The protection_parameters part of the get_protected_attributes_response returned by the get_protected_attributes method shall be populated by the Device according to Table 8.5.2b. The value of protected_attributes part of the protected_attributes_response_data returned by the get_protected_attributes method shall be populated by the Device with Ciphered Information, calculated as per the requirements of Section 8.2. The tag for protected_attributes shall be ‘octet-string’ (0x09) and the length shall be the length of Ciphered Information. Field Value Device Validation Note get_protected_attributes_request tag 0x02 Must have this value Meaning ‘structure’ length 0x02 Must have this value 2 elements in the structure object_list The first element in the get_protected_attributes_request structure tag 0x01 Must have this value Meaning ‘array’ length 0x01 Must have this value 1 entry in the array object_definition The 1 entry in the object_list array tag 0x02 Must have this value Meaning ‘structure’ length 0x05 Must have this value 5 elements in the structure class_id tag 0x12 Must have this value Meaning ‘long-unsigned’ value See ‘Note’ column Must be the same as the class_id in attribute 3 of the Data Protection object being accessed The class_id of the object which is the source of the Encrypted data logical_name tag 0x09 Must have this value Meaning ‘octet-string’ length 0x06 Must have this value Logical_name is always 6 octets long value See ‘Note’ column Must be the same as the logical_name in attribute 3 of the Data Protection object being accessed The logical_name of the object which is the source of the Encrypted data attribute_index tag 0x0F Must have this value Meaning ‘integer’
value See ‘Note’ column Must be the same as the attribute_index in attribute 3 of the Data Protection object being accessed The attribute_index of the object which is the source of the Encrypted data data_index tag 0x12 Must have this value Meaning ‘long-unsigned’ value 0x0000 Must have this value Meaning the whole attribute is captured or set restriction tag 0x02 Must have this value Meaning ‘structure’ length 0x02 Must have this value 2 elements in the structure EITHER Must be present if this invocation is not to access a Log as defined in Section 8.2 If this is not to access a Log as defined in Section 8.2 restriction_type tag 0x16 Must have this value Meaning ‘enum’ value 0x00 Must have this value Meaning ‘none’ restriction_value Assumes that the CHOICE does not need encoding since the value of ‘restriction_type’ defines the CHOICE [Note, there are no tags in the Blue Book for this CHOICE] tag 0x00 Must have this value Meaning ‘null-data’ OR Must be present if this invocation is to access a Log as defined in Section 8.2 If this is to access a Log as defined in Section 8.2 restriction_type tag 0x16 Must have this value Meaning ‘enum’ value 0x01 Must have this value Meaning ‘restriction by date’ restriction_value Assumes that the CHOICE does not need encoding since the value of ‘restriction_type’ defines the CHOICE [Note, there are no tags in the Blue Book for this CHOICE] tag 0x02 Must have this Meaning ‘structure’
Value See ‘Note’ column The concatenation 0x04 || the Originator Counter value part of the transaction_id in the Grouping Header of this Command originator_system_title Tag 0x09 Must have this value Meaning ‘octet-string’ Length 0x08 Must have this value Entity Identifier is always 8 octets in length Value See ‘Note’ column The Entity Identifier of the Encryption Remote Party recipient_system_title Tag 0x09 Must have this value Meaning ‘octet-string’ Length 0x08 Must have this value Entity Identifier is always 8 octets in length Value See ‘Note’ column Must be the Device’s Entity Identifier The Entity Identifier of the Device other_information Tag 0x09 Must have this value Meaning ‘octet-string’ Length 0x00 Must have this value Zero length since this string is empty key_info Tag 0x02 Must have this value Meaning ‘structure’ Length 0x02 Must have this value 2 elements in the structure key_info_type: Tag 0x16 Must have this value Meaning ‘enum’ Value 0x02 Must have this value Meaning ‘agreed_key’ key_info_options CHOICE Assumes that the CHOICE does not need encoding since the value of ‘restriction_type’ defines the CHOICE [Note, there are no tags in the Blue Book for this CHOICE] agreed_key_info_options tag 0x02 Must have this value Meaning ‘structure’ length 0x02 Must have this value 2 elements in the structure key_parameters tag 0x09 Must have this value Meaning ‘octet-string’ length 0x01 Must have this value Length fixed by the Blue Book
