LoRa’sJambalaya - Fernando Kuipers · 2019-05-21 · LoRa’sJambalaya Fernando Kuipers Delft...
Transcript of LoRa’sJambalaya - Fernando Kuipers · 2019-05-21 · LoRa’sJambalaya Fernando Kuipers Delft...
![Page 1: LoRa’sJambalaya - Fernando Kuipers · 2019-05-21 · LoRa’sJambalaya Fernando Kuipers Delft University of Technology May 20th, 2019 . 2 “Sense and the city ... LoRa's Jambalaya](https://reader030.fdocuments.in/reader030/viewer/2022040610/5ed2040c6731c53a5734c2b8/html5/thumbnails/1.jpg)
1
LoRa’s Jambalaya
Fernando KuipersDelft University of Technology
May 20th, 2019https://fernandokuipers.nl
![Page 2: LoRa’sJambalaya - Fernando Kuipers · 2019-05-21 · LoRa’sJambalaya Fernando Kuipers Delft University of Technology May 20th, 2019 . 2 “Sense and the city ... LoRa's Jambalaya](https://reader030.fdocuments.in/reader030/viewer/2022040610/5ed2040c6731c53a5734c2b8/html5/thumbnails/2.jpg)
2
“Sense and the city”
![Page 3: LoRa’sJambalaya - Fernando Kuipers · 2019-05-21 · LoRa’sJambalaya Fernando Kuipers Delft University of Technology May 20th, 2019 . 2 “Sense and the city ... LoRa's Jambalaya](https://reader030.fdocuments.in/reader030/viewer/2022040610/5ed2040c6731c53a5734c2b8/html5/thumbnails/3.jpg)
3
Wireless Sensor Networks
• WSNs:– Multiple hops to sink– Many challenges due to
energy constraints
• Long-range communication:– Direct link to sink/gateway
![Page 4: LoRa’sJambalaya - Fernando Kuipers · 2019-05-21 · LoRa’sJambalaya Fernando Kuipers Delft University of Technology May 20th, 2019 . 2 “Sense and the city ... LoRa's Jambalaya](https://reader030.fdocuments.in/reader030/viewer/2022040610/5ed2040c6731c53a5734c2b8/html5/thumbnails/4.jpg)
4
Unlicensed bands - Non 3GPP standards
Unlicensed bands - Non 3GPP standards
-MLicensed bands - 3GPP
standards
Use casesBandwidth versus range
Low-Power Wide Area Networks
![Page 5: LoRa’sJambalaya - Fernando Kuipers · 2019-05-21 · LoRa’sJambalaya Fernando Kuipers Delft University of Technology May 20th, 2019 . 2 “Sense and the city ... LoRa's Jambalaya](https://reader030.fdocuments.in/reader030/viewer/2022040610/5ed2040c6731c53a5734c2b8/html5/thumbnails/5.jpg)
5
• Semtech's proprietary wireless modulation technology
• Physical layer (PHY) for long range communications
• Based on Chirp Spread Spectrum (CSS)• Robust against multipath, Doppler shift
• Communication protocol (MAC) and architecture for LoRa/FSK
• Specified by the LoRa Alliance• LoRaWAN version
• Common: 1.0.2 (July 2016)• Recent: 1.1 (October 11, 2017)
LoRa vs LoRaWAN
![Page 6: LoRa’sJambalaya - Fernando Kuipers · 2019-05-21 · LoRa’sJambalaya Fernando Kuipers Delft University of Technology May 20th, 2019 . 2 “Sense and the city ... LoRa's Jambalaya](https://reader030.fdocuments.in/reader030/viewer/2022040610/5ed2040c6731c53a5734c2b8/html5/thumbnails/6.jpg)
6
Chirp Spread Spectrum (CSS)
Time (1 up-chirp) Time (1 down-chirp)
Ampl
itude
• One chirp = 1 symbol• One chirp covers entire BW• Frequency offset (+ wrap-
around) determines symbol
Source: https://en.wikipedia.org/wiki/Chirp_spread_spectrum.
