LoRa, LoRaWAN, and thechallenges of long-range
networking in sharedspectrum!
Cogni&ve Radio Pla/orm NL, december 2015

Thomas Telkamp!
This presenta&on by Thomas
Telkamp is licensed under a
Crea&ve Commons ADribu&on 4.0
Interna&onal License

Contents!
• LPWAN!
• LoRa modulation!
• Hardware!
• LoRaWAN protocol!
• Deployment models!
• Long-range networking in shared spectrum!
2

LoRa, LoRaWAN, LPWAN…?!
• LPWAN name for Low Power Wide-Area Network!
• a wireless wide area network technology that is specialized forinterconnecting devices with low-bandwidth connectivity,focusing on range and power efficiency.!

• Mostly unlicensed (but regulated) spectrum under 1 GHz (433,868, 915 MHz)!
• Multiple solutions, including:!
!

3Bandwidth vs Range!

•••

Long Distance!
High Speed!
Low Power!

802.11ac!
3G/4G!
LTE!

WiFi!

Bandwidth!

Pick 2…!

802.11g!

Bluetooth/BLE!

RFID/NFC!

ZigBee!

LoRa, SigFox, UNB!

Range!
4

What is LoRa?!
• Wireless modulation technology!
• Physical layer for long range communications!
• Low bandwidth!
• Low battery usage!
• Operates in the license-free ISM bands all around the world!
• 433, 868, 915 Mhz!
• Regulated (power, duty-cycle, bandwidth)!
• EU: 0.1% or 1% per sub-band duty-cycle limitation (per hour)!

• Sensitivity: -142 dBm!
• Link budget (EU): 156 dB!
5What is LoRaWAN?!
• Communications protocol and architecture that utilizes the LoRa
physical layer!
• Data rates are defined that range from 300bps to 5.5kbps!
• with two high-speed channels at 11kbps and 50kbps (FSKmodulation)!
• Supports !
• secure bi-directional communication,!
• mobility!
• localization.!

6

7

LoRa Modulation!

LoRa characteristics!
• A variation of chirp spread spectrum (CSS)!
• Transmit power in EU 868 Mhz!
band is mostly limited to 14 dBm!
(=25 mW) !
• Increase reach by increasing energy per bit:!
• Transmit power!
• Modulation rate!

• LoRa uses Spreading Factors!
to set the modulation rate!
(SF7 to SF12)!
• Robust to interference, multipath, !
and fading!
• Developed by Cycleo, a French company !
acquired by Semtech in 2012!
• IP requires less than 50k gates!
9

On-Off Keying!
Source: MaD KnightFrequency-shift Keying!

LoRa!
10

BandwidthFrequency

Time domain (1 chirp):

Symbol periodTime

11

Spreading Factors!

freqency• SF7!
• SF8!
• SF9.!

time

12

40=!

020x!

60

80

100

120

LoRa Demodulation (SF7)!

Received Lora signal!

Inverse chirp!

Decoded symbols!

13

LoRa Demodulation!

Baseband!
Lora chirp!

Complex!
Multiply!

FFT!

Inverse!
chirp!

Source: MaD Knight

14

40=!

020x!

60

80

100

120

LoRa Demodulation!

Received Lora signal !
Narrowband interferer!

Inverse chirp!

Decoded symbols!

15

Co-channel interference rejection!

Spreading factor

Constant envelope interferer(FSK, GFSK, …)

Noise like interferer(OFDM, QAM, …)

SF7-12.5 dB-9.5 dB…

…

…

SF12-25 dB-22 dB

16

LoRa specifics!
• Symbol rate: ! Rs = BW
2 SF
• SF bits per symbol!
• Bit rate: ! Rb = SF BW
SF
2• Data whitening, Interleaving, Forward Error Correction!
17

Source: Semtech

18

19

LoRa Spreading Factors (125kHz bw)!
Spreading Factor

Chips/symbol

SNR limit

Time-on-air (10byte packet)

Bitrate7128-7.5

56 ms

5469 bps

8256-10103 ms3125 bps

9512-12.5

205 ms1758 bps

101024-15

371 ms977 bps112048-17.5

741 ms537 bps

124096-20

1483 ms

293 bps

20

LoRa Spreading Factors!

21

Benefits of LoRa CSS!
• Simple to implement (Constant Envelope Modulation)!
• Low acquisition time (compared to DSSS)!

• Very resistant to both in-band and out-of-band interference!
• High immunity to multipath and fading!
• Doppler shift resistant!
• Moving devices!
• High clock tolerance (e.g. 30 ppm crystal!)!

• Good sensitivity!

