I Send, Therefore I Leak: Information Leakage in Low-Power Wide Area Networks

TL;DR

This paper investigates how low-power wide area networks like LoRa, despite their power efficiency, inherently leak sensitive information through radio signals, posing privacy risks that are difficult to mitigate.

Contribution

The study reveals that LPWANs' event-based duty cycling leaks information independently of cryptographic measures, highlighting inherent privacy vulnerabilities.

Findings

Radio signal transmission leaks information regardless of encryption.

Leakage occurs due to duty cycling, not cryptographic weaknesses.

Complete prevention of leakage requires significant additional costs.

Abstract

Low-power wide area networks (LPWANs), such as LoRa, are fast emerging as the preferred networking technology for large-scale Internet of Things deployments (e.g., smart cities). Due to long communication range and ultra low power consumption, LPWAN-enabled sensors are today being deployed in a variety of application scenarios where sensitive information is wirelessly transmitted. In this work, we study the privacy guarantees of LPWANs, in particular LoRa. We show that, although the event-based duty cycling of radio communication, i.e., transmission of radio signals only when an event occurs, saves power, it inherently leaks information. This information leakage is independent of the implemented crypto primitives. We identify two types of information leakage and show that it is hard to completely prevent leakage without incurring significant additional communication and computation costs.