A detection method and system for ROS2 communication security vulnerabilities and application thereof

Abstract

The application discloses a kind of detection methods for ROS2 communication security vulnerabilities.The method comprises the following steps: according to DDSDiscovery protocol, all required scanning UDP ports are obtained, then UDP port scanning is carried out in target LAN, and the communication domain ID where the ROS2 application program is located is obtained;According to the obtained communication domain ID, the basic information scanning of communication domain is carried out, and the basic information of ROS2 application program communication is obtained;According to the basic information obtained in step two, vulnerability detection is carried out on all scanned topics, services and actions respectively, the security thereof is analyzed, and a detection report is generated;The security detection reports of the above obtained topics and / or services and / or actions are merged to generate a complete ROS2 security report.The application also discloses a detection system for implementing the above detection method, and the application of the above detection method or detection system in ROS2 communication security vulnerability detection.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of robot operating system (ROS), and particularly relates to a detection method and system for a ROS2 communication security vulnerability and application thereof. BACKGROUND

[0002] In the background of the era of Industry 4.0, which is known as the "fourth industrial revolution", more and more industrial fields have more demand for automation, thereby increasing the development and use of robots by people. All robots need to be controlled by using software, and the most widely used one is the robot operating system (ROS). As one of the most mainstream robot application development frameworks at present, ROS is widely used in various fields, and its communication security has gradually attracted widespread attention from the industry and academia.

[0003] The first generation of robot operating system ROS1 did not fully consider its security when it was initially designed, and a master node was designed as the management node of the entire network by using a centralized idea, which leads to the fact that other nodes in ROS1 may be threatened once the master node is attacked. Therefore, as a new generation of robot operating system, ROS2 not only abandons the centralized idea of ROS1, but also uses the DDS protocol (data distribution service protocol) as the basic framework of its distributed communication, and further enhances the security of its communication by using the DDS security extension module. However, although ROS2 has significantly improved the security compared with ROS1, it does not mean that ROS2 is absolutely secure. On the one hand, some security vulnerabilities existing in ROS1 may still exist in ROS2, and on the other hand, due to the use of a completely new underlying design, ROS2 itself may also have potential new security problems.

[0004] As a new generation of robot operating system, ROS2 is gradually becoming the most important robot communication framework in various fields, and the security of ROS2 itself directly affects the security of all application programs based on ROS2, therefore, the detection and guarantee of the communication security of ROS2 are particularly important.

[0005] Existing vulnerability detection technologies for ROS1 and ROS2 primarily include static code analysis, dynamic testing, security auditing, and network scanning. Static code analysis and dynamic testing focus on functional system security, making them ineffective for detecting communications security vulnerabilities. Security auditing, on the other hand, requires review of system source code and an in-depth understanding of the internal implementation of ROS1 or ROS2. In contrast, specialized scanning tools designed and developed using network scanning techniques are more feasible and effective for scanning ROS1 or ROS2 for communication security vulnerabilities. However, existing tools such as ROSPennTo and ROSploit currently only support ROS1 and not ROS2. Summary of the Invention

[0006] In order to address the deficiencies in the prior art, the present invention proposes a detection method, a detection system, and its application for ROS2 communication security vulnerabilities, which can realize network scanning and simulated attacks on the ROS2 system, thereby achieving the goal of detecting its vulnerabilities.

[0007] This paper detects communication security vulnerabilities in ROS2 and its applied topics, services, and actions. It proposes several possible vulnerabilities in ROS2 and proposes a detailed vulnerability detection method and process to detect potential communication security vulnerabilities in ROS2.

[0008] Before performing vulnerability detection on the ROS2 system, the present invention realizes scanning of the ROS2 system running in the local area network. Since ROS2 uses DDS as middleware, its communication architecture is different from the centralized architecture of ROS1, and there is no master node as the management node of the entire system. Therefore, the existing scanning method for ROS1 based on the master node port is not suitable for ROS2. In order to solve this problem, the present invention obtains the correspondence between the ROS2 communication domain ID (ROS_DOMAIN_ID) and the UDP broadcast port in the communication domain according to the DDS Discovery protocol (the specific relationship is shown in Formula 1), and discovers the communication domain of ROS2 by scanning the UDP port. This design ensures that each different ROS domain has a unique UDP port, thereby realizing data communication and discovery between different domains.

