Tallinn University of Technology

LoRaWAN

Silva Sammelsaar 153018IASM

Gunnar Kotkasets 153681IASM

Tallinn 2016

Introduction

LoRaWAN is a MAC (media access control) protocol for Low Power Wide Area Network with features that support low-cost, mobile, and secure bidirectional communication for

Internet of Things (IoT), machine-to-machine (M2M), and smart city, and industrial applications. LoRaWAN is optimized for low power consumption and is designed to support large networks with millions and millions of devices. Innovative features of

LoRaWAN include support for redundant operation, geolocation, low-cost, and low-power - devices can even run on energy harvesting technologies enabling the mobility and ease of use of Internet of Things. LoRaWAN can be mapped to the second and third layer of the OSI model.

​LoRaWAN networks are typically laid out in a star-of-stars topology in which gateways relay messages between end-devices and a central network server at the backend. Gateways are connected to the network server via standard IP connections while end-devices use single-hop LoRa™ or FSK communication to one or many gateways.

The LoRaWAN protocols are defined by the

LoRa Alliance ​. ​A LoRaWAN stack is displayed below:

End-devices may transmit on any channel available at any time, using any available data rate, as long as the following rules are considered:

1) The end-device changes channel in a pseudo-random fashion for every transmission. The resulting frequency diversity makes the system more robust to interferences.

2) The end-device respects the maximum transmit duty cycle relative to the sub-band used and local regulations.

3) The end-device respects the maximum transmit duration (or dwell time) relative to the sub-band used and local regulations.

Also important to mention that maximum transmit duty-cycle and duration per sub-band are region specific.

Devices, LoRaWAN Classes

LoRaWAN media accesscontrol protocol is designed to allow low-powered devices communicate with applications that are connected directly to internet. Applications have to work over long range wireless connections. LoRaWAN is using OSI model second and third layer. End-devices divides into three parallel classes (A, B, C) on the same layer which serves application layer.

Devices are divided into three classes to optimize variety of end application by the usage. It is choosing between latency of the network downlink communication versus battery lifetime. Etc. Controlling applications needs network latency more than other application which are just gathering information from analog sensor world that needs rather battery lifetime. be most energy efficient as possible. Devices are required to be supported by all devices and downlink is available after sensor TX. Devices support bidirectional communication. Transmitter device sends randomly message and if server doesn’t respond then transmitter stay wait another successful message Tx-Rx connection.

Receiver (server side) can respond either of the messages which are sent out between short timeframe.

Class B -

Battery powered actuators has less battery efficiency but is designed to work energy efficient latency controlled downlink and slotted communication synchronized with a beacon. Devices are extending Class A by using time-synchronized beacons which are transmitted by gateway and they will periodically open recieve session. The main advantage of the A classes devices are that server is able to know when connection will be made by the device to share gathered information.

Class C - Devices are extending Class A. As this devices allows low-latency communication but consuming more energy and are able to keep receive session

always open unless transmitting. To the server side this means that data is always available with lowest latency. This means that devices can be listened continuously and there are no latency for against downlink communication.

MAC Commands

MAC commands are designed for managing devices from network server side.

LoRaWAN specifies set of commands which can be extended as needed for future releases. Currently commands are checking connectivity by asking device status or setting data rate of a device or modify communication channel settings. MAC layer commands are never visible to application layer. A MAC command consists of a command identifier CID of 1 octet followed by a possibly empty command-specific sequence of octets.

In the single data frame can contain any sequence of MAC command or alternatively piggybacked in the field or sent as a separate data frame. Piggybacked MAC commands are sent every time without encryption and cannot exceed 15 octets. MAC commands are always sent encrypted and must not exceed maximum FRMPayload.

MAC commands Table from lora-alliance specification:

Frequency bands

LoRaWAN operates in unlicensed radio spectrum. This means that anyone can use the radio frequencies without having to pay fees for transmission rights. It is similar to WiFi, which uses the 2.4GHz and 5GHz ISM bands worldwide. Anyone is allowed to set up

WiFi routers and transmit WiFi signals without the need for a license or permit.

