Bridge two secure ROS systems

edit

Hello, I am using ROS 2 Humble and have the following situation: My company is developing ROS code, we have our nodes, topics, etc. Our clients have their own ROS code, nodes, topics, etc.

We want to be able to talk with our clients, however, we don't want to share all our topics, only expose specific ones. Currently we are using ROS_DOMAIN_ID to separate systems and domain_bridge node to connect only necessary topics.

However, we would also like to introduce Secure ROS (SROS2) for security of our system. domain_bridge design doc has "TODO" in "Security" section, I tried running simple example with security enabled anyway, but it failed as expected (keystore depends on domain ID, so certificate only worked for one half of the bridge).

My question is: How can I connect my secure system to the client's (potentially unsecure) one?

I think ideal solution would be domain_bridge which supported separate security configs on each domain, but it's not implemented yet.

Another good-ish solution would be exposing some of the topics of our secure system as unsecure. It would add more security risk, but we would be independent of our client's security setup. However, I couldn't find anywhere that it's even possible to "unsecure" some of the topics in secured ROS system. Any resources on that would be appreciated.

Another solution I could think of would be putting ours' and clients' systems under one security config. However, it would add a lot of coupling of the configurations, we would need to coordinate signing each new permissions file after adding nodes or topics (unless I'm missing something). I don't see it's maintainable in the long term and bigger scale.

I am open to any ideas and suggestions how to solve this issue.