## 3 Long-Range, Low-Power IoT Communication Protocols and Their Security
### LoRaWAN
Thus, the variable-length message payload \(P\) is combined with the _DevAddr_ and frame counter \(C\), each consisting of 32 bits, to create the encrypted payload \(EP\). The frame counter \(C\) helps to keep the encrypted payload unique to avoid replay attacks. The encrypted payload \(EP\) will be transmitted all the way, end-to-end, to the application server, which has the AppSKey to decrypt it. \[EP=\text{AES128\_encrypt(AppSKey, DevAddr\mid C\mid P)} \tag{4}\]  
To provide integrity and authentication, the frame that now has the encrypted payload \(EP\), together with the frame headers, _DevAddr_, and frame counter \(C\), are used as inputsto the AES-CMAC algorithm with a Network Session Key (NwkSKey) to calculate the MIC, which is 32 bits long, as shown in Equation (5). The least significant four bytes of the CMAC are used in the frame. \[\text{cmac}=\text{AES128\_cmac(NwkSKey, Frame Header | DevAddr | C|EP)} \tag{5}\]  
In summary, the MIC provides integrity and authentication for the frames transported over the link layer, from the LoRa mote to the network server which has the NwkSkey to verify the MIC. On the other hand, the AES-encrypted payload is carried all the way to the application server, providing end-to-end confidentiality. **Applications. ** How are the security features of LoRaWAN being used in real applications? Since LoRaWAN has great coverage and capacity for outdoor applications [48], many example applications of LoRa are in fields and farms. There are several examples of LoRa in cattle tracking in different parts of the world, from reindeer tracking over wide areas in Finland [53] to cow activity tracking over areas of tens of kilometers in Uruguay [54]. In these cases, each animal carries a LoRa mote (e.g., an ear tag), with accelerometers to monitor their movement. One project, Cattle Traxx [55], uses LoRaWAN as an infrastructure-mesh network, with solar-powered gateways. These gateways relay information to each other until they reach one that is connected to the internet. However, there are not many details about the security features of LoRa for the cattle monitoring application in Uruguay [54], where the SX1276 LoRa module used was developed by Semtech. The authors describe the radio transmission details of this module, the development of the embedded module with the accelerometer sensors, and the power savings and range (approximately 11 km). According to Semtech [56], the SX1276 supports end-to-end AES-128 data encryption. One assumption is that the cattle data are encrypted end-to-end to the user application in the cloud, although the topology of this application shows only the LoRa gateway and a server for data analysis on the other end. There are no details of LoRa's Join, Network, and Application Servers, which help devices to obtain the session keys, such as NwkSKey and AppSKey. Another application of LoRa in India that has two purposes, agriculture and health monitoring, helps small farmers who reside in mountainous areas [57]. This work also uses Semtech's chips, SX1278, and it covers distances for LoRa nodes within a few kilometers of the gateway. The LoRa gateway sends data to the network server, which authenticates the end nodes, decrypts the data, and functions as an MQTT server. A recent example of LoRa deployment is in South Korea, where tens of LoRa gateways and numerous sensor nodes have been installed along approximately 300 km of a highway [58]. This system employs different types of sensors, to indicate if the guardrails are in good condition and to track the parking spaces in rest areas.