LoRaWAN uses lower radio frequencies with a longer range. The fact that frequencies have a longer range also comes with more restrictions that are often country-specific.

This poses a challenge for LoRaWAN, that tries to be as uniform as possible in all different regions of the world. As a result, LoRaWAN is specified for a number of bands for these regions. These bands are similar enough to support a region-agnostic protocol, but have a number of consequences for the implementation of the backend systems.

European 863-870 MHz and 433 MHz bands

Of the available ISM frequency bands, LoRaWAN uses the 863-870 MHz and 433 MHz bands. The former, which is usually referred to as the 868 MHz band, is currently supported by The Things Network, whereas the latter will be implemented later.

The LoRaWAN specification defines 3 common 125 kHz channels for the 868 MHz band (868.10, 868.30 and 868.50 MHz) that must be supported by all devices and networks, and that all gateways should always be receiving on. These three channels form a common set of channels that all devices can use to join with a network. During this join procedure, the network can instruct the devices to add additional channels to its channel set. These channels are used for both uplink and downlink messages.

EU 863-870 default channels:

The European frequency regulations impose specific duty-cycles on devices for each sub-band. These apply to each device that transmits on a certain frequency, so both gateways and devices have to respect these duty-cycles. Most channels used by

LoRaWAN have a duty-cycle as low as 1% or even 0.1%. As a result, the network should be smart in scheduling messages on gateways that are less busy or on channels that have a higher duty-cycle.

US 902-928 MHz

In the United States, LoRaWAN operates in the 902-928 MHz frequency band. Unlike the European band, the US band has dedicated uplink and downlink channels. The band is divided into 8 sub-bands that each have 8x125 kHz uplink channels, 1x500 kHz uplink channel and 1x500 kHz downlink channel.

US 902-928 MHz channel frequencies:

The 915 MHz ISM Band shall be divided into the following channel plans.

Upstream – 64 channels numbered 0 to 63 utilizing LoRa 125 kHz BW varying from DR0 to DR3 starting at 902.3 MHz and incrementing linearly by 200 kHz to

914.9 MHz.

Upstream – 8 channels numbered 64 to 71 utilizing LoRa 500 kHz BW at DR4 starting at 903.0 MHz and incrementing linearly by 1.6 MHz to 914.2 MHz.

Downstream – 8 channels numbered 0 to 7 utilizing LoRa 500 kHz BW at DR10 to DR13) starting at 923.3 MHz and incrementing linearly by 600 kHz to 927.5

MHz.

US 902-928 end-devices should be capable of operating in the 902 to 928 MHz frequency band and should feature a channel data structure to store the parameters of

72 channels. A channel data structure corresponds to a frequency and a set of data rates usable on this frequency.

Australia 915-928 MHz

The specification of the Australian 915-928 MHz band is practically the same as the US

902- 928 MHz, except that its uplink frequencies are on higher frequencies than in the

US band. Its downlink channels are the same as in the US 868 MHz band.

China 779-787 MHz and 470-510 MHz

The Chinese 779-787 MHz band behaves similar to the European bands as long as the radio device EIRP is less than 10mW (10dBm). The 779-787 MHz band also has three common 125 kHz channels (779.5, 779.7 and 779.9 MHz). The end-device transmit duty-cycle should be lower than 1% and the ​JoinReq message transmit duty-cycle should not be more than 0.1%.

The first three channels correspond to 779.5, 779.7 and 779.9 MHz with DR0 to DR5 and must be implemented in every end-device. Those default channels cannot be modified through the

​NewChannelReq command and guarantee a minimal common channel set between end-devices and gateways of all networks. Other channels can be freely distributed across the allowed frequency range on a network per network basis.

The Chinese 470-510 MHz band behaves similar to the US bands. There are 96 uplink channels and 48 downlink channels. In some regions, a subset of these channels is used by China Electric Power and can therefore not be used for LoRaWAN.

