Secure modification of manufacturer usage description files based on device applications

Patent metadata

Field	Value
Publication number	US-11025628-B2
Application number	US-201815954875-A
Country	US
Kind code	B2
Filing date	Apr 17, 2018
Priority date	Apr 17, 2018
Publication date	Jun 1, 2021
Grant date	Jun 1, 2021

Abstract

Techniques for providing secure modification of manufacturer usage description (MUD) files based on device applications are provided. In one embodiment, a method for secure modification of MUD files may include obtaining a request for one or more applications from a device. The method also includes providing to the device the one or more applications and a certification that includes an updated MUD identifier determined based on the one or more applications requested. The updated MUD identifier is associated with a concatenated MUD file that comprises individual MUD file portions for each of the one or more applications requested. The device is configured to request an updated device identifier using the certification. The updated device identifier includes the updated MUD identifier that is associated with the concatenated MUD file.

First claim

What is claimed is:

1. A method comprising:
obtaining a request for one or more applications from a device;
providing to the device the one or more applications and a certification that includes an updated manufacturer usage description (MUD) identifier determined based on the one or more applications requested; and
wherein the updated MUD identifier is associated with a concatenated MUD file that comprises at least two individual MUD file portions, each for a corresponding application.

2. The method according to claim 1 , wherein the device is configured to request an updated device identifier using the certification, and wherein the updated device identifier includes the updated MUD identifier that is associated with the concatenated MUD file.

3. The method according to claim 1 , wherein the concatenated MUD file is configured to provide access control permissions for the device.

4. The method according to claim 3 , wherein the access control permissions are enforced by an access control device in communication with the device.

5. The method according to claim 1 , wherein the one or more applications include at least a first application and a second application; and
wherein the concatenated MUD file comprises at least a first MUD file portion associated with the first application and a second MUD file portion associated with the second application.

6. The method according to claim 1 , wherein the device is associated with a first device identifier; and
wherein the first device identifier includes a first MUD identifier, the first MUD identifier is associated with a first MUD file for the device, the first MUD file being different from the concatenated MUD file.

7. The method according to claim 1 , further comprising dynamically generating the concatenated MUD file based on the updated MUD identifier.

8. The method according to claim 7 , wherein the updated MUD identifier includes information about the one or more applications requested by the device.

9. The method according to claim 1 , wherein the device includes at least one application that is pre-loaded on the device; and
wherein the device includes a MUD identifier associated with a modified initial MUD file for the device that includes a MUD file portion of the at least two individual MUD file portions, associated with the at least one application pre-loaded on the device.

10. The method according to claim 1 , wherein obtaining the request for the one or more applications from the device includes:
obtaining the request via a communication network to which the device is attached with one or more access control permissions specified in an initial MUD file identified by an initial MUD identifier.

11. The method according to claim 1 , wherein the device is an Internet of Things device that is embedded with information to identify a location of an initial MUD file.

12. An apparatus comprising:
a communication interface configured to enable network communications; and
a processor coupled with the communication interface, and configured to:
obtain a request for one or more applications from a device;
provide to the device the one or more applications and a certification that includes an updated manufacturer usage description (MUD) identifier determined based on the one or more applications requested; and

wherein the updated MUD identifier is associated with a concatenated MUD file that comprises at least two individual MUD file portions, each for a corresponding application.

13. The apparatus of claim 12 , wherein the device is configured to request an updated device identifier using the certification, and
wherein the updated device identifier includes the updated MUD identifier that is associated with the concatenated MUD file.

14. The apparatus according to claim 12 , wherein the one or more applications include at least a first application and a second application: and
wherein the concatenated MUD file comprises at least a first MUD file portion associated with the first application and a second MUD file portion associated with the second application.

15. The apparatus according to claim 12 , wherein the device is associated with a first device identifier; and
wherein the first device identifier includes a first MUD identifier, the first MUD identifier is associated with a first MUD file for the device, the first MUD file being different from the concatenated MUD file.

16. The apparatus according to claim 12 , wherein the processor is configured to dynamically generate the concatenated MUD file based on the updated MUD identifier.

17. The apparatus according to claim 16 , wherein the updated MUD identifier includes information about the one or more applications requested by the device.

18. A system comprising:
at least one device;
an access control software service in communication with the at least one device, the access control software service being configured to enforce access control permissions on a communication network for the at least one device;
an authenticator software service in communication with the at least one device, the authenticator software service configured to provide device identifiers;
a manufacturer application service apparatus in communication with the at least one device, the manufacturer application service apparatus comprising a communication interface configured to enable network communications on the communication network, and a processor coupled with the communication interface, and configured to:
obtain a request for one or more applications from the at least one device;
provide to the at least one device the one or more applications and a certification that includes an updated manufacturer usage description (MUD) identifier determined based on the one or more applications requested; and

wherein the updated MUD identifier is associated with a concatenated MUD file that comprises at least two individual MUD file portions, each for a corresponding application.

19. The system according to claim 18 , wherein the at least one device is configured to request an updated device identifier from the authenticator software service using the certification, and wherein the updated device identifier includes the updated MUD identifier that is associated with the concatenated MUD file.

20. The system according to claim 18 , wherein the access control software service is configured to provide access control permissions for the at least one device based on the concatenated MUD file.

21. The system according to claim 18 , wherein the one or more applications include at least a first application and a second application; and
wherein the concatenated MUD file comprises at least a first MUD file portion associated with the first application and a second MUD file portion associated with the second application.

22. The system according to claim 18 , wherein the at least one device is associated with a first device identifier; and
wherein the first device identifier includes a first MUD identifier, the first MUD identifier is associated with a first MUD file for the at least one device, the first MUD file being different from the concatenated MUD file.

23. The system according to claim 22 , wherein the access control software service changes the access control permissions for the device from the access control permissions associated with the first MUD file to the access control permissions associated with the concatenated MUD file.

Assignees

• Cisco Tech Inc

Inventors

• Lear Eliot
• Steck Christopher S
• Weis Brian

Classifications

• H04L9/0891

  Revocation or update of secret information, e.g. encryption key update or rekeying · CPC title

• H04L63/102

  Entity profiles · CPC title

• H04L9/3263 Primary

  involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823) · CPC title

• H04L9/0643

  Hash functions, e.g. MD5, SHA, HMAC or f9 MAC · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title