draft-ietf-lpwan-overview.xml

<?xml version="1.0"?>
<!DOCTYPE rfc SYSTEM "rfc2629.dtd" [
<!ENTITY I-D.farrell-lpwan-lora-overview SYSTEM "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.farrell-lpwan-lora-overview">
<!ENTITY I-D.minaburo-lpwan-gap-analysis SYSTEM "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.minaburo-lpwan-gap-analysis">
<!ENTITY I-D.zuniga-lpwan-sigfox-system-description SYSTEM "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.zuniga-lpwan-sigfox-system-description">
<!ENTITY I-D.ratilainen-lpwan-nb-iot SYSTEM "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.ratilainen-lpwan-nb-iot">
<!ENTITY I-D.garcia-dime-diameter-lorawan SYSTEM "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.garcia-dime-diameter-lorawan">
<!ENTITY I-D.garcia-radext-radius-lorawan SYSTEM "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.garcia-radext-radius-lorawan">
<!ENTITY I-D.hong-6lo-use-cases SYSTEM "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.hong-6lo-use-cases">


]>

<!--
	 TODO: Add some neutral use-case where there're real details available, if I can find one.
-->

<?rfc toc="yes"?>
<?rfc comments="yes"?>
<?rfc inline="yes" ?>
<rfc category="info" ipr="trust200902" docName="draft-ietf-lpwan-overview-10">
<front>
   <title abbrev="Low Power Wide Area Networking Overview">
     LPWAN Overview 
   </title>


<author role="editor" fullname="Stephen Farrell" initials="S." surname="Farrell">
<organization>Trinity College Dublin</organization>
<address>
<postal>
<street></street>
<city>Dublin</city>
<region></region>
<code>2</code>
<country>Ireland</country>
</postal>
<phone>+353-1-896-2354</phone>
<email>stephen.farrell@cs.tcd.ie</email>
</address>
</author>

   <date/>
   <area>Internet Area</area>
   <workgroup>lpwan</workgroup>
   <keyword>Draft</keyword>
   <abstract>

	  <t>Low Power Wide Area Networks (LPWAN) are wireless technologies
with 
characteristics such as large coverage areas, low bandwidth, possibly 
very small packet and
application layer data sizes and long battery life operation.  
This memo is an
informational overview of the set of LPWAN technologies being 
considered in the IETF and of the gaps that exist between the
needs of those technologies and the goal of running IP in LPWANs.
      </t>
   </abstract>
</front>

<middle>
   <section title="Introduction">

	<t>This document provides background material and an overview of
the technologies being considered in the IETF's Low Power Wide-Area
Networking (LPWAN) working group. We also provide a gap analysis
between the needs of these technologies and currently available 
IETF specifications.</t>

<!--
   </section>

	<section anchor="concerns" title="Common Concerns">

	<t>[[Editors note: We may want a section like this that describes some cross-cutting
issues, e.g. duty-cycles, some of the ISM band restrictions. This isn't intended
to be a problem statement nor a set of requirements but just to describe some 
issues that affect more than one of the LPWAN technologies.
Such a section might be better before or after <xref target="inputs"/>, will 
see when text's added there. There
is some text for this in the current "gaps" draft.]]</t>
-->


<!--
	<t>[[Maybe add text about the common/different goals, eg. NB-IoT has
"improved indoor coverage" which is different, all have "low power
consumption." If so, that'd start to look like <xref target="table-goals"/>.
It may make more sense to eliminate rows of this table that are all
"Y" entries and just say those are common goals in text or another
table.]] </t>

<texttable anchor="table-goals" title="Stated goals of LPWAN Technologies">
    <ttcol align='left'>Goal</ttcol>
    <ttcol align='center'>LoRa</ttcol>
    <ttcol align='center'>NB-IoT</ttcol>
    <ttcol align='center'>SIGFOX</ttcol>
    <ttcol align='center'>WI-SUN</ttcol>

	<c>Improved indoor coverage</c>
	<c>-</c>
	<c>Y</c>
	<c>-</c>
	<c>-</c>

	<c>Massive number of low-throughput devices</c>
	<c>Y</c>
	<c>Y</c>
	<c>Y</c>
	<c>-</c>

	<c>Low delay sensitivity</c>
	<c>Y</c>
	<c>Y</c>
	<c>Y</c>
	<c>-</c>

	<c>Ultra-Low device cost</c>
	<c>Y</c>
	<c>Y</c>
	<c>Y</c>
	<c>-</c>

	<c>Low device power consumption</c>
	<c>Y</c>
	<c>Y</c>
	<c>Y</c>
	<c>-</c>

</texttable>
-->


	<t>Most technologies in this space aim for similar goals of supporting
large numbers of very low-cost, low-throughput devices with
very-low power consumption, so that even battery-powered devices can be
deployed for years. LPWAN devices also tend to be constrained in their
use of bandwidth, for example with limited frequencies being allowed to
be used within limited duty-cycles (usually expressed as a percentage
of time per-hour that the device is allowed to transmit.) 
And as the name implies, coverage of large areas is also a
common goal.  So, by and large, the different technologies aim for deployment
in very similar circumstances.</t>

<!--
There are some differences however, e.g.,
the Narrowband IoT specifications <xref target="nbiot"/> also aim for
increased indoor coverage. 
-->

<t>What mainly distinguishes LPWANs from other constrained networks
is that in LPWANs the balancing act related to power consumption/battery life, cost and
bandwidth tends to prioritise doing better with respect to power and cost and we
are more willing to live with extremely low bandwidth and 
constrained duty-cycles when making the various trade-offs required, in
order to get the multiple-kilometre radio links implied by the "wide
area" aspect of the LPWAN term.</t>

<t> Existing pilot deployments have shown huge potential and created much
industrial interest in these technologies.  As of today, 
essentially no LPWAN end-devices (other than for Wi-SUN) have IP capabilities.
Connecting LPWANs to the Internet would provide significant benefits to these
networks in terms of interoperability, application deployment, and management,
among others.  The goal of the IETF LPWAN working group is to, where necessary, adapt 
IETF-defined protocols,
addressing schemes and naming to this particular constrained environment. 
</t>

	<t>This document is largely the work of the
people listed in <xref target="contribs"/>. </t> 

<!-- <t>Discussion of this
document should take place on the lp-wan@ietf.org list.</t>
-->

	</section>


	<section anchor="inputs" title="LPWAN Technologies">

	<t>This section provides an overview of the set of LPWAN technologies
that are being considered in the LPWAN working group. The text for
each was mainly contributed by proponents of each technology.</t>

<t>Note that this text is not intended to be normative in any sense, but
simply to help the reader in finding the relevant layer 2 specifications
and in understanding how those integrate with IETF-defined technologies.
Similarly, there is no attempt here to set out the pros and cons of the
relevant technologies. 
</t>

<t>Note that some of the technology-specific drafts referenced
below may have been updated since publication of this document.</t>

<!--
	<t>[[Ed: the goal here is 2-3 pages per technology. If
there's much more needed then we could add appendices I guess depending
on what text the WG find useful to include.]]</t>
-->

	<section anchor="lora" title="LoRaWAN">

<!--
	<t>Text here is largely from <xref target="I-D.farrell-lpwan-lora-overview"/>
</t>
-->

	  <section anchor="lora-docs" title="Provenance and Documents">

<!--
	  <t> LoRaWAN is a wireless technology for long-range low-power
low-data-rate applications developed by the LoRa Alliance, a membership
consortium.  <eref target="https://www.lora-alliance.org/"/> This draft is
based on version 1.0.2 <xref target="LoRaSpec"/> of the LoRa specification.
Version 1.0, which has also seen some deployment, is available at
<xref target="LoRaSpec1.0"/>.</t>
-->


<t>LoRaWAN is an ISM-based wireless technology for long-range low-power
low-data-rate applications developed by the LoRa Alliance, a membership
consortium.  <eref target="https://www.lora-alliance.org/"/> This draft is
based on version 1.0.2 <xref target="LoRaSpec"/> of the LoRa specification.
That specification is publicly available and has already seen several
deployments across the globe.</t>
	
	  </section>

	  <section anchor="lora-chars" title="Characteristics">

<t>
   LoRaWAN aims to support end-devices operating on a single battery for an 
   extended period of time (e.g., 10 years or more), extended coverage through 
   155 dB maximum coupling loss, and reliable and efficient file download (as 
   needed for remote software/firmware upgrade).
</t>

<t> LoRaWAN networks are typically organized in a star-of-stars topology in
which gateways relay messages between end-devices and a central "network
server" in the backend.  Gateways are connected to the network server via IP
links while end-devices use single-hop LoRaWAN communication that can be
received at one or more gateways.  Communication is generally
bi-directional; uplink communication from end-devices to the network
server is favored in terms of overall bandwidth availability.  </t>

	<t><xref target="lora-arch"/> shows the entities involved in a 
LoRaWAN network. </t>

<figure anchor="lora-arch" title="LoRaWAN architecture" >
<artwork><![CDATA[
+----------+ 
|End-device| * * * 
+----------+       *   +---------+ 
                     * | Gateway +---+ 
+----------+       *   +---------+   |   +---------+  
|End-device| * * *                   +---+ Network +--- Application
+----------+       *                 |   | Server  |   
                     * +---------+   |   +---------+   
+----------+       *   | Gateway +---+
|End-device| * * *   * +---------+    
+----------+         
    Key: *      LoRaWAN Radio 
         +---+  IP connectivity
  ]]></artwork>
</figure> 
	


<t><list style="symbols">

	<t>End-device: a LoRa client device, sometimes called a mote. Communicates with gateways.</t>

	<t>Gateway: a radio on the infrastructure-side, sometimes called a concentrator or base-station.
	Communicates with end-devices and, via IP, with a network server. </t>

	<t>Network Server: The Network Server (NS) terminates the LoRaWAN MAC layer
for the end-devices connected to the network. It is the center of the star
topology.
</t>

    <t>Join Server: The Join Server (JS) is a server on the Internet
side of an NS that processes join requests from an end-devices.</t>


	<t>Uplink message: refers to communications from an end-device to a network
server or application via one or more gateways. </t>

	<t>Downlink message: refers to communications from a network server or
application via one gateway to a single end-device or a group of end-devices
(considering multicasting). </t>

	<t>Application: refers to application layer code both on the end-device
and running "behind" the network server. For LoRaWAN, there will generally 
only be one application running on most end-devices. Interfaces between
the network server and application are not further described here.</t>

<!--
this isn't really useful here
<t>
Classes A, B and C define different device capabilities and modes
of operation for end-devices. End-devices can transmit uplink
messages at any time in any mode of operation (so long as e.g., ISM band
restrictions are honoured). An end-device in Class
A can only receive downlink messages at predetermined timeslots after
each uplink message transmission. Class B allows the end-device to
receive downlink messages at periodically scheduled timeslots. Class C
allows receipt of downlink messages at anytime. Class selection is
based on the end-devices' application use case and its power supply.
(While Classes B and C are not further described here, readers may have seen
those terms elsewhere so we include them for clarity.)
</t>
-->


</list></t>

<t>In LoRaWAN networks, end-device transmissions may be received at multiple
gateways, so during nominal operation a network server may see multiple
instances of the same uplink message from an end-device.</t>

<t>
The LoRaWAN network infrastructure manages the data rate and RF output power
for each end-device individually by means of an adaptive data rate (ADR)
scheme.  End-devices may transmit on any channel allowed by local regulation at
any time.  </t>

	<t>LoRaWAN radios make use of industrial, scientific and medical (ISM)
bands, for example, 433MHz and 868MHz within the European Union and 915MHz in
the Americas.</t>

	<t>The end-device changes channel in a pseudo-random fashion for every
transmission to help make the system more robust to interference and/or to
conform to local regulations.</t>

<!--
	<t>As with other LPWAN radio technologies, LoRaWAN end-devices respect the
frequency, power and maximum transmit duty cycle requirements for the sub-band
imposed by local regulators. In most cases, this means an end-device is only
transmitting for 1% of the time, as specified by ISM band regulations. And in
some cases the LoRaWAN specification calls for end-devices to transmit less
often than is called for by the ISM band regulations in order to avoid
congestion.  </t>
-->

      <t>
       <xref target="lora-trans"/> below shows that after a transmission slot a Class A device
turns on its receiver for two short receive windows that are offset from
the end of the transmission window. 

