# Enterprise Security for the Internet of Things (IoT): Lightweight Bootstrapping with EAP-NOOB
## 7 Implementation
### OOB Communication with a Blinking LED  
As is evident from the description of the EAP-NOOB protocol presented in Section 5, an out-of-band (OOB) channel is essential for bootstrapping new devices. Previous implementations of EAP-NOOB have relied on QR-codes and NFC tags [35]. Although adding small e-ink displays or NFC tags may theoretically be possible, it not only increases the cost of devices, but also significantly increases energy consumption. While investigating potential OOB channels for our test devices, we noted that they have a very small RGB LED that can be controlled programmatically. Furthermore, the EAP-NOOB specification explicitly states that it may be possible to use a blinking light for delivering the OOB message. There is plenty of research literature and past implementations of visible light communication [57; 58]. However, we were faced with some unique challenges resulting from (a) a very small RGB LED, (b) an off-the-shelf mid-range smartphone, (c) a resource-constrained embedded platform, and (d) a requirement to transfer approximately 100-200 bytes within a few seconds. We now describe our implementation of an OOB channel with blinking LED lights. Modern digital active pixel sensors that are found in smartphones are typically produced using Complementary Metal-Oxide-Semiconductor (CMOS). When compared to Charge-CouplED Device (CCD) sensors, CMOS  
Figure 1: Extensible Authentication Protocol-Nimble out-of-band authentication (EAP-NOOB) deployment overview. sensors have lower power consumption and are easier to manufacture. CMOS sensor cameras capture images using an electronic rolling shutter [59]. This implies that every image is captured progressively by exposing each row of pixel sequentially. This can be utilized for transmitting data with Visible Light Communication (VLC) [60] by encoding it into a binary format and transmitting it to the camera with a blinking Light-Emitting Diode (LED). If the camera's rolling shutter frequency is higher than the LED's blinking frequency, dark and bright bands are captured in the image. Dark bands are captured when the LED is turned off and bright bands when the LED is turned on, as shown in Figure 2. These bands can then be mapped to represent binary data based on their luminosity, a technique that is known as On-Off keying (OOK). In our implementation, a LED acts the transmitter and a smartphone camera as the receiver. We implement the reader as an Android application for the Nokia 5.1 smartphone. The preview resolution of the camera is limited to \(800\times 600\) pixels due to the hardware limitations of the device. Therefore, the camera is only able to reliably capture 30 images per second, while simultaneously decoding each captured image in real-time. On the sender-side, we encode the OOB message with Manchester encoding for robustness and reliability. Because the whole message does not fit in one image, we split it into parts. Furthermore, to indicate the start of a data sequence we use a wider light band for a six-bit preamble (\(011110\)). Figure 3 shows the blinking LED seen through a smartphone camera with wider light bands indicating the preamble. We implement and test two basic methods for transmitting and reading data using VLC. In the first method [61], as shown in Figure 4, the preamble is followed by a 48-bit payload. We also include a prefix indicator to relay information about the length of the message to the reader. While testing transmission reliability, we noticed that the smartphone camera was not able to capture data seamlessly, causing data to be lost between captured images. We managed to solve the issue by repeating each set of three characters multiple times, which gives the camera enough time to capture all of the data successfully. However, moving the smartphone during the scanning process may disrupt the signal, requiring the process to be started over. The second method [62] utilizes sequence numbers to provide error correction.