Low Earth Orbit (LEO) satellites have emerged as a space-based infrastructure to offer networking services anywhere on Earth. Satellite IoTs enable novel Direct-to-Satellite (DtS) connectivity, allowing IoT devices in remote areas to connect to the Internet via LEO satellites using existing terrestrial technologies like LoRa. This paper presents the first-of-its-kind measurement study on satellite IoTs, investigating the practical characteristics of DtS communications and their suitability for IoT applications. We deployed 27 low-cost ground stations across eight locations worldwide to passively measure the network availability of multiple constellations. Our findings reveal a significant gap between the effective durations of DtS connectivity and their theoretical durations, leading to intermittent connections for satellite IoTs. Additionally, we examine the performance of the Tianqi constellation in supporting real-world IoT traffic (agriculture application). We observed longer delays and higher power consumption in satellite IoTs compared to terrestrial IoTs. Our study identifies the bottlenecks and sheds light on potential optimizations for satellite IoTs.

This paper addresses the interference challenges, aiming to improve spatial reuse and optimize spectrum efficiency in LPWANs. We reveal that existing strategies such as interference cancellation and MIMO are ill-suited to the low-cost low-rate characteristics of LPWANs. Our work introduces a novel framework, HydraNet, which leverages the capture effect of LPWAN radios to enable robust concurrent transmissions. HydraNet exempts from strict clock synchronization or accurate channel estimation as required by conventional spatial reuse strategies for interference nulling. We conduct in-depth studies with LoRa radios to uncover their underlying packet reception mechanisms and for the first time characterize their unique capture effect. Based on the new findings, we devise novel strategies to jointly control the timing and power of concurrent LPWAN transmissions. These strategies ensure sufficient power differences between packets and interference at their intended receivers. We prototype HydraNet and integrate with operational LoRaWANs and comprehensively evaluate its performance. Results show that HydraNet achieves higher spectrum utilization with up to 3.6 × throughput improvements over the state-of-the-art.

LoRa technology promises to enable Internet of Things applications over large geographical areas. However, its performance is often hampered by poor channel quality in urban environments, where blockage and multipath effects are prevalent. Our study uncovers that a slight shift in the position or attitude of the receiving antenna can substantially improve the received signal quality. This phenomenon can be attributed to the rich multipath characteristics of wireless signal propagation in urban environments, wherein even small antenna movement can alter the dominant signal path or reduce the polarization angular difference between transceivers. Leveraging these key observations, we propose and implement MoLoRa, an intelligent mobile antenna system designed to enhance LoRa packet reception. At its core, MoLoRa represents the position and attitude of an antenna as a state and employs a statistical optimization method to search for states that offer optimal signal quality efficiently. Through extensive evaluation, we demonstrate that MoLoRa achieves a maximum Signal-to-Noise Ratio (SNR) gain of 13 dB in a few attempts, enabling formerly problematic blind spots to reconnect and strengthening links for other nodes.

Unlike traditional data collection applications which primarily rely on uplink transmissions, emerging applications (e.g., device actuation, firmware update, packet reception acknowledgment) increasingly demand robust downlink transmission capabilities. Current LoRaWAN systems struggle to support these applications due to the inherent asymmetry between downlink and uplink capabilities. While uplink transmissions can handle multiple packets simultaneously, downlink transmissions are restricted to a single logical channel at a time, significantly limiting the deployment of applications that require substantial downlink capacity. To address this challenge,FDLoRaintroduces an innovative in-band full-duplex LoRa gateway design, featuring novel solutions to mitigate self-interference (i.e., the strong downlink interference to ultra-weak uplink reception). This approach enables full-spectrum in-band downlink transmissions without compromising the reception of weak uplink packets. Building on the capabilities of full-duplex gateways,FDLoRapresents a new downlink framework that supports concurrent downlink transmissions across multiple logical channels of available gateways. Evaluation results show thatFDLoRaenhances downlink capacity by 5.7× compared to LoRaWAN in a three-gateway testbed and achieves 2.58× higher downlink concurrency per gateway than the current leading solutions.

