Making Access Control Easy in IoT

被引：2

作者：

Andalibi, Vafa ^{[1
]}

Dev, Jayati ^{[1
]}

Kim, DongInn ^{[1
]}

Lear, Eliot ^{[2
]}

Camp, L. Jean ^{[1
]}

机构：

[1] Indiana Univ, Bloomington, IN 47405 USA

[2] Cisco Syst, Zurich, Switzerland

来源：

HUMAN ASPECTS OF INFORMATION SECURITY AND ASSURANCE, HAISA 2021 | 2021年 / 613卷

基金：

美国国家科学基金会;

关键词：

Usable security; Internet of Things; Network security; Usable access control; IoT; MUD; Manufacturer Usage Description;

D O I：

10.1007/978-3-030-81111-2_11

中图分类号：

TP [自动化技术、计算机技术];

学科分类号：

0812 ;

摘要：

Secure installation of Internet of Things (IoT) devices requires configuring access control correctly for each device. In order to enable correct configuration Manufacturer Usage Description (MUD) has been developed by Internet Engineering Task Force (IETF) to automate the protection of IoT devices by micro-segmentation using dynamic access control lists. The protocol defines a conceptually straightforward method to implement access control upon installation by providing a list of every authorized access for each device. This access control list may contain a few rules or hundreds of rules for each device. As a result, validating these rules is a challenge. In order to make the MUD standard more usable for developers, system integrators, and network operators, we report on an interactive system called MUD-Visualizer that visualizes the files containing these access control rules. We show that, unlike manual analysis, the level of the knowledge and experience does not affect the accuracy of the analysis when MUD-Visualizer is used, indicating that the tool is effective for all participants in our study across knowledge and experience levels.

引用

页码：127 / 137

页数：11

共 24 条

[1] Andalibi V., 2019, 2 USENIX WORKSH HOT
[2] Andalibi Vafa, 2021, 5 EAI INT C SAF SEC
[3] A Survey of Botnet Technology and Defenses
Bailey, Michael
Cooke, Evan
Jahanian, Farnam
Xu, Yunjing
Karir, Manish
[J]. CATCH 2009: CYBERSECURITY APPLICATIONS AND TECHNOLOGY CONFERENCE FOR HOMELAND SECURITY, PROCEEDINGS, 2009, : 299 - +
[4] Brooke J., 1996, Usability Evaluation in Industry, V189, P4, DOI [DOI 10.1201/9781498710411-35, 10.1201/9781498710411-35]
[5] Data Exfiltration From Internet of Things Devices: iOS Devices as Case Studies
D'Orazio, Christian J.
Choo, Kim-Kwang Raymond
Yang, Laurence T.
[J]. IEEE INTERNET OF THINGS JOURNAL, 2017, 4 (02): : 524 - 535
[6] Dodson Donna, 2019, Technical Report
[7] Erbenich V.I.P., 2019, HAISA, P179
[8] Clear as MUD: Generating, Validating and Applying IoT Behavioral Profiles
Hamza, Ayyoob
Ranathunga, Dinesha
Gharakheili, Hassan Habibi
Roughan, Matthew
Sivaraman, Vijay
[J]. PROCEEDINGS OF THE 2018 WORKSHOP ON IOT SECURITY AND PRIVACY (IOT S&P '18), 2018, : 8 - 14
[9] Most people are not WEIRD
Henrich, Joseph
Heine, Steven J.
Norenzayan, Ara
[J]. NATURE, 2010, 466 (7302) : 29 - 29
[10] DDoS in the IoT: Mirai and Other Botnets
Kolias, Constantinos
Kambourakis, Georgios
Stavrou, Angelos
Voas, Jeffrey
[J]. COMPUTER, 2017, 50 (07) : 80 - 84

← 1 2 3 →