Zigbee Security; Security Modes; Zigbee Security Model; Network Layer Security - Digi XBee S2C Zigbee User Manual

Zigbee security

Zigbee supports various levels of security that you can configure depending on the needs of the
application. Security provisions include:
128-bit AES encryption
n
Two security keys that can be preconfigured or obtained during joining
n
Support for a trust center
n
Provisions to ensure message integrity, confidentiality, and authentication
n
This section describes various security features defined in the Zigbee specification and illustrates how
you can configure theXBee/XBee-PRO Zigbee RF Modules to support these features.

Security modes

The Zigbee standard supports three security modes: residential, standard, and high security.
Residential security requires a network key be shared among devices.
n
Standard security adds a number of optional security enhancements over residential security,
n
including an APS layer link key.
High security adds entity authentication and a number of other features not widely
n
supported.
XBee ZB modules primarily support standard security, although end devices that support residential
security can join and interoperate with standard security devices. This section focuses on material
that is relevant to standard security.

Zigbee security model

Zigbee security is applied to the Network and APS layers. Packets are encrypted with 128-bit AES
encryption. A network key and optional link key can be used to encrypt data. Only devices with the
same keys are able to communicate together in a network. Routers and end devices that will
communicate on a secure network must obtain the correct security keys.

Network layer security

The network key is used to encrypt the APS layer and application data. In addition to encrypting
application messages, network security is also applied to route request and reply messages, APS
commands, and ZDO commands. Network encryption is not applied to MAC layer transmissions such
as beacon transmissions. If you enable security on a network, all data packets are encrypted with the
network key.
XBee/XBee-PRO® S2C Zigbee® RF Module User Guide
Security modes
121