![Page 7: LoRa’sJambalaya - Fernando Kuipers · 2019-05-21 · LoRa’sJambalaya Fernando Kuipers Delft University of Technology May 20th, 2019 . 2 “Sense and the city ... LoRa's Jambalaya](https://reader030.fdocuments.in/reader030/viewer/2022040610/5ed2040c6731c53a5734c2b8/html5/thumbnails/7.jpg)
7
LoRa parameters• Data Rate (DR)
– Spreading Factor (SF)1 symbol = SF bits
– Bandwidth (BW)• Carrier Frequency (CF)• Coding Rate (CR)• Transmission Power (TP)
Time
Freq
uenc
y
DR6 (SF7
BW250)
DR5 (SF7
BW125)
DR4 (SF8
BW125)
![Page 8: LoRa’sJambalaya - Fernando Kuipers · 2019-05-21 · LoRa’sJambalaya Fernando Kuipers Delft University of Technology May 20th, 2019 . 2 “Sense and the city ... LoRa's Jambalaya](https://reader030.fdocuments.in/reader030/viewer/2022040610/5ed2040c6731c53a5734c2b8/html5/thumbnails/8.jpg)
8
1st large-scale evaluation [1]
[1] N. Blenn and F.A. Kuipers, “LoRaWAN in the Wild: Measurements from The Things Network,” arXiv:1706.03086.
![Page 9: LoRa’sJambalaya - Fernando Kuipers · 2019-05-21 · LoRa’sJambalaya Fernando Kuipers Delft University of Technology May 20th, 2019 . 2 “Sense and the city ... LoRa's Jambalaya](https://reader030.fdocuments.in/reader030/viewer/2022040610/5ed2040c6731c53a5734c2b8/html5/thumbnails/9.jpg)
9
Results from the wild
1
10
1e+01 1e+03 1e+05
packets sent (n)
100
num
ber
of nodes that
sent
n p
ackets
1618 device id’s
0
4e+06
8e+06
1.2e+07
SF7 BW125
SF7 BW250
SF8 BW125
SF8 BW500
SF9 BW125SF10 BW125
SF11 BW125SF12 BW125
SF12 BW500
frequen
cy
frequency
0
10
20
30
40
867.0 867.5 868.0 868.5 869.0
density
Spreading Factor Frequency usage EU
![Page 10: LoRa’sJambalaya - Fernando Kuipers · 2019-05-21 · LoRa’sJambalaya Fernando Kuipers Delft University of Technology May 20th, 2019 . 2 “Sense and the city ... LoRa's Jambalaya](https://reader030.fdocuments.in/reader030/viewer/2022040610/5ed2040c6731c53a5734c2b8/html5/thumbnails/10.jpg)
10
Link quality
[2] S. Demetri, M. Zuniga, G.P. Picco, F.A. Kuipers, L. Bruzzone, and T. Telkamp, “Automated Estimation of Link Quality for LoRa: A Remote Sensing Approach,” Proc. of ACM/IEEE IPSN 2019.
![Page 11: LoRa’sJambalaya - Fernando Kuipers · 2019-05-21 · LoRa’sJambalaya Fernando Kuipers Delft University of Technology May 20th, 2019 . 2 “Sense and the city ... LoRa's Jambalaya](https://reader030.fdocuments.in/reader030/viewer/2022040610/5ed2040c6731c53a5734c2b8/html5/thumbnails/11.jpg)
11
How far can you go?
