# Enterprise Security for the Internet of Things (IoT): Lightweight Bootstrapping with EAP-NOOB
## 1 Introduction  
The Internet of Things (IoT) promises to integrate a large number of physical devices, such as light bulbs, electronic locks, and various household appliances, into networks of connected smart objects. Connecting these devices to the Internet allows for remote access and control without the need for any direct physical interaction. Many large home appliances, such as smart TVs and refrigerators, typically reuse the existing Wi-Fi infrastructure for Internet connectivity because of its low marginal cost for connecting any number of devices. However, at the same time, there is a growing number of IoT devices that rely on different low-power radio technologies, such as Zigbee [1], Thread [2], and Z-Wave [3]. These devices typically form a mesh network and must rely on a gateway or a hub for Internet connectivity. An example of suchdevices are the Internet-connected light bulbs from Philips [4], Ikea [5] and Osram [6]. While smart light bulbs are a popular example, a plethora of other devices, including switches, power sockets, and window blinds, also rely on radio technologies other than the traditional Wi-Fi network. The reasons for vendors of these devices to use radio technologies other than the widely deployed Wi-Fi network can include extended range, lower cost, lower energy requirements, and support for mesh networking. Regardless of the radio technology used by these smart devices, their owners must provide the necessary security and configuration parameters before they can start using their devices. Security, usability, and scalability of this initial bootstrapping phase is critical. A security breach at this early stage in the lifecycle of a smart device will naturally leave it vulnerable to attacks later on. Similarly, requiring complex user interactions would deter their widespread adoption. IoT devices currently use a very wide variety of techniques for this initial security bootstrapping phase. [PERSON] [7] categorizes the available bootstrapping techniques and lists some methods that are used by existing devices as well as standard protocols. The bootstrapping techniques not only significantly vary in their implementations and manufacturer requirements, but also expect users to perform substantially different tasks. Hence, there is a need for standard, secure, and inter-operable bootstrapping solutions that work with a wide range devices in many different deployment settings without requiring major changes to the tasks that a user must perform. In this paper, we specifically look at secure bootstrapping of devices, such as smart light bulbs, which may form a mesh network and connect to the Internet through a hub. We investigate whether the Extensible Authentication Protocol (EAP) framework [8], which is widely used for bootstrapping enterprise Wi-Fi devices, is also suitable for resource-constrained devices that use other radio technologies with slightly different deployment setups. Our main contributions are as follows:  
1. We chronicle a concise but illustrative overview of existing bootstrapping protocols designed for resource-constrained devices. Our overview describes protocols developed in research literature and standards while also examining the bootstrapping processes of real-world off-the-shelf devices. 2. We identify important design principles for bootstrapping protocols and present arguments in favor of a standards-based bootstrapping solution that is based on the EAP framework. 3. We provide an overview of the EAP-NOOB protocol along with its security properties and implement it on Zolertia Firefly breakout boards. 4. The EAP-NOOB protocol implementation is complemented with the implementation of a novel out-of-band channel that works with a simple small LED light and a mid-range smartphone camera. This OOB channel can accommodate the limitations of a resource-constrained platform and still achieve data transfer rates of 80 bps. 5. We present an initial evaluation of the memory, time, and message size requirements of our bootstrapping solution.