The LoRaWAN standard comes from a Low Power Wide Area Network (LPWAN) technology suitable for developing Internet of Things (IoT) systems that are poised to disrupt the semiconductor industry. Even as a widespread technology used for diverse applications, security issues of long range (LoRa) networks and devices still remain a major challenge. Although the LoRa-Alliance enhanced the security and the network architecture of LoRaWAN from version 1.0 to version 1.1, the last version still faces some drawbacks such as being vulnerable to attacks. Some works in the literature have assessed LoRaWAN (v1.0 and v1.1) security risks and vulnerabilities. Moreover, all these specifications must coexist with each other, which makes compatibility an important factor in ensuring the sustainability of this technology. It is for this reason that we study the vulnerability of the LoRaWAN protocol in the context of compatibility. Hence, We consider four compatibility scenarios and possible cyber-attacks when connecting devices from the two mentioned versions. In this paper, we analyze the LoRaWAN architectures and then discuss the basic security concepts related to the compatibility scenarios between homogeneous or heterogeneous systems integrating the two LoRaWAN versions. After that, we investigate and then identify the potential security risks and network vulnerabilities in LoRaWAN technology. We establish a catalog of vulnerabilities for LoRaWAN on a methodological framework. The catalog contains 5 vulnerabilities related to LoRaWAN v1.0.x and v1.1 and 7 vulnerabilities related to LoRaWAN v1.0.x. After that, we check if these vulnerabilities could be applied to the compatibility scenarios. We observe that the majority of vulnerabilities mitigated in LoRaWAN v1.1 remain present in the compatibility scenarios.
Read full abstract