• LoRa reception is simple (symmetrical up/down budget)!
• Downside: not terribly spectrum efficient!
22

Hardware!

Device chips!
• SX1276 -- 137 MHz to 1020 MHz Low Power Long Range Transceiver!
• SX1272 -- 860 MHz to 1020 MHz!
• FSK, GFSK, MSK, GMSK, OOK and LoRa modulation!
• +20 dBm or +14 dBm (high efficiency PA)!
• Channel activity detection (CAD) mode!
• designed to detect a LoRa preamble on the radio channel with the best
possible power efficiency!

24

Devices!

25

Gateway:!
SX1301 (DSP) + 2x SX1257 (RF)!

26

SX1301!
!
• Base Band processor!
• 2x SX1257 RF front-end!
• 8 separate 125 kHz LoRa!
channels!
• One high speed 250 kHz !
LoRa channel !
• One high speed 200 kHz !
GFSK channel !
• Emulates 49 LoRa !
demodulators!
• SX1308 for femto gateway!
27

LoRaWAN Protocol!

LoRaWAN !
• Protocol standardized by the LoRa Alliance!
• Current version: 1.0!
• 1.0.2 upcoming, with extra frequency plans!
• 1.1 next major release!
• https://www.lora-alliance.org!
• LoRaWAN 1.0 Specification!
• White papers!

• For use in global ISM bands:!
• EU_863_870!
• US_902_928!
• CN779-787, EU433, AU915-928, CN470-510, AS923, KR920-923!
29

Global ISM bands!

30

31

LoRaWAN frame!

Source: Ac&lity

32

LoRaWAN architecture!

33

Gateway RX data format!
{"rxpk":[{"tmst":87485028,"time":"2016-12-06T11:15:50.763950Z","chan":6,"rfch":0,"freq":867.700000,"stat":1,"modu":"LORA","datr":"SF9BW125","codr":"4/5","lsnr":-11.8,"rssi":-118,"size":29,"data":"QDABAUCA3CMBnpi48xb25eMnX2iH5sA/8RqLqNg="}]}34

LoRaWAN device classes!
• Three classes of devices have been defined, to address specificapplication requirements:!
• Class A: Each device's uplink transmission is followed by two short
downlink receive windows.!
• Class B: In addition to the Class A functionality, Class B devices open
extra receive windows at scheduled times. !
• Class C: These devices have a continuous open receive widow,
except when transmitting.!
35

LoRaWAN Class A!

36LoRaWAN security!
• Two layers of security: !
• Network (nwkSkey)!
• Application (appSkey)!

• AES 128 (128 bit key length)!
• The network security authenticates the node in the network!
• Message Integrity Check (MIC)!

• The application layer of security ensures the network operator
does not have access to the application data. !
• Sensitive data can optionally be encrypted on top of this with astronger algorithm.!
37

Applica&on payload

end-device application
session key

DevAddrFCnt

end-device network
session key

AES128encryptionEncrypted Payload

MIC(*)

AES128signature(*) MIC = Message Integrity Check

Source: Semtech38• Upon reception of a frame, the network server checks that the frame received MIC signature
matches the one computed using the end-device’s network session key contained in its key
database!
DevAddr

FCnt

Encrypted Payload

MICcheckMIC
Networksession Key
database

Cryptosignature

Source: Semtech

39

LoRaWAN security!
• Activation by Personalization or Over The Air (OTAA)!
• Personalization:!
• Fixed device addresses and security keys!
• Simple!
• Vulnerable to replay attacks (after a reset)!
• Over The Air Activation!
• New security session keys can be generated from a sharedsecret!
• Enables roaming!
40

Join Process!
• Device is provisioned with DevEUI (64 bits), AppEUI (64 bits), and AppKey (128 bits)!
• Device sends join request message:!

• Network server calculates the session keys:!
• NwkSKey = aes128_encrypt(AppKey, 0x01 | AppNonce | NetID | DevNonce | pad16)!
• AppSKey = aes128_encrypt(AppKey, 0x02 | AppNonce | NetID | DevNonce | pad16)!

• Network server send join accept message:!

41

LoRaWAN scalability!
• Gateways listen on 8 frequencies!
• All SF per frequency!
• Can receive concurrently two different SF on the same frequency!
• In case of collision, packet with strongest signal gets decoded (generally)!
• Two dedicated high-speed channels (10 kbps and 50 kbps)!
• Adaptive Data Rate (ADR), see next slide!
• In case of congestion, scale by adding gateways!
• Nodes get closer to the gateway!
• Due to ADR, spreading factors will be reduced!
• More capacity: multiplicative!!
42

Adaptive Data Rate (ADR) mechanism!
Received packets

SF = 12MaxSNR = -10 dBSpreading Factor

SNR limit

7-7.5

8-10

9-12.5

10-15

11-17.5

12-20

Can increase rate to SF10:-10 dB (SNR) - 5 dB (margin)= -15 dB

Link ADR request: SF1043

Deployment models!

