-
Notifications
You must be signed in to change notification settings - Fork 5
/
rfc8376.txt
2411 lines (1667 loc) · 99.2 KB
/
rfc8376.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
Internet Engineering Task Force (IETF) S. Farrell, Ed.
Request for Comments: 8376 Trinity College Dublin
Category: Informational May 2018
ISSN: 2070-1721
Low-Power Wide Area Network (LPWAN) Overview
Abstract
Low-Power Wide Area Networks (LPWANs) are wireless technologies with
characteristics such as large coverage areas, low bandwidth, possibly
very small packet and application-layer data sizes, and long battery
life operation. This memo is an informational overview of the set of
LPWAN technologies being considered in the IETF and of the gaps that
exist between the needs of those technologies and the goal of running
IP in LPWANs.
Status of This Memo
This document is not an Internet Standards Track specification; it is
published for informational purposes.
This document is a product of the Internet Engineering Task Force
(IETF). It represents the consensus of the IETF community. It has
received public review and has been approved for publication by the
Internet Engineering Steering Group (IESG). Not all documents
approved by the IESG are candidates for any level of Internet
Standard; see Section 2 of RFC 7841.
Information about the current status of this document, any errata,
and how to provide feedback on it may be obtained at
https://www.rfc-editor.org/info/rfc8376.
Copyright Notice
Copyright (c) 2018 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents
(https://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License.
Farrell Informational [Page 1]
RFC 8376 LPWAN Overview May 2018
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2
2. LPWAN Technologies . . . . . . . . . . . . . . . . . . . . . 3
2.1. LoRaWAN . . . . . . . . . . . . . . . . . . . . . . . . . 4
2.1.1. Provenance and Documents . . . . . . . . . . . . . . 4
2.1.2. Characteristics . . . . . . . . . . . . . . . . . . . 4
2.2. Narrowband IoT (NB-IoT) . . . . . . . . . . . . . . . . . 10
2.2.1. Provenance and Documents . . . . . . . . . . . . . . 10
2.2.2. Characteristics . . . . . . . . . . . . . . . . . . . 11
2.3. Sigfox . . . . . . . . . . . . . . . . . . . . . . . . . 15
2.3.1. Provenance and Documents . . . . . . . . . . . . . . 15
2.3.2. Characteristics . . . . . . . . . . . . . . . . . . . 16
2.4. Wi-SUN Alliance Field Area Network (FAN) . . . . . . . . 20
2.4.1. Provenance and Documents . . . . . . . . . . . . . . 20
2.4.2. Characteristics . . . . . . . . . . . . . . . . . . . 21
3. Generic Terminology . . . . . . . . . . . . . . . . . . . . . 24
4. Gap Analysis . . . . . . . . . . . . . . . . . . . . . . . . 26
4.1. Naive Application of IPv6 . . . . . . . . . . . . . . . . 26
4.2. 6LoWPAN . . . . . . . . . . . . . . . . . . . . . . . . . 26
4.2.1. Header Compression . . . . . . . . . . . . . . . . . 27
4.2.2. Address Autoconfiguration . . . . . . . . . . . . . . 27
4.2.3. Fragmentation . . . . . . . . . . . . . . . . . . . . 27
4.2.4. Neighbor Discovery . . . . . . . . . . . . . . . . . 28
4.3. 6lo . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
4.4. 6tisch . . . . . . . . . . . . . . . . . . . . . . . . . 29
4.5. RoHC . . . . . . . . . . . . . . . . . . . . . . . . . . 29
4.6. ROLL . . . . . . . . . . . . . . . . . . . . . . . . . . 30
4.7. CoAP . . . . . . . . . . . . . . . . . . . . . . . . . . 30
4.8. Mobility . . . . . . . . . . . . . . . . . . . . . . . . 31
4.9. DNS and LPWAN . . . . . . . . . . . . . . . . . . . . . . 31
5. Security Considerations . . . . . . . . . . . . . . . . . . . 31
6. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 32
7. Informative References . . . . . . . . . . . . . . . . . . . 32
Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . . 39
Contributors . . . . . . . . . . . . . . . . . . . . . . . . . . 40
Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 43
1. Introduction
This document provides background material and an overview of the
technologies being considered in the IETF's IPv6 over Low Power Wide-
Area Networks (LPWAN) Working Group (WG). It also provides a gap
analysis between the needs of these technologies and currently
available IETF specifications.
