You are here:

4. Restrictions when Using RTI Security Plugins

4.1 When to Set Security Parameters

You must set the security-related participant properties before you create a participant (see the tables in 5. Authentication). You cannot create a participant without security and then call DomainParticipant::set_qos() with security properties, even if the participant has not yet been enabled.

4.2 Impact of Using Security Plugins

Enabling Security Plugins may affect the timing of Connext DDS discovery, causing your applications to behave slightly differently when starting your system. With Security Plugins enabled, two additional processes need to happen before data is successfully exchanged between two applications: first, the two involved DomainParticipants need to complete authentication, which is a three-way handshake process; then, each one of the secured DataWriters and DataReaders need to exchange the key material for protecting the data. Endpoints need to exchange this key material so that protected (encrypted or signed) payloads and submessages can be decrypted and verified.

If protected data, such as user samples, arrive before the key material exchange is complete, this protected data is dropped by Connext DDS. Only samples exchanged over non-volatile, reliable channels (i.e., a channel with the Reliability QoS kind set to RELIABLE, and Durability QoS kind other than VOLATILE) will be resent if they're dropped due to incomplete key material exchange. Since key material exchange is required with Security Plugins, and it takes some additional time for this exchange to occur before endpoints begin accepting data, more data may be sent as repair traffic than in scenarios without Security Plugins enabled.

As a result, if your application starts writing data samples right after enabling the DataWriter, you may observe those initial samples to take longer to be received (if using RELIABLE reliability) or to not be received at all (if using BEST_EFFORT reliability), even if those samples were usually received when not using Security Plugins. (They could also have been lost even if not using security, if discovery was not completed at the time of writing the sample.)

Another consideration is that using the "Generic.Security" profile for enabling security also does some tuning to the reliability protocol parameters for endpoint discovery traffic. The goal of this tuning is to shorten discovery times; however, the configured parameters could be too aggressive for some systems, significantly increasing network traffic during the discovery phase. These parameters can be tuned down by explicitly configuring the following DiscoveryConfigQosPolicy's publication_writer and subscription_writer values: fast_heartbeat_period to 1 sec, late_joiner_heartbeat_period to 1 sec, and max_heartbeat_retries to 30.