As the Internet of Things (IoT) expands across the UK, connecting everything from streetlights in London to water meters in the Scottish Highlands, a critical question arises. If we are filling our cities and buildings with wireless sensors, are we opening the door to hackers?
We have all read the horror stories about insecure Wi-Fi baby monitors or hacked smart fridges used in botnets. These early failures of the consumer IoT market have understandably made IT directors and Facility Managers nervous. When you are dealing with critical infrastructure – like flood warnings, air quality monitoring in schools, or energy management – security is not just a feature. It is the foundation.
At Concept13, we champion LoRaWAN not just for its range and battery life, but because it is one of the few IoT protocols built with “Security by Design” from day one. Unlike older proprietary systems, where security was added as an afterthought, LoRaWAN is encrypted at every level.
This guide peels back the layers of encryption to explain exactly how LoRaWAN protects your data, your devices, and your network from cyber threats.
The Quick Answer
LoRaWAN is exceptionally secure. It uses AES-128 encryption, the same standard used by banks and governments. Its security architecture relies on a “double key” system. The Network Session Key ensures the message is authentic and comes from a trusted device. The Application Session Key ensures that the data payload (the actual reading) is encrypted so that not even the network operator can read it; only you can. Furthermore, modern deployments use OTAA (Over-The-Air Activation), which generates fresh security keys every time a device joins the network, preventing “replay attacks” and ensuring long-term resilience.
The Foundation: AES-128 Encryption
To understand LoRaWAN security, we must look at the mathematics. LoRaWAN uses AES-128 (Advanced Encryption Standard).
This is a symmetric-key algorithm. “128-bit” refers to the key length. To brute force (guess) an AES-128 key using current supercomputers would take billions of years. This level of encryption is standard across the financial and military sectors.
However, having a strong lock is useless if you leave the key under the doormat. The genius of LoRaWAN lies in how it manages these keys using a dual-layer approach.
The “Double Key” Mechanism: Network vs. Application
In many wireless protocols, if you hack the network, you see everything. LoRaWAN separates the “transport” from the “message.” It uses two distinct keys for two distinct jobs.
1. The Network Session Key (NwkSKey)
This key is shared between the sensor and the Network Server (the traffic controller).
-
Function: It creates a “Message Integrity Code” (MIC). It acts like a digital signature.
-
The Check: When a gateway receives a packet, the Network Server checks this signature. If it matches, it knows the device is legitimate and trusted. If it does not match, the packet is instantly dropped.
-
What it protects: It proves identity. It stops hackers from injecting fake sensor data into your network.
2. The Application Session Key (AppSKey)
This key is shared only between the sensor and your specific Application Server (your dashboard or database).
-
Function: It encrypts the actual payload (the temperature reading, the water leak alert).
-
The Privacy: Crucially, the Network Server does not have this key. It routes the data packet, but it cannot read what is inside. It sees a scrambled mess of code. Only when the packet arrives at your private Application Server is it decrypted using the AppSKey.
-
What it protects: It protects privacy. Even if the network provider was compromised, your business data remains unreadable.
The Postal Service Analogy
Think of a LoRaWAN message like a sealed letter sent through the Royal Mail.
-
The Network Session Key is the address on the envelope. The postman (Network Server) needs to read this to deliver it. He checks the stamp to make sure it is paid for and valid.
-
The Application Session Key is the language written inside the letter. Even if the postman steams open the envelope, if the letter is written in a secret code that only you and the sender understand, he learns nothing.
Provisioning: OTAA vs. ABP
When deploying a network, engineers have two ways to connect devices: OTAA and ABP. This choice has massive security implications.
ABP (Activation by Personalisation)
In this method, the security keys are hard-coded into the device at the factory. They never change.
-
The Risk: If a hacker physically steals the sensor and extracts the keys, they have them forever. If you want to change the keys, you have to physically plug a laptop into the sensor.
-
Verdict: ABP is generally avoided for modern, secure deployments.
OTAA (Over-The-Air Activation)
This is the gold standard used by Concept13. The device is born with a “Root Key” (AppKey). When you turn the device on, it performs a “Join Procedure” with the network.
-
The device says, “Hello, can I join?”
-
The network challenges it.
-
If they agree, they mathematically generate brand new Session Keys (NwkSKey and AppSKey) for that specific session.
Why is OTAA safer? If the device reboots or re-joins, it generates new keys. If you suspect a breach, you can force a re-join, effectively changing the locks wirelessly. It provides “Forward Secrecy.”
Physical Security: What if they steal the sensor?
A common fear with Smart Cities is physical tampering. What if someone rips a parking sensor off the road or steals a temperature monitor from a school wall?
If a thief steals a LoRaWAN sensor, they have a plastic box. They do not have access to your network.
-
No Reverse Access: LoRaWAN is asynchronous. You cannot “ping” a sleeping sensor to hack it. The sensor only wakes up to talk when it wants to.
-
Secure Elements: Premium sensors (like those from Synetica or Elsys) can store their Root Keys in a “Secure Element.” This is a dedicated hardware chip that functions like a vault. Even if a hacker wires the chip to a computer, they cannot extract the keys. The chip will destroy the data if tampered with.
-
Frame Counters: Every message sent has a number (1, 2, 3…). The network tracks this. If a hacker records a message saying “No Leak” and tries to replay it later (a Replay Attack), the network sees the counter is old and rejects it immediately.
The LoRa Alliance Certification
Security relies on standards. LoRaWAN is overseen by the LoRa Alliance, a global association of over 500 tech companies.
They run a rigorous certification program. A device cannot wear the “LoRaWAN Certified” logo unless it has passed strict testing to prove it adheres to the security protocols. This prevents the market from being flooded with cheap, insecure knock-offs.
At Concept13, we only deploy certified hardware. This ensures that every link in the chain, from the gateway on the roof to the sensor in the basement, is speaking the same secure language.
Best Practices for a Secure Network
While the protocol is secure, human error is the weak link. To maintain a fortress-like IoT network, we follow strict protocols.
1. Gateway Security The gateway is the bridge to the internet. While the LoRaWAN radio side is secure, the gateway’s internet connection (Ethernet or 4G) must be protected. We ensure all Outdoor Gateways utilise VPNs (Virtual Private Networks) and have their default passwords changed immediately upon installation.
2. Key Management Never store your keys in a spreadsheet called “keys.xls”.
3. Application Separation Because of the “Double Key” system, we can send data from different departments through the same gateway securely. The “Parking Team” cannot see the “Social Housing Team’s” data, even though it goes through the same antenna. This allows Councils to share infrastructure without sharing secrets.
Conclusion
Is LoRaWAN secure? The answer is a definitive yes. In fact, it is often more secure than the Wi-Fi or Bluetooth devices people use in their homes daily.
By utilising AES-128 encryption, rotating session keys via OTAA, and separating the network layer from the application layer, LoRaWAN provides a robust shield for your data. Whether you are monitoring critical infrastructure or tracking assets, you can trust that your data is for your eyes only.
In a world where cyber threats are evolving, choosing a protocol that puts security first is the smartest decision a business can make. For more on how we implement these secure networks for clients, visit our services page.
For further reading on national security standards regarding IoT, the National Cyber Security Centre (NCSC) provides excellent guidance for UK businesses.
