Network Reconnaissance and Vulnerability Excavation of Secure DDS Systems

Abstract

Data Distribution Service (DDS) is a realtime peerto-peer protocol that serves as a scalable middleware between distributed networked systems found in many Industrial IoT domains such as automotive, medical, energy, and defense. Since the initial ratification of the standard, specifications have introduced a Security Model and Service Plugin Interface (SPI) architecture, facilitating authenticated encryption and data centric access control while preserving interoperable data exchange. However, as Secure DDS v1.1, the default plugin specifications presently exchanges digitally signed capability lists of both participants in the clear during the crypto handshake for permission attestation; thus breaching confidentiality of the context of the connection. In this work, we present an attacker model that makes use of network reconnaissance afforded by this leaked context in conjunction with formal verification and model checking to arbitrarily reason about the underlying topology and reachability of information flow, enabling targeted attacks such as selective denial of service, adversarial partitioning of the data bus, or vulnerability excavation of vendor implementations.

Decentralized Information-Flow Control for ROS2

“…Figure 4 shows the overall architecture of Picaros, which builds on the ROS2 software stack. Practically, Picaros enforces DIFC policies at the granularity of SROS2 enclaves [46,[71][72][73], which are collections of ROS2 applications that share the same security policy. However, for ease of exposition, it suffices to think of each ROS2 application as an OS-level process, and Picaros as enforcing DIFC policies at the granularity of individual processes.…”

“…ROS by itself does not provide security, the community has proposed several techniques to add security mechanisms. These efforts include adding mandatory access control (MAC) policy enforcement to ROS [5,10], improving messaging secrecy and integrity [14,28,56,66], techniques to secure the underlying DDS layer (specific to ROS2) [45,73], and other methods to improve ROS application security [25,26,37,72]. SROS2 [27,46,62,71] represents an effort to upstream some of these methods to the ROS2 stack, and is built primarily atop the API of DDS, with patches to the ROS2 as well.…”

Lightweight Cryptographic Techniques and Cybersecurity Approaches

“…Are they wired or wireless? These all are affecting the scanning results which in turn affect the security reconnaissance aspects [45].…”

Formal Safety Assessment and Improvement of DDS Protocol for Industrial Data Distribution Service

“…[18] proposes an ABAC-based DDS security model authorization improvement method, and incorporates the ABAC entity into the security model that defines ABAC behavior across RTPS and DCPS, and implements the model in XACML; Ref. [38] proposes an attacker model that leverages network reconnaissance provided by leaky context, combined with formal verification and model checking to arbitrarily infer the underlying topology and reachability of information flows, enabling targeted attacks, such as selective denial of service, adversarial partitioning of the data bus, or exploiting of vendor-implemented vulnerabilities. Through the comparative analysis in Table 8, the scheme proposed in this paper can not only provide an intuitive and accurate graphical description and verify the correctness of protocol functions, but also discover the attack types of the protocol.…”