LoRa Gateway has new antenna

Finally the new 7dB antenna arrived. Since the new antenna has a 3cm magnetic mount I will try to put it on top of the car for better coverage.

New 868Mhz 7dB LoRa antenna

Specs:

Antenna gain: 7dB
Magnetic mount: 3cm
Cable length: 150 cm
Connector: SMA male

I can connected it to the gateway or to the ESP8266 Lora module from Dorji.com.

LoRa Security issue

With all the issues occurred a week ago where an estimated 100000 end devices caused the flooding and lot of US services and websites being affected made ma to look more closely to the LoRa protocol. 

According to the specification of the LoRaWAN the MAC Frame Payload Encryption (FRMPayload 4.4.3) the encryption scheme used is based on the generic algorithm described in the IEEE 82.15.4/2006 using AES with a key length of 128 bits.

Looking on the key this can be NwkSKey if FPort is zero or AppSKey if FPort is 0x01 ..0xFF. So it is a fixed key. This key is used to encrypt / decrypt as I've explained in this blog post. 

The problem appears on the first frame when every time will have the same key and probably the same data, so if someone is intercepting this for few times the key K and Ai can be found.

Si=aes128_encrypt(K,Ai)

Since the Ai is the same the only way to keep the LoRaWAN secure is to send as first data a RANDOM payload and maybe also an random value of FCntUp. 

In this way will be harder to find the K and decode the payload. 

I hope that the next version of LoRaWAN protocol will address the security issues we encounter these days.

LoRa meetings in Eindhoven

Last week I've spend a quality time together with other LoRa fans here in Eindhoven. I've found that they will try to build some gateways where Lorna Goulden (organizer) and Frank Beks ( tech ) where helping other LoRa and TTN enthusiasts to build their first LoRa gateway so I've went in.

Build and connect your gateway

Next meeting will be in November where nodes will be build so data will be transmitted through the new gateways.

Last weekend I was there just to meet the guys ( I already have gateway and nodes) but in November I will do a short presentation about LoRaWAN 1.0.

Soldering the new gateways

In plan: ESP8266 with GPS and LoRa

Few months ago I bought an GPS receiver from http://navspark.mybigcommerce.com/navspark-mini-uart-to-usb-adapter/ along with an GPS antenna.

The board is "free", just need to pay $10 for delivery :-)
I recommend you to take also the antenna for an extra $9 since without it the board is useless.

The board is :

HARDWARE SPECS
* 100MHz 32bit LEON3 Sparc-V8 + IEEE-754 Compliant Floating Point Unit
* 1024KB Flash Memory + 212KB RAM
* 1x full duplex asynchronous UART
* 1x SPI shared with GPIO
* 1x 2-wire interface shared GPIO
* Atomic clock synchronized P1PPS time reference with +/-10nsec accuracy

GPS SPEC
* 167 channel Venus 8 engine
* Uses GPS, SBAS, QZSS signals
* 1 ~ 10 Hz update rate
* Position accuracy 2.5m CEP 
* Velocity accuracy 0.1m/sec
* Warm start TTFF under open sky 29sec average
* Cold start TTFF under open sky 30sec average
* Cold start sensitivity -148dBm
* Tracking sensitivity -165dBm
* Operating range : (altitude < 18km) or (speed < 515m/sec), both not exceeded simultaneously

http://navspark.mybigcommerce.com/content/GNSS_Viewer.zip 

http://navspark.mybigcommerce.com/content/GNSS-Viewer-User-Guide.rev0.2.pdf

The plan is to connect the GPS with the ESP8266 and with the new LoRa modules from Dorji.com to have a full LoRaWAN module.

I guess can use this setup also as a single channel gateway for LoRaWAN. It will be very small, cheap, battery operated, ideal for demos, students and as a LoRa STARTER KIT.

LoRa gateway antennas

Finally my LoRa gateway has both antennas. One +2dB for the gateway ( there is a bigger one with +7dB on its way to me. I hope I will receive it next week)  and one for the GPS module that is on the linklabs board.

I've order the antenna from eu.banggood.com to be delivered in one week instead of one month.

