Chapter 5 of 6 · KNX Secure
Security needs a status you can understand.
KNX Atlas shows which secure information a project contains and what a connection is missing. KNX IP Secure and KNX Data Secure are marked exactly where they matter for your work.
01
A dedicated view of the secure information
The “Security” area brings together the interfaces, tunnels and secure group addresses found in the project. For a tunnel you see its address, user assignment and whether the required credentials are present.
For secure group addresses, the state of the key information is visible. Missing or invalid data appears with an explanation – instead of a generic error when connecting.
02
Tell IP Secure and Data Secure apart
KNX IP Secure protects the IP connection to the interface, KNX Data Secure the group communication itself. A secure tunnel therefore does not automatically mean that every group address uses Data Secure.
Interfaces and tunnels
Check the assignment and available credentials of the connection.
Group addresses
Recognise secure addresses and the state of their keys.
Write dialog
See that a prepared value will be sent securely.
Commissioning
Downloads over secure tunnels and loading Data Secure devices.
03
The difference stays visible in telegrams too
In the monitor, a secure telegram can be decrypted successfully, recognised as a replay, lack a matching key or be invalid. The app shows these states with text and a marker instead of folding them into a seemingly normal value.
In the CSV export, secure states appear as their own column. Decrypted content is exported only if you explicitly include project content.
04
Commission Data Secure devices
Loading a Data Secure device for the first time needs its device certificate (FDSK). With it, KNX Atlas switches on secure mode, writes the project’s tool key and then loads under that key – in the order ETS uses. Later downloads only use the tool key.
The FDSK stays in memory for the session only and is never shown or stored. To tell certificates apart, the app shows only a four-character identifier. More in the Commissioning chapter.
05
The password belongs to your project file
A password-protected project needs its password. If you like, KNX Atlas remembers it in the device’s Keychain – not automatically, and bound to the specific file. A newly exported project is not opened with an old password by default.
There is no field to enter arbitrary keys for the secure tools. The app uses the information of the opened project and tells you when no suitable connection is possible from it.
06
Handle files, Keychain and exports with care
The project is processed locally on your device; no upload is needed, and KNX Atlas contains no tracking. A file in iCloud Drive or with another provider is also subject to that provider’s sync.
A CSV export or a saved project copy can also contain names, values and relationships of your installation. Where you store them and what you export remains your conscious decision.
Frequently asked questions
Where does KNX Atlas get the secure keys from?
From the opened, password-protected project. ETS stores the credentials for tunnels and the keys of secure group addresses there. If something is missing, the security overview shows exactly what.
Are my project passwords synced?
No. Remembered passwords live in each device’s Keychain and are not meant to sync. On another device you enter the password again.
Can I read and write Data Secure group addresses?
Yes, if the keys are in the project. The session and the confirmation dialog show that the value is sent securely.