Is it possible to form a Zigbee distributed network with nRF Connect SDK v1.5.1?

[Clement Cres]

Hello,

For our application, we need to form a Zigbee distributed network and not a Zigbee centralized network. That means that routers need to be able to form a new network or join an existing one and that we will not have a Trust Center nor a coordinator in our network. Is this compatible with nRF Connect SDK v1.5.1? If yes, is there any example or documentation available on that subject? When I looked at the SDK it does not seem to be compatible yet. For example, I can see the following lines in zigbee_app_utils.c:

	case ZB_BDB_SIGNAL_FORMATION:
		/* At this point the Zigbee stack has finished network formation
		 * procedure. The device may have created a new Zigbee network,
		 * which is indicated by signal's status code.
		 *
		 * Next step:
		 *  - If the device implements Zigbee coordinator
		 *    and the formation is not successful, try to form a new
		 *    Zigbee network by performing network formation after
		 *    1 second (see BDB specification section 8.4).
		 *  - If the network formation was successful, open the newly
		 *    created network for other devices to join by starting
		 *    network steering for a node on a network,
		 *    (see BDB specification section 8.2).
		 *  - If the device implements Zigbee router or end device,
		 *    this signal is not expected.
		 */

If this is not available yet, is it planned?

Thank you in advance,

Best regards,

Clement

[Marte Myrvold]

Hi Clement,

Distributed security is a certified feature in the ZBOSS stack, which is the stack used in NCS, so it should be possible. You can start network steering on the router to make it create a distributed network.

Please be aware that there are some potential security problems with the transport key in distributed network. All routers and end-devices in a distributed network must be pre-configured with a link key, used to encrypt the network key when it is passed to a new device. There has been cases where it has been exploited that the keys were hard coded on the devices.

Best regards,

Marte

[Clement Cres]

Hello,

Thank you for your answer. Do you mean I can form a new network as a router and it will automatically create a distributed network whereas if I form a new network as a coordinator it will be a centralized network? It means that I can use the following function in both cases and the ZBOSS stack will handle the necessary actions based on my device type?

bdb_start_top_level_commissioning(ZB_BDB_NETWORK_FORMATION);

 

Thank you for the reminder about the security problem. We are aware of it but in our case we have no choice but to choose this typology of network. We do not have a unique central product that can create the network and maintain it until the end. Instead, we have several products that will be plugged or unplugged at different times and each of them needs to be able to handle the network (form, join, exchange security keys). That is why we are interested in the distributed network.

Best regards, Clement

[Marte Myrvold]

Hi Clement,

If you start a network with a coordinator working as a Trustcenter, and the coordinator is the only one who can let other nodes join, then it is centralized. I am not certain what additional steps to take in order to have a distributed network. As I mentioned, you will have to store link keys on the routers, and you must implement some functionality so that they are able to let other nodes join. I am waiting for a reply from our developers regarding this, but they are out of office today and yesterday due to public holidays, so I will not get a reply until next week.

Best regards,

Marte

[Clement Cres]

Hello,

Understood, I will wait for your developers' answer then.

Thank you,

Best regards,

Clement