Specifications
XBee®/XBee‐PRO®SERFModules
©2009DigiInternational,Inc. 66
is only decrypted by the destination device. The XBee must be configured with security enabled
(EE set to 1) to use APS encryption.
APS encryption can be enabled in API firmware on a per-packet basis. To enable APS encryption
for a given transmission, the "enable APS encryption" transmit options bit should be set in the API
transmit frame. Enabling APS encryption decreases the maximum payload size by 9 bytes.
Using a Trust Center
The EO command can be used to define the coordinator as a trust center. If the coordinator is a
trust center, it will be alerted to all new join attempts in the network. The trust center also has the
ability to update or change the network key on the network.
Updating the Network Key with a Trust Center
If the trust center has started a network and the NK value is changed, the coordinator will update
the network key on all devices in the network. (Changes to NK will not force the device to leave
the network.) The network will continue to operate on the same channel and PAN ID, but the
devices in the network will update their network key, increment their network key sequence
number, and restore their frame counters to 0.
Authentication
By default, routers and end devices run with authentication disabled. To enable authentication
after joining, set EO to 8 on a router or end device.
Note: Authentication presumes a valid certificate has been installed on the device.
Coordinators always run with authentication enabled (EO2) and their EO setting is read-only.
XBee Security Examples
This section covers some sample XBee configurations to support different security modes. Several
AT commands are listed with suggested parameter values. The notation in this section includes an
'=' sign to indicate what each command register should be set to - for example, EE=1. This is not
the correct notation for setting command values in the XBee. In the API, the two byte command is
used in the command field, and parameters are populated as binary values in the parameter field.
Example 1: Forming a network with security (pre-configured link keys)
1. Start a coordinator with the following settings:
a. ID=2234 (arbitrarily selected)
b. EE=1
c. NK=0
d. KY=4455
e. WR (save networking parameters to preserve them through power cycle)
2. Configure one or more routers or end devices with the following settings:
a. ID=2234
b. EE=1
c. KY=4455
d. WR (save networking parameters to preserve them through power cycle)
3. Read the AI setting on the coordinator and joining devices until they return 0 (formed or joined
a network).
In this example, EE, ID, and KY are set the same on all devices. After successfully joining the
secure network, all application data transmissions will be encrypted by the network key. Since NK
was set to 0 on the coordinator, a random network key was selected. And since the link key (KY)
was configured the same on all devices, to a non-zero value, the network key was sent encrypted
by the pre-configured link key (KY) when the devices joined.