# Lightweight CoAP-Based Bootstrapping Service for the Internet of Things
## 2 State of the Art
### Bootstrapping in IoT  
T. Heer _et al._[15] and Garcia-Morchon _et al._[9] describe the concept of bootstrapping in IoT as the process of a smart object securely joining an IoT network at a specific place and time. It includes the _authentication_ and _authorization_ of the smart object as well as the transfer of some security parameters (e.g., keying material), so allowing a trustworthy operation in a particular domain. As a consequence of the process, the smart object joins a security domain and _accounting_ of the usage of the bootstrapping service may be carried out. The bootstrapping process is specially important in the case of IoT where the configuration of the smart objects is expected to be as much automated as possible, making the scalability of the deployments easier. Figure 2: Bootstrapping framework for internet of things (IoT). In general, the importance of bootstrapping in IoT has been highlighted in several works [52; 53]. On the one hand, the problem of bootstrapping has been discussed in several IETF Working Groups (WG) such as _IPv6 over the TSCH mode of IEEE 802.15.4e_ (6 tisch), _Authentication and Authorization for Constrained Environments_ (ACE) WG, _Constrained RESTful Environments_ (CoRE) WG and _IPv6 over Networks of Resource-constrained Nodes_ (6 lo) WG. Additionally, an IETF mailing list has been created specifically to discuss the bootstrapping [54]. Other standardization organisms and alliances as IEEE, W3C, OMA, ETSI and IPSO among others, are working in IoT and some of them provide insights into the bootstrapping process in IoT. On the other hand, there are several proposals discussing the general problem of bootstrapping for constrained devices while others also propose solutions that consider the use of EAP and, in some cases, the interaction with AAA infrastructures. Garcia-Morchon _et al._[9] analyze of the IP-based security protocols for bootstrapping in IoT networks. In the case of a centralized architecture, as our bootstrapping service, they highlight the potential use of EAP as a protocol to perform authentication and generation of fresh keying material. _The Protocol for carrying Authentication for Network Access_ (PANA) [55] is proposed as a candidate to transport EAP between the smart object, acting as the _PANA client_ (PaC), and the controller, which is the _PANA agent_ (PAA) in PANA terminology. Nevertheless, these authors also recognize that the transfer of configuration parameters in a centralized scenario can be made by other protocols. In our solution, CoAP is used instead of PANA as EAP lower-layer. O'Flynn _et al._[56] discuss the general problem of bootstrapping for low-power wireless networks. They also consider a centralized architecture with a root trusted entity. They consider the option of EAP as authentication protocol and analyze PANA and IEEE 802.1X [51] as possible EAP lower-layers. However, as analyzed in [57], link-layer solutions, such as IEEE 802.1X, are unsuitable for multi-hop wireless networks. Additionally, He _et al._[53] includes the possibility of using HIP-DEX [50] as a bootstrapping protocol, although this option does not have any interaction with EAP or AAA's, limiting the case to small or medium scenarios. Nevertheless, no concrete alternative is chosen in these works. Sarikaya [58] and Sarikaya _et al._[59] propose the use of EAP-TLS, based on certificates, as a specific method for authentication during the bootstrapping. The authors also consider PANA or IEEE 802.1X as EAP lower-layers. S. Das _et al._[16] propose a centralized alternative using PANA, EAP and AAA to bootstrap a pre-shared key (PSK) to establish a DTLS [49] or IKEv2 [44] unicast security association between the smart object and the PAA (the controller). However, CoAP is used afterwards for the post-bootstrapping phase. In particular, the CoAP client (the smart object) requests the CoAP server to bring a key (_pull model_) from an _Authentication Server_ (AS) which acts as EAP server (_i.e._, AAA server) in the EAP authentication involved in the bootstrapping.