Farrell Informational [Page 2]
RFC 8376 LPWAN Overview May 2018
Most technologies in this space aim for a similar goal of supporting
large numbers of very low-cost, low-throughput devices with very low
power consumption, so that even battery-powered devices can be
deployed for years. LPWAN devices also tend to be constrained in
their use of bandwidth, for example, with limited frequencies being
allowed to be used within limited duty cycles (usually expressed as a
percentage of time per hour that the device is allowed to transmit).
As the name implies, coverage of large areas is also a common goal.
So, by and large, the different technologies aim for deployment in
very similar circumstances.
While all constrained networks must balance power consumption /
battery life, cost, and bandwidth, LPWANs prioritize power and cost
benefits by accepting severe bandwidth and duty cycle constraints
when making the required trade-offs. This prioritization is made in
order to get the multiple-kilometer radio links implied by "Wide
Area" in LPWAN's name.
Existing pilot deployments have shown huge potential and created much
industrial interest in these technologies. At the time of writing,
essentially no LPWAN end devices (other than for Wi-SUN) have IP
capabilities. Connecting LPWANs to the Internet would provide
significant benefits to these networks in terms of interoperability,
application deployment, and management (among others). The goal of
the LPWAN WG is to, where necessary, adapt IETF-defined protocols,
addressing schemes, and naming conventions to this particular
constrained environment.
This document is largely the work of the people listed in the
Contributors section.
2. LPWAN Technologies
This section provides an overview of the set of LPWAN technologies
that are being considered in the LPWAN WG. The text for each was
mainly contributed by proponents of each technology.
Note that this text is not intended to be normative in any sense; it
simply exists to help the reader in finding the relevant Layer 2 (L2)
specifications and in understanding how those integrate with IETF-
defined technologies. Similarly, there is no attempt here to set out
the pros and cons of the relevant technologies.
Farrell Informational [Page 3]
RFC 8376 LPWAN Overview May 2018
2.1. LoRaWAN
2.1.1. Provenance and Documents
LoRaWAN is a wireless technology based on Industrial, Scientific, and
Medical (ISM) that is used for long-range low-power low-data-rate
applications developed by the LoRa Alliance, a membership consortium
<https://www.lora-alliance.org/>. This document is based on Version
1.0.2 of the LoRa specification [LoRaSpec]. That specification is
publicly available and has already seen several deployments across
the globe.
2.1.2. Characteristics
LoRaWAN aims to support end devices operating on a single battery for
an extended period of time (e.g., 10 years or more), extended
coverage through 155 dB maximum coupling loss, and reliable and
efficient file download (as needed for remote software/firmware
upgrade).
LoRaWAN networks are typically organized in a star-of-stars topology
in which Gateways relay messages between end devices and a central
"network server" in the backend. Gateways are connected to the
network server via IP links while end devices use single-hop LoRaWAN
communication that can be received at one or more Gateways.
Communication is generally bidirectional; uplink communication from
end devices to the network server is favored in terms of overall
bandwidth availability.
Figure 1 shows the entities involved in a LoRaWAN network.
+----------+
|End Device| * * *
+----------+ * +---------+
* | Gateway +---+
+----------+ * +---------+ | +---------+
|End Device| * * * +---+ Network +--- Application
+----------+ * | | Server |
* +---------+ | +---------+
+----------+ * | Gateway +---+
|End Device| * * * * +---------+
+----------+
Key: * LoRaWAN Radio
+---+ IP connectivity
Figure 1: LoRaWAN Architecture
Farrell Informational [Page 4]
RFC 8376 LPWAN Overview May 2018
o End Device: a LoRa client device, sometimes called a "mote".
Communicates with Gateways.
o Gateway: a radio on the infrastructure side, sometimes called a
"concentrator" or "base station". Communicates with end devices
and, via IP, with a network server.
o Network Server: The Network Server (NS) terminates the LoRaWAN
Medium Access Control (MAC) layer for the end devices connected to
the network. It is the center of the star topology.
o Join Server: The Join Server (JS) is a server on the Internet side
of an NS that processes join requests from an end devices.
o Uplink message: refers to communications from an end device to a
network server or application via one or more Gateways.
o Downlink message: refers to communications from a network server
or application via one Gateway to a single end device or a group
of end devices (considering multicasting).
o Application: refers to application-layer code both on the end
device and running "behind" the NS. For LoRaWAN, there will
generally only be one application running on most end devices.
