Ambient IoT — a tag with no battery

Ambient IoT is a way for a mobile network to talk to tags that have no battery. They run on energy harvested from radio waves, light, movement or heat, and they answer only when they happen to have enough power to answer. It is a system rather than a gadget, and the tag is its cheapest part.

Four jobs, and everything else is one of them:

• Inventory — find out what goods are in an area. Each tag reports an identifier, possibly with status, a measurement or a location beside it.

• Sensor data collection — the tag carries a sensor, and the reading is either fetched or sent when the device has power.

• Asset tracking — the identifier is put together with location information to work out where something is.

• Actuator control — the tag is attached to something that acts, and the network sends it commands.

A real place: a car plant, tags on the parts and readers bolted to the building. The industries named beside the four are smart manufacturing, logistics and warehousing, smart grid, agriculture and the smart home.

1. An application asks the network's front door for an inventory, naming itself and, if it wants, an area and which tags.
2. The front door checks the application may ask, and picks the Ambient IoT Function that will run the job.
3. That function makes a Correlation ID, opens a session under it, and fetches security material from the credential store.
4. It swaps permanent identifiers for temporary ones where privacy is on, then chooses the base station and the readers.
5. Accept or reject travels back to the application at once, before anything is sent over the air.
6. The readers broadcast a page carrying the identification information and the security material that goes with it.
7. The page opens a set of slots; every matching tag rolls a die for one and makes up a random number of its own.
8. The reader echoes those numbers back, and a tag that hears its own has won the slot and keeps it as its address.
9. That tag sends its report: its random number, and a value proving it knows its long-term key.
10. The base station passes reports up with the Correlation ID and which reader saw each tag, marking the last one complete.
11. The function authenticates each tag, recovers its permanent identifier, releases the session and tells the application.

Read out of clauses 4.2.1.3, 4.2.1.4 and 4.2.2.3 of TS 33.369 TS 33.369, the security specification for Ambient IoT.

NEA0 is the null cipher, so supporting it is supporting the option of no encryption at all.

Four more things the specification writes down and does not fix:

• Authentication runs one way. The device is always authenticated. Nothing lets it check who is paging it.

• There is no replay counter. The counter fed to the protection algorithms is all zeros.

• Re-paging. An attacker pages a device in the middle of a procedure, and no measure against it is specified.

• Amplification. Page everything, and the network drowns in answers it never asked for. No measure against that is specified either.

All four are written down in TS 33.369, clauses 5.2.2 and 5.3.3.

The Ambient IoT documents in reading order, and what each one answers.

• TS 22.369 — what the system is for.
• TR 22.840 — the use cases behind it, with numbers attached.
• TR 38.848 — where the device classes and topologies were defined. No parsed copy of it is on this machine, and everything downstream points at it rather than restating it.
• TR 38.769 — can a radio do this, and at what power.
• TR 23.700-13 — the architecture options studied, and the conclusions that became the system.
• TS 23.369 — the system as built. The centre of the chain.
• TS 38.300 — the radio's own overview (clause 16.23 of TS 38.300).
• TS 24.369 — the messages between device and core.
• TS 33.369 — who the device is, who may read it, who may silence it.
• TS 23.003 — the bit layout of every identifier, in its clause 31.
• TS 29.522 — the interface an outside application calls (clause 5.45 of TS 29.522).