![Page 12: LoRa’sJambalaya - Fernando Kuipers · 2019-05-21 · LoRa’sJambalaya Fernando Kuipers Delft University of Technology May 20th, 2019 . 2 “Sense and the city ... LoRa's Jambalaya](https://reader030.fdocuments.in/reader030/viewer/2022040610/5ed2040c6731c53a5734c2b8/html5/thumbnails/12.jpg)
12
It depends!
objectsin the environment
hardware
temperature
humidity
mobility
interference
R2Object
+14
range
Rx power [dBm]
R1
free space
+14
-140
![Page 13: LoRa’sJambalaya - Fernando Kuipers · 2019-05-21 · LoRa’sJambalaya Fernando Kuipers Delft University of Technology May 20th, 2019 . 2 “Sense and the city ... LoRa's Jambalaya](https://reader030.fdocuments.in/reader030/viewer/2022040610/5ed2040c6731c53a5734c2b8/html5/thumbnails/13.jpg)
13
Typical gateway coverage
GOOD> -100 dBm
INTERMEDIATE[ -115 -100 ] dBm
BAD< -115 dBm
No reception
Measuring coverage is costly: we need an automated approach!
![Page 14: LoRa’sJambalaya - Fernando Kuipers · 2019-05-21 · LoRa’sJambalaya Fernando Kuipers Delft University of Technology May 20th, 2019 . 2 “Sense and the city ... LoRa's Jambalaya](https://reader030.fdocuments.in/reader030/viewer/2022040610/5ed2040c6731c53a5734c2b8/html5/thumbnails/14.jpg)
14
Remote sensing
![Page 15: LoRa’sJambalaya - Fernando Kuipers · 2019-05-21 · LoRa’sJambalaya Fernando Kuipers Delft University of Technology May 20th, 2019 . 2 “Sense and the city ... LoRa's Jambalaya](https://reader030.fdocuments.in/reader030/viewer/2022040610/5ed2040c6731c53a5734c2b8/html5/thumbnails/15.jpg)
15
Land-cover classesLOS NLOS
![Page 16: LoRa’sJambalaya - Fernando Kuipers · 2019-05-21 · LoRa’sJambalaya Fernando Kuipers Delft University of Technology May 20th, 2019 . 2 “Sense and the city ... LoRa's Jambalaya](https://reader030.fdocuments.in/reader030/viewer/2022040610/5ed2040c6731c53a5734c2b8/html5/thumbnails/16.jpg)
16
Link quality per class
![Page 17: LoRa’sJambalaya - Fernando Kuipers · 2019-05-21 · LoRa’sJambalaya Fernando Kuipers Delft University of Technology May 20th, 2019 . 2 “Sense and the city ... LoRa's Jambalaya](https://reader030.fdocuments.in/reader030/viewer/2022040610/5ed2040c6731c53a5734c2b8/html5/thumbnails/17.jpg)
17
Okumura-Hata model
LOS
① urban small city② urban large city③ suburban④ rural
PL = f Hgw,Hed,d( )
gateway height end-device height
distance
NLOS
![Page 18: LoRa’sJambalaya - Fernando Kuipers · 2019-05-21 · LoRa’sJambalaya Fernando Kuipers Delft University of Technology May 20th, 2019 . 2 “Sense and the city ... LoRa's Jambalaya](https://reader030.fdocuments.in/reader030/viewer/2022040610/5ed2040c6731c53a5734c2b8/html5/thumbnails/18.jpg)
18
Dominant land-cover class
![Page 19: LoRa’sJambalaya - Fernando Kuipers · 2019-05-21 · LoRa’sJambalaya Fernando Kuipers Delft University of Technology May 20th, 2019 . 2 “Sense and the city ... LoRa's Jambalaya](https://reader030.fdocuments.in/reader030/viewer/2022040610/5ed2040c6731c53a5734c2b8/html5/thumbnails/19.jpg)
19
Complete tool
Automatic coverage
predictionOkumura-
HataLand cover
mapMultispectral
satelliteimages
Land cover analysis
PL = f Hgw,Hed,d( )
![Page 20: LoRa’sJambalaya - Fernando Kuipers · 2019-05-21 · LoRa’sJambalaya Fernando Kuipers Delft University of Technology May 20th, 2019 . 2 “Sense and the city ... LoRa's Jambalaya](https://reader030.fdocuments.in/reader030/viewer/2022040610/5ed2040c6731c53a5734c2b8/html5/thumbnails/20.jpg)
20
Estimation error
![Page 21: LoRa’sJambalaya - Fernando Kuipers · 2019-05-21 · LoRa’sJambalaya Fernando Kuipers Delft University of Technology May 20th, 2019 . 2 “Sense and the city ... LoRa's Jambalaya](https://reader030.fdocuments.in/reader030/viewer/2022040610/5ed2040c6731c53a5734c2b8/html5/thumbnails/21.jpg)
21
Collisions & the capture effect
[3] A. Rahmadhani and F.A. Kuipers, “When LoRaWAN Frames Collide,” Proc. of ACM WiNTECH 2018.
