# LoRaWAN Physical Layer-Based Attacks and Countermeasures, A Review
## 2 LoRaWAN
### LoRa Physical Layer  
Physical-layer signaling, which is used to carry LoRaWAN payloads, is defined by the proprietary LoRa chirp-spread-spectrum (CSS) modulation, whose frequency increases linearly. The I branch of the LoRa preamble and its spectrogram are given in Figure 3.  
As the LoRa modulation format is designed with robustness against noise and interference in mind, LoRa packets can be correctly received even for signal-to-noise ratios (SNR) well below zero. Hence, a wide communication range both indoors and outdoors can be achieved with LoRaWAN. During LoRa modulation, the MAC-layer payload bits are converted into several chirp signals, where the different bit strings of a payload are conveyed to the physical-RF signal by phase modulation. The capacity of a chirp in LoRa is defined by the so called spreading factor (SF), which can take discrete values from 7 to 12. Hence, a single chirp can hold, at most, SF bits. Since, in LoRa, the signal bandwidth and the phase resolution are fixed, a change in SF directly affects the duration of the modulated RF waveform as given by \(T=2^{\text{SF}}/\text{BW}\), where BW denotes the bandwidth of a LoRa signal. For instance, LoRaWAN packets of a 16 bytes payload and \(\text{BW}=125\) kHz with \(\text{SF}=7\) or \(\text{SF}=12\) translate into LoRa signals with periods of 66 ms and 1646 ms, respectively. Hence, the LoRaWAN data rates and the LoRaWAN device air times are often quite restricted. Nevertheless, LoRa modulation allows for the modulation and demodulation of RF waveforms with moderate complexity, which is favourable from an IoT-application point of view.  
Apart from signaling, other physical layer parameters such as center frequency, duty cycling or transmission power are often regionally defined. Since LoRaWAN operation is intended to be free of charge, the typical bands include the licence-free ISM channels, i.e., EU433, EU63-870, AU915-928/AS923-1, US902-928 and IN865-867. Next to channel regulations, regional restrictions to the LoRaWAN packet air time apply. For instance, in the EU, according to the ETSI EN300.220 standard, the devices must comply with duty cycles between 0.1% and 10% depending on the used sub-band.  
Figure 2: LoRaWAN reception windows in Class-A operation mode.  
RF transceivers with built-in support for LoRa include those from Semtech. On LoRaWAN devices, the popular SX1276-79 modules are favoured, which offer a wide tuning range from 137 MHz up to 1020 MHz, a maximum RF transmission power of 20 dBm and a maximum link budget of 168 dBm. Next to LoRa waveform modulation and demodulation, a transceiver integrates a direct conversion transmitter and a direct conversion receiver in a single chip package. From an application point of view, e.g., a low-power microcontroller-based wireless sensor, a LoRa transceiver offers useful features such as so called wake-up interrupts, which notify the host after a successful detection of a preamble, detection of a sync address or decoding of a payload. As it turns out, such features are also useful for implementing reactive jamming on a LoRa hardware. On the LoRaWAN gateway side, Semtechs SX130x digital baseband chips are utilized. They include a demodulation path, which is able to demodulate signals on multiple neighboring subchannels and consequently decode several LoRa packets in parallel. Typically, the baseband modems are accompanied by the SX125x analog frontends, which take care of RF signal up/down conversions as well as digital-to-analog and analog-to-digital conversions.  
For more detailed descriptions of the LoRa modulation and the related RF components, we refer an interested reader to, e.g., [39].