# Lightweight CoAP-Based Bootstrapping Service for the Internet of Things
## 1 Introduction  
Over the last few years, the global information network formed by Internet-connected objects known, as the Internet of Things (IoT) [1] has experienced an impressive growth. To accomplish the vision of the Internet of Things, standardization organizations and the research community have been working on the definition of several architectures and protocols [2, 3]. These networks lead the trend that every device is connected to the Internet and can exchange information. Indeed, an important part of the IoT networks is foreseen to be formed by a vast amount of devices with constrained capabilities (_smart objects_) and IP-based networking connectivity [4]. These are typically based on low power radio technologies [4] such as IEEE 802.15.4 [5] or Bluetooth Smart [6]. For IP-based communications, the IP version _6 over Low power Wireless Personal Area Networks_ (6 LowPAN) standard [7] enables IPv6 connectivity for smart objects. This brings in new and promising areas of application such as smart cities, smart grids, home automation, e-healthcare, among others. While it allows for opportunities and improvements in our daily life, it also raises multiple security risks, which need to be tackled. In particular, one of the basic aspects of security is the _bootstrapping_ of the smart object [8]. As described by Garcia-Morchon _et al._[9] bootstrapping refers to the process by which a smart object securely joins the IoT network at a given time and location. It includes the _authentication_ and _authorization_ of a device as well as the transfer of security parameters (e.g., keying material) to the device allowing a trustworthy operation in a particular network. As a consequence of the process, the node joins a security domain and _accounting_ of the usage of the bootstrapping service may be carried out. In very demanding IoT scenarios, such as smart cities, a high number of smart objects will need to be authenticated and authorized before joining a security domain. The bootstrapping service is in charge of these operations. Additionally, these smart objects may belong to different organizations but may be deployed and bootstrapped in the same security domain. Thus, the concept of identity federation becomes relevant, though it has not yet been clarified how it will be managed [10]. In this sense, we foresee the key importance of _Authentication_, _Authorization and Accounting_ (AAA)-based infrastructures [11] to provide a flexible, scalable and federation-aware bootstrapping service in IoT. The reason is two-fold: first, they are robust infrastructures for managing the authentication, authorization and accounting of the activity the smart objects and, in conjunction with the _Extensible Authentication Protocol_ (EAP) [12], provide a secure framework for flexible authentication, authorization and key distribution [13; 14]. Some evidences of the use of AAA framework in the context of IoT can be found in [15; 16; 17]. Second, it is widely used to manage a great number of device connections and, therefore, AAA support large scale deployments. In fact, AAA infrastructures based on the protocol Diameter [18] are commonly used in 3G networks to control the access of millions of users [19]. Another example is _eduroam_ (educational roaming network) [20], which is a world-wide federation for WiFi connectivity across campuses and research and educational organizations around the world, that support thousands of users. Eduroam deploys EAP and an AAA infrastructure based on the _Remote Authentication Dial In User Service_ (RADIUS) [21], which provides the identity federation substrate. In this context, we propose a novel bootstrapping service that is built on top of the _Constrained Application Protocol_ (CoAP) [22] with the assistance of EAP and AAA infrastructures.