# Lightweight CoAP-Based Bootstrapping Service for the Internet of Things
## 5 Conclusions and Future Work  
In this work we have discussed the importance of bootstrapping in IoT networks. We have presented a novel bootstrapping service that uses EAP, interacts with AAA infrastructures, and defines a new and simple EAP lower-layer using CoAP to provide a flexible, scalable, secure and constrained solution. After the bootstrapping is completed, we propose two ways of establishing a security association between the Smart Object and the Controller in an IoT network. The first uses a new CoAP Option (AUTH Option) defined for integrity protection and the second is done through DTLS. For this purpose a key hierarchy has been presented.  
We have shown some performance results related to the message length, bootstrapping time and message processing time, memory footprint and energy consumption. We have contrasted these results with those obtained from PANATIKI, which is an optimized implementation for bootstrapping in IoT based on PANA. Therefore, it is good representative of other bootstrapping alternatives that use EAP and AAA and key technologies. We conclude that our solution, thanks to having a shorter message size brought to the overall bootstrapping process, such as bootstrapping time, probability of finishing the bootstrapping (success percentage) and energy consumption, substantial improvements. Other improvements such as memory footprint and message processing time are more limited, mainly due to the EAP method, even when EAP-PSK is considered lightweight. This suggests that more constrained methods may be required in the future. Nevertheless, when we focus on one of the key contribution of our work, the proposed CoAP-based EAP lower-layer, we observe that a part is substantially reduced in compared to PANA. In other words, we can conclude that the next steps in this field should be aimed at of improving or designing new EAP methods.  
In this sense, future work has been planned for the use of other EAP methods (e.g., EAP-AKA [106]). Moreover, testing our bootstrapping service in _Low Power Wide Area Network_, where reducing the message size is vital, is under discussion. Finally, the next step is to study alternativesto provide authorization, key distribution and secure communications between smart objects from the same (or different) security domains _after_ the bootstrapping (_post-bootstrapping_). This is related to how a smart object that successfully performed the bootstrapping and entered the security domain can perform different actions, in a secure and controlled fashion, and consume the services that are being offered by other entities.  
We want to thank Raul Sanchez Sanchez for his initial work in the CoAP-EAP prototype; Pedro Moreno Sanchez for his insights on the implementation and testing of PANATIKI; Gabriel Lopez-Millan and Sara Nieves Matheu Garcia for their deep review of this work, and Antonio F. Gomez-Skarmeta for supporting it. We also want to thank the anonymous reviewers of this work whose insights helped to improve it. This paper has been also possible partially by the SMARTIE project (FP7-SMARTIE-609062 EU Project) and the Spanish National Project CICYT EDISON (TIN2014-52099-R).  
Garcia-Carrillo and Marin-Lopez conceived and designed the architecture and the experiments; Garcia-Carrillo performed the experiments; Garcia-Carrillo and Marin-Lopez analyzed the data; Garcia-Carrillo and Marin-Lopez wrote the paper.  
The authors declare no conflict of interest.