[0009] According to the DDS Discovery protocol, the relationship between ROS_DOMAIN_ID and its corresponding broadcast UDP port is as shown in the following formula 1:

[0010] UDP port DiscoveryMulticastPort = PB + DG * ROS_DOMAIN_ID (1)

[0011] Wherein, PB is a constant value 7400, representing the starting port number, that is, the discovery broadcast port of the domain with DomainID 0; DG is a constant value 250, representing the maximum number of ports that can be included in a domain. The application calculates the required scanning UDP port according to the formula.

[0012] The existing research on network security attacks related to ROS is mostly directed at ROS1, and various attacks are realized by controlling the master node of ROS1, so it is also not applicable to ROS2. In order to test whether ROS2 can resist the attacks in ROS1, the attacks originally directed at ROS1 are redesigned and implemented in ROS2, such as unauthorized message publishing and unauthorized message subscribing, and the attacks are further strengthened for SROS2, so that the ROS2 system under the protection of SROS2 can be simulated and attacked.

[0013] SROS2 (Secure Robot Operating System 2) is a security extension of ROS2 (Robot Operating System 2). ROS2 is an open-source robot operating system framework designed to support the development and operation of robot systems. SROS2 provides security enhancements for ROS2, including authentication, data encryption, and access control, to protect the security and integrity of ROS2 communication and data.

[0014] The detection method for security vulnerabilities in ROS2 communication according to the application comprises the following steps:

[0015] Step one: according to the DDS Discovery protocol, all required UDP ports are obtained, and then UDP port scanning is performed in the target local area network to obtain the communication domain ID of the ROS2 application program;

[0016] The UDP port is a digital identifier used to identify the application program or service that sends and receives UDP data packets. UDP protocol uses port numbers to distinguish different application programs or services, so as to realize the transmission and exchange of data packets.

[0017] The DDS Discovery protocol is a distributed protocol used to discover and connect nodes in a DDS network. This protocol allows nodes to discover each other and establish connections by exchanging information. It achieves this through broadcast, multicast, and unicast. ROS2 uses this protocol to connect nodes. When a ROS2 node starts, it uses the DDS Discovery protocol to discover and connect to other nodes, while using the ROS_DOMAIN_ID to identify the domain to which it belongs. The relationship between the ROS_DOMAIN_ID and its corresponding broadcast UDP port is shown in Equation 1.

[0018] Step 2: Scan the communication domain for ROS2 basic information based on the communication domain ID obtained in step 1 to obtain basic information about ROS2 application communication; the basic information includes: node basic information, topic basic information, service basic information, and action basic information;

[0019] Step 3: Based on the basic information of the topic obtained in step 2, perform vulnerability detection on all scanned topics, test their security, and generate a detection report;

[0020] and / or,

[0021] Based on the basic service information obtained in step 2, perform vulnerability detection on all scanned services, test their security, and generate a detection report;

[0022] and / or

[0023] Based on the basic action information obtained in step 2, perform vulnerability detection on all scanned actions, check their security, and generate a detection report;

[0024] Step 4: Combine the security detection reports of topics and / or services and / or actions obtained in step 3 to generate a complete ROS2 security report.

[0025] In the method for detecting ROS2 communication security vulnerabilities proposed by the present invention, the step 1 further includes the following steps:

[0026] Step A1: The correspondence between the ROS2 communication domains specified in the DDS Discovery protocol and their UDP broadcast ports is shown in Formula 1. According to Formula 1, input ROS_DOMAIN_ID (range 0 to 232) and output the list of UDP ports to be scanned.

[0027] Step A2: Use the network port scanning tool Nmap to scan the ports in the UDP port list calculated in step A1 in the target LAN in sequence, and return the communication domain ID corresponding to the open port; the open port corresponds to the communication domain where the ROS2 application is located.

[0028] In the ROS2 communication security vulnerability detection method proposed by the present invention, the step 2 further includes the following steps:

[0029] Step B1: Based on the communication domain ID returned in step 1, use the ROS2 API to scan the node information in the communication domain corresponding to the returned communication domain ID. If no node is scanned, it means that the port is not the port corresponding to the ROS2 communication domain. Otherwise, proceed to the next step.

