## 1 Introduction  
In recent years, the integration of Internet of Things (IoT) technologies in industrial environments has enabled the development of the well-known Industry 4.0 or Industrial Internet of Things (IIoT) [1]. This concept has been widely recognized as one of the main pillars for economic growth at the European level in order to improve the efficiency of industrial sectors such as automotive or telecom equipment [2] With the increasing digitalization of the industry, systems and components can be continuously and remotely accessed to be monitored during their development cycle and deployment. Like in other IoT-enabled scenarios, security concerns rise in an increasingly pervasive industrial environment. Indeed, security concerns could lead to huge economic losses for manufacturers, as well as a decrease in users' trust in the IIoT [3]. The recent and well-known attacks and botnets (e.g., Mirai [4]) underline the need for approaches to the detection, analysis, and mitigation of cybersecurity attacks in IoT devices. In most of the cases, the issue is not a single device itself, but the huge potential number of devices and systems that may be affected. An effective detection process is the first step to react to potential attacks efficiently. For this, it is crucial to identify the expected operation of a certain device in order to detect possible anomalies in its behavior. However, the definition of these behavioral profiles can be challenging due to the heterogeneity of IoT devices, in which a wide variety of technologies and protocols can be used with different configurations. Toward this end, the Manufacturer Usage Description (MUD) [5] has been recently proposed as an Internet Engineering Task Force (IETF) standard. standard for definingthe intended use of specific-purpose devices. The main objective is to limit the attack surface of a certain device by defining policies or Access Control Lists (ACLs) to restrict the communication with other devices or services. MUD has received a significant interest from the industry, and is considered by the National Institute of Standards and Technology (NIST). as a promising approach for the protection of IoT devices against denial of service (DoS) attacks [6]. In fact, the standard is intended for device manufacturers to define the behavior profile of their devices in order to facilitate a secure and automated deployment. The MUD approach defines an architecture and format for the specification of the ACLs, but it does not define specific mechanisms for obtaining and enforcing such policies in a trusted and secured way. We believe that the definition of these processes based on standard technologies is crucial to encourage the use and deployment of the MUD standard. To address such needs, this work proposes the design and implementation of a security architecture for obtaining and enforcing MUD policies through the use of Software-Defined Networks (SDN) [7]. First, we define a lightweight mechanism for obtaining the MUD file through the integration and extension of the MUD architecture. For this, we propose the use of the Protocol for carrying Authentication for Network Access (PANA) [8] as a standard protocol for the transport of Extensible Authentication Protocol (EAP) [9] authentication messages. This way, the obtaining of the MUD file is carried out once the device has been correctly authenticated by the corresponding network components. Additionally, we base our approach on pre-shared key (PSK) authentication, in order to accommodate our approach into devices with tight resource constraints. Second, we propose an SDN architecture that is responsible for translating MUD policies into rules to be enforced by SDN switches. In particular, the proposed SDN approach is based on some of the components of the security management architecture proposed in the scope of the EU H2020 ANASTACIA project [10].