Abstract
In recent years, Internet of Things (IoT) as an essential infrastructure for industrial development, environmental protection and human life enhancement has attracted researchers' attention. Currently, there are four hot research topics in IoT fields, including sensor design, communication scheme, secure transmission, and data mining. The LoRaWAN, an unlicensed band based long range wide area network specification, is very suitable for the activities or operations in an IoT environment due to its low power and long range communication. In the LoRaWAN, star-of-stars topology, asynchronous communication, and three communication modes are used to reduce its power consumption. In order to enhance the security of network communication, the LoRaWAN adopts the 128-bit Advanced Encryption Standard (AES-128) and utilizes two session keys: network session key and application session key, for encrypting/decrypting data between end devices and network/application servers. However, according to the LoRaWAN Backend Interfaces 1.0 Specification announced by LoRa Alliance in 2017, the application layer communication securities between two arbitrary servers (including network servers, join server, and application servers) are out of the specification's scope. That is to say that the important data transmitted from one server to another may be attacked, falsified, or stolen easily. In this paper, a session key generation method is proposed to generate session keys with which two servers can securely communicate with each other, especially enhancing the application layer communication securities undefined in the LoRaWAN Specification. By integrating elliptic curve cryptography and AES-128, the session keys for different pairs of servers are created. The security discussion shows that the proposed method provides the features of mutual authentication, confidentiality and message integrity. Besides, it can also help to resist replay and eavesdropping attacks.
Highlights
In recent years, many Internet-of-Things (IoT) applications have been developed to improve industrial manufacturing processes and enhance people’s quality of lives
Since αJS is kept in join server and another server’s system time and private key are generated in the KEYGEN procedure (step (1) of Round 1), all these three parameters are protected with elliptic curve cryptography (ECC) and Advanced Encryption Standard (AES) cryptographies
STUDIES In order to provide secure communication for LoRaWAN servers, the S2KG is proposed in this study
Summary
Many Internet-of-Things (IoT) applications have been developed to improve industrial manufacturing processes and enhance people’s quality of lives. The development of IoT comes from the advancement of various technologies, including sensors, network communication techniques, security policies, innovative applications, and so on. LoRaWAN adopts unlicensed bands to define IoT network architecture and provides long-range communication, long battery lifetime, secure data communication and high network capacity. In this paper, a LoRaWAN Server Session Key Generation (S2KG) method which extends the concept of [13] is proposed to secure the communications among different LoRaWAN servers. The S2KG utilizes both public key cryptography and symmetric key cryptography on different server pairs For those join-server-related communication links, the elliptic curve cryptography (ECC) is employed, and for other communication links, the AES is used. 1) We proposes the S2KG to generate application-layer communication session keys which are undefined in LoRaWAN specification v1.0 and v1.1.
Sign-in/Register to view highlights & summary Talk to us
Join us for a 30 min session where you can share your feedback and ask us any queries you have
Schedule a callDisclaimer: All third-party content on this website/platform is and will remain the property of their respective owners and is provided on "as is" basis without any warranties, express or implied. Use of third-party content does not indicate any affiliation, sponsorship with or endorsement by them. Any references to third-party content is to identify the corresponding services and shall be considered fair use under The CopyrightLaw.