[0030] The scanning of ROS2 nodes is divided into default mode and enhanced mode according to whether the security enhancement module of ROS2 is enabled. When the security enhancement module is not enabled, the default mode is used, and when the security enhancement mode is enabled, the enhanced mode is used to ensure that all ROS2 nodes can be scanned.

[0031] Step B2: Use the ROS2 API to scan the basic information of the ROS2 nodes scanned in step B1, such as nodes, topics, services, and actions, and return the scan results.

[0032] In ROS2, a node is an executable file that can communicate (exchange data) with other nodes using the ROS2 communication network. Each node in ROS is generally responsible for a single, modular purpose. Each node can send and receive data to other nodes through topics, services, actions, or parameters. A complete ROS2 system consists of many nodes working together.

[0033] Topics are an important element in ROS2 communication, acting as a bus for nodes to exchange information. Nodes can use topics to implement one-to-many, many-to-one, and many-to-many communication modes.

[0034] In the ROS2 communication network, services are another way for nodes to communicate. Service communication is based on the client / server model and is only provided when the client calls it.

[0035] Actions are a type of communication in ROS2 used for long-running tasks. They consist of three main parts: a goal, feedback, and a result. Action communication is built on topics and services, and clients can cancel actions at any time. Actions also provide stable feedback, rather than services that return a single response.

[0036] Among them, the basic information of the node includes: node name, node type, and whether the node is an authorized node; the basic information of the topic includes: topic name, topic type, and whether the topic is protected by SROS2; the basic information of the service includes: service name, service type, and whether the service is protected by SROS2; the basic information of the action includes: action name, action type, and whether the action is protected by SROS2.

[0037] SROS2 is a security extension in ROS2 that provides security features such as encryption, authentication, and access control for ROS2 applications to protect them from attacks. SROS2 is an important component of ROS2 and can help developers build more secure ROS2 applications.

[0038] In the ROS2 communication security vulnerability detection method proposed in the present invention, vulnerability detection and analysis is performed on the scanned topic in step 3, further comprising the following steps:

[0039] Step C1: Search for the target topic in the topic basic information list returned in Step 2. Based on the target topic's name and type, use the corresponding ROS2 API to obtain the topic's message interface type. Topic message interface types are mainly categorized into basic data types, string types, array types, custom message types, time types, and header types. Developers can also flexibly define topic message interface types as needed.

[0040] Step C2: Create an intruder node in the communication domain where the target topic is located. Depending on whether the target topic is protected by SROS2, decide whether to authorize the intruder node. If the target topic is protected by SROS2, authorize the intruder node. If the target topic is not protected by SROS2, do not authorize the intruder node.

[0041] Step C3: Based on the message interface type obtained in step C1, create a subscriber and publisher of the target topic in the intruder node created in step C2, perform "unauthorized message subscription" and "unauthorized message publishing" vulnerability detection on the target topic, and generate a detection report.

[0042] The method for detecting ROS2 communication security vulnerabilities proposed by the present invention further includes the following steps:

[0043] Step D1: Find the target service in the service basic information list returned in step 2, and use the corresponding ROS2 API to further obtain the service interface type based on the name and type of the target service. In addition to common types such as Empty.srv, SetBool.srv, AddTwoInts.srv, and GetString.srv, developers can also define interface types as needed.

[0044] Step D2: Create an intruder node in the communication domain where the target service is located. Depending on whether the target service is protected by SROS2, decide whether to authorize the intruder node. If the target service is protected by SROS2, authorize the intruder node. If the target service is not protected by SROS2, do not authorize the intruder node.

[0045] Step D3: Based on the service interface type obtained in step D1, a client of the target service is created in the intruder node created in step D2, the target topic is tested for an "unauthorized service call" vulnerability, and a test report is generated.

[0046] In the ROS2 communication security vulnerability detection method proposed in the present invention, vulnerability detection and analysis are performed on the scanned actions in step 3, further comprising the following steps:

[0047] Step E1: Search for the target action in the action basic information list returned in step 2. Based on the name and type of the target action, use the corresponding ROS2 API to further obtain the action's interface type. In addition to commonly used action interface types such as Fibonacci.action, FollowJointTrajectory.action, and NavigateToPose.action, developers can also define interface types as needed.

