# Enterprise Security for the Internet of Things (IoT): Lightweight Bootstrapping with EAP-NOOB
## 9 Discussion  
Network selection is one important aspect of our bootstrapping solution that we have not discussed thus far. A newly unboxed IoT device has no mechanism of knowing the appropriate network to which it should try to connect. In the presence of several networks, we require the device to perform the EAP-NOOB Initial Exchange with each of them and then transfer one URL per available network over the OOB channel. URLs are accompanied by network meta information obtained by the device. This meta information can include beacon payloads, which may help the user to identify his network. A similar approach to network selection is also used by Zigbee. Naturally, the OOB channel is limited by the number of bytes that can be transferred reliably in a few seconds. If there are more than 2-3 potential networks, a simple blinking LED light cannot transfer the OOB messages that are required for the EAP-NOOB protocol to successfully complete. Additional hints can also be used in order to reduce the number of potential networks. For example, Zigbee controllers include an \"Allow Join\" flag in their beacon when users are adding a new device. Controller devices also ensure that this flag is propagated to all routers in the network. A new device being added can examine this flag to limit the number of potential networks it probes. One of the most serious threats against our implementation of EAP-NOOB is that we rely on HTTPS and a web browser on the user's phone for delivering the OOB message between the device and the server. We expect users to identify the meta information of their network and the URL of their management server before entering any login credentials and adding a new device. Otherwise, an attacker can setup a network that mimics the honest user's home network and a management server whose URL is only subtly different from what the user expects. Consequently, the attacker's fake management server could capture either the honest user's login credentials or take control of the new device. To avoid such attacks in practice, users  
Figure 9: Time for each phase with Carrier Sense Multiple Access (CSMA) and Time Slotted Channel Hopping (TSCH). must verify that the URL received over the OOB message indeed opens a secure HTTPS connection to the management server where he has an account. These attacks require the attacker's network to be within range of the device being added and a careless user who does not check the URL before entering his login credentials while adding a new device. The usual phishing countermeasures apply here: user education and logging into the management server through a bookmark or a trusted portal page before scanning the blinking light. We also counter the chances of such an attack in our implementation. On the device side, we ignore server that send non HTTPS links. Our Android application includes additional countermeasures to prevent users from inadvertently opening malicious URLs. We allow users to enter the details of their management server (URL and login details) before adding any device. Thus, instead of showing all the URLs received over the OOB channel to the user, we only show the one for the user's management server. In practical real-world deployments, the user may be asked to download a companion smartphone application before bootstrapping an IoT device. The smartphone application might come pre-configured with the correct server URL. Such pre-configuration inherently protects careless users from registering their new devices with an attacker. EAP-NOOB, like any EAP method, requires the setting up of a trust relation between the controller and management server. However, from then on, it saves the work of performing any additional configuration when new devices are added. This initial trust configuration requires setting up of peering between the controller device and AAA management server such that the EAP packets are securely forwarded. This peering is typically based on protocols, such as RADIUS or DIAMETER.