<!--
The frequencies and data rate chosen
for the first of these receive windows depends on those used for the transmit window.
The frequency and data-rate for the second receive window are configurable.
If a downlink message preamble is detected during a receive window, then
the end-device keeps the radio on in order to receive the frame.
</t>

<t>

-->
End-devices can only transmit a subsequent uplink frame after the end
of the associated receive windows. When a device joins a LoRaWAN
network, there are similar timeouts on parts of that process.
</t>


<figure anchor="lora-trans" title="LoRaWAN Class A transmission and reception window">
<artwork>
|----------------------------|         |--------|     |--------|
|             Tx             |         |   Rx   |     |   Rx   |
|----------------------------|         |--------|     |--------| 
                             |---------|         
                              Rx delay 1
                             |------------------------|
                              Rx delay 2             
</artwork>
</figure>

	<t>Given the different regional requirements the detailed specification for the
LoRaWAN physical layer (taking up more than 30 pages of
the specification) is not reproduced here.  Instead
and mainly to illustrate the kinds of issue encountered, in 
<xref target="lora-ism868"/> we present some of the default settings for one
ISM band (without fully explaining those here) and in <xref target="lora-minmax"/>
we describe maxima and
minima for some parameters of interest to those defining ways to use IETF
protocols over the LoRaWAN MAC layer.</t>

<texttable anchor="lora-ism868" title="Default settings for EU 868MHz band">
    <ttcol align='center'>Parameters</ttcol>
    <ttcol align='center'>Default Value</ttcol>

<c> Rx delay 1 </c>
<c> 1 s </c>

<c> Rx delay 2 </c>
<c> 2 s (must be RECEIVE_DELAY1 + 1s) </c>

<c> join delay 1 </c>
<c> 5 s </c>

<c> join delay 2 </c>
<c> 6 s </c>

<c>868MHz Default channels</c> 
<c>3 (868.1,868.2,868.3), 
data rate: 0.3-50kbps</c>

</texttable>

<texttable anchor="lora-minmax" title="Minima and Maxima for various LoRaWAN Parameters">
    <ttcol align='left'>Parameter/Notes</ttcol>
    <ttcol align='center'>Min</ttcol>
    <ttcol align='center'>Max</ttcol>
<c>Duty Cycle: some but not all ISM bands impose a limit in terms of how often an
end-device can transmit. In some cases LoRaWAN is more restrictive in an attempt to
avoid congestion.</c>
<c>1%</c>
<c>no-limit</c>
<c>EU 868MHz band data rate/frame-size</c>
<c>250 bits/s : 59 octets</c>
<c>50000 bits/s : 250 octets</c>

<c>US 915MHz band data rate/frame-size</c>
<c>980 bits/s : 19 octets </c>
<c>21900 bits/s : 250 octets </c>

</texttable>

<t>Note that in the case of the smallest frame size (19 octets), 
8 octets are required for LoRa MAC layer headers leaving only
11 octets for payload (including MAC layer options). However, those
settings do not apply for the join procedure - end-devices are
required to use a channel and data rate that can send the 23-byte Join-request
message for the join procedure.</t>

	<t>Uplink and downlink higher layer data is carried in a MACPayload.  There
is a concept of "ports" (an optional 8-bit value) to handle different
applications on an end-device. Port zero is reserved for LoRaWAN specific
messaging, such as the configuration of the end device's network parameters 
(available channels, data rates, ADR parameters, RX1/2 delay, etc.).</t> 

<!--
<t>The header also distinguishes the uplink/downlink
directions and whether or not an acknowledgement ("confirmation") is required
from the peer.</t>

	<t>All payloads are encrypted  
and ciphertexts are protected with a cryptographic
Message Integrity Check (MIC) 
- see <xref target="sec-cons"/> for details.</t>
-->

<t>In addition to carrying higher layer PDUs
there are Join-Request and Join-Response (aka Join-Accept) messages for handling 
network access. And so-called "MAC commands" (see below) up to 15 bytes long can be 
piggybacked in an options field ("FOpts").</t>

<!--

	<t>LoRaWAN end-devices can choose various different data rates from a menu
of available rates (dependent on the frequencies in use). It is however, 
recommended that end-devices set the Adaptive Data Rate ("ADR") bit
in the MAC layer which is a signal that the network should control the
data rate (via MAC commands to the end-device). 
The network can also assert the ADR bit and control data rates at it's
discretion.
The goal is to ensure
minimal on-time for radios whilst increasing throughput and reliability when possible.
Other things being equal, the effect should be that end-devices closer to a 
gateway can successfully use higher data rates, whereas end-devices
further from all gateways still receive connectivity though at a lower
data rate.
</t>

	<t>Data rate changes can be validated via a scheme of acks from
the network with a fall-back to lower rates in the event that 
downlink acks go missing.</t>

	<t>There are 16 (or 32) bit frame counters maintained in each direction
that are incremented on each transmission (but not re-transmissions)
that are not re-used for a given key. When the device supports a 32 bit counter, then
only the least significant 16 bits are sent in the MAC header, but
all 32 bits are used in cryptographic operations. (If an end-device
only supports a 16 bit counter internally, then the topmost 16 bits
are set to zero.)</t>
-->

	<t>There are a number of MAC commands for
	link and device status checking, ADR and duty-cycle negotiation,
managing the RX windows and radio channel settings. For example,
the link check response message allows the network server (in
response to a request from an end-device) to
inform an end-device about the signal attenuation seen most
recently at a gateway, and to also tell the end-device how
many gateways received the corresponding link request MAC
command.</t>

<t>Some MAC commands are initiated by the network server.
For example, one command allows the network server
to ask an end-device to reduce its duty-cycle to only
use a proportion of the maximum allowed in a region. 
Another allows the network server to query the
end-device's power status with the response from
the end-device specifying whether it has an external power 
source or is battery powered (in which case a relative
battery level is also sent to the network server).</t>
	
<!--
	<t>The network server can also inform an end-device
about channel assignments (mid-point frequencies and data
rates). Of course, these must also remain within the
bands assigned by local regulation.</t>
-->

<!--
	<t>A LoRaWAN network has a network identifier ("NwkID"), currently a
seven-bit value.  A private network (common for LoRaWAN) can use the value
zero or one. If a network wishes to support "foreign" end-devices then the NwkID needs
to be registered with the LoRA Alliance, in which case the NwkID is the seven
least significant bits of a registered 24-bit NetID. (Note however, that the
methods for "roaming" are defined in the upcoming LoRaWAN 1.1
specification.)</t>


	<t>In order to operate nominally on a LoRaWAN network, a device needs a 
32-bit device address, which is the concatenation of the NwkID and a
25-bit device-specific network address that is assigned when the
device "joins" the network (see below for the join procedure) or
that is pre-provisioned into the device.</t>
-->

<t>
In order to operate nominally on a LoRaWAN network, a device needs a
32-bit device address, that is assigned when the
device "joins" the network (see below for the join procedure) or that
is pre-provisioned into the device.  In case of roaming devices, the device address
is assigned based on the 24-bit network identifier (NetID) that is allocated to the network
by the LoRa Alliance. Non-roaming devices can be assigned device addresses
by the network without relying on a LoRa Alliance-assigned NetID.
</t>


	<t>End-devices are assumed to work with one or a quite limited 
number of applications, 
identified by a 64-bit AppEUI, which is assumed
to be a registered IEEE EUI64 value.
	In addition, a device needs to have two symmetric session
keys, one for protecting network artifacts (port=0), the NwkSKey,
and another for protecting application layer traffic, the 
AppSKey. Both keys are used for 128-bit AES cryptographic
operations. 
	So, one option is for an end-device to have all of the above,
plus channel information, 
somehow (pre-)provisioned, in which case the end-device can
simply start transmitting. This is achievable in many cases via
out-of-band means given the nature of LoRaWAN networks.
<xref target="table-nominal"/> summarizes these values.
</t>

<texttable anchor="table-nominal" title="Values required for nominal operation">
    <ttcol align='left'>Value</ttcol>
    <ttcol align='left'>Description</ttcol>
<c>DevAddr</c> <c>DevAddr (32-bits) =  device-specific network address generated from the NetID</c>
<c>AppEUI </c> <c> IEEE EUI64 corresponding to the join server for an application</c>
<c>NwkSKey </c> <c> 128-bit network session key used with AES-CMAC</c>
<c>AppSKey </c> <c> 128-bit application session key used with AES-CTR</c> 
<c>AppKey </c> <c> 128-bit application session key used with AES-ECB</c> 
</texttable>

	<t>As an alternative, end-devices can use the LoRaWAN
join procedure with a join server behind the NS in order to setup some
of these values and dynamically gain access to the network.
	To use the join procedure, an end-device must still
know the AppEUI, and 
	in addition, 
a different (long-term) symmetric key that
is bound to the AppEUI - this is the application key (AppKey),
and is distinct from the application session key (AppSKey). The
AppKey is required to be specific to the device, that is, 
each end-device should have a different AppKey value. And
finally, the end-device also needs a long-term identifier for
itself, syntactically also an EUI-64, and known as the 
device EUI or DevEUI. <xref target="table-join"/> summarizes
these values.</t> 

<texttable anchor="table-join" title="Values required for join procedure">
    <ttcol align='left'>Value</ttcol>
    <ttcol align='left'>Description</ttcol>
<c>DevEUI </c> <c> IEEE EUI64 naming the device</c>
<c>AppEUI </c> <c> IEEE EUI64 naming the application</c>
<c>AppKey </c> <c> 128-bit long term application key for use with AES</c> 
</texttable>

	<t>The join procedure involves a special exchange where
the end-device asserts the AppEUI and DevEUI (integrity 
protected with the long-term AppKey, but not encrypted) in a Join-request
uplink message. This 
is then routed to the network server which interacts with
an entity that knows that AppKey to verify the Join-request.
All going well, a Join-accept downlink message is returned
from the network server to the end-device that specifies the 24-bit NetID, 32-bit
DevAddr
and channel information and from which the AppSKey and
NwkSKey can be derived based on knowledge of the AppKey.
This provides the end-device with all the values listed
in <xref target="table-nominal"/>.</t>

<!--

	<t>There is some special handling related to which channels 
to use and for multiple transmissions for the join-request which
is intended to ensure a successful join in as many cases as
possible. Join-request and Join-accept messages also include
some random values (nonces) to both provide some replay 
protection and to help ensure the session keys are unique
per run of the join procedure. If a Join-request fails validation, then no Join-accept
message (indeed no message at all) is returned to the end-device.
For example, if an end-device is factory-reset then it should end up in a
state in which it can re-do the join procedure. </t>

	<t>In this section we describe the use of cryptography in LoRaWAN.
This section is not intended as a
full specification but to be sufficient so
that future IETF specifications can encompass the required
security considerations. The emphasis is on describing the
externally visible characteristics of LoRaWAN.</t>

-->

	<t>All payloads are encrypted and have data integrity. 
MAC commands, when sent as a payload (port zero), are therefore 
protected. MAC commands piggy-backed as frame options ("FOpts") are
however sent in clear.
	Any MAC commands sent as frame options and not
only as payload, are visible to a passive
attacker but are not malleable for an active attacker
due to the use of the Message Integrity Check (MIC)
described below.</t>

