NIST SPECIAL PUBLICATION 1800-15

---

Securing Small-Business and Home Internet of Things (IoT) Devices:

Securing Small-Business and Home Internet of Things (IoT) Devices:

Mitigating Network-Based Attacks Using Manufacturer Usage Description (MUD)

---

Includes Executive Summary (A); Approach, Architecture, and Security Characteristics (B); How-To Guides (C); and Functional Demonstration Results

Donna Dodson*

Douglas Montgomery

Tim Polk

Mudumbai Ranganathan

Murugiah Souppaya

NIST

Steve Johnson

Ashwini Kadam

Craig Pratt

Darshak Thakore

Mark Walker

CableLabs

Eliot Lear

Brian Weis

Cisco

William C. Barker

Dakota Consulting

Dean Coclin

Avesta Hojjati

Clint Wilson

DigiCert

Tim Jones

Forescout

Adnan Baykal

Global Cyber Alliance

Drew Cohen

Kevin Yeich

MasterPeace Solutions, Ltd.

Yemi Fashina

Parisa Grayeli

Joshua Harrington

Joshua Klosterman

Blaine Mulugeta

Susan Symington

The MITRE Corporation

Jaideep Singh

Molex

*Former employee; all work for this publication done while at employer.

FINAL

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.1800-15

Draft versions of this publication is available free of charge from: https://www.nccoe.nist.gov/library/securing-small-business-and-home-internet-things-iot-devices-mitigating-network-based

NIST SPECIAL PUBLICATION 1800-15

Securing Small-Business and Home Internet of Things (IoT) Devices: Mitigating Network-Based Attacks Using Manufacturer Usage Description (MUD)

Includes Executive Summary (A); Approach, Architecture, and Security Characteristics (B); How-To Guides (C); and Functional Demonstration Results (D)

Donna Dodson*

Douglas Montgomery

Tim Polk

Mudumbai Ranganathan

Murugiah Souppaya

NIST

Steve Johnson

Ashwini Kadam

Craig Pratt

Darshak Thakore

Mark Walker

CableLabs

William C. Barker

Dakota Consulting

Dean Coclin

Avesta Hojjati

Clint Wilson

DigiCert

Tim Jones

ForeScout

Adnan Baykal

Global Cyber Alliance

Drew Cohen

Kevin Yeich

MasterPeace Solutions, Ltd.

Yemi Fashina

Parisa Grayeli

Joshua Harrington

Joshua Klosterman

Blaine Mulugeta

Susan Symington

The MITRE Corporation

Jaideep Singh

Molex

*Former employee; all work for this publication done while at employer.

FINAL

May 2021

U.S. Department of Commerce

Gina M. Raimondo, Secretary

National Institute of Standards and Technology

Dr. James K. Olthoff, Performing the non-exclusive functions and duties of the Under Secretary of Commerce for Standards and Technology

Volume A

• Executive Summary
  • Why We Wrote This Guide
  • Challenge
  • Solution
  • How to Use This Guide
  • Supporting Resources
  • Share Your Feedback
  • Technology Partners/Collaborators