[0048] Step E2: Create an intruder node in the communication domain where the target action is located. Depending on whether the target action is protected by SROS2, decide whether to authorize the intruder node. If the target action is protected by SROS2, authorize the intruder node. If the target action is not protected by SROS2, do not authorize the intruder node.

[0049] Step E3: Based on the action interface type obtained in step E1, a client for the target action is created in the intruder node created in step E2, the target topic is tested for an "unauthorized action call" vulnerability, and a test report is generated.

[0050] The present invention also provides a detection system for implementing the above-mentioned communication security vulnerability detection method, and the system includes: a communication domain scanning module and a vulnerability detection module.

[0051] The communication domain scanning module is used to scan the ROS2 system running in the local area network and pass its communication domain ID to the vulnerability detection module. This module can be further divided into a port scanning module and a ROS2 node scanning module.

[0052] The port scanning module is used to perform UDP port scanning within a local area network. First, the ROS2 communication domain ID ranges from 0 to 232. Entering this into Formula 1 yields all the UDP ports to be scanned, forming a pre-scan port list. Then, the ports in the pre-scan port list are scanned sequentially on the hosts on the local area network, returning all ports that are open.

[0053] The ROS2 node scanning module is used to further filter the ports scanned by the port scanning module to determine whether the port is a broadcast port of the ROS2 communication domain. First, according to Formula 1, the ROS_DOMAIN_ID corresponding to the scanned UDP port can be calculated. Then, an intruder node is added to the communication domain corresponding to the ROS_DOMAIN_ID. The intruder node scans other ROS2 nodes in the communication domain. If a ROS2 node exists, the communication domain ID is returned. Otherwise, the ROS2 node scan continues to the next port.

[0054] The vulnerability detection module is used to simulate an intruder and conduct network attacks on the ROS2 applications discovered by the port scanning module to test their security. This module can be further divided into a topic vulnerability detection module, a service vulnerability detection module, and an action vulnerability detection module.

[0055] The topic vulnerability detection module is used to detect vulnerabilities in topic communication in the ROS2 system. It mainly detects vulnerabilities in the target system through two attacks: unauthorized subscription and unauthorized publication. If the attack is successful, it means that there are corresponding vulnerabilities in the target system and a corresponding security report is generated. The specific process of this module is as follows Figure 3 As shown, first, the target communication domain is obtained through the communication domain scanning module; then, a daemon node is created in the target communication domain to obtain the basic data of the target topic, such as the topic name and topic type; finally, subscribers and publishers are created according to the obtained basic data to perform unauthorized subscription and publication on the target topic.

[0056] The service vulnerability detection module is used to detect vulnerabilities in the service communication of the ROS2 system. It mainly detects vulnerabilities in the target system through unauthorized service call attacks. If the attack is successful, it means that there are corresponding vulnerabilities in the target system and a corresponding security report is generated. The specific process of this module is as follows Figure 4 As shown, first, the target communication domain is obtained through the communication domain scanning module; then, a daemon node is created in the target communication domain to obtain the basic data of the target service, such as the service name and service type; finally, a service client is created based on the obtained basic data, and a service request is sent to make an unauthorized call to the target.

[0057] The action vulnerability detection module is used to detect vulnerabilities in the action communication of the ROS2 system. It mainly detects vulnerabilities in the target system through unauthorized action call attacks. If the attack is successful, it means that there are corresponding vulnerabilities in the target system and a corresponding security report is generated. The specific process of this module is as follows Figure 5 As shown, first, the target communication domain is obtained through the communication domain scanning module; then, a daemon node is created in the target communication domain to obtain the basic data of the target action, such as the action name and action type; finally, an action client is created based on the obtained basic data, and an action request is sent to make an unauthorized call to the target action.

[0058] Finally, the security reports obtained by these three detection modules are merged to generate a complete ROS2 security detection report.

[0059] The present invention also provides the above-mentioned security vulnerability detection method, or the application of the above-mentioned security vulnerability detection system in ROS2 communication security vulnerability detection.

[0060] The beneficial effects of the present invention include: The proposed ROS2 communication security vulnerability detection method detects and analyzes ROS2 applications based on the principles of penetration testing, performing vulnerability detection by constructing simulated attacks. If the attack is successful, the corresponding vulnerability is detected in the program and a detailed detection report is generated; otherwise, the program does not have the corresponding vulnerability. The present invention aims to detect potential communication security issues in ROS2 applications and help improve the security of ROS2 applications.