	<t>For LoRaWAN version 1.0.x, the NWkSkey session key is used
to provide data integrity between the end-device and the network
server. The AppSKey is used to provide data confidentiality between
the end-device and network server, or to the application "behind"
the network server, depending on the implementation of the 
network. </t>

	<t>All MAC layer messages have an outer 32-bit MIC
calculated using AES-CMAC calculated over the ciphertext payload and other
headers and using the NwkSkey.  Payloads are encrypted using AES-128, with a
counter-mode derived from IEEE 802.15.4 using the AppSKey.  Gateways are not
expected to be provided with the AppSKey or NwkSKey, all of the
infrastructure-side cryptography happens in (or "behind") the network server.
When session keys are derived from the AppKey as a result of the join procedure
the Join-accept message payload is specially handled.</t> 

<t>The long-term AppKey is directly used to protect the Join-accept message
content, but the function used is not an AES-encrypt operation, but rather an
AES-decrypt operation. The justification is that this means that the end-device
only needs to implement the AES-encrypt operation. (The counter mode variant
used for payload decryption means the end-device doesn't need an AES-decrypt
primitive.)</t>

	<t>The Join-accept plaintext is always less than 16 bytes long, so
electronic code book (ECB) mode is used for protecting Join-accept
messages. The Join-accept contains an AppNonce (a 
24 bit value) that is recovered on the end-device along
with the other Join-accept content (e.g. DevAddr) using
the AES-encrypt operation.
	Once the Join-accept payload is available to
the end-device the session keys are derived from the
AppKey, AppNonce and other values, again using an
ECB mode AES-encrypt operation, with
the plaintext input being a maximum of 16 octets.</t>


	  </section>

	</section>

	<section anchor="nbiot" title="Narrowband IoT (NB-IoT)">

<!--
	<t>Text here is largely from <xref target="I-D.ratilainen-lpwan-nb-iot"/></t>
-->

	  <section anchor="nbiot-docs" title="Provenance and Documents">


      <t>Narrowband Internet of Things (NB-IoT) is developed and standardized
by 3GPP.  The standardization of NB-IoT was finalized with 3GPP Release 13 in
June 2016, and further enhancements for NB-IoT are specified in 3GPP Release
14 in 2017, for example in the form of multicast support. Further
features and improvements will be developed in the following releases, but
NB-IoT has been ready to be deployed since 2016, and is rather simple to
deploy especially in the existing LTE networks with a software upgrade in the
operator’s base stations. For more information of what has been specified for
NB-IoT, 3GPP specification 36.300 <xref target="TGPP36300"></xref> provides an
overview and overall description of the E-UTRAN radio interface protocol
architecture, while specifications 36.321 <xref target="TGPP36321"></xref>,
36.322 <xref target="TGPP36322"></xref>, 36.323 <xref
target="TGPP36323"></xref> and 36.331 <xref target="TGPP36331"></xref> give
more detailed description of MAC, Radio Link Control (RLC), 
Packet Data Convergence 
Protocol (PDCP) and Radio Resource Control (RRC) protocol layers,
respectively. Note that the description below assumes familiarity with
numerous 3GPP terms.</t>

<t>For a general overview of NB-IoT, see <xref target="nbiot-ov"/>.</t>

	  </section>

	  <section anchor="nbiot-chars" title="Characteristics">

<t>
Specific targets for NB-IoT include: Less than US$5 module cost, extended
coverage of 164 dB maximum coupling loss, battery life of over 10 years, ~55000
devices per cell and uplink reporting latency of less than 10 seconds.</t>

<t>NB-IoT supports Half Duplex FDD operation mode with 60 kbps peak rate in
uplink and 30 kbps peak rate in downlink, and a maximum transmission unit
(MTU) size of 1600 bytes limited by PDCP layer (see Figure 4 for the protocol
structure), which is the highest layer in the user plane, as explained later.
Any packet size up to the said MTU size can be passed to the NB-IoT stack from
higher layers, segmentation of the packet is performed in the RLC layer, which
can segment the data to transmission blocks with size as small as 16 bits. As
the name suggests, NB-IoT uses narrowbands with bandwidth of 180 kHz in
both downlink and uplink. The multiple access scheme used in the downlink is
OFDMA with 15 kHz sub-carrier spacing. In uplink, SC-FDMA single tone with
either 15kHz or 3.75 kHz tone spacing is used, or optionally multi-tone SC-
FDMA can be used with 15 kHz tone spacing. </t>

<t>NB-IoT can be deployed in three ways. In-band deployment means that the
narrowband is deployed inside the LTE band and radio resources are flexibly
shared between NB-IoT and normal LTE carrier. In Guard-band deployment the
narrowband uses the unused resource blocks between two adjacent LTE carriers.
Standalone deployment is also supported, where the narrowband can be located
alone in dedicated spectrum, which makes it possible for example to reframe a
GSM carrier at 850/900 MHz for NB-IoT. All three deployment modes are used in
licensed frequency bands. The maximum transmission power is either 20 or 23
dBm for uplink transmissions, while for downlink transmission the eNodeB may
use higher transmission power, up to 46 dBm depending on the deployment.</t>

<t>A maximum coupling loss (MCL) target for NB-IoT coverage enhancements
defined by 3GPP is 164 dB. With this MCL, the performance of NB-IoT in
downlink varies between 200 bps and 2-3 kbps, depending on the deployment
mode. Stand-alone operation may achieve the highest data rates, up to few
kbps, while in-band and guard-band operations may reach several hundreds of
bps. NB-IoT may even operate with MCL higher than 170 dB with very low bit
rates.</t>

<t>For signaling optimization, two options are introduced in addition to
legacy LTE RRC connection setup; mandatory Data-over-NAS (Control Plane
optimization, solution 2 in <xref target="TGPP23720"></xref>) and optional RRC
Suspend/Resume (User Plane optimization, solution 18 in <xref
target="TGPP23720"></xref>). In the control plane optimization the data is
sent over Non-Access Stratum, directly to/from Mobility Management Entity
(MME) (see Figure 3 for the network architecture) in the core network to the
User Equipment (UE) without interaction from the base station. This means there are no Access
Stratum security or header compression provided by the PDCP layer in the
eNodeB, as the Access Stratum is bypassed, and only limited RRC procedures.
RoHC based header compression may still optionally be provided and terminated
in MME.</t> <t>The RRC Suspend/Resume procedures reduce the signaling overhead
required for UE state transition from RRC Idle to RRC Connected mode compared
to legacy LTE operation in order to have quicker user plane transaction with
the network and return to RRC Idle mode faster.</t>

<t>In order to prolong device battery life, both power-saving mode (PSM) and
extended DRX (eDRX) are available to NB-IoT. With eDRX the RRC Connected mode
DRX cycle is up to 10.24 seconds and in RRC Idle the eDRX cycle can be up to 3
hours. In PSM the device is in a deep sleep state and only wakes up for uplink
reporting, after which there is a window, configured by the network, during
which the device receiver is open for downlink connectivity, of for periodical
“keep-alive” signaling (PSM uses periodic TAU signaling with additional
reception window for downlink reachability).</t>

<t>Since NB-IoT operates in licensed spectrum, it has no channel access
restrictions allowing up to a 100% duty-cycle.</t>

<t>3GPP access security is specified in <xref target="TGPP33203"></xref>.</t>

    <figure align="center" anchor="nbiot-diag" title="3GPP network architecture">
       <artwork align="left"><![CDATA[
+--+
|UE| \                 +------+      +------+
+--+  \                | MME  |------| HSS  |
       \             / +------+      +------+
+--+    \+--------+ /      |
|UE| ----| eNodeB |-       |
+--+    /+--------+ \      |
       /             \ +--------+
      /               \|        |    +------+     Service PDN
+--+ /                 |  S-GW  |----| P-GW |---- e.g. Internet
|UE|                   |        |    +------+
+--+                   +--------+
           ]]></artwork>
     </figure>

  <t>Figure 3 shows the 3GPP network architecture, which applies to NB-IoT.
Mobility Management Entity (MME) is responsible for handling the mobility of
the UE. MME tasks include tracking and paging UEs, session management,
choosing the Serving gateway for the UE during initial attachment and
authenticating the user. At MME, the Non-Access Stratum (NAS) signaling from
the UE is terminated.</t>

  <t>Serving Gateway (S-GW) routes and forwards the user data packets through
the access network and acts as a mobility anchor for UEs during handover
between base stations known as eNodeBs and also during handovers between 
NB-IoT and other 3GPP technologies.</t>

  <t>Packet Data Network Gateway (P-GW) works as an interface between 3GPP
network and external networks.</t>

  <t>The Home Subscriber Server (HSS) contains user-related and subscription-
related information. It is a database, which performs mobility management,
session establishment support, user authentication and access
authorization.</t>

  <t>E-UTRAN consists of components of a single type, eNodeB. eNodeB is a base
station, which controls the UEs in one or several cells.</t>

  <t>The 3GPP radio protocol architecture is illustrated in
  	<xref target="nbiot-stack"></xref>.</t>


    <figure align="center" anchor="nbiot-stack" title="3GPP radio protocol architecture for control plane">
       <artwork align="left"><![CDATA[
+---------+                                       +---------+
| NAS     |----|-----------------------------|----| NAS     |
+---------+    |    +---------+---------+    |    +---------+ 
| RRC     |----|----| RRC     | S1-AP   |----|----| S1-AP   |
+---------+    |    +---------+---------+    |    +---------+
| PDCP    |----|----| PDCP    | SCTP    |----|----| SCTP    |
+---------+    |    +---------+---------+    |    +---------+
| RLC     |----|----| RLC     | IP      |----|----| IP      |
+---------+    |    +---------+---------+    |    +---------+
| MAC     |----|----| MAC     | L2      |----|----| L2      |
+---------+    |    +---------+---------+    |    +---------+
| PHY     |----|----| PHY     | PHY     |----|----| PHY     |
+---------+         +---------+---------+         +---------+
            LTE-Uu                         S1-MME
    UE                     eNodeB                     MME
           ]]></artwork>
     </figure>

  <t>Control plane protocol stack</t>   <t>The radio protocol architecture of
NB-IoT (and LTE) is separated into control plane and user plane. The control plane
consists of protocols which control the radio access bearers and the
connection between the UE and the network. The highest layer of control plane
is called Non-Access Stratum (NAS), which conveys the radio signaling between
the UE and the Evolved Packet Core (EPC), passing transparently through the radio network.  NAS
responsible for authentication, security control, mobility management and
bearer management.</t>

  <t>Access Stratum (AS) is the functional layer below NAS, and in the control
plane it consists of Radio Resource Control protocol (RRC) <xref
target="TGPP36331"></xref>, which handles connection establishment and release
functions, broadcast of system information, radio bearer establishment,
reconfiguration and release. RRC configures the user and control planes
according to the network status. There exists two RRC states, RRC_Idle or
RRC_Connected, and RRC entity controls the switching between these states. In
RRC_Idle, the network knows that the UE is present in the network and the UE
can be reached in case of incoming call/downlink data. In this state, the UE
monitors paging, performs cell measurements and cell selection and acquires
system information. Also the UE can receive broadcast and multicast data, but
it is not expected to transmit or receive unicast data. In RRC_Connected the
UE has a connection to the eNodeB, the network knows the UE location on the
cell level and the UE may receive and transmit unicast data. An RRC connection
is established when the UE is expected to be active in the network, to
transmit or receive data.  The RRC connection is released, switching back to
RRC_Idle, when there is no more traffic in order to preserve UE battery life
and radio resources. However, a new feature was introduced for NB-IoT, as
mentioned earlier, which allows data to be transmitted from the MME directly
to the UE transparently to the eNodeB, thus bypassing AS functions.</t>

