KNX Data Secure: шифрование на уровне приложений для чувствительных групповых адресов и исполнительных устройств

Примеры устройств, поддерживающих Data Secure

Switch actuators:
  MDT AKS-0816.02   — 8×16A Data Secure switch actuator
  MDT AKS-0424.02   — 4×16A Data Secure switch actuator
  Gira 2094-00      — 8-channel Data Secure switch actuator
  ABB SA/S 8.10.2.2 — 8×10A switch actuator with Data Secure

Push-buttons / inputs:
  Gira 2093-00      — Push-button with Data Secure support
  MDT BE-GT2W.02    — Glass push-button with Data Secure
  ABB M4120-01      — 4-gang binary input with Data Secure

Logic / coupling:
  Gira X1           — Logic processor and gateway with Data Secure
  MDT SCN-IP100.02  — IP router with Data Secure gateway function
  Weinzierl KNX IP Interface 740 — with Data Secure support

Check: KNX Secure logo (lock icon) in device datasheet
ETS6: Data Secure capable devices show padlock icon
in device catalog and in the device properties panel

Конфигурация устройств с Data Secure в ETS6

Per-device configuration in ETS6:
  Select device in topology → Properties panel
  Security tab → Data Secure: Enable (checkbox ON)
  Tool access code: set a 6-digit code (prevents unauthorised
  ETS6 parameter access to this device without the code)
  Key: generated automatically by ETS6 (unique per device)

Key properties:
  Generated: 128-bit random key per device
  Stored: in ETS6 project file (encrypted)
  Downloaded: to device during Full Device Configuration
  Cannot be read back: device stores key in write-only memory
  If key lost: must factory reset device to clear it,
  then re-download with new key from ETS6

Tool access code usage:
  Required when accessing device parameters in ETS6
  (prevents unauthorised configuration changes on-site)
  Store tool access codes in password manager
  Document in commissioning record (access-restricted copy)

Правила работы смешанной шины

Secured GAs (Confidential or Authenticated):
  Only Data Secure devices with correct key can send/receive
  Non-Secure devices receive encrypted telegram → cannot decrypt
  → Non-Secure device ignores the telegram (no action)

Non-secured GAs (None security level):
  Both Secure and non-Secure devices participate normally
  Standard KNX telegram — no overhead

Migration strategy for adding security incrementally:
  Phase 1: Add Data Secure actuators for access control circuits
           (replace existing door lock actuators with Data Secure models)
           Update ETS6, download, test
  Phase 2: Replace alarm panel KNX interface with Secure version
  Phase 3: Add Secure push-buttons for access-controlled areas
           (non-Secure push-buttons on same bus still work for
           non-secured GAs — lighting control unchanged)

Coexistence check:
  ETS6 topology scan: Secure devices show padlock icon
  Non-Secure devices show no lock icon
  Group Monitor: secured GAs show encrypted status in ETS6
  (ETS6 decodes them locally — other bus monitors see encrypted)

Управление ключами и требования к резервному копированию

ETS6 project backup (contains all Data Secure keys):
  Backup frequency: after every programming session (daily minimum)
  Backup format: encrypted .knxproj file (ETS6 native)
  Backup locations:
    Primary: encrypted network share (RAID protected)
    Secondary: encrypted cloud storage (Backblaze B2, AWS S3)
    Tertiary: encrypted USB drive in physically secure location
  Password: strong (minimum 20 chars) stored in password manager

Test restore procedure (mandatory before handover):
  Restore backup .knxproj to second ETS6 installation
  Verify: all Data Secure devices listed with keys
  Verify: Group Monitor shows decrypted telegrams after restore
  Document: restore test date and result in commissioning record

Loss recovery (ETS6 project lost, no backup):
  Each Data Secure device must be factory reset
  Factory reset: device-specific procedure (see datasheet)
  Effect: clears Data Secure key AND KNX application
  Reprogram required: Full Device Configuration download
  Time estimate: 1 hour per 10 Data Secure devices
  For 50-device installation: estimated 5 hours minimum