Actuation-Level Protection
Varoa Enforcer protects cyber-physical systems against cyber-physical threats by moving the security perimeter directly to the physical boundary: the actuation level. By deploying Intelligent Actuation Nodes (IAN) at each motor, joint, or axis, both inbound commands and return telemetry are cryptographically authenticated at the hardware layer.
> SECURE_BUS: ENFORCER_NODE_01 ACTIVE
> DRIVE_CMD: STATUS_NOMINAL=1
Architectural Insight
"The bus is contested space."
Assuming the internal communication bus (CAN-FD, EtherCAT, etc.) is contested space, security cannot reside in the controller alone. It must be distributed directly to the actuation level. Varoa Enforcer establishes cryptographic verification and a hardware-controlled authority boundary at the actuator. Reference designs may use galvanic isolation where required by the electrical, safety, or threat model.
Inside a machine, the actuator bus is a shared highway
Many deployed actuator networks rely primarily on bus access and protocol conformance rather than per-actuator cryptographic authority. Where command authentication and freshness are absent, a device with bus access may be able to inject or replay traffic that appears structurally valid.
One way in, access to everything
A shared bus is a highway. Reach it through a service port, a physical tap, or one weak peripheral, and you can talk to every joint on that segment.
Injection is cheap
Standard buses carry commands in the clear. Inexpensive, off-the-shelf hardware is enough to listen in and inject commands that look legitimate to the motors.
Replay works
Without per-command freshness, a captured "move" or "release brake" sequence can be played back later to cause unauthorized motion.
No proof of identity
An unsecured bus can't tell a genuine controller or motor from a swapped-in clone. Trust is assumed, not verified.
The comfortable assumption - 'the enclosure is sealed and the network is secured, so the bus is safe' - does not hold. U.S. GAO report 19-128 found that security testers routinely bypassed network defenses, and once inside, the control bus was wide open.
Varoa starts from the opposite assumption: the bus is contested space.
From "trust by default" to "verify everything"
Who can command a motor
Anything that reaches the wire or bus
Only an authenticated source the actuator already trusts
Command integrity
Often none - commands taken at face value
Every command is cryptographically authenticated
Replaying old commands
Usually possible
Rejected - commands have to be fresh
Feedback / telemetry
One-way or unverified
Authenticated two-way, so the readings can be trusted too
Component identity
Assumed
Hardware-bound identity for every actuator
Electrical noise / interference
Can be misread as real commands → erratic motion
Spurious signals cannot pass authentication; physics-informed analysis provides additional evidence for interference-versus-suspicious-activity triage
Behavior under attack
Unpredictable - runaway or hard crash
Graduated security states ending in a hardware-enforced security lockout; distinct from functional-safety STO
Same machine, same motors. The difference is whether the last inch of control trusts everything by default - or verifies everything by design.
Technical Breakdown
IAN
Intelligent Actuation Node
- Hardware-isolated security domains
- Cryptographic command validation
- Isolated sensor monitoring path
AAC
Actuation Authority Controller
- Coordinated fleet policy control
- High-availability command routing
- Unalterable audit trail logs
Energy Gating
Hardware-Enforced Isolation
Hardware-enforced safe state overriding software commands. De-asserts drive-enable at the actuation level independently of the software controller, with high-speed galvanic isolation available where the electrical, safety, or threat model requires it, securing against unauthorized physical movement.
Security State Machine
| State | Condition | Response | Indicator |
|---|---|---|---|
| NORMAL | Attested credentials; nominal operation | Full operating envelope | ACTIVE |
| DEGRADED | Minor environmental anomalies | Reduced authority; automatic recovery | WARN |
| ALERT | Repeated anomalies / suspected interference | Further reduced authority; controlled motion | ALERT |
| LOCKOUT | Confirmed attack / integrity failure | Hardware energy gate de-asserted; re-auth needed | HALT |
These are cybersecurity states. They are distinct from functional-safety Safe Torque Off (STO) - Varoa complements your safety architecture and does not replace it.
Physics-informed discrimination
Cryptography establishes who issued a command. It cannot tell whether a correctly authenticated command makes physical sense, or whether an anomaly is electrical noise or deliberate manipulation. Enforcer adds physics-informed filtering, which checks commands and telemetry against what the actuator can physically do, and cross-signal analysis, which correlates independent signals rather than trusting any one in isolation. Together they provide evidence for separating likely environmental interference from suspicious manipulation, informing graduated state transitions rather than a single trip to lockout.
Calibration and validation are specific to the actuator and deployment environment. Complete diagnostic, integration, and verification specifications are available in our secure Customer Portal.
About Us
Varoa is a 100% Canadian-owned cyber-physical security company headquartered in Edmonton, Alberta. We are dedicated to securing cyber-physical systems against cyber-physical threats at the actuation level. Through hardware-enforced trust mechanisms, we protect next-generation autonomous systems and fleets. The core technology powering Varoa Enforcer is patent pending with the USPTO.
Get in Touch
Contact our engineering team to request technical documents, reference designs, firmware integration guides, or licensing information.