Table of Contents: 

1. Introduce

A standard LoRaWAN packet via UDP packet forward to LoRaWAN server is AES128 encryption. In this chapter, we will show how this packet looks like in the server and see the possibility to get the content of this packet.

image-20220527085838-1.png

Unencrypt Network modified from LoRaWAN

2. Analyze the LoRaWAN packet

If the gateway is connected to LoRaWAN server via UDP packet fordward. We can set the server address to a UDP server to get the LoRaWAN packets.

image-20220527090005-2.png

UDP Server

We can get one of the LoRaWAN packet and analyze it. See below

image-20220527090050-3.png

Analyze the data

From above screen shot, we can see most of the meaning except this "data":"QHxqASaAygwCXrumS1oFsgRq". This is the AES128 encryption data we mention above, it is base64 format. To decode this data, we need to have the APP Session Key and Network Session Key of this end node. If we have these two keys, we are able to decode this packet by some LoRaWAN decode website like: LoRaWAN Decode Website.

Below is an example, from

 

image-20220527090122-4.png

Decode the packet

3. Difference between OTAA and ABP mode

There are two mode for End Node:

  • OTAA: Over the air activation. In this mode, the end node will send a Join Request to server, server will reply with a Join Accept and the end node will parse this Join Accept message to get the Dev Addr / APP Session Key(AppSkey / Network Session Key(NwkSKey). Because the AppSkey and NwkSkey is dynamic, OTAA mode provide more security.
  • ABP: Activation by personalization. There is no hand-shake with LoRaWAN server for activition. The end node will use fix Dev Addr / APP Session Key(AppSkey / Network Session Key(NwkSKey) to upload the packet. So the packet can be decode if someone know these fix keys

4. Get and decode the packet

According to above, it is possible to get the payload from sensor without LoRaWAN server:

  • Setting the end node to ABP mode

5. Use an unencrypt firmware

If user doesn't care about the security of the data and use Dragino end node, it is possible that we provide a firmware without AES128 encrytion, so the server no need to decode packet. Please note this software is no LoRaWAN compatible and no security.

The software will disable encryption, so the LoRaWAN payload raw "data":"QHxqASaAygwCXrumS1oFsgRq" will looks like "data":"4068370126000000000c9e11223361898841", and the meaning is as below:

image-20220527090341-5.png

Unencrypt packet

Note: In some device's firmware . There is a AT Command to Disable Encryption. See below:

  • AT+DECRYPT=1     The payload is uploaded without encryption
  • AT+DECRYPT=0     Encrypt when uploading payload (default)

6. limitation

  • None standard LoRaWAN protocol, it is not compatible with LoRaWAN server.
  • No device management / ADR management defined in LoRaWAN protocol
  • No security.
  • No Downlink
  • Only use for ABP

 

Tags:
    
Copyright ©2010-2022 Dragino Technology Co., LTD. All rights reserved
Dragino Wiki v2.0