## 3 Long-Range, Low-Power IoT Communication Protocols and Their Security
### NB-IoT  
Narrowband (NB) IoT is defined by the Third Generation Partnership Project (3 GPP) and is often called a Cellular IoT (CIoT) technology [59; 60] that operates within the licensed spectrum. It is closely related to the Long-Term Evolution (LTE) cellular standard but it is catered to low-power devices and aims to improve coverage [61; 62; 63]. **Architecture. ** To describe the NB-IoT architecture and the differences between LTE and NB-IoT, this section describes its architecture for both physical and network layers. As for naming conventions, in an NB-IoT network, there is the user equipment (UE), which is the IoT device; the enhanced NodeB (eNodeB), which is the base station; and the Evolved Packet Core (EPC) IP network, which resembles the _fog_ network in an IoT system, as in the IoT network model discussed in [PERSON]'s survey [21]. In the physical layer, NB-IoT uses the same channel multiplexing technologies as LTE: in the downlink, Orthogonal Frequency Division Multiple-Access (OFDMA), and in the uplink, Single-Carrier Frequency Division Multiple-Access (SC-FDMA). The channel to be multiplexed can be either 200-KHz or 180-KHz, depending on the NB-IoT radio interface's three modes [61]. * _Stand-alone_ mode operates on a separate Global System for Mobile (GSM) communications channel, with a bandwidth of 200 kHz. * _Guard-band_ mode operates on the side bands of the LTE channel, with 180 kHz bandwidth, and it uses one physical resource block (PRB) of the LTE band. * _In-band_ mode operates in the LTE band and it also uses one PRB, at 180 kHz bandwidth. From a cellular provider's point of view, the latter mode is considered the best option, because it maximizes the provider's channel assignments [61]. These modes define the larger channel, or macro-channel, in which NB-IoT operates. To allow multiple users to send uplink data, these NB-IoT macro-channels are divided into narrow micro-channels of 15 kHz or 3.75 kHz [63; 64]. For 3 GPP Release 13, NB-IoT supports uplink data rates of 16.9 kbps (single-tone) and 66 kbps (multi-tone), while Release 14 specifies uplink data rates of up to 159 kbps. Multi-tone uses 15 kHz channels, but the higher data rates depend on good coverage. Another difference between LTE and NB-IoT is that NB-IoT uses data re-transmissions [64]. This is called coverage enhancement (CE). It helps to support a large number of nodes over a wide area, even when packet losses are high. There are three CE levels: level zero for normal coverage, level one for poor coverage, and level two for extremely poor coverage. The base station broadcasts the received power thresholds according to the CE level. Based on this power level and the current signal strength, the device decides whether the data frames should be transmitted several times. The higher the CE level, the higher the number of repeated transmissions, because re-transmissions of the same frame increase the chances that one of them is received by the base station. As opposed to the random access in LoRaWAN, the NB-IoT uplink micro-channel needs to be scheduled by the service provider. Whenever the UE device needs to send data, it sends a request through a physical random access channel (PRACH) to the eNodeB. Then, the service provider's EPC network assigns one of the narrow-band channels for the device to transmit, which is the narrowband physical uplink shared channel (NPUSCH). In the network layer, two operation modes are defined [63; 65; 66]:  
* Power Saving Mode (PSM) allows the UE to enter a sleep mode, from which it can wake itself up at any time to transmit data. * Extended Discontinuous Reception (eDRX), in which the UE enters sleep mode from which it wakes up periodically. These wake-up periods are synchronized with the network, which sends control messages to the device to tell it to return to idle mode, receive data, or request to transmit data. The NB-IoT core network has different servers for signaling and data. There is an application server that processes the uplink and downlink packets.