LoRa & LoRaWAN · Study deck

LoRaWAN Security and Joining

A farm meter loses power after sending several readings.

Radio Remi is your guide for this deck.

archsecurityjoining
Radio Remi, the module guide, in a scene from this chapter.
iotclass.org

After studying this chapter

Learning objectives

Trace activation and session custody; compare OTAA with a bounded ABP exception; test reset counters and retired-device revocation.

  • Trace activation and session custody.Record who creates, protects, resets, and retires the state used by the device.
  • Compare OTAA with a bounded ABP exception.Provisioning, approval, recovery, expiry, and exception ownership belong in the record.
  • Test reset counters and retired-device revocation.Verify that old session traffic is rejected and the replacement follows its approved route.
iotclass.org

Major section

Start Simple · Overview: Security Review Starts at the Boundary

A farm meter is replaced after a storm.

  • The new unit must enter the right service, while the damaged unit must never return as a trusted member.
  • An encrypted reading alone does not prove safe entry, replacement, or retirement.
  • The release record should answer simple questions.
  • Security review starts before the first payload.

Key terms

DevAddr
DevAddr is the short device address used inside the network.

Why it matters

That level of detail prevents an "encrypted uplink" claim from hiding shared keys, unclear custody, or a recovery path that bypasses the intended owner.

Security boundaries separate the device and join path from network and application session material.
Security boundaries separate the device and join path from network and application session material.
iotclass.org

Major section

Practitioner: Write the Activation Evidence Record

A useful release record separates the normal OTAA path from any ABP exception.

  • OTAA gives the reviewer join evidence and fresh session state.
  • ABP provisions session state directly, so it removes the join proof and shifts more burden onto counter persistence, recovery procedure, and owner approval.
  • The device can rejoin or follow the approved rejoin procedure.

Key terms

Counters and recovery behavior
Counters and recovery behavior are tested across reset before release.
OTAA review follows the join path: join request, check, session state, routes, first uplink, and verification.
OTAA review follows the join path: join request, check, session state, routes, first uplink, and verification.
iotclass.org

Major section

Practitioner: Write the Activation Evidence Record (continued)

Counters and recovery behavior are tested across reset before release.

  • OTAA's join evidence is not free, and a release record should say so.
  • A brownout-prone installation or firmware change can therefore create extra join traffic if its implementation discards session state.
  • Credential custody, join owner, network owner, and application owner are named.
iotclass.org

Major section

Practitioner: Write the Activation Evidence Record (continued)

Track actual rejoin behavior and restart frequency alongside counter and recovery evidence, rather than treating "uses OTAA" as a cost-free default.

  • Session state is provisioned before use and the reason for bypassing join is written down.
  • Provisioning owner, recovery owner, and decommissioning owner are named.
  • Verification uplink reaches the expected application boundary after join.
  • Provisioning, counters, recovery, and expiry or migration trigger are approved.
iotclass.org

Major section

Practitioner: Write the Activation Evidence Record (continued)

Worked Review: New Sensor FleetA new sensor fleet uses OTAA with unique activation material.

  • The join owner can show join records, the network owner can show validation and counter behavior, and the application owner can show the first routed payload after join.
  • Worked Review: Legacy ABP DeviceA legacy device cannot run the join procedure in its current firmware.
  • ABP may be acceptable only as a limited exception with a written reason, counter persistence proof, recovery steps, decommissioning steps, and an owner-approved migration or expiry trigger.
iotclass.org

Major section

Under the Hood: Recovery Cannot Bypass Replay Protection

Frame counters are not bookkeeping trivia.

  • They help the receiving side reject stale or repeated traffic.
  • A device that works once but fails after reset is not release-ready.
  • The network side can validate network behavior without owning application payload meaning.
  • The application side can process payload meaning without owning gateway forwarding.

Key terms

FRMPayload
FRMPayload is AppSKey ciphertext.
The release record closes the loop: version/profile, activation, material owners, counters, boundaries, verification, exceptions, and future owner.
The release record closes the loop: version/profile, activation, material owners, counters, boundaries, verification, exceptions, and future owner.
iotclass.org

Major section

Under the Hood: Recovery Cannot Bypass Replay Protection (continued)

Security and ADR Incident ReviewSecurity recovery can look like radio trouble if the team reads symptoms too quickly.

  • Incident playbooks should send each symptom to the boundary that can actually provide evidence.
  • The review should also keep timing clear.
  • A reset, rejoin, profile change, or credential repair can change recent link evidence.
iotclass.org

Major section

Under the Hood: Recovery Cannot Bypass Replay Protection (continued)

If operations asks to "reset counters" so a troubled device comes back quickly, the release owner should treat that as a security decision, not a support shortcut.

  • Counter repair, key replacement, and ADR retuning may happen in the same incident window, but they should have separate evidence and owners so a radio optimization is not mistaken for a security fix.
  • ADR separationKeep ADR decisions separate from stale, mobile, mixed, or recovery-period link evidence.
  • DecommissioningName how retired, replaced, or compromised devices lose access without weakening replay protection for the rest of the fleet.
iotclass.org

Major section

Restore a Meter without Reusing Yesterday's Session

The counter has moved backward by 5, so those values cannot be treated as fresh progress in the same session.

  • An integrity check on the packet does not erase this replay concern.
  • The server and device must preserve valid state or establish a fresh session through the activation procedure appropriate to their version.
LoRaWAN frame field matrix showing byte widths, FHDR subfields, network integrity, application confidentiality, and replay evidence.
LoRaWAN frame field matrix showing byte widths, FHDR subfields, network integrity, application confidentiality, and replay evidence.
iotclass.org

Major section

Restore a Meter without Reusing Yesterday's Session (continued)

The server can keep the two reception records while delivering one application event.

