ROS 2 Security & Encryption Guide 2026

Implement security in ROS 2 systems. Master SROS2 (Secure ROS2), DDS encryption, certificate management, and secure communication for production robotics.

1. SROS2 Security Overview

ROS 2 Secure (SROS2) provides authentication and encryption:

# Install SROS2 tools
sudo apt-get install -y ros-humble-sros2 ros-humble-ros2-security-policy

# Create security keystore
ros2 security create_keystore ~/sros2_keystore

# Generate keys for nodes
ros2 security create_key ~/sros2_keystore /robot_node
ros2 security create_key ~/sros2_keystore /camera_node

# Create access control policy
ros2 security create_policy ~/sros2_keystore policy.xml

# Enable security
export ROS_SECURITY_STRATEGY=enforce
export ROS_SECURITY_ROOT_DIRECTORY=~/sros2_keystore
export ROS_SECURITY_LOOKUP_TYPE=FILE

# Run with security enabled
ros2 run my_robot_app robot_node --ros-args --enforce-ros-args

2. Certificate Management

Manage certificates for secure communication:

# Generate CA certificate
openssl genrsa -out ca_key.pem 2048
openssl req -new -x509 -days 365 -key ca_key.pem -out ca_cert.pem

# Generate node certificate
openssl genrsa -out node_key.pem 2048
openssl req -new -key node_key.pem -out node.csr
openssl x509 -req -days 365 -in node.csr   -CA ca_cert.pem -CAkey ca_key.pem -CAcreateserial   -out node_cert.pem

# Configure DDS security
export CERT_FILE=/path/to/node_cert.pem
export KEY_FILE=/path/to/node_key.pem
export CA_FILE=/path/to/ca_cert.pem

3. DDS Security Plugins

Enable DDS-level security:

// Configure FastDDS with security
#include <fastdds/dds/domain/DomainParticipantFactory.hpp>
#include <fastdds/security/authentication/Authentication.h>

using namespace eprosima::fastdds::dds;
using namespace eprosima::fastdds::security;

DomainParticipantQos qos;

// Enable authentication
PropertySeq auth_properties;
Property auth_prop;
auth_prop.name() = "dds.sec.auth.plugin";
auth_prop.value() = "builtin.PKI-DH";
auth_properties.push_back(auth_prop);

// Enable encryption
Property enc_prop;
enc_prop.name() = "dds.sec.crypto.plugin";
enc_prop.value() = "builtin.AES-GCM-GMAC";
auth_properties.push_back(enc_prop);

qos.properties(auth_properties);

// Create participant with security
auto factory = DomainParticipantFactory::get_instance();
DomainParticipant* participant = factory->create_participant(0, qos);

4. Access Control Policies

Define role-based access control:

<?xml version="1.0" encoding="UTF-8"?>
<policy version="0.2.0">
  <domain name="*">
    <description>Global domain policy</description>

    <!-- Robot controller node -->
    <participant name="robot_controller" domain_id="0">
      <role name="controller">
        <permission name="sub_action_goal">
          <topics>
            <topic>rt/robot/goal</topic>
          </topics>
          <partitions>
            <partition>robot/*</partition>
          </partitions>
        </permission>
        <permission name="pub_action_result">
          <topics>
            <topic>rt/robot/result</topic>
          </topics>
        </permission>
      </role>
    </participant>

    <!-- Camera node -->
    <participant name="camera" domain_id="0">
      <role name="sensor">
        <permission name="pub_image">
          <topics>
            <topic>rt/camera/image</topic>
          </topics>
        </permission>
      </role>
    </participant>
  </domain>
</policy>

5. Authentication & Key Exchange

Implement mutual authentication:

# DH-based authentication configuration
export RMW_IMPLEMENTATION=rmw_fastrtps_cpp
export FASTRTPS_DEFAULT_PROFILES_FILE=/etc/fastdds.xml

# fastdds.xml
<?xml version="1.0" encoding="UTF-8"?>
<profiles>
  <security_profile name="secure_participant">
    <authentication>
      <enable>true</enable>
      <plugin_name>builtin.PKI-DH</plugin_name>
      <private_key>file://path/to/key.pem</private_key>
      <certificate>file://path/to/cert.pem</certificate>
      <ca_certificate>file://path/to/ca.pem</ca_certificate>
    </authentication>
    <encryption>
      <enable>true</enable>
      <plugin_name>builtin.AES-GCM-GMAC</plugin_name>
    </encryption>
  </security_profile>
</profiles>

6. Secure Communication Channels

Use TLS for secure communication:

// DTLS configuration for ROS 2
class SecureROS2Node : public rclcpp::Node {
 public:
  SecureROS2Node() : Node("secure_node") {
    // Enable SROS2
    rcl_security_options_t security_options =
      rcl_get_default_security_options();
    security_options.enforce_security = RCL_SECURITY_ENFORCEMENT_ENFORCE;

    // Initialize with security
    auto options = rclcpp::NodeOptions()
      .security_options(security_options);

    publisher_ = create_publisher<std_msgs::msg::String>(
      "secure_topic", 10, options);
  }

 private:
  rclcpp::Publisher<std_msgs::msg::String>::SharedPtr publisher_;
};

7. Monitoring & Auditing

Log security events:

# Monitor security events
export ROS_LOG_LEVEL=DEBUG
ros2 run my_robot_app robot_node 2>&1 | grep -i "security|auth|encrypt"

# Check certificate validity
openssl x509 -in node_cert.pem -text -noout
openssl x509 -in node_cert.pem -checkend 86400  # Check expiry in 1 day

# Audit security policy
ros2 security audit ~/sros2_keystore/robot_node

# Monitor DDS traffic (with security)
tcpdump -i eth0 -n "udp port 7400" -w secure_traffic.pcap

8. Certificate Rotation

Manage certificate lifecycle:

# Generate new certificate before expiry
openssl x509 -in old_cert.pem -noout -dates

# Rotate certificate
ros2 security update_key ~/sros2_keystore /robot_node new_cert.pem

# Deploy new certificates without downtime
# Use rolling updates in Kubernetes or container orchestration
# 1. Generate new certificates
# 2. Deploy to standby nodes
# 3. Drain and update primary nodes
# 4. Verify security posture

9. Best Practices

• Key Management: Store keys securely, use hardware security modules (HSM) for production
• Certificate Rotation: Rotate certificates before expiry (30-90 day intervals)
• Access Control: Implement least-privilege principle
• Monitoring: Log and audit all security events
• Testing: Test security policies before deployment

10. Security Compliance

Meet industry standards:

• End-to-end encryption for all DDS communication
• Mutual authentication between nodes
• Role-based access control (RBAC)
• Audit logging of all security events
• Regular security updates and patching

Key Takeaways

Implement SROS2 for production robotics systems. Use certificate-based authentication, DDS-level encryption, and role-based access control. Monitor security events and rotate certificates regularly. Comply with industry standards for secure autonomous systems.