{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,14]],"date-time":"2026-10-14T00:08:07Z","timestamp":1791936487171,"version":"4.3.4"},"reference-count":101,"publisher":"Association for Computing Machinery (ACM)","issue":"4","license":[{"start":{"date-parts":[[2022,11,30]],"date-time":"2022-11-30T00:00:00Z","timestamp":1669766400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"name":"LOEWE initiative"},{"name":"German Federal Ministry of Education and Research and the Hessen State Ministry for Higher Education"},{"name":"National Research Center for Applied Cybersecurity ATHENE"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Sen. Netw."],"published-print":{"date-parts":[[2022,11,30]]},"abstract":"<jats:p>The changing vulnerability and threat landscape constantly challenge the security of wireless communication standards and protocols. For the Internet of Things (IoT), LoRaWAN is one of the dominant technologies for urban environments, industrial settings, or critical infrastructures due to its low-power and long-range capabilities. LoRaWAN IoT deployments are expected to operate for multiple years or even decades. Hence, it is imperative to maintain operational security at all times while continuously evolving the security of the standard and its implementations. We survey LoRaWAN security and follow a systematic and evolvable approach that can be dynamically updated. To this end, we propose a novel methodology to create evolvable surveys which relate the analyzed critical security concepts, thus allowing IT security experts to reason about LoRaWAN security properties over time. With this, we provide a tool to hardware manufacturers, software developers and providers, and network operators to achieve sustainable security for IoT deployments.<\/jats:p>","DOI":"10.1145\/3561973","type":"journal-article","created":{"date-parts":[[2022,9,8]],"date-time":"2022-09-08T08:22:07Z","timestamp":1662625327000},"page":"1-55","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":33,"title":["LoRaWAN Security: An Evolvable Survey on Vulnerabilities, Attacks and their Systematic Mitigation"],"prefix":"10.1145","volume":"18","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-8158-3030","authenticated-orcid":false,"given":"Frank","family":"Hessel","sequence":"first","affiliation":[{"name":"Technical University of Darmstadt, Darmstadt, Germany"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1296-2920","authenticated-orcid":false,"given":"Lars","family":"Almon","sequence":"additional","affiliation":[{"name":"Technical University of Darmstadt, Darmstadt, Germany"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9163-5989","authenticated-orcid":false,"given":"Matthias","family":"Hollick","sequence":"additional","affiliation":[{"name":"Technical University of Darmstadt, Darmstadt, Germany"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2023,3,7]]},"reference":[{"key":"e_1_3_2_2_2","doi-asserted-by":"publisher","DOI":"10.1109\/MCOM.2017.1600613"},{"key":"e_1_3_2_3_2","doi-asserted-by":"publisher","DOI":"10.1109\/CYBConf.2017.7985777"},{"key":"e_1_3_2_4_2","doi-asserted-by":"publisher","DOI":"10.1145\/3144457.3144478"},{"key":"e_1_3_2_5_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-662-58387-6_14"},{"key":"e_1_3_2_6_2","doi-asserted-by":"publisher","DOI":"10.1145\/3297280.3297366"},{"key":"e_1_3_2_7_2","doi-asserted-by":"publisher","DOI":"10.6028\/NIST.SP.800-57pt1r5"},{"key":"e_1_3_2_8_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-62554-2_25"},{"key":"e_1_3_2_9_2","doi-asserted-by":"publisher","DOI":"10.1109\/ETFA46521.2020.9211875"},{"key":"e_1_3_2_10_2","doi-asserted-by":"publisher","DOI":"10.1007\/3-540-44706-7_1"},{"key":"e_1_3_2_11_2","doi-asserted-by":"publisher","DOI":"10.1145\/3213299.3213304"},{"key":"e_1_3_2_12_2","doi-asserted-by":"publisher","DOI":"10.3390\/fi11010003"},{"key":"e_1_3_2_13_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-23696-0_2"},{"key":"e_1_3_2_14_2","volume-title":"LoRaWAN Networks Susceptible to Hacking: Common Cyber Security Problems, How to Detect and Prevent Them","author":"Cerrudo Cesar","year":"2020","unstructured":"Cesar Cerrudo, Esteban Martinez Fayo, and Matias Sequeira. 