Volume B

• 1 Summary
  • 1.1 Challenge
  • 1.2 Solution
  • 1.3 Benefits
• 2 How to Use This Guide
  • 2.1 Typographic Conventions
• 3 Approach
  • 3.1 Audience
  • 3.2 Scope
  • 3.3 Assumptions
  • 3.4 Risk Assessment
    • 3.4.1 Threats
    • 3.4.2 Vulnerabilities
    • 3.4.3 Risk
• 4 Architecture
  • 4.1 Reference Architecture
    • 4.1.1 Support for MUD
    • 4.1.2 Support for Updates
    • 4.1.3 Support for Threat Signaling
    • 4.1.4 Build-Specific Features
  • 4.2 Physical Architecture
• 5 Security Characteristic Analysis
  • 5.1 Assumptions and Limitations
  • 5.2 Security Control Map
  • 5.3 Scenarios
    • 5.3.1 Scenario 1: No MUD or Threat-Signaling Protection
    • 5.3.2 Scenario 2: MUD and Threat-Signaling Protection
• 6 Build 1
  • 6.1 Collaborators
    • 6.1.1 Cisco Systems
    • 6.1.2 DigiCert
    • 6.1.3 Forescout
    • 6.1.4 Molex
  • 6.2 Technologies
    • 6.2.1 MUD Manager
    • 6.2.2 MUD File Server
    • 6.2.3 MUD File
    • 6.2.4 Signature File
    • 6.2.5 DHCP Server
    • 6.2.6 Link Layer Discovery Protocol
    • 6.2.7 Router/Switch
    • 6.2.8 Certificates
    • 6.2.9 IoT Devices
      • 6.2.9.1 MUD-Capable IoT Devices
      • 6.2.9.2 Non-MUD-Capable IoT Devices
    • 6.2.10 Update Server
      • 6.2.10.1 NCCoE Update Server
      • 6.2.10.2 Molex Update Agent
    • 6.2.11 Unapproved Server
    • 6.2.12 MQTT Broker Server
    • 6.2.13 IoT Device Discovery
  • 6.3 Build Architecture
    • 6.3.1 Logical Architecture
    • 6.3.2 Physical Architecture
    • 6.3.3 Message Flow
      • 6.3.3.1 Installation of MUD-Based Access Control Rules for MUD-Capable Devices
      • 6.3.3.2 Updates
      • 6.3.3.3 Prohibited Traffic
      • 6.3.3.4 MQTT Protocol Example
  • 6.4 Functional Demonstration
  • 6.5 Observations
• 7 Build 2
  • 7.1 Collaborators
    • 7.1.1 MasterPeace Solutions
    • 7.1.2 Global Cyber Alliance
    • 7.1.3 DigiCert
  • 7.2 Technologies
    • 7.2.1 MUD Manager
    • 7.2.2 MUD File Server
    • 7.2.3 MUD File
    • 7.2.4 Signature File
    • 7.2.5 DHCP Server
    • 7.2.6 Router/Switch
    • 7.2.7 Certificates
    • 7.2.8 IoT Devices
      • 7.2.8.1 MUD-Capable IoT Devices
      • 7.2.8.2 Non-MUD-Capable IoT Devices
    • 7.2.9 Update Server
      • 7.2.9.1 NCCoE Update Server
    • 7.2.10 Unapproved Server
    • 7.2.11 IoT Device Discovery, Categorization, and Traffic Policy Enforcement–Yikes! Cloud
    • 7.2.12 Display and Configuration of Device Information and Traffic Policies–Yikes! Mobile Application
    • 7.2.13 Threat Agent
      • 7.2.13.1 GCA Quad9 Threat Agent
    • 7.2.14 Threat-Signaling MUD Manager
      • 7.2.14.1 GCA Quad9 MUD Manager
    • 7.2.15 Threat-Signaling DNS Services
      • 7.2.15.1 GCA Quad9 DNS Service
    • 7.2.16 Threat-Signaling API
      • 7.2.16.1 GCA Quad9 Threat API
    • 7.2.17 Threat MUD File Server
      • 7.2.17.1 ThreatSTOP Threat MUD File Server
    • 7.2.18 Threat MUD File
  • 7.3 Build Architecture
    • 7.3.1 Logical Architecture
      • 7.3.1.1 MUD Capability
      • 7.3.1.2 Yikes! Cloud Capability
      • 7.3.1.3 Threat-Signaling Capability