[0061] Compared with the existing technology, the present invention expands the communication security vulnerabilities of ROS2. In existing research, the security analysis of ROS2 mostly focuses on its security module SROS2, and the research on the communication mechanism of ROS2 itself is relatively scarce. The small amount of relevant research does not fully cover the three communication mechanisms of ROS2 topics, services and actions. On the basis of existing research and analysis, the present invention expands the communication security vulnerabilities in ROS1, realizes the vulnerability detection of all communication mechanisms of ROS2, and aims to fully perform communication security analysis on the ROS2 system. At the same time, for the security module SROS2 of ROS2, the present invention strengthens the vulnerability attack achieved, that is, the identity authorization of the intruder node mentioned in the above step description, so that it can effectively attack the ROS2 system under the protection of SROS2, thereby realizing vulnerability detection of ROS2 systems with and without the SROS2 module turned on. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without paying any creative work.

[0063] Figure 1 This is an overall flow chart of the detection method for ROS2 communication security vulnerabilities of the present invention.

[0064] Figure 2 This is a port scanning flow chart of the detection method for ROS2 communication security vulnerabilities of the present invention.

[0065] Figure 3 This is a flow chart of the topic vulnerability detection module of the detection system for ROS2 communication security vulnerabilities of the present invention.

[0066] Figure 4 This is a flow chart of the service vulnerability detection module of the detection system for ROS2 communication security vulnerabilities of the present invention.

[0067] Figure 5 This is a flow chart of the action vulnerability detection module of the detection system for ROS2 communication security vulnerabilities of the present invention.

[0068] Figure 6 Schematic diagram of an embodiment of a method for detecting ROS2 communication security vulnerabilities according to the present invention. DETAILED DESCRIPTION

[0069] The invention is further described in detail with reference to the following specific examples and accompanying drawings. The processes, conditions, experimental methods, etc. for implementing the present invention, except for those specifically mentioned below, are common knowledge and common common sense in the art and are not particularly limited by the present invention.

[0070] The present invention proposes a detection method, detection system, and application for communication security vulnerabilities in the open-source ROS2 (second-generation Robot Operating System). The method first calculates all UDP ports to be scanned based on the DDS Discovery protocol. The method then uses the Nmap network scanning tool to scan ports in a pre-scanned port list in the target local area network. The scan results are further filtered through a ROS2 node scan to determine whether a ROS2 node exists in the communication domain. Next, the present invention performs a ROS2 basic information scan to obtain the basic structure and composition of ROS2 applications. Finally, based on the ROS2 communication mechanism, topic, service, and action vulnerability detection is performed to determine whether a vulnerability threat exists in the ROS2 application and generate a corresponding detection report. The present invention is applicable to ROS2 implementations involving two communicating nodes. Through vulnerability detection, the present invention detects the security of ROS2 and its applications in the three major communication mechanisms of topic, service, and action.

[0071] This paper proposes a detection method for ROS2 communication security vulnerabilities. It mainly analyzes the three communication mechanisms of ROS2, proposes potential security vulnerabilities in each communication mechanism, and uses penetration testing to detect and analyze these vulnerabilities. Finally, it returns the detection results and generates a detection report.

[0072] This invention expands upon existing research analyzing ROS2 communication security vulnerabilities. Existing research on ROS2 security has largely focused on its security module, SROS2. Research on ROS2's communication mechanisms has been relatively scarce, and the few studies that have been conducted do not fully cover the three communication mechanisms of ROS2: topics, services, and actions. Building on this existing research, this invention expands upon existing research and analysis by detecting communication security vulnerabilities in ROS1 and enabling vulnerability detection across all ROS2 communication mechanisms, aiming to provide a comprehensive communication security analysis for the ROS2 system.

[0073] like Figure 1 As shown, the application of the present invention in the ROS2 Foxy version includes the following steps:

[0074] Step 1: Obtain all required UDP ports according to the DDS Discovery protocol. Then, use the network port scanning tool Nmap to perform a UDP port scan in the target LAN. Scan the UDP port with the "open" status and return the communication domain ID corresponding to the port, which is the communication domain ID where the ROS2 application is located.

