Enhancing LoRaWAN Security through a Lightweight and Authenticated Key Management Approach

TLDR

IoT and LP‑WAN technologies such as LoRaWAN incorporate security, but their pre‑shared key schemes lack flexibility for key updates. This study evaluates LoRaWAN key‑management vulnerabilities and proposes alternative schemes. We performed a comparative conceptual analysis of LoRaWAN security schemes to assess overhead and benefits. An EDHOC‑based approach proved convenient, offering flexible session‑key updates, low computational cost, and minimal message exchanges.

Abstract

Luckily, new communication technologies and protocols are nowadays designed considering security issues. A clear example of this can be found in the Internet of Things (IoT) field, a quite recent area where communication technologies such as ZigBee or IPv6 over Low power Wireless Personal Area Networks (6LoWPAN) already include security features to guarantee authentication, confidentiality and integrity. More recent technologies are Low-Power Wide-Area Networks (LP-WAN), which also consider security, but present initial approaches that can be further improved. An example of this can be found in Long Range (LoRa) and its layer-two supporter LoRa Wide Area Network (LoRaWAN), which include a security scheme based on pre-shared cryptographic material lacking flexibility when a key update is necessary. Because of this, in this work, we evaluate the security vulnerabilities of LoRaWAN in the area of key management and propose different alternative schemes. Concretely, the application of an approach based on the recently specified Ephemeral Diffie⁻Hellman Over COSE (EDHOC) is found as a convenient solution, given its flexibility in the update of session keys, its low computational cost and the limited message exchanges needed. A comparative conceptual analysis considering the overhead of different security schemes for LoRaWAN is carried out in order to evaluate their benefits in the challenging area of LP-WAN.