LoRaWAN Physical Layer-Based Attacks and Countermeasures, A Review

Abstract

As LoRaWAN is one of the most popular long-range wireless protocols among low-power IoT applications, more and more focus is shifting towards security. In particular, physical layer topics become relevant to improve the security of LoRaWAN nodes, which are often limited in terms of computational power and communication resources. To this end, e.g., detection methods for wireless attacks improve the integrity and robustness of LoRaWAN access. Further, wireless physical layer techniques have potential to enhance key refreshment and device authentication. In this work, we aim to provide a comprehensive review of various vulnerabilities, countermeasures and security enhancing features concerning the LoRaWAN physical layer. Afterwards, we discuss the impact of the reviewed topics on LoRaWAN security and, subsequently, we identify research gaps as well as promising future research directions.

LoRa Communication Quality Optimization on Agriculture Based on the PHY Anti-Frame Loss Mechanism

“…At the PHY, LoRaWAN operates within unlicensed frequency bands below 1 GHz, utilizing a proprietary spread spectrum modulation scheme derived from chirp spread spectrum modulation (CSS). This modulation scheme significantly enhances the link budget and immunity to in-band interference, as noted by Sinha et al [12,13] and Sanchez-Iborra et al [14]. At the MAC layer, LoRaWAN defines three types of terminal devices: classes A, B, and C. Class A terminals use the ALOHA protocol to upload data on demand.…”

Susceptibility of LoRa Communications to Intentional Electromagnetic Interference with Different Sweep Periods

“…Despite all the advantages, IoT systems can also be vulnerable to cyber attacks [3]. An overview of cyber attack techniques used against LoRa systems can be found in [4]. The authors describe different types of attacks such as sniffing, jamming, and wormhole in this reference.…”

“…They describe a scenario where a particular field of the join request message called DevNonce is jammed, resulting in denial-of-service (DoS). In the first version of the long range wide area network (LoRaWAN) protocol, DevNonce is a RSSI-based random parameter whose value never repeats in such a way as to avoid replay attacks [4]. In this context, the emission of strong jamming signals that saturate the power measurement unit of a LoRa transceiver forces the LoRa device to use the same RSSI every time and, therefore, generate the same DevNonce, and all attempts of this node to join the network are refused.…”

“…In this context, the emission of strong jamming signals that saturate the power measurement unit of a LoRa transceiver forces the LoRa device to use the same RSSI every time and, therefore, generate the same DevNonce, and all attempts of this node to join the network are refused. Mitigation strategies against jamming attacks designed for LoRa systems can be found in [4,5,11].…”

A Survey on Different Application Areas based on RSS (Received Signal Strength) and Possible Hardware and Software Tools for the Collection of RSS

“…Two wireless nodes Alice and Bob can communicate in presence of an intruder Eve, by generating a secure key at both ends using RSSI data exchanged between them. Preprocessing of RSSI using any mathematical model or any other technique can further improve network performance between Alice and Bob [10][11][12]. Therefore, based on the discussion made so far, it is concluded that RSSI/CSI pre-processing can be used for system performance enhancement.…”