# LoRaWAN Physical Layer-Based Attacks and Countermeasures, A Review
## 4 Protection Techniques
### Replay Attack Detection  
The state-of-the-art literature considers mostly replay-attack prevention methods pointing to a vulnerability connected to the OTAA procedure, which takes place on a MAC layer. In terms of physical-layer-replay-attacks-protection mechanisms, the authors of [64] introduced a detection technique to an attack vector against gateway-side timestamping, where the delayed forwarding of LoRa waveforms plays the key role. The so called frame-delay attack mechanism closely follows the popular RollJam attack [76], which targets rolling-code-based replay attack prevention in keyless-entry systems. In the LoRaWAN settings, a frame-delay attack necessitates, firstly, an eavesdropper node, which listens for a victim device. Secondly, a collider/replay node takes care of the blocking of the legitimate  
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**Ref.** & **Technique** & **Enhances \({}^{*}\)** & **Advantages** & **Disadvantages** \\ \hline
[64] & Replay detection & C & Comprehensive experimental validation & - \\
[65] & Secret key agreement & C,I & Experimental validation & No experiments with LoRaWAN \\
[19] & Secret key agreement & C,I & Quantization for high key randomness & No experiments with LoRaWAN \\
[21] & Secret key agreement & C,I & Effective over long communication & Requires reconfigurable antennas \\
[66] & Secret key agreement & C,I & Suitable for mobile and stationary nodes & - \\
[67] & Secret key agreement & C,I & Low algorithmic complexity & Bit disagreement rate \\
[68] & Secret key agreement & C,I & High secret key entropy & Increased algorithmic complexity \\
[22] & Jamming detection & A & Versatile modeling tools for performance & No large scale validation \\
[23] & Jamming detection & A & High detection accuracy & Only small scale validation \\
[69] & Jamming resilience & A & - & No experimental validation \\
[70] & Jamming resilience & A & - & No experimental validation \\
[24] & Jamming resilience & A & Effective against synchronized jammers & - \\
[71] & Jamming resilience & A & High performance improvement with low overhead & Acknowledged transmissions not supported \\
[72] & Jamming resilience & A & High performance improvement & - \\
[16] & Wireless fingerprinting & U & Investigation on various neural networks & Channel effect is not considered \\
[73] & Wireless fingerprinting & U & Algorithm for manual extraction of RF fingerprints & Experiments on channel \\
[74] & Wireless fingerprinting & U & Both indoor and outdoor experiments. & Solutions to channel and receiver \\
[75] & Wireless fingerprinting & U & Receiver and channel effects are studied. & effects are not provided \\
[14] & Wireless fingerprinting & U & Experiments at various distances are conducted & Solutions to channel effects are not provided \\
[18] & Wireless fingerprinting & U & Consideration on openset/zero-shot classification & Solutions to channel effects are not provided \\
[17] & Wireless fingerprinting & U & Large-scale dataset of 100 LoRa devices. & - \\
[17] & Wireless fingerprinting & U & Design of channel independent spectrogram to mitigate channel effects. & Low SNR outdoor experiments are missing \\ \hline \hline \end{tabular}  
* (C—Confidentiality, I—Integrity, A—Availability, U—Authentication).  
\end{table}
Table 3: Overview of physical layer countermeasures.  
LoRa frames and replaying of the eavesdropped frames. Hence, arbitrary delays can be introduced to the gateway-side timestamps and, thus, e.g., sensor data arriving late to an application server cannot be distinguished from actual nondelayed data by the commodity LoRaWAN hardware. The authors proposed a physical-layer detection mechanism by extracting frequency bias from LoRa waveforms with an RTL-SDR receiver connected to a LoRaWAN gateway. By comparing known frequency-bias values to collected bias values, replay attempts could be detected even for a signal with an SNR as low as \(-18\) dB.