A Lightweight Blockchain based Two Factor

Authentication Mechanism for LoRaWAN Join

Procedure
Syed Muhammad Danish∗ , Marios Lestas† , Waqar Asif‡ , Hassaan Khaliq Qureshi∗ , Muttukrishnan Rajarajan‡
∗ NationalUniversity of Sciences & Technology (NUST), Islamabad, Pakistan
∗ {sdanish.msee16seecs,
hassaan.khaliq}@seecs.nust.edu.pk
† Frederick University, Cyprus
† [email protected]
‡ School of Engineering and Mathematical Sciences, City University, London, UK.
‡ {r.muttukrishnan, waqar.asif}@city.ac.uk

Abstract—Recently, there has been increasing interest in em- and self executing smart contract scripts makes blockchain
ploying blockchain in different applications, other than crypto- more secure and allow distributed automated workflows thus,
currencies. Blockchains allow a peer to peer distributed network makes it alluring to developer and researchers working in IoT
where different nodes communicate with each other, in a trustless
manner. Long Range Wide Area Network (LoRaWAN) is an technology domain.
Internet of Things (IoT) technology, which enables long range According to Gartner [2], there will be more than 20 billion
communication. Although LoRaWAN networks are secure, the Internet of Things (IoT) devices by 2020 and the number
LoRaWAN join procedure is susceptible to replay and jamming will continuously increase. IoT applications have significant
attacks. Moreover, trust between network server and LoRa end impact on people’s daily life nowadays. To compensate for
device is the basic foundation of LoRaWAN network however, the
centralized nature of network servers raise trust issues between long range, low power and losw cost requirements, Low
network operators and customers. To solve this problem, we Power Wide Area Network (LPWAN) has been introduced
propose a lightweight two factor authentication mechanism for to connect IoT devices. LoRaWAN, a MAC layer protocol
LoRaWAN join procedure, based on blockchain technology. The in the family of LPWAN IoT technology, is designed to
proposed blockchain based framework provides an extra layer support bidirectional long range, low power and low data rate
of security for LoRaWAN join procedure and build trust among
LoRaWAN network components. The proposed framework is communication between IoT devices. LoRaWAN fills the gap
validated using the Ethereum blockchain. The results demon- between the high power consumption long range networks
strate that the proposed framework provides efficient system and low power consumption short range networks. LoRaWAN
performance in terms of throughput and latency. The proposed network is designed to ensure confidentiality, authentication
blockchain architecture is a cost effective solution, which can be and integrity for secure communication between LoRaWAN
utilized in the LoRaWAN network with few network servers and
LoRa end device, having no strict requirement of throughput network’s entities. However, much work has yet to be done to
and latency. make LoRaWAN network more secure.
Keywords—Blockchain, LoRaWAN Join Procedure, Lo- LoRaWAN has been shown to be susceptible to wormhole
RaWAN, Authentication, Internet of Things. attack [3], bit flipping attacks [4], replay attacks [5][6] and
jamming attacks [7][8]. In [13], authors explained that Lo-
I. I NTRODUCTION RaWAN network server cannot be trusted for handling user’s
Blockchain technology has been one of the most revolution- personal data and can modify the user’s information. Authors
ary technological concept over the past few years. Blockchain in [7] demonstrate how a jammer can stop LoRa end device
technology has attracted significant attention from a wide to make a connection with the LoRaWAN network server by
range of industries: utilities, finance, medical services and generating constant Received Signal Strength (RSS) around
the real estate [1]. By employing blockchain technology, LoRa end device. To detect jammer around LoRa end de-
applications that needed a central trusted authority for their ex- vice, authors in [6], proposed intrusion detection mechanism.
ecution, can now be executed in a decentralized and distributed Authors in [4], explains the susceptibility of LoRaWAN join
environment without the need of a trusted third party or procedure to replay attacks by setting up an attack scenario.
intermediary and attain the similar reliability and functionality, Recently, Blockchain has been employed within IoT networks
which was merely impossible before. Blockchain enables the to improve security. In [9], authors proposed an authentication
network entities to operate in a trust-less environment even framework for IoT networks, based blockchain technology. In
if the parties do not trust each other. The absence of central [10], an identity framework, based on blockchain technology,
trusted authority leads to faster agreement among communi- is proposed for IoT networks. To authenticate smart meters, au-
cating parties. Cryptography, distributed consensus mechanism thors proposed [11] a blockchain based zero knowledge proof

