Vimar 0072031B45CB, Руководство по установке, Страница: 10 / 32

10
2. KNXnet/IP
The presence of the Internet Protocol (IP) has led to the definition of the KNXnet/IP protocol . As documented in the KNXnet/IP protocol specifications, KNX telegrams can
be transmitted encapsulated in IP packets . Ethernet networks can be used to route and tunnel KNX telegrams .
KNX IP routers are highly similar to TP line couplers . Only difference is they use the IP communication medium instead of TP and the KNXnet/IP communication protocol .
According to this, IP interfaces and IP routers are an excellent alternative to USB data interfaces and TP line/area couplers . A TP backbone can be completely be replaced
by a fast Ethernet based IP Backbone line . KNX end devices can be integrated directly via IP . This makes the Ethernet a real KNX medium .
2.1 IP (Secure) Tunneling
KNXnet/IP offers the possibility for point-to-point connections for the ETS (IP Tunneling connections) or, for example, between supervisory system and KNX installation .
On activation of “Secure Tunneling”, these connections become IP Secure Tunneling connections . They are protected by encryption and usage of extra passwords .
2.2 IP (Secure) Routing
IP Routing is the KNXnet/IP protocol for interconnecting KNX lines and areas by IP networks . Hereby, the KNXnet/IP protocol defines the KNX IP communication . Using
IP Secure Routing means runtime communication on KNX IP is entirely encrypted according to the KNX IP Secure mechanism .
2.3 IP Firmware Update
The IP bootloader function makes it possible to remotely carry out Firmware Updates and rewrite the flash memory content via an IP connection . This is not just a simple
application download . Both communication stack and application software are downloaded .
The Firmware Update procedure via IP can be executed by 01548´s web front-end, which is independent from ETS, and makes use of special messages to speed up
the process . To be protected, this process makes use of a special encryption .
3. KNX Secure
The KNX Secure technology adds extra security to a KNX installation, during commissioning as well as for KNX installations at runtime . Difference between normal KNX
devices and KNX Secure devices is KNX Secure devices have the ability to encrypt and decrypt telegrams .
Every KNX Secure device supports a secure mode . Only when this secure mode is activated, the KNX Secure device will be able to encrypt/decrypt telegrams . For activation,
device certificates are necessary (see chapter 1 .5 Secure Commissioning) .
KNX telegrams encrypted by KNX Secure devices are called KNX Secure telegrams . Regarding both KNX Security mechanisms, KNX IP Secure and KNX Data Secure, two
types of encryption can be distinguished:
• KNX IP Secure can only be applied upon the KNX IP medium . KNX telegrams are sent as encrypted IP Secure frames, also called entirely encrypted telegrams (no matter
if KNX Data Secure is used or not) .
• KNX Data Secure can be applied on any KNX communication medium . End-to-end communication between end devices is encrypted . Due to an individual security key,
end devices encrypt/decrypt parts of their telegrams . Then, only devices having identical Group Addresses can encrypt/decrypt the telegrams .
For programming a KNX Secure device, ETS must know both its factory key (FDSK) and its serial number . But it is not necessary entering factory key or serial number . The
ETS generates this information from the Device Certificate .
A Device Certificate is a device-specific 32-character code which contains serial number and FDSK (Factory Default Setup Key) . Serial number and FDSK cannot be modified .
ETS retrieves the FDSK via the device certificate (see chapter 1 .5 Secure Commissioning) .
After a KNX Secure device has been added to an ETS project and after its Device Certificate has been added too, ETS automatically sets the Tool Key for the project . This
Tool Key cannot be modified . It can only be reset to its FDSK by a Factory Reset (see chapter 4 .6 .2 Factory Reset) .
Mixing unsecure and secure communication on the same Group Address is impossible .
A mix of KNX IP Secure couplers in secure mode with KNX IP Secure devices in plain mode, or simply plain KNX IP devices, does not work .
KNXnet/IP - KNX Secure