Interfaces between the NS and the application are not further
described here.
In LoRaWAN networks, end device transmissions may be received at
multiple Gateways, so, during nominal operation, a network server may
see multiple instances of the same uplink message from an end device.
The LoRaWAN network infrastructure manages the data rate and Radio
Frequency (RF) output power for each end device individually by means
of an Adaptive Data Rate (ADR) scheme. End devices may transmit on
any channel allowed by local regulation at any time.
LoRaWAN radios make use of ISM bands, for example, 433 MHz and 868
MHz within the European Union and 915 MHz in the Americas.
The end device changes channels in a pseudorandom fashion for every
transmission to help make the system more robust to interference and/
or to conform to local regulations.
Farrell Informational [Page 5]
RFC 8376 LPWAN Overview May 2018
Figure 2 shows that after a transmission slot, a Class A device turns
on its receiver for two short receive windows that are offset from
the end of the transmission window. End devices can only transmit a
subsequent uplink frame after the end of the associated receive
windows. When a device joins a LoRaWAN network, there are similar
timeouts on parts of that process.
|----------------------------| |--------| |--------|
| Tx | | Rx | | Rx |
|----------------------------| |--------| |--------|
|---------|
Rx delay 1
|------------------------|
Rx delay 2
Figure 2: LoRaWAN Class A Transmission and Reception Window
Given the different regional requirements, the detailed specification
for the LoRaWAN Physical layer (PHY) (taking up more than 30 pages of
the specification) is not reproduced here. Instead, and mainly to
illustrate the kinds of issue encountered, Table 1 presents some of
the default settings for one ISM band (without fully explaining those
here); Table 2 describes maxima and minima for some parameters of
interest to those defining ways to use IETF protocols over the
LoRaWAN MAC layer.
+-----------------------+-------------------------------------------+
| Parameters | Default Value |
+-----------------------+-------------------------------------------+
| Rx delay 1 | 1 s |
| | |
| Rx delay 2 | 2 s (must be RECEIVE_DELAY1 + 1 s) |
| | |
| join delay 1 | 5 s |
| | |
| join delay 2 | 6 s |
| | |
| 868MHz Default | 3 (868.1,868.2,868.3), data rate: 0.3-50 |
| channels | kbit/s |
+-----------------------+-------------------------------------------+
Table 1: Default Settings for EU 868 MHz Band
Farrell Informational [Page 6]
RFC 8376 LPWAN Overview May 2018
+------------------------------------------------+--------+---------+
| Parameter/Notes | Min | Max |
+------------------------------------------------+--------+---------+
| Duty Cycle: some but not all ISM bands impose | 1% | no |
| a limit in terms of how often an end device | | limit |
| can transmit. In some cases, LoRaWAN is more | | |
| restrictive in an attempt to avoid congestion. | | |
| | | |
| EU 868 MHz band data rate/frame size | 250 | 50000 |
| | bits/s | bits/s |
| | : 59 | : 250 |
| | octets | octets |
| | | |
| US 915 MHz band data rate/frame size | 980 | 21900 |
| | bits/s | bits/s |
| | : 19 | : 250 |
| | octets | octets |
+------------------------------------------------+--------+---------+
Table 2: Minima and Maxima for Various LoRaWAN Parameters
Note that, in the case of the smallest frame size (19 octets), 8
octets are required for LoRa MAC layer headers, leaving only 11
octets for payload (including MAC layer options). However, those
settings do not apply for the join procedure -- end devices are
required to use a channel and data rate that can send the 23-byte
Join-Request message for the join procedure.
Uplink and downlink higher-layer data is carried in a MACPayload.
There is a concept of "ports" (an optional 8-bit value) to handle
different applications on an end device. Port zero is reserved for
LoRaWAN-specific messaging, such as the configuration of the end
device's network parameters (available channels, data rates, ADR
parameters, Rx Delay 1 and 2, etc.).
In addition to carrying higher-layer PDUs, there are Join-Request and
Join-Response (aka Join-Accept) messages for handling network access.
And so-called "MAC commands" (see below) up to 15 bytes long can be
piggybacked in an options field ("FOpts").
There are a number of MAC commands for link and device status
checking, ADR and duty cycle negotiation, and managing the RX windows
and radio channel settings. For example, the link check response
message allows the NS (in response to a request from an end device)
to inform an end device about the signal attenuation seen most
recently at a Gateway and to tell the end device how many Gateways
received the corresponding link request MAC command.
