Manualshelf

User Manual

ManualsBrandsSensize ManualsElectronicsSensize Tracker v2 CAT-M
231232233234235236237238239240
Table Of Contents
SARA-R4 series-AT commands manual
UBX-17003787 - R16
20Device and data security
Page 233 of 401
To prevent flooding the server with "security heartbeats", if the command is issued within 5 minutes of
the last sent "security heartbeat", the request will be rejected and an error result code will be returned.
20.2.6.2Syntax
Type Syntax Response Example
Action AT+USECCONN OK OK
20.3Data security
20.3.1Introduction
20.3.1.1SSL/TLS/DTLS
SSL/TLS/DTLS (where supported) provides a secure connection between two entities using TCP socket for
communication (i.e. HTTP/FTP server and HTTP/FTP client).
The SSL/TLS/DTLS with digital certificates support provides different connection security aspects:
• Server authentication: use of the server certificate verification against a specific trusted certificate or a
trusted certificates list;
• Client authentication: use of the client certificate and the corresponding private key;
• Data security and integrity: data encryption and Hash Message Authentication Code (HMAC) generation.
The security aspects used in the current connection depend on the SSL/TLS/DTLS configuration and features
supported by the communicating entities.
u-blox cellular modules support all the described aspects of SSL/TLS/DTLS security protocol with these AT
commands:
• AT+USECMNG: import, removal, list and information retrieval of certificates or private keys;
• AT+USECPRF: configuration of USECMNG (u-blox SECurity MaNaGement) profiles used for an SSL/TLS/
DTLS connection.
The USECMNG provides a default SSL/TLS/DTLS profile which cannot be modified. The default USECMNG
profile provides the following SSL/TLS settings:
Setting Value Meaning
Certificates validation level Level 0 The server certificate will not be checked or verified.
Minimum SSL/TLS/DTLS version Any The server can use any of the TLS1.0/TLS1.1/TLS1.2/DTLS1.2 versions
for the connection.
Cipher suite Automatic The cipher suite will be negotiated in the handshake process.
Trusted root certificate internal
name
"" (none) No certificate will be used for the server authentication.
Expected server host-name "" (none) No server host-name is expected.
Client certificate internal name "" (none) No client certificate will be used.
Client private key internal name "" (none) No client private key will be used.
Client private key password "" (none) No client private key password will be used.
Pre-shared key "" (none) No pre-shared key key password will be used.
SARA-R4 / SARA-N4
The default USECMNG profile does not provide the client certificate internal name and the client private
key internal name.
The secure re-negotiation and the SSL/TLS/DTLS session resumption are currently not supported, and if
mandated by the server the SSL/TLS connection will fail with an Generic SSL/TLS handshake alert.
20.3.1.2SARA-R410M-63B / SARA-R410M-73B / SARA-R410M-83B Local encryption and decryption
The +USECDATAENC, +USECDATADEC, +USECFILEENC, +USECFILEDEC AT commands provide a method
for managing symmetric crypto functions via AT command and to allow device to locally encrypt/decrypt and
authenticate critical data (e.g. certificates, tokens) on the device itself.
20.3.1.3SARA-R410M-63B / SARA-R410M-73B / SARA-R410M-83B Pre-Shared Keys (PSK) provisioning
The +USECPSK AT command allows to provision and manage a session unique PSK in the module and in the
cloud for application layer security. The PSK is generated and protected by the RoT.