In the local networking lecture in this section, we saw how easy it is to communicate over the local
network to retrieve data from other raw systems.
There may be times where you want to secure that data from prying eyes, in which case you can secure
your Ross message streams using Ross two Security features.
These security configurations are part of the Se ROS package.
You can check out the ROS index page for more information about ROS, but in my opinion, one of the
best resources to learn is ROS is the introduction to ROS two security tutorial page on the ROS docks.
So in this lecture we're going to follow this tutorial together to create a keystore, generate keys
and certificates and then use them to encrypt our ROS message streams by passing it in as arguments
when we launch our notes.
Keep in mind that these keys and certificates we generate should never be stored with your code base,
such as part of a GitHub repo for your package, but instead generated and copied on an as needed basis
on the computers you are using them on.
That is because you do not want others to be able to access these keys and certificates to decode your
message streams should your code be compromised or accessed by an unauthorized individual.
Examples of this in real life is Uber's 2016 data breach in which they stored private keys on a GitHub
repo which became compromised, leading to 57 million customers data being leaked.
Keep in mind that the most realistic ROS applications will generally only be related to specific message
streams, such as image feeds, which may showcase a trade secret process at a manufacturing facility,
or sending any personal info over ROS for a robot to process.
But with that, let's jump in.
So at the beginning of this tutorial it goes over some background as well as some arguments which you
need to pass in if you're building ROS two from source.
So if you want to use these features utilizing what we did in the last lecture, make sure to include
these C make arguments D security on.
But if you're going to be utilizing your binary installation, that's fine.
We can just go ahead and move on.
Then it talks about using alternative middleware, such as using alternative communication architectures.
This is a more advanced topic and would generally only be pursued if you had incredibly strict or specific
security implementation options.
So for now, we are not going to worry about this.
So finally getting started, we will be creating a directory to store our keys and certificates.
So in this tutorial they just create a directory in the user's home directory called SW Ros to demo,
which I'll just go ahead and follow along with for simplicity.
So I'll just go ahead and drag this browser tab to the side and open up a terminal on the other side.
Then we can run the command to make the directory.
All right.
So that's gone ahead and created our Rasta demo directory.
Then step two has us create a keystore.
So we'll go over to our terminal and change it to our directory and run this ROS to security terminal
command to configure a keystore which we are calling demo Keystore.
Now, normally you would name this according to the project you are working on to better describe what
the keys are trying to secure.
But again, I'll just keep it as is for simplicity.
So now I can open up my file explorer window, go into my two demo folder, and here we have our demo
Keystore.
And here we see that that command has generated some folders, which includes information about our
keystore and is going to be storing our keys and certificates that we're going to be generating in step
three.
So the way we go about doing this is using the ROS to security's create Enclave command.
Essentially we just pass it in the name of the Keystone, which in this case ours is demo underscore
keystore, which we just created, followed by the name of these keys and certificates.
This name is usually organized as a type of project description, followed by a forward slash, and
then the node names you plan to use it on.
You need to make sure to run this create enclave command for each node you plan to secure.
So for this tutorial, we're going to be launching the demo talker and listener nodes that we've been
launching in previous lectures.
So the naming is relatively arbitrary, but it's a good rule of thumb to help keep your enclaves organized
and understandable.
So let's go ahead and run these commands.
And with that, we've created our enclave.
So if I go into the Enclaves folder, we now have the Talker listener hierarchy, and if we go into
that, we see the entries created for the Talker node and the entries created for the listener node.
And this contains various keys and certificates which will be utilizing to secure our message streams.
Now that we've generated our keys and certificates, we need to define some environment variables so
Ross knows where to look for our key stores.
You'll need to do this for each terminal environment.
So in production you can include these environment variables in a launch file or bash C file, but for
now we will just run the commands manually for each new terminal.
So just go ahead and copy this, which basically points to our keystore directory.
Enable security and the type of strategy which we just claim as in force.
Then I can scroll down and we can see we can run my talker node by calling Ros to run and configuring
the Ross arguments to utilize the Enclave Talker listener slash talker for the Talker node.
So I'll go ahead and copy this.
And here we see our Hello World messages publishing to the screen.
So now if I open up a new terminal and let's see if we can access the chatter topic that is publishing
these messages.
And we only see the parameter events and Ros alt topics.
No indication of the chatter topic at all.
So let's, let's try checking for the note.
Still nothing.
So for safekeeping, let's try run our listener node like normal.
And we see no messages are being received.
So I'll just go ahead and stop this.
And now let's try and set our environment variables for our keystore.
And now relaunch the node using the ROS arguments with our Enclave Talker listener, listener, keys
and certificates.
I'll go ahead and copy that.
And now we're actually able to receive our Hello World messages being published from our Talker note.
So compared to having everything open as we did before, we have secured our communication streams from
prying eyes.
You can implement this feature across devices as well as using what we learned from the local networking
lecture.
You'll just need to make sure you copy your keystore to any additional devices and use them accordingly.
Now, by all means, this is a pretty sufficient introduction to Ross security, but there are so much
more fine tuned control which you can implement if you and your organization desires, such as setting
up access control by generating policies and creating permissions.
So if that interests you, feel free to check out the following tutorial, which you can find on the
left side of the page in the security section.
So this goes into actually setting up permissions documents for finer tuned control of your security.
But again, this is more advanced than most users will have to get into.
So we're not going to worry about that for right now.
But with that you are able to secure your Ross message streams by creating a keystore generating enclaves
for each node, then configuring our environment variables to use the enclave and implemented them at
Node runtime.
As always, a constant reminder to never store these key stores within your code base as it can compromise
your production systems.
If someone gains access to your code, such as through an online GitHub repository.