[0075] Step 2: Create an intruder node in the corresponding communication domain based on the communication domain ID obtained in Step 1. Use this node to scan for basic ROS2 information and obtain basic information about ROS2 applications, including nodes, topics, services, and actions. If the returned value is empty, it is assumed that there are no ROS2 applications running in the communication domain.

[0076] Among them, the basic information of the node includes: node name, node type, and whether the node is an authorized node; the basic information of the topic includes: topic name, topic type, and whether the topic is protected by SROS2; the basic information of the service includes: service name, service type, and whether the service is protected by SROS2; the basic information of the action includes: action name, action type, and whether the action is protected by SROS2.

[0077] The ROS2 basic information scan is divided into two modes: default mode and enhanced mode, depending on whether the intruder node is an authorized ROS2 node. In the default mode, the intruder node is a regular ROS2 node and can only communicate with regular ROS2 nodes, not authorized ROS2 nodes. In the enhanced mode, the intruder node is an authorized ROS2 node and can only communicate with authorized ROS2 nodes, not regular ROS2 nodes. The authorized ROS2 node refers to the ROS2 authorization mechanism.

[0078] Step 3: Based on the topic name and topic type obtained in step 2, perform vulnerability detection on the target topic, test its security, and generate a detection report. First, based on whether the subscriber / publisher node of the target topic in step 2 is an identity-authorized node, create an intruder node of the same type; then, based on the name and type of the target topic in step 2, use the corresponding ROSAPI to obtain the message type of the target topic; finally, based on the obtained target topic message type, establish a subscriber or publisher of the target topic in the created intruder node, and detect the two vulnerabilities of "unauthorized message publishing" and "unauthorized message subscription". Repeat the above steps for all scanned topics, record the vulnerability detection results for each topic, and generate a detection report.

[0079] According to the service information obtained in step two, vulnerability detection is performed on all scanned services, security is detected, and a detection report is generated. First, according to whether the target service server node in step two is an identity-authorized node, an intruder node of the same type is created; then, according to the name and type of the target service in step two, the service interface type of the target service is obtained using the corresponding ROS API; finally, according to the obtained target service service interface type, a client of the target service is established in the created intruder node, and the "unauthorized service call" vulnerability detection is performed. Repeat the above operation for all scanned services, record the vulnerability detection results of each service, and generate a detection report.

[0080] According to the action information obtained in step two, vulnerability detection is performed on all scanned actions, security is detected, and a detection report is generated. First, according to whether the target action server node in step two is an identity-authorized node, an intruder node of the same type is created; then, according to the name and type of the target action in step two, the action interface type of the target action is obtained using the corresponding ROS API; finally, according to the obtained target action interface type, a client of the target action is established in the created intruder node, and the "unauthorized action call" vulnerability detection is performed. Repeat the above operation for all scanned actions, record the vulnerability detection results of each service, and generate a detection report.

[0081] Step four: merge the security detection reports of the topics and / or services and / or actions obtained in step three to generate a complete ROS2 security report.

[0082] Embodiment

[0083] This embodiment takes a communication network composed of two mutually communicating ROS2 nodes in Figure 6 as an example to detect security vulnerabilities.

[0084] This embodiment takes a communication network composed of two mutually communicating ROS2 nodes in Figure 6As shown in the figure, the communication domain ID of the ROS2 application is 0, and node A and node B conduct three types of communication: topic, service and action. In topic communication, node A and node B transmit messages through topic, node A is the publisher node of topic, and node B is the subscriber node; in service communication, node A and node B communicate through service, node A is the client node of service, responsible for issuing service requests and waiting for responses, node B is the server node of service, responsible for receiving and processing service requests; in action communication, node A and node B communicate through action, node A is the client node of action, responsible for issuing action requests and waiting for responses, node B is the server node, responsible for receiving and processing requests.