2020. LoRaWAN Networks Susceptible to Hacking: Common Cyber Security Problems, How to Detect and Prevent Them. Technical Report."},{"key":"e_1_3_2_15_2","doi-asserted-by":"publisher","DOI":"10.1109\/IAEAC50856.2021.9390904"},{"key":"e_1_3_2_16_2","doi-asserted-by":"publisher","DOI":"10.1109\/GIOTS.2019.8766430"},{"key":"e_1_3_2_17_2","doi-asserted-by":"publisher","DOI":"10.1109\/ISSREW53611.2021.00100"},{"key":"e_1_3_2_18_2","volume-title":"LoRaWAN\u2014Simple Rate Adaptation Recommended Algorithm","author":"Corporation Semtech","year":"2016","unstructured":"Semtech Corporation. 2016. LoRaWAN\u2014Simple Rate Adaptation Recommended Algorithm. Technical Report."},{"key":"e_1_3_2_19_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-70545-1_38"},{"key":"e_1_3_2_20_2","doi-asserted-by":"publisher","DOI":"10.1109\/LCOMM.2018.2797057"},{"key":"e_1_3_2_21_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICC.2018.8422721"},{"key":"e_1_3_2_22_2","doi-asserted-by":"publisher","DOI":"10.1109\/iThings-GreenCom-CPSCom-SmartData-Cybermatics5384 6.2021.00029"},{"key":"e_1_3_2_23_2","volume-title":"Change Request: FOpts Encrpytion, Usage of FCntDown on the LoRaWAN L2 1.1 Specification","author":"Delclef Joris","year":"2018","unstructured":"Joris Delclef. 2018. Change Request: FOpts Encrpytion, Usage of FCntDown on the LoRaWAN L2 1.1 Specification. Technical Report. STMicroelectronics. Retrieved from https:\/\/lora-alliance.org\/resource-hub\/fopts-encryption-usage-fcntdwn-errata-lorawan-l2-11-specification."},{"key":"e_1_3_2_24_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.procs.2018.07.202"},{"key":"e_1_3_2_25_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.procs.2018.07.143"},{"key":"e_1_3_2_26_2","doi-asserted-by":"publisher","DOI":"10.1109\/ISMICT.2019.8743947"},{"key":"e_1_3_2_27_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2018.11.017"},{"key":"e_1_3_2_28_2","doi-asserted-by":"publisher","DOI":"10.1109\/giots.2017.8016251"},{"key":"e_1_3_2_29_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-49443-8_4"},{"key":"e_1_3_2_30_2","volume-title":"FUOTA Process Summary\u2014Technical Recommendation TR002 v1.0.0","author":"Committee FUOTA Working Group of the LoRa Alliance Technical","year":"2019","unstructured":"FUOTA Working Group of the LoRa Alliance Technical Committee. 2019. FUOTA Process Summary\u2014Technical Recommendation TR002 v1.0.0. Technical Report. LoRa Alliance. Retrieved from https:\/\/lora-alliance.org\/resource-hub\/fuota-process-summary-technical-recommendation-tr002-v100."},{"key":"e_1_3_2_31_2","doi-asserted-by":"publisher","DOI":"10.1109\/WorldS4.2018.8611576"},{"key":"e_1_3_2_32_2","doi-asserted-by":"publisher","DOI":"10.3390\/electronics11111762"},{"key":"e_1_3_2_33_2","doi-asserted-by":"publisher","DOI":"10.4108\/eai.26-10-2015.150597"},{"key":"e_1_3_2_34_2","doi-asserted-by":"publisher","DOI":"10.3390\/cryptography2040034"},{"key":"e_1_3_2_35_2","doi-asserted-by":"publisher","DOI":"10.3390\/s18113995"},{"key":"e_1_3_2_36_2","doi-asserted-by":"publisher","DOI":"10.3390\/s17061193"},{"key":"e_1_3_2_37_2","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2022.3150281"},{"key":"e_1_3_2_38_2","doi-asserted-by":"publisher","DOI":"10.1145\/3395351.3399423"},{"key":"e_1_3_2_39_2","volume-title":"LoRaWAN Security Analysis: An Experimental Evaluation of Attacks","author":"Hessel Frank Philipp","year":"2019","unstructured":"Frank Philipp Hessel. 