## 2 Related Work
However, the standard does not define the whole process required for a legitimate device to communicate the corresponding MUD URL. Indeed, it should be noted that, in the case of the first two options, a device may be able to forge its identity and credentials, thus gaining additional network access [5]. To fill this gap, this paper proposes a novel mechanism for obtaining securely and in a trusted way the MUD file during a device's bootstrapping, by using strong authentication between manufacturer and the device. The proposed MUD obtaining is based on Extensible Authentication Protocol (EAP) to enable multi-domain deployments demanded by Industrial IoT. Namely, in our approach, we consider an alternative based on pre-shared key (PSK) authentication, which is realized through the use of standard technologies (such as EAP and PANA) during the bootstrapping process of the device, that is, when the device is deployed on a certain network [22]. The main motivation to consider PSK authentication is that some IoT devices may not be able to manage the use of public key cryptography operations due to resource constraints. Moreover, the MUD specification does not define specific mechanisms for the enforcement of MUD profiles. To deal with this aspect, most of the recent approaches consider the use of SDN for the deployment of the rules contained in a certain MUD file. In particular, the authors in [23] propose an SDN-based architecture to translate MUD policies into flow rules to be enforced. These rules are proactively configured into network switches and used to detect attacks by using an Intrusion Detection System (IDS). The same authors use an SDN-based approach to monitor the compliance of a device's behavior with the corresponding MUD profile [24]. Toward this end, they develop an anomaly detection mechanism to identify potential attacks, such as DoS and Address Resolution Protocol (ARP) spoofing. An SDN-based framework is also considered by [25] for enforcing network access control and mitigating ARP spoofing attacks in the scope of smart homes. For evaluation purposes, they use the online tool _mudmaker_ ([[https://www.mudmaker.org/](https://www.mudmaker.org/)]([https://www.mudmaker.org/](https://www.mudmaker.org/))). Furthermore, an implementation of an SDN-based enforcement approach of MUD profiles is provided in [26]. This implementation is supported by the NIST, and it is publicly available ([[https://github.com/usnistgov/nist-mud](https://github.com/usnistgov/nist-mud)]([https://github.com/usnistgov/nist-mud](https://github.com/usnistgov/nist-mud))). However, these proposals do not provide details or evaluation results related to the translation of the MUD policies into flow rules to be enforced through SDN components. These aspects are summarized in Table 1.  
In contrast to previous approaches, our solution defines an architecture to manage the obtaining and enforcement of MUD profiles. In particular, we integrate both aspects into a bootstrapping mechanism, so that the network components in the deployment domain get the MUD files after the authentication of the IoT device. This way, only behavioral profiles of legitimate devices will be obtained and enforced. Our approach also represents a lightweight alternative to the use of certificates, which are proposed in the MUD standard. This aspect is crucial to ensure the deployment of the standard even in the presence of constrained devices or networks. Another advantage is the use of standard technologies for the process, which is transparent for the IoT device being deployed. Furthermore, this approach is integrated into the SDN-based architecture defined in the scope of the H2020 EU project ANASTACIA [10]. Such architecture follows a policy-based approach, so that MUD profiles are translated into an intermediate policy language before being translated into flow rules to be enforced by SDN switches. This intermediate translation provides a flexible approach, so potential changes in the MUD representation do not affect the rules enforcement.