Farrell Informational [Page 7]
RFC 8376 LPWAN Overview May 2018
Some MAC commands are initiated by the network server. For example,
one command allows the network server to ask an end device to reduce
its duty cycle to only use a proportion of the maximum allowed in a
region. Another allows the network server to query the end device's
power status with the response from the end device specifying whether
it has an external power source or is battery powered (in which case,
a relative battery level is also sent to the network server).
In order to operate nominally on a LoRaWAN network, a device needs a
32-bit device address, which is assigned when the device "joins" the
network (see below for the join procedure) or that is pre-provisioned
into the device. In case of roaming devices, the device address is
assigned based on the 24-bit network identifier (NetID) that is
allocated to the network by the LoRa Alliance. Non-roaming devices
can be assigned device addresses by the network without relying on a
NetID assigned by the LoRa Alliance.
End devices are assumed to work with one or quite a limited number of
applications, identified by a 64-bit AppEUI, which is assumed to be a
registered IEEE EUI64 value [EUI64]. In addition, a device needs to
have two symmetric session keys, one for protecting network artifacts
(port=0), the NwkSKey, and another for protecting application-layer
traffic, the AppSKey. Both keys are used for 128-bit AES
cryptographic operations. So, one option is for an end device to
have all of the above plus channel information, somehow
(pre-)provisioned; in that case, the end device can simply start
transmitting. This is achievable in many cases via out-of-band means
given the nature of LoRaWAN networks. Table 3 summarizes these
values.
+---------+---------------------------------------------------------+
| Value | Description |
+---------+---------------------------------------------------------+
| DevAddr | DevAddr (32 bits) = device-specific network address |
| | generated from the NetID |
| | |
| AppEUI | IEEE EUI64 value corresponding to the join server for |
| | an application |
| | |
| NwkSKey | 128-bit network session key used with AES-CMAC |
| | |
| AppSKey | 128-bit application session key used with AES-CTR |
| | |
| AppKey | 128-bit application session key used with AES-ECB |
+---------+---------------------------------------------------------+
Table 3: Values Required for Nominal Operation
Farrell Informational [Page 8]
RFC 8376 LPWAN Overview May 2018
As an alternative, end devices can use the LoRaWAN join procedure
with a join server behind the NS in order to set up some of these
values and dynamically gain access to the network. To use the join
procedure, an end device must still know the AppEUI and a different
(long-term) symmetric key that is bound to the AppEUI (this is the
application key (AppKey), and it is distinct from the application
session key (AppSKey)). The AppKey is required to be specific to the
device; that is, each end device should have a different AppKey
value. Finally, the end device also needs a long-term identifier for
itself, which is syntactically also an EUI-64 and is known as the
device EUI or DevEUI. Table 4 summarizes these values.
+---------+----------------------------------------------------+
| Value | Description |
+---------+----------------------------------------------------+
| DevEUI | IEEE EUI64 naming the device |
| | |
| AppEUI | IEEE EUI64 naming the application |
| | |
| AppKey | 128-bit long-term application key for use with AES |
+---------+----------------------------------------------------+
Table 4: Values Required for Join Procedure
The join procedure involves a special exchange where the end device
asserts the AppEUI and DevEUI (integrity protected with the long-term
AppKey, but not encrypted) in a Join-Request uplink message. This is
then routed to the network server, which interacts with an entity
that knows that AppKey to verify the Join-Request. If all is going
well, a Join-Accept downlink message is returned from the network
server to the end device. That message specifies the 24-bit NetID,
32-bit DevAddr, and channel information and from which the AppSKey
and NwkSKey can be derived based on knowledge of the AppKey. This
provides the end device with all the values listed in Table 3.
All payloads are encrypted and have data integrity. MAC commands,
when sent as a payload (port zero), are therefore protected.
However, MAC commands piggybacked as frame options ("FOpts") are sent
in clear. Any MAC commands sent as frame options and not only as
payload, are visible to a passive attacker, but they are not
malleable for an active attacker due to the use of the Message
Integrity Check (MIC) described below.
For LoRaWAN version 1.0.x, the NwkSKey session key is used to provide
data integrity between the end device and the network server. The
AppSKey is used to provide data confidentiality between the end
device and network server, or to the application "behind" the network
server, depending on the implementation of the network.
