Security Architecture for Defining and Enforcing Security Profiles in DLT/SDN-Based IoT Systems.

Area of Science:

• Computer Science
• Cybersecurity
• Network Engineering

Background:

• Internet of Things (IoT) devices face increasing cyber threats due to extensive data and connectivity.
• The Manufacturer Usage Description (MUD) standard offers a solution by defining network access control policies during manufacturing.
• Existing MUD implementations require enhancement to cover broader security aspects.

Purpose of the Study:

• To propose an architecture and process for obtaining and enforcing MUD restrictions during device bootstrapping.
• To extend the MUD model with a flexible policy language for data privacy, channel protection, and resource authorization.
• To leverage Software Defined Networking (SDN) and attribute-based access control for robust IoT security.

Main Methods:

• Defined an architecture and process for MUD policy enforcement during device bootstrapping.
• Extended the MUD model with a flexible policy language for enhanced security attributes.
• Utilized Software Defined Networking (SDN) and attribute-based access control (ABAC) with encryption.
• Integrated a blockchain platform for secure data sharing among devices.

Main Results:

• Successfully implemented and evaluated an architecture for MUD-based IoT security in a real-world scenario.
• Demonstrated the reduction of the attack surface in IoT deployments by restricting device communications.
• Showcased improved data privacy, channel protection, and resource authorization through the extended MUD model.

Conclusions:

• The proposed approach effectively enhances IoT security by enforcing MUD restrictions early in the device lifecycle.
• The integration of SDN, ABAC, and blockchain provides a comprehensive solution for securing sensitive IoT data.
• This method significantly reduces the vulnerability of IoT networks to cyberattacks by proactively managing device communication.