LoRa is a promising technology that provides widespread low-power IoT connectivity. With its capabilities for multi-channel communication, orthogonal transmission, and spectrum sharing, LoRaWAN is poised to connect millions of IoT devices across thousands of logical channels. However, current LoRa gateways rely on hardwired Rx chains that cover less than 1% of these channels, restricting the potential for large-scale LoRa communications. This paper introduces XGate, a groundbreaking gateway design that uses a single Rx chain to simultaneously receive packets from all logical channels, enabling scalable LoRa transmission and flexible network access. Unlike the hardwired Rx chains in existing gateway designs, XGate dynamically allocates resources, including software-controlled Rx chains and demodulators, based on the extracted meta-information of incoming packets. XGate overcomes several challenges to efficiently detect incoming packets without prior knowledge of their parameter configurations. Evaluations demonstrate that XGate enhances LoRa concurrent transmissions by$8.4\times $compared to state-of-the-art solutions.

LoRa is a promising technology that offers ubiquitous low-power IoT connectivity. With the features of multi-channel communication, orthogonal transmission, and spectrum sharing, LoRaWAN is poised to connect millions of IoT devices across thousands of logical channels. However, current LoRa gateways utilize hardwired Rx chains that cover only a small fraction (<1%) of the logical channels, limiting the potential for massive LoRa communications. This paper presents XGate, a novel gateway design that uses a single Rx chain to concurrently receive packets from all logical channels, fundamentally enabling scalable LoRa transmission and flexible network access. Unlike hardwired Rx chains in the current gateway design, XGate allocates resources including software-controlled Rx chains and demodulators based on the extracted meta information of incoming packets. XGate addresses a series of challenges to efficiently detect incoming packets without prior knowledge of their parameter configurations. Evaluations show that XGate boosts LoRa concurrent transmissions by 8.4× than state-of-the-art.

Unlike traditional data collection applications (e.g., environment monitoring) that are dominated by uplink transmissions, the newly emerging applications (e.g., device actuation, firmware update, packet reception acknowledgement) also pose ever-increasing demands on downlink transmission capabilities. However, current LoRaWAN falls short in supporting such applications primarily due to downlink-uplink asymmetry. While the uplink can concurrently receive multiple packets, downlink transmission is limited to a single logical channel at a time, which fundamentally hinders the deployment of downlink-hungry applications. To tackle this practical challenge, FDLoRa develops the first-of-its-kind in-band full-duplex LoRa gateway design with novel solutions to mitigate the impact of self-interference (i.e., strong downlink interference to ultra-weak uplink reception), which unleashes the full spectrum for in-band downlink transmissions without compromising the reception of weak uplink packets. Built upon the full-duplex gateways, FDLoRa introduces a new downlink framework to support concurrent downlink transmissions over multiple logical channels of available gateways. Evaluation results demonstrate that FDLoRa boosts downlink capacity by 5.7x compared to LoRaWAN on a three-gateway testbed and achieves 2.58x higher downlink concurrency per gateway than the state-of-the-art.

This paper presents our design and implementation of a fast and accurate data aggregation strategy for LoRa networks namedOne-shot. To facilitate data aggregation, One-shot assigns distinctive chirps for different LoRa nodes to encode individual data. One-shot coordinates the nodes to concurrently transmit encoded packets. Receiving concurrent transmissions, One-shot gateway examines the frequencies of superimposed chirp signals and computes application-defined aggregate functions (e.g., sum, max, count, ), which give a quick overview of sensor data in a large monitoring area. One-shot develops techniques to handle a series of practical challenges involved in frequency and time synchronization of concurrent chirps. We evaluate the effectiveness of One-shot with extensive experiments. Results show that One-shot substantially outperforms state-of-the-art data aggregation methods in terms of aggregation accuracy as well as query efficiency.

