[Paper Review] I Send, Therefore I Leak: Information Leakage in Low-Power Wide Area Networks

P. Leu, Ivan Puddu+2 more|arXiv (Cornell University)|Nov 24, 2019

IoT Networks and Protocols25 references5 citations

TL;DR

This paper reveals that event-driven communication in Low-Power Wide Area Networks (LPWANs), particularly LoRa, inherently leaks information about sensor events—such as car presence or equipment failure—due to the timing and pattern of transmissions, regardless of encryption. The authors demonstrate that preventing this leakage requires significant energy and communication overhead, making strong privacy protection in LPWANs fundamentally challenging under current power constraints.

ABSTRACT

Low-power wide area networks (LPWANs), such as LoRa, are fast emerging as the preferred networking technology for large-scale Internet of Things deployments (e.g., smart cities). Due to long communication range and ultra low power consumption, LPWAN-enabled sensors are today being deployed in a variety of application scenarios where sensitive information is wirelessly transmitted. In this work, we study the privacy guarantees of LPWANs, in particular LoRa. We show that, although the event-based duty cycling of radio communication, i.e., transmission of radio signals only when an event occurs, saves power, it inherently leaks information. This information leakage is independent of the implemented crypto primitives. We identify two types of information leakage and show that it is hard to completely prevent leakage without incurring significant additional communication and computation costs.

Motivation & Objective

• To investigate the privacy implications of event-driven communication in LPWANs, particularly LoRa, which is widely used in smart city and IoT applications.
• To analyze how the duty-cycling mechanism of LPWANs—transmitting only when events occur—leads to information leakage independent of cryptographic security.
• To evaluate the feasibility of privacy-enhancing techniques like dummy transmission and obfuscation in LPWANs under strict energy and bandwidth constraints.
• To demonstrate that preventing both statistical and existential leakage in LPWANs requires substantial increases in communication and energy consumption.

Proposed method

• The authors analyze the timing and pattern of LoRa transmissions in real-world sensor deployments to identify leakage of event occurrence.
• They model information leakage as a function of transmission timing and event frequency, distinguishing between statistical and existential leakage.
• They evaluate obfuscation techniques such as injecting dummy packets to mask real event timing, analyzing their impact on energy and bandwidth.
• They derive theoretical bounds on the communication cost of obfuscation, showing that protecting against leakage at multiple timescales multiplies the required background transmission rate.
• They use software-defined radio (SDR) experiments to validate that simple receivers can detect event patterns across city-wide deployments.

Experimental results

Research questions

• RQ1 To what extent does event-driven transmission in LPWANs leak information about sensor events, even with strong encryption?
• RQ2 How does the long communication range and one-hop topology of LPWANs amplify information leakage compared to traditional wireless networks?
• RQ3 What are the energy and communication costs of implementing obfuscation techniques to hide event timing in LPWANs?
• RQ4 Can existing privacy-preserving mechanisms like mix networks or dummy packet injection be adapted to LPWANs without violating power constraints?

Key findings

• Event-driven transmission in LoRa and other LPWANs inherently leaks information about the occurrence of events, such as a car parking or a sensor detecting a fault, regardless of the cryptographic primitives used.
• An attacker with a single SDR receiver can infer event patterns across a city by monitoring transmission timing, due to the long range and predictable duty-cycling of LPWAN devices.
• Obfuscation techniques that hide event timing by injecting dummy packets multiply the background transmission rate by the size of the anonymity set, leading to unacceptably high energy costs.
• Protecting against both statistical and existential leakage at multiple timescales increases the communication cost multiplicatively, making such protection infeasible under strict LPWAN power constraints.