ZigBee-2007安全核心解析

需积分: 10 81 浏览量更新于2024-07-24 收藏 858KB PDF 举报

"本文主要探讨了ZigBee-2007标准的安全核心要素，由Ender Yüksel、Hanne Riis Nielson和Flemming Nielson等专家撰写，来自丹麦技术大学的信息学与数学建模部门。ZigBee是一种资源需求较低但具有广泛应用前景的无线网络标准，尤其在安全方面扮演着重要角色。ZigBee的每个新版本都在提升其安全级别，ZigBee-2007是其中最新的规范。作者详细解释了ZigBee-2007中的关键概念、协议和计算过程，并用标准的协议叙述方式进行了表述，同时指出了在巩固ZigBee技术时需要考虑的关键挑战。" ZigBee-2007安全要点详解： 1. **密钥管理**：ZigBee-2007规范引入了更为复杂的密钥管理机制，包括设备间的对称密钥和网络密钥。这些密钥用于加密通信内容，确保数据在传输过程中的安全性。 2. **认证过程**：设备加入ZigBee网络前，必须通过认证过程，以防止未授权设备接入。ZigBee-2007使用了基于预共享密钥的认证协议，增强了网络的准入控制。 3. **加密算法**：ZigBee-2007支持AES-128（高级加密标准）加密，提供强大的数据保护，防止数据被窃听或篡改。 4. **网络安全层**：ZigBee-2007定义了网络安全服务，包括数据完整性检查、消息源验证和数据机密性，这些服务通过网络层协议实现，确保数据的完整性和来源的真实性。 5. **网络安全模式**：包括设备到设备的直接安全连接，以及通过路由器的间接安全连接。这些模式确保了不同类型的通信都能得到适当的保护。 6. **安全事件响应**：ZigBee-2007提供了对安全攻击的检测和应对机制，如网络监控和异常行为报告，以便及时发现并处理潜在威胁。 7. **网络层安全协议**：例如网络层数据加密（NLDE）和网络层数据完整性（NLDI），它们在数据包传输过程中提供加密和完整性保护。 8. **安全升级**：ZigBee-2007允许网络进行安全更新，以适应新的威胁和漏洞，保持网络安全性的最新状态。 9. **挑战与未来方向**：尽管ZigBee-2007在安全方面取得了进步，但仍有挑战，如设备功耗与安全性的平衡、大规模网络的安全管理以及对新兴攻击的防御等，这些都是进一步研究和改进的重点。总结来说，ZigBee-2007在设计上考虑了各种安全需求，提供了全面的保障措施，但随着无线网络环境的复杂化，不断面临新的安全挑战。为了确保ZigBee网络的持续安全，开发者和研究人员需密切关注这些挑战，不断优化和完善ZigBee的安防机制。

Table 3: Derived Key Types (0x: He xadecimal)

Key Type Computation Explanation

Key-Transport Key HMAC(0x00)

Protects transported NKs

Key-Load Key HMAC(0x02)

Protects transported MKs and LKs

Data Key LK Equal to the LK

Table 4: Key Distribution

Purpose Device receives from TC Via

Trust Management Initial MK or Active NK Unsecured Key Transport

Network Management Initial active NK and updated NKs Secured Key Transport

Conﬁguration MK or LKs Secured Key Transport

execution of diﬀerent security protocols can be logically separated. Three types of secret keys

can be derived from a LK as listed in Table 3. The derivation of these keys, except Data Key,

requires computation of a Keyed-Hashing for Message Authentication Code (HMAC) [4]. All

the derived keys must share the associated frame counters.

Trust Center In each secure ZigBee network, there exists a unique Trust Center (TC)

application which is trusted by all the devices in the network. TC distributes keys as part of

network and end-to-end application conﬁguration management. In high-security (commercial)

applications devices are using MK, whereas in low-security (residential) applications devices

are using NK to initiate secure communication with TC. In parallel with the key acquirement

schemes in Table 1, MK and NK can be obtained by either pre-installation or a kind of key

transport which is called in-band unsecured key transport. Certainly, the latter option is not

tolerable in vulnerable situations. The interaction between a ZigBee device and the TC for

diﬀerent purposes is given in Table 4.

As we mentioned before, there are three logical device types in a ZigBee network: coordina-

tor, router, and end device. TC is not a device type, but an application. In a ZigBee network,

the ZigBee Coordinator conﬁgures the security level (which can also be unsecured). The ZigBee

Coordinator also conﬁgures the TC of the network, which is by default the ZigBee Coordinator

itself.

Security Modes TC can be conﬁgured to operate in either Standard Security mode (SS)

or High Security mode (HS). In SS mode, which is designed for the residential applications, the

TC is required to maintain the SNK and control the policies of network admittance. In HS

mode, which is designed for the commercial applications, the TC is required to maintain a list

of all the devices in the network (this is actually optional in SS mode), all the relevant keys

(MKs, LKs, HSNKs) and control the policies of network admittance. As a result, the required

memory of the TC grows with the number of the devices in the network in HS mode, but not in

SS mode. In addition, the implementation of the Symmetric-Key Key Exchange (See Subsection

4.7) and the Mutual Entity Authentication (See Subsection 4.8) protocols are mandatory in HS

mode. Right now, among the application proﬁles mentioned in Section 2, only the Commercial

Building Automation (CBA) proﬁle uses HS mode.

4.4 Network Layer Security

The Network (NWK) layer provides functionality to ensure correct operation of the MAC layer

and also provides suitable service interface to the APL layer. When a NWK layer frame needs

to be secured, the NWK layer secures it by using AES [3] encryption/authentication in the

Enhanced Counter with CBC-MAC (CCM*) mode of operation (see Subsection 4.9). The

NWK layer processes outgoing/incoming frames in order to securely transmit/receive them.

The upper layers control the security processing operations by setting up the security keys,

剩余21页未读，继续阅读

Paulyen001

粉丝: 0
资源: 3

ZigBee-2007安全核心解析

ZigBee标准2007 ZigBee-Specification-2007

ZigBee-2007协议规范(英文)

近几年zigbee国外研究发展史按年份介绍

ZigBeeZ-stack协议栈

zigbee android

ZigBeeZ-stack协议栈物理层

基于 ZigBee 网络的无线光照度检测系统软件数据流示意图

基于ZigBee获取hc-sr501

zigbee rejoin

基于maven引入Java-Zigbee库，pom文件怎么编写

最新资源