978-1-7281-2373-8/19/$31.00
Authorized licensed ©2019
use limited to: Indian Institute IEEE
of Information Technology Design & Manufacturing. Downloaded on November 25,2023 at 16:40:47 UTC from IEEE Xplore. Restrictions apply.
 the network server fetch information from blockchain network
on real time, the addition of another authentication check in
LoRaWAN join procedure leads to the delay in LoRaWAN join
procedure. To sum up, the proposed blockchain architecture
is a cost effective solution, which can be utilized in the
LoRaWAN network with few network servers and LoRa end
device, having no strict requirement of throughput and latency.
It is designed explicitly to enhance trust and security in
LoRaWAN join procedure however, it comes at the cost of
delay at LoRaWAN network server.
The rest of the paper is organized as follows. In sec-
tion II, backgound information on the LoRaWAN and the
blockchain technology is presented. The proposed blockchain
based framework is described in Section III. Section IV pro-
Fig. 1. LoRaWAN architecture vides details about the working of proposed framework while
Section V presents the performance evaluation and results. The
key conclusion and future work is summarized in section VI
solution. Authors in [12] proposed a two factor authentication of our paper.
scheme for IoT networks based on blockchain technology.
To the best of our knowledge, the only previous work which II. BACKGROUND
employ blockchain technology in the LoRaWAN network is In this section, the background information on blockchain
[13], in which authors propose a blockchain based solution to technology and LoRaWAN technology is provided.
ensure trust and data integrity in LoRaWAN networks. This is
the first work to utilize blockchain technology in LoRaWAN A. LoRaWAN
network to assist the authentication of LoRa end devices in LoRaWAN network is organized in a star networking
the LoRaWAN join procedure. topology in which the the packets from LoRa end device
The main objective of this work is to propose a two reach the LoRaWAN network server via the gateway. LoRa
factor authentication mechanism, based on blockchain, for Lo- end devices use a physical layer protocol, called LoRa, to
RaWAN join procedure to add an additional layer of security communicate with the gateways while, gateways communicate
in authentication mechanism and to build trust among LoRa with the network server over the standard TCP/IP connections.
end devices and network servers. The join request message in To offer low power and long range communication between
LoRaWAN join procedure is not encrypted and is susceptible the gateway and LoRa end device, Chirp Spread Spectrum
to jamming and replay attacks. Also, the centralized nature of (CSS) technique is used. Each LoRa end node has to go
network servers raise the trust issues between network servers through a join procedure to start communication with the
and LoRa end device since, the network server can modify LoRaWAN network server. In LoRaWAN join procedure, the
the user’s private data. Therefore, in this paper, we propose network server authenticates the LoRa end device based on
two factor authentication mechanism for LoRaWAN join pro- the join request sent by it. This process is called Over The
cedure to enhance authentication security and to build trust Air Activation (OTAA). The network server simply discard
among LoRa end devices and network server, by employing the join request message if the same DevNonce value is used
blockchain in LoRaWAN network. Unlike [13], we assume in join request message. Also, based on the contents of join
that there are few numbers of network servers in LoRaWAN request, the session keys are generated by the join server and
network thus, network servers cannot be equipped with the distributed to network and application servers. The LoRaWAN
functionality of blockchain. In our framework, blockchain network architecture is shown in Fig. 1.
is an independent network, working concurrently with the
LoRaWAN network entities, to save the information of the B. Blockchain Technology
LoRa end device for authentication purpose. With the help Blockchain is a type of distributed ledger which use inde-
of smart contracts, the blockchain network save the LoRa end pendent nodes to share, record and synchronize data in their
device information, which is triggered by the transactions from respective database instead of keeping the data in traditional
the gateways. central server. Blockchain technology is managed by a peer-
The proposed framework is simulated using the Ethereum to-peer network without the involvement of any trusted third
blockchain and Python client and server implementation of party. The two operations associated with the blockchain are
LoRa end device and network server respectively. The frame- read operation and write operation. The transactions are stored
work is evaluated on the basis of different performance metrics on the blockchain network in the form of blocks. Crypto-
i.e. throughput and latency. The simulations results demon- graphic hash is used to identify each block and each next
strate that the proposed framework provides efficient system block on the blockchain data structure contains the hash of
performance in terms of throughput and latency. Although the previous block. Thus, a link is established between blocks

