4.3 Entity identification
Devices and services in Amazon Sidewalk have unique identification numbers. Endpoints are identified by a Device ID number, Cloud Services are identified by a Cloud Service ID.
4.3.1 Device ID
Device ID is a number that uniquely identifies a device in the Amazon Sidewalk network. Amazon Sidewalk has three types of Device ID:
- 32 B SMSN
- 5 B Sidewalk ID
- 5 B TXID
4.3.2 Sidewalk Manufacturing Serial Number (SMSN)
For registration, the Amazon Sidewalk protocol shall use a subset(Size encoded 5B) of the Amazon Sidewalk Manufacturing Serial Number (SMSN) as the Device ID. The SMSN is constructed by calculating a hash over numbers of device-unique fields, using the following formula:
- SMSN=SHA256(DMS-DeviceType, ([DSN | unique serial number], APID))
where:
- SMSN - Unique identifier generated from values controlled by the customer. The unique identifier is the result of a SHA256 hashing calculation
- DMS-DeviceType - device type issued by DMS for the customer.
- DSN or Unique Serial Number - customer provided identifier that is unique to a particular device. If the customer has the concept of a Device Serial Number (DSN) this can be used, otherwise a UUID is sufficient.
- APID- Advertised Product ID - shortened product ID delivered by DMS present in the MFG page.
4.3.3 Amazon Sidewalk ID
The Amazon Sidewalk ID is onboarded to the Endpoint during the registration process. After the registration process, the Amazon Sidewalk ID is not used for communication within the Amazon Sidewalk network. The Amazon Sidewalk ID is not used after registration to help protect user privacy. Instead of the Amazon Sidewalk ID, TXID is used in the Amazon Sidewalk network. The process of assigning a ”random ID” (TXID) to a device is called obfuscation. For more information, see section 4.6.
| Device ID Type | Sub-Type | Usage | Periodicity |
|---|---|---|---|
| SMSN | Device Registration | Pre-registration | |
| Sidewalk ID | Device Registration | During registration | |
| TX_ID | Counter-based | 1. Time sync on device when device has no notion of time 2. Deregistration from cloud Service when device has no notion of time | During time synchronization and factory reset |
| TX_ID | Time Based | 1. Regular Sidewalk data path communication 2. Periodic time sync for error correction in deviation when device has notion of time 3. Deregistration from cloud Service when device has notion of time | Every 15 min |
For the Endpoint, the first 3 bits are defined as 0b101 and the remaining 37 bits allow more than 137 billion devices to be addressed. Device identity (Device ID and credentials) is built during the manufacturing provisioning process. During device provisioning, device control records containing the device serial number (SMSN) and public keys issued are stored in control logs, and uploaded to AWS. For more information, see section 4.4.2.
4.3.4 Service ID
Cloud services are identified by a unique Cloud Service ID number. Because Cloud Service ID can have a value from 0 to 237 - 1, it is not required to send 5 B size-encoded Cloud Service ID address over the air.Figure 4.5 is an example of Cloud Service ID 36 (0x24) being converted to a size-encoded address.
There are four types of devices in the Amazon Sidewalk network (Endpoint, Gateway, Amazon Sidewalk Network Server and Application Server). Each device contains a unique ID (identity). IDs are secured by identity credentials built into the device during device manufacturing/releasing. Keys and certificates are issued based on the PKI security model using PKI certificates stored in the devices. Devices are connected by encrypting network and application data with separate keys. Links between termination points at each layer are secured by encryption with an ephemeral key exchange.
Endpoint ’K’ (one of k Endpoints connected to a Gateway ’M’) contains credentials related to its own ID, Link Layer related to temporary Endpoint’s TXID, application layer and PKI infrastructure. Gateway ’M’ (one of m Gateways connected to a Network Server) contains credentials related to its own ID, Network Server credentials associated with its own ID and PKI certificates. Network Server contains its own credentials, a list of credentials related to each of the Gateways connected to the Network Server at the Network Layer, and a list of credentials of each Endpoint (addressed by TXID and Device ID) at the Link Layer. Application Server contains its own credentials and also Endpoint credentials.
Figure 4.6 shows an overview of certificate and key locations within the system. Associated credentials are presented in dotted boxes.
fig 4.6 Sidewalk network security