Secure modification of manufacturer usage description files based on device applications

Patent metadata

Field	Value
Publication number	US-11902277-B2
Application number	US-202117235284-A
Country	US
Kind code	B2
Filing date	Apr 20, 2021
Priority date	Apr 17, 2018
Publication date	Feb 13, 2024
Grant date	Feb 13, 2024

Abstract

Techniques for providing secure modification of manufacturer usage description (MUD) files based on device applications are provided. In one embodiment, a method for secure modification of MUD files may include obtaining a request for one or more applications from a device. The method also includes providing to the device the one or more applications and a certification that includes an updated MUD identifier determined based on the one or more applications requested. The updated MUD identifier is associated with a concatenated MUD file that comprises individual MUD file portions for each of the one or more applications requested. The device is configured to request an updated device identifier using the certification. The updated device identifier includes the updated MUD identifier that is associated with the concatenated MUD file.

First claim

What is claimed is:

1. A method comprising:
determining one or more applications that are installed on a device, the device having associated therewith a first device identifier; and
generating a certification that includes an updated manufacturer usage description (MUD) identifier determined based on the one or more applications, wherein the updated MUD identifier is associated with a concatenated MUD file that comprises at least two individual MUD file portions that at least in part are based on the one or more applications installed on the device,
wherein the first device identifier includes a first MUD identifier that is associated with a first MUD file for the device, the first MUD file being different from the concatenated MUD file.

2. The method of claim 1 , wherein the concatenated MUD file is configured to provide access control permissions for the device.

3. The method of claim 2 , wherein the access control permissions are enforced by an access control device in communication with the device.

4. The method of claim 1 , wherein the one or more applications include at least a first application and a second application, and
wherein the concatenated MUD file comprises at least a first MUD file portion associated with the first application and a second MUD file portion associated with the second application.

5. The method of claim 1 , further comprising dynamically generating the concatenated MUD file based on the updated MUD identifier.

6. The method of claim 1 , wherein the updated MUD identifier is a modified initial MUD file for the device and is different from an initial MUD file based on the one or more applications pre-loaded on the device.

7. The method of claim 1 , further comprising:
obtaining a request for one or more applications, from the device, via a communication network to which the device is attached with one or more access control permissions specified in an initial MUD file identified by an initial MUD identifier.

8. The method of claim 1 , wherein the device is an Internet of Things device that is embedded with information to identify a location of an initial MUD file different from the concatenated MUD file.

9. The method of claim 1 , wherein the at least two individual MUD file portions include one or more network policies regarding communications of each of the one or more applications.

10. An apparatus comprising:
a communication interface configured to enable network communications; and
a processor coupled with the communication interface, and configured to:
determine one or more applications that are installed on a device, the device having associated therewith a first device identifier; and
generate a certification that includes an updated manufacturer usage description (MUD) identifier determined based on the one or more applications, wherein the updated MUD identifier is associated with a concatenated MUD file that comprises at least two individual MUD file portions that at least in part are based on the one or more applications installed on the device,
wherein the first device identifier includes a first MUD identifier that is associated with a first MUD file for the device, the first MUD file being different from the concatenated MUD file.

11. The apparatus of claim 10 , wherein the concatenated MUD file is configured to provide access control permissions for the device.

12. The apparatus of claim 11 , wherein the access control permissions are enforced by an access control device in communication with the apparatus via the communication interface.

13. The apparatus of claim 10 , wherein the one or more applications include at least a first application and a second application, and
wherein the concatenated MUD file comprises at least a first MUD file portion associated with the first application and a second MUD file portion associated with the second application.

14. The apparatus according to claim 10 , wherein the processor is further configured to dynamically generate the concatenated MUD file based on the updated MUD identifier.

15. The apparatus of claim 10 , wherein the processor is further configured to:
obtaining a request for one or more applications, from the device, via a communication network to which the device is attached with one or more access control permissions specified in an initial MUD file identified by an initial MUD identifier.

16. The apparatus of claim 10 , wherein the at least two individual MUD file portions include one or more network policies regarding communications of each of the one or more applications.

17. A system comprising:
at least one device;
an access control device in communication with the at least one device, the access control device being configured to enforce access control permissions on a communication network for the at least one device;
an authenticator entity in communication with the at least one device, the authenticator entity configured to provide device identifiers; and
a manufacturer application service apparatus in communication with the at least one device, the manufacturer application service apparatus comprising a communication interface configured to enable network communications on the communication network, and a processor coupled with the communication interface, and configured to:
determine one or more applications that are installed on the at least one device, the at least one device having associated therewith a first device identifier; and
generate a certification that includes an updated manufacturer usage description (MUD) identifier determined based on the one or more applications, wherein the updated MUD identifier is associated with a concatenated MUD file that comprises at least two individual MUD file portions that at least in part are based on the one or more applications installed on the at least one device,
wherein the first device identifier includes a first MUD identifier that is associated with a first MUD file for the at least one device, the first MUD file being different from the concatenated MUD file.

18. The system according to claim 17 , wherein the at least one device is configured to request an updated device identifier from the authenticator entity using the certification, and wherein the updated device identifier includes the updated MUD identifier that is associated with the concatenated MUD file.

19. The system according to claim 17 , wherein the access control device is configured to provide access control permissions for the at least one device based on the concatenated MUD file.

20. The system according to claim 17 , wherein the one or more applications include at least a first application and a second application, and
wherein the concatenated MUD file comprises at least a first MUD file portion associated with the first application and a second MUD file portion associated with the second application.

Assignees

• Cisco Tech Inc

Inventors

• Lear Eliot
• Steck Christopher S
• Weis Brian

Classifications

• H04L63/10 Primary

  for controlling access to devices or network resources · CPC title

• H04L9/3263 Primary

  involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823) · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/101

  Access control lists [ACL] · CPC title

• H04L9/0891

  Revocation or update of secret information, e.g. encryption key update or rekeying · CPC title