The emerging Internet of Things (IoT) has lead to a dramatic increase in type, quantity, and the number of functions that can be offered in a smart environment. Future smart environments will be even richer in terms of the number of devices and functionality provided by them. This poses two major challenges a) an end user has to search through a vast number of IoT devices to identify the suitable devices that satisfy their preferences, and b) it is extremely difficult for users to manually define fine-grained security policies to support workflows involving multiple functions. This paper introduces an intelligent new approach to overcome these challenges by a) enabling users to describe their required functionalities in the form of activity workflow, b) automatically selecting a group of devices to satisfy users functional requirements and maximise their preferences over device usage, c) systematically generating local network access control policies to ensure enforce the principle of least privilege. We study different heuristic search algorithms to find the preferred devices for a given workflow. Experiments results show that the Genetic Algorithm is the best, among the algorithms that we test, as it offers a balance between efficiency and effectiveness.
The main objective of MUD is to introduce the least privilege access required for IoT devices. However, as MUD policy is generated prior to the deployment it cannot define all access endpoints with fine granularity, especially local ones @cite_18 . In contrast to the MUD policy, we propose to use a user defined activity workflow to drive automatic policy establishment. @cite_10 proposed Vigilia, which uses capability-based RMI access control to derive access control policy. However, it requires predefined capability-base access to specify the access between different type of devices prior to the depolyment. This requirement limits the interaction of a device to what is pre-defined in its driver. @cite_3 developed a firewall that automatically generates profiles (i.e. policies) for IoT devices by monitoring their traffic during learning phase. Then enforce the learned policies during the depolyment. This approach work well, but it requires the devices to generate all possible traffic during the learning phase. However, we target the activity automation workflow so that policies can be automatically generated to ensure least privilege access to devices that are part of the workflow
@cite_18 @cite_10 @cite_3
2886897065 2887792592 2114182286 2143884558
The IETF's push towards standardizing the Manufacturer Usage Description (MUD) grammar and mechanism for specifying IoT device behavior is gaining increasing interest from industry. The ability to control inappropriate communication between devices in the form of access control lists (ACLs) is expected to limit the attack surface on IoT devices; however, little is known about how MUD policies will get enforced in operational networks, and how they will interact with current and future intrusion detection systems (IDS). We believe this paper is the first attempt to translate MUD policies into flow rules that can be enforced using SDN, and in relating exception behavior to attacks that can be detected via off-the-shelf IDS. Our first contribution develops and implements a system that translates MUD policies to flow rules that are proactively configured into network switches, as well as reactively inserted based on run-time bindings of DNS. We use traces of 28 consumer IoT devices taken over several months to evaluate the performance of our system in terms of switch flow-table size and fraction of exception traffic that needs software inspection. Our second contribution identifies the limitations of flow-rules derived from MUD in protecting IoT devices from internal and external network attacks, and we show how our system is able to detect such volumetric attacks (including port scanning, TCP UDP ICMP flooding, ARP spoofing, and TCP SSDP SNMP reflection) by sending only a very small fraction of exception packets to off-the-shelf IDS. IoT devices are increasingly being implicated in cyber-attacks, raising community concern about the risks they pose to critical infrastructure, corporations, and citizens. In order to reduce this risk, the IETF is pushing IoT vendors to develop formal specifications of the intended purpose of their IoT devices, in the form of a Manufacturer Usage Description (MUD), so that their network behavior in any operating environment can be locked down and verified rigorously. This paper aims to assist IoT manufacturers in developing and verifying MUD profiles, while also helping adopters of these devices to ensure they are compatible with their organizational policies. Our first contribution is to develop a tool that takes the traffic trace of an arbitrary IoT device as input and automatically generates the MUD profile for it. We contribute our tool as open source, apply it to 28 consumer IoT devices, and highlight insights and challenges encountered in the process. Our second contribution is to apply a formal semantic framework that not only validates a given MUD profile for consistency, but also checks its compatibility with a given organizational policy. Finally, we apply our framework to representative organizations and selected devices, to demonstrate how MUD can reduce the effort needed for IoT acceptance testing. The use of multi-user detection (MUD) in a cooperative CDMA network is investigated for the uplink in synchronous CDMA systems. Suppose that, at any instant in time, part of the users serve as sources while the others serve as relays. The proposed MUD scheme decorrelates the sources' messages at the destination with the help of precoding at the relays. Three cooperation methods are considered: (1) transmit beamforming, (2) selective relaying and (3) distributed space- time coding. The optimal weighting factors of each method are determined by taking the quality of the source-to-relay and or the relay-to-destination links into account. We show that significant improvements in terms of the spatial diversity and multiple-access interference (MAI) mitigation can be attained when precoding is employed at the relays to aid the decorrelation at the destination. The advantages are even more pronounced when selective relaying is combined with the other two schemes. Abstract Many applications in cellular systems and sensor networks involve a random subset of a large number of users asynchronously reporting activity to a base station. This paper examines the problem of multiuser detection (MUD) in random access channels for such applications. Traditional orthogonal signaling ignores the random nature of user activity in this problem and limits the total number of users to be on the order of the number of signal space dimensions. Contention-based schemes, on the other hand, suffer from delays caused by colliding transmissions and the hidden node problem. In contrast, this paper presents a novel pairing of an asynchronous non-orthogonal code-division random access scheme with a convex optimization-based MUD algorithm that overcomes the issues associated with orthogonal signaling and contention-based methods. Two key distinguishing features of the proposed MUD algorithm are that it does not require knowledge of the delay or channel state information of every user and it has polynomial-time computational complexity. The main analytical contribution of this paper is the relationship between the performance of the proposed MUD algorithm in the presence of arbitrary or random delays and two simple metrics of the set of user codewords. The study of these metrics is then focused on two specific sets of codewords, random binary codewords and specially constructed algebraic codewords, for asynchronous random access. The ensuing analysis confirms that the proposed scheme together with either of these two codeword sets significantly outperforms the orthogonal signaling-based random access in terms of the total number of users in the system.