# US 2019/0319953 A1 · Secure modification of manufacturer usage description files based on device applications > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2019/0319953 A1 - Document ID: US20190319953A1 - Status: Published application - Kind: A1 - Application number: 15/954,875 - Filed: 2018-04-17 - Published: 2019-10-17 - Earliest claimed: 2018-04-17 - Assignees: Cisco Technology, Inc. - Applicants: Cisco Technology, Inc. - Inventors: Eliot Lear; Christopher S. Steck; Brian Weis - Web page: https://patentgrep.com/patent/US20190319953A1 ## CPC - H04L 63/10: {for controlling access to devices or network resources} - H04L 9/0643: {Hash functions, e.g. MD5, SHA, HMAC or f9 MAC} - H04L 9/0891: {Revocation or update of secret information, e.g. encryption key update or rekeying} - H04L 9/3263: {involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823)} - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L 63/102: {Entity profiles} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 63/101: {Access control lists [ACL]} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Techniques for providing secure modification of manufacturer usage description (MUD) files based on device applications are provided. In one embodiment, a method for secure modification of MUD files may include obtaining a request for one or more applications from a device. The method also includes providing to the device the one or more applications and a certification that includes an updated MUD identifier determined based on the one or more applications requested. The updated MUD identifier is associated with a concatenated MUD file that comprises individual MUD file portions for each of the one or more applications requested. The device is configured to request an updated device identifier using the certification. The updated device identifier includes the updated MUD identifier that is associated with the concatenated MUD file. ## Claims ### Claim 1 A method comprising: obtaining a request for one or more applications from a device; providing to the device the one or more applications and a certification that includes an updated manufacturer usage description (MUD) identifier determined based on the one or more applications requested; and wherein the updated MUD identifier is associated with a concatenated MUD file that comprises individual MUD file portions for each of the one or more applications requested. ### Claim 2 (depends on 1) The method according to claim 1, wherein the device is configured to request an updated device identifier using the certification, and wherein the updated device identifier includes the updated MUD identifier that is associated with the concatenated MUD file. ### Claim 3 (depends on 1) The method according to claim 1, wherein the concatenated MUD file is configured to provide access control permissions for the device. ### Claim 4 (depends on 3) The method according to claim 3, wherein the access control permissions are enforced by an access control device in communication with the device. ### Claim 5 (depends on 1) The method according to claim 1, wherein the one or more applications include at least a first application; and wherein the concatenated MUD file comprises at least a first MUD file portion associated with the first application. ### Claim 6 (depends on 1) The method according to claim 1, wherein the device is associated with a first device identifier; and wherein the first device identifier includes a first MUD identifier, the first MUD identifier is associated with a first MUD file for the device, the first MUD file being different from the concatenated MUD file. ### Claim 7 (depends on 1) The method according to claim 1, further comprising dynamically generating the concatenated MUD file based on the updated MUD identifier. ### Claim 8 (depends on 7) The method according to claim 7, wherein the updated MUD identifier includes information about the one or more applications requested by the device. ### Claim 9 (depends on 1) The method according to claim 1, wherein the device includes at least one application that is pre-loaded on the device; and wherein the device includes a MUD identifier associated with a modified initial MUD file for the device that includes a MUD file portion associated with the at least one application pre-loaded on the device. ### Claim 10 An apparatus comprising: a communication interface configured to enable network communications; and a processor coupled with the communication interface, and configured to: obtain a request for one or more applications from a device; provide to the device the one or more applications and a certification that includes an updated manufacturer usage description (MUD) identifier determined based on the one or more applications requested; and wherein the updated MUD identifier is associated with a concatenated MUD file that comprises individual MUD file portions for each of the one or more applications requested. ### Claim 11 (depends on 10) The apparatus of claim 10, wherein the device is configured to request an updated device identifier using the certification, and wherein the updated device identifier includes the updated MUD identifier that is associated with the concatenated MUD file. ### Claim 12 (depends on 10) The apparatus according to claim 10, wherein the one or more applications include at least a first application; and wherein the concatenated MUD file comprises at least a first MUD file portion associated with the first application. ### Claim 13 (depends on 10) The apparatus according to claim 10, wherein the device is associated with a first device identifier; and wherein the first device identifier includes a first MUD identifier, the first MUD identifier is associated with a first MUD file for the device, the first MUD file being different from the concatenated MUD file. ### Claim 14 (depends on 10) The apparatus according to claim 10, wherein the processor is configured to dynamically generate the concatenated MUD file based on the updated MUD identifier. ### Claim 15 (depends on 14) The apparatus according to claim 14, wherein the updated MUD identifier includes information about the one or more applications requested by the device ### Claim 16 A system comprising: at least one device; an access control device in communication with the at least one device, the access control device being configured to enforce access control permissions on a communication network for the at least one device; an authenticator entity in communication with the at least one device, the authenticator entity configured to provide device identifiers; a manufacturer application service apparatus in communication with the at least one device, the manufacturer application service apparatus comprising a communication interface configured to enable network communications on the communication network, and a processor coupled with the communication interface, and configured to: obtain a request for one or more applications from the at least one device; provide to the at least one device the one or more applications and a certification that includes an updated manufacturer usage description (MUD) identifier determined based on the one or more applications requested; and wherein the updated MUD identifier is associated with a concatenated MUD file that comprises individual MUD file portions for each of the one or more applications requested. ### Claim 17 (depends on 16) The system according to claim 16, wherein the at least one device is configured to request an updated device identifier from the authenticator entity using the certification, and wherein the updated device identifier includes the updated MUD identifier that is associated with the concatenated MUD file. ### Claim 18 (depends on 16) The system according to claim 16, wherein the access control device is configured to provide access control permissions for the at least one device based on the concatenated MUD file. ### Claim 19 (depends on 16) The system according to claim 16, wherein the one or more applications include at least a first application; and wherein the concatenated MUD file comprises at least a first MUD file portion associated with the first application. ### Claim 20 (depends on 16) The system according to claim 16, wherein the at least one device is associated with a first device identifier; and wherein the first device identifier includes a first MUD identifier, the first MUD identifier is associated with a first MUD file for the at least one device, the first MUD file being different from the concatenated MUD file. ### Claim 21 (depends on 20) The system according to claim 20, wherein the access control device changes the access control permissions for the at least one device from the access control permissions associated with the first MUD file to the access control permissions associated with the concatenated MUD file.