Trust Center; Forming Or Joining A Secure Network; Implement Security On The Xbee/Xbee-Pro Zigbee Rf Module - Digi XBee-PRO S2C Zigbee User Manual

Zigbee security

Trust center

Zigbee defines a trust center device that is responsible for authenticating devices that join the
network. The trust center also manages link key distribution in the network.

Forming or joining a secure network

The coordinator is responsible for selecting a network encryption key. This key can either be
preconfigured or randomly selected. In addition, the coordinator generally operates as a trust center
and must select the trust center link key. The trust center link key can also be preconfigured or
randomly selected.
Devices that join the network must obtain the network key when they join. When a device joins a
secure network, the network and link keys can be sent to the joining device. If the joining device has a
preconfigured trust center link key, the network key will be sent to the joining device encrypted by the
link key. Otherwise, if the joining device is not preconfigured with the link key, the device could only
join the network if the network key is sent unencrypted ("in the clear").
The trust center must decide whether or not to send the network key unencrypted to joining devices
that are not preconfigured with the link key. We do not recommend sending the network key
unencrypted as it can open a security hole in the network. To maximize security, preconfigure devices
with the correct link key.

Implement security on the XBee/XBee-PRO Zigbee RF Module

If you enable security in the XBee Zigbee firmware, devices acquire the network key when they join a
network. Data transmissions are always encrypted with the network key, and can optionally be end-
to-end encrypted with the APS link key.
XBee/XBee-PRO® S2C Zigbee® RF Module
Implement security on the XBee/XBee-PRO Zigbee RF Module
105