LoMM: A Monitoring and Management Platform for LoRaWAN Experimentation

Year after year, Long-Range (LoRa) is globally becoming recognized as a low-power wide-area network technology that enables cheap and easy-to-setup deployments of Internet of things (IoT) networks. Being its stack open, lots of researchers have been deeply investigating LoRa performance and proposing interesting ways of enhancing its capabilities, yet with little impact on the standard. In this paper, we present a novel platform for the monitoring and management of LoRa-based IoT networks called LoMM, whose aim is that of bridging the gap between the research domain and the real deployments domain. The modular architecture of LoMM allows the rapid prototyping of solutions at the edge, spanning from algorithms and policies for efficient network management, to custom functionalities for novel applications. Some preliminary demonstration results as well as several examples of envisioned LoMM use cases are provided to prove its capabilities and versatility.


I. INTRODUCTION
Long-Range (LoRa) has quickly become (one of) the most prominent wireless technologies implementing low-power wide-area networks (LPWANs) [1]. Like other LPWAN technologies, LoRa was designed and is currently being developed to enable massive machine-type communication use cases entailing, e.g., remote monitoring devices that deliver reports of collected data from the surrounding environment a few times per day to an Application Server (AS) in order to allow further data analysis of environmental processes as well as industrial processes. LoRa terminals, referred to as end devices (EDs) in jargon, operate on unlicensed frequency bands and target a lifespan of several years of autonomous operation. LoRa radio gateways (RGs) act as remote radio heads, forwarding uplink (UL) and downlink (DL) traffic (without processing it) to/from a central entity called Network Server (NS), which is the mastermind of the network [2]. The reasons for LoRa's success are multiple, spanning from the cheap hardware and fast roll-out of deployments to its open protocol stack which allows researchers to dive into the specifications [3] and plugand-play with the technology. Besides the technical benefits, a large body of work is being fed by researchers in topics such as physical-layer aspects, network-layer aspects, possible improvements, and extensions to the standard [4].
In this paper, we introduce a novel platform for monitoring and management of LoRa access network called LoMM. The platform is powered by the open-source, software-defined 5G-EmPOWER radio access network (RAN) controller, 1 which is 1 https://5g-empower.io/ being continuously improved and extended by our research unit at Fondazione Bruno Kessler (FBK). The controller follows the principles of programming abstraction to model the fundamental aspects of wireless networks, namely state management, resource provisioning, network monitoring, and network reconfiguration, thus hiding the implementation details of the underlying wireless technology and providing programmers with expressive tools to control the state of the network [5]. Along with these principles, LoMM allows to move part of the functionality of the default, centralized backend of LoRa Wide Area Network (LoRaWAN) closer to the access network by, e.g., monitoring the status of the LoRa RGs and the wireless channels and implementing local strategies for network management and control. The main objective of our platform is allowing researchers to easily manage LoRa deployments, bring their concepts and algorithms into real networks, and monitor their impact on network performance. Some preliminary demonstration results as well as several examples of envisioned use cases of our platform will be provided to illustrate the benefits and versatility of LoMM.
The rest of the paper is organized as follows. In Section II, we provide an overview of the LoRa standard and review existing experimentation tools in the literature. Then, the functional and architectural design of the LoMM platform is presented in Section III, while the first experimental results are shown in Section IV. Various envisioned use cases of LoMM are described in Section V. The conclusion of this work and the envisioned ways forward are drawn in Section VI.

A. Brief Overview on LoRa and LoRaWAN Specifications
The term 'LoRa' specifically refers to the physical-layer modulation developed and patented by Semtech Corporation, thus it is the only closed feature of this LPWAN technology. The modulation is based on chirp spread spectrum [6], [7] and is designed to be extremely robust to interference on the crowded industrial, scientific, and medical (ISM) frequency bands as well as to allow EDs to reach the RGs even in very unfavorable channel conditions thanks to a very low sensitivity. Each ED utilizes i) a given channel within the unlicensed frequency bands and ii) a given spreading factor (SF) index (SF ∈ {7, ..., 12}) to reach one or more RGs.
On top of LoRa, an open protocol stack denoted as Lo-RaWAN is continuously being developed and maintained by the LoRa Alliance. 2 LoRaWAN defines three classes of EDs according to the ED type: i) Class A for battery-powered sensors, ii) Class B for battery-powered actuators, and iii) Class C for main powered actuators. The most interesting features of LoRaWAN are related to the category that entails the greatest challenges, i.e., Class A, and they are specifically related to the medium-access control (MAC) protocol and the Adaptive Data Rate (ADR) mechanism, which basically assigns SFs to EDs based on their radio channel conditions.
The LoRaWAN back-end is characterized by the Network Server (NS), which represents the core of network intelligence and manages all packets captured by RGs. The NS functionality is logically split into three parts: i) the home NS (hNS) which stores the various network profiles and has a direct relation with the Application Server (AS); ii) the serving NS (sNS), which control the MAC of the ED; and iii) the forwarding NS (fNS), which manages the RGs. In order to enable roaming of EDs across different operators and national deployments, 3 these three functionalities can be delegated by the hNS to the NS of the visited networks, depending on the type of roaming agreement [8]. The back-end includes also the Join Server (JS), which manages the security keys.

