Digi XBee, Руководство пользователя, Страница: 102 / 307

ZigBee security Security modes
XBee/XBee-PRO® S2C ZigBee® RF Module 102
Security modes
The ZigBee standard supports three security modes: residential, standard, and high security.
n
Residential security requires a network key be shared among devices.
n
Standard security adds a number of optional security enhancements over residential security,
including an APS layer link key.
n
High security adds entity authentication and a number of other features not widely
supported.
XBee ZB modules primarily support standard security, although end devices that support residential
security can join and interoperate with standard security devices. This section focuses on material
that is relevant to standard security.
ZigBee security model
ZigBee security is applied to the Network and APS layers. Packets are encrypted with 128-bit AES
encryption. A network key and optional link key can be used to encrypt data. Only devices with the
same keys are able to communicate together in a network. Routers and end devices that will
communicate on a secure network must obtain the correct security keys.
Network layer security
The network key is used to encrypt the APS layer and application data. In addition to encrypting
application messages, network security is also applied to route request and reply messages, APS
commands, and ZDO commands. Network encryption is not applied to MAC layer transmissions such
as beacon transmissions. If you enable security on a network, all data packets are encrypted with the
network key.
Frame counter
The network header of encrypted packets includes a 32-bit frame counter. Each device in the network
maintains a 32-bit frame counter that increments for every transmission. In addition, devices track
the last known 32-bit frame counter for each of its neighbors. If a device receives a packet from a
neighbor with a smaller frame counter than previously seen, it discards the packet. The device uses
the frame counter to protect against replay attacks.
If the frame counter reaches a maximum value of 0xFFFFFFFF, it does not wrap to 0 and cannot send
any more transmissions. Due to the size of the frame counters, reaching the maximum value is