Farrell Informational [Page 9]
RFC 8376 LPWAN Overview May 2018
All MAC-layer messages have an outer 32-bit MIC calculated using AES-
CMAC with the input being the ciphertext payload and other headers
and using the NwkSkey. Payloads are encrypted using AES-128, with a
counter-mode derived from [IEEE.802.15.4] using the AppSKey.
Gateways are not expected to be provided with the AppSKey or NwkSKey,
all of the infrastructure-side cryptography happens in (or "behind")
the network server. When session keys are derived from the AppKey as
a result of the join procedure, the Join-Accept message payload is
specially handled.
The long-term AppKey is directly used to protect the Join-Accept
message content, but the function used is not an AES-encrypt
operation, but rather an AES-decrypt operation. The justification is
that this means that the end device only needs to implement the AES-
encrypt operation. (The counter-mode variant used for payload
decryption means the end device doesn't need an AES-decrypt
primitive.)
The Join-Accept plaintext is always less than 16 bytes long, so
Electronic Code Book (ECB) mode is used for protecting Join-Accept
messages. The Join-Accept message contains an AppNonce (a 24-bit
value) that is recovered on the end device along with the other Join-
Accept content (e.g., DevAddr) using the AES-encrypt operation. Once
the Join-Accept payload is available to the end device, the session
keys are derived from the AppKey, AppNonce, and other values, again
using an ECB mode AES-encrypt operation, with the plaintext input
being a maximum of 16 octets.
2.2. Narrowband IoT (NB-IoT)
2.2.1. Provenance and Documents
Narrowband Internet of Things (NB-IoT) has been developed and
standardized by 3GPP. The standardization of NB-IoT was finalized
with 3GPP Release 13 in June 2016, and further enhancements for
NB-IoT are specified in 3GPP Release 14 in 2017 (for example, in the
form of multicast support). Further features and improvements will
be developed in the following releases, but NB-IoT has been ready to
be deployed since 2016; it is rather simple to deploy, especially in
the existing LTE networks with a software upgrade in the operator's
base stations. For more information of what has been specified for
NB-IoT, 3GPP specification 36.300 [TGPP36300] provides an overview
and overall description of the Evolved Universal Terrestrial Radio
Access Network (E-UTRAN) radio interface protocol architecture, while
specifications 36.321 [TGPP36321], 36.322 [TGPP36322], 36.323
[TGPP36323], and 36.331 [TGPP36331] give more detailed descriptions
Farrell Informational [Page 10]
RFC 8376 LPWAN Overview May 2018
of MAC, Radio Link Control (RLC), Packet Data Convergence Protocol
(PDCP), and Radio Resource Control (RRC) protocol layers,
respectively. Note that the description below assumes familiarity
with numerous 3GPP terms.
For a general overview of NB-IoT, see [nbiot-ov].
2.2.2. Characteristics
Specific targets for NB-IoT include: module cost that is Less than US
$5, extended coverage of 164 dB maximum coupling loss, battery life
of over 10 years, ~55000 devices per cell, and uplink reporting
latency of less than 10 seconds.
NB-IoT supports Half Duplex Frequency Division Duplex (FDD) operation
mode with 60 kbit/s peak rate in uplink and 30 kbit/s peak rate in
downlink, and a Maximum Transmission Unit (MTU) size of 1600 bytes,
limited by PDCP layer (see Figure 4 for the protocol structure),
which is the highest layer in the user plane, as explained later.
Any packet size up to the said MTU size can be passed to the NB-IoT
stack from higher layers, segmentation of the packet is performed in
the RLC layer, which can segment the data to transmission blocks with
a size as small as 16 bits. As the name suggests, NB-IoT uses
narrowbands with bandwidth of 180 kHz in both downlink and uplink.
The multiple access scheme used in the downlink is Orthogonal
Frequency-Division Multiplex (OFDMA) with 15 kHz sub-carrier spacing.
In uplink, Sub-Carrier Frequency-Division Multiplex (SC-FDMA) single
tone with either 15kHz or 3.75 kHz tone spacing is used, or
optionally multi-tone SC-FDMA can be used with 15 kHz tone spacing.
