MeshGuard: MUD-Based Network Access Control for Large-Scale Thread-Powered IoT Networks

Computer Science > Cryptography and Security [Submitted on 29 May 2026] MeshGuard: MUD-Based Network Access Control for Large-Scale Thread-Powered IoT Networks Dominik Roy George, Wouter van Hoof, Habib Mostafaei, Savio Sciancalepore The IETF standard Manufacturer Usage Description (MUD) enables manufacturers to equip IoT devices with certified URLs that provide traffic profiles for those devices, helping administrators enforce network access control. However, MUD assumes devices operate on full IP stacks and therefore does not account for constrained IoT devices running Thread--the dominant low-power mesh networking standard--which lacks complete TCP/IP functionality. While prior work proposes extensions to support MUD in Thread environments, these approaches are limited to simple topologies with a single border router and do not scale to realistic deployments with multiple, heterogeneous border routers. We introduce MeshGuard, a framework enabling MUD-based access control in complex Thread networks, with any number of border routers. MeshGuard extends the Mesh Link Establishment (MLE) protocol to deliver MUD information from constrained devices to border routers regardless of network topology. Moreover, MeshGuard leverages Software-Defined Networking (SDN) to synchronize access control lists across all routers. Experiments on our proof-of-concept with real devices (nRF5340, nRF52833, Raspberry-Pi 3) demonstrate enhanced security, minimal overhead, and linear scalability compared to state-of-the-art approaches. Comments: Accepted at IEEE/IFIP DSN 2026 - 56th Annual IEEE/IFIP International Conference on Dependable Systems and Networks Subjects: Cryptography and Security (cs.CR); Networking and Internet Architecture (cs.NI) Cite as: arXiv:2605.31326 [cs.CR]   (or arXiv:2605.31326v1 [cs.CR] for this version)   https://doi.org/10.48550/arXiv.2605.31326 Focus to learn more Journal reference: IEEE/IFIP DSN 2026 - 56th Annual IEEE/IFIP International Conference on Dependable Systems and Networks Submission history From: Savio Sciancalepore [view email] [v1] Fri, 29 May 2026 14:00:42 UTC (463 KB) Access Paper: HTML (experimental) view license Current browse context: cs.CR < prev   |   next > new | recent | 2026-05 Change to browse by: cs cs.NI References & Citations NASA ADS Google Scholar Semantic Scholar Export BibTeX Citation Bookmark Bibliographic Tools Bibliographic and Citation Tools Bibliographic Explorer Toggle Bibliographic Explorer (What is the Explorer?) Connected Papers Toggle Connected Papers (What is Connected Papers?) Litmaps Toggle Litmaps (What is Litmaps?) scite.ai Toggle scite Smart Citations (What are Smart Citations?) Code, Data, Media Demos Related Papers About arXivLabs Which authors of this paper are endorsers? | Disable MathJax (What is MathJax?)