Enhancing, Expanding, and Automating MUD 

Manufacturer Usage Description (MUD) is a whitelisting-based access control framework allowing IoT manufacturers to publish their devices’ legitimate communications by specifying the permitted end-points and flows using domain names and port\protocol information. In this talk, we present three independent enhancements to the MUD framework.

 First, while MUD services typically run on the CPE at the LAN-level, we suggest applying MUD at the ISP-level, thus providing a more scalable solution. We present a demo that summarizes our successful PoC with a large nation-level ISP. 

 Secondly, some end-points with which an IoT device may communicate are not associated with a domain-name, making it impossible to specify them accurately in a MUD file (e.g., cases of  P2P or local end-points within the LAN).   We thus extend the MUD  architecture to enable accurate specification of such end-points. We then discuss our experience of implementing the solution using osMUD. 

Thirdly, while the MUD philosophy is that vendors specify the MUD files, we suggest that for IoT vendors that do not provide MUD files, the files can be automatically acquired from IoT traffic in-the-wild. Combining the automatic acquisition with the first enhancement, the ISP-level architecture, improves both considerably. 

 Integrating all three enhancements together considerably strengthen and expand the MUD effectiveness and provide a higher security level. 

 The work presented here is the cumulative product of several projects done in part with: Yehuda Afek, David Hay, Ran Goldschmidt, Lior Shafir, Gafnit Abraham, Avraham Shalev, Ihab Zhaika, Haim Levy, Zohar Yakhini, Bar Meyuhas and Ran Shuster.