## 6 Enhancing Digital Twins with MUD Profiles
Thus, Figure 6 shows the time and standard deviation (with 30 executions for each value) required for the MUD translation (messages 26-27 from Figure 3) for an MUD file that allows bi-directional connectivity among the devices provided by the same manufacturer. For evaluation purposes, the tests were divided in ten iterations where we considered a deployment of 50-500 IoT devices (with intervals of 50 devices). As shown, the MUD translation process follows a logarithmic progression. This is because, even if an MUD rule could be translated into different MSPL policies, only specific parameters (e.g., IP addresses) are modified. Furthermore, Figure 6 shows the means and standard deviation for the MSPL to final configuration translation process (messages 28-29 in Figure 3). In this case, the results also show a linear progression. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Phase** & **Mean Time (ms)** & **Standard Deviation** \\ \hline Manufacturer Usage Description obtaining & 37.133 & 6.791 \\ Manufacturer Usage Description signature obtaining & 34.833 & 3.905 \\ Manufacturer Usage Description signature verification & 7.733 & 1.964 \\ Total & 79.700 & 8.243 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Manufacturer Usage Description phases performance. Figure 6: MUD translation and enforcement performance. This second translation process requires considerably more time than the first one, since, unlike the first that is basically a data model translation, this second process involves the execution of the software plugin required to generate specific configurations using MSPL. Finally, all the obtained configurations during the policy translation are enforced through the northbound API of the SDN controller (messages 30 to 35, from Figure 3). In this case, the result is also linear since the enforced configurations are quite similar but we can see a slight change in the deviations which is attributed to network latency. Since the MUD file employed (Listing 1 contains rules with the word _same-manufacturer_, and all the devices deployed are from the same manufacturer, each rule leads to the number of devices within the network multiplied by two; a rule limiting the communication from the device, and another one to that device. Although this expressivity is an advantage of the MUD standard, the efforts of generating all the rules, translating, and enforcing them are visible in our results. Figure 7 shows an overview of the time consumption for each phase according to a different number of generated policies. As shown, for a small number of rules, the smart object authentication and MUD enforcement times represent most of the time consumption over the process (45.15% and 36.91%, respectively). However, for a large number of rules, the translation of the MSPL policies and the MUD enforcement become into the most consuming phases. Indeed, for 500 rules, these processes represent the 28.29% and 63.21% respectively. This coincides with the previous results, where the impact of translation and enforcement is highlighted. In this direction, part of our future work is focused on the optimization of MSPL policies translations, while the expressivity of the MUD standard can be still leveraged. This aspect could enhance the potential deployment of MUD in broad-scale scenarios. ## 8 Conclusions

Industry 4.0 represents an emerging IoT-enabled ecosystem with a huge social and economic impact. In a more ubiquitous industrial scenario, security is crucial to cope with the effects of potential attacks, which could lead to a decreasing trust of end users. In this work, we have proposed a proactive security approach to manage a secured and automated deployment of IoT devices behavioral profiles by using an SDN-enabled security architecture and standard technologies. Our mechanism integrates and extends the recent MUD standard architecture, so that only legitimate devices are enabled to access a certain domain, in which security behavioral profiles are enforced to restrict the attack surface.