  <t>Packet Data Convergence Protocol's (PDCP) <xref target="TGPP36323"></xref>
main services in control plane are transfer of control plane data, ciphering
and integrity protection. </t>

  <t>Radio Link Control protocol (RLC) <xref target="TGPP36322"></xref>
performs transfer of upper layer PDUs and optionally error correction with
Automatic Repeat reQuest (ARQ), concatenation, segmentation, and reassembly of
RLC SDUs, in-sequence delivery of upper layer PDUs, duplicate detection, RLC
SDU discard, RLC-re-establishment and protocol error detection and recovery.
</t>

  <t>Medium Access Control protocol (MAC) <xref target="TGPP36321"></xref>
provides mapping between logical channels and transport channels, multiplexing
of MAC SDUs, scheduling information reporting, error correction with HARQ,
priority handling and transport format selection. </t>

  <t>Physical layer <xref target="TGPP36201"></xref> provides data transport
services to higher layers. These include error detection and indication to
higher layers, FEC encoding, HARQ soft-combining, rate matching and mapping of
the transport channels onto physical channels, power weighting and modulation
of physical channels, frequency and time synchronization and radio
characteristics measurements.</t>

<t>User plane is responsible for
transferring the user data through the Access Stratum. It interfaces with IP
and the highest layer of user plane is PDCP, which in user plane performs
header compression using Robust Header Compression (RoHC), transfer of user
plane data between eNodeB and UE, ciphering and integrity protection. Similar
to control plane, lower layers in user plane include RLC, MAC and physical
layer performing the same tasks as in control plane.</t>

	  </section>

	</section>

	<section anchor="sigfox" title="SIGFOX">

<!--
	<t>Text here is largely from <xref target="I-D.zuniga-lpwan-sigfox-system-description"/>,
which may have been updated since this was published.</t>
-->

	  <section anchor="sigfox-docs" title="Provenance and Documents">

<t> The SIGFOX LPWAN is in line with the terminology and specifications being
defined by ETSI <xref target="etsi_unb" />.  As of today, SIGFOX's 
network has been fully deployed in
12 countries, with ongoing deployments on 26 other countries, giving in total
a geography of 2 million square kilometers, containing 512 million people.  </t>

	  </section>

	  <section anchor="sigfox-chars" title="Characteristics">

<t>SIGFOX LPWAN autonomous battery-operated devices send only a few bytes per
day, week or month, in principle allowing them to remain on a single battery
for up to 10-15 years. Hence, the system is designed as to allow devices to last
several years, sometimes even buried underground. </t>

<t>Since the radio protocol is connection-less and optimized for uplink communications, 
the capacity of a SIGFOX base station depends on the number of messages generated by 
devices, and not on the actual number of devices. Likewise, the battery life of devices 
depends on the number of messages generated by the device. Depending on the use case, devices can vary from 
sending less than one message per device per day, to dozens of messages per device per day.</t> 

<t>The coverage of the cell depends on the link budget and on the type of
deployment (urban, rural, etc.). The radio interface is compliant with the following regulations:</t>

<t><list style="hanging">
	   <t>Spectrum allocation in the USA <xref target="fcc_ref" /></t>
	   <t>Spectrum allocation in Europe <xref target="etsi_ref" /></t>
	   <t>Spectrum allocation in Japan <xref target="arib_ref" /></t>
	   </list></t>
	   
	   
<t>The SIGFOX radio interface is also compliant with the local
regulations of the following countries: Australia, Brazil, Canada, Kenya,
Lebanon, Mauritius, Mexico, New Zealand, Oman, Peru, Singapore, South Africa,
South Korea, and Thailand.</t>

<t> The radio interface is based on Ultra Narrow Band (UNB) communications,
which allow an increased transmission range by spending a limited amount of
energy at the device. Moreover, UNB allows a large number of devices to coexist
in a given cell without significantly increasing the spectrum interference.
</t>

<t>Both uplink and downlink are supported, although the system is optimized 
for uplink communications. Due to spectrum optimizations, different uplink and 
downlink frames and time synchronization methods are needed.</t>

<t>The main radio characteristics of the UNB uplink transmission are:</t>

<t><list style="symbols">
			  
  <t>Channelization mask: 100 Hz / 600 Hz (depending on the region)</t>

  <t>Uplink baud rate: 100 baud / 600 baud (depending on the region)</t>

  <t>Modulation scheme: DBPSK</t>

  <t>Uplink transmission power: compliant with local regulation</t>

  <t>Link budget: 155 dB (or better)</t>

  <t>Central frequency accuracy: not relevant, provided there is no significant
frequency drift within an uplink packet transmission</t>

</list></t>
			  
<t>For example, in Europe the UNB uplink frequency band is limited to 868.00 to 868.60 MHz,
with a maximum output power of 25 mW and a duty cycle of 1%.  </t>


<t>The format of the uplink frame is the following:</t>

<figure anchor="fig:ul_frame" title="Uplink Frame Format">
<artwork><![CDATA[
+--------+--------+--------+------------------+-------------+-----+
|Preamble|  Frame | Dev ID |     Payload      |Msg Auth Code| FCS | 
|        |  Sync  |        |                  |             |     |
+--------+--------+--------+------------------+-------------+-----+
]]>
</artwork>
</figure> 

<t>The uplink frame is composed of the following fields: </t>

<t><list style="symbols">

  <t>Preamble: 19 bits</t>
  <t>Frame sync and header: 29 bits</t>
  <t>Device ID: 32 bits</t>
  <t>Payload: 0-96 bits</t>
  <t>Authentication: 16-40 bits</t>
  <t>Frame check sequence: 16 bits (CRC)</t>

</list></t>
			  
<t>The main radio characteristics of the UNB downlink transmission are:</t>

<t><list style="symbols">

  <t>Channelization mask: 1.5 kHz</t>
  <t>Downlink baud rate: 600 baud</t>
  <t>Modulation scheme: GFSK</t>
  <t>Downlink transmission power: 500 mW / 4W (depending on the region)</t>
  <t>Link budget: 153 dB (or better)</t>

  <t>Central frequency accuracy: the center frequency of downlink transmission
is set by the network according to the corresponding uplink transmission</t>

</list></t>

<t>For example, in Europe the UNB downlink frequency band is limited to 869.40 to 869.65
MHz, with a maximum output power of 500 mW  with 10% duty cycle.  </t>

<t> The format of the downlink frame is the following:</t>

<figure anchor="fig:dl_frame" title="Downlink Frame Format" >
<artwork><![CDATA[
+------------+-----+---------+------------------+-------------+-----+
|  Preamble  |Frame|   ECC   |     Payload      |Msg Auth Code| FCS | 
|            |Sync |         |                  |             |     |
+------------+-----+---------+------------------+-------------+-----+
]]>
</artwork>
</figure> 

<t>The downlink frame is composed of the following fields:</t>

<t><list style="symbols">

  <t>Preamble: 91 bits</t>
  <t>Frame sync and header: 13 bits</t>
  <t>Error Correcting Code (ECC): 32 bits</t>
  <t>Payload: 0-64 bits</t>
  <t>Authentication: 16 bits</t>
  <t>Frame check sequence: 8 bits (CRC)</t>

</list></t>

<t> The radio interface is optimized for uplink transmissions, which are
asynchronous. Downlink communications are achieved by devices querying the network for
available data.</t>

<t> A device willing to receive downlink messages opens a fixed window for
reception after sending an uplink transmission.  The delay and duration of this
window have fixed values. The network transmits the downlink message for a
given device during the reception window, and the network also selects the 
base station (BS) for transmitting the corresponding downlink message.  </t>

<t> Uplink and downlink transmissions are unbalanced due to the regulatory
constraints on ISM bands. Under the strictest regulations, the system can
allow a maximum of 140 uplink messages and 4 downlink messages per device
per day. 
<!-- "per day" is according to https://ask.sigfox.com/questions/1182/limit-of-140-messages.html -->
These restrictions can be slightly relaxed depending on system conditions and
the specific regulatory domain of operation. </t>

<figure anchor="sigfox-arch" title="SIGFOX network architecture" >
<artwork><![CDATA[
             +---+
             |DEV| *                    +------+
             +---+   *                  |  RA  |
                       *                +------+  
             +---+       *                 |
             |DEV| * * *   *               |
             +---+       *   +----+        |       
                           * | BS | \  +--------+  
             +---+       *   +----+  \ |        |   
     DA -----|DEV| * * *               |   SC   |----- NA
             +---+       *           / |        |   
                           * +----+ /  +--------+   
             +---+       *   | BS |/                                 
             |DEV| * * *   * +----+    
             +---+         * 
                         *
             +---+     *
             |DEV| * *
             +---+
]]></artwork>
</figure> 
	
<t> <xref target="sigfox-arch" /> depicts the different elements of the SIGFOX
network architecture.  </t>

<t>
SIGFOX has a "one-contract one-network" model allowing devices to connect in
any country, without any need or notion of either roaming or handover.</t>

<t> The architecture consists of a single cloud-based core network, which allows global
connectivity with minimal impact on the end device and radio access network.
The core network elements are the Service Center (SC) and the Registration
Authority (RA). The SC is in charge of the data connectivity between the Base
Station (BS) and the Internet, as well as the control and management of the BSs
and End Points.  The RA is in charge of the End Point network access
authorization.</t>

<t> The radio access network is comprised of several BSs connected directly to
the SC. Each BS performs complex L1/L2 functions, leaving some L2 and L3
functionalities to the SC.</t>

<t> The Devices (DEVs) or End Points (EPs) are the objects that communicate
application data between local device applications (DAs) and network
applications (NAs).</t>

<t> Devices (or EPs) can be static or nomadic, as they associate with the SC
and they do not attach to any specific BS. Hence, they can communicate with the
SC through one or multiple BSs.</t>

<t> Due to constraints in the complexity of the Device, it is assumed that Devices host
only one or very few device applications, which most of the time communicate each to a single
network application at a time.</t>     

<t>The radio protocol authenticates and ensures the integrity
of each message. This is achieved by using a unique device ID and an AES-128
based message
authentication code, ensuring that the message has been generated
and sent by the device with the ID claimed in the message. 
Application data can be
encrypted at the application level or not, depending on the criticality of the 
use case, 
to provide a 
balance between cost and effort vs. risk. 
AES-128 in counter mode is used for encryption.

Cryptographic keys are independent for each device. 
These keys are associated
with the device ID and separate integrity and confidentiality keys are 
pre-provisioned. A confidentiality key is only provisioned if 
confidentiality is to be used.  

