1. Introduction
The Zigbee Smart Energy (SE) profile is a framework specifically designed for energy management applications. Devices following the SE profile can interoperate in energy management systems, providing utilities and consumers with tools to monitor and optimize energy usage. Because of the type of data and control within the SE network, application security is a key requirement. The application will use link keys which are optional in the ZigBee and ZigBee Pro stack profiles but are required within a SE network.
2. Installation Code
During the manufacturing process, a random Installation Code is created for each of the SE devices. The associated Pre-configured Link Key is derived using the hashing function Matyas-Meyer Oseas (MMO) and programmed in the device.
More information about the Installation Code can be found in the Zigbee Install Code.
Link keys of the devices that need to join the network should be added to the Trust Center using the following API:
/* On Trust Center, add a TC Link Key derived from the given install code */
ZbSecAddDeviceLinkKeyByInstallCode( stZigbeeAppInfo.pstZigbee, dlPartnerExtendedAdress, (uint8_t *)szLinkKeyInstallCode , ZB_SEC_KEYSIZE + 2 );
3. Zigbee Key Establishment (ZKE) cluster
ZKE cluster is a cluster for managing secure communication in ZigBee. It’s used to establish a shared secret key between two devices, which can then be used to encrypt and decrypt messages exchanged between them.
The ZKE cluster uses a combination of asymmetric and symmetric key cryptography to establish and distribute keys. At the end of the process, both nodes will have shared secret key. It is used to encrypt and decrypt messages exchanged between them.
Key agreement scheme is the process of establishing the shared secret key without sending it over the air. It is done between an Initiator, who starts the process, and a Responder.
There are 2 types of key agreement:
- Symmetric Key Key Establishment (SKKE).
- Public Key Key Establishment (PKKE).
PKKE involves the exchange of public keys, which can be static (long-term) or ephemeral (temporary), to mutually authenticate devices and establish a shared secret key for secure communications.
The device's static public key can be transported independently, so relying on an implicit trust, or as part of a implicit certificate signed by a Certificate Authority (CA), which is called Certificate-Based Key Establishment (CBKE).
If using CBKE, static public keys Su and Sv are exchanged and verified using the CA's public key.
In Zigbee Smart Energy, CBKE is a critical component for ensuring that the devices are who they claim to be.
The following Figure illustrates the 5 steps of PKKE process.
| General Exchange for PKKE |
|---|
 |
4. Certificate-Based Key Establishment (CBKE)
The Certificate-Based Key-Establishment (CBKE) is considered to be a variant of PKKE.
The Certificate-Based Key-Establishment (CBKE) solution uses public-key technology with digital certificates and root keys. Each device has a static public key and a digital certificate that is signed by a Certificate Authority (CA).
Certificates provide a mechanism for cryptographically binding a public key to a device's identity and characteristics.
5. CBKE Application
In a Normal Scenario the Coordinator act as a Trust Center and CBKE is activated by filling CBKE startup configuration at both Ends, End device and the coordinator.
The CBKE startup Configurations are filled in the struct ZbStartupCbkeT of struct ZbStartupT used for startup. Some important fields of ZbStartupCbkeT are defined as follows:
/** CBKE configuration parameters for ZbStartup. This configuration is only
* applicable if the 'suite_mask' is non-zero. */
struct ZbStartupCbkeT {
uint8_t endpoint;
/**< Endpoint to assign ZCL Key Exchange cluster. Default is ZB_ENDPOINT_CBKE_DEFAULT (240) */
uint16_t deviceId;
/**< Device Id to assign to the endpoint created for the ZCL Key Exchange cluster.
* Default is ZCL_DEVICE_METER */
uint16_t suite_mask;
/**< The Key Exchange suite bitmask. E.g. ZCL_KEY_SUITE_CBKE2_ECMQV for CBKE version 2 (cbke_v2). */
struct ZbZclCbkeInfoT cbke_v1;
/**< CBKE version 1 certificate and security keys configuration.
* Only applicable if ZCL_KEY_SUITE_CBKE_ECMQV is set in suite_mask. */
struct ZbZclCbke2InfoT cbke_v2;
/**< CBKE version 2 certificate and security keys configuration.
* Only applicable if ZCL_KEY_SUITE_CBKE2_ECMQV is set in suite_mask. */
...
};
