Clear as MUD: Generating, validating and applying IoT behavioral profiles
Date
2018
Authors
Hamza, A.
Ranathunga, D.
Gharakheili, H.H.
Roughan, M.
Sivaraman, V.
Editors
Advisors
Journal Title
Journal ISSN
Volume Title
Type:
Conference paper
Citation
Proceedings of the ACM SIGCOMM 2018 Workshop on IoT Security and Privacy (IoT S&P'18), 2018, pp.8-14
Statement of Responsibility
Ayyoob Hamza, Dinesha Ranathunga, Hassan Habibi Gharakheili, Matthew Roughan, Vijay Sivaraman
Conference Name
ACM SIGCOMM Workshop on IoT Security and Privacy (IoT S&P) (20 Aug 2018 : Budapest)
Abstract
IoT devices are increasingly being implicated in cyber-attacks, raising community concern about the risks they pose to critical infrastructure, corporations, and citizens. In order to reduce this risk, the IETF is pushing IoT vendors to develop formal specifications of the intended purpose of their IoT devices, in the form of a Manufacturer Usage Description (MUD), so that their network behavior in any operating environment can be locked down and verified rigorously. This paper aims to assist IoT manufacturers in developing and verifying MUD profiles, while also helping adopters of these devices to ensure they are compatible with their organizational policies. Our first contribution is to develop a tool that takes the traffic trace of an arbitrary IoT device as input and automatically generates the MUD profile for it. We contribute our tool as open source, apply it to 28 consumer IoT devices, and highlight insights and challenges encountered in the process. Our second contribution is to apply a formal semantic framework that not only validates a given MUD profile for consistency, but also checks its compatibility with a given organizational policy. Finally, we apply our framework to representative organizations and selected devices, to demonstrate how MUD can reduce the effort needed for IoT acceptance testing.
School/Discipline
Dissertation Note
Provenance
Description
Access Status
Rights
© 2018 Association for Computing Machinery.