Provisioning a mesh node after IV index update

RE: Provisioning a mesh node after IV index update

AndyM — Thu, 23 Feb 2023 19:29:51 GMT

Thank you for clarification

RE: Provisioning a mesh node after IV index update

Aleksander Nowakowski — Thu, 23 Feb 2023 16:33:55 GMT

Hi, IV Index is passed through Provisioning Data. The provisioner's IV Index will be passed to the provisioning device. There is no need to do it manually.

cmd_iv_update_test enables Test mode, which will turn off 96 hours check. cmd_iv_update_test will toggle IV Update state (Normal -> In progress -> Normal).

If you bring the provisioner to the network after a gap of IV updates, you need to give it some time to receive at least one beacon and recover the current IV index.

Depending on the situation of the network it can take upto 10 minutes.

RE: Provisioning a mesh node after IV index update

Aleksander Nowakowski — Thu, 23 Feb 2023 15:49:54 GMT

I think the right way is to pass the IV Index to the mesh shell command. I'm not an expert in the shell, but the only occurrence of IV Index is here: https://docs.zephyrproject.org/3.2.0/connectivity/bluetooth/api/mesh/shell.html#mesh-prov-local-netkeyindex-addr-ivindex

Regarding the other methods - I'll pass the question to the mesh team.

RE: Provisioning a mesh node after IV index update

AndyM — Thu, 23 Feb 2023 15:34:01 GMT

As I mentioned, I provision my nodes with the mesh shell so there is no mobile phone.

One option is to pass the IV index to the mesh shell command

If my understanding is correct it can be obtained from cmd_iv_update_test from the node that has been on the network prior to the one being provisioned.

Another option is to call cmd_iv_update_test or cmd_iv_update on the newly provisioned node.

Which method is preferred?

Also, it's not clear what the difference is between cmd_iv_update_test or cmd_iv_update - which one should be used to trigger an IV index update?

Thanks

RE: Provisioning a mesh node after IV index update

Aleksander Nowakowski — Thu, 23 Feb 2023 10:54:05 GMT

Hello,

[quote userid="77539" url="~/f/nordic-q-a/96975/provisioning-a-mesh-node-after-iv-index-update"]it updates every 96 hours if I' m not mistaken[/quote]

An IV Index Update must not be started more often than every 192 hours. The Normal Operation must last AT LEAST 96 hours and the Update Active phase must additionally be AT MOST 144h. The IV Update should be initiated by a node which reached around 50% of it's available SEQ number. With that assumption it should use the same amount of time to go to 100% and exhaust available SEQ numbers, so an IV Update is necessary. It has been calculated, that with some assumptions (number of packets per second) it won't take less then ~96h.

The IV Update procedure is initiated by any node that is a member of a primary subnet. This may be done when the node believes it is at risk of exhausting its sequence numbers, or it determines another node is close to exhausting its sequence numbers. The node changes its IV Index and sends an indication to other nodes in the mesh that the IV Index is being updated.

If the nodes are sending messages less frequently, the duration of normal operation may take longer time.

[quote userid="77539" url="~/f/nordic-q-a/96975/provisioning-a-mesh-node-after-iv-index-update"]Is my understanding correct that the addition of a node with index 0 into the network with a higher IV index will trigger the IV index update in that node? If yes - how long does it usually take?[/quote]

The current IV Index is sent to an unprovisioned node during provisioning in encrypted data together with its Unicast Address and the Network Key. So a new node should know the current IV Index from the beginning. Mind, that the Provisioner needs to know the IV Index before it starts provisioning. A node can update its IV Index by at most 42, but the required time needs to pass (96h per step)

[quote userid="77539" url="~/f/nordic-q-a/96975/provisioning-a-mesh-node-after-iv-index-update"]Are there any build configuration parameters that need to be enabled for this to happen ?[/quote]

You may need to connect the Provisioner to a Proxy (assuming you're using a mobile phone) so that it receives a Secure Network Beacon with the current IV Index and only then start provisioning.