LoPhy: A Resilient and Fast Covert Channel over LoRa PHY

Covert channel, which can break the logical protections of the computer system and leak confidential or sensitive information, has long been considered a security issue in the network research community. However, recent research has shown that cooperative agents can use the "covert" channel to augment the communication of legitimate applications, rather than by adversaries seeking to compromise computer security. This further broadens the potential applications of covert channels. Despite this, the design and implementation of covert channels in the context of Low Power Wide Area Networks (LPWANs) have not been widely discussed. Current state-of-the-art uses On-off keying (OOK) on LoRa PHY to create a covert channel, but this channel has limited transmission distance and capacity. In this paper, we propose LoPhy, a resilient and fast covert channel over LoRa physical layer (PHY). LoPhy uses the Chirp Spreading Spectrum (CSS) modulation scheme to increase its resilience and explore the trade-off between the covert channel's capacity and the legitimate channel's resilience. We implement the proposed covert channel on off-the-shelf devices and software-defined radios and show that LoPhy achieves a 0.57% bit error rate at a distance of 700m without affecting the legitimate channel's performance. Moreover, we present two applications enabled by LoPhy to demonstrate the potential of LoPhy. Compared with the state-of-the-art, LoPhy brings up to 18x reduction of bit errors and 63x gain on noise resilience.