45

Private vs Public Network!
• Private Network!
• Individually managed!
• Specific deployments: geographically bound!
• Centralized Public Network!
• Telecom operator managed network!
• Large geographical coverage!
• Fully managed!
• Roaming!
• Distributed/Cooperative Public Network!
• No single owner, no single point of control!
• E.g. The Things Network!
• Internet model!

46

The Things Network!
• Global community LoRaWAN network!
• No “single point of control”!
• End-to-end encryption!
• No country borders!
• Overlapping device-addresses !
• Uses recently released sub-band g1, line 3, Note 5!

47

48

49

Core Components!
Gateway
Send data to andreceive data fromnodes

B
HBroker
Decoupling from Routerand Applica&on Handler
ApplicaNon Handler
Decryp&on, deduping,works on behalf of apps

RNCA

RouterRoutes raw packets
from gateways tobrokers
Network Controller
Node state: data rateand frequency
management
ApplicaNon
User applica&on
50

Public and Private Networking!

HHH

NC

RR
Private NetworkR

B

NC

B

NR

Private Storage Handler

BNC

A
A

H
H

A
A
51

!

Long-range networking inshared spectrum!

LoRaWAN observations!
• LoRa designed for use in ISM band: interference tolerant!
• Due to uncoordinated transmission, system can’t sustain a high load(‘ALOHA-like’)!
• Maintain reception duty-cycle under 10% (per channel)!
• Manage load by densifying the network: cheap gateways!
• Additional benefit: more downlink capacity (half-duplex gateways)!
• Is this good use of the (ISM) spectrum?!
• How does LoRa affect other long-range technologies?!
53

Optimizations!
• Adaptive Data Rate!
• Manage spreading factor and transmission power!
• Geography based channel allocation (use certain frequencies in someplaces but not in others)!
• Listen Before Talk!

54

Alternative LPWAN technologies!
• SigFox!
• (Ultra) narrowband DBPSK uplink!
• 100Hz uplink channels (random!) in 200 kHz band !
• 12 bytes packets, 3x repetition!
• GFSK downlink (600 baud)!
• Gateways and servers managed by SigFox!
• LinkLabs Symphony Link!
• LoRa based, but synchronized/slotted !
• Not for public networking!
• Other!
• Ingenu, 802.11ah, Waviot, Weightless-N, -P, etc.!
55

3GPP!
• LTE Cat-M1!
• ‘LTE-Light’!
• Smaller front-end (1.4Mhz), half-duplex, 1 antenna!
• Cheaper chipset!
• Power Saving Mode and Extended Discontinuous Reception!
• Questions/Issues: cost, IPR, actual battery usage!
!
• LTE Cat-NB, NB-IOT!
• Not LTE!
• 200 kHz bands: stand-alone, guard-band, in-band!
• Questions/Issues: deployment, IPR, cost, battery, mobility, sim-card (?)!
56

Commons!
• Elinor Ostrom, “Governing the Commons”!
• “Tragedy of the commons” can be prevented if a commons is bound bypeople, place, and rules!
• ISM band for SRD is regulated for uncooperative users!
• Limit power and duty-cycle to limit influence of a single user!
• But for long-range networking this is different. Users:!
• are related to each other (could be grouped)!
• have common objectives!
• could develop and maintain rules that maximize total gain!
57

What can we do?!
• Recent (lpwan) IoT research reports (Dialogic, Stratix, Figo, Strict, etc.) signal
potential problems, but do not provide significant solutions (or directions) otherthan managing the problem itself by raising awareness, additional spectrum,stricter rules, monitoring, etc.!
• What can we learn from Cognitive Radio, Commons models, and available data for
future use of license-exempt spectrum?!
• For example, simple CR capabilities!
• Mix LoRa (CSS) with narrowband and have devices and the network make smart
decisions, to optimize performance and efficiency!
• E.g. Ultra-Narrowband for uplink, LoRa for downlink!

• Measure and share frequency usage!
• Multi dimensional metrics?!

• Can we start experimenting with technical and policy solutions in current licenseexempt spectrum, to build a case for future allocations?!
58

Extra material!

60

SODAQ balloon flight (>14km altitude)!

Max. number of gateway for a single message: 84!
Max. distance: 325 km!

61