# Lightweight CoAP-Based Bootstrapping Service for the Internet of Things
## 3 The Bootstrapping Service: CoAP-EAP  
Our bootstrapping service for IoT rests on three main technologies: CoAP, EAP and AAA. To make this service possible, we have designed a new EAP lower-layer based on CoAP, so it is used to steer an EAP authentication between the smart object and the controller. In turn, the controller interacts with a backend AAA infrastructure to complete the authentication and authorization steps required in the bootstrapping.  
As a consequence of the _bootstrapping phase_, fresh cryptographic material is generated and shared between the smart object and the controller to dynamically establish a security association between them. Thus, the smart object will automatically join the controller's security domain, and the controller will become a trusted third party for the smart object. In this work, we present two examples to build this security association (although other options could be considered in the future): either by integrity protecting (encryption will be considered in the future) CoAP messages at application level with a new CoAP option, named _AUTH (AUTH-based protection)_, or by establishing a DTLS security association (_DTLS-based protection_).  
After the bootstrapping, during the _post-bootstrapping phase_, the smart object is able to access other services in the security domain. These services can be provided by other smart objects or entities, such as a border router to access the Internet service. It is worth noting that our solution offers the framework and the cryptographic material to be used in the post-bootstrapping, although the operation in this phase is considered as future work. For example, after the bootstrapping, the controller may act as a key distribution center as is specified in [72] or as an authorization server, as specified in [73].  
By defining a bootstrapping service with these technologies, we propose a solution with the following features:  
* _Constrained and low-overhead_. CoAP is designed for communications among smart objects in constrained networks. Moreover, we assume that the smart object already ships a CoAP implementation to support other services in IoT networks, so we can re-use the source code for the bootstrapping service.
* _Interoperability_. The solution is based on three well-known standards, which promotes interoperability and easy deployment. The influence that CoAP has on constrained devices and their use in IoT environments as an application protocol for smart object management benefits interoperability.
* _Security and well-known key distribution and management_. The use of EAP and its associated key management process and the guidelines for AAA key management defined in [13] provides a mature framework for key management.
* _Flexibility_. The use of EAP and AAA provides flexibility in the authentication and authorization processes, so they can be easily adapted to the needs of IoT networks.
* _Scalability and large scale deployment_. AAA framework is already deployed to support millions of users nowadays, for example in 3G networks.
* _Federation support_. AAA provides federated authentication and authorization by design.  
The constrained devices that will be able to benefit from this solution will be devices of classes 1 and 2 as described in [37]. Class 0 devices are not considered a target of this solution because of their constraints in memory and processing capabilities as they are not expected to have the resources required to communicate directly with the Internet in a secure manner.  
Below, we describe the details of the architecture of our bootstrapping service and how the entities involved are mapped to the _EAP Key Management Framework_ (KMF) and the AAA framework we have described in Section 2.