This paper presents the design and implementation of HyLink which aims to fill the gap between limited link capacity of LoRa and the diverse bandwidth requirements of IoT systems. At the heart of HyLink is a novel technique named parallel Chirp Spread Spectrum modulation, which tunes the number of modulated symbols to adapt bit-rates according to channel conditions. Over strong link connections, HyLink fully exploits the link capability to transmit more symbols and thus transforms good channel SNRs to high link throughput. While for weak links, it conservatively modulates one symbol and concentrates all transmit power onto the symbol to combat poor channels, which can achieve the same performance as legacy LoRa. HyLink addresses a series of technical challenges on encoding and decoding of multiple payloads in a single packet, aiming at amortizing communication overheads in terms of channel access, radio-on power, transmission air-time, etc. We perform extensive experiments to evaluate the effectiveness of HyLink. Evaluations show that HyLink produces up to$10\times $higher bit rates than LoRa when channel SNRs are higher than$\mathrm {5 dB}$. HyLink inter-operates with legacy LoRa devices and can support new emerging traffic-intensive IoT applications.

This paper presents our design and implementation of a fast and accurate data aggregation strategy for LoRa networks named One-shot. To facilitate data aggregation, One-shot assigns distinctive chirps for different LoRa nodes to encode individual data. One-shot coordinates the nodes to concurrently transmit encoded packets. Receiving concurrent transmissions, One-shot gateway examines the frequencies of superimposed chirp signals and computes application-defined aggregate functions (e.g., sum, max, count, etc.), which give a quick overview of sensor data in a large monitoring area. One-shot develops techniques to handle a series of practical challenges involved in frequency and time synchronization of concurrent chirps. We evaluate the effectiveness of One-shot with extensive experiments. Results show that One-shot substantially outperforms state-of-the-art data aggregation methods in terms of aggregation accuracy as well as query efficiency.

LoRaWAN suffers dramatic performance degradation over a long communication range due to signal attenuation and blockages. To ensure reliable data transfer, LoRaWAN adopts retransmission mechanism where an unacknowledged packet is retransmitted multiple times in the hope of successfully delivering the packet at least once over harsh wireless channels. This retransmission mechanism is ill-suited for LoRa: 1) unsuccessful retransmissions lead to high power consumption for battery-powered LoRa nodes, and 2) a retransmission at another time does not necessarily improve the signal strength over harsh wireless channels.

This paper describes our design and implementation of a covert channel over LoRa physical layer (PHY). LoRa adopts a unique modulation scheme (chirp spread spectrum (CSS)) to enable long range communication at low-power consumption. CSS uses the initial frequencies of LoRa chirps to differentiate LoRa symbols, while simply ignoring other RF parameters (e.g., amplitude and phase). Our study reveals that the LoRa physical layer leaves sufficient room to build a covert channel by embedding covert information with a modulation scheme orthogonal to CSS. To demonstrate the feasibility of building a covert channel, we implementCloakLoRa.CloakLoRaembeds covert information into a regular LoRa packet by modulating the amplitudes of LoRa chirps while keeping the frequency intact. As amplitude modulation is orthogonal to CSS, a regular LoRa node receives the LoRa packet as if no secret information is embedded into the packet. Such an embedding method is transparent to all security mechanisms at upper layers in current LoRaWAN. As such, an attacker can create an amplitude modulated covert channel over LoRa without being detected by current LoRaWAN security mechanism. We conduct comprehensive evaluations with COTS LoRa nodes and receive-only software defined radios and experiment results show thatCloakLoRacan send covert information over 250 m.

