Block 1 · 12:00–12:50 · From LoRa Radio to a Secure LoRaWAN Network
CHAPTER 7
LoRaWAN, TTN, Gateways, Tracking,
and Private-Cloud Integration
- distinguish LoRa modulation, LoRa peer-to-peer, LoRaWAN, The Things Network, and Meshtastic;
- explain the history, star-of-stars architecture, protocol roles, security separation, and packet flow of LoRaWAN;
- select a legal regional frequency plan and explain why one radio configuration cannot be deployed unchanged worldwide;
- compare OTAA and ABP activation and protect device identifiers, root keys, session keys, and frame counters;
- explain Classes A, B, and C, Adaptive Data Rate, confirmed traffic, receive windows, roaming, and downlink constraints;
- specify, build, place, register, monitor, and maintain a multi-channel LoRaWAN gateway, including a Raspberry Pi-based gateway;
- register and join an end device and gateway to The Things Stack/The Things Network;
- design compact versioned payloads, decoders, MQTT/webhook integrations, and a resilient private-cloud bridge;
- evaluate commercial sensors, GPS trackers, gateways, coverage claims, price ranges, battery life, and total deployment cost; and
- test coverage, capacity, provenance, security, outage recovery, and field maintainability using defensible evidence.
7.1 A Short History of LoRaWAN
The radio technology associated with LoRa originated with Cycleo in France and became part of Semtech after its acquisition in 2012. The LoRa Alliance began operating in 2015 as an open, nonprofit industry association to standardize and promote low-power wide-area networking.
Embedded Linux – Fall 2026
Early LoRaWAN specifications appeared in 2015, followed by revisions improving interoperability, security, device behavior, and deployment support [48, 49, 50].
The Things Network (TTN) developed as a community effort to build open LoRaWAN coverage, while The Things Industries developed the The Things Stack software and commercial services. Today, LoRaWAN can be deployed as a community network, a commercial managed network, or a private network under an organization’s control.
Historical dates help explain the ecosystem, but a deployment must be based on the exact LoRaWAN version, Regional Parameters revision, network-server version, and device certification/profile in use. “LoRaWAN compatible” is not sufficiently precise for procurement or integration.
7.2 LoRaWAN Architecture and Packet Flow
LoRaWAN commonly uses a star-of-stars architecture. End devices transmit radio frames without selecting one gateway. Every compatible gateway that receives the uplink forwards it over an IP backhaul. The network server validates network-layer information, deduplicates copies, manages radio/network behavior, and routes application data. The application server handles application-layer payload protection and delivery. A join server participates in activation and key derivation in architectures that separate that role.

Gateways are usually transparent packet forwarders rather than application interpreters. Receiving the same uplink through multiple gateways improves diversity and gives the network server multiple metadata observations. It also means that gateway count is not packet count; deduplication is essential.
| Role | Primary responsibility |
|---|---|
| End device | Senses or acts, prepares LoRaWAN frames, follows class/region/MAC behavior, and protects assigned secrets |
| Gateway | Forwards radio packets and metadata over IP; authentication and encryption depend on the selected forwarding protocol |
| Network server | Validates network frames, rejects replays, deduplicates gateway copies, manages MAC commands, data rate, and downlink scheduling |
| Join server | Holds activation-related root-key context and supports session-key derivation according to protocol architecture |
| Application server | Decrypts/interprets application payload context and provides integrations to authorized applications |
| Application/bridge | Validates decoded data, maps identity, stores/forwards events, applies business logic, and exposes observability |
| Identity/access service | Authenticates users/components and controls permitted resources and operations |
Implementations may combine roles in one deployment, but combining software does not erase logical trust boundaries. Prefer authenticated, encrypted forwarding such as correctly configured LoRa Basics Station; the legacy Semtech UDP packet forwarder does not itself provide equivalent transport protection.
7.3 LoRaWAN Frame Concepts
A gateway forwards the received LoRaWAN physical payload together with radio metadata such as frequency, data rate, RSSI, and SNR. Those metadata are not all fields transmitted inside the LoRaWAN frame. At the network layer, fields include a message header and, for data frames, device address, frame control, frame counter, optional frame options, an optional port and encrypted frame payload when present, and integrity protection. Exact security processing depends on LoRaWAN version.
The FPort field distinguishes payload use: port 0 carries MAC commands; ports 1–223 are available for application payloads, subject to any adopted application-package reservations. Device address DevAddr is a session/network address, not a permanent globally meaningful asset ID. Frame counters support replay protection and ordering. Resetting counters incorrectly can cause a network server to reject otherwise valid frames.
LoRaWAN limits usable application payload according to regional parameters and data rate. The correct response is compact, versioned encoding rather than assuming Internet-sized messages. Fragmentation and bulk transfer are possible only with additional complexity and are not the natural strength of LPWAN.
7.4 Regional Frequency Plans
LoRaWAN operates in regionally regulated spectrum. Frequency ranges, channel plans, data rates, maximum radiated power, duty cycle or dwell time, listen-before-talk rules, and gateway requirements differ. Select the network server’s exact frequency plan and matching hardware before deployment.