NB-IoT can be deployed in three ways. In-band deployment means that
the narrowband is deployed inside the LTE band and radio resources
are flexibly shared between NB-IoT and normal LTE carrier. In Guard-
band deployment, the narrowband uses the unused resource blocks
between two adjacent LTE carriers. Standalone deployment is also
supported, where the narrowband can be located alone in dedicated
spectrum, which makes it possible, for example, to reframe a GSM
carrier at 850/900 MHz for NB-IoT. All three deployment modes are
used in licensed frequency bands. The maximum transmission power is
either 20 or 23 dBm for uplink transmissions, while for downlink
transmission the eNodeB may use higher transmission power, up to 46
dBm depending on the deployment.
A Maximum Coupling Loss (MCL) target for NB-IoT coverage enhancements
defined by 3GPP is 164 dB. With this MCL, the performance of NB-IoT
in downlink varies between 200 bps and 2-3 kbit/s, depending on the
deployment mode. Stand-alone operation may achieve the highest data
Farrell Informational [Page 11]
RFC 8376 LPWAN Overview May 2018
rates, up to a few kbit/s, while in-band and guard-band operations
may reach several hundreds of bps. NB-IoT may even operate with an
MCL higher than 170 dB with very low bit rates.
For signaling optimization, two options are introduced in addition to
the legacy LTE RRC connection setup; mandatory Data-over-NAS (Control
Plane optimization, solution 2 in [TGPP23720]) and optional RRC
Suspend/Resume (User Plane optimization, solution 18 in [TGPP23720]).
In the control-plane optimization, the data is sent over Non-Access
Stratum (NAS), directly to/from the Mobile Management Entity (MME)
(see Figure 3 for the network architecture) in the core network to
the User Equipment (UE) without interaction from the base station.
This means there is no Access Stratum security or header compression
provided by the PDCP layer in the eNodeB, as the Access Stratum is
bypassed, and only limited RRC procedures. Header compression based
on Robust Header Compression (RoHC) may still optionally be provided
and terminated in the MME.
The RRC Suspend/Resume procedures reduce the signaling overhead
required for UE state transition from RRC Idle to RRC Connected mode
compared to a legacy LTE operation in order to have quicker user-
plane transaction with the network and return to RRC Idle mode
faster.
In order to prolong device battery life, both Power-Saving Mode (PSM)
and extended DRX (eDRX) are available to NB-IoT. With eDRX, the RRC
Connected mode DRX cycle is up to 10.24 seconds; in RRC Idle, the
eDRX cycle can be up to 3 hours. In PSM, the device is in a deep
sleep state and only wakes up for uplink reporting. After the
reporting, there is a window (configured by the network) during which
the device receiver is open for downlink connectivity or for
periodical "keep-alive" signaling (PSM uses periodic TAU signaling
with additional reception windows for downlink reachability).
Since NB-IoT operates in a licensed spectrum, it has no channel
access restrictions allowing up to a 100% duty cycle.
3GPP access security is specified in [TGPP33203].
Farrell Informational [Page 12]
RFC 8376 LPWAN Overview May 2018
+--+
|UE| \ +------+ +------+
+--+ \ | MME |------| HSS |
\ / +------+ +------+
+--+ \+--------+ / |
|UE| ----| eNodeB |- |
+--+ /+--------+ \ |
/ \ +--------+
/ \| | +------+ Service Packet
+--+ / | S-GW |----| P-GW |---- Data Network (PDN)
|UE| | | +------+ e.g., Internet
+--+ +--------+
Figure 3: 3GPP Network Architecture
Figure 3 shows the 3GPP network architecture, which applies to
NB-IoT. The MME is responsible for handling the mobility of the UE.
The MME tasks include tracking and paging UEs, session management,
choosing the Serving Gateway for the UE during initial attachment and
authenticating the user. At the MME, the NAS signaling from the UE
is terminated.
The Serving Gateway (S-GW) routes and forwards the user data packets
through the access network and acts as a mobility anchor for UEs
during handover between base stations known as eNodeBs and also
during handovers between NB-IoT and other 3GPP technologies.
The Packet Data Network Gateway (P-GW) works as an interface between
the 3GPP network and external networks.
The Home Subscriber Server (HSS) contains user-related and
subscription-related information. It is a database that performs
mobility management, session-establishment support, user
authentication, and access authorization.
E-UTRAN consists of components of a single type, eNodeB. eNodeB is a
base station that controls the UEs in one or several cells.
The 3GPP radio protocol architecture is illustrated in Figure 4.