Hub Time Cluster that is available over the ESME’s HAN interface 8 0-0:1.0.0.255 M 5 Action preset_adjusting_time structure{ preset_time: octet-string, octet-string} {‘not specified’, Supplier Current Time, Supplier Current Time + Tolerance Period} ‘not specified’ in preset_time shall be the value as required by the Blue Book. All times shall be formatted as according to section 4.1.6.1 of the Blue Book 8 0-0:1.0.0.255 M 4 Action adjust_to_preset_time Integer 0 8 0-0:1.0.0.255 A 2 Get time Octet-string Null This get means that the resulting Time of the ESME shall be provided in the Response 8 0-0:1.0.0.255 A 4 Get status Unsigned Null This get means that the resulting Time Status of the ESME shall be provided in the Response Table 9.1.4.2a: Construction of Command Payload In this Section 9.1.4.2, the object with OBIS code 0-0:1.0.0.255 shall be referred to as the Clock and italicised terms shall have their Blue / Green Book meaning. On receipt of the Command, the ESME shall undertake processing in the following sequence: the ESME shall undertake the ‘Command Authenticity and Integrity Verification’ processing required for Commands of type SME.C.C. If that fails, processing shall cease; the ESME shall process the instructions in the access-request-body of the Command as follows: when attribute 9 of the Clock (clock_base) is set to ‘radio controlled’ (5), the ESME shall request the value of the Communications Hub Time from the Communications Hub via its ZigBee radio. If a time of 0xFFFFFFFF is provided or if no time is received: if the current Time Status is set to ‘Reliable’, the ESME shall set bit 1 of attribute 4 (so setting status of Clock to be ‘doubtful value’ (Unreliable)); or if the current Time Status is not set to ‘Reliable’, the ESME shall not change status. the preset_adjusting_time method of the Clock shall be executed. Note this is to set parameters for the adjust_to_present_time method.
Grouping Remote Party Message Message Type Command, Response and Alert (if future dated) Message Type Category SME.C.C Capable of future dated invocation? Yes Protection Against Replay Required? No SEC User Gateway Services Schedule (Service Request) Reference N/A for Communications Hub (this Command is not available as part of the User Gateway Services) 11.3 for ESME and GSME Valid Target Device(s) ESME / GSME / CH Valid Business Originator role(s) for Command invocation (and so, for DLMS COSEM Commands, which Application Association is to be used for delivery of the Command to the Device) [Remote Party Messages Only] Supplier for ESME / GSME WAN Provider for CH Valid Response Recipient role(s) (only for Messages authorised by the Access Control Broker on behalf of parties not known to the Device) [Remote Party Messages Only] N/A Valid initiating Device type(s) [HAN Only Messages] N/A Protocol ASN.1 Table 11.5: Use Case Cross References for CS06 Activate Firmware Pre-conditions None. Detailed Steps Construction of Command Activate Firmware Command Payloads shall be constructed according to the requirements of Section 11.5.2.3 and populated as specified in Table 11.5.2.1. MAC Header, Grouping Header, KRP Signature and ACB-SMD MAC shall be populated as required for a Command of the SME.C.C Message Category. Attribute name Data Type Value (blank cells mean the command specific value is derived by the encoding process) Mandatory, OPTIONAL or DEFAULT value Notes SEQUENCE manufacturerImageHash OCTET STRING The Manufacturer Image Hash of the image to be activated. Mandatory An octet-string of length 32 interpreted as the Manufacturer Image Hash of the Manufacturer Image that is to be activated executionDateTime The date-time at which the Command is to be executed, if future dated OPTIONAL Table 11.5.2.1: @ActivateFirmware.CommandPayload population
currentSeqNumber INTEGER The corresponding Counter value Present if statusCode=0 The Protection Against Replay number held by the Device for this role’s use of the Update Security Credentials Command trustAnchorCellsDetails SEQUENCE OF At least one in the SEQUENCE OF must be present if statusCode=0 SEQUENCE trustAnchorCellKeyUsage BIT STRING digitalSignature (0) , keyAgreement (4) , keyCertSign (5) Mandatory if SEQUENCE is present To what use can the public key in this Cell be put trustAnchorCellUsage INTEGER prePaymentTopUp(1) DEFAULT management (0) Only needs to be present for the {supplier, keyAgreement, prePaymentTopUp} Cell existingSubjectUniqueID OCTET STRING Entity Identifier in this Cell Mandatory if SEQUENCE is present See Section 12.4 existingSubjectKeyIdentifier OCTET STRING Key Identifier of the key in this Cell Mandatory if SEQUENCE is present Table 13.2.4.4: Attribute values for Provide Security Credentials Response Response Cryptographic Protection If the Command that triggered this Response was protected by a MAC then the Device shall calculate a MAC using the parameters in Table 13.2.4.5 and set SMD-KRP MAC to the value so calculated.
