Skip to content

SECURITY

Security architecture & technology stack

The long-form version of how Qubotix keeps robot fleets secure: the nine architectural principles and the technology stack behind them.

HOW WE KEEP IT SECURE

An honest note first: no serious security company claims to be literally “hack-proof,” and buyers distrust vendors who do. Qubotix's promise is defense-in-depth engineered to the highest current standards, so that compromising a fleet requires defeating many independent layers.

Nine principles

  1. 01

    NIST-standardized algorithms only

    ML-KEM (FIPS 203), ML-DSA (FIPS 204), SLH-DSA (FIPS 205). No homemade cryptography, ever.

  2. 02

    Hybrid cryptography

    Classical + post-quantum together during the migration era; an attacker must break both simultaneously.

  3. 03

    Hardware root of trust

    Keys stored in secure elements / TPMs where the platform provides them; private keys never leave the device.

  4. 04

    Zero-trust fleet identity

    Every robot authenticates on every connection; no implicit trust inside the network; least-privilege command authorization.

  5. 05

    Side-channel-resistant implementation

    Constant-time code paths building on audited open-source implementations (liboqs / PQClean lineage) to resist timing and power-analysis attacks.

  6. 06

    Signed everything

    Firmware, configuration and policy updates are all quantum-safe signed; robots reject unsigned or tampered payloads (secure boot chain).

  7. 07

    Key rotation & revocation

    Short-lived session keys, scheduled identity rotation, and instant fleet-wide revocation of compromised devices.

  8. 08

    Independent validation

    Third-party penetration testing before GA, published SBOM (software bill of materials), a coordinated vulnerability-disclosure program, and a FIPS 140-3 validation path for the crypto module.

  9. 09

    Company-side security

    Signed reproducible builds, hardened CI/CD, and SOC 2 for the SaaS dashboard, so Qubotix itself is not the weak link in the supply chain.

TECHNOLOGY STACK

Technology stack

Technology stack by layer
LayerTechnology
01Embedded coreRust (memory-safe) with C bindings; algorithms from liboqs / PQClean, hardened & optimized for ARM Cortex-M/A and NVIDIA Jetson
02Robot integrationsROS 2 SROS2 / DDS security plugin; MAVLink 2 signing extension; generic C / Rust / Python SDKs
03Transport securityTLS 1.3 & DTLS 1.3 with hybrid ML-KEM groups; MQTT over quantum-safe TLS for telemetry
04Fleet dashboardTypeScript / React frontend; Rust / Go backend; PostgreSQL; cloud KMS / HSM integration for root keys
05OTA update systemSLH-DSA-signed firmware packages; The Update Framework (TUF)-style metadata against rollback attacks
06DevOps & assuranceReproducible builds, fuzzing (cargo-fuzz), static analysis, hardware-in-the-loop test rigs with real Jetson / Pixhawk boards
Embedded core
Rust (memory-safe) with C bindings; algorithms from liboqs / PQClean, hardened & optimized for ARM Cortex-M/A and NVIDIA Jetson
Robot integrations
ROS 2 SROS2 / DDS security plugin; MAVLink 2 signing extension; generic C / Rust / Python SDKs
Transport security
TLS 1.3 & DTLS 1.3 with hybrid ML-KEM groups; MQTT over quantum-safe TLS for telemetry
Fleet dashboard
TypeScript / React frontend; Rust / Go backend; PostgreSQL; cloud KMS / HSM integration for root keys
OTA update system
SLH-DSA-signed firmware packages; The Update Framework (TUF)-style metadata against rollback attacks
DevOps & assurance
Reproducible builds, fuzzing (cargo-fuzz), static analysis, hardware-in-the-loop test rigs with real Jetson / Pixhawk boards
Request a design-partner slotRead the concept paper