Manufacturer Usage Description Specification

Lear, Eliot; Romascanu, Dan; Droms, Ralph

doi:10.17487/rfc8520

Cited by 144 publications

(144 citation statements)

References 0 publications

Supporting

Mentioning

143

Contrasting

Unclassified

Order By: Relevance

“…For this reason, the MUD standard could be considered as a relevant effort to define the devices' intended behavior during the manufacturing phase. The aim of the MUD standard [2] is to reduce the attack surface of a certain specific-purpose device by delegating the task of creating a behavioral profile to the manufacturers rather than a network administrator. Some examples of these restrictions could be "allow communications between devices of the same manufacturer" or "deny the access to a specific service though a specific port".…”

Section: Motivation Challenges and Proposed Solutionsmentioning

confidence: 99%

“…One of the main initiatives to enhance security aspects in IoT devices is the usage of behavioral profiles, which describe the intended behavior of a device. Indeed, the realization of this concept has been mainly driven by the recent Manufacturer Usage Description (MUD) [2], which is an IETF standard encouraging manufacturers to represent the allowed/denied network communications of their devices through a simple and flexible data format. The behavioral profiles can be used to configure the device before it joins the network, in order to reduce the attack surface as well as to monitor its behavior to detect suspicious behaviors (e.g., due to an ongoing attack).…”

Section: Introductionmentioning

confidence: 99%

“…One of the most significant approaches is the Policy Core Information Model (PCIM) [17] standard from the IETF, which was used in several European projects focused on policy frameworks, such as PoSecCo (https://cordis.europa.eu/project/id/257129) and POSITIF (https://cordis.europa.eu/project/id/ 002314), to represent firewall and channel protection configurations, due to its high expressiveness.Other approaches have been proposed in last years, such as those proposed by Molloy et al [18] and by Barrera et al [19], which define a novel policy enforcement architecture to restrict the network behavior of IoT devices. Another more recent standard to specify these policies is the YANG Data Model for Network Access Control Lists (ACLs) [20], which is considered in the MUD standard [2]. MUD gives the responsibility to the manufacturer to specify the expected network behavior of an IoT device, describing the communications allowed to/from the device.…”

mentioning

confidence: 99%

“…Other approaches have been proposed in last years, such as those proposed by Molloy et al [18] and by Barrera et al [19], which define a novel policy enforcement architecture to restrict the network behavior of IoT devices. Another more recent standard to specify these policies is the YANG Data Model for Network Access Control Lists (ACLs) [20], which is considered in the MUD standard [2]. MUD gives the responsibility to the manufacturer to specify the expected network behavior of an IoT device, describing the communications allowed to/from the device.…”

mentioning

confidence: 99%

See 3 more Smart Citations

Security Architecture for Defining and Enforcing Security Profiles in DLT/SDN-Based IoT Systems

Matheu

Robles-Enciso

Zarca

et al. 2020

Sensors

View full text Add to dashboard Cite

Despite the advantages that the Internet of Things (IoT) will bring to our daily life, the increasing interconnectivity, as well as the amount and sensitivity of data, make IoT devices an attractive target for attackers. To address this issue, the recent Manufacturer Usage Description (MUD) standard has been proposed to describe network access control policies in the manufacturing phase to protect the device during its operation by restricting its communications. In this paper, we define an architecture and process to obtain and enforce the MUD restrictions during the bootstrapping of a device. Furthermore, we extend the MUD model with a flexible policy language to express additional aspects, such as data privacy, channel protection, and resource authorization. For the enforcement of such enriched behavioral profiles, we make use of Software Defined Networking (SDN) techniques, as well as an attribute-based access control approach by using authorization credentials and encryption techniques. These techniques are used to protect devices’ data, which are shared through a blockchain platform. The resulting approach was implemented and evaluated in a real scenario, and is intended to reduce the attack surface of IoT deployments by restricting devices’ communication before they join a certain network.

show abstract

Section: Motivation Challenges and Proposed Solutionsmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

mentioning

confidence: 99%

mentioning

confidence: 99%

See 2 more Smart Citations

Security Architecture for Defining and Enforcing Security Profiles in DLT/SDN-Based IoT Systems

Matheu

Robles-Enciso

Zarca

et al. 2020

Sensors

View full text Add to dashboard Cite

show abstract

“…Existing works using offline/pre-defined policies such as manufacturer usage descriptions (MUD) [23] are not sufficient for dynamic IoT environments [19]. The MUDs are defined offline by IoT vendors to specifiy what network access is required for a particular IoT device to work properly [23]. For example, a coffee maker may only require inbound and outbound access to a cloud service on TCP port 443.…”

Section: Introductionmentioning

confidence: 99%

Automatic Device Selection and Access Policy Generation Based on User Preference for IoT Activity Workflow

Al-Shaboti

Chen

Welch

2019

2019 18th IEEE International Conference on Trust, Security and Privacy in Computing and Communications/13th IEEE International

View full text Add to dashboard Cite

The emerging Internet of Things (IoT) has lead to a dramatic increase in type, quantity, and the number of functions that can be offered in a smart environment. Future smart environments will be even richer in terms of number of devices and functionality provided by them. This poses two major challenges a) an end user has to search through a vast number of IoT devices to identify the suitable devices that satisfy their preferences, and b) it is extremely difficult for users to manually define fine-grained security policies to support workflows involving multiple functions.This paper introduces an intelligent new approach to overcome these challenges by a) enabling users to describe their required functionalities in the form of activity workflow, b) automatically selecting a group of devices to satisfy users functional requirements and maximise their preferences over device usage, c) systematically generating local network access control policies to ensure enforce the principle of least privilege. We study different heuristic search algorithms to find the preferred devices for a given workflow. Experiments results show that the Genetic Algorithm is the best, among the algorithms that we test, as it offers a balance between efficiency and effectiveness.

show abstract