RoboShield v2 introduces inline command firewall for ROS 2 using Rust
Key Takeaway
RoboShield v2 is an inline gateway that uses Rust to inspect and enforce security rules for ROS 2 robot commands.
Summary
The RoboShield v2 project has transitioned from a passive watchdog to an active inline gateway designed to protect ROS 2 robots. Built with Rust and rclrs, the gateway sits between untrusted networks and the robot domain, acting as a bridge between two different domain IDs. It inspects incoming commands for anomalies such as invalid joint limits, NaN/inf values, and unauthorized publishers, triggering a lockdown if security is breached.
Technical implementation of RoboShield v2
- Uses Rust and rclrs to achieve low-latency command processing (1.37 µs median for 6-joint commands).
- Implements a two-domain bridge architecture where the kernel does not forward packets, relying on a single process to bridge isolated LANs.
- Features a rule engine that validates joint names, array lengths, position/velocity/effort limits, and rate limits via a token-bucket algorithm.
- Provides per-message publisher filtering by matching MessageInfo.publisher_gid to nodes in the graph.
- Supports SROS2 on the untrusted side to create an enforced enclave while allowing a plain domain on the robot side.
Why it matters
This provides a security layer for ROS 2 deployments where the robot hardware itself cannot support full DDS-Security.
Original reference: discourse.openrobotics.org →