(8) , anyByContingency (9) plaintextSymmetricKey [0] IMPLICIT OCTET STRING The symmetric key that will decrypt the encrypted Contingency Key held on the Device OPTIONAL Only to be present if the Contingency Key arrangements are being used (so if = anyByContingency). The contents provide the symmetric key to decrypt the Contingency Public Key in the (root, digitalSignature, management) Trust Anchor Cell applyTimeBasedCPVChecks [1] IMPLICIT INTEGER disapply(1) DEFAULT apply Only to be present if the Remote Party sending the Command is instructing the Device not to apply time based checks as part of Certification Path Validation. This should only be in exceptional circumstances (e.g. root credentials on the Device have expired without replacement for unforeseen reasons) authorisingRemotePartyTACellIdentifier [2] IMPLICIT SEQUENCE OPTIONAL This structure identifies which Public Key on the Device is to be used in verifying KRP Signature. The key is identified by way of Trust Anchor Cell and so the nature of the check, by way of the KeyUsage parameter, is also identified. can only be omitted when the Access Control Broker is
trustAnchorCellKeyUsage BIT STRING {digitalSignature (0) , keyAgreement (4) , keyCertSign (5)} , Mandatory if SEQUENCE is present To what use can the public key in this Cell be put trustAnchorCellUsage INTEGER DEFAULT management Should be absent unless: the deviceType is eSME or gSME; and the supplier operating the Device has chosen to use a separate key agreement Key Pair in relation to prepayment top ups to the Device and this is a replacement of the corresponding certificate certificationPathCertificates SEQUENCE OF The list of certificates needed for Certification Path Validation At least one Certificate must be present since root will never directly sign any end entity certificate Provide the certificates needed to undertake Certification Path Validation of the new end entity certificate against the root public key held on the Device. The number of these may be less than the number of replacement certificates (e.g. a supplier may replace all of its certificates but may only need to supply one Certification Authority Certificate to link them all back to root executionDateTime The date-time at which the replacements are OPTIONAL This field may only be present if
networkOperator (3) , (4) , transitionalCoS (5) , wanProvider (6) , otherRemotePartyFloorSeqNumber INTEGER The corresponding Counter value Mandatory if SEQUENCE is present newRemotePartySpecialistFloorSeqNumber SEQUENCE OF OPTIONAL Only present where Remote Party Role is supplier SEQUENCE seqNumberUsage INTEGER {prepaymentTopUp (0)} , Mandatory if present Specify the usage of the SeqNumber seqNumber INTEGER Mandatory if present Specify the associated SeqNumber replacementOutcomes SEQUENCE OF One per replacement in the corresponding Command so at least one For each replacement in the Command, detail the outcome and impacted parties
anyByContingency root digitalSignature management Table 13.3.5.5: Valid credentialsReplacementMode by Remote Party Roles authorising the Command Valid credentialsReplacementMode by the targetTrustAnchorCells specified in the Command A Command containing a certain credentialsReplacementMode can only validly replace the Security Credentials in a certain subset of Trust Anchor Cells. The Command identifies the Cells that are to have credentials replaced in each targetTrustAnchorCell within each TrustAnchorReplacement in replacements. Table 13.3.5.6 below lists the only valid targetTrustAnchorCell combinations for each credentialsReplacementMode. All other combinations are invalid. A Command containing any invalid combinations shall not be processed any further by the Device. targetTrustAnchorCell RemotePartyRole KeyUsage CellUsage