Protecting LoRaWan data against untrusted network servers

LoRaWAN is a wireless network technology applied in the Internet of Things long-range communication. Even though LoRaWAN is an end-to-end data encryption protocol by design, security risks in the IoT LoRaWAN-based applications should be carefully analyzed. The LoRaWAN-based application is a system of systems and integrates numerous parties. It usually applies a third-party network server to avoid infrastructure costs so that the network server is not a trusted entity. This work aims to improve data security resilience in IoT LoRaWAN-based applications that employ untrusted network servers. A security risk assessment was performed to demonstrate the data hazards of using an untrusted network server. Subsequently, this work set out a security measure that is a payload format to mitigate the identified risks against assessed scenarios. Finally, tests were carried out in an IoT LoRaWAN-based system prototype to verify results without and with the security measure. In conclusion, IoT LoRaWAN-based applications using third-party network servers cannot assume network servers as trusted entities. The payload format proposed in this work provides additional data confidentiality and integrity layers to mitigate the risks of using an untrusted network server.