![Page 22: LoRa’sJambalaya - Fernando Kuipers · 2019-05-21 · LoRa’sJambalaya Fernando Kuipers Delft University of Technology May 20th, 2019 . 2 “Sense and the city ... LoRa's Jambalaya](https://reader030.fdocuments.in/reader030/viewer/2022040610/5ed2040c6731c53a5734c2b8/html5/thumbnails/22.jpg)
22
LoRaWAN architecture
![Page 23: LoRa’sJambalaya - Fernando Kuipers · 2019-05-21 · LoRa’sJambalaya Fernando Kuipers Delft University of Technology May 20th, 2019 . 2 “Sense and the city ... LoRa's Jambalaya](https://reader030.fdocuments.in/reader030/viewer/2022040610/5ed2040c6731c53a5734c2b8/html5/thumbnails/23.jpg)
23
GW-A1
Network A
ED-A2
ED-A1
GW-B1
Network B
ED-B2
ED-B3
ED-B1 GW-
A2
Network A
ED-A4
ED-A3
ED-A5
ED-A3
Collisions are bound to happen
![Page 24: LoRa’sJambalaya - Fernando Kuipers · 2019-05-21 · LoRa’sJambalaya Fernando Kuipers Delft University of Technology May 20th, 2019 . 2 “Sense and the city ... LoRa's Jambalaya](https://reader030.fdocuments.in/reader030/viewer/2022040610/5ed2040c6731c53a5734c2b8/html5/thumbnails/24.jpg)
24
Parameters Device 1 (N1)
Device 2 (N2)
Equal received power (TP)
2 dBm
Different transmission powers (TP)
2 dBm 8 dBm
Time offset 0 ms ++ 1 ms(delayed)
Packets per time offset 20
Frequency (CF) 869.7 MHz (SF11 plotted)
Payload size 26 bytes
Network Private
Distance to gateway (LOS)
5 m
Distance to gateway (NLOS)
30 m
Single GW experiment setup
![Page 25: LoRa’sJambalaya - Fernando Kuipers · 2019-05-21 · LoRa’sJambalaya Fernando Kuipers Delft University of Technology May 20th, 2019 . 2 “Sense and the city ... LoRa's Jambalaya](https://reader030.fdocuments.in/reader030/viewer/2022040610/5ed2040c6731c53a5734c2b8/html5/thumbnails/25.jpg)
25
Data Extraction Rate (DER)
DER: Ratio of received frames (at application layer) to transmitted frames
Pack
et D
eliv
ery
Rat
ioPa
cket
Del
iver
y R
atio
![Page 26: LoRa’sJambalaya - Fernando Kuipers · 2019-05-21 · LoRa’sJambalaya Fernando Kuipers Delft University of Technology May 20th, 2019 . 2 “Sense and the city ... LoRa's Jambalaya](https://reader030.fdocuments.in/reader030/viewer/2022040610/5ed2040c6731c53a5734c2b8/html5/thumbnails/26.jpg)
26
Frame loss conditions • Both frames get destroyed
(preamble lock)
• Weaker frame gets destroyed, stronger frame survives (LoRaheader of the weaker frame gets destroyed, receiver immediately starts reading new frame)
