A Security-Conscious Primer on LoRa and LoRaWAN Technologies

Abstract

At its core, the Internet of Things (IoT) paradigm encompasses a wealth of devices, mainly sensors, actuators and systems that can connect and exchange data through any means of communication, as long as they’re individually addressable and are a part of a network. There is a wide array of possible network types, among which Low-Power Short-Range Networks (LPSRNs) and Low-Power Wide-Area Networks (LPWANs) offer a great deal of potential to support energy efficient communications with low maintenance. LoRa (an abbreviation of “Long Range”), one of the most popular technologies for implementing LPWANs, is a radio-based technique derived from Chirp Spread Spectrum (CSS) technology (where “Chirp” stands for Compressed High Intensity Radar Pulse). However, when used as a standalone technology, it exposes exchanged data as LoRa devices simply transmit packets publicly without any built-in security. The LoRaWAN (LoRa Wide Area Network) framework addresses these shortcomings by providing a software layer on top of LoRa, supporting device addressing, management and message acknowledgement, while also providing a security framework with network and application encryption layers based on the AES-128 algorithm. LoRaWAN security mechanisms provide authentication and integrity protection of transmitted packets to the LoRaWAN Network Server (LNS), to ensure end-to-end encryption at the application layer. Due to its widespread application in IoT scenarios such as smart cities, smart transportation and environmental monitoring, the security of the LoraWAN framework is fundamental to ensure the security and safety of critical metering and telemetry infrastructures. In this paper we provide a primer on LoRa and LoRaWAN technologies and address the security and management-related aspects of this framework, also presenting a threat model for LoRaWAN networks based on the STRIDE (Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege) methodology, providing a convenient starting point for risk assessment and preventive/mitigation action planning.