In recent decades, there has been an increasing number of studies on control flow integrity (CFI), particularly those implementing hardware-assisted CFI solutions that utilize a special instruction set extension. More recently, ARM and Intel, which are prominent processor architectures, also announced instruction set extensions for CFI called branch target identification (BTI) and control-flow enhancement technology (CET), respectively. However, according to our preliminary analysis, they do not support various CFI solutions in an efficient and scalable manner. In this study, we propose Bratter, a new instruction set extension for forward CFI solutions on RISC-V. At the center of Bratter, there are Branch Tag Registers and dedicated instructions for these registers. We implemented well-known CFI solutions (i.e., branch regulation and function signature check) using Bratter to evaluate its performance. Our experimental results show that, by using Bratter, even when these two solutions work together, they impose only 1.20% and 5.99% overhead for code size and execution time, respectively.

Robotic systems are increasingly prevalent across various fields, necessitating a strong focus on safety and security. The evolution from ROS 1 to ROS 2 has addressed many security concerns; however, it has also introduced new challenges, particularly in anomaly detection due to its decentralized architecture. This shift emphasizes the need for robust methods to monitor and analyze system behavior, as traditional techniques tailored for centralized systems may overlook subtle anomalies. In this paper, we propose an offline anomaly detection using machine learning in ROS 2. Our methodology leverages the widely adopted ros2_tracing framework for efficient and automated data collection, and employs Turtlebot3 running Cartographer SLAM in a Gazebo simulation environment that closely mimics real-world conditions. We further enhance our evaluation by applying controlled fault injection and data augmentation techniques to simulate both malicious and benign anomalies. In our experiments, we utilize multiple machine learning models, including Isolation Forest, OCSVM, and Autoencoder, to analyze the temporal characteristics of callbacks, focusing on response time and invocation frequency. Based on our evaluation, Isolation Forest achieved an F1 score of up to 0.94 with a false positive rate of 1.3%, OCSVM reached an F1 score of up to 0.98 with a false positive rate of around 1.7%, and the Autoencoder attained an F1 score of up to 0.99 with a false positive rate as low as 1.0%.

Robot Operating System (ROS) is a software framework for robotic systems that includes various packages for developing robotic applications. Composition is a package that combines multiple applications, namely, nodes , to be loaded and executed in a single process. However, permitting multiple nodes to share the address space could expand the attack surface such that vulnerabilities in a node are more likely to be exploited to subvert nodes running in the same space. We propose ROSec, an in-process isolation solution for ROS composition that utilizes Intel Memory Protection Keys. ROSecaims to enforce memory isolation between nodes within a process by preventing unauthorized access from one node to another. Unlike previous works that assume the number and sizes of nodes are statically defined and partitioned by developers, ROSecis designed to handle the dynamic nature of nodes that can be loaded and executed in a process at any time during execution. To achieve this, ROSecadopts a unique scheduling mechanism that utilizes the executor-centric execution model of ROS to perform two main operations for MPK-based isolation: protection key assignment and reassignment . Our evaluation shows that ROSeceffectively enforces in-process isolation while incurring a 6.4% performance overhead on a real-world application. Note to Practitioners —Cyber-Physical Systems are the core of modern applications, particularly robotics, as they integrate computing and physical processes. ROS necessitates real-time and security guarantees, which, unfortunately, trade-off with each other. While traditional ROS architecture relies on process isolation to separate various nodes, ROS2 introduces a feature called composition, which allows multiple nodes to run inside a single process, thus exposing various nodes to potential malicious compromises from others. This paper proposes a technique that utilizes Intel memory protection keys (MPK) to provide intraprocess isolation for ROS composition. Given that ROS nodes are dynamic, ROSEC provides key assignment and reassignment techniques to configure MPK dynamically.

Numerous embedded systems utilize firmware written in memory-unsafe C/C++. So, the firmware may exhibit spatial memory vulnerabilities, such as buffer overflows, which, if exploited by an attacker, can lead to various software attacks. While several studies have proposed defenses against these memory vulnerabilities, they often introduce significant performance and memory overhead or are impractical for application in embedded systems. In this paper, we introduce micro-fat pointer, a novel solution for heap memory safety for embedded systems. Notably, micro-fat pointer leverages TT instructions newly introduced in ARMv8-M to implement an efficient bounds-checking mechanism. Our evaluation results demonstrate that micro-fat pointer exhibits a 41% performance improvement compared to the existing state-of-the-art heap memory safety solution.

The Robot Operating System 2 (ROS 2) ecosystem and its embedded variant micro-ROS are increasingly used in Cyber-Physical Systems (CPS) on Microcontroller Units (MCUs). micro-ROS clients communicate through the Data Distribution Service (DDS) profile for eXtremely Resource-Constrained Environments (XRCE-DDS), but this middleware has no built-in way to verify client firmware integrity before nodes join the network, so a compromised client can join and disseminate malicious data. Existing mechanisms such as secure boot and Trusted Platform Module (TPM)-based remote attestation let verifiers check that a device boots an expected image, but they usually require dedicated TPM hardware and are ill-suited to low-end MCU-based platforms. MCU attestation schemes have been proposed, but they largely remain research prototypes and are not integrated with ROS 2 or XRCE-DDS, so micro-ROS lacks a standard way to enforce firmware integrity at network admission time. In this paper, we propose SERA, a secure mechanism that embeds remote attestation into the Micro XRCE-DDS handshake, requiring each client to prove its firmware integrity before joining the DDS network. SERA leverages Roots of Trust, including the Device Identifier Composition Engine (DICE), Arm Platform Security Architecture (Arm PSA), the Memory Protection Unit (MPU), and Arm TrustZone-M to offer isolation profiles on MCUs. On a NUCLEO-L552ZE-Q board, SERA adds handshake latency of 380–795 ms and increases initialization time and firmware size compared to a baseline without attestation, while keeping startup overheads practical. In targeted experiments, SERA successfully prevents firmware tampering and replay attacks from joining the DDS network.