# Lightweight CoAP-Based Bootstrapping Service for the Internet of Things
## 2 State of the Art
### The Constrained Application Protocol: CoAP  
Bormann _et al._[35] discuss the possibility of smart objects being susceptible to offering some resources or services represented by an _Uniform Resource Identifier_ (URI). While this is solved in non-constrained deployments with HTTP. In IoT, instead of HTTP, the _Constrained Application Protocol_ (CoAP) [22] has been proposed as a web transfer protocol based on the REST [36] model. The main reason is that CoAP has been specially designed for constrained devices with shorter message length and less demand on resources. In fact, HTTP might be a too weighty protocol for some types of smart objects. As analyzed in [35], HTTP poses a considerable implementation burden that exceeds the capabilities of small devices. Indeed, IoT devices [37] are constrained in memory, energy and computational resources and are expected to be deployed in constrained networks, where  
Figure 1: Extensible Authentication Protocol (EAP) pass-through model. increasing the message length by a few bytes of information might result in fragmentation in the links. A constrained application protocol as CoAP, with short message length and low computational requirements, therefore alleviates these problems. For all these reasons, although CoAP has certain similarities with HTTP, they are not compatible. It is worth noting that the transport of CoAP messages in IEEE 802.15.4e frames is currently being considered [38]. CoAP has been designed with several features, of which we highlight: (1) low overhead and low parsing complexity; and (2) support for the discovery of CoAP resources and services. On the one hand, low overhead mainly refers to the simple message format and protocol exchange that leads to a reduced parsing and processing complexity, saving system resources as a consequence (CPU, memory, battery, _etc._). On the other hand, the discovery of CoAP services and resources is also important since it is expected that the number of devices and services offered by these devices will grow rapidly [1]. Additionally, UDP binding in CoAP provides optional reliability when supporting unicast and multicast requests. CoAP defines an _endpoint_ as an entity that participates in a CoAP exchange. A CoAP message has a 4-byte header and optionally a set of options and a payload. Each message contains a _Message ID_ used to detect duplicates and for optional reliability. A message can be of a type (Type field) _Confirmable_ (CON), _Non-confirmable_ (NON), an _Acknowledgement_ (ACK) or a _Reset_ (RST). CON or NON messages can be _requests_ or _responses_ depending on the _Code field_ value in the header. An endpoint sending a Confirmable message will first wait for an _Acknowledgement_ (ACK) message. To improve the efficiency (by sending more information with fewer messages), a _piggybacked response_ can be included in the payload of an ACK to answer a Confirmable request. On the contrary, if a Non-confirmable message is sent, an ACK message is not expected. A _CoAP client_ is an endpoint that sends _requests_ to a _CoAP server_ for a service. When the CoAP server receives a request, it may send a response. A token value (_Token_), which is chosen randomly (it could have zero length) is used to relate a request with the corresponding response. If the CoAP server cannot process a message, it will send a RST message to indicate the inability to process it. This might happen, for example, when the smart object reboots and has forgotten some state to process the message. The RST can also be used as for the aliveness test of an endpoint, also called _CoAP Ping_. If the server is going to answer a Confirmable message with a CoAP response, but the information is not available yet, it can send an ACK message with empty payload (a CoAP message containing only the header) to indicate that the response will arrive later. CoAP defines four basic request methods _GET_, _POST_, _PUT_ and _DELETE_. The client can use the GET method to retrieve information from the server.