KNX Security overview – KNX Association

This article describes some rules and background information on handling KNX Secure in ETS. It can be split in the following parts:

Applications

The following applications are enabled by KNX Secure.

Secure Communication, medium IP

A. Safeguarding of KNX telegrams on the IP medium (= security on the transport level)
In a KNX installation, the IP medium (= LAN) is usually freely accessible or is used by several applications/ systems simultaneously.
B. Secure access by PCs directly via a KNX secure IP interface to the KNX installation, also through internet (keyword VPN access)

Secure communication, all media

C. Complete safeguarding of KNX telegrams on every medium between the respective end-devices (= end-to-end security on the application level)

Secure communication, with devices

D. A secure communication channel including authentication of communication partners is established; e.g. for the commissioning of KNX Secure Devices by ETS

Threat Scenarios

The following threat scenarios or possible attacks on the KNX system are effectively thwarted by KNX Secure.

Telegram repeats

Prevents repeated sending by an attacker to again trigger the actions of (previously) correctly executed telegrams; so-called replay attacks to again trigger a (previously recorded) door opener command, for example. That we call: Freshness

Telegram Manipulation

Prevents the modification/manipulation of the data contents of telegrams, e.g. through unauthorized changes to telegrams or through unauthorized infiltration with and sending of telegrams (e.g. switching commands). That we call: Data Integrity

Ensuring that the other partner is indeed the authorized/intended communication partner and is not only pretending to be. That we call: Authentication

Telegram Visibility

Prevention of the visibility of telegram contents, e.g. reading configuration data during ETS commissioning. That we call: Encryption

Search

KNX Secure