LoRa technology promises to connect billions of battery-powered devices over a long range for years. However, recent studies and industrial deployment find that LoRa suffers severe signal attenuation because of signal blockage in smart cities and long communication ranges in smart agriculture applications. As a result, weak LoRa packets cannot be correctly demodulated or even be detected in practice. To address this problem, this paper presents the design and implementation of MALoRa: a new LoRa reception scheme which aims to improve LoRa reception performance with antenna diversities. At a high level, MALoRa improves signal strength by reliably detecting and coherently combining weak signals received by multiple antennas of a gateway. MALoRa addresses a series of practical challenges, including reliable packet detection, symbol edge extraction, and phase-aligned constructive combining of weak signals. Moreover, MALoRa can also be applied to mobile devices. Experiment results show that MALoRa can effectively expand communication range, increase battery life of LoRa devices, and improve packet detection and demodulation performance especially in ultra-low SNR scenarios.

LoRaWAN forms a one-hop star topology where LoRa nodes send data via one-hop uplink transmission to a LoRa gateway. If the LoRa gateway can be jammed by attackers, it may not be able to receive any data from any nodes in the network. Our empirical study shows that although the LoRa physical layer (PHY) is robust and resilient by design, it is still vulnerable to synchronized jamming chirps. Potential protection solutions (e.g., collision recovery, parallel decoding) may fail to extract LoRa packets if an attacker transmits synchronized jamming chirps at higher power. To protect the LoRa PHY from such attacks, we propose a new protection method that can separate LoRa chirps from jamming chirps by leveraging their difference in power domain. We note that the new protection solution is orthogonal to existing solutions that leverage the chirp misalignment in the time domain or the frequency disparity in the frequency domain. We conduct experiments with COTS LoRa nodes and software-defined radios with varied experiment settings such as different spreading factors, bandwidths, and code rates. Results show that synchronized jamming chirps at high power can jam all previous solutions, whereas our protection solution can effectively protect LoRa gateways from the jamming attacks.

LoRa technology promises to connect billions of battery-powered devices over a long range for years. However, recent studies and industrial deployment find that LoRa suffers severe signal attenuation because of signal blockage in smart cities and long communication ranges in smart agriculture applications. As a result, weak LoRa packets cannot be correctly demodulated or even be detected in practice. To address this problem, this paper presents the design and implementation of MALoRa: a new LoRa reception scheme which aims to improve LoRa reception performance with antenna diversities. At a high level, MALoRa improves signal strength by reliably detecting and coherently combining weak signals received by multiple antennas of a gateway. MALoRa addresses a series of practical challenges, including reliable packet detection, symbol edge extraction, and phase-aligned constructive combining of weak signals. Experiment results show that MALoRa can effectively expand communication range, increase battery life of LoRa devices, and improve packet detection and demodulation performance especially in ultra-low SNR scenarios.

This paper presents the design and implementation of HyLink which aims to fill the gap between limited link capacity of LoRa and the diverse bandwidth requirements of IoT systems. At the heart of HyLink is a novel technique named parallel Chirp Spread Spectrum modulation, which tunes the number of modulated symbols to adapt bit-rates according to channel conditions. Over strong link connections, HyLink fully exploits the link capability to transmit more symbols and thus transforms good channel SNRs to high link throughput. While for weak links, it conservatively modulates one symbol and concentrates all transmit power onto the symbol to combat poor channels, which can achieve the same performance as legacy LoRa. HyLink addresses a series of technical challenges on encoding and decoding of multiple payloads in a single packet, aiming at amortizing communication overheads in terms of channel access, radio-on power, transmission air-time, etc. We perform extensive experiments to evaluate the effectiveness of HyLink. Evaluations show that HyLink produces up to 10× higher bit rates than LoRa when channel SNRs are higher than 5 dB. HyLink inter-operates with legacy LoRa devices and can support new emerging traffic-intensive IoT applications.