Table 7.2. High-level examples of LoRaWAN regional parameter families. These are orientation ranges, not a substitute for the current Regional Parameters document or national law.
| Plan family | Indicative spectrum | Example geography | Important planning issue |
|---|---|---|---|
| EU868 | Primarily 863–870 MHz | European countries including Denmark | Sub-band power/duty rules and network channel plan; verify current ETSI/national requirements |
| EU433 | Around 433 MHz | Permitted European use cases | Different antennas, channels, and restrictions; less commonly selected for many deployments |
| US915 | 902–928 MHz | United States | Large channel set, sub-band/channel-mask behavior, dwell/power rules |
| AU915 | 915–928 MHz | Australia and related deployments | Similar-looking hardware is not sufficient; select the correct regional channel plan |
| AS923 variants | Around 923 MHz with country-specific variants | Parts of Asia-Pacific and other adopted jurisdictions | Variant, channel offset, power, dwell time, and local adoption must match country |
| IN865 | Approximately 865–867 MHz | India | Region-specific channels and power behavior |
| KR920 | Approximately 920–923 MHz | South Korea | Local channel and access requirements |
| CN470 | Approximately 470–510 MHz | China | Different hardware/front end and large regional channel plan |
| RU864 | Approximately 864–870 MHz | Russian regional plan | Confirm present legal and network support before deployment |
For this course in Denmark, EU868 is the expected starting plan unless the instructor specifies otherwise. A 915 MHz-only gateway or antenna is not interchangeable with an EU868 installation. The authoritative sources are the current LoRa Alliance Regional Parameters specification, applicable national regulation, and network-operator policy [51].
7.5 Fair Use, Duty Cycle, and Network Capacity
Legal radio limits and network-provider fair-use policies are separate. A private network can remove a community provider’s usage policy, but it cannot remove government spectrum rules or physics.
The TTN/The Things Stack Sandbox duty-cycle documentation, checked on 8 September 2026, states a Fair Use Policy of 30 seconds of uplink airtime and 10 downlink messages per end device per 24 hours (including acknowledgements) [52]. Students must recheck the current policy before deployment because service terms can change.
Duty-cycle usage is based on airtime, not message count. Long payloads, high spreading factors, confirmed uplinks, join retries, MAC commands, and repeated downlinks consume capacity. A fleet that transmits synchronously after midnight or after power restoration can collide even when each node individually appears modest.
Gateways have more severe downlink constraints than many newcomers expect. While transmitting, a common gateway radio chain cannot simultaneously receive on that chain; a long downlink can therefore block reception of many uplinks. Network scheduling, regional restrictions, and Class A receive windows further limit delivery. Design LoRaWAN as uplink-oriented and keep downlinks rare, short, and purposeful.
7.6 Device Activation and Identifiers
Over-the-Air Activation (OTAA) performs a join exchange and derives session context. It supports cleaner session renewal and is generally preferred. Activation by Personalization (ABP) installs session parameters directly and can be useful in controlled cases, but counter persistence, key lifecycle, and reprovisioning are easier to get wrong.
Common identifiers and secrets include:
| Item | Purpose | Handling principle |
|---|---|---|
| DevEUI | Globally unique end-device identifier | Normally not secret; must be correct and unique |
| JoinEUI | Identifies the join-server context; called AppEUI in older versions | Normally not secret; multiple devices can share the same JoinEUI |
| AppKey | Root key used in activation context | Secret; unique per device wherever feasible; never publish |
| NwkKey | Additional root-key role in LoRaWAN 1.1 architectures | Secret; version-specific handling |
| DevAddr | Session/network device address | Not stable asset identity and not normally secret |
| Session keys | Protect network and application session traffic | Secret; derived or provisioned according to activation/version |
| Frame counters | Support replay protection and ordering | Must be handled correctly across reset and session lifecycle |
In OTAA, the device transmits a join request and accepts a valid join response. The network and join components establish session state. A joined device is not guaranteed continuous coverage; joining proves only that a particular exchange succeeded.
Provisioning should preserve a secure mapping between physical asset label, hardware revision, DevEUI, application, profile, owner, installation location, firmware, root-key custody, and decommission state. Avoid copying one device’s credentials into a fleet image.
7.7 Security and Key Separation
LoRaWAN uses AES-128-based cryptographic mechanisms and separates network-layer and application-layer security roles according to protocol version. The security model is stronger than sending plaintext peer-to-peer frames, but operational security still depends on unique keys, protected storage, correct counters, authentic firmware, secure backend connections, access control, and revocation.
Important rules are:
- never place root or session keys in public source code, screenshots, reports, decoder scripts, or topic names;
- avoid fleet-wide shared root keys;
- protect manufacturing and enrollment systems;
- restrict TTN console and API rights by role;
- authenticate gateway and integration connections;
- rotate integration credentials and revoke lost devices;
- validate downlink commands at the application and actuator boundary; and
- maintain recovery when keys, administrators, or cloud services are unavailable.
Radio encryption does not protect data after it has been decoded and exported through MQTT, webhook, database, dashboard, or CSV. End-to-end privacy and authorization continue through the complete data lifecycle.
7.8 Device Classes and Receive Behavior
All LoRaWAN end devices implement Class A. Class B and Class C add receive opportunities at energy and infrastructure cost.
| Class | Receive behavior | Engineering implication |
|---|---|---|
| A | Opens RX1 after uplink and RX2 if no valid intended downlink was received in RX1 | Lowest-power mandatory class; server downlink waits for an uplink opportunity |
| B | Adds synchronized scheduled ping slots | More predictable downlink opportunities; requires timing/beacon support and more energy |
| C | Listens almost continuously except while transmitting | Low downlink latency but high power; normally mains-powered or energy-rich devices |
A Class A device that reports every hour may wait nearly an hour before the network gets a receive opportunity. Sending unnecessary uplinks solely to poll for commands consumes capacity and battery. Safety-critical immediate control should not depend on best-effort LoRaWAN downlink.

Figure 7.3.