• Both frames get destroyed (LoRa header of the weaker frame OK, keeps lock)
• Both frames get destroyed (MIC/Payload CRC error)
![Page 27: LoRa’sJambalaya - Fernando Kuipers · 2019-05-21 · LoRa’sJambalaya Fernando Kuipers Delft University of Technology May 20th, 2019 . 2 “Sense and the city ... LoRa's Jambalaya](https://reader030.fdocuments.in/reader030/viewer/2022040610/5ed2040c6731c53a5734c2b8/html5/thumbnails/27.jpg)
27
Parameters Device 1 (N1)
Device 2 (N2)
Same network scenario TTN
Different networks TTN KPN
Transmission power (TP)
8 dBm 14 dBm
Time offset 0 ms ++ 1 symbol (delayed)
Frequency (CF) 868.1 MHz
Data Rate SF9BW125
Multiple GWs experiment setup
![Page 28: LoRa’sJambalaya - Fernando Kuipers · 2019-05-21 · LoRa’sJambalaya Fernando Kuipers Delft University of Technology May 20th, 2019 . 2 “Sense and the city ... LoRa's Jambalaya](https://reader030.fdocuments.in/reader030/viewer/2022040610/5ed2040c6731c53a5734c2b8/html5/thumbnails/28.jpg)
28
DER
DER
DER multiple GWs
Same network (TTN)
Different networks (TTN & KPN):- KPN device as interferer- KPN device received 2 new frequency channels (867.7 and 867.9 MHz) due to ADR
![Page 29: LoRa’sJambalaya - Fernando Kuipers · 2019-05-21 · LoRa’sJambalaya Fernando Kuipers Delft University of Technology May 20th, 2019 . 2 “Sense and the city ... LoRa's Jambalaya](https://reader030.fdocuments.in/reader030/viewer/2022040610/5ed2040c6731c53a5734c2b8/html5/thumbnails/29.jpg)
29
• Conditions for the capture effect to occur:– The stronger frame overlaps with the LoRa header of the
weaker frame– Both frames might still be decoded whenever the stronger
frame only slightly overlaps with the payload CRC of the weaker frame
• Adding more gateways improves DER:– Stronger signals are received by more distant gateways than
weaker signals
Insigths
![Page 30: LoRa’sJambalaya - Fernando Kuipers · 2019-05-21 · LoRa’sJambalaya Fernando Kuipers Delft University of Technology May 20th, 2019 . 2 “Sense and the city ... LoRa's Jambalaya](https://reader030.fdocuments.in/reader030/viewer/2022040610/5ed2040c6731c53a5734c2b8/html5/thumbnails/30.jpg)
30
LoRaWAN security vulnerabilities
Do not try this at home ;)
[4] X. Wang, E. Karampatzakis, C. Doerr, and F.A. Kuipers, “Security Vulnerabilities in LoRaWAN,” Proc. of ACM/IEEE IoTDI 2018.
