The concepts of what can be described as robots dates back as early as the Ancient Greeks, envisioning artificial humanoid automata - 'Golden Maidens' - that were intelligent.
"There is intelligence in their hearts, and there is speech in them and strength, and from the immortal gods they have learned how to do things." - Homer, Iliad 18. 416 ff
It is suggested that these robots have learned how to behave intelligently from their creators, which is exactly how early modern robots behaved.
Many visions and depictions of early robotic systems typically showcased humanoid robots, such as Thea von Harbou's Maschinenmensch, the Japanese Gakutensoku, and many more. Regardless of how robots were depicted, however, many were envisioned as an entity that could perform menial tasks that human beings did not necessarily want to do.
Moving away from humanoid robots, we started to see the rise of industrial robots from as early as the 1930s, consisting of manipulators and joints to perform motions such as pulling, pushing and lifting objects. However, unlike many of today's robots, these were typically teleoperated - through the use of a controller apparatus. It was not until the early 1950s when Unimate was invented - an industrial robot that was digitally operated and programmable to perform an array of tasks - and deployed in the early 1960s.
With the advances of mechanical and electrical engineering, we started to see more complex robotic systems, making use of sensors such as rangefinders for tasks like navigation and force feedback. One key example includes the KUKA IR 160/60 robots developed in the early 1980s, which played a significant role in automotive production. In the 1990s, we saw the use of robots in assisted surgery - one of the many domains in which robots began interacting directly with, and operating alongside, humans in shared workspaces.
By the beginning of the early 2000s, we started to see robots moving into more critical environments.
Robots in a connected world
With the rise of Industry 4.0, coupled with significant advances in computer science and engineering, we have seen the world of robotics take a graceful leap into many different areas, including the automotive industry, medicine and the military, to name a few.
In 2022, the Global Robotics Market was valued at over $72 billion, forecasted to exceed $140 billion in 2027, with many billions being further invested globally in VC-backed start-up companies. In particular, we are seeing more installations in the automotive industry and commercial warehouses, where robots are deployed to provide higher levels of efficiency, accuracy and flexibility across our supply chains.
To achieve this, robotic systems are becoming increasingly connected - both to the public Internet and to internal networks (such as within a hospital) - to enable higher levels of automation, including delegating vision computation processes to the cloud. Unfortunately, connectivity now means that the safety of these robots in the real world, and how they operate or behave, has become a concern for cybersecurity.
Takeaway 1. "Being connected results in safety becoming a cybersecurity challenge"
Consider a surgical robot deployed in a hospital. As a patient, our assurance that everything will go well is predominantly placed on the hospital, which employs a team of professionals trained and certified to carry out the necessary procedures. We trust that those professionals can perform surgeries in a time-critical manner, as safely as possible, with the highest levels of accuracy to minimise the risk of complications.
When we consider a robot, however, our assurance is no longer guaranteed in the same way - it now rests on the robot's software and hardware components. With these robots being increasingly connected, they rely on the lowest possible latency in communications, as well as the highest degree of accuracy and precision for the tasks they carry out. If the robot is performing a scalpel incision on a patient, even the slightest drop in accuracy can mean the difference between life and death. If this robot were under attack - for example, through a Denial of Service attack that leaves it unable to communicate in a timely manner - complex decisions can no longer be made in time-critical scenarios, putting those who interact with the robot at significantly higher risk of serious complications.
Because robots both operate and communicate with various entities across both the digital and physical world, it is important to discuss how security impacts safety in both contexts - particularly for robots deployed in safety-critical environments.
The physical domain
Many robotic systems can be classed as cyber-physical systems, one of the core trends of Industry 4.0 alongside automation and data exchange. Unlike traditional computing systems, whose hardware is predominantly only interacted with by users (a keyboard or a monitor), robotic systems physically interact with the real world - influenced by the results of processing and communications in the cyber domain.
Consider a vision system in an autonomous vehicle that feeds data into decision-making processes to inform whether a hazard has been recognised and the vehicle should halt. In manufacturing, robot arms may lift or move heavy materials, or carry out more specific tasks such as deciding how to cut, shape or weld components together.
With regard to the safety of these robots in the physical domain, the first thing that comes to mind is the use of safety mechanisms. In connected robotic systems, the assurance we place on these systems now relates to their software and hardware components.
Taking automated manufacturing robots as an example: the requirements for flexibility and adaptability - on top of accuracy and precision - further exacerbate the dynamic nature and complexity of the environment they work in. Many of these robots operate in collaboration with, or in environments near, humans. The typical risks associated with working near machinery, such as collision or compression, still exist. However, given the dynamic nature of how robots operate, taking precautions to mitigate the impact of such hazards is highly unpredictable. Traditional machinery follows a fixed setup phase, carries out a specific range of motion and performs only pre-programmed tasks that never vary. In a connected, autonomous assembly line, environmental factors can influence how a robot behaves - meaning traditional safety mechanisms may no longer be adequate. When mobile robots enter this equation, it is simply impossible to fence off an operating area.