Authorized licensed use limited to: Indian Institute of Information Technology Design & Manufacturing. Downloaded on November 25,2023 at 16:40:47 UTC from IEEE Xplore. Restrictions apply.
 Fig. 2. Blockchain based framework for LoRaWAN two factor authentication

and a chain of blocks is created, called blockchain. Miners shows the proposed architecture for two factor authentication
mine the blocks by following the consensus algorithm. This system for LoRaWAN network.
consensus mechanism guarantees the security of information, The system architecture consist of the following compo-
making it difficult to tamper with. Smart contracts can also nents: Blockchain network, smart contract, network server,
be deployed on blockchain network. Smart contract is a piece join server, agent node, gateways and LoRa end devices.
of code which is executed automatically when a node trigger
it by sending transaction [1]. Blockchain technology can be A. LoRa end device
beneficial in following ways: These are battery operated, resource constrained and low
• the information stored in the blockchain network is
power IoT devices to perform a range of automated task. They
immutable and tamper-proof. have limited storage and computational and capabilities and
• multiple nodes on the blockchain network validates trans-
are susceptible to attack because they are not designed to have
actions and blocks instead of a traditional central server. effective security measures. LoRa end devices are connected
• a decentralized peer-to-peer network i.e. network is not
to the network server through the gateways and the LoRaWAN
managed by a central entity. network servers identify each LoRa end device with a 128 bit
• every node in the blockchain network saves a copy of the
AppKey (NwkKey in LoRaWAN specification v1.1).
ledger instead of keeping the data in traditional central B. Gateway
server.
Gateways act as a bridge between the LoRaWAN network
• once deployed, smart contracts cannot be deleted from
servers and LoRa end device. LoRa end devices use LoRa
the blockchain network by a single node.
modulation and LoRaWAN protocol to connect to the gateway,
Thus, the blockchain network enables secure and tamper- whereas the gateway utilize the high bandwidth network like
proof communication between the individual nodes on the Cellular, Ethernet or WIFI to connect to the network server.
blockchain network. Gateways receive the LoRa end device packets by scanning
III. P ROPOSED A RCHITECTURE the spectrum. All gateways in the vicinity of LoRa end device
receive packets since LoRa end node is not associated with
In this section, blockchain based framework for two fac- single gateway.
tor authentication in LoRaWAN join procedure is explained.
The presented blockchain based framework for LoRaWAN C. Network & Join Server
join procedure propose a new authentication system which The network server forwards the packets of LoRa end
combines the current LoRaWAN join procedure protocol with device to application server. Main functionality of networks
blockchain based authentication of LoRa end device to en- server is scheduling and managing the utilization of gateways,
hance the security of LoRaWAN join procedure. keep track of each LoRa end device to map the packets
In our proposed framework, blockchain is an independent to correct application server and to keep track of security
network, working in parallel with the LoRaWAN network. keys and frame counters. Join server is directly connected to
Blockchain functionality has not been added in the LoRa network server and is responsible for Over The Air Activation
end device and gateways because these devices are normally (OTAA) LoRaWAN join procedure. It provides the network
resource constrained as well as deployed outdoor and can- and application session keys to the network and application
not perform complex blockchain tasks. Furthermore, in the server respectively.
blockchain network, a smart contract is deployed on agent
node and gateways in addition to network servers, are con- D. Agent Server
nected to this agent node to interact with the smart contract. The smart contract in our framework is deployed by the
The distinctive feature of smart contract is that it is unique agent node in the blockchain network. The agent node owns
and cannot be removed from the blockchain network. Fig. 2 the smart contract and after deployment in the blockchain

