Page
25
of
60
©
2019 Radiocrafts AS
MBUS User Manual (ver 2.01)
MBUS USER MANUAL
6 Encryption and decryption
The module supports AES-128 encryption for both extended link layer (ELL) encryption and transport layer (TPL)
encryption.
6.1 Key exchange
When a slave is produced, it is normally programmed with a unique ID and a corresponding unique key. These ID-
key pairs must be kept in a central database.
When a slave requests to be installed at a gateway, the gateway host MCU must request the encryption key from
the central utility data base. This is done over a secure connection. The host MCU then programs the key for the
slave into the same register location number as is used for installing the slave ID. The
‘K’-command is used for this.
The slave must have its own key installed at register location number 0x01.
Figure 13
– Encryption key lookup
6.2 Enabling Encryption and decryption
When the key is registered on the master side, the slave and master can start using encryption.
Two conditions needs to be met for encryption and decryption to take place:
1. Encrypt or decrypt flag (or both) needs to be set in the flag register for each slave that requires encryption.
For the gateway the flag register corresponding to that particular slave needs to be used. On the slave side
register number 1 must be used.
2. Encryption needs to be defined in the packet header when sending the packet to the RC1xxx-MBUSx
module. Here there are two options, and how encryption is defined is slightly different for the two options.
o
Link Layer Encryption
o
Transport Layer Encryption
6.3 The flag register
There are two configuration parameters in NVM named ENCRYPT and DECRYPT. These will set the
encrypt/decrypt flags in the flag registers for all register location numbers when the device is booted. The flag
registers are in RAM and are also referred to as auto-message flag register
s. They can be edited with the ‘A’-
command.
6.4 Link Layer Encryption
If you want to use Link Layer encryption, you need to use the Extended Link Layer (ELL).
If both Link Layer encryption and Transport Layer Encryption is defined
– LinkLayer encryption will be used.
The ELL encryption mode 1, uses the counter mode (AES-128-CTR) and does not need any padding of data.