2019. LoRaWAN Security Analysis: An Experimental Evaluation of Attacks. Master\u2019s thesis. Technische Universit\u00e4t Darmstadt."},{"key":"e_1_3_2_40_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICNP49622.2020.9259364"},{"key":"e_1_3_2_41_2","doi-asserted-by":"publisher","DOI":"10.1049\/iet-ifs.2019.0447"},{"key":"e_1_3_2_42_2","doi-asserted-by":"publisher","DOI":"10.1109\/PST52912.2021.9647741"},{"key":"e_1_3_2_43_2","doi-asserted-by":"publisher","DOI":"10.1145\/3163058.3163064"},{"key":"e_1_3_2_44_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-55583-2_13"},{"key":"e_1_3_2_45_2","doi-asserted-by":"publisher","DOI":"10.1002\/ett.4452"},{"key":"e_1_3_2_46_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICOIN.2017.7899554"},{"key":"e_1_3_2_47_2","doi-asserted-by":"publisher","DOI":"10.1145\/3212480.3212508"},{"key":"e_1_3_2_48_2","doi-asserted-by":"publisher","DOI":"10.1109\/GLOBECOM46510.2021.9685973"},{"key":"e_1_3_2_49_2","volume-title":"LoRaWAN\u2122 Backend Interfaces 1.0 Specification","author":"Committee LoRa Alliance Technical","year":"2017","unstructured":"LoRa Alliance Technical Committee. 2017. LoRaWAN\u2122 Backend Interfaces 1.0 Specification. Technical Report. LoRa Alliance. Retrieved from https:\/\/lora-alliance.org\/resource-hub\/lorawanr-back-end-interfaces-v10."},{"key":"e_1_3_2_50_2","volume-title":"LoRaWAN\u2122 Specification v1.1","author":"Committee LoRa Alliance Technical","year":"2017","unstructured":"LoRa Alliance Technical Committee. 2017. LoRaWAN\u2122 Specification v1.1. Technical Report. LoRa Alliance. Retrieved from https:\/\/lora-alliance.org\/resource-hub\/lorawanr-specification-v11."},{"key":"e_1_3_2_51_2","volume-title":"LoRaWAN\u2122 Specification V1.0.3","author":"Committee LoRa Alliance Technical","year":"2018","unstructured":"LoRa Alliance Technical Committee. 2018. LoRaWAN\u2122 Specification V1.0.3. Technical Report. LoRa Alliance. Retrieved from https:\/\/lora-alliance.org\/resource-hub\/lorawanr-specification-v103."},{"key":"e_1_3_2_52_2","volume-title":"Technical Recommendations for Preventing State Synchronization Issues around LoRaWAN\u2122 1.0.x Join Procedure","author":"Committee LoRa Alliance Technical","year":"2018","unstructured":"LoRa Alliance Technical Committee. 2018. Technical Recommendations for Preventing State Synchronization Issues around LoRaWAN\u2122 1.0.x Join Procedure. Technical Report. LoRa Alliance."},{"key":"e_1_3_2_53_2","volume-title":"LoRaWAN \u00ae L2 1.0.4 Specification (TS001-1.0.4)","author":"Committee LoRa Alliance Technical","year":"2020","unstructured":"LoRa Alliance Technical Committee. 2020. LoRaWAN \u00ae L2 1.0.4 Specification (TS001-1.0.4). Technical Report. LoRa Alliance."},{"key":"e_1_3_2_54_2","first-page":"85","volume-title":"LoRaWAN\u00ae Backend Interfaces Technical Specification (TS002-1.1.0)","author":"Committee LoRa Alliance Technical","year":"2020","unstructured":"LoRa Alliance Technical Committee. 2020. LoRaWAN\u00ae Backend Interfaces Technical Specification (TS002-1.1.0). Technical Report. Semtech Corporation. 85 pages."},{"key":"e_1_3_2_55_2","volume-title":"RP002-1.0.1 LoRaWAN\u00ae Regional Parameters","author":"Workgroup LoRa Alliance Technical Committee Regional Parameters","year":"2020","unstructured":"LoRa Alliance Technical Committee Regional Parameters Workgroup. 