# Secure Authentication and Credential Establishment in Narrowband IoT and 5G
## 3 Background
### Lo-CoAP-Eap  
LO-CoAP-EAP [10] is a low-overhead bootstrapping protocol integrating a Constrained Application Protocol (CoAP) as an EAP lower layer for constrained IoT devices, also known as smart objects. In fact, the LO-CoAP-EAP protocol is based on three standards: an Authentication, Authorization, and Accounting (AAA) infrastructure [25], an EAP protocol [26], and a CoAP [27]. Furthermore, this solution is included in recent standardization efforts of IETF, such as the \"Secure IoT Bootstrapping\" draft [28]. The LO-CoAP-EAP solution allows for a good balance of performance, flexibility, scalability, and technology independence for enabling secure authentication and the generation of fresh keying material in limited IoT devices. The integrated techniques enable an important group of features to LO-CoAP-EAP. First, the integration of the CoAP protocol allows for the implementation of a lightweight bootstrapping procedure as a service of CoAP. This solution enables a wireless technology independence because it is runs over the UDP/IP stack. Unlike PANA-based solutions, LO-CoAP-EAP is based on a CoAP, an application protocol used by most of IoT devices for machine-to-machine (M2M) communications. This reduces the code size and complexity because it does not need a new protocol to transport the EAP IP messages to perform the bootstrapping process. Moreover, LO-CoAP-EAP employs AAA infrastructures to enable enhanced properties such as identity federation, supporting more scalable deployments with multi-domain scenarios. The inclusion of an EAP allows different IoT devices and organizations to use different authentication mechanisms (based on symmetric keys, certificates, etc.) depending on their requirements. Finally, as well as PANA, LO-CoAP-EAP enables the key derivation to be employed to protect the end-to-end communications, so that the IoT device can be included as a trustworthy entity in the application domain. The design of LO-CoAP-EAP considers the limitations of IoT devices in terms of computing capacities, low power consumption, and wireless communication technologies (LPWAN) such as NB-IoT. Figure 1: Protocol flow of PANA with a generic EAP method (EAP-X) _Source:_[24]. The following sections provide a detailed description of the developed solution evaluated in a real NB-IoT network and with 5G specifications. Figure 2 provides an overview of the message exchange of LO-CoAP-EAP. This exchange represents the version of the protocol that does not perform a handshake. It starts with a POST message that contains the identity of the mode. The controller then creates an AAA message (RADIUS in this case), acting as an AAA client, with the information provided by the smart object and sends it to the EAP server. The EAP server then chooses the EAP method to be used for the authentication and starts the EAP exchange between the EAP server and the smart object, the controller acting as a forwarder of the EAP messages. When the EAP method finishes and the smart object is successfully authenticated, the EAP server sends an EAP success message to the controller, which contains the MSK that will be used to derive key material to further secure communications. The details and specifics of the working of LO-CoAP-EAP can be reviewed in their original work [10]. LO-CoAP-EAP represents an improvement over PANA in the realm of IoT by using CoAP. This is because CoAP is an application layer protocol that is expected to be present in most IoT stacks as a fundamental building block over IPv6/UDP [29]. It removes the necessity of application-level proxies and improves security by reducing header size, thus reducing the need of message fragmentation, which presents a security risk if an attacker can intercept fragments belonging to the same message [29]. At the time we reuse code, we are reducing the number of bytes sent over the air, as we can appreciate the simplification on the number of messages exchanged by LO-CoAP-EAP. A detailed comparison of the protocols is done in [10].