Z-Wave

How Z-Wave works

A Z-Wave network consists of internet of things (IoT) devices and a primary controller, also known as a smart home hub, which is the only device in a Z-Wave network that is usually connected to the internet. When a Z-Wave hub receives a command from a smart home application on a user's smartphone, tablet or computer, it routes the command to its destination device across networks of up to 232 devices -- including the hub.

Using source-routed mesh network technology, Z-Wave signals can hop through other Z-Wave devices to reach the device a user intends to control. Each Z-Wave network accommodates a maximum of four hops.

The Z-Wave protocol operates on the low-frequency 908.42 band in the U.S. and the 868.42 MHz band in Europe. Though interference with other home electronics, such as cordless phones, is possible, the protocol avoids interference with the 2.4 GHz band where Wi-Fi and Bluetooth operate.

Z-Wave offers transmission rates of small data packets using throughput rates of 9.6 kbps, 40 kbps or 100 kbps. The Z-Wave PHY and MAC layers are based on the ITU-T G.9959 global radio standard, and the protocol uses GFSK modulation and Manchester encoding. It also includes AES 128 encryption, IPv6 and multichannel operation.

In terms of identification and authorization, each Z-Wave network is identified by a network ID and each end device is identified with a node ID. The unique network ID prevents, for example, one Z-Wave-equipped house from controlling devices in another similarly equipped house.

Communication between devices ranges from 98 to 328 feet; the 500 Series has a range of 130 feet and the 700 Series 328 feet. Because walls and other dense building materials limit the range, the general deployment best practice is to place Z-Wave devices 50 feet or fewer apart for maximum signal strength.

Using a Z-Wave repeater -- an additional Z-Wave device between other devices -- or using line-powered -- not battery-powered -- devices in the network can also strengthen the signal and help it reach its destination. The maximum range with four hops is estimated to be 600 feet.

In regards to battery life, some 700 Series Z-Wave devices can last up to 10 years on a coin cell battery, while many other battery-powered devices last a year or longer.

All Z-Wave technology is backward-compatible.

To bear the Z-Wave branding, smart home products must become Z-Wave certified. This involves meeting a number of requirements and, most importantly, being interoperable with all other Z-Wave-certified devices.

History

First envisioned by Danish company Zensys, the Z-Wave protocol began as a light-control system for consumers and evolved into a home automation network mesh protocol implemented on a proprietary system-on-a-chip (SoC). The company aimed to make a simpler, less expensive alternative to existing smart home protocols. Zensys was acquired by Sigma Designs Inc. in 2008.

In 2001, the 100 Series chipset was released, followed by the 200 Series in 2005. In 2013, the 500 Series, also known as Z-Wave Plus, was released, offering a 50% improvement in battery life, 67% improvement in range and 250% more bandwidth, as well as plug-and-play capabilities and standardized, over-the-air updates.

The Z-Wave Alliance, a consortium of industry leaders, manufacturers and integrators aimed at developing and expanding Z-Wave applications and capabilities, was founded in 2005 when members from Intermatic Inc., Leviton Manufacturing Co. Inc., Wayne Dalton, Danfoss and Universal Electronics met with Zensys to discuss the state of home automation protocols. The more than 700 current members include D-Link Systems Inc., Honeywell International Inc., LG Electronics and Verizon, among others.

In 2016, some Z-Wave technology was made open source. Sigma Designs added an interoperability layer to the Z-Wave open source library with the aim to give software developers, manufacturers, hobbyists and academics, among others, the ability to read, use and comment on how Z-Wave works without joining the Z-Wave Alliance or purchasing a Z-Wave development kit. Prior to this, nondisclosure agreements were required, and the specifications were only available to Z-Wave Alliance members and Z-Wave development kit holders.

Sigma Designs also released the Z-Wave S2 security specification, the Z-Wave over IP Specification for transporting Z-Wave signals over IP networks and Z-Ware middleware in 2016.

In 2017, Sigma Designs announced Z-Wave SmartStart, a combination of the Z-Wave protocol and Z-Wave gateway software layers, allowing for preconfiguration and eliminating the need to manually add devices to a Z-Wave home network, as they can automatically connect when powered on.

The 700 Series was announced at the 2018 Consumer Electronics Show and will be available later in the year. This iteration offers a device-to-device range of more than 328 feet and a mesh range of more than 1,312 feet. It also uses a 32-bit Arm Cortex SoC, unlike previous versions that used the 8-bit Intel MCS-51/8051-compatible foundation.

