# Lightweight CoAP-Based Bootstrapping Service for the Internet of Things
## 2 State of the Art  
### Authentication, Authorization and Accounting (AAA) Framework  
The _Authentication_, _Authorization and Accounting_ (AAA) Framework [11] provides support for the three basic security services in network deployments: authentication (to determine who the end user is), authorization (to determine under what conditions an end user is granted access to the network resource), and accounting (to register the resource consumed by the end user). Thus, it is consistent with at least two of the required processes, authentication and authorization, involved during the bootstrapping.  
The AAA framework defines a model consisting of: an _End User_ (EU) desiring access to a specific network service; an _Identity Provider_ (IdP) which has registered the end user's identity and long-term credentials (e.g., a certificate or pre-shared key); and a _Service Provider_ (SP) operating and controlling the access to the network service. In a _non-federated case_, the IdP and SP belong to the same organization (_IdP's organization_). In _federated cases_, where some bilateral agreements are assumed among different domains joining the federation, the IdP and SP belong to different organizations that operate independent AAA servers: _the IdP's AAA server_ and _the SP's AAA server_. Both AAA servers are capable of exchanging authentication, authorization information and accounting data.  
Additionally, the SP also operates the entity that intermediates between the smart object and the AAA infrastructure to carry out the authentication and authorization processes. This entity is generally called _Network Access Server (NAS)_. Thus, the simplest AAA infrastructure consists of a NAS directly connected to a AAA server by a AAA protocol. Nevertheless, several AAA servers (usually called _AAA proxies_) can be deployed between the NAS and the AAA server for scalability reasons or federated access support.  
Either way, the NAS, AAA proxies and AAA servers that constitute the AAA infrastructure exchange information by using AAA protocols. Today, the most commonly deployed AAA protocols are RADIUS [21] and Diameter [18]. Although the latter is the most complete, in terms of the functionality provided by its design, RADIUS is still one of the most widely deployed protocols within existing AAA infrastructures [26].  
The _Remote Authentication Dial In User Service_ (RADIUS) [21; 27] is a client-server protocol where a NAS acts as RADIUS client transporting messages on top of UDP. The RADIUS client sends AAA information in a RADIUS message request to the RADIUS server, which answers with a RADIUS response. There can be two RADIUS servers for different purposes: the authentication and authorization server (RFC 2865) that keeps a database with registered users and accounting server (RFC 2866) that collects data from the service usage (data sent and received, connection time, _etc._).  
In contrast, Diameter [18] is an evolution to solve some of the RADIUS limitations in terms of scalability and security. It uses a reliable transport like TCP or SCTP [28]. For the security part, it uses either IPsec [29] or TLS [30] and provides a message format allowing a longer message size and a higher number of concurrent connections. Thus, it is better adapted for multiple numbers of end users.