So, we've got a ROS application running on a robot, which is going to be distributed to potential partners/customers. The code on the robot's computer will be compiled, but we want to add extra layers of security so that people wouldn't have as easy a time getting inside (to read/decompile/reverse-enginner it) and to the compiled binaries and we are looking at encryption as a potential way to do that.
The main computer on the robot is an Nvidia Jetson, so it's basically running a slightly modified ubuntu on it, and the communication to it will be done through a web-app via websocket.
Options we have considered:
- encrypting the compiled binary files of the app
- encrypting a partition on the robot's computer where the app would live
- encrypting the whole disk
In the first case, the binaries would have to be decrypted before being run, which we think kind of defeats the pupose?
In the second and third cases - is there a point to either of them? Can we run the app from within the partition/disk without having to undo the encryption first? And if we cannot, doesn't that still open it up to basically the same vulnerabilities apart from being accessed by someone who's just pulled the hard disk off the computer?
Is just going with something like setting user groups and restricting permissions and access in that way a viable alternative option?
p.s.: any tips on securing the webserver and websocket connections for the web-application would also be appreciated