![Page 31: LoRa’sJambalaya - Fernando Kuipers · 2019-05-21 · LoRa’sJambalaya Fernando Kuipers Delft University of Technology May 20th, 2019 . 2 “Sense and the city ... LoRa's Jambalaya](https://reader030.fdocuments.in/reader030/viewer/2022040610/5ed2040c6731c53a5734c2b8/html5/thumbnails/31.jpg)
31
![Page 32: LoRa’sJambalaya - Fernando Kuipers · 2019-05-21 · LoRa’sJambalaya Fernando Kuipers Delft University of Technology May 20th, 2019 . 2 “Sense and the city ... LoRa's Jambalaya](https://reader030.fdocuments.in/reader030/viewer/2022040610/5ed2040c6731c53a5734c2b8/html5/thumbnails/32.jpg)
32
![Page 33: LoRa’sJambalaya - Fernando Kuipers · 2019-05-21 · LoRa’sJambalaya Fernando Kuipers Delft University of Technology May 20th, 2019 . 2 “Sense and the city ... LoRa's Jambalaya](https://reader030.fdocuments.in/reader030/viewer/2022040610/5ed2040c6731c53a5734c2b8/html5/thumbnails/33.jpg)
33
![Page 34: LoRa’sJambalaya - Fernando Kuipers · 2019-05-21 · LoRa’sJambalaya Fernando Kuipers Delft University of Technology May 20th, 2019 . 2 “Sense and the city ... LoRa's Jambalaya](https://reader030.fdocuments.in/reader030/viewer/2022040610/5ed2040c6731c53a5734c2b8/html5/thumbnails/34.jpg)
34
Security features of LoRaWAN• Channel confidentiality
– Network and application keys– End-to-end encryption
• Enrollment protocol– Activation by Personalization (ABP)– Over-the-Air Activation (OTAA)
• Integrity and authenticity validation– Message Integrity Code (MIC)
![Page 35: LoRa’sJambalaya - Fernando Kuipers · 2019-05-21 · LoRa’sJambalaya Fernando Kuipers Delft University of Technology May 20th, 2019 . 2 “Sense and the city ... LoRa's Jambalaya](https://reader030.fdocuments.in/reader030/viewer/2022040610/5ed2040c6731c53a5734c2b8/html5/thumbnails/35.jpg)
35
Channel confidentiality
End Devices Gateway NetworkServer
ApplicationServer
Sensor1NwkSKey
AppSKey 1AppSKey 1
AppSKey 2
Sensor2NwkSKey
AppSKey 1
Sensor3NwkSKey
AppSKey 2
NwkSKey
EncryptedIntegrity
Protected
![Page 36: LoRa’sJambalaya - Fernando Kuipers · 2019-05-21 · LoRa’sJambalaya Fernando Kuipers Delft University of Technology May 20th, 2019 . 2 “Sense and the city ... LoRa's Jambalaya](https://reader030.fdocuments.in/reader030/viewer/2022040610/5ed2040c6731c53a5734c2b8/html5/thumbnails/36.jpg)
36
Encryption by AppSKey
Nonce
Ciphertext
Plaintext
key
Block Counter FCntUp/Down
AES
Ciphertext
Plaintext
key
Block Counter
Block Cipher in CTR Mode LoRaWAN implementation
block cipherencryption
![Page 37: LoRa’sJambalaya - Fernando Kuipers · 2019-05-21 · LoRa’sJambalaya Fernando Kuipers Delft University of Technology May 20th, 2019 . 2 “Sense and the city ... LoRa's Jambalaya](https://reader030.fdocuments.in/reader030/viewer/2022040610/5ed2040c6731c53a5734c2b8/html5/thumbnails/37.jpg)
37
Enrollment protocol• OTAA:
– End-device sends Join Request– Network server sends Join Accept with AppNonce– AppNonce to generate NwkSKey and AppSKey
• ABP:– No exchange of join messages– NwkSKey and AppSKey pre-assigned
![Page 38: LoRa’sJambalaya - Fernando Kuipers · 2019-05-21 · LoRa’sJambalaya Fernando Kuipers Delft University of Technology May 20th, 2019 . 2 “Sense and the city ... LoRa's Jambalaya](https://reader030.fdocuments.in/reader030/viewer/2022040610/5ed2040c6731c53a5734c2b8/html5/thumbnails/38.jpg)
