# Testbed for LoRaWAN Security: Design and Validation through Man-in-the-Middle Attacks Study
## 5 Conclusions  
In this paper, we have first discussed the cyber security aspects of LoRaWAN LPWAN technology, and then introduced and detailed the design of an SDR and GNU Radio-based testbed for assessing and experimenting with the on-air security in LoRaWAN. Then, we have reported the results of our experiments conducted using the designed testbed. Specifically, we have shown how LoRa packets can be eavesdropped by an SDR. Further, we have demonstrated that knowing the AppKey, the AppSKey and NwkSKey can be reconstructed by eavesdropping the OTAA join procedure. Having these keys, an intruder can launch a bit-flipping attack, resulting in false data being accepted by the NS. Note that despite these attacks having potentially devastating consequences, state-of-the-art technology already provides means to mitigate them. First, the newer versions of the LoRaWAN protocol (i.e., LoRaWAN 1.1.x protocol) decouples the NwkSKey from AppKey; however, to use this, an upgrade to LoRaWAN 1.1.x has to be performed both on the GWs/NSs (a software update) and on the devices (e.g., the hardware or firmware). Notably, especially the latter, requires substantial efforts and costs. Second, the attacks demonstrated by us in this paper (except the replay attack) imply either unencrypted transmission (which is not supported by LoRaWAN) or the knowledge of AppKey. While the early-day EDs used to allow reading this key and other security credentials back from an ED, the LoRaWAN sensors of today usually prevent access to these data; however, given the demonstrated attack procedures in this paper, it becomes clear that these credentials should be secured at the AS as well. All in all, the man-in-the-middle attacks in the LPWAN in general and LoRaWAN, in particular, has attained rather limited attention so far. Nonetheless, this field offers multiple challenges to be addressed and problems still to be solved:  
* Development of the algorithms and tools (if needed--inclusive of the dedicated hardware devices) to detect and classify the on-air attacks in LoRaWAN. Specifically, the algorithms can be based on monitoring the re-connection patterns of the individual  
Figure 16: Fake message injected in LoRaWAN NS database. devices, their traffic patterns and variation of their radio-channel parameters (e.g., RSSI and signal-to-noise ratio (SNR), as discussed by [PERSON] et al. [22]). * Development of algorithms and procedures enabling EDs to detect bogus GWs/NS. * Engineering the mechanisms and procedures allowing re-connection and re-establishment of control over the hijacked sensors and the EDs suffering an attack (e.g., connected to a bogus NS). * Addressing the novel types of attacks, specific for the IoT networks (e.g., the energy-depletion attack [39]). We expect that these challenges will become even more critical in the coming years, with the further deployment of LoRaWAN networks. Specifically, the introduction of the non-terrestrial satellite-based LoRaWAN networks enabled by novel long range-frequency hopping spread spectrum (LR-FHSS) modulation [40] will clearly bring new security challenges. Importantly, to validate and assess the efficiency of the newly suggested security mechanisms in practice, one requires a specialized testbed. To address this need, the current study presents and details the design of a flexible, SDR-based security-oriented testbed for a LoRaWAN network; therefore, we are certain that the receipts and results reported in this paper will serve not only as a motivation but also provide a reference toolset for practical security studies dealing with LoRaWAN, and, potentially, the other LPWANs. Conceptualization, O.P., R.F., K.M., H.R. and J.M. ; methodology, O.P., H.R. and R.F. ; software, O.P. ; validation, O.P., R.F., K.M., H.R. and J.M. ; formal analysis, O.P., R.F., K.M., H.R. and J.M. ; investigation, O.P., R.F. and K.M. ; resources, O.P., R.F. and K.M. ; data curation, O.P. ; writing--original draft preparation, O.P., R.F., K.M. and J.M. ; writing--review and editing, O.P., R.F., K.M., H.R. and J.M.