Wireless sensor/actuator device configuration by NFC with secure key exchange

Modern building automation systems are networks of sensors (heat, power, light, humidity, air presure, etc.), actuators (air conditioners, door openers, window openers, lamps, switches, alarms, etc.) and control units. The network technology is typically hybrid. Cables, communication via power lines and wireless technologies are used in one logical network. Large buildings (like office or public buildings) or even plants require the installation of a large amount of such devices. All devices need to be personalized after their installation, i.e., they need a unique ID in order to be locatable and logically addressable. In security critical environments they need to obtain initial secret keys to enable secure communication methods. The initialization is usally done after the installation of the device. This can be done with special wired initialization equipment or wirelessly by radio or, as it is assumend in this paper, by Near Field Communication (NFC). As NFC itself is a publically readable protocol, it needs a secure public key exchange method to provide devices with initial keys. This paper shows how to initialize new or replaced devices using an Android app with NFC and focusses on the public key exchange mechanism by Diffie-Hellman to prepare the device for encryption.