Manufacturer Usage Descriptions
MUD attempts to address this problem by capitalizing on the assumptions that, unlike the general-purpose computers we use to surf the Web, IoT devices have a single or small number of uses, and that these uses may be tied to a predictable set of communications patterns. For example, it is unlikely that your Internet-enabled toothbrush–a real world device that uses a built-in camera to capture and report on dental hygiene–is going to need access to Netflix. If that toothbrush attempts to access Netflix, something fishy is happening. Since manufacturers are the ones that designed these Things, they are in a very good position to document what sort of access they need.
Put in terms that network administrators might find useful, device manufacturers are in a very good position to provide us most of what we need in IP-based access lists for their devices. MUD provides the basic framework to enable manufacturers to provide policy that can be used to generate IP-based access lists. The astute will notice that manufacturers cannot know what IP addresses should be listed in an access list. To address that issue, MUD establishes some abstractions, such as “my-controller”, “controller {URI}”, “same-manufacturer”, “manufacturer”, and the use of domain names, with the idea being that each will map to one or more devices that the device should be allowed to access, or not. These abstractions build upon and augment the IETF’s brand new access control list (ACL) model (RFC 8519). A simple example of how to construct a “MUD file” can be found at MUD File Maker.
The MUD file itself is served up via HTTPS, just like any other file. It thus has a URL associated with it. What is left is for devices to output that URL such that deployments can retrieve it. This can be done in any number of ways, including via DHCP (RFC 2131 and RFC 8415), Link Layer Discovery Protocol (LLDP), or, my favorite, via a device certificate in an EAP-TLS or Tunnel Extensible Authentication Protocol (TEAP) transaction (RFC 7170) .