[0085] In this embodiment, a network port scan is first performed to scan the ROS2 communication domain within the local area network. Figure 2 As shown in the figure, first, a UDP port scan is performed on the hosts in the LAN. Then, the scanned ports are filtered through the ROS2 node scan, and the ports containing ROS2 nodes are returned as the final scan results. After the port scan is completed, according to the principle of penetration testing, an intruder is simulated to attack the vulnerability and the final detection results are returned. The specific steps are as follows:

[0086] Step 1: According to the DDS Discovery protocol, obtain all the UDP ports that need to be scanned, and then use the network port scanning tool Nmap to perform a UDP port scan in the target LAN. Scan the UDP port with port number 7400 and return the communication domain ID corresponding to the port (ID = 0 in this embodiment), which is the communication domain ID where the ROS2 application is located.

[0087] Step 2: Based on the communication domain ID obtained in step 1, create an intruder node in the corresponding communication domain, scan the ROS2 basic information through the node, obtain the basic information of the ROS2 application, and obtain the basic information of node A, node B, topic, service, and action.

[0088] Step 3: Based on the topic name and type obtained in Step 2, the topic is tested for the "unauthorized message publishing" and "unauthorized message subscription" vulnerabilities, and a test report is generated. The results show that an intruder can successfully attack the topic using both vulnerabilities. This means that the topic is vulnerable to both "unauthorized message publishing" and "unauthorized message subscription" vulnerabilities, posing a risk of data theft or false data injection.

[0089] Based on the service names and interface types obtained in step 2, all scanned services are tested for the "unauthorized service call" vulnerability and a test report is generated. The results show that an intruder can successfully make an "unauthorized service call" to the service, indicating that the service has this vulnerability, which may result in malicious command calls or theft of result data.

[0090] Based on the action information obtained in step 2, all scanned actions are tested for the "unauthorized action call" vulnerability and a test report is generated. The results show that an intruder can successfully perform an "unauthorized action call" on an action, indicating that the action has this security vulnerability, which may lead to the risk of malicious command calls or feedback information being maliciously stolen.

[0091] Step 4: Combine the security detection reports of topics and / or services and / or actions obtained in step 3 to generate a complete ROS2 security report.

[0092] In this embodiment, the ROS2 communication security vulnerability detection method of the present invention is used to successfully detect vulnerabilities in the program in the embodiment and discover the security issues therein, which helps developers or maintenance personnel to enhance protection against specific security vulnerabilities and further improve the security of ROS2 applications, making them more secure and reliable.

[0093] The protection content of the present invention is not limited to the above embodiments. Without departing from the spirit and scope of the inventive concept, changes and advantages that can be thought of by those skilled in the art are included in the present invention and are protected by the appended claims.

Claims

1. A method for detecting ROS2 communication security vulnerabilities, characterized in that: The following steps are involved: Step 1: According to the DDSDiscovery protocol, obtain all the UDP ports that need to be scanned, and then perform a UDP port scan in the target LAN to obtain the communication domain ID where the ROS2 application is located; Step 2: Based on the communication domain ID obtained in step 1, scan the communication domain for ROS2 basic information to obtain basic information about ROS2 application communication; The basic information includes: node basic information, topic basic information, service basic information and action basic information; Step 3: Based on the basic information of the topic obtained in step 2, perform vulnerability detection on all scanned topics, analyze their security, and generate a detection report; and / or, Based on the basic service information obtained in step 2, perform vulnerability detection on all scanned services, analyze their security, and generate a detection report; and / or, Based on the basic action information obtained in step 2, perform vulnerability detection on all scanned actions, analyze their security, and generate a detection report; Step 4: Combine the security detection reports of topics and / or services and / or actions obtained in step 3 to generate a complete ROS2 security report.

2. The method for detecting ROS2 communication security vulnerabilities according to claim 1, wherein: The ROS2 communication domain scan performed in step 1 includes the following steps: Step A1: According to the correspondence between ROS2 communication domain ID and UDP port specified in the DDSDiscovery protocol, calculate the UDP port list to be scanned; Step A2: Use a network port scanning tool to scan the ports in the UDP port list calculated in step A1 in the target LAN in sequence, and return the communication domain ID corresponding to the open port; the open port corresponds to the communication domain where the ROS2 application is located.

3. The method for detecting ROS2 communication security vulnerabilities according to claim 2, wherein: The relationship between the ROS2 communication domain ROS_DOMAIN_ID and the UDP port DiscoveryMulticastPort specified in DDSDiscovery is as follows: DiscoveryMulticastPort=PB+DG*ROS_DOMAIN_ID, Among them, PB represents the starting port number, that is, the discovery broadcast port of the domain with DomainID 0; DG represents the maximum number of ports that can be included in a domain, and ROS_DOMAIN_ID represents the ROS2 communication domain ID.