  • That deduplication case is not permission for the device to reuse old counters after a reset.
  • It may create two devices with the same trusted identity if the old unit returns.
  • The security lesson reaches beyond the join light.
iotclass.org

Major section

Restore a Meter without Reusing Yesterday's Session (continued)

The roles differ: checking a valid frame does not require the gateway to interpret a temperature, while decrypting application content does not settle every network replay rule.

  • Replacement needs its own approved identity and a retirement action for the removed unit.
  • The server-side lifecycle test should demonstrate that yesterday's accepted ownership does not silently reopen access.
  • In an illustrative recovery trace, joining starts at 2 s and the application accepts the test reading at 14 s, an end-to-end interval of 12 s.
iotclass.org

Deck summary

Key takeaways

A farm meter is replaced after a storm.

  • A useful release record separates the normal OTAA path from any ABP exception.
  • Counters and recovery behavior are tested across reset before release.
  • Track actual rejoin behavior and restart frequency alongside counter and recovery evidence, rather than treating "uses OTAA" as a cost-free default.
  • Worked Review: New Sensor FleetA new sensor fleet uses OTAA with unique activation material.
iotclass.org

Retrieval practice

Recall check 1 of 6

Radio Remi says: answer from memory, then check your reasoning.

Q1A LoRaWAN team says the deployment is secure because the radio traffic is encrypted. What should the review ask for first?

AA gateway packet log, because forwarding shows the gateway now owns the security boundary
BA boundary record covering activation, credentials, servers, counters, and evidence
COne decoded application payload, because a good payload proves activation and recovery
DA post-release operations note, because counter evidence can wait until incidents
Show answer

Answer: B Security claims need observable evidence at each LoRaWAN security boundary.

iotclass.org

Retrieval practice

Recall check 2 of 6

Radio Remi says: answer from memory, then check your reasoning.

Q2A gateway hears an uplink with a valid radio path, but the application cannot read its payload. Which boundary should the review keep separate?

AGateway ownership of both network acceptance and decrypted application meaning
BRadio hearing as proof the application has decrypted and interpreted payload
CNetwork checks and counters in network path; payload meaning in app path
DDashboard label changes as repairs for network and application trust checks
Show answer

Answer: C Network-side material handles frame behavior, while application-side material protects payload meaning.

iotclass.org

Retrieval practice

Recall check 3 of 6

Radio Remi says: answer from memory, then check your reasoning.

Q3A team wants to use ABP because it avoids the join procedure. What should the reviewer require before approval?

AA provisioning note saying ABP is safer because the device can skip join traffic
BOne successful payload after setup, with counter review deferred until faults appear
CAn ABP exception record covering counters, replay risk, recovery, retirement, and expiry
DA promise to rotate material later, without named recovery or decommissioning owners
Show answer

Answer: C ABP removes join evidence, so the release must prove the controls that make the exception bounded.

iotclass.org

Retrieval practice

Recall check 4 of 6

Radio Remi says: answer from memory, then check your reasoning.

Q4A reset device starts producing rejected uplinks after a previously successful LoRaWAN release. What is the best first review action?

ADisable counter checks temporarily so the recovered device can resume service
BTreat the gateway as failed because the application no longer sees payloads
CLower the data rate immediately because rejected uplinks prove poor link margin
DCheck activation, counters, replay evidence, and owners before ADR changes
Show answer

Answer: D LoRaWAN reset and recovery issues must preserve replay protection while routing each symptom to the correct owner.

iotclass.org

Retrieval practice

Recall check 5 of 6

Radio Remi says: answer from memory, then check your reasoning.

Q5A restored device sends an uplink with a counter below the value already accepted in the same session. Its integrity check passes. Why may the server still reject it?

AA lower counter resembles replay even when the packet integrity check passes.
BA passing integrity check makes an older session counter acceptable to the server.
CAn antenna reset at the gateway can raise the restored device's counter.
DA payload-unit change in the application decoder repairs counter freshness.
Show answer

Answer: A The device must preserve valid counter state or establish a fresh session through the right activation path.

iotclass.org

Retrieval practice

Recall check 6 of 6

Radio Remi says: answer from memory, then check your reasoning.

Q6A field unit is retired after a change of owner. Which security check closes the old unit’s access?

AKeep retired session keys active for reuse because a later owner can resume the existing session securely.
BDelete only the dashboard tile while the old device's network credentials remain.
CReset the frame counter and keep accepting the retired device's old session.
DRevoke accepted credentials and verify later uplinks are rejected and logged.
Show answer

Answer: D Decommissioning must end the old trust path and leave test evidence.

iotclass.org

Print reference

Answers 1 of 2

Answer key.

  1. B · Security claims need observable evidence at each LoRaWAN security boundary.
  2. C · Network-side material handles frame behavior, while application-side material protects payload meaning.
  3. C · ABP removes join evidence, so the release must prove the controls that make the exception bounded.
  4. D · LoRaWAN reset and recovery issues must preserve replay protection while routing each symptom to the correct owner.
  5. A · The device must preserve valid counter state or establish a fresh session through the right activation path.
iotclass.org
Security review answers 1–5: B, C, C, D, A. Encryption needs custody evidence; radio reception does not prove application meaning; ABP needs an exception; reset failures need counter review; integrity does not make an old counter fresh.

Print reference

Answers 2 of 2

Answer key.

  1. D · Decommissioning must end the old trust path and leave test evidence.
iotclass.org
D: revoke the retired unit credentials, then verify later uplinks are rejected and logged.