B. Using Off-the-Shelf Platforms for LoRaWAN Experimentation and Research
Most of the complexity of the LoRaWAN infrastructure lies in the back-end services. For LoRaWAN experimentation, currently there are basically two options for back-end implementation and deployment: For more control of network features, one can resort to opensource LoRaWAN NS stack solutions (option 2). ChirpStack 5 is currently a popular and complete solution, written in Go language, that provides open-source, ready-to-use components for LoRaWAN networks, such as Network, Application and Geolocation Servers. Other open-source solutions, but less complex, are the Gotthard's LoRaWAN server 6 , written in Erlang language, that merges together both the NS and the AS, and FloraNET, 7 written in Python. These back-end, opensource solutions can be installed either on private local servers or relying on available Cloud services like Azure and Google, which implement specific features supporting IoT deployment.
Above-mentioned solutions allow developers to rapidly deploy LoRaWAN sensors and start data collection. However, researchers who need to explore network management features and latest standard's features in deeper have no rapid development solution yet. While it is, of course, possible to adapt open-source software for research needs, it can become rapidly an overwhelming, thus time-consuming, activity.

C. Our Contribution
The core of this paper resides in the development of a novel platform (LoMM) for network management of IoT networks based on LoRaWAN. The modular design of LoMM allows to distribute the management and control of EDs from the remote back-end to an edge back-end, offloading the centralized back-end architecture from tasks that can be performed in a decentralized manner, thus tailoring the network configuration to the actual network deployment. Researchers and experts can easily leverage this tool to manage their own LoRaWAN testbeds [9], [10], and implement dedicated algorithms and policies for network management while monitoring their effect on network performance. Moreover, the capability of accessing radio network information from real deployments allows to apply smart data analytic methods, eventually powered by machine-learning (ML) engines, with the aim of drawing insights about network behavior and anomalies so that proper countermeasures can be taken promptly.

III. LOMM PLATFORM DESIGN
LoMM leverages, and extends, the 5G-EmPOWER framework to create a platform capable of supporting LoRaWAN experimentation and research. 5G-EmPOWER is a softwaredefined RAN controller that can manage full-capability real hardware of mobile networks, i.e., cellular base stations, and wireless local area networks (WLANs), i.e., Wi-Fi access points. The flexible design of 5G-EmPOWER allows to integrate additional radio access technologies (RATs), de-facto extending its range of application. In this context, LoMM extends the current capabilities of 5G-EmPOWER by introducing the support of LPWANs -in particular, of LoRaWAN.

A. LoMM Functional Design
From the topological point of view, LoMM is positioned between the LoRa RGs and the LoRaWAN back-end infrastructure, with the purpose of monitoring, collecting and analyzing data, managing the LPWAN at the edge. As a matter of fact, LoMM mainly operates at the physical layer, being the role of LoRa RGs that of decoding UL packets from the air and forwarding them unprocessed to the NS as well as executing network management instructions coming from the NS.
As far as LoRaWAN architecture is concerned, the role of the LoMM platform changes according to the management level agreement (MLA) between the remote back-end and the edge back-end that is required by the user. Specifically, the LoMM platform supports two solutions: i) a standalone mode with basic networking capability and ii) a proxy mode. In standalone mode, LoMM implements the logical functionality of a sNS, thus it is able to instruct the RGs through appropriate MAC commands, while it relies on off-the-shelf platforms for the remaining components of the remote back-end. On the other hand, in proxy mode, the entire back-end is implemented on a remote, off-the-shelf platform, and LoMM analyzes the incoming/outgoing network traffic from/to the RG without interfering with the hNS procedures.
Based on the previous considerations, the functional design of LoMM is shown in Fig. 1, in both the standalone variant (Fig. 1a) and the proxy variant (Fig. 1b). We finally remark that, if a specific deployment LoMM is used only for monitoring and data collection purposes, LoMM can be configured to be used even without further LoRaWAN backend infrastructure.