Before I had for the 868Mhz band an 8.2 cm wire (1/4 wave lenght) converted from an 2.4Ghz WiFi antenna. I've used only the base to be able to mount it on the gateway and I've soldered to wire.

Old home made antenna vs the new 2dB 

The full setup needs just a proper waterproof case to be mounted outside.

Both antennas in place

GPS is working, I see the coordinates and altitude but more important now I am ready for class B and for precise downlink messages from my Network Server.

New LoRa modules from dorji.com

Santa Claus came early this year for me with 10 great modules from dorji.com. You can buy them easy on tindie,com , ebay.com or give them an email.

Modules are based on SX1276 chip have the code DRF1276G with the full specs:

•  (G)FSK/4(G)FSK/LoRa Modulation
•  868/915MHz transceiver
•  20dBm output power
•  -139dBm sensitivity
•  Standard SPI interface
•  127dB dynamic Range RSSI
•  Automatic RF sense and CAD monitor
•  Data Rate: <300 kbps
•  Standby current: <1uA
• Supply voltage: 1.8~3.6V

Dorji DRF1276G LoRa 868Mhz modules

Comparing them with other modules I have, from niceRF, the space between the pads is 2mm versus 1mm on niceRF so there is more easy to solder them on. Also have pins on both sides so is much easy to design a good PCB. See a picture with the niceRF LoRa module.

niceRF SX1276  v1.1 868Mhz LoRa module

I will connect them to the ESP8266 on the SPI I will let you know about the progress.

You can connect them to this ESP module or this one which is battery operated (keep in mind that are 3.3V modules) and don't forget to read this post.

Another nice thing abut this modules is that you can use them as a single channel gateway for LoRa so you will make an economy of few hundred euros so you can buy more modules and test or deploy your network.

Finally my LoRa gateway will be happy to receive another 10 motes. I am waiting for ideas what to connect as sensors for  nodes. 

Other software I am working on is a new LoRa Network Server that will be deployed as SaaS into the cloud so anyone can have a LoRa Server in a matter of minutes. With this server will be very easy to deploy your private LoRa network.

As a status, the Rx (uplink) part is done and I am working now on the TX ( downlink).  The network server will support for the beginning the latest version (2) and I will add previous version (1) later on.

My LoRa Gateway

More devices IN

I've completed to code to add more devices, so now the module as common code can:

• update from OTA server if the version on server is bigger the its own version of code
• get the data from AUTH server (topics, type, MQTT server etc, credentials)
• get the time from NTP server
• log data to an external server
• log debug data to a DEBUG server
• do  CRON tasks on GPIO pins based on schedule received from Android App
• send status and its state to Android app.

All these features are part of the common code that will run an all my modules.
Now sky is the limit on what each module can do : 

• temperature,
• humidity, 
• noise, 
• presence,
• gas detection, 
• acceleration, 
• vibration, 
• measuring power consumption, 
• controlling blinds, 
• garage door, 
• boiler, 
• irrigation controller, 
• fish tank, 
• motors, 
• air conditioning or a thermostat etc
• coffee machines
• washing machines
• fridge
• remote control substitute for TV, Satellite dish, Cable TV or any other IR
• power sockets
• exterior lights
• interior lights
• power sockets
• air quality

And the beauty is that I am not limited by the WiFi, the same things I can do with my new LoRa modules.

The all power will be at your finger tips.

 Obs: Later I'll try to add some Artificial Intelligence (AI) to my system, because the IoT without AI  is pretty  much limited on manually or semi automatic control.

