KNX Data Secure protects KNX installations against unauthorized access and manipulation.
The following security mechanisms form the basis of a secure KNX installation.
Freshness
The Freshness mechanism prevents an attacker from recording valid telegrams and replaying them at a later time.
This reliably prevents replay attacks, for example the repeated opening of a garage door using a previously recorded switching telegram.
A receiver processes only current ("fresh") telegrams from a known sender.
In combination with Data Integrity, Freshness provides effective protection against replay attacks.
Data Integrity
Data Integrity prevents telegrams from being modified or additional information from being inserted during transmission.
To achieve this, each telegram contains an encrypted authentication code.
The receiver uses this code to verify that the telegram has not been altered.
Authentication
Authentication ensures that telegrams originate only from authorized communication partners.
A receiver rejects commissioning or group telegrams if the source address (physical address) is unknown.
Confidentiality
Telegram contents are encrypted to prevent unauthorized reading during normal group communication and ETS commissioning.
Without the required group or ETS keys, telegram contents such as switching commands or values cannot be interpreted.
Overview
///