2020. RP002-1.0.1 LoRaWAN\u00ae Regional Parameters. Technical Report. LoRa Alliance. Retrieved from https:\/\/lora-alliance.org\/resource-hub\/rp2-101-lorawanr-regional-parameters."},{"key":"e_1_3_2_56_2","doi-asserted-by":"publisher","DOI":"10.3390\/s22103717"},{"key":"e_1_3_2_57_2","doi-asserted-by":"publisher","DOI":"10.1109\/CSNet50428.2020.9265530"},{"key":"e_1_3_2_58_2","doi-asserted-by":"publisher","DOI":"10.23919\/WMNC.2019.8881830"},{"key":"e_1_3_2_59_2","doi-asserted-by":"publisher","DOI":"10.1109\/JSEN.2020.3013117"},{"key":"e_1_3_2_60_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.icte.2017.12.005"},{"key":"e_1_3_2_61_2","doi-asserted-by":"publisher","DOI":"10.1145\/3339252.3340525"},{"key":"e_1_3_2_62_2","doi-asserted-by":"publisher","DOI":"10.3390\/jsan10020036"},{"key":"e_1_3_2_63_2","article-title":"Lora security: Building a secure LoRa solution","author":"Miller Robert","year":"2016","unstructured":"Robert Miller. 2016. Lora security: Building a secure LoRa solution. MWR Labs Whitepaper (2016).","journal-title":"MWR Labs Whitepaper"},{"key":"e_1_3_2_64_2","doi-asserted-by":"publisher","DOI":"10.1109\/HST53381.2021.9619847"},{"key":"e_1_3_2_65_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICOIN.2017.7899580"},{"key":"e_1_3_2_66_2","doi-asserted-by":"publisher","DOI":"10.1145\/3372297.3420022"},{"key":"e_1_3_2_67_2","doi-asserted-by":"publisher","DOI":"10.1007\/s11277-019-06832-x"},{"key":"e_1_3_2_68_2","doi-asserted-by":"publisher","DOI":"10.1109\/AICCSA.2017.73"},{"key":"e_1_3_2_69_2","doi-asserted-by":"publisher","DOI":"10.1109\/CSCN.2019.8931397"},{"key":"e_1_3_2_70_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.iot.2020.100303"},{"key":"e_1_3_2_71_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICCP.2017.8117042"},{"key":"e_1_3_2_72_2","doi-asserted-by":"publisher","DOI":"10.23919\/SpliTech49282.2020.9243739"},{"key":"e_1_3_2_73_2","doi-asserted-by":"publisher","DOI":"10.1109\/DependSys51298.2020.00025"},{"key":"e_1_3_2_74_2","doi-asserted-by":"publisher","DOI":"10.3390\/app11167642"},{"key":"e_1_3_2_75_2","doi-asserted-by":"publisher","DOI":"10.1145\/3267204.3267212"},{"key":"e_1_3_2_76_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICT.2016.7500415"},{"key":"e_1_3_2_77_2","doi-asserted-by":"publisher","DOI":"10.3390\/s20113068"},{"key":"e_1_3_2_78_2","doi-asserted-by":"publisher","DOI":"10.1007\/s11276-022-02999-7"},{"key":"e_1_3_2_79_2","doi-asserted-by":"publisher","DOI":"10.1145\/3098243.3098267"},{"key":"e_1_3_2_80_2","first-page":"19","volume-title":"Proceedings of the 29th USENIX Security Symposium (USENIX Security 20)","author":"Ruge Jan","year":"2020","unstructured":"Jan Ruge, Jiska Classen, Francesco Gringoli, and Matthias Hollick. 2020. Frankenstein: Advanced wireless fuzzing to exploit new bluetooth escalation targets. In Proceedings of the 29th USENIX Security Symposium (USENIX Security 20). 19\u201336."},{"key":"e_1_3_2_81_2","doi-asserted-by":"publisher","DOI":"10.3390\/s18061833"},{"key":"e_1_3_2_82_2","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2016.23236"},{"key":"e_1_3_2_83_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICUMT.2018.8631198"},{"key":"e_1_3_2_84_2","volume-title":"LoRaWAN\u2122 Specification v1.0","author":"Sornin Nicolas","year":"2015","unstructured":"Nicolas Sornin, Miguel Luis, Thomas Eirich, Thorsten Kramp, and Olivier Hersent. 2015. LoRaWAN\u2122 Specification v1.0. Technical Report. LoRa Alliance. Retrieved from https:\/\/lora-alliance.org\/resource-hub\/lorawanr-specification-v10."},{"key":"e_1_3_2_85_2","volume-title":"LoRaWAN\u2122 Specification v1.0.1","author":"Sornin Nicolas","year":"2016","unstructured":"Nicolas Sornin, Miguel Luis, Thomas Eirich, Thorsten Kramp, and Olivier Hersent. 