# Testbed for LoRaWAN Security: Design and Validation through Man-in-the-Middle Attacks Study
## 2 Background
### Related Works  
The LoRaWAN security has been considered by a number of scholars. The most up-to-date contributions can be classified into three major tracks: (i) general description of security aspects and possible vulnerabilities, (ii) new mechanisms for improving cyber security in LoRaWAN networks and (iii) preventing attacks in LoRaWAN networks. The selected works and a brief summary of their key points are summarized in Table 1.  
In what follows we detail the results of several studies, which deal with the replay and bit-flipping attacks, and thus are relevant to the scenarios emulated by us. The interested readers can find a more comprehensive overview of the other attack types and challenges in, e.g., [25]. [PERSON] et al. [26] identify five major LoRaWAN vulnerabilities, including the replay attack and the bit-flipping attack. These attacks are also demonstrated by practical labora \begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt}} \hline \hline
**Work** & **Description** \\ \hline Category: General description of security and possible vulnerabilities \\ \hline [PERSON] 2016 [9] & Possible vulnerabilities and attacks in LoRaWAN 1.0.x network. \\ \hline [PERSON] et al., 2017 [10] & Susceptibility of LoRaWAN to jamming, replay attack and wormhole. \\ \hline [PERSON] et al., 2017 [11] & Analysis of security aspects of LoRaWAN and discussion of security options based on certificates. \\ \hline [PERSON] et al., 2018 [12] & Summary of security threats in LoRaWAN versions 1.0 and 1.1. \\ \hline Category: Improving security of LoRaWAN \\ \hline [PERSON] et al., 2017 [13] & A solution that improves the security of the LoRaWAN 1.0 network by making better use of the relational key between the ED and NS. \\ \hline [PERSON] et al., 2017 [14] & Description of security gaps in key generation, and design of a new activation scheme based on a dual key. \\ \hline [PERSON] et al., 2017 [15] & Security analysis of the LoRaWAN protocol and suggestion of a public key infrastructure. \\ \hline [PERSON] et al., 2017 [16] & Design of an open, trusted decentralized tamper-resistant system within LoRaWAN using blockchain technology. \\ \hline [PERSON] et al., 2018 [17] & Security risk assessment for key management within LoRaWAN and design of a key management method based on ephemeral Diffie–Hellman over COSE. \\ \hline [PERSON] et al., 2019 [18] & Hardware improvement of LoRaWAN security using USIM cards as cryptographic chips. \\ \hline [PERSON] et al., 2020 [19] & Improved key management within the LoRaWAN architecture using Blockchain technology. \\ \hline [PERSON] et al., 2020 [20] & Establishing relation using elliptic curves and AES algorithms to boost the security of S2 KG communication between servers. \\ \hline Category: Attack prevention \\ \hline [PERSON] et al., 2017 [21] & Design of a prevention scheme for replay attack. \\ \hline [PERSON] et al., 2018 [22] & Protection against replay attack using RSSI and handshaking. \\ \hline [PERSON] et al., 2019 [23] & Design of SPT model to detect and protect against replay attack. \\ \hline [PERSON] et al., 2020 [24] & Man-in-the-middle attack mitigation based on cryptographic Galois counter mode. \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Summary of selected articles on LoRaWAN cyber security. tory demonstrations. The authors approached the replay attack and the bit-flipping attack differently than we had. Specifically, they implied ABP activation and focused on uplink data transmissions carrying application data, while we consider the OTAA activation and demonstrate the potential consequences of its eavesdropping. [PERSON] et al. [21] deal with the prevention of replay attacks using the duplication of the DevNonce value. As part of their work, they created a prevention scheme, thanks to which the probability of duplication of the DevNonce value is reduced by 60-89% in comparison to conventional LoRaWAN. The article deals with the prevention of replay attacks, but not with the very possibility of performing an attack and eavesdropping.