We are planning to connect several thousands of door opening and other home security sensors to a public LoRaWAN network country-wide, but our concern is, that in theory our public LoRaWAN network provider can decode the devices' messages. We may apply ABP activation (Activation By Personalization) so that we don't share the AppSKey with the public service provider, but it would result in a very complicated provisioning procedure. Is there any way to set up end-to-end security with ThingPark network server even in case of Over The Air Activation?
Add a comment
|
1 Answer
Actually even in OTA (using Join) the LoRaWAN spec separates the network session key (used by the network server to verify checksums and potentially de-ambiguate colliding short DevAddr addresses into their unique devEUIs), and the payload encrypting session key (AppSKey). It is one of its key innovations compared to other MAC layers like 802.15.4.
The trick is to use a HSM (hardware security module) which will have access to the device's root key (AppKey), and derive the NwkSKey and AppSkey (joining process). The HSM will pass the NwkSkey to the network server in clear, and will pass the AppSkey encrypted (using a key encryption key previously shared with the application server). The network server therefore has no access to the payload information, is passes the payload as-is (encrypted by device at the source), together with the encrypted AppSkey, to the Application Server. The AS first decrypts the AppSkey, then the payload using AppSkey.
A common misconception is that the HSM must be at the end customer premises. It is not the case, HSMs are designed to be secure in a hostile environment, i.e. the HSM in the cloud will not reveal its keys unless a pair of smart cards are presented to it, and any attempt to get into the hardware will destroy the keys. Therefore you can use hosted HSMs, as long as the smart cards are kept by trusted party.
This secure framework is available on your ThingPark platform, either locally by taking the HSM option, or by using the separate ThingPark Activation platform (https://www.actility.com/iot-device-activation/), which acts as a secure join server and can be used in combination with any network server which supports the standard LoRaWAN back-end interface.
You can use these solutions either with AppKeys provisioned by your device vendor into the ThingPark platform HSM, or using preconfigured Secure elements for your devices. The ThingPark HSM hosts secure key derivation sostware from leading SE vendors, which can access the AppKey directly from the SE serial number, so there is no need to provision any key in the HSM.
Once the device root key is provisioned in ThingPark Activation Platform, it can never be accessed, you can only transfer it's ownership by means of a one-time activation token (provided, the first time, as part of the standard LoRaWAN QR code on recent LoRaWAN devices).