This article presents the design and implementation of PCube, a phase-based parallel packet decoder for concurrent transmissions of LoRa nodes. The key enabling technology behind PCube is a novel air-channel phase measurement technique that is able to extract phase differences of air-channels between LoRa nodes and multiple antennas of a gateway. PCube leverages the reception diversities of multiple receiving antennas of a gateway and scales the concurrent transmissions of a large number of LoRa nodes, even exceeding the number of receiving antennas at a gateway. As a phase-based parallel decoder, PCube provides a new dimension to resolve collisions and supports more concurrent transmissions by complementing time and frequency-based parallel decoders. PCube is implemented and evaluated with synchronized software defined radios and off-the-shelf LoRa nodes in both indoors and outdoors. Results demonstrate that PCube can substantially outperform state-of-the-art works in terms of aggregated throughput by 4.9× and the number of concurrent nodes by up to 5×. More importantly, PCube scales well with the number of receiving antennas of a gateway, which is promising to break the barrier of concurrent transmissions.

LoRaWAN forms a one-hop star topology where LoRa nodes send data via one-hop up-link transmission to a LoRa gateway. If the LoRa gateway can be jammed by attackers, the LoRa gateway may not be able to receive any data from any nodes in the network. Our empirical study shows that although LoRa physical layer (PHY) is robust and resilient by design, it is still vulnerable to synchronized jamming chirps. Potential protection solutions (e.g., collision recovery, parallel decoding) may fail to extract LoRa packets if an attacker transmits synchronized jamming chirps at high power. To protect the LoRa PHY from such attacks, we propose a new protection method that can separate LoRa chirps from jamming chirps by leveraging their difference in the received signal strength in power domain. We note that the new protection solution is orthogonal to existing solutions which leverage the chirp misalignment in time domain or the frequency disparity in frequency domain. We conduct experiments with COTS LoRa nodes and software defined radios. The results show that synchronized jamming chirps at high power can jam all previous solutions, while our protection solution can effectively protect LoRa gateways from the jamming attacks.

This paper presents the design and implementation of PCube, a phase-based parallel packet decoder for concurrent transmissions of LoRa nodes. The key enabling technology behind PCube is a novel air-channel phase measurement technique which is able to extract phase differences of air-channels between LoRa nodes and multiple antennas of a gateway. PCube leverages the reception diversities of multiple receiving antennas of a gateway and scales the concurrent transmissions of a large number of LoRa nodes, even exceeding the number of receiving antennas at a gateway. As a phase-based parallel decoder, PCube provides a new dimension to resolve collisions and supports more concurrent transmissions by complementing time and frequency based parallel decoders. PCube is implemented and evaluated with synchronized software defined radios and off-the-shelf LoRa nodes in both indoors and outdoors. Results demonstrate that PCube can substantially outperform state-of-the-art works in terms of aggregated throughput by 4.9× and the number of concurrent nodes by up to 5×. More importantly, PCube scales well with the number of receiving antennas of a gateway, which is promising to break the barrier of concurrent transmissions.

This paper describes our design and implementation of a covert channel over LoRa physical layer (PHY). LoRa adopts a unique modulation scheme (chirp spread spectrum (CSS)) to enable long range communication at low-power consumption. CSS uses the initial frequencies of LoRa chirps to differentiate LoRa symbols, while simply ignoring other RF parameters (e.g., amplitude and phase). Our study reveals that the LoRa physical layer leaves sufficient room to build a covert channel by embedding covert information with a modulation scheme orthogonal to CSS. To demonstrate the feasibility of building a covert channel, we implement CloakLoRa. CloakLoRa embeds covert information into a regular LoRa packet by modulating the amplitudes of LoRa chirps while keeping the frequency intact. As amplitude modulation is orthogonal to CSS, a regular LoRa node receives the LoRa packet as if no secret information is embedded into the packet. Such an embedding method is transparent to all security mechanisms at upper layers in current LoRaWAN. As such, an attacker can create an amplitude modulated covert channel over LoRa without being detected by current LoRaWAN security mechanism. We conduct comprehensive evaluations with COTS LoRa nodes and receive-only software defined radios and experiment results show that CloakLoRa can send covert information over 250m.