In 2018, Sigma Designs sold Z-Wave to Silicon Labs.

Z-Wave adoption and popularity

In 2002, a reported six Z-Wave-certified devices were available on the market. In 2012, that number rose to 1,000. Currently, in 2018, more than 2,400 Z-Wave-certified devices are available from the more than 700 members of the Z-Wave Alliance.

Z-Wave's website claims it has the largest selection of smart products available across widely recognized brands, and that more than 100 million Z-Wave protocols have been sold for smart homes worldwide.

Today, Z-Wave-certified devices are used for remote control and management in a variety of smart home and IoT devices and applications, including smart thermostats, smart locks, smart lighting, smart sensors, smart plugs and outlets, and smart home hubs.

Z-Wave-certified products are available from brands including ADT, GE, Honeywell, Kwikset, Schlage and SmartThings.

Z-Wave security

Early on, Z-Wave had a bad security reputation. While it offered AES encryption, there were a number of security incidents involving Z-Wave largely due to implementation errors by manufacturers or manufacturers not using the recommended security in the first place.

In a 2013 Black Hat presentation, hackers demonstrated how to use the Z-Force packet interception and injection tool to identify a critical implementation vulnerability in the Z-Wave security layer. They showed how to compromise an AES-encrypted Z-Wave door lock, which turned out not to be a flaw introduced by Z-Wave, but by the door lock manufacturer. In response, Sigma Designs added additional security test cases to its certification processes.

In a 2016 ShmooCon presentation, two hackers demonstrated how the open source EZ-Wave penetration testing tool could be used to destroy lights and physically damage Z-Wave-certified devices. In their research, the hackers found that only nine of the 33 devices they tested supported AES. In turn, the Z-Wave Alliance made AES 128 encryption mandatory for a device to become certified.

The Z-Wave Alliance mandated Z-Wave-certified devices follow the Security 2 (S2) framework beginning in April 2017. This modified the process from a three-step process in the previous S0 framework to a one-step process in S2.

In an attempt to mitigate man-in-the-middle, distributed denial-of-service and brute-force attacks against Z-Wave devices, S2 uses elliptic curve Diffie-Hellman cryptography and requires a QR or PIN code at the device level for authentication. S2 also implements strengthened cloud communication by tunneling all Z-Wave over IP traffic through a secure TLS 1.1 tunnel.

In May 2018, researchers from Pen Test Partners found a five-year-old software vulnerability in the Z-Wave protocol dubbed Z-Shave, which affected an estimated 100 million SoCs in smart home devices manufactured by more than 2,400 vendors.

In the attack, one device is tricked into believing the other does not support Z-Wave's S2 framework, so it downgrades the device's security to the S0 framework for compatibility. As S0 uses a hardcoded encryption key, hackers in range can potentially intercept communication and smart lock keys to unlock home doors.

Silicon Labs refuted the ability of the attack, claiming that this attack requires close physical proximity to the device during the pairing process, which is done during initial installation or reinstallation. This means the user would have to be present at the time of the attack and would be made aware of a device running S0. The company also stated that it is updating the specification to ensure users get a warning any time a device is downgraded to S0. The user would have to acknowledge and accept the warning to run the system.

Z-Wave vs. Zigbee

Z-Wave and Zigbee are two of the biggest names in smart home communication protocols. Both use short-range, low-power radio signals and mesh network technologies, and both are secured using AES. However, there are some notable differences.

Z-Wave operates on the low-frequency 908.42 band while the Zigbee protocol operates at 2.4 GHz. While the higher frequency allows Zigbee to transmit more data faster -- 40-250 kbps to Z-Wave's 9.6 to 100 kbps -- it reduces the range of the signal. Z-Wave's range of 98 feet is greater than Zigbee's 32-foot range. As an open standard run by the Zigbee Alliance, Zigbee chips are available from multiple vendors, while Z-Wave chips are only available from Silicon Labs.

Zigbee is often perceived as more complex due to its multiple protocols; for example, it offers specifications for smart energy, healthcare, gateways and more -- which historically do not communicate well together. However, the release of Zigbee 3.0 aims to address this issue and address the complexity.

A Zigbee network, which doesn't have a maximum number of allowed hops, can support more than 65,000 devices, while a Z-Wave network, limited to four hops, supports a maximum of 232 devices.

Often considered an either/or situation, many smart home hubs today, including Samsung SmartThings and Wink Hub, support both standards, allowing Zigbee and Z-Wave devices to communicate with each other, so there is no need to choose one over the other.