Systematic Verification of IoT Device Conformance to Ietf Manufacturer Usage Description Standard

The exponential growth of vulnerable Internet-of-Things (loT) devices, like networked cameras, sensors, or actuators, has raised concerns about the cybersecurity risks they pose to individuals, organizations, governments, and the Internet at large. Ensuring the integrity and security of these devices and their networks is crucial and requires immediate attention. However, implementing robust security measures on devices can be costly, and imposing stringent requirements may pose challenges for many manufacturers. A network-level approach appears promising and more practical, particularly with the adoption of the Manufacturer Usage Description (MUD) standard ratified by the Internet Engineering Task Force (IETF), which fundamentally aids in reducing network attack surfaces. This article aims to enhance the adoption of this lightweight standard by proposing a systematic approach to verify the conformity of IoT devices with MUD specifications. Our specific contributions are threefold. (1) We map the standard MUD specifications, as described in RFC8520, into 26 specific tests that focus on three critical components: IoT devices, cloud servers, and content of MUD files; (2) We categorize these tests into six progressive levels, allowing for gradual adoption of and staged conformance to the MUD standard; and, (3) We build a testbed, configure a Raspberry Pi device to represent a reference device under test (DUT), develop an automated software tool that performs 26 specific tests on the DUT, and evaluate the conformity of more than 70 MUD files from two public repositories.