38
Integrity and Authenticity validation
RadioPreamble PHYLayer Payload CRC
MICMAC Layer PayloadMAC HDR(DevAddr, FCnt)
Frame PayloadFrmHdr
FramePort
Integrity Check using NwkSKey
Encrypted by AppSKey
![Page 39: LoRa’sJambalaya - Fernando Kuipers · 2019-05-21 · LoRa’sJambalaya Fernando Kuipers Delft University of Technology May 20th, 2019 . 2 “Sense and the city ... LoRa's Jambalaya](https://reader030.fdocuments.in/reader030/viewer/2022040610/5ed2040c6731c53a5734c2b8/html5/thumbnails/39.jpg)
39
Replay attack
End Devices Gateway
Message 69 (FCntUp = 70)
ACK
Message 1 (FCntUp = 0)
ACK
Reset or overflow
Message 2 (FCntUp = 1)
ACK
Malicious Message (FCntUp = 70)
ACK
Message 3 (FCntUp = 2)Message 4 (FCntUp = 3)
xx
x Adversary replaysold m
essage
![Page 40: LoRa’sJambalaya - Fernando Kuipers · 2019-05-21 · LoRa’sJambalaya Fernando Kuipers Delft University of Technology May 20th, 2019 . 2 “Sense and the city ... LoRa's Jambalaya](https://reader030.fdocuments.in/reader030/viewer/2022040610/5ed2040c6731c53a5734c2b8/html5/thumbnails/40.jpg)
40
Eavesdropping
Nonce
Ciphertext
Plaintext
key
Block Counter FCntUp/Down
AES
Ciphertext
Plaintext
key
Block Counter
Block Cipher in CTR Mode LoRaWAN implementation
block cipherencryption
If FCnt is re-used
Guess one word to derive the other
![Page 41: LoRa’sJambalaya - Fernando Kuipers · 2019-05-21 · LoRa’sJambalaya Fernando Kuipers Delft University of Technology May 20th, 2019 . 2 “Sense and the city ... LoRa's Jambalaya](https://reader030.fdocuments.in/reader030/viewer/2022040610/5ed2040c6731c53a5734c2b8/html5/thumbnails/41.jpg)
41
ACK spoofing
End Device Gateway Network Server
M1, UCtr = 20 M1, UCtr = 20
ACK, DCtr = 10
UCtr = 20,DCtr = 10
xx
M2, UCtr = 21 xACK, DCtr = 10
Application Server
M1, UCtr = 20
...
![Page 42: LoRa’sJambalaya - Fernando Kuipers · 2019-05-21 · LoRa’sJambalaya Fernando Kuipers Delft University of Technology May 20th, 2019 . 2 “Sense and the city ... LoRa's Jambalaya](https://reader030.fdocuments.in/reader030/viewer/2022040610/5ed2040c6731c53a5734c2b8/html5/thumbnails/42.jpg)
42
Bit flipping
![Page 43: LoRa’sJambalaya - Fernando Kuipers · 2019-05-21 · LoRa’sJambalaya Fernando Kuipers Delft University of Technology May 20th, 2019 . 2 “Sense and the city ... LoRa's Jambalaya](https://reader030.fdocuments.in/reader030/viewer/2022040610/5ed2040c6731c53a5734c2b8/html5/thumbnails/43.jpg)
43
Counter-measure
RadioPreamble PHYLayer Payload MIC
MIC
MAC Layer PayloadMAC HDR(DevAddr, FCnt)
Frame PayloadFrmHdr
FramePort
Integrity Check using NwkSKey
Authenticated Encryption by AppSKey
MIC of
MIC of
![Page 44: LoRa’sJambalaya - Fernando Kuipers · 2019-05-21 · LoRa’sJambalaya Fernando Kuipers Delft University of Technology May 20th, 2019 . 2 “Sense and the city ... LoRa's Jambalaya](https://reader030.fdocuments.in/reader030/viewer/2022040610/5ed2040c6731c53a5734c2b8/html5/thumbnails/44.jpg)
44
More info? Contact me at
Fernando KuipersDelft University of Technology
[email protected]://fernandokuipers.nl/