# Secure Service Proxy: A CoAP(s) Intermediary for a Securer and Smarter Web of Things
## 4 The Secure Service Proxy
### Secure Service Proxy: Implementation
#### 4.3.2 Implemented Application Layer Adapters
\begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Adapter** & **Functionality** & **Configuration Parameters** \\ \hline Access control & \begin{tabular}{l} Restrict access to virtual devices depending on \\ client identify, request method and URI. \\ \end{tabular} & ACL rules and default policy \\ \hline Static resource & \begin{tabular}{l} Host RESTful resources on virtual devices that \\ can be read and modified. \\ \end{tabular} & Payload and content type \\ \hline Cache & \begin{tabular}{l} Cache and serve previous responses from \\ virtual devices to clients. \\ \end{tabular} & Default cache entry lifetime \\ \hline Congestion control & \begin{tabular}{l} Enforce congestion control on clients querying \\ virtual devices. Per-device and network-wide \\ rules are implemented. \\ \end{tabular} & Per user CC limits \\ \hline.well-known/core & \begin{tabular}{l} Manipulate discovery responses from virtual \\ devices to include functionality hosted \\ by the proxy. \\ \end{tabular} & None \\ \hline Proxy & \begin{tabular}{l} Proxies requests for the virtual device \\ to a CoAP(s) server (e.g., the constrained \\ device). Also aggregates observation registrations. \\ \end{tabular} & CoAP(s) server endpoint \\ \hline Mirror server & \
\begin{tabular}{l} Proxies requests for a virtual device to \\ a mirror server. \\ \end{tabular} &
\begin{tabular}{l} Mirror server endpoint and \\ sleepy device anchor point \\ \end{tabular} \\ \hline \hline \end{tabular}
\end{table} 
Table 1: The proxy offers a number of functionalities, called adapters, that are hosted on virtual devices. The list of adapters that were implemented at the time of this work are shown in this table. requests for which a response has not been sent yet. If a client reaches its limit, then the request is dropped until either a response is received or one of the prior requests of that client is removed after a time out period (can be configured). Finally, a client can either be identified by its endpoint address or by its identity derived from the authentication credentials during the (D)TLS handshake. The.well-known/core adapter is responsible for including the functionality that is hosted on the virtual devices in the resource discovery responses of the real constrained device. In the current implementation, the.well-known/core (wkc) adapter asks every adapter from all of the adapter chains that are defined for the virtual device to modify the discovery response from the real device. This way, the static resource adapter can add a link to its virtual resource, and the ACL adapter can remove links for resources that the user is not authorized to access. To this end, every adapter type offers a \"processDiscoveryResponse\" method that is used by the wkc adapter. The proxy adapter takes a request for a virtual device and issues a new CoAP request to the corresponding actual constrained device. Therefore, an instance of this adapter is configured with the CoAP(s) endpoint of the constrained device. Only the transport layer addresses are changed; the new CoAP request is copied from the output of the previous adapter in the adapter chain (with the exception of the message ID and the token, of course). The proxy adapter will either retrieve a response or generate a time-out; therefore, it always comes last in adapter chains. This adapter will also combine observation registrations when it receives multiple registrations for the same resource on a virtual device. Likewise, it also multiplexes responses from constrained devices to multiple clients in case there is more than one ongoing observation registration. Finally, the mirror server adapter is a special type of proxy adapter in that it issues CoAP(s) requests to a mirror server instead of the constrained device itself. Apart from the end point of the mirror server, also the handler of the constrained device is configured into the mirror server adapter instance.