At the time of
writing the algorithms and keying details for this are not published.</t>



	  </section>

	</section>

	<section anchor="wisun" title="Wi-SUN Alliance Field Area Network (FAN)">

	<t>Text here is via personal communication from Bob Heile
(bheile@ieee.org) and was authored by Bob and Sum Chin Sean. 
Duffy (paduffy@cisco.com) also provided
additional comments/input on this section.
</t>

	  <section anchor="wisun-docs" title="Provenance and Documents">

<t> The Wi-SUN Alliance <eref target="https://www.wi-sun.org/"/> is an industry
alliance for
smart city, smart grid, smart utility, and a broad set of general IoT
applications. The Wi-SUN Alliance Field Area Network (FAN) profile is open
standards based (primarily on IETF and IEEE802 standards) and was developed to
address applications like smart municipality/city infrastructure monitoring and
management, electric vehicle (EV) infrastructure, advanced metering
infrastructure (AMI), distribution automation (DA), supervisory control and
data acquisition (SCADA) protection/management, distributed generation
monitoring and management, and many more IoT applications. 
Additionally, the Alliance has
created a certification program to promote global multi-vendor
interoperability.  </t>

<t>The FAN profile is specified within ANSI/TIA as an extension of work
previously done on Smart Utility Networks. <xref target="ANSI-4957-000"/>.
Updates to those specifications intended to be published in 2017 will
contain details of the FAN profile. A current snapshot of the work
to produce that profile is presented in 
<xref target="wisun-pressie1"/>
<xref target="wisun-pressie2"/>
.
</t>

	  </section>

	  <section anchor="wisun-chars" title="Characteristics">

<t>The FAN profile is an IPv6
wireless mesh network with support for enterprise level security. The frequency hopping
wireless mesh topology aims to offer superior network
robustness, reliability due to high redundancy, good scalability due to the
flexible mesh configuration and good resilience to interference. 
Very low power modes are in development permitting long
term battery operation of network nodes.</t>

<t>
The following list contains some overall characteristics of Wi-SUN that are
relevant to LPWAN applications.
<list style="symbols">
<t>Coverage:
The range of Wi-SUN FAN is typically 2 -- 3 km in line of sight, matching the
needs of neighborhood area networks, campus area networks, or corporate area
networks. The range can also be extended via multi-hop networking.</t>

<t> High bandwidth, low link latency:

Wi-SUN supports relatively high bandwidth, i.e. up to 300 kbps [FANTPS], enables remote update and upgrade of devices so that they can handle new applications, extending their working life. Wi-SUN supports LPWAN IoT applications that require on-demand control by providing low link latency (0.02s) and bi-directional communication.</t>

<t> Low power consumption:

FAN devices draw less than 2 uA when resting and only 8 mA when listening. Such devices can maintain a long lifetime even if they are frequently listening. For instance, suppose the device transmits data for 10 ms once every 10 s; theoretically, a battery of 1000 mAh can last more than 10 years.</t>


<t>Scalability:

Tens of millions Wi-SUN FAN devices have been deployed in urban, suburban and rural environments, including deployments with more than 1 million devices.</t>
 </list></t>


<t>
A FAN contains one      
   or more networks.  Within a network, nodes assume one of  
   three operational roles. First, each network contains a Border Router 
   providing Wide Area Network (WAN) connectivity to the network.  The Border 
   Router maintains source routing tables for all nodes within its network, 
   provides node authentication and key management services, and disseminates 
   network-wide information such as broadcast schedules. Secondly, Router 
   nodes, which provide upward and downward packet forwarding (within a  
   network). A Router also provides services for relaying security and 
   address management protocols. Lastly, Leaf nodes provide minimum 
   capabilities: discovering and joining a network, send/receive IPv6 
   packets, etc. A low power network may contain a mesh topology with Routers 
   at the edges that construct a star topology with Leaf nodes.
</t>

<t>
The FAN profile is based on various open standards developed by the IETF 
(including 
<xref target="RFC0768"/>,
<xref target="RFC2460"/>,
<xref target="RFC4443"/> and
<xref target="RFC6282"/>),
IEEE802 (including 
<xref target="IEEE-802-15-4"/> and
<xref target="IEEE-802-15-9"/>) and 
ANSI/TIA 
<xref target="ANSI-4957-210"/>
for low power and lossy networks. 
</t>

<t>
The FAN profile specification provides an application-independent
IPv6-based transport service.  There are two possible methods for
establishing the IPv6 packet routing: Routing Protocol for Low-Power and
Lossy Networks (RPL) at the Network layer is mandatory, and Multi-Hop Delivery
Service (MHDS) is optional at the Data Link layer. <xref target="table-wisun"/> 
provides an overview of the FAN network stack.</t>


<t> The Transport service is based on User Datagram Protocol (UDP) defined in
RFC768 or Transmission Control Protocol (TCP) defined in RFC793.  </t>

<t> The Network service is provided by IPv6 as defined in RFC2460 with 6LoWPAN
adaptation as defined in RFC4944 and RFC6282. ICMPv6, as defined
in RFC4443, is used for the control plane during information exchange.  </t>

<t>The Data Link service provides both control/management of the Physical layer
and data transfer/management services to the Network layer. These services are
divided into Media Access Control (MAC) and Logical Link Control (LLC)
sub-layers. The LLC sub-layer provides a protocol dispatch service which
supports 6LoWPAN and an optional MAC sub-layer mesh service. The MAC sub-layer
is constructed using data structures defined in IEEE802.15.4-2015. Multiple
modes of frequency hopping are defined. The entire MAC payload is encapsulated
in an IEEE802.15.9 Information Element to enable LLC protocol dispatch between
upper layer 6LoWPAN processing, MAC sublayer mesh processing, etc. These areas
will be expanded once IEEE802.15.12 is completed.</t>

<t>The PHY service is derived from a sub-set of the SUN FSK specification in
IEEE802.15.4-2015. The 2-FSK modulation schemes, with channel spacing range
from 200 to 600 kHz, are defined to provide data rates from 50 to 300 kbps,
with Forward Error Coding (FEC) as an optional feature. Towards enabling
ultra-low-power applications, the PHY layer design is also extendable to low
energy and critical infrastructure monitoring networks.
</t>

<texttable anchor="table-wisun" title="Wi-SUN Stack Overview">
    <ttcol align='left'>Layer</ttcol>
    <ttcol align='left'>Description</ttcol>
<c>IPv6 protocol suite</c> <c>TCP/UDP</c>
<c></c><c>6LoWPAN Adaptation + Header Compression</c>
<c></c><c>DHCPv6 for IP address management.</c>
<c></c><c>Routing using RPL.</c>
<c></c><c>ICMPv6.</c>
<c></c><c>Unicast and Multicast forwarding. </c>

<c>MAC based on IEEE 802.15.4e + IE extensions</c><c>Frequency hopping</c>
<c></c><c>Discovery and Join</c>
<c></c><c>Protocol Dispatch (IEEE 802.15.9)</c>
<c></c><c>Several Frame Exchange patterns</c>
<c></c><c>Optional Mesh Under routing (ANSI 4957.210).</c>

<c>PHY based on 802.15.4g</c><c> Various data rates and regions</c>

<c>Security</c><c>802.1X/EAP-TLS/PKI  Authentication.
TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 required for EAP-TLS.</c>
<c></c><c>802.11i Group Key Management</c>
<c></c><c>Frame security is implemented as AES-CCM* as specified in IEEE 802.15.4</c>
<c></c><c>Optional ETSI-TS-102-887-2 Node 2 Node Key Management</c>

</texttable>

<t>The FAN security supports Data Link layer network access control, mutual
authentication, and establishment of a secure pairwise link between a FAN node
and its Border Router, which is implemented with an adaptation of IEEE802.1X
and EAP-TLS as described in <xref target="RFC5216"/> using secure device identity as described
in IEEE802.1AR. 
Certificate formats are based upon <xref target="RFC5280"/>. A secure group link
between a Border Router and a set of FAN nodes is established using an
adaptation of the IEEE802.11 Four-Way Handshake. A set of 4 group keys are
maintained within the network, one of which is the current transmit key. Secure
node to node links are supported between one-hop FAN neighbors using an
adaptation of ETSI-TS-102-887-2. FAN nodes implement Frame Security as
specified in IEEE802.15.4-2015.  </t>


	  </section>



	</section>

   </section>

	<section anchor="terms" title="Generic Terminology">

<t> LPWAN technologies, such as those discussed above, have similar
architectures but different terminology. We can identify different types of
entities in a typical LPWAN network:</t>

<t> <list style="symbols">

<t>End-Devices are the devices or the "things" (e.g. sensors, actuators,
etc.); they are named differently in each technology (End Device, User
Equipment or End Point). There can be a high density of end devices
per radio
gateway.</t>

<t>The Radio Gateway, which is the end point of the constrained link. It is
known as: Gateway, Evolved Node B or Base station.</t>

<t>The Network Gateway or Router is the interconnection node between the Radio
Gateway and the Internet. It is known as: Network Server, Serving GW or Service
Center.</t>

<t>LPWAN-AAA Server, which controls the user authentication, the applications. It is
known as: Join-Server, Home Subscriber Server or Registration Authority.  
(We use the term LPWAN-AAA server because we're not assuming that this
entity speaks RADIUS or Diameter as many/most AAA servers do, but equally 
we don't want to rule that out, as the functionality will be similar. </t> 

<t>At last we have the Application Server, known also as Packet Data Node
Gateway or Network Application.</t> </list> </t>

<figure anchor="term-comp" title="LPWAN Architecture Terminology">
<artwork align="left"><![CDATA[
+---------------------------------------------------------------------+
| Function/ |           |           |            |        |           |
|Technology |  LORAWAN  |   NB-IOT  |   SIGFOX   | Wi-SUN |    IETF   |
+-----------+-----------+-----------+------------+--------+-----------+
|  Sensor,  |           |           |            |        |           |
|Actuator,  |    End    |    User   |     End    |  Leaf  |   Device  |
|device,    |  Device   | Equipment |    Point   |  Node  |   (Dev)   |
| object    |           |           |            |        |           |
+-----------+-----------+-----------+------------+--------+-----------+
|Transceiver|           |  Evolved  |    Base    | Router |   RADIO   |
| Antenna   |  Gateway  |  Node B   |   Station  |  Node  |  Gateway  |
+-----------+-----------+-----------+------------+--------+-----------+
| Server    |  Network  |  PDN GW/  |   Service  | Border |  Network  |
|           |  Server   |   SCEF    |   Center   | Router |  Gateway  |
|           |           |           |            |        |   (NGW)   |
+-----------+-----------+-----------+------------+--------+-----------+
| Security  |   Join    |    Home   |Registration|Authent.|  LPWAN-   |
|  Server   |  Server   | Subscriber| Authority  | Server |   AAA     |
|           |           |   Server  |            |        |  SERVER   | 
+-----------+-----------+-----------+------------+--------+-----------+
|Application|Application|Application|  Network   |Appli-  |Application|
|           |   Server  |  Server   | Application| cation |   (App)   |
+---------------------------------------------------------------------+
]]></artwork>
</figure>

<figure anchor="term-arch" title="LPWAN Architecture">
<artwork align="left"><![CDATA[
                                                 +------+
 ()    ()   ()         |                         |LPWAN-|
   ()  () () ()       / \         +---------+    | AAA  |
() () () () () ()    /   \========|    /\   |====|Server|  +-----------+
 ()  ()   ()        |             | <--|--> |    +------+  |APPLICATION|
()  ()  ()  ()     / \============|    v    |==============|    (App)  |
  ()  ()  ()      /   \           +---------+              +-----------+
 Dev         Radio Gateways           NGW
]]></artwork>
</figure>

	<t>In addition to the names of entities, LPWANs are also subject
to possibly regional frequency band regulations. Those may include
restrictions on the duty-cycle, for example requiring that hosts
only transmit for a certain percentage of each hour.</t>

	</section>

<section anchor="gaps" title="Gap Analysis">

<t>This section considers some of the gaps between current 
		LPWAN technologies and the goals of the LPWAN working
		group. Many of the generic considerations described 
		in <xref target="RFC7452"/> will also apply in LPWANs,
		as end-devices can also be considered as a subclass of
		(so-called) "smart objects." In addition, LPWAN device
		implementers will also need to consider the issues 
		relating to firmware updates described in <xref target="RFC8240"/>.</t>

<section anchor="naive" title="Naive application of IPv6">

<t>IPv6 <xref target='RFC8200'/> has been designed to allocate addresses to all the nodes 
 connected to the Internet. Nevertheless, the header overhead of at least 40 bytes 
 introduced by the protocol is incompatible with LPWAN constraints. If IPv6 with 
 no further optimization were used, several LPWAN frames could be needed just to carry
 the IP header.
 Another problem arises from IPv6 MTU requirements, which require the layer below
 to support at least 1280 byte packets <xref target='RFC2460' />.
</t>

<t>
IPv6 has a configuration protocol - neighbor discovery protocol, 
(NDP) <xref target='RFC4861'/>). For a node to learn network parameters
NDP generates regular traffic with 
a relatively large message size that does not fit LPWAN constraints.
</t>

<t>In some LPWAN technologies, layer two multicast is not supported.  In that case, if 
the network topology is a star, the solution and considerations of section 3.2.5 of
<xref target='RFC7668'/> may be applied.</t>

<t> 
Other key protocols such as DHCPv6 <xref target="RFC3315"/>,
IPsec  <xref target="RFC4301"/> 
and TLS <xref target="RFC5246"/>
have similarly problematic properties
in this context. Each of those require relatively
frequent round-trips between the host and some
other host on the network. In the case of cryptographic
protocols such as IPsec and TLS, in addition to the
round-trips required for secure session
establishment, cryptographic operations can require
padding and addition of authenticators that are
problematic when considering LPWAN lower layers.
Note that mains powered Wi-SUN mesh router nodes will typically be more resource capable than the other LPWAN techs discussed.
This can enable use of more "chatty" protocols for some aspects of Wi-SUN.

