service is protected by SROS2; the basic information of the action includes: action name, action type, whether the action is protected by SROS2.

6. The method for detecting ROS2 communication security vulnerabilities as claimed in claim 1, characterized in that: In step 3, the ROS2 topic vulnerability detection includes the following steps: Step C1: Search for the target topic in the topic basic information list returned in step 2, and use the corresponding ROS2API to further obtain the message interface type of the topic according to the name and type of the target topic; Step C2: Create an intruder node in the communication domain where the target topic is located, and decide whether to authorize the intruder node based on whether the target topic is protected by SROS2 security; Step C3: According to the message interface type obtained in step C1, create a subscriber and publisher of the target topic in the intruder node created in step C2, perform "unauthorized message subscription" and "unauthorized message publishing" vulnerability detection on the target topic, and generate a detection report.

7. The method for detecting ROS2 communication security vulnerabilities as claimed in claim 1, characterized in that: In step 3, the ROS2 service vulnerability detection includes the following steps: Step D1: Find the target service in the service basic information list returned in step 2, and use the corresponding ROS2API to further obtain the service interface type according to the name and type of the target service; Step D2: Create an intruder node in the communication domain where the target service is located, and decide whether to authorize the intruder node based on whether the target service is protected by SROS2 security; Step D3: Based on the service interface type obtained in step D1, create a client of the target service in the intruder node created in step D2, perform an "unauthorized service call" vulnerability detection on the target topic, and generate a detection report.

8. The method for detecting ROS2 communication security vulnerabilities as claimed in claim 1, characterized in that: In step 3, the ROS2 action vulnerability detection is performed including the following steps: Step E1: Search for the target action in the action basic information list returned in step 2, and use the corresponding ROS2API to further obtain the interface type of the action according to the name and type of the target action; Step E2: Create an intruder node in the communication domain where the target action is located, and decide whether to authorize the intruder node based on whether the target action is protected by SROS2 security; Step E3: According to the action interface type obtained in step E1, a client of the target action is created in the intruder node created in step E2, the target topic is tested for "unauthorized action call" vulnerability, and a test report is generated.

9. A detection system for implementing the ROS2 communication security vulnerability detection method as described in any one of claims 1 to 8, characterized in that: The detection system includes: a communication domain scanning module and a vulnerability detection module; The communication domain scanning module includes a port scanning module and a ROS2 node scanning module; The port scanning module is used to implement UDP port scanning in the local area network; the ROS2 node scanning module is used to further screen the port scanned by the port scanning module to determine whether the port is a broadcast port of the ROS2 communication domain; The vulnerability detection module includes a topic vulnerability detection module, a service vulnerability detection module and an action vulnerability detection module; The topic vulnerability detection module is used to perform vulnerability detection on topic communication in the ROS2 system; the service vulnerability detection module is used to perform vulnerability detection on service communication in the ROS2 system; and the action vulnerability detection module is used to perform vulnerability detection on action communication in the ROS2 system.

10. Application of the detection method according to any one of claims 1 to 8, or the detection system according to claim 9, in detecting security vulnerabilities in ROS2 communication.

Images