credentialsReplacementMode rootBySupplier root keyCertSign management rootByWanProvider root keyCertSign management supplierBySupplier supplier any valid for GBCS any valid for GBCS networkOperatorByNetworkOperator networkOperator any valid for GBCS any valid for GBCS accessControlBrokerByACB accessControlBroker any valid for GBCS any valid for GBCS wanProviderByWanProvider wanProvider any valid for GBCS any valid for GBCS transCoSByTransCoS transitionalCoS digitalSignature management supplierByTransCoS supplier any valid for GBCS any valid for GBCS anyExceptAbnormalRootByRecovery any valid for GBCS any valid for GBCS any valid for GBCS anyByContingency any valid for GBCS any valid for GBCS any valid for GBCS Table 13.3.5.6: Valid credentialsReplacementMode by the targetTrustAnchorCells specified in the Command
Issue Security Credentials Command and Response payloads – structure definition Each instance of @IssueSecurityCredentials.CommandPayload and of @IssueSecurityCredentials.ResponsePayload shall be an octet string containing the DER encoding of the populated structure defined in this Section 13.4.6 which specifies the structure in ASN.1 notation. IssueSecurityCredentials DEFINITIONS ::= BEGIN CommandPayload ::= SEQUENCE { -- specify the keyUsage to which the generated key-pair will be put, if subsequently authorised keyUsage KeyUsage } ResponsePayload ::= CHOICE { -- if the Command was successful, provide the generated Certification Request. CertificationRequest shall -- be as defined in ASN.1 by IETF RFC 5912. For reference, it is in the section headed ‘ASN.1 Module for RFC 2986’ certificationRequest CertificationRequest, -- if the Command was unsuccessful, detail the failure issueCredentialsResponseCode IssueCredentialsResponseCode } -- KeyUsage is only repeated here for ease of reference. It is defined in IETF RFC 5912 KeyUsage ::= BIT STRING { -- Define valid uses of Public Keys held by Devices in their Trust Anchor Cells. digitalSignature (0), contentCommitment (1), -- not valid for GBCS compliant transactions keyEncipherment (2), -- not valid for GBCS compliant transactions dataEncipherment (3), -- not valid for GBCS compliant transactions keyAgreement (4), keyCertSign (5), -- not valid for this Use Case cRLSign (6), -- not valid for this Use Case encipherOnly (7), -- not valid for GBCS compliant transactions decipherOnly (8) -- not valid for GBCS compliant transactions } IssueCredentialsResponseCode::= INTEGER
Certificate See IETF RFC 5912 A new Device Certificate that the Device is to process Mandatory Table 13.5.7a: @UpdateDeviceCertificateonDevice.CommandPayload population @UpdateDeviceCertificateonDevice.ResponsePayload shall have the structure defined in Section 13.5.6, and the Device constructing the Response shall populate with values according to Table 13.5.7b. Attribute name Data Type Value (blank cells mean the command specific value is derived by the encoding process) Mandatory, OPTIONAL or DEFAULT value Notes UpdateDeviceCertResponseCode INTEGER Shall be populated according to the processing defined in Section 13.5.4 Mandatory Table 13.5.7b: @UpdateDeviceCertificateonDevice.ResponsePayload population
ProvideDeviceCertResponseCode::= INTEGER { invalidKeyUsage (1), noCertificateHeld (2), certificateRetrievalFailure (3) } END Constructing the @ProvideDeviceCertificateFromDevice.CommandPayload and @ProvideDeviceCertificateFromDevice.ResponsePayload @ProvideDeviceCertificateFromDevice.CommandPayload shall have the structure defined in Section 13.6.6 and the Remote Party constructing the Command shall populate with values according to Table 13.6.7a. Attribute name Data Type Value (blank cells mean the command specific value is derived by the encoding process) Mandatory, OPTIONAL or DEFAULT value Notes SEQUENCE keyUsage BIT STRING Either digitalSignature (0) only, Or keyAgreement (4) only Mandatory Only one or the other is valid Table 13.6.7a: @ProvideDeviceCertificateFromDevice.CommandPayload population @ProvideDeviceCertificateFromDevice.ResponsePayload shall have the structure defined in Section 13.6.6, and the Device constructing the Response shall populate with values according to Table 13.6.7b. Attribute name Data Type Value (blank cells mean the command specific value is derived by the encoding process) Mandatory, OPTIONAL or DEFAULT value Notes CHOICE