Farrell Informational [Page 13]
RFC 8376 LPWAN Overview May 2018
+---------+ +---------+
| NAS |----|-----------------------------|----| NAS |
+---------+ | +---------+---------+ | +---------+
| RRC |----|----| RRC | S1-AP |----|----| S1-AP |
+---------+ | +---------+---------+ | +---------+
| PDCP |----|----| PDCP | SCTP |----|----| SCTP |
+---------+ | +---------+---------+ | +---------+
| RLC |----|----| RLC | IP |----|----| IP |
+---------+ | +---------+---------+ | +---------+
| MAC |----|----| MAC | L2 |----|----| L2 |
+---------+ | +---------+---------+ | +---------+
| PHY |----|----| PHY | PHY |----|----| PHY |
+---------+ +---------+---------+ +---------+
LTE-Uu S1-MME
UE eNodeB MME
Figure 4: 3GPP Radio Protocol Architecture for the Control Plane
The radio protocol architecture of NB-IoT (and LTE) is separated into
the control plane and the user plane. The control plane consists of
protocols that control the radio-access bearers and the connection
between the UE and the network. The highest layer of control plane
is called the Non-Access Stratum (NAS), which conveys the radio
signaling between the UE and the Evolved Packet Core (EPC), passing
transparently through the radio network. The NAS is responsible for
authentication, security control, mobility management, and bearer
management.
The Access Stratum (AS) is the functional layer below the NAS; in the
control plane, it consists of the Radio Resource Control (RRC)
protocol [TGPP36331], which handles connection establishment and
release functions, broadcast of system information, radio-bearer
establishment, reconfiguration, and release. The RRC configures the
user and control planes according to the network status. There exist
two RRC states, RRC_Idle or RRC_Connected, and the RRC entity
controls the switching between these states. In RRC_Idle, the
network knows that the UE is present in the network, and the UE can
be reached in case of an incoming call/downlink data. In this state,
the UE monitors paging, performs cell measurements and cell
selection, and acquires system information. Also, the UE can receive
broadcast and multicast data, but it is not expected to transmit or
receive unicast data. In RRC_Connected state, the UE has a
connection to the eNodeB, the network knows the UE location on the
cell level, and the UE may receive and transmit unicast data. An RRC
connection is established when the UE is expected to be active in the
network, to transmit or receive data. The RRC connection is
released, switching back to RRC_Idle, when there is no more traffic;
this is in order to preserve UE battery life and radio resources.
Farrell Informational [Page 14]
RFC 8376 LPWAN Overview May 2018
However, as mentioned earlier, a new feature was introduced for
NB-IoT that allows data to be transmitted from the MME directly to
the UE and then transparently to the eNodeB, thus bypassing AS
functions.
The PDCP's [TGPP36323] main services in the control plane are
transfer of control-plane data, ciphering, and integrity protection.
The RLC protocol [TGPP36322] performs transfer of upper-layer PDUs
and, optionally, error correction with Automatic Repeat reQuest
(ARQ), concatenation, segmentation, and reassembly of RLC Service
Data Units (SDUs), in-sequence delivery of upper-layer PDUs,
duplicate detection, RLC SDU discarding, RLC-re-establishment, and
protocol error detection and recovery.
The MAC protocol [TGPP36321] provides mapping between logical
channels and transport channels, multiplexing of MAC SDUs, scheduling
information reporting, error correction with Hybrid ARQ (HARQ),
priority handling, and transport format selection.
The PHY [TGPP36201] provides data-transport services to higher
layers. These include error detection and indication to higher
layers, Forward Error Correction (FEC) encoding, HARQ soft-combining,
rate-matching, mapping of the transport channels onto physical
channels, power-weighting and modulation of physical channels,
frequency and time synchronization, and radio characteristics
measurements.
The user plane is responsible for transferring the user data through
the Access Stratum. It interfaces with IP and the highest layer of
the user plane is the PDCP, which, in the user plane, performs header
compression using RoHC, transfer of user-plane data between eNodeB
and the UE, ciphering, and integrity protection. Similar to the
control plane, lower layers in the user plane include RLC, MAC, and
the PHY performing the same tasks as they do in the control plane.
2.3. Sigfox
2.3.1. Provenance and Documents
The Sigfox LPWAN is in line with the terminology and specifications
being defined by ETSI [etsi_unb]. As of today, Sigfox's network has
been fully deployed in 12 countries, with ongoing deployments in 26
other countries, giving in total a geography of 2 million square
kilometers, containing 512 million people.
