User Guide Part 8

Security Aspects
We.R
™
System User Guide
299
Appendix G Pairing and Bonding
Motivation
Many of the services offered over wireless communication such as Bluetooth
®
and Z-Wave
®
can expose private data or allow the connecting party to control the involved devices.
For security and reliability reasons it is necessary to be able to recognize specific devices and
thus enable control over which devices are allowed to connect to a given device.
To resolve this conflict wireless communication systems like Bluetooth
®
and Z-Wave
®
uses a
process called bonding, and a bond is created through a process called pairing.
The pairing process is triggered either by a specific request from a user to create a bond (for
example, the user explicitly requests to “Add a Z-Wave
®
device”), or it is triggered
automatically when connecting to a service where (for the first time) the identity of a device is
required for security purposes. These two cases are referred to as dedicated bonding and
general bonding respectively.
Pairing often involves some level of user interaction; this user interaction is the basis for
confirming the identity of the devices. Once pairing successfully completes, a bond will have
been formed between the two devices, enabling those two devices to connect to each other in
the future without requiring the pairing process in order to confirm the identity of the devices.
When desired, the bonding relationship can later be removed by the user.
Implementation
During the pairing process, the two devices involved establish a relationship by creating a
shared secret known as a link key. If a link key is stored by both devices they are said to be
paired or bonded.
A device that wants to communicate only with a bonded device can cryptographically
authenticate the identity of the other device, and so be sure that it is the same device it
previously paired with. Once a link key has been generated, an authenticated Asynchronous
Connection-Less (ACL) link between the devices may be encrypted so that the data that they
exchange over the airwaves is protected against snooping.
Link keys can be deleted at any time by either device. If done by either device this will implicitly
remove the bonding between the devices; so it is possible for one of the devices to have a link
key stored but not be aware that it is no longer bonded to the device associated with the given
link key.