In this video, we'll explain the role of the network server and the application server and we'll see 1
how end devices manage to transmit information to these servers. 2
First of all, we said in a previous video that end devices transmit information to all gateways present 3
in the coverage area. After the gateway, the message transmit on internet all the way to the application 4
server. 5
When we design a protocol, security is fundamental. 6
You don't want anyone to understand what the end device says. 7
You don't want anyone to be able to change only one bit of the transmitted frame. 8
And finally, you want to be sure that the data comes from an end device allowed to speak to the server. 9
These three security features are not specific to LoRaWAN. Any software, any network and also any end device 10
internal firmware has the same security requirements. 11
We call these features : confidentiality, integrity and authencity. 12
So now the question is, how does Lorawan handle it? 13
So first, if you want your data to be confidential, so nobody can understand it, you need to use encryption. 14
This is done by a key stored on the end device and on the applications server. 15
In Lorawan, the key used for encryption is called application session key. 16
And of course, they must be the same on each side. 17
Let's take an example. 18
We will again use the same example of an end device sending one byte of temperature. Let's say that 19
the device sent temperature of 25 degrees with an application session key named application session key 20
one. 21
This data will go through the Lora network and will reach the application server. 22
And in our case, the application server as the same AppSKey_1. 23
AppSKey_1. 24
This means that after the decryption process, the temperature data will reach the user with the right 25
value. 26
All the way the confidentiality is respected. 27
That's perfect. 28
But from a security point of view, is that enough? 29
Let's take an example of a second temperature device. 30
So obviously, with another Application Session Key chosen randomly in the end-device. It will transmit another 31
temperature value. 32
Let's say 100 degrees. 33
This temperature would transit to the gateway through the network server and then the application server 34
decrypts it. 35
Obviously with the wrong application session key, the temperature decrypted will be wrong. 36
Of course there would be a temperature resulting from the decryption process. 37
I can't tell you what it would be 10, 20 or whatever. 38
And by the way, it could be a real danger because the wrong temperature can lead to wrong decision 39
and to use your application inside. Anyway, 40
why does it happen? 41
Because there was no authentication. 42
It has not been defined whether the device has the right to send data to the application server. 43
And this is exactly what the network server does. 44
This means that we will need another set of key dealing with authentication. 45
This key is the network session key. 46
So there has to be a network system key present in the device, I call it networks session key one and 47
the same on the network server. 48
Now, if I come to the second end device, it doesn't have the same network session key. 49
Let's call it network session key two. 50
So when this end device will sends his temperature, it will transfer its information to the network server. 51
But on this network server, there won't be this undividual registered. 52
The consequence is that these network server will discard this packet silently because it's simply 53
assumed that this and device doesn't belong to this network. 54
We, therefore, need two parameters on the server and on the end device : network session key and application 55
session key. The network session key is for authentication and the application session key is for encryption. 56
But what about integrity? 57
We said that the last requirement of a secure transmission was that we must be sure that no one can 58
modify the message. 59
Then it's done already, thanks to the same network session key. 60
Indeed the networks session key insure both the authentification and the integrity of the transmission. 61
So we don't need another credential for that. 62
We're just missing one 63
thing though. 64
It's the identification address. 65
Not confidential, but still has to be on both side. 66
So in the end device and on the server. 67
It's called the device address. 68
In short, we have three parameters : the network session key, the application session key and the device 69
address. 70
If these configurations are correct, then we don't need any other settings to have a successful 71
Lorawan transmission. 72
Well, this session key explanation is really a key point of Lorawan protocol. 73
So I'm glad everything is clear for you now.