    • 7.3.2 Physical Architecture
    • 7.3.3 Message Flow
      • 7.3.3.1 Installation of MUD-Based Access Control Rules for MUD-Capable Devices
      • 7.3.3.2 Installation of Category-Based Access Control Rules for All Devices
      • 7.3.3.3 Updates
      • 7.3.3.4 Prohibited Traffic
      • 7.3.3.5 DHCP Events
      • 7.3.3.6 Threat Signaling
  • 7.4 Functional Demonstration
  • 7.5 Observations
• 8 Build 3
  • 8.1 Collaborators
    • 8.1.1 CableLabs
    • 8.1.2 DigiCert
  • 8.2 Technologies
    • 8.2.1 MUD Manager
    • 8.2.2 MUD File Server
    • 8.2.3 MUD File
    • 8.2.4 Signature file
    • 8.2.5 Router/Switch
    • 8.2.6 Certificates
    • 8.2.7 IoT Devices
      • 8.2.7.1 MUD-Capable IoT Devices
      • 8.2.7.2 Non-MUD-Capable IoT Devices
    • 8.2.8 Update Server
      • 8.2.8.1 NCCoE Update Server
    • 8.2.9 Unapproved Server
    • 8.2.10 MUD Registry
    • 8.2.11 SDN Controller
    • 8.2.12 Onboarding Manager
    • 8.2.13 User and Device Interface to the Onboarding Manager
    • 8.2.14 Bootstrapping Interface to the Onboarding Manager
    • 8.2.15 Network Onboarding Component
  • 8.3 Build Architecture
    • 8.3.1 Logical Architecture
      • 8.3.1.1 MUD Capability
      • 8.3.1.2 Wi-Fi Easy Connect Device Onboarding
      • 8.3.1.3 On-Premises Micronets
      • 8.3.1.4 Micronets Microservices
      • 8.3.1.5 Intelligent Services and Business Logic
      • 8.3.1.6 Micronets API Framework
    • 8.3.2 Physical Architecture
    • 8.3.3 Message Flow
      • 8.3.3.1 Onboarding MUD-Capable Devices
      • 8.3.3.2 Onboarding Non-MUD-Capable Devices
      • 8.3.3.3 Updates
      • 8.3.3.4 Prohibited Traffic
  • 8.4 Functional Demonstration
  • 8.5 Observations
• 9 Build 4
  • 9.1 Collaborators
    • 9.1.1 NIST Advanced Networking Technologies Laboratory
    • 9.1.2 DigiCert
  • 9.2 Technologies
    • 9.2.1 SDN Controller
    • 9.2.2 MUD Manager
    • 9.2.3 MUD File Server
    • 9.2.4 MUD File
    • 9.2.5 Signature File
    • 9.2.6 DHCP Server
    • 9.2.7 Router/Switch
    • 9.2.8 Certificates
    • 9.2.9 IoT Devices
      • 9.2.9.1 MUD-Capable IoT Devices
      • 9.2.9.2 Non-MUD-Capable IoT Devices
    • 9.2.10 Controller and My-Controller
    • 9.2.11 Update Server
      • 9.2.11.1 NCCoE Update Server
    • 9.2.12 Unapproved Server
  • 9.3 Build Architecture
    • 9.3.1 Logical Architecture
    • 9.3.2 Physical Architecture
    • 9.3.3 Message Flow
      • 9.3.3.1 Installing MUD-Based Access Control Rules for MUD-Capable Devices
      • 9.3.3.2 Updates
      • 9.3.3.3 Prohibited Traffic
      • 9.3.3.4 Installation of Timed-Out Flow Rules and Eventual Consistency
      • 9.3.3.5 DNS Events
  • 9.4 Functional Demonstration
  • 9.5 Observations
• 10 General Findings, Security Considerations, and Recommendations
  • 10.1 Findings
  • 10.2 Security Considerations
  • 10.3 Recommendations
• 11 Future Build Considerations
  • 11.1 Extension to Demonstrate the Growing Set of Available Components
  • 11.2 Recommended Demonstration of IPv6 Implementation
• Appendix A List of Acronyms
• Appendix B Glossary
• Appendix C References

