{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,8,5]],"date-time":"2026-08-05T15:16:46Z","timestamp":1785943006832,"version":"3.56.0"},"reference-count":35,"publisher":"Association for Computing Machinery (ACM)","issue":"1","license":[{"start":{"date-parts":[[2021,10,5]],"date-time":"2021-10-05T00:00:00Z","timestamp":1633392000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"name":"MOE AcRF Tier 1","award":["2019-T1-001-044 and 2018-T1-002-081"],"award-info":[{"award-number":["2019-T1-001-044 and 2018-T1-002-081"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Sen. Netw."],"published-print":{"date-parts":[[2022,2,28]]},"abstract":"<jats:p>\n            Low-power wide-area network technologies such as long-range wide-area network (LoRaWAN) are promising for collecting low-rate monitoring data from geographically distributed sensors, in which timestamping the sensor data is a critical system function. This article considers a synchronization-free approach to timestamping LoRaWAN uplink data based on signal arrival time at the gateway, which well matches LoRaWAN\u2019s one-hop star topology and releases bandwidth from transmitting timestamps and synchronizing end devices\u2019 clocks at all times. However, we show that this approach is susceptible to a\n            <jats:italic>frame delay attack<\/jats:italic>\n            consisting of malicious frame collision and delayed replay. Real experiments show that the attack can affect the end devices in large areas up to about 50,000, m\n            <jats:sup>2<\/jats:sup>\n            . In a broader sense, the attack threatens any system functions requiring timely deliveries of LoRaWAN frames. To address this threat, we propose a LoRaTS gateway design that integrates a commodity LoRaWAN gateway and a low-power software-defined radio receiver to track the inherent frequency biases of the end devices. Based on an analytic model of LoRa\u2019s chirp spread spectrum modulation, we develop signal processing algorithms to estimate the frequency biases with high accuracy beyond that achieved by LoRa\u2019s default demodulation. The accurate frequency bias tracking capability enables the detection of the attack that introduces additional frequency biases. We also investigate and implement a more crafty attack that uses advanced radio apparatuses to eliminate the frequency biases. To address this crafty attack, we propose a pseudorandom interval hopping scheme to enhance our frequency bias tracking approach. Extensive experiments show the effectiveness of our approach in deployments with real affecting factors such as temperature variations.\n          <\/jats:p>","DOI":"10.1145\/3474368","type":"journal-article","created":{"date-parts":[[2021,10,5]],"date-time":"2021-10-05T20:05:13Z","timestamp":1633464313000},"page":"1-31","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":16,"title":["Attack-aware Synchronization-free Data Timestamping in LoRaWAN"],"prefix":"10.1145","volume":"18","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-2153-811X","authenticated-orcid":false,"given":"Chaojie","family":"Gu","sequence":"first","affiliation":[{"name":"Nanyang Technological University, Nanyang Avenue, Singapore"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8501-9488","authenticated-orcid":false,"given":"Linshan","family":"Jiang","sequence":"additional","affiliation":[{"name":"Nanyang Technological University, Nanyang Avenue, Singapore"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8441-9973","authenticated-orcid":false,"given":"Rui","family":"Tan","sequence":"additional","affiliation":[{"name":"Nanyang Technological University, Nanyang Avenue, Singapore"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Mo","family":"Li","sequence":"additional","affiliation":[{"name":"Nanyang Technological University, Nanyang Avenue, Singapore"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Jun","family":"Huang","sequence":"additional","affiliation":[{"name":"Massachusetts Institute of Technology, Cambridge, United States, MA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2021,10,5]]},"reference":[{"key":"e_1_2_1_1_1","unstructured":"Modtronix. 2018. Retrieved from http:\/\/modtronix.com\/prod\/components\/wireless\/sx1276.pdf.  Modtronix. 2018. Retrieved from http:\/\/modtronix.com\/prod\/components\/wireless\/sx1276.pdf."},{"key":"e_1_2_1_2_1","unstructured":"Pieter Robyns. 2019. Retrieved from https:\/\/github.com\/rpp0\/gr-lora.  Pieter Robyns. 2019. Retrieved from https:\/\/github.com\/rpp0\/gr-lora."},{"key":"e_1_2_1_3_1","unstructured":"Charles Byers. 2019. Fog Computing for Industrial Automation. Retrieved from http:\/\/bit.ly\/2uOYp9z.  Charles Byers. 2019. Fog Computing for Industrial Automation. Retrieved from http:\/\/bit.ly\/2uOYp9z."},{"key":"e_1_2_1_4_1","unstructured":"RTL-SDR Blog. 2019. RTL-SDR. Retrieved from https:\/\/www.rtl-sdr.com\/.  RTL-SDR Blog. 2019. RTL-SDR. Retrieved from https:\/\/www.rtl-sdr.com\/."},{"key":"e_1_2_1_5_1","unstructured":"Keysight Technologies. 2019. Vector Signal Analyzer. Retrieved from https:\/\/www.keysight.com\/en\/pc-2416877\/vector-signal-analyzer?cc=US&lc=eng.  Keysight Technologies. 2019. Vector Signal Analyzer. Retrieved from https:\/\/www.keysight.com\/en\/pc-2416877\/vector-signal-analyzer?cc=US&lc=eng."},{"key":"e_1_2_1_6_1","unstructured":"Ettus Research. 2020. GPSDO. Retrieved from http:\/\/bit.ly\/2FL8Fl5.  Ettus Research. 2020. GPSDO. Retrieved from http:\/\/bit.ly\/2FL8Fl5."},{"key":"e_1_2_1_7_1","unstructured":"Fabian Pedregosa. 