</t>


</section>

<section anchor="SIXlo" title="6LoWPAN">

<t>Several technologies that exhibit significant constraints in various
dimensions have exploited the 6LoWPAN suite of specifications <xref
target='RFC4944'/>, <xref target='RFC6282'/>, <xref target='RFC6775'/> to
support IPv6 <xref target="I-D.hong-6lo-use-cases"/>. However, the constraints of LPWANs,
often more extreme than those typical of technologies that have (re)used
6LoWPAN, constitute a challenge for the 6LoWPAN suite in order to enable IPv6
over LPWAN.  LPWANs are characterized by device constraints (in terms of
processing capacity, memory, and energy availability), and specially, link
constraints, such as: </t>

<t> <list style="symbols">

<t>tiny layer two payload size (from ~10 to ~100 bytes),</t>

<t>very low bit rate (from ~10 bit/s to ~100 kbit/s), and </t>

<t>in some specific technologies, further message rate constraints (e.g.
between ~0.1 message/minute and ~1 message/minute) due to regional regulations
that limit the duty cycle.</t>

</list> </t>

<section anchor="HC" title="Header Compression">

<t>6LoWPAN header compression reduces IPv6 (and UDP) header overhead by eliding
header fields when they can be derived from the link layer, and by assuming
that some of the header fields will frequently carry expected values. 6LoWPAN
provides both stateless and stateful header compression. In the latter, all
nodes of a 6LoWPAN are assumed to share compression context. In the best case,
the IPv6 header for link-local communication can be reduced to only 2 bytes.
For global communication, the IPv6 header may be compressed down to 3 bytes in
the most extreme case. However, in more practical situations, the smallest IPv6
header size may be 11 bytes (one address prefix compressed) or 19 bytes (both
source and destination prefixes compressed). These headers are large
considering the link layer payload size of LPWAN technologies, and in some
cases are even bigger than the LPWAN PDUs. 6LoWPAN has been initially designed
for IEEE 802.15.4 networks with a frame size up to 127 bytes and a throughput
of up to 250 kb/s, which may or may not be duty-cycled.  </t>

</section>

<section anchor="Autoconf" title="Address Autoconfiguration">

<t>Traditionally, Interface Identifiers (IIDs) have
been derived from link layer identifiers <xref target='RFC4944'/> . This allows
optimizations such as header compression. Nevertheless, recent guidance has
given advice on the fact that, due to privacy concerns, 6LoWPAN devices should
not be configured to embed their link layer addresses in the IID by default.
<xref target="RFC8065"/> provides guidance on better methods for generating
IIDs.
</t>

</section>

<section anchor="Frag" title="Fragmentation">

<t> As stated above, IPv6 requires the layer below to support an MTU of 1280
bytes <xref target='RFC2460'/>. Therefore, given the low maximum payload size
of LPWAN technologies, fragmentation is needed.</t>

<t>If a layer of an LPWAN technology supports fragmentation, proper analysis
has to be carried out to decide whether the fragmentation functionality
provided by the lower layer or fragmentation at the adaptation layer should be
used.  Otherwise, fragmentation functionality shall be used at the adaptation
layer.  </t>

<t>6LoWPAN defined a fragmentation mechanism and a fragmentation header to
support the transmission of IPv6 packets over IEEE 802.15.4 networks <xref
target='RFC4944'/>.  While the 6LoWPAN fragmentation header is appropriate for
IEEE 802.15.4-2003 (which has a frame payload size of 81-102 bytes), it is not
suitable for several LPWAN technologies, many of which have a maximum payload
size that is one order of magnitude below that of IEEE 802.15.4-2003.  The
overhead of the 6LoWPAN fragmentation header is high, considering the reduced
payload size of LPWAN technologies and the limited energy availability of the
devices using such technologies. Furthermore, its datagram offset field is
expressed in increments of eight octets.  In some LPWAN technologies, the
6LoWPAN fragmentation header plus eight octets from the original datagram
exceeds the available space in the layer two payload. In addition, the MTU in
the LPWAN networks could be variable which implies a variable fragmentation
solution.  </t>

</section>

<!--
<t>[[Ed: this was commented out in original XML I (SF) think]]</t>

<t> IEEE 802.15.4 is a CSMA/CA protocol which means that every unicast frame is
acknowledged.  Because IEEE 802.15.4 has its own reliability mechanism by
retransmission, 6LoWPAN does not have reliable delivery. Some LPWAN
technologies do not provide such acknowledgements at L2 and would require other
reliability mechanisms.  </t>

<t> 6lo extends the usage of 6LoWPAN to other technologies (BLE, DECT, …), with
similar characteristics to IEEE 802.15.4. The main constraint in these networks
comes from the nature of the devices (constrained devices), whereas in LPWANs
it is the network itself that imposes the most stringent constraint.  </t>

<t> 6LoWPAN has optimized Neighbor Discovery by reducing the message size, the
periodic exchanges and removing multicast message for point-to-point exchanges
with border router.  </t>

-->

<section anchor="ND" title="Neighbor Discovery">

<t>6LoWPAN Neighbor Discovery <xref target='RFC6775'/> defined optimizations to
IPv6 Neighbor Discovery <xref target='RFC4861'/>, in order to adapt
functionality of the latter for networks of devices using IEEE 802.15.4 or
similar technologies.  The optimizations comprise host-initiated interactions
to allow for sleeping hosts, replacement of multicast-based address resolution
for hosts by an address registration mechanism, multihop extensions for prefix
distribution and duplicate address detection (note that these are not needed in
a star topology network), and support for 6LoWPAN header compression.  </t>

<t> 6LoWPAN Neighbor Discovery may be used in not so severely constrained LPWAN
networks. The relative overhead incurred will depend on the LPWAN technology
used (and on its configuration, if appropriate). In certain LPWAN setups (with
a maximum payload size above ~60 bytes, and duty-cycle-free or equivalent
operation), an RS/RA/NS/NA exchange may be completed in a few seconds, without
incurring packet fragmentation.</t>   

<t>In other LPWANs (with a maximum payload size of ~10 bytes, and a message
rate of ~0.1 message/minute), the same exchange may take hours or even days,
leading to severe fragmentation and consuming a significant amount of the
available network resources.  6LoWPAN Neighbor Discovery behavior may be tuned
through the use of appropriate values for the default Router Lifetime, the
Valid Lifetime in the PIOs, and the Valid Lifetime in the 6LoWPAN Context Option (6CO), as well as the
address Registration Lifetime. However, for the latter LPWANs mentioned above,
6LoWPAN Neighbor Discovery is not suitable.  </t>

</section>

</section>

<section anchor="Sixlo" title="6lo">

<t>The 6lo WG 
has been
reusing and adapting 6LoWPAN to enable IPv6 support over link layer
technologies such as 
Bluetooth Low Energy (BTLE), 
ITU-T G.9959,  
DECT-ULE, 
MS/TP-RS485,  
NFC 
IEEE 802.11ah. (See 
<eref target="https://tools.ietf.org/wg/6lo"/> for details.) 
These technologies are similar in several
aspects to IEEE 802.15.4, which was the original 6LoWPAN target technology.
</t>

<t>6lo has mostly used the subset of 6LoWPAN techniques best suited for each
lower layer technology, and has provided additional optimizations for
technologies where the star topology is used, such as BTLE or DECT-ULE. </t> 

<t>The main constraint in these networks comes from the nature of the devices
(constrained devices), whereas in LPWANs it is the network itself that imposes
the most stringent constraints.</t>

</section>

<section anchor="SIXtisch" title="6tisch">

<t>The 6tisch solution is dedicated to mesh networks that operate using
802.15.4e MAC with a deterministic slotted channel.  The time slot
channel (TSCH) 
can help to
reduce collisions and to enable a better balance over the channels. It improves
the battery life by avoiding the idle listening time for the return
channel.</t>

<t> A key element of 6tisch is the use of synchronization to enable
determinism.  TSCH and 6TiSCH may provide a standard scheduling function.  The
LPWAN networks probably will not support synchronization like the one used in
6tisch.  </t>

</section>

<section anchor="ROHC" title="RoHC">

<!--
this is the old version new is from a mail from Ana
<t>RoHC mechanisms were defined
for point to point multimedia channels, to reduce the header overhead of RTP
flows. RoHC can also reduce the overhead of IPv4 or IPv6 or UDP headers. It is
based on shared context which does not require any state, but compressed packets
are not routable.  The context is initialised at the beginning of the
communication or when communication is lost.  The compression is
managed using a sequence number (SN) which is encoded using a windowing
algorithm allowing for reduction of the SN to 4 bits instead of 2 bytes. 
This window however needs to be updated every
15 packets which implies larger headers.  When RoHC is used we talk about an
average header compression size to give the performance of compression. For
example, RoHC starts sending bigger packets than the original (52 bytes) to
reduce the header up to 4 bytes (it stays there only for 15 packets, which
correspond to the window size). Each time the context is lost or needs to be
synchronised, packets of about 15 to 43 bytes are sent.  [[Ed: the above isn't
that cleaar to me.]] </t>
-->

<t>
Robust header compression (RoHC) is a header compression mechanism <xref
target="RFC3095"/> developed for multimedia
flows in a point to point channel. RoHC uses 3 levels of
compression, each level having its own header format. 
In the first level, RoHC sends  52 bytes of header, in the
second level the header could be from 34 to 15 bytes and in the third level
header size could be from 7 to 2 bytes. The level of compression is managed by
a sequence number, which varies in size from 2 bytes to 4 bits in the minimal
compression. SN compression is done with an algorithm called W-LSB (Window-
Least Significant Bits). This window has a 4-bit size representing 15
packets, so every 15 packets RoHC needs to slide the window in order to receive
the correct sequence number, and sliding the window implies a reduction of the
level of compression. When packets are lost or errored, the decompressor loses
context and drops packets until a bigger header is sent with more complete
information.
To estimate the performance of RoHC, an average header size is used. This
average depends on the transmission conditions, but most of the time 
is between 3 and 4 bytes.
</t>

<t>RoHC has not been adapted specifically to the constrained hosts and networks
of LPWANs: it does
not take into account energy limitations nor the transmission rate, and
RoHC context is synchronised during transmission, which does not allow better
compression.</t>

</section>

<section anchor="ROLL" title="ROLL">

<t>Most technologies considered by the lpwan WG are based on a star topology,
which eliminates the need for routing at that layer. Future work may address
additional use-cases that may require adaptation of existing routing protocols
or the definition of new ones. As of the time of writing, work similar to that
done in the ROLL WG  and other routing protocols are out of scope of the LPWAN
WG. </t> 