B. LoMM Architectural Design
The software architecture of the LoMM platform leverages the 5G-EmPOWER runtime core for its basic operations (e.g., management application program interface (API), user management, REST interfaces), while, for LoRaWAN-related functionality, it implements custom software modules. LoMM's design takes into account the following requirements.
• Rapid prototyping of new research ideas. While it is easy to enter in the IoT world, thanks to the availability of low-cost and easy-to-program sensors (think at, e.g., the LoRaWAN module for BBC micro:bit 8  We also want to remark that the LoMM design approach has the additional advantage of allowing to leverage the 5G-EmPOWER framework core functionality (i.e., cellular base 8 https://uk.pi-supply.com/products/iot-micro-bit-lora-node stations and Wi-Fi access points management and programmability) to conduct multi-RAT experimentation of cross-RAT features like, e.g., network slicing. A graphical representation of the LoMM platform architecture is provided in Fig. 2. An open-source version of LoMM is available online at https://gitlab.fbk.eu/lomm. In the following, the implementation details of LoMM are described.
1) Southbound Interface Towards LoRaWAN RGs: LoMM enriches the 5G-EmPOWER capability with a southbound interface (SBi) implementing the new Semtech's Basic Station LNS protocol (based on WebSockets). 9 LoMM provides also a SBi and server to manage the Semtech's NS Discovery Protocol. All the interactions with the LoRaWAN RGs happen through the LoMM SBi, which generates events for every significant LoRaWAN event, e.g., new RG connection/disconnection, new data packet arrivals, join procedures.
2) Northbound Interface for LoMM Management: A northbound interface (NBi) towards third-party software for accessing the LoRa data and controller is also available. The NBi consists of a set of APIs that allow to manage LoMM data, e.g., adding/removing RG data, as well as users and projects.
3) LoMM Framework Apps: LoMM framework provides a number of already developed apps, that can be loaded as needed. Two fundamental apps are used to implement the two architectural variants of LoMM in Fig. 1: • the Edge sNS App, which implements the functionalities of a sNS and supports the connection to a remote backend for functionalities such as authentication of nodes and AS. This app is the access point for implementing MAC functionalities, e.g., ADR algorithms and acknowledgement policies (confirmed/unconfirmed traffic); • the Proxy App, which acts as a proxy to a NS. At the moment, it implements the Semtech's UDP Packet Forwarder Protocol, 10 but we plan to extend it to connect also to other architecture. Besides these, other apps have been developed to add further functionalities to LoMM:

4) APIs for LoRaWAN App Development:
LoMM gives to the researcher the possibility of creating his/her own apps, using the LoMM APIs and leveraging the implementation of event-driven callbacks or monitoring loops for adding functionalities or services to the platform. In LoMM, the API allows to interact with the RG through the SBi, e.g., to send DL messages to the RG and request statistics, and to react at application level to various events triggered by the LoRaWAN network (e.g., at the reception of a new packet, new RG connection, or new join request by a ED). Within a LoMM app, for each LoRaWAN event, a customized callback can be invoked. Apps can be combined, supporting software reuse and exchange.
IV. PRELIMINARY DEMONSTRATION In the following, some preliminary demonstration results of the LoRaWAN monitoring capability obtained from the LoMM platform are shown. We consider a testbed consisting of an in-the-wild LoRaWAN deployment, entailing: 1) an owned LoRaWAN deployment located within the FBK premises, which includes a single RG and 2 EDs operating on the EU863-870 frequency band; 2) another incumbent LoRaWAN network deployment. The results have been collected through a measurement campaign carried out across November and December 2019.
As a first outcome of the monitoring capability of LoMM, we were able to reveal the presence of the incumbent Lo-RaWAN network deployment, realizing that it consisted of 3 EDs falling in the coverage area of our RG. Then, following the example of the technical report [11], we collected statistics on the following performance figures: RSSI, SNR, data rate (DR) (defined as the pair of a SF index and the utilized transmission bandwidth, as per LoRaWAN regional parameters specifications for the EU863-870 band [12, Tab. 5]), and channel utilization. In particular, Fig. 3 shows the probability mass function (PMF) of the RSSI. It is easy to spot two RSSI clusters centered at approximately −30 dBm and −65 dBm, which correspond to our owned deployment and the incumbent deployment, respectively. Fig. 4 shows the empirical cumulative distribution function (ECDF) of the SNR; it is evident that all EDs are in quite good channel conditions, as the average SNR is quite high. Fig. 5 provides interesting information regarding the SF allocations. From our experiments, it turns out that DR0 (SF12), DR4 (SF8), and DR5 (SF7) are utilized by EDs. The predominance of DR5 is a further confirmation of the good coverage conditions. Finally, we show the PMF of the utilized channels in the EU863-870 band, discovering that the three default LoRa channels (centered at 868.1, 868.3, and 868.5 MHz) are almost equally exploited. This is due to  the frequency hopping [13] implemented by some of the EDs (as revealed by the data, but not in these plots).