Decoding a LoraWAN payload send by your ESP8266 gateway

If you are receiving a LoraWAN packet on you LoraWAN gateway using the ESP8266 module most probably  you will forward it to a back-end server to be processed by your application. But the message is encoded and encrypted so this is the procedure to do it right.

rxpk update: {"rxpk":[{"tmst":1060664170,"chan":0,"rfch":0,"freq":868.100000,"stat":1,"modu":"LORA","datr":"SF7BW125","codr":"4/5","lsnr":12,"rssi":-28,"size":31,"data":"QGIH4AIAqgABvJNVF4DpUapp/xQN1REVnI+jYoR6Ig=="}]}

Step1. Base64

The "data":"QGIH4AIAqgABvJNVF4DpUapp/xQN1REVnI+jYoR6Ig==" need to be decoded using base64 and the result will be:

64, 98, 7, -32, 2, 0, -86, 0, 1, -68, -109, 85, 23, -128, -23, 81, -86, 105, -1, 20, 13, -43, 17, 21, -100, -113, -93, 98, -124, 122, 34

Step 2. Build the block A(i) according to the 4.3.3.1 

For each data message, the algorithm defines a sequence of Blocks Ai  for i = 1..k 

with k = ceil(len(pld) / 16). In our case the k=2 because the len(pld)=31 so there are 2 blocks that need to be constructed.

An A Block will be like this one:

-----------------------------------------------------------------------------------------------------------

                          | Dir | Device Address     | Fcnt Up/Down       |      | Block number     

-----------------------------------------------------------------------------------------------------------

0x01 | 0x00 0x00 0x00 0x00| 0x00| 0x62 0x07 0xE0 0x02| 0xAA 0x00 0x00 0x00| 0x00 | 0x01

-----------------------------------------------------------------------------------------------------------

                          | Dir | Device Address     | Fcnt Up/Down       |      | Block number     

-----------------------------------------------------------------------------------------------------------

0x01 | 0x00 0x00 0x00 0x00| 0x00| 0x62 0x07 0xE0 0x02| 0xAA 0x00 0x00 0x00| 0x00 | 0x02

Where Dir is direction and it is 0 for uplink and 1 for downlink

Step 3. Encrypt each A Block

The blocks Ai are encrypted to get a sequence S of blocks S(i) :  S(i) = aes128_encrypt(K, Ai) for i = 1..k

So, on this step each A block will be encrypted ( yes encrypted !!!) AES128 with the same

key used on node side. 

A ciphertext will be like:

c7b11d72ec853e8853dd4362a77d71ad

Step 4. XOR the cipher with payload.

S = S1 | S2 | .. | Sk

Don't forget that encryption and decryption of the payload is done by truncating (pld | pad16) XOR S to the first len(pld) octets.

At the end the text {"Hello":"World1"} will be available for your application. If at the node side this text is encrypted your app will need to do a decryption to get it.

Esp8266 meets LoRaWan

I guess that you don't have any doubts that ESP8266 can do LoRaWan.

For this project I've used two modules:

1.LoRaWan Single Channel Gateway

Single channel gateway ( to be compatible with LoRaWan you must have 8 channes) was made using the SX1276 module and a Raspberry Pi2. Comunication is done over SPI using wiringPi library.

Single channel gateway

2.LoRaWan node with ESP8266 

For node I've used the Witty module with the modifications from this post.
As a software I've used the ported LMICv1.51 and modified to send data to only one channel since the gateway is single channel ( I am using 868.1Mhz).

Lora Node with ESP8266

Now the gateway is enrolled in TTN ( https://thethingsnetwork.org/) and the data has started to arrive. I've managed to receive also data from other surrounding nodes.


On the gateway data looks like:



Packet RSSI: -107, RSSI: -105, SNR: -11, Length: 108

rxpk update: {"rxpk":[{"tmst":368384825,"chan":0,"rfch":0,"freq":868.100000,"stat":1,"modu":"LORA","datr":"SF7BW125","codr":"4/5","lsnr":-11,"rssi":-107,"size":108,"data":"Wqish6GVYpKy6o9WFHingeTJ1oh+ABc8iALBvwz44yxZP+BKDocaC5VQT5Y6dDdUaBILVjRMz0Ynzow1U/Kkts9AoZh3Ja3DX+DyY27exB+BKpSx2rXJ2vs9svm/EKYIsPF0RG1E+7lBYaD9"}]}


and data from my nodes:

Packet RSSI: -28, RSSI: -105, SNR: 12, Length: 31

rxpk update: {"rxpk":[{"tmst":1060664170,"chan":0,"rfch":0,"freq":868.100000,"stat":1,"modu":"LORA","datr":"SF7BW125","codr":"4/5","lsnr":12,"rssi":-28,"size":31,"data":"QGIH4AIAqgABvJNVF4DpUapp/xQN1REVnI+jYoR6Ig=="}]}

Next I'll have to add sensors to nodes and to run some tests for range and buy a real gateway.