Farrell Informational [Page 15]
RFC 8376 LPWAN Overview May 2018
2.3.2. Characteristics
Sigfox LPWAN autonomous battery-operated devices send only a few
bytes per day, week, or month, in principle, allowing them to remain
on a single battery for up to 10-15 years. Hence, the system is
designed as to allow devices to last several years, sometimes even
buried underground.
Since the radio protocol is connectionless and optimized for uplink
communications, the capacity of a Sigfox base station depends on the
number of messages generated by devices, and not on the actual number
of devices. Likewise, the battery life of devices depends on the
number of messages generated by the device. Depending on the use
case, devices can vary from sending less than one message per device
per day to dozens of messages per device per day.
The coverage of the cell depends on the link budget and on the type
of deployment (urban, rural, etc.). The radio interface is compliant
with the following regulations:
Spectrum allocation in the USA [fcc_ref]
Spectrum allocation in Europe [etsi_ref1] [etsi_ref2]
Spectrum allocation in Japan [arib_ref]
The Sigfox radio interface is also compliant with the local
regulations of the following countries: Australia, Brazil, Canada,
Kenya, Lebanon, Mauritius, Mexico, New Zealand, Oman, Peru,
Singapore, South Africa, South Korea, and Thailand.
The radio interface is based on Ultra Narrow Band (UNB)
communications, which allow an increased transmission range by
spending a limited amount of energy at the device. Moreover, UNB
allows a large number of devices to coexist in a given cell without
significantly increasing the spectrum interference.
Both uplink and downlink are supported, although the system is
optimized for uplink communications. Due to spectrum optimizations,
different uplink and downlink frames and time synchronization methods
are needed.
The main radio characteristics of the UNB uplink transmission are:
o Channelization mask: 100 Hz / 600 Hz (depending on the region)
o Uplink baud rate: 100 baud / 600 baud (depending on the region)
Farrell Informational [Page 16]
RFC 8376 LPWAN Overview May 2018
o Modulation scheme: DBPSK
o Uplink transmission power: compliant with local regulation
o Link budget: 155 dB (or better)
o Central frequency accuracy: not relevant, provided there is no
significant frequency drift within an uplink packet transmission
For example, in Europe, the UNB uplink frequency band is limited to
868.00 to 868.60 MHz, with a maximum output power of 25 mW and a duty
cycle of 1%.
The format of the uplink frame is the following:
+--------+--------+--------+------------------+-------------+-----+
|Preamble| Frame | Dev ID | Payload |Msg Auth Code| FCS |
| | Sync | | | | |
+--------+--------+--------+------------------+-------------+-----+
Figure 5: Uplink Frame Format
The uplink frame is composed of the following fields:
o Preamble: 19 bits
o Frame sync and header: 29 bits
o Device ID: 32 bits
o Payload: 0-96 bits
o Authentication: 16-40 bits
o Frame check sequence: 16 bits (Cyclic Redundancy Check (CRC))
The main radio characteristics of the UNB downlink transmission are:
o Channelization mask: 1.5 kHz
o Downlink baud rate: 600 baud
o Modulation scheme: GFSK
o Downlink transmission power: 500 mW / 4W (depending on the region)
o Link budget: 153 dB (or better)
Farrell Informational [Page 17]
RFC 8376 LPWAN Overview May 2018
o Central frequency accuracy: the center frequency of downlink
transmission is set by the network according to the corresponding
uplink transmission.
For example, in Europe, the UNB downlink frequency band is limited to
869.40 to 869.65 MHz, with a maximum output power of 500 mW with 10%
duty cycle.
The format of the downlink frame is the following:
+------------+-----+---------+------------------+-------------+-----+
| Preamble |Frame| ECC | Payload |Msg Auth Code| FCS |
| |Sync | | | | |
+------------+-----+---------+------------------+-------------+-----+
Figure 6: Downlink Frame Format
The downlink frame is composed of the following fields:
o Preamble: 91 bits
o Frame sync and header: 13 bits
o Error Correcting Code (ECC): 32 bits
o Payload: 0-64 bits
o Authentication: 16 bits
o Frame check sequence: 8 bits (CRC)
The radio interface is optimized for uplink transmissions, which are
asynchronous. Downlink communications are achieved by devices
querying the network for available data.
A device willing to receive downlink messages opens a fixed window
for reception after sending an uplink transmission. The delay and
duration of this window have fixed values. The network transmits the
downlink message for a given device during the reception window, and
the network also selects the BS for transmitting the corresponding
downlink message.