All Z-Wave Certified IoT Devices Now Require Mandatory Security Protocols
As of April 2, the Z-Wave Alliance will require "strict and uniform adoption of a new security protocol" for all Z-Wave devices receiving certification. This follows the Alliance Board of Directors unanimous vote for the implementation of Security 2 framework in November 2016.
According to a 2016 AT&T study, 58% of companies reported they were not confident in the security of connected devices. Other consumer studies have shown that safety and privacy is a primary concern among those looking to adopt smart home. The industry focus on IoT security continues to amplify and today’s milestone demonstrates Z-Wave’s early leadership role in the space. The Z-Wave Alliance has been working for several years with chipmaker Sigma Designs to develop world-class security standards for all Z-Wave devices as IoT expands into homes around the globe.
“We are absolutely committed to making Z-Wave the safest, most secure ecosystem of smart devices on the global market,” commented Mitchell Klein, executive director of the Z-Wave Alliance, “Our work, in conjunction with the entire Alliance membership, will ensure that developers, service providers, manufacturers and consumers alike will look to Z-Wave as the most trusted solution with the highest levels of protection.”
Z-Wave’s technical certification program, which is administered through 3rd party test facilities in Europe, US, and Asia, will check that all S2 security solutions, which contain rules for command classes, timers, and device types are correctly implemented in every new, certified device. S2 devices will also be backward compatible with existing devices on the market.
The Z-Wave S2 framework was developed in conjunction with the cyber security expert community to give the already secure Z-Wave devices new levels of impenetrability. By securing communication both locally for home-based devices and in the hub or gateway for cloud functions, S2 also virtually removes the risk of devices being hacked while they are included in the network.
By using a QR or pin-code on the device itself, the devices are uniquely authenticated to the network as well. Common hacks such as man-in-the-middle and brute force are virtually powerless against the S2 framework through the implementation of the industry-wide accepted secure key exchange using Elliptic Curve Diffie-Hellman (ECDH).
Finally, Z-Wave also strengthened its cloud communication, enabling the tunneling of all Z-Wave over IP (Z/IP) traffic through a secure TLS 1.1 tunnel, removing the vulnerability.