More info about LMIC port and code here.

About LoRa and LoRaWan

LoRa is based on opened radio-frequency communications, different frequencies are used depend on locations:

• 430 Mhz – valid for Asia
• 780 Mhz – valid for China
• 433 Mhz – valid for Europe
• 866 Mhz – valid for Europe
• 915 Mhz – valid for USA

LoRa supports different Data Rates and offer a large radio link budget over 160dB. The power consumption is about 40mA during transmission and 10mA during reception. It allows a wide coverage : about 2.5Km from antenna inside a city and up to 15km in a countryside.

LoRa is based on a Spead Spectrum technology this technology helps to reach long distance over noise boosting up to 10x the distances obtains with classical transmission systems. It also have a good shifting frequency immunity.  LoRa sound to have good results on movement. It uses wide-band linear frequency modulated pulses. Frequency increase or decrease to encode the information.

LoRaWAN Classes, © 2015 LoRa™ Alliance.

LoRaWAN™ is a Low Power Wide Area Network (LPWAN) specification intended for wireless battery operated Things in regional, national or global network. LoRaWAN target key requirements of internet of things such as secure bi-directional communication, mobility and localization services. This standard will provide seamless interoperability among smart Things without the need of complex local installations and gives back the freedom to the user, developer, businesses enabling the roll out of Internet of Things.

LoRaWAN network architecture is typically laid out in a star-of-stars topology in which gateways is a transparent bridge relaying messages between end-devices and a central network server in the backend. Gateways are connected to the network server via standard IP connections while end-devices use single-hop wireless communication to one or many gateways. All end-point communication is generally bi-directional, but also supports operation such as multicast enabling software upgrade over the air or other mass distribution messages to reduce the on air communication time.

Communication between end-devices and gateways is spread out on different frequency channels and data rates. The selection of the data rate is a trade-off between communication range and message duration. Due to the spread spectrum technology, communications with different data rates do not interfere with each other and create a set of "virtual" channels increasing the capacity of the gateway. LoRaWAN data rates range from 0.3 kbps to 50 kbps. To maximize both battery life of the end-devices and overall network capacity, the LoRaWAN network server is managing the data rate and RF output for each end-device individually by means of an adaptive data rate (ADR) scheme.

National wide networks targeting internet of things such as critical infrastructure, confidential personal data or critical functions for the society has a special need for secure communication. This has been solved by several layer of encryption:

• Unique Network key (EUI64) and ensure security on network level
• Unique Application key (EUI64) ensure end to end security on application level
• Device specific key (EUI128)

LoRaWAN has several different classes of end-point devices to address the different needs reflected in the wide range of applications:

• Bi-directional end-devices (Class A): End-devices of Class A allow for bi-directional communications whereby each end-device's uplink transmission is followed by two short downlink receive windows. The transmission slot scheduled by the end-device is based on its own communication needs with a small variation based on a random time basis (ALOHA-type of protocol). This Class A operation is the lowest power end-device system for applications that only require downlink communication from the server shortly after the end-device has sent an uplink transmission. Downlink communications from the server at any other time will have to wait until the next scheduled uplink.
• Bi-directional end-devices with scheduled receive slots (Class B): In addition to the Class A random receive windows, Class B devices open extra receive windows at scheduled times. In order for the End-device to open its receive window at the scheduled time it receives a time synchronized Beacon from the gateway. This allows the server to know when the end-device is listening.
• Bi-directional end-devices with maximal receive slots (Class C): End-devices of Class C have nearly continuously open receive windows, only closed when transmitting. Class C

[Text from https://www.lora-alliance.org/What-Is-LoRa/Technology]

More details about the protocol can be found in the document.