Volume C

• 1 Introduction
  • 1.1 How to Use this Guide
  • 1.2 Build Overview
    • 1.2.1 Usage Scenarios
    • 1.2.2 Reference Architecture Overview
      • 1.2.2.1 Support for MUD
      • 1.2.2.2 Support for Updates
      • 1.2.2.3 Support for Threat Signaling
      • 1.2.2.4 Build-Specific Features
    • 1.2.3 Physical Architecture Overview
  • 1.3 Typographic Conventions
• 2 Build 1 Product Installation Guides
  • 2.1 Cisco MUD Manager
    • 2.1.1 Cisco MUD Manager Overview
    • 2.1.2 Cisco MUD Manager Configurations
      • 2.1.2.1 Hardware Configuration
      • 2.1.2.2 Network Configuration
      • 2.1.2.3 Software Configuration
    • 2.1.3 Setup
      • 2.1.3.1 Preinstallation
      • 2.1.3.2 MUD Manager Installation
      • 2.1.3.3 MUD Manager Configuration
      • 2.1.3.4 FreeRADIUS Installation
      • 2.1.3.5 FreeRADIUS Configuration
      • 2.1.3.6 Start MUD Manager and FreeRADIUS Server
  • 2.2 MUD File Server
    • 2.2.1 MUD File Server Overview
    • 2.2.2 Configuration Overview
      • 2.2.2.1 Network Configuration
      • 2.2.2.2 Software Configuration
      • 2.2.2.3 Hardware Configuration
    • 2.2.3 Setup
      • 2.2.3.1 Apache Web Server
      • 2.2.3.2 MUD File Creation and Signing
  • 2.3 Cisco Switch–Catalyst 3850-S
    • 2.3.1 Cisco 3850-S Catalyst Switch Overview
    • 2.3.2 Configuration Overview
      • 2.3.2.1 Network Configuration
      • 2.3.2.2 Software Configuration
      • 2.3.2.3 Hardware Configuration
    • 2.3.3 Setup
  • 2.4 DigiCert Certificates
    • 2.4.1 DigiCert CertCentral® Overview
    • 2.4.2 Configuration Overview
    • 2.4.3 Setup
      • 2.4.3.1 TLS Certificate
      • 2.4.3.2 Premium Certificate
  • 2.5 IoT Devices
    • 2.5.1 Molex PoE Gateway and Light Engine
      • 2.5.1.1 Configuration Overview
      • 2.5.1.2 Setup
    • 2.5.2 IoT Development Kits–Linux Based
      • 2.5.2.1 Configuration Overview
      • 2.5.2.2 Setup
    • 2.5.3 IoT Development Kit–u-blox C027-G35
      • 2.5.3.1 Configuration Overview
      • 2.5.3.2 Setup
    • 2.5.4 IoT Devices–Non-MUD-Capable
      • 2.5.4.1 Configuration Overview
      • 2.5.4.2 Setup
  • 2.6 Update Server
    • 2.6.1 Update Server Overview
    • 2.6.2 Configuration Overview
      • 2.6.2.1 Network Configuration
      • 2.6.2.2 Software Configuration
      • 2.6.2.3 Hardware Configuration
    • 2.6.3 Setup
  • 2.7 Unapproved Server
    • 2.7.1 Unapproved Server Overview
    • 2.7.2 Configuration Overview
      • 2.7.2.1 Network Configuration
      • 2.7.2.2 Software Configuration
      • 2.7.2.3 Hardware Configuration
    • 2.7.3 Setup
      • 2.7.3.1 Apache Web Server
  • 2.8 MQTT Broker Server
    • 2.8.1 MQTT Broker Server Overview
    • 2.8.2 Configuration Overview
      • 2.8.2.1 Network Configuration
      • 2.8.2.2 Software Configuration
      • 2.8.2.3 Hardware Configuration
    • 2.8.3 Setup
      • 2.8.3.1 Mosquitto Setup
  • 2.9 Forescout–IoT Device Discovery
    • 2.9.1 Forescout Overview
    • 2.9.2 Configuration Overview
      • 2.9.2.1 Network Configuration