Authorized licensed use limited to: Indian Institute of Information Technology Design & Manufacturing. Downloaded on November 25,2023 at 16:40:47 UTC from IEEE Xplore. Restrictions apply.
 Fig. 3. Interaction among different components of proposed framework for two factor authentication

network, it retrieves the address of the smart contract. Gateway B. Initial Authentication and Registration
interact with the smart contract through its address and the In order to connect to the LoRaWAN network server, a
authentication information of LoRa end device is saved in the join request message is sent from the LoRa end device to the
blockchain network based on the join request’s block id field. gateway. LoRa end device is performing the join procedure
LoRaWAN network server uses call function, along with the for the first time so, the join request’s block id field is empty.
block id, to retrieve this saved information from blockchain Also, the join request message is unencrypted according to Lo-
network to authenticate LoRa end device. RaWAN specification v1.1. The gateway forward this request
to the network server as well as to the smart contract, using
E. Blockchain Network
smart contract address. The validity of join request message
In our framework, private blockchain has been used as will be checked by the LoRaWAN network server. Meanwhile,
a blockchain network for the sake of simplicity. Private the blockchain network will mine the device information, sent
blockchain has been chosen to evaluate the system since it to smart contract. After mining, the block id will be sent to
provides better and reliable result than public blockchains. network server and the join accept message will be sent by the
However, public blockchain should be utilized in our proposed network server to LoRa end device along with the block id. At
framework. In the private blockchains, only private nodes can this point, the information of LoRa end device is registered in
write data however, anyone in the network can read the data. the blockchain network and LoRa end device is also connected
The data, stored in the blockchain network, is fully tamper- to the LoRaWAN network server for the first time.
proof and decentralized.
C. Two Factor Authentication
IV. S YSTEM I NTERACTION
After registering the LoRa end device information in the
This section explains the interaction between different com- blockchain network, the information will be authenticated
ponents of the proposed framework. These interactions can be through normal LoRaWAN join procedure as well as by the
classified into three stages: Setting up the blockchain network, information stored in the blockchain network. For the second
Initial authentication and registration of LoRa end device in time, when the LoRa end device wants to join LoRaWAN
blockchain network, and finally the two factor authentication network, it send the join request message along with the block
of LoRa end device using blockchain, in LoRaWAN network. id. At this point, 128 bit NwkKey will be used to encrypt the
join request message. After receiving the join request message,
A. Setting up Blockchain Network LoRaWAN network server will use the given block id to
In this phase, the smart contract is deployed in the retrieve the data from the blockchain network. If the LoRa
blockchain network by the agent node. After the smart contract end device’s information, saved in the blockchain network,
has been deployed, the address of smart contract is replied matches with the current join request message information,
by the blockchain network. The LoRaWAN network server LoRaWAN network server will check the authenticity of join
uses this address of the smart contract to read the device request message using the current LoRaWAN join procedure
information from the blockchain network, while the device protocol, defined in LoRaWAN specification v1.1. If the join
information is written on the blockchain network when the request message passes both the authentication checks, the
gateway sends the transaction to smart contract. Gateway will network server will reply with a join accept message and the
only forward the join request message to blockchain network LoRa end device will be connected to the LoRaWAN network
if the join request’s block id field is empty. server.

Authorized licensed use limited to: Indian Institute of Information Technology Design & Manufacturing. Downloaded on November 25,2023 at 16:40:47 UTC from IEEE Xplore. Restrictions apply.
 Fig. 4. Evaluation Domain

