Modern Internet of Things environments use lightweight communication protocols to exchange telemetry, commands, and resource information between constrained devices and backend services. The Constrained Application Protocol (CoAP) is designed for such environments, and Eclipse Californium provides a Java-based CoAP framework for building IoT services and applications. Californium supports CoAP features and provides configurable protocol and resource-management controls.
A CoAP request-flooding attack occurs when a large number of requests are generated against an IoT service within a short period. The objective of the controlled attack is to increase request-processing activity and consume available protocol or application resources, such as processing threads, peer state, exchanges, blockwise-transfer state, or application memory.
Californium provides several resource-protection controls. Its CoAP configuration includes controls for maximum active peers, maximum peer inactivity period, maximum message size, maximum resource-body size, blockwise status lifetime, server-side observe limits, exchange lifetime, and related protocol state. These controls can reduce the amount of state and data that a CoAP service is required to maintain.
In this use case, a controlled Eclipse Californium CoAP server is deployed on Ubuntu Linux inside an isolated VirtualBox laboratory. A synthetic IoT resource is created to represent a realistic sensor or device-management endpoint. Kali Linux is used as the controlled security-testing platform to generate a repeatable burst of CoAP requests against the laboratory Californium service. The testing remains restricted to the authorized laboratory network.
A request-rate enforcement layer is implemented before resource processing so that excessive requests from a controlled source can be identified and restricted. The Californium server is additionally configured with protocol resource controls such as maximum active peers, maximum message size, maximum resource-body size, peer inactivity limits, blockwise-transfer limits, and server-side observe limits where applicable.
The security workflow therefore uses two complementary protection layers: request-rate enforcement controls how frequently a client is allowed to generate requests, while protocol resource controls restrict the amount of state, message data, peer state, blockwise state, and observation state that the Californium service can maintain.
Wazuh monitors the Ubuntu host and relevant Californium activity, while OpenSearch provides centralized investigation and correlation of request-flooding events. The controlled flooding test is performed first against the baseline configuration and then repeated after the defensive controls are implemented. The objective is to verify that excessive request activity is detected and restricted while legitimate CoAP requests continue to operate normally.
Complete IoT Cyber Security Workflow : CoAP Client → Eclipse Californium IoT Service → Request Processing → Request-Rate Measurement → Excessive Request Detection → Rate Enforcement → Protocol Resource Controls → Excessive Request Restriction → Security Event Logging → Wazuh Monitoring → OpenSearch Investigation → Remediation → Post-Remediation Validation
Eclipse Californium provides the controlled CoAP server environment for the laboratory IoT service. Californium CoAP configuration provides resource-management controls, including maximum active peers, maximum peer inactivity period, maximum message size, maximum resource-body size, blockwise-transfer state lifetime, and maximum server-side observes. The MAX_ACTIVE_PEERS control is specifically intended to limit peer state so that memory consumption can be better predicted.
A CoAP service can become exposed to resource-exhaustion conditions when an excessive number of requests are processed without sufficient request-rate controls or protocol resource limits. Repeated requests may consume application-processing capacity and create additional protocol state. Depending on the request type, the service may also maintain peer state, exchanges, blockwise-transfer state, or observe relationships.
The security problem is therefore:
The proposed security architecture introduces request-rate enforcement before excessive traffic reaches the application-processing layer and combines it with Californium native protocol-resource controls to limit resource consumption.
A CoAP request-flooding attack involves generating an excessive number of CoAP requests against a target IoT service within a limited period. The controlled attack does not attempt to exploit a software vulnerability. Instead, it evaluates how the Californium service behaves when exposed to abnormal request volume. The Kali Linux testing system generates repeated requests against a synthetic Californium resource, deliberately increasing the request rate beyond the normal laboratory baseline. The test measures request volume, response behavior, processing activity, and relevant resource-state changes. The same test is then repeated after request-rate enforcement and protocol resource controls have been implemented.
Request-rate enforcement establishes a controlled limit on how frequently a client can submit requests to the laboratory CoAP service.
The rate-control layer measures requests using attributes such as source identity, source address, target resource, and time window. When the request frequency exceeds the configured laboratory threshold, additional requests are restricted instead of being passed normally to the application resource. Californium native configuration provides a complementary resource-protection layer. MAX_ACTIVE_PEERS limits the number of active peers whose state is maintained, while MAX_PEER_INACTIVITY_PERIOD allows stale peer state to be discarded. MAX_MESSAGE_SIZE limits the maximum payload that can be transferred in a single message, and MAX_RESOURCE_BODY_SIZE limits resource-body size accepted for transparent blockwise transfers. Californium also provides controls for server-side observes and blockwise-transfer state.
The secure processing flow is:
A controlled application-level rate-enforcement layer measures the number of requests received from a client within a defined time window.
Prevent excessive request rates from continuously reaching the Californium application-processing layer.
Requests are tracked using the source identity or address associated with the laboratory CoAP client.
Identify which client is generating abnormal request volume.
The security layer compares the observed request rate against the configured laboratory threshold.
Distinguish normal CoAP activity from excessive request behavior.
Requests exceeding the defined rate threshold are restricted before normal resource processing.
Reduce the processing load generated by a request-flooding source.
Californium MAX_ACTIVE_PEERS limits the number of active peers for which CoAP state is maintained. Californium documents this control as a way to make memory consumption more predictable.
Limit excessive peer-state consumption.
Californium MAX_PEER_INACTIVITY_PERIOD controls when inactive peers become stale and associated state can be discarded.
Prevent stale peer state from remaining indefinitely.
Californium MAX_MESSAGE_SIZE limits the payload size that can be transferred in a single CoAP message.
Limit excessive per-message resource consumption.
Californium MAX_RESOURCE_BODY_SIZE limits resource-body size accepted during transparent blockwise transfers and is documented as a safeguard against excessive memory consumption.
Reduce memory exposure from excessively large resource bodies.
Blockwise-transfer state is restricted through Californium blockwise configuration and status lifetime controls.
Prevent excessive persistence of incomplete blockwise exchanges.
Californium provides MAX_SERVER_OBSERVES to limit the number of observations supported by a CoAP server.
Restrict excessive observation-state consumption.
CoAP exchange lifetime and related timeout controls are configured according to the laboratory service requirements.
Limit how long protocol state remains active.
Request-rate violations and relevant Californium service activity are recorded for security monitoring.
Detect and investigate abnormal CoAP request behavior.
Relevant request-flooding telemetry is forwarded to centralized analysis infrastructure.
Correlate request-rate violations with service and host activity.
Eclipse Californium provides the controlled CoAP server framework for the laboratory IoT service. It is a Java-based CoAP framework intended for IoT and constrained environments.
The Californium endpoint exposes the synthetic laboratory IoT resources used during the security test.
A lightweight application-level rate-control component is placed before the protected CoAP resource-processing logic.
Kali Linux provides the controlled environment for generating authorized request-flooding traffic.
Wireshark is used to inspect the controlled CoAP network traffic between the Kali testing system and the Californium server.
Wazuh monitors the Ubuntu host and relevant Californium security activity.
OpenSearch provides centralized analysis of request-flooding security events.
Ubuntu provides the controlled environment hosting the Californium IoT service.
VirtualBox provides the isolated laboratory infrastructure.
Research Breakthrough Possible @S-Logix