Exploiting LoRaWAN for efficient and resilient IoT networks

It is estimated that, by 2025, there will be more than 21 billion Internet of Things (IoT) devices deployed in various domains. These massive IoT devices will be interconnected by numerous IoT networks with the Internet as the backbone. The IoT networks will be primarily wireless, ranging from cellular networks, Wi-Fi infrastructures, low-power multi-hop wireless networks (e.g., Zigbee and Bluetooth personal area networks), and the recently emerging low-power wide-area networks. The greatly increased pervasive connectivity owing to the deployment of these IoT networks will foster the next-generation Internet-based innovations. This thesis focuses on exploiting LoRaWAN, a representative low-power wide-area networking technology, to build efficient and resilient low-power wireless IoT networks. Given the increasingly crowded radio frequency (RF) spectrum, the efficiency of utilizing the finite wireless bandwidth is a primary goal of designing and operating IoT networks. Moreover, the networks' resilience, i.e., their abilities to recover and maintain connectivity and efficiency despite external disturbances such as interference from neighbor RF technologies and even cyber-attacks, is also important to the IoT applications. This thesis aims at studying how the low-power long-range communication capability of LoRaWAN can be exploited to address some of the efficiency and resilience issues in IoT networks. This thesis studies the following two main problems. First, it studies how to use the one-hop LoRaWAN to build out-of-band control planes for the low-power multi-hop wireless networks to improve their efficiency and resilience. Specifically, it exploits the simplicity of LoRaWAN to manage the complexity of multi-hop wireless networks. Second, given LoRaWAN's communication throughput limitation due to the narrow bandwidth and low duty cycle defined in LoRaWAN specification, this thesis studies how to efficiently maintain the common notion of time among all LoRaWAN end devices. In addition, it investigates the potential attacks that aim at disrupting the common notion of time and develops countermeasures for resilience. The details of the two main problems and this thesis' solutions are as follows. The first part of this thesis addresses the Separation of Control and Data Planes (SCDP) for low-power multi-hop wireless networks using LoRaWAN. SCDP is a desirable paradigm for low-power multi-hop wireless networks requiring high network performance and manageability. Existing SCDP networks generally adopt an in-band control plane scheme in that the control-plane messages are delivered by their data-plane networks. The physical coupling of the two planes may lead to undesirable consequences. For example, when a node loses connections with its neighbors, the controller cannot reach the node anymore. Recently, multi-radio platforms (e.g., TI CC1350 and OpenMote B) are increasingly available, which make the physical SCDP possible. To advance the network architecture design, this thesis leverages on the LoRaWAN to form one-hop out-of-band control planes called LoRaCP. Several characteristics of LoRaWAN such as downlink-uplink asymmetry and primitive ALOHA media access control need to be dealt with to achieve high efficiency and good resilience. To address these challenges, a TDMA-based multi-channel transmission control is designed, which features an urgent channel and negative acknowledgment. On a testbed of 16 nodes, LoRaCP is applied to physically separate the control-plane network of the Collection Tree Protocol (CTP) from its Zigbee-based data-plane network. Extensive experiments show that LoRaCP increases CTP's packet delivery ratio from 65% to 80% in the presence of external interference, while consuming little per-node average radio power. LoRaWAN is promising for collecting low-rate monitoring data from geographically distributed sensors, in which timestamping the sensor data with a common notion of time is a critical system function. The second part of this thesis considers a synchronization-free approach to timestamping LoRaWAN uplink data based on signal arrival time at the gateway, which well matches LoRaWAN's one-hop star topology and releases bandwidth from transmitting timestamps and synchronizing end devices' clocks at all times. However, this thesis shows that this approach is susceptible to a frame delay attack consisting of malicious frame collision and delayed replay. In the attack, the attacker records the signal sent by the transmitter and sends a colliding frame to jam the receiver. Then, it replays the recorded signal after an intended delay. Real experiments show that the attack can affect the end devices in large areas up to about 50,000 square meters. In a broader sense, the attack threatens any system functions requiring timely deliveries of LoRaWAN frames. To address this threat, this thesis proposes a LoRa TimeStamping (LoRaTS) gateway design that integrates a commodity LoRaWAN gateway and a listen-only low-power software-defined radio to track the inherent frequency biases of the end devices. Based on an analytic model of LoRa's chirp spread spectrum modulation, this thesis develops signal processing algorithms to estimate the frequency biases with high accuracy beyond that achieved by LoRa's default demodulation. The accurate frequency bias tracking capability enables the detection of the attack that introduces additional frequency biases. Our approach supports the bandwidth-efficient sync-free time stamping and requires no modifications on the LoRaWAN end devices. Extensive real-world experiments based on a testbed deployed in a university campus show the effectiveness of the proposed approach. The availability of multiple RF technologies and the mixed use of them in IoT networks create both opportunities and also challenges. The approach designs presented in this thesis demonstrate the exploitation of the new unique features of LoRaWAN in addressing the efficiency and resilience issues of the legacy Zigbee networks and LoRaWAN networks themselves. The author's future work will also follow the same methodology to improve IoT networks.Doctor of Philosoph