Fortunately, many connected robotic systems leverage sensing equipment to provide flexible, fenceless safety systems ideal for close-proximity human interaction. However, some sensing equipment is expensive, which may lead manufacturers or installers to rely on off-the-shelf components to reduce costs. While this may address economic concerns, it does not necessarily guarantee reliability, proper calibration or adequate component life - all of which pose a threat to the accuracy of sensing equipment and, ultimately, to the effectiveness of safety mechanisms.
And of course, this is only talking about physical domain impacts - never mind the threats posed to sensors that are connected.
It is also important to consider the potential for physical compromise. The availability of robots is a significant property that must be upheld, yet is unfortunately the most easily influenced. It has been shown that if a jamming attack - carried out by interfering with communications and signals - was placed at significant points in a road network, this could induce emergency stops at inopportune times, with potentially catastrophic consequences for passengers and other road users. Even if the attack only succeeded in redirecting a vehicle, the next best path would have to be taken - and if an attacker could effectively map where to place these disruptions, entire road networks could come to a halt.
Aside from jamming, replacing sensors with faulty or malicious ones can lead to unintended perturbations in sensor data or captured images. Several incidents have been reported of vehicles incorrectly recognising hazards, leading to major accidents. Sensors are only one type of component that makes up an entire robot - so these two challenges, which represent only a small part of the full threat picture, are just a drop in the pond compared to what we need to understand before deploying robots in the real world.
Takeaway 2. "There are many different components in robots, each of which may have their own security requirements and threats"
The cyber domain
With robots becoming increasingly connected, many forms of physical compromise can now be carried out from the cyber domain - with significant impacts on the physical domain, and vice versa.
Takeaway 3. "Attacks in the cyber domain can pose a threat to anything in the physical domain, and vice versa"
In many modern robots, the component considered most critical when threats are concerned is the electronic control system, which handles input to the robot - commands from a controller or decisions from neural networks - and translates these into actions in the physical domain. Simply put, the majority of all components that make up a robot are, in some way, tied to this master electronic control system.
While there are many attacks possible in the cyber domain, primarily concerning the networks through which robots communicate, consider just a selection of the threats we need to be aware of before deploying robots in real-world, safety-critical scenarios.
One way to classify certain types of cyber attacks on robots is through three categories: attacks that impact the intended actions of a robot (intention modification), attacks that modify messages flowing within networks (intention manipulation), and attacks that cause the robot to ignore an intended action and do something entirely different (hijacking). Attackers can modify commands - even those in flight - compromising integrity in real time. If these commands are tampered with, attackers can manipulate how a robot behaves and potentially cause damage to itself, its environment and nearby humans. While existing solutions such as message integrity checking or encrypted communication channels can help prevent an attacker reading messages, this becomes increasingly more challenging when robots are connected to the public Internet where attackers can target them from anywhere, not just internal networks.
A study in 2018 showed that a large number of robots were exposed to the public Internet - many of which were legitimate robots deployed in the real world, not just in research. Because of this, these robots could be moved to different locations or remotely controlled in other ways, posing potentially significant risks to the robot and its environment. Concerningly, it was not just actuators such as robot arms that could be accessed, but a variety of different sensors including laser rangefinders, cameras and GPS devices. The implications of giving a remote attacker access to a robot's location, or what it sees through its cameras, are significant.
Takeaway 4. "There are many different attacks in the cyber domain, with direct and secondary impacts"
Where do we go from here?
This article does not provide in-depth analysis of the various threats posed to the safety of robots in both the cyber and physical world - it was not meant to. The goal is simply to help readers understand why it is important to focus on securing our robots now, rather than waiting too late and rushing to find quick solutions to current dangers. In most cases, it is far more cost-effective to ensure preventative measures are rigorously tested and put in place to mitigate or entirely prevent attacks from happening, rather than solving problems as they occur.
A narrow summary of the various things we can start to do across these two domains includes the following:
- Ensure the integrity (no modifications) and authenticity (verify the sender) of commands or messages to and from robots
- Maintain tamper-resistant logs and trails of evidence, which allows us to audit and locate sources of failures and malicious behaviours
- Secure communication channels from the likes of tampering, addition of malicious input and hijacking
- Mitigate the impact of physical domain attacks such as jamming and signal saturation
- Ensure that only authenticated and authorised components are used in robots to prevent physical tampering - including not just primary components like sensors and robot arms, but even power and ethernet cables
- Ensure the security of robots at start-up before they begin to operate normally (secure boot)
Takeaway 5. "It is important to get ahead of attackers and mitigate future risks to robots"
More in-depth discussions and additional avenues beyond the physical and cyber domains can be found in my research publications.