2016. LoRaWAN\u2122 Specification v1.0.1. Technical Report. LoRa Alliance. Retrieved from https:\/\/lora-alliance.org\/resource-hub\/lorawanr-specification-v101."},{"key":"e_1_3_2_86_2","volume-title":"LoRaWAN\u2122 Specification v1.0.2","author":"Sornin Nicolas","year":"2016","unstructured":"Nicolas Sornin, Miguel Luis, Thomas Eirich, Thorsten Kramp, and Olivier Hersent. 2016. LoRaWAN\u2122 Specification v1.0.2. Technical Report. LoRa Alliance. Retrieved from https:\/\/lora-alliance.org\/resource-hub\/lorawanr-specification-v102."},{"key":"e_1_3_2_87_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.comcom.2022.02.017"},{"key":"e_1_3_2_88_2","doi-asserted-by":"publisher","DOI":"10.23919\/ICACT.2018.8323684"},{"key":"e_1_3_2_89_2","doi-asserted-by":"publisher","DOI":"10.1109\/WCNCW.2017.7919091"},{"key":"e_1_3_2_90_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-981-16-9576-6_1"},{"key":"e_1_3_2_91_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-22263-5_47"},{"key":"e_1_3_2_92_2","doi-asserted-by":"publisher","DOI":"10.1109\/JIOT.2017.2768498"},{"key":"e_1_3_2_93_2","volume-title":"LoRaWAN Vulerability Analysis \u2013 (In)validation of Possible Vulnerabilities in the LoRaWAN Protocol Specification","author":"Es Eef van","year":"2018","unstructured":"Eef van Es. 2018. LoRaWAN Vulerability Analysis \u2013 (In)validation of Possible Vulnerabilities in the LoRaWAN Protocol Specification. Master\u2019s thesis. Open University of the Netherlands."},{"key":"e_1_3_2_94_2","doi-asserted-by":"publisher","DOI":"10.1145\/3230833.3232804"},{"key":"e_1_3_2_95_2","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134027"},{"key":"e_1_3_2_96_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICCUBEA47591.2019.9128417"},{"key":"e_1_3_2_97_2","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP48549.2020.00034"},{"key":"e_1_3_2_98_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICASID.2019.8925203"},{"key":"e_1_3_2_99_2","volume-title":"LoRaWAN: Vulnerability Analysis and Practical Exploitation","author":"Yang Xueying","year":"2017","unstructured":"Xueying Yang. 2017. LoRaWAN: Vulnerability Analysis and Practical Exploitation. Master\u2019s thesis. Delft University of Technology."},{"key":"e_1_3_2_100_2","doi-asserted-by":"publisher","DOI":"10.1109\/IoTDI.2018.00022"},{"key":"e_1_3_2_101_2","doi-asserted-by":"publisher","DOI":"10.3390\/s18061888"},{"key":"e_1_3_2_102_2","volume-title":"Security Threat Analysis and Countermeasures for LoRaWAN Join Procedure","author":"Zulian Simone","year":"2016","unstructured":"Simone Zulian. 2016. Security Threat Analysis and Countermeasures for LoRaWAN Join Procedure. Master\u2019s thesis. Universit\u00e1 degli Studi di Padova."}],"container-title":["ACM Transactions on Sensor Networks"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3561973","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3561973","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T13:49:07Z","timestamp":1750168147000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3561973"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,11,30]]},"references-count":101,"journal-issue":{"issue":"4","published-print":{"date-parts":[[2022,11,30]]}},"alternative-id":["10.1145\/3561973"],"URL":"https:\/\/doi.org\/10.1145\/3561973","relation":{},"ISSN":["1550-4859","1550-4867"],"issn-type":[{"value":"1550-4859","type":"print"},{"value":"1550-4867","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022,11,30]]},"assertion":[{"value":"2022-03-18","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2022-08-15","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2023-03-07","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}