Overview

Zigbee supports and single defined security mode called Standard Security, with various policies existing within this mode to control how devices behave or interact on the network. Zigbee implements security at the network and security layers only. 

Standard security, introduced in the Zigbee 2007 specification along with Zigbee PRO, is the security model being used in all Zigbee application profiles and in Zigbee 3.0. It is the only security model supported by the EmberZNet stack libraries.

Standard security uses network keys and link keys to encrypt data at the network and application layers, respectively. The application support (APS) layer security allows the trust centre to securely transport the network key to joining or rejoining nodes, and it optionally allows applications to add additional security to their messages.

Network (NWK) layer security is used to secure all traffic sent on a Zigbee network, with the exception of basic MAC layer communication such as association, data requests (polling), and MAC ACKs.

Network Layer Security

The trust centre may periodically update and switch to a new network key. The trust centre may use either a broadcast update or a unicast update. In the broadcast case, the trust centre first broadcasts a new network key encrypted with the old network key. In the unicast case, the trust centre sends a new network key to each device encrypted with that device’s corresponding Trust Centre Link Key. 

In both cases, the trust centre later tells all devices to switch to using the new network key. The new network key has a sequence number that is one higher than the last sequence number.

Authentication and Encryption

Zigbee uses a 128-bit symmetric key to encrypt all transmissions at the network layer using AES-128. The network and auxiliary headers are sent in the clear but authenticated, while the network payload is authenticated and encrypted.

AES-128 is used to create a hash of the entire network portion of the message (header and payload), which is appended to the end of the message. This hash is known as the Message Integrity Code (MIC)(4-bytes) and is used to authenticate the message by insuring it has not been modified. A receiving device hashes the message and verifies the calculated MIC against the value appended to the message.

Alterations to the message invalidate the MIC and the receiving node will discard the message entirely.

Table 1. MIC Generation

The Network Security Frame Counter

A frame counter is included in the auxiliary headers as a means of protecting against replay attacks. All devices have their own outgoing frame counter and they maintain a list of their neighbour's and children's frame counters. The frame count is 32 bits and may not wrap to 0. The network key must be updated before the Frame Counter reaches it's max value.

Unencrypted Network Data

All normal network packets are required to have network security and a valid frame counter. The only exception for this is during joining the join mechanism, when devices do not yet have the network key. In that case a joining device's messages are relayed through its parent until it is fully joined and authenticated. Any other messages that are received without network layer security are silently discarded.

Trust Centre Networks

APS Layer Security

This section describes how Zigbee implements security at the Application Support (APS) layer.

End-to-End Security

APS security is intended to provide a way to send messages securely within a Zigbee network such that no other devices on the network can decrypt the data except the source and destination. This is different than network security, which provides only hop-by-hop security. In hop-by-hop security, every device that is part of the network and hears the packet being relayed to its destination, decrypts it.

APS security uses a shared key that only the source and destination know about, thus providing end-to-end security.

Both APS layer and network layer encryption can be used simultaneously to encrypt the contents of a message. In that case APS layer security is applied first, and then network layer security.

A packet secured at the APS layer is composed of the following elements:

                                                                    |------------------------------------------------------- Authenticated -----------------------------------------|

                                                                                                                          |----------------- Encrypted -----------------|                                         

Link Keys

APS security uses a peer-to-peer key known as the link key. Both devices must have already established this key with one another before sending APS-secured data.

There are two types of link keys:

1. Trust Centre Link Keys
2. Application Link Keys

Trust Centre Link Keys

Link key for when one of the devices is the Trust Centre. The stack uses this key to send and receive APS command messages to and from the trust centre. The application may also use this key to send APS-encrypted data messages. All devices in a Zigbee network must have link keys. The trust centre link key is used in these cases:

1. Encrypting the initial transfer of the network key to a joining node.
2. Encrypting an updated copy of the network key to a rejoining node that does not have the current network key.
3. Routers sending or receiving APS security messages to or from the trust centre. These may be updates informing the trust centre of a joining or rejoining node, or a command sent by the trust centre to a router to perform some security function.
4. Application unicast messages that enable APS encryption, where either the sending or receiving device is the trust centre.

The trust centre has the option of deciding how to manage the trust centre link keys. It may choose unique keys for each device in the network, keys derived from a common piece of shared data (the IEEE address of the device), or a global key that is the same for all devices in the network. Trust centre link keys may also be negotiated at the application layer using a key establishment protocol like Certificate-Based Key Establishment (CBKE).

Application Link Keys

Application link keys are shared keys that may be established between any two nodes in the network, where neither device is a trust centre. They may be used to add additional security to messages being sent to or from the application running on a node. Devices can have a different application link key for each device with which they communicate.

A device may preconfigure an application link key or request a link key between itself and another device. In the latter case it issues a request to the trust centre encrypted with its trust centre link key. The trust centre acts as a trusted third party to both devices, so they can securely establish communications with one another.