## 6 Enhancing Digital Twins with MUD Profiles
The Policy Interpreter implements the translator from MSPL into SDN low-lever configurations understandable by ONOS controller, namely set of ONOS northbound APIs calls. ### Smart Object Authentication and MUD Obtaining

The delay required for each message during the smart object authentication phase (see Section 5 is shown in Table 3. Each value represents the time of receiving and processing a message, and the delay to generate the next one according to the process. As shown, the messages to be processed by the smart object (with constrained capabilities) require more delay, specially the EAP Success (message 36), in which the device receives the cryptographic material to generate the shared secret. According to these partial times, the total delay for the authentication process requires a mean time of 4454.164 milliseconds. This delay is acceptable taking into account the advantages provided by our approach in terms of flexibility, multi-domain, and standardization properties. It should be noted that our approach is an alternative to the use of certificates, as proposed in the MUD standard. In that case, the use public key cryptography could be unfeasible in devices with tight resource constraints. Furthermore, the use of certificates requires the transport of more heavy messages that could have a negative impact, especially in the case of Low Power and Lossy Networks (LLN). \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Component** & **Hardware** & **Role** & **Software** \\ \hline Smart Object & Zolertia Z1 with 92 kB of nominal & EAP peer & Cooja (Contiki OS 2.7) \\  & ROM and 8 kB of RAM & PANA Client & OpenPana \\ \hline Authentication & Linux Ubuntu VM with 2 GB of RAM, & & \\ Authentication & 30 GB HDD and a processor Intel(R) Core(TM) & EAP Authenticator & FreeRadius 2.0.2. \\ Agent & i7-8550U at 1.9 GHz, using 1 core & PAA & OpenPana \\ \hline AAA Server & Linux Ubuntu VM with 2 GB of RAM, & & \\ AAA Server & 30 GB HDD and a processor Intel(R) Core(TM) & AAA Server & FreeRadius 2.0.2. \\  & i7-8550U at 1.9 GHz, using 1 core & EAP Server & C application \\ \hline \multirow{4}{*}{MUD Manager} & Intel Core Processor (Haswell) at 1.5 GHz & IoT Controller & Python application \\  & using 2 vCores, 2 GB of RAM and 15 GB of HDD & SDN Orchestrator & Django 2.2.2 and Falcon 2.0 \\ \cline{1-1}  & Intel(R) Core(TM) i7-2600 CPU at 3.4 GHz, & SDN Controller & ONOS \\ \cline{1-1}  & using 3 vCores, 3.5 GB of RAM & Policy Interpreter & Django 2.2.2 and Falcon 2.0 \\ \cline{1-1}  & and 30 GB of HDD & SDN Controller & ONOS \\ \hline \multirow{4}{*}{MUD Server} & Linux Ubuntu VM with 2 GB of RAM, & & \\ \cline{1-1}  & 30 GB HDD and a processor Intel(R) Core(TM) & MUD Server & Apache 2.4.39 \\ \cline{1-1}  & i7-8550U at 1.9 GHz, using 1 core & & \\ \hline Border router & Zolertia Z1 with 92 kB of nominal & & \\ \cline{1-1}  & ROM and 8 kB of RAM & Border router & Contiki OS 2.7 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Testbed specifications. Regarding the MUD Obtaining phase, we distinguish three steps according to Figure 3: MUD file obtaining (messages 17-18), MUD signature obtaining (messages 19-20 ), and the validation of the MUD signature. Table 4 shows the time measurement for these steps. For these values, we used the MUD file shown in Listing 1 and an Elliptic Curve Digital Signature Algorithm (ECDSA). signature of 256 bits generated through OpenSSL 1.1.1 ([[https://www.openssl.org/](https://www.openssl.org/)]([https://www.openssl.org/](https://www.openssl.org/))). ### Translating and Enforcing MUD Rules

Regarding the MUD translation phase, the MUD model provides high-level terms like \"same-manufacturer\", which must be translated in specific deployed devices provided by the same manufacturer. We use these aspects to evaluate the scalability of our approach.