# Improvements of the xAAL Home Automation System
## 5 The xAAL Communication Protocol
### Alternative Home Automation Protocols over IP
#### 5.7.4 Aqara  
Aqara is a home automation company of Lumi United Technology [44]. Aqara products are generally sold by Xiaomi. Some product variants may be purchased directly to Aqara, with almost the same shape and functionalities.  
Technically, Aqara devices are connected to an Aqara Hub at home via the Zigbee radio protocol. This hub is a small home automation gateway with a WiFi interface for Internet connection, and which is in charge of forwarding home devices messages to and from Aqara cloud servers via a non-published but verbose UDP protocol. Cloud services allow consumers to get control of their home devices via a mobile application, retrieve monitored activities, and to set up automation scripting. Some automation (e.g., alarms) is executed locally by the hub, other more complex processes are executed by cloud services. The Aqara cloud platform provides a documented REST API for third-party applications (e.g., for compatibility with Google Home, Alexa, and others), or for open-source applications [45].  
Some models of Aqara Hubs may be configured to activate a home network interface in addition to the cloud connection. This allows user applications controlling home devices directly, without usingcloud services. This local communication uses two UDP sockets: multicast and unicast. The multicast channel is used: (i) for discovering (for applications to discover hubs present on the home network), (ii) for heartbeat messages (the hubs and their sub-devices regularly announce that they are alive, plus a battery level, plus a changing security token), and (iii) to send report messages (i.e., notifications of events and sensors changes, from the hubs to users' applications). The UDP unicast channel is for command control from users' applications to the hubs. These messages indicate: (i) the sub-device id (which seems to be stable and in relation to some Zigbee address of the physical device), (ii) the _model_ name of the sub-device (this model name is specific to the Aqara or to the Xiaomi products), and (ii) a set of _parameters_ relating to the indicated model name. These parameters are documented on web pages of Aqara.  
Aqara messages are in JSON format, in clear text. Note that command messages include a security key that is computed by concatenating the gateway key with the device token and then ciphering this with the AES-CBC 128 algorithm, initialized with a predefined vector. The gateway key is randomly generated by the Aqara cloud service for the first time the gateway is installed by the consumer. This key is stable and is supposed to be secret. Mobile applications get it from the cloud after the user login. Devices tokens are publicly available in heartbeat messages and change every 10 s. Aqara messages are not ciphered nor signed, this security key just brings a certain level of confidence in the fact that command messages are sent by a regular application.  
To sum up, the Aqara local protocol has some pro and cons. Having two sockets makes the communication protocol more cumbersome. On the other hand, providing some functionalities on unicast is a pragmatic workaround for the weakness of WiFi regarding multicast. Devices are described by a model name, with an effort to document it. Unfortunately, there is no attempt to organize those devices' descriptions in terms of family of devices with shared functions or so. For now, there are about twenty device models. One may wonder about the evolution of the products list. The security of the local communication protocol is rather poor, but at least it exists, which is rather rare in this domain. However, the main criticism is about the privacy concerns caused by the cloud services.