4. The method for detecting ROS2 communication security vulnerabilities according to claim 1, wherein: The ROS2 basic information scan performed in step 2 includes the following steps: Step B1: Based on the communication domain ID returned in step 1, use the ROS2 API to scan the node information in the communication domain corresponding to the returned communication domain ID. If no node is scanned, it means that the scanned UDP port is not the port corresponding to the ROS2 communication domain. If a node is scanned, continue with the subsequent steps. Step B2: Use the ROS2 API to scan the basic information of the ROS2 communication domain, including nodes, topics, services, and actions, and return the scan results.

5. The method for detecting ROS2 communication security vulnerabilities according to claim 4, wherein: The scanning of ROS2 nodes is divided into default mode and enhanced mode according to whether the security enhancement module of ROS2 is enabled. When the security enhancement module is not enabled, the default mode is used, and when the security enhancement mode is enabled, the enhanced mode is used to ensure that all ROS2 nodes can be scanned; The basic information of a node includes: node name, node type, and whether the node is an authorized node; the basic information of a topic includes: topic name, topic type, and whether the topic is protected by SROS2; the basic information of a service includes: service name, service type, and whether the service is protected by SROS2; the basic information of an action includes: action name, action type, and whether the action is protected by SROS2.

6. The method for detecting ROS2 communication security vulnerabilities according to claim 1, wherein: In step 3, the ROS2 topic vulnerability detection includes the following steps: Step C1: Search for the target topic in the topic basic information list returned in step 2, and use the corresponding ROS2 API to further obtain the message interface type of the topic based on the name and type of the target topic; Step C2: Create an intruder node in the communication domain where the target topic is located, and decide whether to authorize the intruder node based on whether the target topic is protected by SROS2 security. Step C3: Based on the message interface type obtained in step C1, create a subscriber and publisher for the target topic in the intruder node created in step C2, perform "unauthorized message subscription" and "unauthorized message publishing" vulnerability detection on the target topic, and generate a detection report.

7. The method for detecting ROS2 communication security vulnerabilities according to claim 1, wherein: In step 3, the ROS2 service vulnerability detection includes the following steps: Step D1: Find the target service in the service basic information list returned in step 2, and use the corresponding ROS2 API to further obtain the service interface type based on the name and type of the target service; Step D2: Create an intruder node in the communication domain where the target service is located, and decide whether to authorize the intruder node based on whether the target service is protected by SROS2 security. Step D3: Based on the service interface type obtained in step D1, create a client for the target service in the intruder node created in step D2, perform an "unauthorized service call" vulnerability check on the target topic, and generate a test report.

8. The method for detecting ROS2 communication security vulnerabilities according to claim 1, wherein: In step 3, the ROS2 action vulnerability detection includes the following steps: Step E1: Search for the target action in the action basic information list returned in step 2, and use the corresponding ROS2 API to further obtain the action interface type based on the name and type of the target action; Step E2: Create an intruder node in the communication domain where the target action is located, and decide whether to authorize the intruder node based on whether the target action is protected by SROS2 security. Step E3: Based on the action interface type obtained in step E1, create a client for the target action in the intruder node created in step E2, perform an "unauthorized action call" vulnerability check on the target topic, and generate a detection report.

9. A detection system for implementing the ROS2 communication security vulnerability detection method according to any one of claims 1 to 8, characterized in that: The detection system includes: a communication domain scanning module and a vulnerability detection module; The communication domain scanning module includes a port scanning module and a ROS2 node scanning module; The port scanning module is used to implement UDP port scanning in the local area network; the ROS2 node scanning module is used to further screen the port scanned by the port scanning module to determine whether the port is a broadcast port of the ROS2 communication domain; The vulnerability detection module includes a topic vulnerability detection module, a service vulnerability detection module and an action vulnerability detection module; The topic vulnerability detection module is used to perform vulnerability detection on topic communication in the ROS2 system; the service vulnerability detection module is used to perform vulnerability detection on service communication in the ROS2 system; and the action vulnerability detection module is used to perform vulnerability detection on action communication in the ROS2 system.

Images