Robotic systems have been widely used in various industries, so the security of communication between robots and their components has become an issue that needs to be focused on. As a framework for developing robotic systems, the security of ROS2 (Robot Operating System 2) can directly affect the security of the upper-level robotic systems. Therefore, it is a worthwhile research topic to detect and analyze the security of ROS2. In this study, we adopted a formal approach to analyze the security of the communication mechanism of ROS2. First, we used a state transition system to model the potential vulnerabilities of ROS2 based on the ROS2 communication mechanism and the basic process of penetration testing. Secondly, we introduced a CIA model based on the established vulnerability model and used linear temporal logic to define its security properties. Then, we designed and implemented a vulnerability detection tool for ROS2 applications based on the vulnerability model and security properties. Finally, we experimentally tested some ROS2-based applications, and the results show that ROS2 has vulnerabilities without additional protection safeguards.

Robotic systems have been widely used in various industries, so the security of communication between robots and their components has become an issue that needs to be focused on. As a framework for developing robotic systems, the security of ROS2 can directly affect the security of the upper-level robotic systems. Therefore, it is a worthwhile research topic to detect and analyze the security of ROS2. In this paper, we adopt a formal approach to analyze the security of the communication mechanism of ROS2. First, we use a state transition system to model the potential vulnerabilities of ROS2 based on the ROS2 communication mechanism and the basic process of penetration testing. Secondly, we introduce the CIA model on the basis of the established vulnerability model and use LTL to define its security properties. Then, we design and implement a vulnerability detection tool for ROS2 applications based on the vulnerability model and security properties. Finally, we experimentally test some ROS2-based applications, and the results show that ROS2 has vulnerabilities without additional protection safeguards.