ZigBee security
Implementing security on the XBee/XBee-PRO ZigBee RF Module
XBee/XBee-PRO® S2C ZigBee® RF Module
107
only decrypted by the destination device. The XBee/XBee-PRO ZigBee RF Module must be configured
with security enabled (
EE
set to 1) to use APS encryption.
APS encryption can be enabled in API firmware on a per-packet basis. To enable APS encryption for a
given transmission, set the "enable APS encryption" transmit options bit in the API transmit frame.
Enabling APS encryption decreases the maximum payload size by nine bytes.
Use a trust center
Use the Encryption Options (
EO
) parameter define the coordinator as a trust center. If the coordinator
is a trust center, it received alerts to all new join attempts in the network. The trust center also has
the ability to update or change the network key on the network.
In ZB firmware, you can establish a secure network with or without a trust center. Network and APS
layer encryption are supported regardless of whether you use a trust center.
Updating the network key with a trust center.
If the trust center has started a network and the
NK
value changes, the coordinator updates the
network key on all devices in the network. Changes to
NK
will not force the device to leave the
network. The network continues to operate on the same channel and PAN ID, but the devices in the
network update their network key, increment their network key sequence number, and restore their
frame counters to 0.
Updating the network key without a trust center.
If the coordinator is not running as a trust center, the Network Reset (
NR1
) command can be used to
force all devices in the network to leave the current network and rejoin the network on another
channel. When devices leave and reform then network, the frame counters are reset to 0. This
approach causes the coordinator to form a new network that the remaining devices should join.
Resetting the network in this manner brings the coordinator and routers in the network down for
about ten seconds, and causes the 16-bit PAN ID and 16-bit addresses of the devices to change.
In ZigBee firmware, a secure network can be established with or without a trust center. Network and
APS layer encryption are supported regardless of whether a trust center is used.
Security examples
This section covers some sample XBee device configurations to support different security modes and
lists several
AT
commands with suggested parameter values.
In
AT
command mode, issue each command with a leading 'AT' and no '=' sign: For example, EE1. In
the API, the two byte command is used in the command field, and parameters are populated as binary
values in the parameter field.
Example 1: Forming a network with security (pre-configured link keys)
1. Start a coordinator with the following settings:
a.
ID
= 2234 (arbitrarily selected)
b.
EE
= 1
c.
NK
= 0
d.
KY
= 4455
e.
WR
(save networking parameters to preserve them through power cycle)