</section>

<section anchor="CORE" title="CoAP">

<t>CoAP <xref target="RFC7252"/> provides a RESTful framework for applications
intended to run on constrained IP networks.  It may be necessary to adapt CoAP
or related protocols to take into account for the extreme duty cycles and the
potentially extremely limited throughput of LPWANs. </t>

<t>For example, some of the timers in CoAP may need to be redefined. Taking
into account CoAP acknowledgments may allow the reduction of L2
acknowledgments. On the other hand, the current work in progress in the CoRE
WG where the COMI/CoOL network management interface which, uses Structured
Identifiers (SID) to reduce payload size over CoAP may prove to be a good solution
for the LPWAN technologies.  The overhead is reduced by adding a dictionary
which matches a URI to a small identifier and a compact mapping of the YANG
model into the CBOR binary representation.  </t>

</section>


<section anchor="Mobility" title="Mobility">

<t> LPWAN nodes can be mobile.  However, LPWAN mobility is different from the
one specified for Mobile IP.  LPWAN implies sporadic traffic and will rarely be
used for high-frequency, real-time communications.  The applications do not
generate a flow, they need to save energy and most of the time the node will be
down.</t>  

<t>In addition, LPWAN mobility may mostly apply to groups of devices, that
represent a network in which case mobility is more a concern for the gateway
than the devices.  
NEMO <xref target="RFC3963"/> Mobility or other mobile gateway solutions (such
as a gateway with an LTE uplink) may be used in the case where some
end-devices belonging to the same network gateway move from one point to another
such that they are not aware of being mobile.  </t>

</section>


<section anchor="DNS" title="DNS and LPWAN">

<t>The 
Domain Name System (DNS) 
DNS <xref target="RFC1035"/>,
enables applications to name things with a
globally resolvable name.  Many protocols use the DNS to identify hosts,
for example applications using CoAP. </t>

<t>
The DNS query/answer protocol as a pre-cursor to other communication
within the time-to-live (TTL) of a DNS answer is clearly problematic
in an LPWAN, say where only one round-trip per hour can be used, and
with a TTL that is less than 3600.
It is currently unclear whether and how
DNS-like functionality might be provided in LPWANs.</t>

</section>


</section>

   <section anchor="sec-cons" title="Security Considerations">

<t> Most LPWAN technologies integrate some authentication or encryption
mechanisms that were defined outside the IETF.  The working group may need to
do work to integrate these mechanisms to unify management.  A standardized
Authentication, Accounting, and Authorization (AAA) infrastructure <xref
target="RFC2904"/> may offer a scalable solution for some of the security and
management issues for LPWANs.  AAA offers centralized management that may be of
use in LPWANs, for example <xref target="I-D.garcia-dime-diameter-lorawan"/>
and <xref target="I-D.garcia-radext-radius-lorawan"/> suggest possible security
processes for a LoRaWAN network. Similar mechanisms may be useful to explore
for other LPWAN technologies.  </t>

<t>Some applications using LPWANs may raise few or no privacy considerations.
For example, temperature sensors in a large office building may not raise
privacy issues. However, the same sensors, if deployed in a home environment
and especially if triggered due to human presence, can raise significant
privacy issues - if an end-device emits (an encrypted) packet every time
someone enters a room in a home, then that traffic is privacy sensitive. And
the more that the existence of that traffic is visible to network entities, the
more privacy sensitivities arise. At this point, it is not clear whether 
there are workable mitigations for problems like this - in a more typical
network, one would consider defining padding mechanisms and allowing for
cover traffic. In some LPWANs, those mechanisms may not be feasible. Nonetheless,
the privacy challenges do exist and can be real and so some solutions will
be needed. Note that many aspects of solutions in this space may not be visible in
IETF specifications, but can be e.g. implementation or deployment
specific.</t>

<t>Another challenge for LPWANs will be how to handle key management
and associated protocols. In a more traditional network (e.g. the web),
servers can "staple" Online Certificate Status Protocol (OCSP) responses in order to allow browsers to 
check revocation status for presented certificates. <xref target="RFC6961"/>
While the 
stapling approach is likely something that would help in an LPWAN,
as it avoids an RTT, certificates and OCSP responses are bulky items
and will prove challenging to handle in LPWANs with bounded bandwidth.</t>



   </section>

   <section title="IANA Considerations">
      <t>
        There are no IANA considerations related to this memo.
      </t>
   </section>

<section anchor="contribs" title="Contributors">

<t>[[RFC editor: Please fix names below for I18N.]]</t>

<t>As stated above this document is mainly a collection of
content developed by the full set of contributors listed 
below. The main input documents and
their authors were:</t>

<t><list style="symbols">

<t>Text for <xref target="lora"/>  was provided
by Alper Yegin and Stephen Farrell
in <xref target="I-D.farrell-lpwan-lora-overview"/>.</t>

<t>Text for <xref target="nbiot"/> was provided by
Antti Ratilainen in
<xref target="I-D.ratilainen-lpwan-nb-iot"/>.</t>

<t>Text for <xref target="sigfox"/> was provided by 
Juan Carlos Zuniga and Benoit Ponsard in 
<xref target="I-D.zuniga-lpwan-sigfox-system-description"/>.</t>

<t>Text for <xref target="wisun"/> was provided via personal communication
from Bob Heile (bheile@ieee.org) and was authored by Bob and Sum Chin Sean.
There is no Internet draft for that at present.</t>

<t>Text for <xref target="gaps"/> was provided by Ana Minabiru, Carles Gomez,
Laurent Toutain, Josep Paradells and Jon Crowcroft in 
<xref target="I-D.minaburo-lpwan-gap-analysis"/>. Additional
text from that draft is also used elsewhere above.</t>

</list></t>

<t>The full list of contributors are:</t>

<figure><artwork>
<![CDATA[
   Jon Crowcroft
   University of Cambridge
   JJ Thomson Avenue
   Cambridge, CB3 0FD
   United Kingdom

   Email: jon.crowcroft@cl.cam.ac.uk


   Carles Gomez
   UPC/i2CAT
   C/Esteve Terradas, 7
   Castelldefels 08860
   Spain

   Email: carlesgo@entel.upc.edu


   Bob Heile
   Wi-Sun Alliance
   11 Robert Toner Blvd, Suite 5-301
   North Attleboro, MA  02763
   USA

   Phone: +1-781-929-4832
   Email: bheile@ieee.org


   Ana Minaburo
   Acklio
   2bis rue de la Chataigneraie
   35510 Cesson-Sevigne Cedex
   France

   Email: ana@ackl.io


   Josep PAradells
   UPC/i2CAT
   C/Jordi Girona, 1-3
   Barcelona 08034
   Spain

   Email: josep.paradells@entel.upc.edu


   Charles E. Perkins
   Futurewei
   2330 Central Expressway
   Santa Clara  95050
   Unites States

   Email: charliep@computer.org


   Benoit Ponsard
   SIGFOX
   425 rue Jean Rostand
   Labege  31670
   France

   Email: Benoit.Ponsard@sigfox.com
   URI:   http://www.sigfox.com/


   Antti Ratilainen
   Ericsson
   Hirsalantie 11
   Jorvas  02420
   Finland

   Email: antti.ratilainen@ericsson.com


   Chin-Sean SUM
   Wi-Sun Alliance
   20, Science Park Rd
   Singapore  117674

   Phone: +65 6771 1011
   Email: sum@wi-sun.org


   Laurent Toutain
   Institut MINES TELECOM ; TELECOM Bretagne
   2 rue de la Chataigneraie
   CS 17607
   35576 Cesson-Sevigne Cedex
   France

   Email: Laurent.Toutain@telecom-bretagne.eu


   Alper Yegin
   Actility
   Paris, Paris
   FR

   Email: alper.yegin@actility.com


   Juan Carlos Zuniga
   SIGFOX
   425 rue Jean Rostand
   Labege  31670
   France

   Email: JuanCarlos.Zuniga@sigfox.com
   URI:   http://www.sigfox.com/
  ]]>
</artwork></figure>


</section>

   <section title="Acknowledgments">
	
	<t>Thanks to all those listed in <xref target="contribs"/>
for the excellent text. Errors in the handling of that are
solely the editor's fault.
</t>

<t>[[RFC editor: Please fix names below for I18N, at least Mirja's does
		need fixing.]]</t>

	<t>In addition to the contributors above, thanks are due 
to (in alphabetical order):  
Abdussalam Baryun,
Andy Malis,
Arun (arun@acklio.com),
Behcet SariKaya,
Dan Garcia Carrillo,
Jiazi Yi, 
Mirja Kühlewind, 
Paul Duffy, 
Russ Housley,
Samita Chakrabarti,
Thad Guidry,
Warren Kumari,
for comments.</t>

<t>Alexander Pelov and Pascal Thubert were the LPWAN WG
chairs while this document was developed.</t>

		<t>Stephen Farrell's work on this memo was supported by 
Pervasive Nation, the Science Foundation Ireland's CONNECT centre national IoT
network. <eref target="https://connectcentre.ie/pervasive-nation/"/>
</t>
	
   </section>

</middle>

<back>
   <references title="Informative References">
<!--
   <?rfc include='reference.RFC.2119'?>
-->
   <?rfc include='reference.RFC.0768'?>
   <?rfc include='reference.RFC.1035'?>
   <?rfc include='reference.RFC.2460'?>
   <?rfc include='reference.RFC.2904'?>
   <?rfc include='reference.RFC.3095'?>
   <?rfc include='reference.RFC.3315'?>
   <?rfc include='reference.RFC.3963'?>
   <?rfc include='reference.RFC.4301'?>
   <?rfc include='reference.RFC.4443'?>
   <?rfc include='reference.RFC.4861'?>
   <?rfc include='reference.RFC.4944'?>
   <?rfc include='reference.RFC.5216'?>
   <?rfc include='reference.RFC.5246'?>
   <?rfc include='reference.RFC.5280'?>
   <?rfc include='reference.RFC.6282'?>
   <?rfc include='reference.RFC.6775'?>
   <?rfc include='reference.RFC.6961'?>
   <?rfc include='reference.RFC.7252'?>
   <?rfc include='reference.RFC.7452'?>
   <?rfc include='reference.RFC.7668'?>
   <?rfc include='reference.RFC.8065'?>
   <?rfc include='reference.RFC.8200'?>
   <?rfc include='reference.RFC.8240'?>
    &I-D.farrell-lpwan-lora-overview;
	&I-D.minaburo-lpwan-gap-analysis;
	&I-D.zuniga-lpwan-sigfox-system-description;
	&I-D.ratilainen-lpwan-nb-iot;
	&I-D.garcia-dime-diameter-lorawan;
	&I-D.garcia-radext-radius-lorawan;
	&I-D.hong-6lo-use-cases;
     <reference anchor="TGPP36300" target="http://www.3gpp.org/ftp/Specs/2016-09/Rel-14/36_series/">
       <front>
         <title>TS 36.300 v13.4.0 Evolved Universal Terrestrial Radio Access (E-UTRA) and Evolved Universal Terrestrial Radio Access Network (E-UTRAN); Overall description; Stage 2</title>

         <author>
           <organization>3GPP</organization>
         </author>

         <date year="2016" />
       </front>
     </reference>

   <reference anchor="TGPP36321">
       <front>
         <title>TS 36.321 v13.2.0 Evolved Universal Terrestrial Radio Access (E-UTRA); Medium Access Control (MAC) protocol specification</title>

         <author>
           <organization>3GPP</organization>
         </author>

         <date year="2016" />
       </front>
     </reference>

   <reference anchor="TGPP36322">
       <front>
         <title>TS 36.322 v13.2.0 Evolved Universal Terrestrial Radio Access (E-UTRA); Radio Link Control (RLC) protocol specification</title>

