DOCS demo
Support# Reference Simulation: Cryptographic Identity Verification in Distributed Control Networks **Bauxite Technical Demonstration Suite** *June 2026* --- ```text Reproducibility Repository: docs/demos/imposter/ Environment: Ubuntu 22.04 Kernel 5.15+ Loopback interface Duration: ~15 seconds Output: MCAP recording XDP drop counts Security audit trail Objective: Demonstrate fast-path packet authorization, unauthorized publisher rejection, and automated fallback activation under command spoofing attacks. ``` --- ## Abstract In distributed autonomous systems, physical access to local networks (such as Ethernet or CAN) often grants raw execution privileges to control networks. This paper presents a reference simulation of Bauxite's **Identity-Based Command Authorization** framework, a kernel-level security architecture that enforces zero-trust identity authentication. We demonstrate the defense of a distributed robotic controller's command stream (`/cmd_vel`) against physical packet spoofing. Bauxite uses eBPF/XDP to check packet GUIDs and pre-validated cryptographic tokens in the fast path, dropping unauthorized packets before socket processing. Complete cryptographic validation of node sessions (such as Ed25519 signature checks) is performed out-of-band at channel establishment, allowing lightweight fast-path filtering. We present empirical results from three operational phases: baseline clean operation, a volumetric spoofing attack, and active Bauxite guard protection. The results show that Bauxite rejects unauthorized command payloads at the network interface layer, protecting control loop integrity and preventing unauthorized commands from impacting system state. --- ## 1. Introduction Distributed control networks in robotic and industrial environments rely on internal buses (such as Ethernet switches or CAN buses) to transmit command signals. A primary vulnerability of standard middleware (like ROS2/DDS) is the assumption of network trust: a rogue device connected directly to the network can broadcast command packets (such as steering velocity inputs, `/cmd_vel`) with spoofed identifiers, which are executed blindly by receiver nodes. Bauxite resolves this vulnerability by introducing an **Identity-Based Command Authorization** framework that requires every safety-critical command packet to be authorized before it can be processed. Rather than performing expensive public-key signature verification on every fast-path packet, Bauxite verifies Ed25519 signatures during node session negotiation, mapping authorized node GUIDs to temporary session keys inside eBPF maps. The fast-path filter then checks packet headers against these maps to accept or discard packets at the network interface level. --- ## 2. System Architecture Bauxite's security layer runs directly inside the operating system kernel. Using eBPF (Extended Berkeley Packet Filter) and XDP (eXpress Data Path), Bauxite intercepts incoming command frames at the network interface card (NIC) driver level, before the kernel allocates sockets or buffers. 1. **Identity Verification**: Authorized control nodes establish authenticated channels using Ed25519 signatures. Upon successful validation, session tokens are loaded into kernel-space maps. 2. **Fast-Path Filtering**: The Bauxite eBPF/XDP filter extracts the packet payload, checks the GUID prefix and session token, and drops any packets lacking a valid authorization mapping. 3. **Fallback State Activation**: If the authenticated command stream is interrupted or blocked by the filter due to spoofing detection, the receiver node detects the missing control inputs and automatically transitions to a safe fallback state. --- ## 3. Methodology & Test Environment The simulation environment is designed to evaluate Bauxite's zero-trust signature validation performance: * **Host Setup**: Standard Linux testbed (Ubuntu 22.04 LTS, kernel 5.15). * **Interfaces**: Loopback (`lo`) virtualized network interface. * **Workload Generator**: A custom simulator broadcasts steering commands (`/cmd_vel`) authorized with session tokens (50 Hz). A simulated attacker floods unauthorized command packets at ~2,500 packets/sec to spoof steering commands. The simulation is evaluated across three sequential phases: * **Phase 1: Baseline Clean Operation**: The controller receives validly signed, authorized steering commands. * **Phase 2: Unprotected Spoofing Attack**: A rogue device floods the network with unauthorized spoofed commands while the Bauxite guard is disabled. * **Phase 3: Bauxite Mitigated Operation**: The Bauxite guard is enabled, and spoofed command packets are dropped at the NIC level. ### Running the Demo To run this demo locally and record the telemetry log, run: ```bash ./docs/demos/imposter/run.sh ``` This builds the Rust binary `imposter_demo` and runs the workload generator. The results are output as an MCAP telemetry file in `/tmp/bauxite_recordings/`. ### Visualizing in Foxglove Open Foxglove Studio, choose "Open local file", and select the generated `.mcap` file. Load the custom layout from `docs/demos/imposter/foxglove_layout.json` to view control latencies and XDP packet drops. --- ## 4. Results and Discussion The empirical results aggregated across 10 simulation trials are summarized in the table and chart below. ### System Performance Under Physical Intrusion (10-Trial Summary) | Metric | Standard Stack (Unprotected) | Bauxite Protected | | :--- | :---: | :---: | | **Command authentication** | None | Required | | **Spoofed commands executed** | Yes (Receiver processes spoofed messages) | No | | **Invalid packets rejected** | No | Yes (Filtered at XDP layer) | | **Control stream integrity** | Compromised | Maintained | | **Identity audit log** | None | Available (MCAP Format) | | **Fallback activation** | Manual | Automatic (Missing stream detection) | ### Simulated Fast-Path Drop Rate Timeline  Under standard operation (Phase 1), the controller processes only authorized commands, maintaining a stable state. When the spoofing attack is launched without protection (Phase 2), all spoofed command messages are processed by the receiver, causing command conflicts and control stream compromise. In Phase 3, Bauxite's eBPF filters drop the spoofed packets at the network interface driver layer using the session map. Because the unauthorized commands are rejected early, the control loop remains protected from the spoofing traffic, and the receiver node automatically engages its fallback state. --- ## 5. Conclusion Enforcing a zero-trust model at the network layer is critical for edge robotics. Bauxite's Identity-Based Command Authorization framework protects endpoint command channels against unauthorized publishers connected to the local network while maintaining low fast-path processing overhead by moving signature verification out of the fast path. --- ## Appendix: Raw Telemetry Time-Series Dataset The table below compiles checkpoint parameters and state validation stages recorded during the simulation run, aggregated across 10 trials: | Time (s) | Phase | Invalid Packets Received | Invalid Packets Executed | Fallback State | XDP Drops (cumulative) | | :---: | :---: | :---: | :---: | :---: | :---: | | **0.0** | Clean | 0 | 0 | INACTIVE | 0 | | **2.0** | Clean | 0 | 0 | INACTIVE | 0 | | **4.0** | Clean | 0 | 0 | INACTIVE | 0 | | **5.0** | Attack | approx. 2.5k | approx. 2.5k | INACTIVE | 0 | | **6.0** | Attack | approx. 5.0k | approx. 5.0k | INACTIVE | 0 | | **8.0** | Attack | approx. 10.0k | approx. 10.0k | INACTIVE | 0 | | **10.0** | Attack | approx. 12.5k | approx. 12.5k | INACTIVE | 0 | | **11.0** | Guarded | approx. 12.5k | 0 | ACTIVE | approx. 12.5k | | **13.0** | Guarded | approx. 14.5k | 0 | ACTIVE | approx. 14.5k | | **15.0** | Guarded | approx. 17.0k | 0 | ACTIVE | approx. 17.0k |