# Lightweight CoAP-Based Bootstrapping Service for the Internet of Things
## 2 State of the Art
### Bootstrapping in IoT
Our solution does not require a specific protocol just for bootstrapping (PANA) but reuses the deployment of CoAP to build the bootstrapping service. Moreno _et al._[25] designed and implemented a lightweight version of a PANA client (PaC) for Contiki OS [60] (PANATIKI) by adapting PANA for constrained devices. It implies removing part of the PaC state machine to make it suitable for constrained devices. Although PANATIKI does not make any modification to the standard, it does not implement some parts of the standard PaC state machine. In other words, it represents a reduced version of the standard, and a best case for PANA-based solutions. That is why we will make a comparison with PANATIKI to evaluate our proposal against an implementation that is optimized for constrained devices. It is important to note that (the use of) PANA is part of _Zigbee IP_[23]. In particular, the standard proposes the use of a PANA and EAP-TLS method [61] (based on X.509 certificates) for the EAP authentication. They use EAP in standalone mode without AAA infrastructures. Nevertheless, our CoAP-based EAP lower-layer could be used instead of PANA. Additionally, the _Institute of Electrical and Electronics Engineers_ (IEEE) association in the standard IEEE 802.15.9 [62] proposes a transport method for key management protocol (KMP) datagrams that will make use of existing KMPs with the IEEE 802.15.4 and.7. Guidelines will be provided regarding the use of KMPs like HIP, IKEv2, IEEE 802.1X and PANA. On another note, the _European Telecommunications Standards Institute_ ETSI [63] defines the support for Generic Bootstrapping Architecture (GBA) and adopts PANA as an option. Thus, as observed, the previous set of solutions that consider EAP and, possibly, AAA offer a range of alternatives. The references proposing a concrete solution focus on the use of PANA, such as the case of PANATIKI. However, we argue that a lighter protocol, CoAP, is still possible to provide a lightweight bootstrapping process. It is worth mentioning there is also another set of solutions [64; 65; 66; 67; 68; 69] that show the need for a bootstrapping process but they do not consider EAP or AAA infrastructures as part of their solution. In this sense, they do not support federated authentication and authorization, so limiting the deployment to small or medium scale scenarios. For example, Garcia-Morchon _et al._[64] propose two different architectures providing secure network access, key management and secure communications. The first solution uses a variant of HIP-DEX based on pre-shared keys and the second solution uses DTLS. For secure network access, a pre-shared key is assumed (_i.e._, manually configured by the administrator) between a domain manager and the constrained device. This key is used in HIP-DEX or DTLS in order to authenticate with the domain manager and gain access to the network. Alternatively, Bergmann _et al._[65] propose a bootstrapping solution with CoAP. First, the starting node discovers another node that can assist in the bootstrapping. This helping node serves to distribute a temporary secret and establish an association based on DTLS with the pre-shared key (DTLS-PSK). This security association is used to obtain a final session key. With this final session key a new DTLS session can be established. The critical part of the solution lies in the fact that the temporary shared secret is sent in the clear with no protection. Again, the issue with this approach is that the envisioned scenario is only valid for small scale deployments, such as home automation systems. Korhonen [66] adapts the 3 GPP's _Generic Bootstrapping Architecture_ (GBA) [47] to fit in IoT networks. The solution maps the protocols used in GBA, such HTTP and TLS, to its IoT counterparts, CoAP and DTLS, respectively. To simplify the bootstrapping process, a lightweight GBA bootstrapping architecture is proposed. This architecture assumes some pre-configuration of symmetric keys and renders the AAA server unnecessary.