# A Complete Key Management Scheme for LoRaWAN v1.1 +
## 1 Introduction  
The Internet of Things (IoT) has experienced rapid growth in recent years. According to [1] the total number of inter-connected devices in the world will reach more than 50 billion in 2023 and it is expected to exceed 100 billion devices by 2025 [2]. Moreover, the total IoT revenue is expected to reach US $19 trillion United States dollars by 2025 [2]. The majority of different connections between IoT devices are wireless. The Low Power Wide Area Network (LPWAN) is a class of wireless access technologies that are characterized by low power consumption and long-distance coverage. In certain applications, LPWANs have their own advantages over short-range wireless technologies such as Wireless Fidelity technology (Wi-Fi) and Bluetooth because short-range wireless communication protocols have the advantage of high data rates but it usually comes with high energy consumption. Unfortunately, most IoT devices such as Radio-Frequency Identification devices (RFIDs) or smart cards, have limited resources such as limited power and low computing and processing abilities [3, 4]. LoRaWAN stands for a Low Power, Long Range Wide Area Network, it is a Medium Access Control (MAC) layer networking protocol. It has been designed to connect mobile or stationary power-constrained devices via two-ways communication wirelessly in multiple domains such as national or regional. LoRaWAN is one of the most popular LPWAN standards quickly adopted in IoT applications. The paper [5] indicates that 70% of the IoT devices are highly vulnerable to security attacks. Given the observed steady growth of IoT devices, IoT security becomes one of the key factors ensuring internet reliability. Therefore, the design of efficient IoT security systems is of high importance. One of the ways to defend the LoRaWAN security is to have a strong key management security framework [6, 7, 8, 9, 10, 11, 12, 13, 14, 15]. The current key management security framework is provided in the LoRaWAN v1.1. The LoRaWAN v1.1 was released on 11 October 2017 [16], offering a significant improvement of the key management security aspect. However, LoRaWAN v1.1 still has some limitations and drawbacks in its key management scheme, which can pose danger toits security defense. [6; 17; 18] have addressed the importance of using a new session key generation algorithm rather than the traditional algorithm used by the current release due to the traditional algorithm is considered computational heavy for the IoT end devices. IoT end devices' security will be compromised if the traditional algorithm is used, since the limitation of secret key updates from the constrained battery power, which would let the attackers have enough time to decipher the secret key [19; 20]. Also, the current key updating scheme is not clearly defined [7]. Key back-up, recovery, revocation, and handling of backward compatibility issues [21; 22; 23; 24] are existed in the current version. Those issues make the key management security framework vulnerable. Currently, there are a few key management schemes that existed in the literature [7; 8; 9; 10; 11; 12]. However, each focused on a different aspect of the key management, more details can be found in Table 1 of Section 1. For example, in the paper [8], they focused on the static root key updates, our approach focused on the session key generation and believed that the more frequent session key updates with the support of the key updating scheme can reduce the chance of exposing the session keys even the root keys. Hence, the need for root key updates is reduced. Also, most key management schemes covered only one aspect of the security key management, but our paper has addressed more areas such as providing guidelines to handle session key update, key back-up, recovery, revocation, and handling of backward compatibility issues.