## 3 Long-Range, Low-Power IoT Communication Protocols and Their Security
### NB-IoT
For instance, the eNodeB may receive duplicate packets, which are removed by the application server. Moreover, over the wireless link, between UE and eNodeB, data packets can be transmitted without an IP header. The data are encapsulated directly in the data link frame header, which results in smaller packets. **Security. ** How is the security provided at the link layer? First, during the connection phase, the UE and eNodeB agree on a security mode to provide confidentiality and another security mode to help protect the integrity of the data. They may be the same or different. Each can have one of four values [67]: no cipher algorithm, SNOW 3G, AES, or ZUC encryption. Assuming AES encryption, the frame shown in Figure 6 shows that NB-IoT provides security using MAC-then-Encrypt (MtE). First, NB-IoT calculates the MAC-I (or MIC). As in Equation (6), it uses AES in Cipher-based MAC (CMAC) mode [68], which works as in AES-CBC mode. It divides the message into blocks of 128 bits, and each block is used in an XOR operation with the following block [46]. The message bits, plus a 32-bit frame counter, a 1-bit direction bit (uplink or downlink), and a 5-bit radio bearer identifier (ID), are inputsto generate the 32-bit MAC-I. The key used in this step is the integrity key KRRCint, which is created at the Radio Resource Control (RRC) sub-layer. \[\text{Cmac}=\text{AES128\_cmac}(\text{K}_{\text{RRCint}},\text{Count}\,|\,\text {Dir}\,|\,\text{ID}\,|\,\text{Msg}) \tag{6}\]  
Then, the entire message, including the 32-bit MAC-I, goes through the AES-CTR encryption procedure, as in Equation (7). The encryption key also comes from the Radio Resource Control sub-layer. Encryption key KRRCenc is used to encrypt signaling messages, while key KUPenc encrypts regular data packets. All keys are 128 bits long. AES-CTR mode encrypts a random 128-bit key using a 128-bit counter value, where the Home Subscriber Server (HSS) at the EPC sets the first 96 bits [44]. The inputs to the AES-128 CTR algorithm are a 32-bit frame counter, a direction bit, a 5-bit radio bearer identifier (ID), and the block length (Equation (7)). This produces the encrypted keystream, which will be XORed with the plaintext block, to generate the final encrypted frame or ciphertext, as in Equation (8). \[\text{Keystream}=\text{AES128\_enc}(\text{K}_{\text{Upenc}},\text{Count}\,|\, \text{Dir}\,|\,\text{ID}\,|\,\text{Length}) \tag{7}\]  
\[\text{Ciphertext}=(\text{message}\,|\,\text{MAC-I})\,\text{XOR}\,\text{Keystream} \tag{8}\]  
The ciphertext is then transmitted over the radio link. Therefore, NB-IoT security provides integrity and confidentiality at the link layer using the MAC-then-Encrypt (ME) strategy. It is also possible that NB-IoT uses the SNOW 3G encryption algorithm [69]. The SNOW 3G algorithm is defined by the European Telecommunications Standards Institute (ETSI). In SNOW 3G, a Linear Feedback Shift Register (LFSR) consisting of sixteen 32-bit registers is used to generate input values to a Finite State Machine (FSM). The output of the FSM is then used in an XOR operation with the data in the least significant register of the LFSR to generate a stream of keys that are used to encrypt the message [70]. SNOW 3G is also used for integrity and authentication. In the next hop, between eNodeB and the application server at the EPC, the application data are encapsulated into an IP/UDP header. Although the Transport Control Protocol (TCP) is supported, the more lightweight UDP transport protocol is preferred. Network layer encryption such as an IP Security (IPSec) protocol [71] is used, as in an example shown for NB-IoT in [49] where a virtual private network tunnel is used between the core network server and the user application in the cloud. Moreover, Datagram Transport Layer Security (DTLS) over UDP is an option at the application layer. Based on [PERSON]'s [21] approach of \"end-through-node-to-end encryption\", NB-IoT adopts a similar strategy, since the server  
Figure 6: IoT network architectures for wide-area and their security protocols.