Technical Manual – IP Router SCN-IP100.03
MDT technologies GmbH •
51766 Engelskirchen • Papiermühle 1
Tel.: +49-2263-
880 • Fax: +49-2263-4588 • [email protected] • www.mdt.de
14
14
3 Safety – IP Secure/Data Secure
3.1 Safety mechanisms – IP Secure/Data Secure
KNX Data Security distinguishes between two mechanisms: IP Secure and Data Secure.
KNX IP Secure
allows to encrypt and to authenticate messages sent by KNX devices to transmit them
securely over the IP layer. This ensures that KNX tunneling or routing messages on IP cannot be read
or manipulated. KNX IP Secure forms an additional "security shell" that protects the complete
KNXnet IP data traffic.
KNX Data Secure
enables the secure commissioning of devices that support data security and the
encrypted transmission of group addresses between two devices that support Data Secure.
For 2 devices to communicate securely with Data Secure, both devices must support Data Secure.
However, it is also possible for a Data Secure device to communicate with a device that does not
support Data Secure. In this case, however, only via an unsecured connection.
3.2 Basic terms
3.2.1 FDSK
Every Secure device is delivered with the "Factory Device Setup Key" (FDSK). The system
integrator/installer enters this key into the ETS, which generates a device-specific tool key from it.
The ETS sends the tool key via the KNX bus to the device to be configured. This transmission is
encrypted and authenticated with the FDSK key. After this initial commissioning, the device only
accepts the received tool key. The FDSK is no longer required for further transmission - unless the
device is reset via the master reset.
After initial commissioning, the FDSK of all devices in a project should be detached from the device
sticker and stored in a project-specific manner. The IP interface has two FDSKs for each application
one, therefore you will find two different keys on the right and left side of the interface.
3.2.2 Secured Mode - Secure Mode
If a device is parameterised in such a way that it only transmits encrypted data, this is known as
secure mode.
3.2.3 Non-secured mode - Plain Mode
If a device is parameterised in such a way that it only transmits in unencrypted form, this is known as
non-secured mode (plain mode).
3.2.4 Backbone Key
If a KNX bus is connected to Data Secure via 2 IP Routers, they communicate encrypted with the
backbone key. This key must be identical in all devices. The key is assigned independently by the ETS
and cannot be changed.