      • 2.9.2.2 Software Configuration
      • 2.9.2.3 Hardware Configuration
    • 2.9.3 Setup
      • 2.9.3.1 Forescout Appliance Setup
      • 2.9.3.2 Enterprise Manager Setup
• 3 Build 2 Product Installation Guides
  • 3.1 Yikes! MUD Manager
    • 3.1.1 Yikes! MUD Manager Overview
    • 3.1.2 Configuration Overview
    • 3.1.3 Setup
  • 3.2 MUD File Server
    • 3.2.1 MUD File Server Overview
  • 3.3 Yikes! DHCP Server
    • 3.3.1 Yikes! DHCP Server Overview
    • 3.3.2 Configuration Overview
    • 3.3.3 Setup
  • 3.4 Yikes! Router
    • 3.4.1 Yikes! Router Overview
    • 3.4.2 Configuration Overview
      • 3.4.2.1 Network Configuration
      • 3.4.2.2 Software Configuration
      • 3.4.2.3 Hardware Configuration
    • 3.4.3 Setup
  • 3.5 DigiCert Certificates
  • 3.6 IoT Devices
    • 3.6.1 IoT Development Kits—Linux Based
      • 3.6.1.1 Configuration Overview
      • 3.6.1.2 Setup
  • 3.7 Update Server
  • 3.8 Unapproved Server
  • 3.9 Yikes! IoT Device Discovery, Categorization, and Traffic Policy Enforcement (Yikes! Cloud and Yikes! Mobile Application)
    • 3.9.1 Yikes! IoT Device Discovery, Categorization, and Traffic Policy Enforcement Overview
    • 3.9.2 Configuration Overview
      • 3.9.2.1 Network Configuration
      • 3.9.2.2 Software Configuration
      • 3.9.2.3 Hardware Configuration
    • 3.9.3 Setup
      • 3.9.3.1 Yikes! Router and Account Cloud Registration
      • 3.9.3.2 Yikes! MUD-Capable IoT Device Discovery
      • 3.9.3.3 Yikes! Alerts
      • 3.9.3.4 Yikes! Device Categories and Setting Rules
      • 3.9.3.5 Yikes! Network Rules
  • 3.10 GCA Quad9 Threat Signaling in Yikes! Router
    • 3.10.1 GCA Quad9 Threat Signaling in Yikes! Router Overview
    • 3.10.2 Configuration Overview
    • 3.10.3 Setup
• 4 Build 3 Product Installation Guides
  • 4.1 Product Installation
    • 4.1.1 DigiCert Certificates
    • 4.1.2 MUD Manager
      • 4.1.2.1 MUD Manager Overview
      • 4.1.2.2 Configuration Overview
      • 4.1.2.3 Setup
    • 4.1.3 MUD File Server
      • 4.1.3.1 MUD File Server Overview
      • 4.1.3.2 Configuration Overview
      • 4.1.3.3 Setup
    • 4.1.4 Micronets Gateway
      • 4.1.4.1 Micronets Gateway Overview
      • 4.1.4.2 Configuration Overview
      • 4.1.4.3 Setup
    • 4.1.5 IoT Devices
      • 4.1.5.1 IoT Devices Overview
      • 4.1.5.2 Configuration Overview
      • 4.1.5.3 Setup
    • 4.1.6 Update Server
    • 4.1.7 Unapproved Server
    • 4.1.8 CableLabs MUD Registry
      • 4.1.8.1 CableLabs MUD Registry Overview
      • 4.1.8.2 Configuration Overview
      • 4.1.8.3 Setup
    • 4.1.9 CableLabs Micronets Manager for SDN Control
      • 4.1.9.1 CableLabs Micronets Manager Overview
      • 4.1.9.2 Configuration Overview
      • 4.1.9.3 Setup
    • 4.1.10 Micronets Websocket Proxy
      • 4.1.10.1 Micronets Websocket Proxy Overview
      • 4.1.10.2 Configuration Overview
      • 4.1.10.3 Setup
    • 4.1.11 Micronets iPhone Application for Device Onboarding
      • 4.1.11.1 Micronets iPhone Application Overview