Fig. 6. Timeout messages

[14][15]. Thus, the evaluation of Ethereum blockchain is

ignored intentionally and the performance of the components,
outside the blockchain network i.e. network server and LoRa
end device, is evaluated. Moreover, in the simulations, we
assumed that join request message from LoRa end device is
already at the gateway since the physical layer delay param-
eters for LoRa relies on the Spreading Factor (SF) [16]. It is
also assumed that blockchain network contains the LoRa end
device information. LoRa end device client is implemented
using the Python programming language, to generate the
concurrent join request messages and the LoRaWAN network
server is implemented with a server written in Python, which
communicates wth LoRa end device Python client using socket
Fig. 5. Average Throughput
programming. A smart contract is deployed on Ethereum
private blockchain to save LoRa end device information. The
The proposed blockchain based LoRaWAN join procedure LoRa end device information is retrieved from the blockchain
architecture is designed explicitly to enhance the trust and network using JSON RPC calls on real time and a join accept
security in LoRaWAN join procedure. The join request mes- message is sent back to Python LoRa end device client using
sage will be encrypted and the block id will be unique for socket programming. Each experiment is repeated 5 times to
each LoRa end device. Thus, two way authentication will calculate the average values of throughput and latency for
enhance security and trust among LoRaWAN network entities. different concurrent clients, in the range from 1 to 1000.
However, the main limitation of our system is that the first B. Evaluation
join request message from LoRa end device will experience
significant delay since the authentication information of LoRa First, we evaluate the performance of network server in
end device is mined in the blockchain network to get the block terms of throughput. Throughput is defined as the number
id. of join request messages, a network server processes, in a
second. In this scenario, the LoRa end device Python client
V. R ESULTS sends the join request message to Python network server
using socket programming. Once the request is received, the
A. Implementation Python network server use JSON RPC call to fetches the
UBUNTU 16.04 desktop with Intel(R) Core(TM) i7-6700 device information from smart contract using the block id
@ 3.40 Ghz specifications was used to perform the experi- field in join request message and if the device information
ments. The simulation scenario for two factor authentication in matches, it then checks the validity of other fields in the join
LoRaWAN join procedure is shown in Fig. 4. To simulate the request message i.e. DevNonce and reply with a join accept
proposed framework, a private blockchain was implemented message to LoRa end device Python client. Fig. 5 shows the
using geth Ethereum client. Ethereum is one of the most pop- average throughput at the network server. It can be seen that
ular blockchain platform and has been extensively examined for the average throughput for all the clients remains almost
by the developers and researchers, in terms of performance unchanged for different number of join request messages.