Modulation and Data Rate

LoRaWAN uses LoRa modulation which is based technologically spread- spectrum technology. It is used because of well handling of channel noise, multipath fading and the Doppler effect at lower power conditions.

Firstly data rate depends on used bandwidth that is used and secondly spreading factor.

Data rates vary on bandwidth that is used etc LoRaWAN. Frequencies vary worldwide etc. 125kHz, 250kHz and 500 kHz used on channels. Spreading factor is chosen by considering end-device and how long does it take to transmit data frame.

Modulation is needed to create the long range communication link over physical layer or wirelessly. Most popular legacy wireless systems are using FSK - frequency shifting keying modulation as it is most efficient to use on low power systems. LoRa means

Long Range communication ability and is based on chirp technologies which is use decades by military. LoRa differs from military technology only its low cost design for commercial usage.

LoRa and LoRaWAN differs from competitors not because capability of long range communication, single gateway or coverage area but it have a link budget greater than any other standardized communication technology. The link budget is measured in dB

(decibels) and it is primary factor in determining the range in a given environment. For that reason entire countries can be easily covered with one standardized network.

Below is an example of LoRaWan coverage in Belgium.

Address space in LoRaWAN

LoRaWAN is making difference between end-device identifier (DevEUI 64 bit unique), device address (DevAddr 32 bit non-unique), application identifier (AppEUI 64 bit unique), GatewayEUI (64 bit unique).

64 bit DevUI is assigned to the device chip by the manufacturer, but all the communications is done with the dynamic DevAddr 32 bit device address which 7 of the bits is fixed and reserved for the Things Network. Other 25 bits are used for individual devices, procedure called Activation.

Application has in LoRaWAN network 64 bit identifier of The Things Network which is marked as AppEUI. The Things Network’s account server allocates AppEUI from MAC address book.

EUI is preferred to choose from configuration file but each of gateway has also unique

MAC address which is also used for identifying The Things Network.

There are two possible ways to to connect with The Things Network.One is OTAA

Over-the-Air Activation. Dynamic DevAddr is assigned and security keys are negotiated with the device.

There are other way to connect The Things Network. Sometimes DevAddr is hardcoded and also security keys in the device. This is called ABP Activation by Personalization.

Connecting is faster and simpler because of skipping joining procedure but security suffers.

Security

LoRaWAN knows three distinct 128-bit security keys. The application key ​AppKey is only known by the device and by the application. When a device joins the network (this is called a join or activation), an application session key AppsKey and a network session key NwkSKey are generated. The NwkSKey is shared with the network, while the AppSKey is kept private. These session keys will be use ​d for the duration of the session.

The above figure shows how these keys are used. Th

​e AppSKey is used for end-to-end encryption of the frame payload. The algorithm used for this is AES-128, similar to the algorithm used in the 802.15.4 standard. The NwkSKey is known by the network and the device and is used to validate the integrity of each message by its Message Integrity

Code (MIC). This MIC is similar to a checksum, except that it prevents intentional tampering with a message. For this, LoRaWAN uses AES-CMAC.

Frame Counters - Frame Counters prevent replay attacks where an attacker re-transmits a previously recorded message. To prevent this, the network and the device must both reject messages that contain a frame counter that is lower than the expected frame counter.

Estonia’s first public LoRaWAN network

First Estonian public nationwide LoRaWAN network in Estonia is called NORAnet. The network opened 5 October 2016. Companies that lead this in Estonia are The Estonian

IT and Communications company Unitcom Eesti OÜ.

Used literature

1. https://www.thethingsnetwork.org/wiki/LoRaWAN/Overview

2. https://www.lora-alliance.org/portals/0/specs/LoRaWANSpecification1R0.pdf

3. http://193.40.244.77/idu0310/wp-content/uploads/2016/09/LoRaWAN101.pdf

4. https://www.lora-alliance.org/For-Developers/LoRaWANDevelopers