Certificate See IETF RFC 5912 The Device Certificate provided pursuant to Section 13.6.4 Mandatory Mandatory if certificate successfully produced provideDeviceCertResponseCode INTEGER Shall be populated according to the processing defined in Section 13.5.4 Mandatory Mandatory if certificate is not successfully produced Table 13.6.7b: @ProvideDeviceCertificateFromDevice.ResponsePayload population
{ success (0), otherDeviceNotInDeviceLog (1), otherFailure (2) } END Constructing the @UnjoinDevice.CommandPayload and of @UnjoinDevice.ResponsePayload @UnjoinDevice.CommandPayload shall have the structure defined in Section 13.7.4.6.1, and the Remote Party constructing the Command shall populate with values according to Table 13.7.4.6.2a. Attribute name Data Type Value (blank cells mean the command specific value is derived by the encoding process) Mandatory, OPTIONAL or DEFAULT value Notes @UnjoinDevice.CommandPayload OtherDeviceEntityIdentifier OCTET STRING Entity Identifier Mandatory The Entity Identifier of the Device which is to be removed from this Device’s Device Log Table 13.7.4.6.2a: @UnjoinDevice.CommandPayload population @UnjoinDevice.ResponsePayload shall have the structure defined in Section 13.7.4.6.1, and the Remote Party constructing the Command shall populate with values according to Table 13.7.4.6.2b. Attribute name Data Type Value (blank cells mean the command specific value is derived by the encoding process) Mandatory, OPTIONAL or DEFAULT value Notes @UnjoinDevice.ResponsePayload unjoinResponseCode INTEGER success (0), (0), otherDeviceNotInDeviceLog (1), (1), otherFailure (2) (2) Mandatory Shall be populated according to the processing defined in Section 13.7.4.3 Table 13.7.4.6.2b: @UnjoinDevice.ResponsePayload population
ZSE Report Event Status command Element Meaning Value Octets ZCL header Frame control Cluster-specific; not manufacturer specific; client-server; allow default response; 0b00000001 1 Transaction sequence number 0x00 1 Command identifier Report Event Status 0x00 1 ZCL payload Issuer Event ID (UINT32) Set to the event ID from the corresponding ZSE command received from the ESME See ‘Meaning’ column 4 Event Status (UINT8) Refer to ZigBee standard As per the requirements of this Section 18.1.1 1 Event Status Time (UTCTime) An HCALCS is not required to have a clock and therefore the HCALC is not required to know UTC time 0x00000001 4 Criticality Level Applied (UINT8) 0x01 = Voluntary 0x01 1 Cooling Temperature Set Point Applied (UINT16) Not used 0x8000 2 Heating Temperature Set Point Applied (UINT16) Not used 0x8000 2 Average Load Adjustment Percentage Applied (INT8) Not used 0x80 1 Duty Cycle Applied (UINT8) 0x00 (0) = switched OFF; 0x64 (100) = switched ON See ‘Meaning’ column 1 Event Control (BITMAP8) Do not randomise 0x00 1 Signature Type (UINT8) No signature 0x00 1 Table 18.1.1.4: ZSE Report Event Status command DLMS COSEM Message Templates Table 18.2 contains Message Templates for all Use Case with DLMS COSEM payloads. These Message Templates are derived from the Mapping Table, and shall be complied with in the construction and population of all such Messages. Table 18.2: DLMS COSEM Message Templates Encoding Italicised terms in this Section 18.2.1 shall have their DLMS COSEM meaning.