      • 4.1.11.2 Configuration Overview
      • 4.1.11.3 Setup
    • 4.1.12 MSO Portal Bootstrapping Interface to the Onboarding Manager
      • 4.1.12.1 MSO Portal Overview
      • 4.1.12.2 Configuration Overview
      • 4.1.12.3 Setup
  • 4.2 Product Integration and Operation
    • 4.2.1 Adding an MSO Subscriber
      • 4.2.1.1 Prerequisites
      • 4.2.1.2 Instructions
    • 4.2.2 Associating the Micronets Gateway with a Subscriber
      • 4.2.2.1 Prerequisites
      • 4.2.2.2 Instructions
    • 4.2.3 Integrating Micronets Proto-Pi Device
      • 4.2.3.1 Prerequisites
      • 4.2.3.2 Instructions
    • 4.2.4 Updating MUD Registry
      • 4.2.4.1 Prerequisites
      • 4.2.4.2 Instructions
    • 4.2.5 Integrating the Micronets iPhone App with MSO Portal
      • 4.2.5.1 Prerequisites
      • 4.2.5.2 Instructions
    • 4.2.6 Onboarding Micronets Proto-Pi to a Micronet
      • 4.2.6.1 Prerequisites
      • 4.2.6.2 Instructions
    • 4.2.7 Interacting with Micronets Manager
      • 4.2.7.1 Prerequisites
      • 4.2.7.2 Instructions
    • 4.2.8 Removing Micronets Proto-Pi from a Micronet
      • 4.2.8.1 Prerequisites
      • 4.2.8.2 Instructions
    • 4.2.9 Removing an MSO Subscriber
      • 4.2.9.1 Prerequisites
      • 4.2.9.2 Instructions
• 5 Build 4 Product Installation Guides
  • 5.1 NIST SDN Controller/MUD Manager
    • 5.1.1 NIST SDN Controller/MUD Manager Overview
    • 5.1.2 Configuration Overview
      • 5.1.2.1 Hardware Configuration
      • 5.1.2.2 Network Configuration
      • 5.1.2.3 Software Configuration
    • 5.1.3 Preinstallation
    • 5.1.4 Setup
  • 5.2 MUD File Server
    • 5.2.1 MUD File Sever Overview
    • 5.2.2 Configuration Overview
      • 5.2.2.1 Hardware Configuration
      • 5.2.2.2 Network Configuration
      • 5.2.2.3 Software Configuration
    • 5.2.3 Setup
      • 5.2.3.1 MUD File Creation
      • 5.2.3.2 MUD File Signing
      • 5.2.3.3 MUD File Serving
  • 5.3 Northbound Networks Zodiac WX Access Point
    • 5.3.1 Northbound Networks Zodiac WX Access Point Overview
    • 5.3.2 Configuration Overview
      • 5.3.2.1 Network Configuration
      • 5.3.2.2 Software Configuration
      • 5.3.2.3 Hardware Configuration
    • 5.3.3 Setup
  • 5.4 DigiCert Certificates
  • 5.5 IoT Devices
    • 5.5.1 IoT Devices Overview
    • 5.5.2 Configuration Overview
      • 5.5.2.1 Network Configuration
      • 5.5.2.2 Software Configuration
      • 5.5.2.3 Hardware Configuration
    • 5.5.3 Setup
  • 5.6 Update Server
    • 5.6.1 Update Server Overview
    • 5.6.2 Configuration Overview
      • 5.6.2.1 Network Configuration
      • 5.6.2.2 Software Configuration
      • 5.6.2.3 Hardware Configuration
    • 5.6.3 Setup
  • 5.7 Unapproved Server
    • 5.7.1 Unapproved Server Overview
    • 5.7.2 Configuration Overview
      • 5.7.2.1 Network Configuration
      • 5.7.2.2 Software Configuration
      • 5.7.2.3 Hardware Configuration
    • 5.7.3 Setup
• Appendix A List of Acronyms
• Appendix B Glossary
• Appendix C Bibliography