Authorized licensed use limited to: Indian Institute of Information Technology Design & Manufacturing. Downloaded on November 25,2023 at 16:40:47 UTC from IEEE Xplore. Restrictions apply.
 smart contract is employed to read and write information in
the blockchain network. Also, the blockchain technology is
not combined with the gateways and LoRa end device be-
cause of their low computational complexities. The proposed
framework is simulated using the Ethereum blockchain and
Python client and server implementation of LoRa end device
and network server respectively. The simulation results demon-
strate that the proposed framework provides efficient system
performance in terms of throughput and latency. The proposed
blockchain architecture is a cost effective solution, which can
be utilized in the LoRaWAN network with few LoRa end
devices and network servers, having no strict requirement
of latency and throughput. In future, we are planning the
hardware implementation of the proposed framework.
R EFERENCES
Fig. 7. Latency
[1] Christidis, Konstantinos, and Michael Devetsikiotis, Blockchains and
smart contracts for the internet of things.: IEEE Access: 2292-2303, 2016.
[2] ”Gartner Says 20.4 Billion Connected Things” Will Be in Use in 2020”,
However, increasing the number of concurrent clients from 2017. [Online]. Available: https://www.gartner.com/newsroom/id/3598917
1 to 100 increases the throughput at the LoRaWAN network [3] Emekcan Aras, Gowri Sankar Ramachandran, Piers Lawrence and Danny
Hughes,, Exploring The Security Vulnerabilities of LoRa: International
server. However, when the concurrent clients are increased to Conference on Cybernetics (CYBCONF), 2017.
1000, the throughput decrease slightly with the increase in [4] JungWoon Lee, DongYeop Hwang, JiHong Park, and Ki-Hyung Kim,
per client’s join request message and the behavior is related Risk Analysis and Countermeasure for Bit-Flipping Attack in LoRaWAN:
International Conference on Information Networking (ICOIN), 2017.
to timeout messages as shown in Fig. 6. Secondly, we evaluate [5] Emekcan Aras, Gowri Sankar Ramachandran, Piers Lawrence and Danny
the performance of network server in terms of latency using Hughes, Exploring The Security Vulnerabilities of LoRa: International
the same aforementioned scenario. Latency is defined as the Conference on Cybernetics (CYBCONF), 2017.
[6] SeungJae Na, DongYeop Hwang, WoonSeob Shin, and Ki-Hyung Kim,
amount of time required by the network server in retrieving Scenario and Countermeasure for Replay Attack Using join request Mes-
the device information from blockchain network and replying sages in LoRaWAN: International Conference on Information Networking
back the join accept message to LoRa end device. Fig. 7 shows (ICOIN), 2017.
[7] Stefano Tomasin, Simone Zulian and Lorenzo Vangelista, Security Anal-
the average latency for fetching the device information from ysis of LoRaWANTM Join Procedure for Internet of Things Networks:
blockchain network. What stands out from the graph is that the IEEE Wireless Communications and Networking Conference Workshops
latency increases with the increasing number of join request (WCNCW), 2017.
[8] S. M. Danish, A. Nasir, H. K. Qureshi, A. B. Ashfaq, S. Mumtaz, J.
messages per client. It can also be seen that increasing the Rodriguez, Network Intrusion Detection System for Jamming Attack in
number of concurrent clients from 1 to 1000 results in an LoRaWAN Join Procedure: Proceedings of the 54th IEEE International
increases in the average latency at network server. Conference on Communications (ICC), pp. , May, 2018
[9] Hammi, Mohamed Tahar, Patrick Bellot, and Ahmed Serhrouchni, BC-
It can be seen from the above results that as the number Trust: A decentralized authentication blockchain-based mechanism: In
of concurrent clients increase, the throughput at the net- IEEE Wireless Communications and Networking Conference (WCNC), pp.
work server increases. However, increasing the number of 1-6. IEEE, 2018.
[10] Lee, Chan Hyeok, and Ki-Hyung Kim, Implementation of IoT system
concurrent clients and join requests, the latency increases using block chain with authentication and data protection.: In IEEE
significantly. This increase in latency is because of the ad- International Conference on Information Networking (ICOIN), pp. 936-
dition of blockchain authentication check in LoRaWAN join 940, 2018.
[11] Zhu, Xiaoyang, Youakim Badr, Jesus Pacheco, and Salim Hariri,
procedure. However, keeping in mind the fact that LoRa end Autonomic Identity Framework for the Internet of Things.: In IEEE
device normally performs the authentication mechanism one International Conference on Cloud and Autonomic Computing (ICCAC),
time in a day, our proposed system provides efficient system pp. 69-79, 2017.
[12] Wu, Longfei, Xiaojiang Du, Wei Wang, and Bin Lin, An out-of-band
performance with enhanced security. authentication scheme for internet of things using blockchain technology.:
In IEEE International Conference on Computing, Networking and Com-
VI. C ONCLUSION munications (ICNC), pp. 769-773. 2018.
[13] Jun Lin, Zhiqi Shen, and Chunyan Miao, Using Blockchain Technology
The join request message in LoRaWAN join procedure is to Build Trust in Sharing LoRaWAN IoT: In Proceedings of the ACM 2nd
not encrypted and is susceptible to jamming and replay attacks. International Conference on Crowd Science and Engineering (ICCSE’17)
Also, the centralized nature of network servers raise the trust pp. 38-43, 2017.
[14] https://github.com/ethereum/tests
issues between network servers and LoRa end device since, [15] https://blog.ethcore.io/performance-analysis/
the network server can modify the user’s private data. In this [16] https://www.semtech.com/images/datasheet/LoraDesignGuide STD.pdf
paper, we propose two factor authentication mechanism for
LoRaWAN join procedure to enhance authentication security
and to build trust among LoRa end devices and network
server, by employing blockchain in LoRaWAN network. A

Authorized licensed use limited to: Indian Institute of Information Technology Design & Manufacturing. Downloaded on November 25,2023 at 16:40:47 UTC from IEEE Xplore. Restrictions apply.