How Does MUD Control Access for IoT Devices?

TL;DR

MUD limits an IoT device to its approved communication profile, while a MUD-capable router blocks connections outside that profile. The device provides a MUD URL, the MUD manager retrieves and validates the signed JSON policy, and the resulting traffic filter applies an allowlist with a final deny rule. Threat signaling can add separate near real-time blocklisting.

Transcript

Really looking forward to the first presentation this morning to kick us all off, and we're gonna be speaking about mitigating network-based attacks using MUD. So for that, I'd love you all to welcome please, Dr. Parisa Grelli and Blaine Mulugeta. Good morning. Thank you for joining us bright and early Wednesday morning. I'm Parisa Grelli. I will b... Read More

Key Insights

• MUD is an additional network security layer that restricts an IoT device to its intended communication profile. It does not replace cybersecurity hygiene on the device, but limits unauthorized traffic when a vulnerable device is compromised or attempts connections outside its expected behavior.
• A MUD file is a JSON document containing the communication profile of an IoT device. The file and its signature reside on a MUD file server that can be hosted and managed by the device manufacturer or by a third party acting for the manufacturer.
• A MUD-capable IoT device emits its MUD URL when it connects to a network. The presentation identifies DHCP, LLDP, and X.509 as supported ways to communicate the URL, which points toward the server hosting the device's MUD file.
• The MUD manager retrieves both the MUD file and its signature through an HTTPS connection. It validates that the policy originated from the correct MUD file server and verifies that the file has not been altered before approving it for enforcement.
• The MUD manager converts a validated communication policy into a traffic filter for the router. The implementation can use mechanisms such as access lists, IP tables, or IP routes, depending on the architecture and products selected for a particular deployment.
• MUD enforcement works as an allowlist followed by a deny-all rule. Traffic matching approved communications, such as contact with the device manufacturer's update server, is permitted, while attempts to reach unrelated local devices or unauthorized external systems are rejected.
• Threat signaling is a separate security capability rather than part of MUD. While MUD allowlists intended destinations, threat signaling supplies near real-time blocklisting information and can tell the router to reject traffic to an approved destination if that destination becomes compromised.
• MUD components can be arranged flexibly across physical systems. A router, MUD manager, and some threat-signaling capabilities may be combined in one device for a home, while other deployments can separate them on premises or place the MUD manager in the cloud.

Questions & Answers

Q: What is Manufacturer Usage Description for IoT devices?

Manufacturer Usage Description, or MUD, is a network security approach defined by IETF RFC 8520. It uses a device-specific communication profile to identify the network connections an IoT device should be allowed to make. A MUD-capable router permits traffic within that profile and rejects traffic outside it, adding protection without replacing the device's own cybersecurity hygiene.

Q: How does MUD restrict an IoT device's network access?

MUD restricts access by turning the device's approved communication profile into a traffic filter enforced by a router. Connections listed in the profile, such as communication with a smartphone or the manufacturer's update server, can proceed. Connections not listed, such as unnecessary traffic to a printer or camera, are dropped under the filter's final deny-all rule.

Q: What information is stored in a MUD file?

A MUD file is described as a JSON file containing the communication profile of an IoT device. That profile defines the network interactions the device is intended to perform. The file resides on a MUD file server together with a signature file, and both may be hosted and managed by the manufacturer or a third party working for it.

Q: How does an IoT device provide its MUD URL?

When a MUD-capable IoT device boots and connects to the network, it emits a MUD URL that identifies the location of its MUD policy. The presentation identifies DHCP, LLDP, and X.509 as delivery methods. For DHCP, the URL can be placed in the packet's optional portion, allowing the router to extract and forward it.

Q: What does a MUD manager do?

A MUD manager receives the device's MUD URL from the router, connects to the corresponding file server through HTTPS, and retrieves the MUD file and its signature. It validates the policy's source and integrity, translates the approved JSON policy into a traffic filter, and sends that filter to the router for network enforcement.

Q: How is a MUD file validated before enforcement?

The MUD manager retrieves both the MUD file and its signature from the MUD file server. It uses the signature to check that the file came from the correct server and that its contents have not been tampered with. Only after those checks give the file a stamp of approval is it translated into an enforceable traffic filter.

Q: How does threat signaling differ from MUD?

MUD and threat signaling provide different forms of network control. MUD acts as an allowlist by permitting communications defined in the device's intended profile and denying everything else. Threat signaling acts as a blocklist, using near real-time information to reject destinations that have become unsafe, even when a destination such as an update server was originally approved.

Q: Where can the router and MUD manager be deployed?

The logical architecture does not require every component to be a separate physical device. A router and MUD manager can be combined, potentially with some threat-signaling functions, which suits a home deployment. Other builds can place the router and manager on separate on-premises systems, or keep the router on premises while hosting the MUD manager in the cloud.

Summary & Key Takeaways

• Manufacturer Usage Description, defined by IETF RFC 8520, adds network-level access control for IoT devices without replacing basic cybersecurity hygiene. It reduces opportunities for compromised devices to contact unauthorized systems, pivot to other local devices, join botnets, or participate in network-based attacks such as distributed denial-of-service attacks.

• A MUD-capable device communicates its MUD URL through DHCP, LLDP, or X.509 when connecting to the network. The router extracts that URL and forwards it to a MUD manager, which establishes an HTTPS connection to the file server, retrieves the JSON MUD file and signature, and validates their authenticity and integrity.

• After validating the policy, the MUD manager translates the MUD file into a traffic filter and sends it to the router. Implementations can use access lists, IP tables, or IP routes. Components may share one physical device, remain separate on premises, or place the MUD manager in the cloud.