V. ENVISIONED USE CASES OF LOMM
We can think of several use cases of LoMM in the context of LoRaWAN network management. First of all, the platform can be exploited to optimize RAN-related parameters of LoRabased IoT networks. Indeed, one of the most challenging aspects of LoRaWAN management resides in the selection of the most suitable configuration (in terms of, e.g., DR, code rate, power back-off, number of transmission attempts) of the EDs under the control of the sNS [14]. In particular, we recall that the SF index selection and transmit power setting are achieved through the ADR procedure, which is managed by the sNS via apposite MAC commands. However, the default ADR algorithm does not behave properly in all conditions, e.g., it lacks the agility to adapt to the changing link conditions, requiring (in the best case) some hours to converge to a reliable and energy-efficient communication state [15], [16]. Therefore, since LoMM provides APIs to trigger LoRaWAN MAC commands, the researchers can implement ADR algorithms and parameter optimization policies in LoMM in order to test their effectiveness in a real deployment. Examples of custom ADR policies entail, e.g.,  • implementing solutions of optimization problems which aim at maximizing the packet success probability in the network [17]; • equalizing the SF utilization in the network [16] as well as balancing the received signal strength in order to achieves data rate fairness among EDs [18]; • pre-processing of radio measurements in order to maximize the precision of the channel estimate based on which the SF assignment is performed [19]. Other than facilitating the initial network configuration, the monitoring capability of LoMM can be leveraged to statistically characterize the traffic generated from and towards the LoRa network, exploiting the methods described in [20], thus giving rise to a number of applications that are now able to exploit the knowledge of network traffic, both in the RAN and in remote back-end. Regarding the RAN, the identification of UL traffic patterns allows to optimize sensing intervals, as proposed, e.g., in [21], and/or to design optimal parameter selection heuristics, as discussed in [16], [22]. As for the backend, we could exploit the monitor to measure the performance of the connectivity towards the remote back-end blocks, i.e., the hNS, AS, and JS for prompt fault detection or to implement network resilience strategies like, e.g., proactive buffering of DL traffic or instantiation of redundant connection towards the remote back-end.
Another use case consists in processing RAN-related information to improve the network operations and to detect network anomalies. For example, in [23] a methodology to process LoRaWAN packets and perform profiling of the EDs according to their radio and network behavior via ML (in particular, exploiting k-means) is proposed. Other than verifying a correct network behavior, the final objective is that of triggering alerts on malfunctioning EDs. Such malfunctioning may derive not only of ED failures, but also due to security attacks. In fact, despite some literature studies focus on securing LoRaWAN architecture [24], security threats on RAN entailing, e.g., jamming of [25] are little treated. LoMM could be leveraged to implement local strategies to detect and react to such attacks.

VI. CONCLUSION AND FUTURE WORK
In this paper, we presented the design of a monitoring and management platform for LoRaWAN experimentation called LoMM. The platform is powered by the 5G-EmPOWER RAN controller and its aim is to fill the gap between research and real implementation, allowing researchers to implement network management strategies and verify their impact on network performance. Moreover, the monitoring feature of LoMM is suitable to inspect and analyze radio network information through ML models, yielding interesting applications. A prominent example of how to exploit the monitoring feature is related to LoRaWAN security and consists of the detection of anomalies in the behavior of the EDs in order to enable a prompt network reconfiguration.
As future work, we plan to enrich the LoMM platform to include additional functionalities through new apps like ED testing against conformance tests according to LoRaWAN standard, interfacing to ML algorithms for network optimization or anomaly detection algorithms, and network diagnostics, e.g., duty-cycle measurements, jamming, or energy attacks detection.