2020. Memory Profiler. Retrieved from https:\/\/github.com\/pythonprofilers\/memory_profiler.  Fabian Pedregosa. 2020. Memory Profiler. Retrieved from https:\/\/github.com\/pythonprofilers\/memory_profiler."},{"key":"e_1_2_1_8_1","unstructured":"Chengdu Ebyte Electronic Technology Co. Ltd. 2020. Wireless SX1262 LoRa Module. Retrieved from http:\/\/www.ebyte.com\/en\/product-view-news.aspx?id=437.  Chengdu Ebyte Electronic Technology Co. Ltd. 2020. Wireless SX1262 LoRa Module. Retrieved from http:\/\/www.ebyte.com\/en\/product-view-news.aspx?id=437."},{"key":"e_1_2_1_9_1","unstructured":"Adafruit. 2020. Wireless SX1262 LoRa Module. Retrieved from https:\/\/www.adafruit.com\/product\/393.  Adafruit. 2020. Wireless SX1262 LoRa Module. Retrieved from https:\/\/www.adafruit.com\/product\/393."},{"key":"e_1_2_1_10_1","unstructured":"Amazon. 2020. RTL-SDR Blog R820T2 RTL2832U 1PPM TCXO SMA Software Defined Radio (Dongle Only). Retrieved from https:\/\/www.amazon.com\/dp\/B0129EBDS2.  Amazon. 2020. RTL-SDR Blog R820T2 RTL2832U 1PPM TCXO SMA Software Defined Radio (Dongle Only). Retrieved from https:\/\/www.amazon.com\/dp\/B0129EBDS2."},{"key":"e_1_2_1_11_1","volume-title":"Proceedings of CYBCONF. 1\u20136.","author":"Aras E.","unstructured":"E. Aras , G. S. Ramachandran , P. Lawrence , and D. Hughes . 2017. Exploring the security vulnerabilities of LoRa . In Proceedings of CYBCONF. 1\u20136. E. Aras, G. S. Ramachandran, P. Lawrence, and D. Hughes. 2017. Exploring the security vulnerabilities of LoRa. In Proceedings of CYBCONF. 1\u20136."},{"key":"e_1_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1145\/3144457.3144478"},{"key":"e_1_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1145\/1409944.1409959"},{"key":"e_1_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1109\/RTSS.2012.73"},{"key":"e_1_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1145\/3302506.3310396"},{"key":"e_1_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1109\/IPSN.2018.00013"},{"key":"e_1_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2919274"},{"key":"e_1_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.1145\/3098822.3098845"},{"key":"e_1_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.5555\/2120959.2121128"},{"key":"e_1_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.5555\/3323234.3323258"},{"key":"e_1_2_1_21_1","unstructured":"The European Telecommunications Standards Institute. 2017. Technical characteristics for Low Power Wide Area Networks Chirp Spread Spectrum (LPWAN-CSS) operating in the UHF spectrum below 1 GHz. Retrieved from https:\/\/www.etsi.org\/deliver\/etsi_tr\/103500_103599\/103526\/01.01.01_60\/tr_103526v010101p.pdf.  The European Telecommunications Standards Institute. 2017. Technical characteristics for Low Power Wide Area Networks Chirp Spread Spectrum (LPWAN-CSS) operating in the UHF spectrum below 1 GHz. Retrieved from https:\/\/www.etsi.org\/deliver\/etsi_tr\/103500_103599\/103526\/01.01.01_60\/tr_103526v010101p.pdf."},{"key":"e_1_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1109\/TUFFC.2005.1561660"},{"key":"e_1_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1145\/3293534"},{"key":"e_1_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1145\/2461381.2461396"},{"key":"e_1_2_1_25_1","doi-asserted-by":"crossref","unstructured":"R. V. E. Lovelace J. M. Sutton and E. E. Salpeter. 1969. Digital search methods for pulsars. Nature 222 5190 (1969) 231\u2013233.  R. V. E. Lovelace J. M. Sutton and E. E. Salpeter. 1969. Digital search methods for pulsars. Nature 222 5190 (1969) 231\u2013233.","DOI":"10.1038\/222231a0"},{"key":"e_1_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.3141\/1804-14"},{"key":"e_1_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1145\/3230543.3230567"},{"key":"e_1_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.1145\/3302506.3310408"},{"key":"e_1_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1145\/3098243.3098267"},{"key":"e_1_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1016\/S0031-9201(99)00007-2"},{"key":"e_1_2_1_31_1","unstructured":"N. Sornin M. Luis T. Eirich T. Kramp and O. Hersent. 2016. LoRaWAN Specification (V1.0.2).  N. Sornin M. Luis T. Eirich T. Kramp and O. Hersent. 2016. LoRaWAN Specification (V1.0.2)."},{"key":"e_1_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.1023\/A:1008202821328"},{"key":"e_1_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.applthermaleng.2019.114646"},{"key":"e_1_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.1109\/TCOMM.2004.840623"},{"key":"e_1_2_1_35_1","doi-asserted-by":"publisher","DOI":"10.1145\/1859995.1860002"}],"container-title":["ACM Transactions on Sensor Networks"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3474368","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3474368","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T19:30:26Z","timestamp":1750188626000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3474368"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021,10,5]]},"references-count":35,"journal-issue":{"issue":"1","published-print":{"date-parts":[[2022,2,28]]}},"alternative-id":["10.1145\/3474368"],"URL":"https:\/\/doi.org\/10.1145\/3474368","relation":{},"ISSN":["1550-4859","1550-4867"],"issn-type":[{"value":"1550-4859","type":"print"},{"value":"1550-4867","type":"electronic"}],"subject":[],"published":{"date-parts":[[2021,10,5]]},"assertion":[{"value":"2020-11-01","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2021-07-01","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2021-10-05","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}