For this demonstration, 1
I've got an ABP end device and before starting it I opened several windows to take the logs on several 2
part of my network. 3
On the left, I've got my end device log and on the right, there's one tab representing my gateway logs and 4
the other one is my application server. We'll see there the decrypted data. 5
So let's go. 6
I start my end device. 7
We know that because it's an ABP end device, it already has the session keys so it can transmit right away. 8
For that, I use the push button. 9
There we go. 10
We can see the frame on my device log, then I can see them on my gateway log and finally I can see 11
them on my application logs. 12
We can also check that the packet includes a frame counter and obviously I found the same frame counter 13
value and the end device on my gateway and again on my application server. 14
Everything works well. 15
So let's send ten of these frames and I come back to you. 16
Okay. 17
That's been ten frames send. 18
So now let's say that for some reasons, I need to reset my end device. 19
What's going to happen? 20
Let's try that. 21
So I clear my device logs, my gateway logs and my application logs, and I press the reset button. 22
Right. 23
So now my end device start back from the beginning and its application will send exactly the same data. 24
But of course, the frame counter is back to one. 25
Fine. 26
We can see the frame on the gateway, but when we look at the application logs, there is nothing. 27
What happened? 28
That is simple. 29
The network server simply detected a replay attack because it has already received the frame counter one, 30
two and so on up to ten. 31
So it dropped my frame because it considered that it already received it. 32
When will the reception process go back to normal? 33
That will be when the frame counter will reach the value 11 because the network server considered all 34
previous values as replay attack. 35
So I send all frame up to ten, 36
thanks to the push button. 37
Here is the number ten. 38
And now comes the 11th. 39
And the 11th is now accepted on the server. 40
So obviously this behavior is not acceptable for an application. 41
If you consider an end device with a very high frame counter, 42
we're not going to wait for ages that it takes all value before being able to transmit again. 43
So what our options? 44
The first option is to change end device firmware and to make an application which keeps a frame value 45
in a nonvolatile memory. 46
Each time it sends a frame, then the frame counter is set. 47
So if for any reason it resets, then it will easily restore the last frame counter used. 48
No LoRaWAN packet will be lost. 49
Actually, this option is the only acceptable solution if you want to use ABP. 50
And that's the one described into 1.0.4 LoRaWAN specification. 51
The second option is to go on the server. And when the end device reset, 52
then we also reset the frame counter on the server side, we can try that, but of course we'll not be 53
protected from the replay attack anymore and that we'll build the case as long as the device has not reach 54
its old value, which in this case was 11. 55
So I delete my logs on, and I reset the end device. 56
Obviously nothing happens on the application server. 57
Now if I want to reset the frame counter, I need to go on the general settings then network layer. 58
Expand and at the bottom there is an option called session and MAC state reset. 59
This option resets the frame counter value. 60
So if I click on that and accept the warning. 61
Then now, 62
I've got the packet coming in the application server again. 63
This option is not secure and as we can see, is not easily manageable. 64
We use this possibility only on rare occasions. 65
Right, now if you work on a ABPLoRaWAN end device, then during development or of testing purposes, 66
it would be nice to be able to reset our end device as much as we will. 67
So there is another option available, but this one completely removed the replay attack protection. 68
You should never use this option in the real device deployment. 69
So if you are sure that you want to do this, you have to go to the general settings tab, then network 70
layer, expand, and at the bottom advanced MAC settings and hit the option reset frame counter. 71
You can notice that when you think this box then warning appear saying that resetting is insecure and 72
makes your device susceptible for replay attacks. 73
So yes, it's now possible to reset your device, but be really careful. 74
You're now not protected from replay attack and you have to be aware of that. 75
We can now reset our end device. 76
And see that all frames are received. 77
Even if the frame counter went back to one. 78
Finally, there is one last option and that's probably the best choice as we have seen the ABP activation 79
mode has his first drawback, about the way it deals with the frame counter. 80
So the best solution is to change and to use OTAA instead of ABP. 81
And that's what I'm going to show you in the next video.