# Testbed for LoRaWAN Security: Design and Validation through Man-in-the-Middle Attacks Study
## 1 Introduction  
The Internet of things (IoT) has gained momentum in the past few years, resulting in many devices taking their place all around us, thus opening the road for many versatile applications across different verticals. The low-power wide-area network (LPWAN) technologies, which is an umbrella term for the radio access technologies (RATs) characterized by low energy consumption, broad coverage and good scalability, are considered among the critical enablers for the massive machine type connectivity (mMTC). For these reasons, LPWANs today are actively being rolled out commercially all around the globe [1]. Among the LPWAN RATs available today, the LoRaWAN technology is among the most widely spread non-3 GPP technologies (about 191 million LoRa end node devices [2]) both as a part of public and private networks; however, due to the fast pace of the development and commercialization of these technologies and the design compromises required to reduce the cost and energy consumption of the devices, the LPWAN technologies have some shortcomings. One of them is related to the security and privacy of data transfers [3, 4, 5], especially whilst maintaining backwards compatibility with the already-deployed commercial networks. Figure 1 illustrates the number of papers found in the Google Scholar database dealing with LPWANs and LPWAN security (prognosis is used for years beyond2020 and was obtained by computing the conservative linear growth prediction for the following five years based on previous data). The trend shows the increase in the interest of the scientific community in this topic. Investigating the shape of the curve, one can see an exponential growth in the first few years, and then a gradual change to a linear curve (since 2017); however, it is worth noting that even though a significant share of the articles mention security, only a small portion focuses on security in depth.  
In this context, the contribution of the current paper is threefold:  
* We provide an overview of the state-of-the-art for cyber security for LoRaWAN technology.
* We detail the design of an software-defined radio (SDR)-based testbed for trialing the LoRaWAN security in practice.
* We demonstrate the operation of the designed testbed through investigating the two practical LoRaWAN attacks, study their effects and discuss the possible ways to mitigate them. Specifically, we focus on replay and bit-flipping (i.e., change of message content) attacks. These two attacks have been selected due to their potential to have a devastating effect on infrastructure monitoring applications, which are among the core use case of LoRaWAN.  
The paper is structured as follows. We start by discussing the relevant background on LoRaWAN technology, security solutions in LoRaWAN and the results of the state-of-the-art studies focusing on LoRaWAN cyber security. In Section 3, we detail the design of our security-focused testbed, our experimental environment. The experimental results demonstrating the operation of the developed testbed, including the trials of the two nano-in-the-middle class attacks, are discussed in Section 4. This is followed by the summary of our results and identification of the potential future research directions in Section 5.