         <author>
           <organization>3GPP</organization>
         </author>

         <date year="2016" />
       </front>
     </reference>

   <reference anchor="TGPP36323">
       <front>
         <title>TS 36.323 v13.2.0 Evolved Universal Terrestrial Radio Access (E-UTRA); Packet Data Convergence Protocol (PDCP) specification (Not yet available)</title>

         <author>
           <organization>3GPP</organization>
         </author>

         <date year="2016" />
       </front>
     </reference>

   <reference anchor="TGPP36331">
       <front>
         <title>TS 36.331 v13.2.0 Evolved Universal Terrestrial Radio Access (E-UTRA); Radio Resource Control (RRC); Protocol specification</title>

         <author>
           <organization>3GPP</organization>
         </author>

         <date year="2016" />
       </front>
     </reference>

   <reference anchor="TGPP36201">
       <front>
         <title>TS 36.201 v13.2.0 - Evolved Universal Terrestrial Radio Access (E-UTRA); LTE physical layer; General description</title>

         <author>
           <organization>3GPP</organization>
         </author>

         <date year="2016" />
       </front>
     </reference>

     <reference anchor="TGPP23720">
       <front>
         <title>TR 23.720 v13.0.0 - Study on architecture enhancements for Cellular Internet of Things</title>

         <author>
           <organization>3GPP</organization>
         </author>

         <date year="2016" />
       </front>
     </reference>

     <reference anchor="TGPP33203">
       <front>
         <title>TS 33.203 v13.1.0 - 3G security; Access security for IP-based services</title>

         <author>
           <organization>3GPP</organization>
         </author>

         <date year="2016" />
       </front>
     </reference>

<!--
      <reference anchor="etsi_ltn">
        <front>
          <title>ETSI Technical Committee on EMC and Radio Spectrum Matters (ERM) TG28 Low Throughput Networks (LTN)</title>
          <author fullname="ETSI ERM TG28 LTN"/>
          <date year="2015" month="February"/>
        </front>
      </reference>
-->
	  

	  
	  <reference anchor="fcc_ref">
	    <front>
		  <title>FCC CFR 47 Part 15.247 Telecommunication Radio Frequency Devices - Operation within the bands 902-928 MHz, 2400-2483.5 MHz, and 5725-5850 MHz.</title>
		  <author fullname="FCC"/>
		  <date year="2016" month="June"/>
		</front>
	  </reference>
	  
	  <reference anchor="etsi_ref">
	    <front>
		  <title>ETSI EN 300-220 (Parts 1 and 2): Electromagnetic compatibility and Radio spectrum Matters (ERM); Short Range 
		  Devices (SRD); Radio equipment to be used in the 25 MHz to 1 000 MHz frequency range with power levels ranging up to 500 mW</title>
		  <author fullname="ETSI"/>
		  <date year="2016" month="May"/>
		</front>
	  </reference>	  
<!--		  
	  <reference anchor="gbt_ref">
	    <front>
		  <title>GB/T 15629.15-2010: Information technology - Telecommunications and information exchange between systems local and 
		  metropolitan area networks - Specific requirements - Part 15.4: Wireless medium access control and physical layer (PHY) 
		  specification for low rate wireless personal area networks.</title>
		  <author fullname="GB/T"/>
		  <date year="2010" month="January"/>
		</front>
	  </reference>	 
-->	  
	  <reference anchor="arib_ref">
	    <front>
		  <title>ARIB STD-T108 (Version 1.0): 920MHz-Band Telemeter, Telecontrol and data transmission radio equipment.</title>
		  <author fullname="ARIB"/>
		  <date year="2012" month="February"/>
		</front>
	  </reference>	

      <reference anchor="LoRaSpec" target="http://portal.lora-alliance.org/DesktopModules/Inventures_Document/FileDownload.aspx?ContentID=1398">
         <front>
            <title>
               LoRaWAN Specification Version V1.0.2
            </title>
            <author>
               <organization>LoRa Alliance</organization>
            </author>
            <date month="July" year="2016"/>
         </front>
      </reference>

	  <!--
      <reference anchor="LoRaSpec1.0" target="https://www.lora-alliance.org/portals/0/specs/LoRaWAN%20Specification%201R0.pdf">
         <front>
            <title>
               LoRaWAN Specification Version V1.0
            </title>
            <author>
               <organization>LoRa Alliance</organization>
            </author>
            <date month="Jan" year="2015"/>
         </front>
      </reference>
	-->

      <reference anchor="ANSI-4957-000" target="https://global.ihs.com/doc_detail.cfm?%26rid=TIA%26item_s_key=00606368">
         <front>
            <title>
				Architecture Overview for the Smart Utility Network
            </title>
            <author>
               <organization> ANSI, TIA-4957.000 </organization>
            </author>
            <date month="May" year="2013"/>
         </front>
      </reference>

      <reference anchor="ANSI-4957-210" target="https://global.ihs.com/doc_detail.cfm?%26csf=TIA%26item_s_key=00601800">
         <front>
            <title>
				Multi-Hop Delivery Specification of a Data Link Sub-Layer
            </title>
            <author>
               <organization> ANSI, TIA-4957.210 </organization>
            </author>
            <date month="May" year="2013"/>
         </front>
      </reference>

      <reference anchor="wisun-pressie1" target="http://indiasmartgrid.org/event2017/10-03-2017/4.%20Roundtable%20on%20Communication%20and%20Cyber%20Security/1.%20Phil%20Beecher.pdf">
         <front>
            <title>
				Wi-SUN Alliance Overview
            </title>
            <author>
               <organization>Phil Beecher, Chair, Wi-SUN Alliance</organization>
            </author>
            <date month="March" year="2017"/>
         </front>
      </reference>

      <reference anchor="wisun-pressie2" target="https://www.ietf.org/proceedings/97/slides/slides-97-lpwan-35-wi-sun-presentation-00.pdf">
         <front>
            <title>
				IETF97 Wi-SUN Alliance Field Area Network (FAN) Overview
            </title>
            <author>
               <organization>Bob Heile, Director of Standards, Wi-SUN Alliance</organization>
            </author>
            <date month="November" year="2016"/>
         </front>
      </reference>

    <reference anchor='IEEE-802-15-4' target="https://standards.ieee.org/findstds/standard/802.15.4-2015.html">
      <front>
        <title>IEEE Standard for Low-Rate Wireless Personal Area
        Networks (WPANs)</title>
	<author></author>
        <date year='2015'/>
      </front>
      <seriesInfo name="IEEE" value="Standard 802.15.4" />
    </reference>

    <reference anchor='IEEE-802-15-9' target="https://standards.ieee.org/findstds/standard/802.15.9-2016.html">
      <front>
        <title>IEEE Recommended Practice for Transport of Key Management Protocol (KMP) Datagrams</title>
	<author></author>
        <date year='2016'/>
      </front>
      <seriesInfo name="IEEE" value="Standard 802.15.9" />
    </reference>

      <reference anchor="etsi_unb">
        <front>
          <title>ETSI TR 103 435 System Reference document (SRdoc); Short Range Devices (SRD); Technical characteristics for Ultra Narrow Band (UNB)
		  SRDs operating in the UHF spectrum below 1 GHz</title>
          <author fullname="ETSI ERM"/>
          <date year="2017" month="February"/>
        </front>
      </reference>

      <reference anchor="nbiot-ov">
        <front>
			<title>NB-IoT technology overview and experience from cloud-RAN implementation</title>
			<author>
  				<organization> Beyene, Yihenew Dagne, et al.</organization>
			</author>
		  	<date year="2017" month="June"/>
        </front>
      	<seriesInfo name="IEEE Wireless Communications" value="24,3 (2017): 26-32"/>
      </reference>

	  

	</references>
	<section title="Changes">

	<t>[[RFC editor: Please remove this before publication]]</t>

	<section title="From -00 to -01">

	<t><list style="symbols">

	<t>WG have stated they want this to be an RFC.</t>

	<t>WG clearly want to keep the RF details.</t>

	<t>Various changes made to remove/resolve a number of 
	editorial notes from
	-00 (in some cases as per suggestions from Ana Minaburo)</t>

	<t>Merged PR's: #1...</t>

	<t>Rejected PR's: #2 (change was made to .txt not .xml but was
	replicated manually by editor)</t>

	<t>Github repo is at: https://github.com/sftcd/lpwan-ov</t>

	</list></t>


	</section>

	<section title="From -01 to -02">
	<t><list style="symbols">

	<t>WG seem to agree with editor suggestions in slides 13-24 of the presentation on this topic 
    given at IETF98 (See: https://www.ietf.org/proceedings/98/slides/slides-98-lpwan-aggregated-slides-07.pdf)
	</t>

	<t>Got new text wrt Wi-SUN via email from Paul Duffy and 
	merged that in</t>

	<t>Reflected list discussion wrt terminology and "end-device"</t>

	<t>Merged PR's: #3...</t>

	</list></t>
	</section>

	<section title="From -02 to -03">
	<t><list style="symbols">

	<t>Editorial changes and typo fixes thanks to Fred Baker running something
called Grammerly and sending me it's report.</t>

	<t>Merged PR's: #4, #6, #7...</t>

	<t>Editor did an editing pass on the lot.</t>

	</list></t>
	</section>

	<section title="From -03 to -04">
	<t><list style="symbols">
	
	<t>Picked up a PR that had been wrongly applied that expands UE</t>

	<t>Editorial changes wrt LoRa suggested by Alper</t>

	<t>Editorial changes wrt SIGFOX provided by Juan-Carlos</t>

	</list></t>
	</section>

	<section title="From -04 to -05">
	<t><list style="symbols">

	<t>Handled Russ Housley's WGLC review.</t>

	<t>Handled Alper Yegin's WGLC review.</t>

	</list></t>
	</section>

	<section title="From -05 to -06">
	<t><list style="symbols">

	<t>More Alper comments:-)</t>

	<t>Added some more detail about sigfox security.</t>

	<t>Added Wi-SUN changes from Charlie Perkins</t>

	</list></t>
	</section>

	<section title="From -06 to -07">
	<t><list style="symbold">

	<t>Yet more Alper comments:-)</t>
	<t>Comments from Behcet Sarikaya</t>
	
	</list></t>
	</section>

	<section title="From -07 to -08">
	<t><list style="symbold">

	<t>various typos</t>
	<t>Last call and directorate comments from Abdussalam Baryun (AB) and Andy Malis</t>
	<t>20180118 IESG ballot comments from Warren: nits handled, two possible bits of
	text still needed.</t>

	<t>Some more AB comments handled. Still need to check over 7452 and 8240
			to see if issues from those need to be discussed here.</t>

	<t>Corrected "no IP capabilities - Wi-SUN devices do v6 (thanks
	Paul Duffy:-)</t>

	<t>Mirja's AD ballot comments handled.</t>

	<t>Added a sentence in intro trying to say what's "special" about LPWAN
			compared to other constrained networks. (As suggested by Warren.)</t>

	<t>Added text @ start of gap analysis referring to RFCs 7252 and 8240,
			as suggested by a few folks (AB, Warren, Mirja)</t>

	<t>Added nbiot-ov reference for those who'd like a more polished presentation
			of NB-IoT</t>
	

	</list></t>
	</section>

	<section title="From -08 to -09">
	<t><list style="symbold">

	<t>Changes due to IoT-DIR review from Samita Chakrabarti: 
			fixed error on max rate between tables 1 and 2; s/eNb/eNodeB/; fixed 
			references to hong-6lo-use-cases; added RFC8065 reference</t>

	</list></t>
	</section>

	<section title="From -09 to -10">
	<t><list style="symbold">

	<t>Added Charlie Perkins as contributor - was supposed to have been done ages ago - editor forgot;-)</t>

	</list></t>
	</section>


	</section>

 </back>
</rfc>