INS14278-4
How to Use Certified Apps in Z-Wave 700
2019-03-22
| Building a more connected world.
Page 15 of 45
Endpoints is the ability for a device to support multiple controllable endpoints within one device.
Each
endpoint specifies device and command classes supported and can be controlled individually.
4.6
Security
Security 0 was the first version of security. This command class provides a framework for establishing
encrypted communications within a Z-Wave network. However, the key exchange at inclusion is
vulnerable to interception.
The Security 2 is the latest Security Command Class and is required for all Z-Wave 700 devices. The S2
defines three types of security layers:
S2 Access Control
S2 Authenticated
S2 Unauthenticated
S2 security operates with the concept of a network key. All nodes may use this key to communicate to
each other. S2 divides the logical Z-Wave network into three dedicated security classes, with each one
having a unique network key. A given S2 security class not only identifies the network key to use but
also dictates the rules applying to authentication of a new node during inclusion. The “S2 Access
Control” class is the most trusted class, intended for access control devices like door locks and garage
doors. The “S2 Authenticated” class is used for all normal household devices such as sensors and light
dimmers. The “S2 Unauthenticated” class is the least trusted class and is only intended for the most
constrained controllers that, due to a limited user interface, are not capable of authenticating a node
joining the network.
In a wireless environment, there is a real risk that a foreign node is included accidentally or due to
malicious intent. The S2 authentication process allows an including controller to verify that a joining
node is indeed the physical device that it claims to be. Depending on the UI, an including controller may
allow the user to enter a Device-Specific Key (DSK) string of decimal digits that can be read visually or
scanned as a QR code.
Giving that SmartStart is mandatory for Z-Wave 700 devices, all Z-Wave 700 based devices must request
either S2 Access Control or S2 Authenticated. If requesting S2 Authenticated, a node must also request
S2 Unauthenticated for backwards combability.
Refer to [3] and [8] for more information.