The black text specifies the parts of the ASN.1 structure, the blue text specifies the value it is set to by the Device and the comments explain each of the values. ASN.1 Notes supplierUpdatingAllSupplierCertificatesResponse Response ::= {credentialsReplacementMode supplierBySupplier, remotePartySeqNumberChanges {{otherRemotePartyRole supplier, otherRemotePartyFloorSeqNumber 987654321} }, replacementOutcomes { {affectedTrustAnchorCell trustAnchorCellRemotePartyRole supplier, trustAnchorCellKeyUsage { digitalSignature}}, statusCode success, existingSubjectUniqueID '123456789ABCDEF0'H, existingSubjectKeyIdentifier '1234567890123456'H, replacingSubjectUniqueID 'FEDCBA9876543210'H, replacingSubjectKeyIdentifier 'ABCDEABCDEABCDEA'H}, {affectedTrustAnchorCell {trustAnchorCellRemotePartyRole supplier, trustAnchorCellKeyUsage { keyAgreement}}, statusCode success, existingSubjectUniqueID '123456789ABCDEF0'H, existingSubjectKeyIdentifier '0987654321098765'H, replacingSubjectUniqueID 'FEDCBA9876543210'H, The corresponding Command was for the Supplier replacing supplier credentials This is the new supplier’s counter, which the Device will now use for Protection Against Replay in relation to the supplier role This outcome is for the supplier digital signing store The old supplier’s Entity Identifier The KeyIdentifier for the old supplier’s digital signing key The new supplier’s Entity Identifier The KeyIdentifier for the old supplier’s digital signing key This outcome is for the supplier key agreement store
that the UTRN Counter contained within a UTRN is greater than the lowest value in the UTRN Counter cache held on the Device. This ensures that a limited number of UTRNs can be executed out of sequence); and that the UTRN Counter is not equal to any value currently held in the UTRN Counter cache, i.e. that the Pre-payment Command has not be accepted before. PTUT Truncated Originator Counter The PTUT Truncated Originator Counter is detailed separately in Section 14 but a summary is included here for completeness. This is the UTRN Counter as carried in the locally entered 20 digit UTRN. It is the 10 least significant bits of the UTRN Counter, which is itself the 32 most significant bits of the Originator Counter for the Command. The PTUT truncated counter is not processed in WAN received top-up commands. The PTUT Truncated Originator provides a means for a Device to derive the Originator Counter (and therefore the UTRN Counter) for the Prepayment Top Up Command when it is entered locally (as a numeric 20 digit code). In order to determine the UTRN Counter, the Device uses the algorithm defined in Section 14.6. There is no additional impact to the Device as the same UTRN Counter cache is used as for the UTRN Counter. Remote Party Floor Sequence Numbers 64-bit values carried in Update Security Credentials Command, in: newRemotePartyFloorSeqNumber attribute; otherRemotePartyFloorSeqNumber sequence; attribute; and sequence; The values are used to set Counters associated with the credential being updated to new values. Processing is as detailed in Section 13.3.5.10. Remote Party Floor Sequence Numbers are of two types: Remote Party Sequence Numbers. Values used to set Execution Counters on a change of a Remote Party’s digital signing credential with which the counter is associated; and Remote Party Specialist Sequence Numbers. Value is used to populate UTRN Counter cache following its clearance on change of the Supplier Key Agreement Prepayment credential. Both types have a ‘new’ and ‘other’ variant. ‘new’ is used when the authorising remote party is changing its own credentials (e.g. r
5 Calculate p – 29 (Call this variable, x) (See footnote ) x = 812 - 512 100101100 300 6 Calculate p + 29 (Call this variable, y) y = 812 + 512 10100101100 1324 7 Test r against x and y and set s accordingly If r < x then s = r + 210 If r > y then s = – 210 Else s = r 300 < 812 < 1324, therefore s = r 1100101100 812 8 Set deduced Originator Counter = (q + s) *232 10,560,878,642,999,590,912 9 Set deduced UTRN Counter as most significant 32 bits of Deduced Originator Counter 2,458,896,172 Table 27: Derivation of the UTRN Counter from the PTUT Truncated UTRN Counter – a worked example