Volume D

• 1 Introduction
  • 1.1 How to Use this Guide
  • 1.2 Functional Demonstration Overview
  • 1.3 Functional Demonstration Activities
  • 1.4 Assumptions
  • 1.5 Document Conventions
  • 1.6 Document Organization
  • 1.7 Typographic Conventions
• 2 Build 1
  • 2.1 Evaluation of MUD-Related Capabilities
    • 2.1.1 Requirements
    • 2.1.2 Test Cases
      • 2.1.2.1 Test Case IoT-1-v4
      • 2.1.2.2 Test Case IoT-2-v4
      • 2.1.2.3 Test Case IoT-3-v4
      • 2.1.2.4 Test Case IoT-4-v4
      • 2.1.2.5 Test Case IoT-5-v4
      • 2.1.2.6 Test Case IoT-6-v4
      • 2.1.2.7 Test Case IoT-7-v4
      • 2.1.2.8 Test Case IoT-8-v4
      • 2.1.2.9 Test Case IoT-9-v4
      • 2.1.2.10 Test Case IoT-10-v4
      • 2.1.2.11 Test Case IoT-11-v4
    • 2.1.3 MUD Files
      • 2.1.3.1 Ciscopi2.json
      • 2.1.3.2 expiredcerttest.json
      • 2.1.3.3 molex.json
      • 2.1.3.4 ublox.json
      • 2.1.3.5 dnstest.json
  • 2.2 Demonstration of Non-MUD-Related Capabilities
    • 2.2.1 Non-MUD-Related Functional Capabilities
    • 2.2.2 Exercises to Demonstrate the Above Non-MUD-Related Capabilities
      • 2.2.2.1 Exercise CnMUD-13-v4
• 3 Build 2
  • 3.1 Evaluation of MUD-Related Capabilities
    • 3.1.1 Requirements
    • 3.1.2 Test Cases
      • 3.1.2.1 Test Case IoT-1-v4
      • 3.1.2.2 Test Case IoT-2-v4
      • 3.1.2.3 Test Case IoT-3-v4
      • 3.1.2.4 Test Case IoT-4-v4
      • 3.1.2.5 Test Case IoT-5-v4
      • 3.1.2.6 Test Case IoT-6-v4
      • 3.1.2.7 Test Case IoT-7-v4
      • 3.1.2.8 Test Case IoT-8-v4
      • 3.1.2.9 Test Case IoT-9-v4
      • 3.1.2.10 Test Case IoT-10-v4
      • 3.1.2.11 Test Case IoT-11-v4
    • 3.1.3 MUD Files
      • 3.1.3.1 Fe-controller.json
      • 3.1.3.2 Fe-localnetwork-from2.json
      • 3.1.3.3 Fe-localnetwork-to2.json
      • 3.1.3.4 Fe-manufacturer1.json
      • 3.1.3.5 Fe-manufacturer2.json
      • 3.1.3.6 Fe-mycontroller.json
      • 3.1.3.7 Fe-samemanufacturer-from2.json
      • 3.1.3.8 Fe-samemanufacturer-to2.json
      • 3.1.3.9 Yikesmain.json
  • 3.2 Demonstration of Non-MUD-Related Capabilities
    • 3.2.1 Terminology
    • 3.2.2 General Overview of Build 2’s Non-MUD Functionality
    • 3.2.3 Non-MUD-Related Functional Capabilities
    • 3.2.4 Exercises to Demonstrate the Above Non-MUD-Related Capabilities
      • 3.2.4.1 Exercise YnMUD-1-v4
      • 3.2.4.2 Exercise YnMUD-2-v4
      • 3.2.4.3 Exercise YnMUD-3-v4
      • 3.2.4.4 Exercise YnMUD-4-v4
      • 3.2.4.5 Exercise YnMUD-5-v4
      • 3.2.4.6 Exercise YnMUD-6-v4
      • 3.2.4.7 Exercise YnMUD-7-v4
• 4 Build 3
  • 4.1 Evaluation of MUD-Related Capabilities
    • 4.1.1 Requirements
    • 4.1.2 Test Cases
      • 4.1.2.1 Test Case IoT-1-v4
      • 4.1.2.2 Test Case IoT-2-v4
      • 4.1.2.3 Test Case IoT-3-v4
      • 4.1.2.4 Test Case IoT-4-v4
      • 4.1.2.5 Test Case IoT-5-v4
      • 4.1.2.6 Test Case IoT-6-v4
      • 4.1.2.7 Test Case IoT-9-v4
      • 4.1.2.8 Test Case IoT-10-v4
      • 4.1.2.9 Test Case IoT-11-v4
    • 4.1.3 MUD Files
      • 4.1.3.1 nist-model-fe_northsouth.json
      • 4.1.3.2 nist-model-fe_mycontroller.json
      • 4.1.3.3 nist-model-fe_controller_anyport.json
      • 4.1.3.4 nist-model-fe_expiredcert.json
      • 4.1.3.5 nist-model-fe_invalidsig.json
      • 4.1.3.6 nist-model-fe_manufacturer1.json
      • 4.1.3.7 nist-model-fe_manufacturer2.json
      • 4.1.3.8 nist-model-fe_manufacturer-from.json
      • 4.1.3.9 nist-model-fe_manufacturer-to.json
      • 4.1.3.10 nist-model-fe_samemanufacturer.json
      • 4.1.3.11 nist-model-fe_samemanufacturer-to.json
      • 4.1.3.12 nist-model-fe_samemanufacturer-from.json
      • 4.1.3.13 nist-model-fe_localnetwork_anyport.json
  • 4.2 Demonstration of Non-MUD-Related Capabilities
    • 4.2.1 Non-MUD-Related Functional Capabilities
    • 4.2.2 Exercises to Demonstrate the Above Non-MUD-Related Capabilities
      • 4.2.2.1 Exercise MnMUD-1
      • 4.2.2.2 Exercise MnMUD-2
      • 4.2.2.3 Exercise MnMUD-3
• 5 Build 4
  • 5.1 Evaluation of MUD-Related Capabilities
    • 5.1.1 Requirements
    • 5.1.2 Test Cases
      • 5.1.2.1 Test Case IoT-1-v4
      • 5.1.2.2 Test Case IoT-2-v4
      • 5.1.2.3 Test Case IoT-3-v4
      • 5.1.2.4 Test Case IoT-4-v4
      • 5.1.2.5 Test Case IoT-5-v4
      • 5.1.2.6 Test Case IoT-6-v4
      • 5.1.2.7 Test Case IoT-9-v4
      • 5.1.2.8 Test Case IoT-10-v4
      • 5.1.2.9 Test Case IoT-11-v4
    • 5.1.3 MUD Files
      • 5.1.3.1 mudfile-sensor.json
      • 5.1.3.2 mudfile-otherman.json