Verifying and Monitoring IoTs Network Behavior Using MUD Profiles
Verifying and Monitoring IoTs Network Behavior Using MUD Profiles
复制标题
DOI：
10.1109/tdsc.2020.2997898
复制
发表时间：
2019-02
影响因子：
7.3
通讯作者：
Ayyoob Hamza;Dinesha Ranathunga;H. Gharakheili;Theophilus A. Benson;M. Roughan;V. Sivaraman
中科院分区：
文献类型：
--
作者：
Ayyoob Hamza;Dinesha Ranathunga;H. Gharakheili;Theophilus A. Benson;M. Roughan;V. Sivaraman
物联网设备越来越多地参与网络攻击，引起了社区对它们对关键基础设施、企业和公民构成的风险的担忧。为了降低这种风险，IETF正在推动物联网供应商以制造商使用描述（MUD）的形式开发其物联网设备预期用途的正式规范，以便他们在任何操作环境中的网络行为都可以被锁定和严格验证。本文旨在帮助物联网制造商开发和验证MUD配置文件，同时帮助这些设备的采用者确保它们与其组织策略兼容，并使用其MUD配置文件跟踪设备网络行为。我们的第一个贡献是开发一个工具，该工具将任意物联网设备的流量跟踪作为输入，并自动为其生成MUD配置文件。我们将我们的工具作为开源贡献，将其应用于28个消费者物联网设备，并强调在此过程中遇到的见解和挑战。我们的第二个贡献是应用一个正式的语义框架，不仅验证了一个给定的MUD配置文件的一致性，但也检查其与给定的组织政策的兼容性。我们将我们的框架应用于代表性组织和选定的设备，以展示MUD如何减少物联网验收测试所需的工作。最后，我们展示了运营商如何使用已知的MUD配置文件动态识别物联网设备并监控其网络中的行为变化。
IoT devices are increasingly being implicated in cyber-attacks, raising community concern about the risks they pose to critical infrastructure, corporations, and citizens. In order to reduce this risk, the IETF is pushing IoT vendors to develop formal specifications of the intended purpose of their IoT devices, in the form of a Manufacturer Usage Description (MUD), so that their network behavior in any operating environment can be locked down and verified rigorously. This article aims to assist IoT manufacturers in developing and verifying MUD profiles, while also helping adopters of these devices to ensure they are compatible with their organizational policies and track device network behavior using their MUD profile. Our first contribution is to develop a tool that takes the traffic trace of an arbitrary IoT device as input and automatically generates the MUD profile for it. We contribute our tool as open source, apply it to 28 consumer IoT devices, and highlight insights and challenges encountered in the process. Our second contribution is to apply a formal semantic framework that not only validates a given MUD profile for consistency, but also checks its compatibility with a given organizational policy. We apply our framework to representative organizations and selected devices, to demonstrate how MUD can reduce the effort needed for IoT acceptance testing. Finally, we show how operators can dynamically identify IoT devices using known MUD profiles and monitor their behavioral changes in their network.