4.8 Flex Layer messaging
4.8.1 Flex Layers
Flex Layer headers use a Type, Length Value (TLV) format. The Flex Layer header format is used for Network Layer header content and Link Layer header content in the Flex headers for Gateway to cloud communication and for cloud to Gateway communication. Flex headers are also used to achieve different security layers for communications. Single and Double flex headers are supported in Amazon Sidewalk communication.
4.8.2 Flex Layers message flow
It is assumed that the Gateway is registered in the Amazon Sidewalk network. See section 4.4.2.1. It is assumed that the Endpoint has successfully finished the Join procedure, and the Endpoint time is synchronized.
A packet received from the Endpoint (with TXID) is encrypted with the Gateway’s GCM_KEY and encapsulated in an inner flex packet (inner flex headers are added).
The whole inner flex packet is encapsulated in an outer flex frame (with header and security related metadata) and sent over a TCP/IP secured link towards the Network Server in the Sidewalk Cloud. The Network server, recovers the Device ID from the TXID, decrypts the flex data using the GCM_KEY key and routes the encrypted message to the Application server. The Application server decrypts the payload data and redirects the payload to the relevant Third party Application ID.
Downlink sequence: A message with the destination Device ID is encrypted (using APP_CTR_KEY) and is sent to Network server. A TXID is generated from the Device ID, based on an internal map for device obfuscation. The Inner Flex headers are added and the payload is encrypted with the GCM_KEY. The message is encapsulated in an outer Flex message (headers and security related data are added) and the outer Flex message is sent over secured TCP/IP network to the Gateway. The Gateway decrypts the Flex payload using the GCM_KEY and places the packet with the TXID in a queue (the App message in the Flex payload is still encrypted with the APP_CTR_KEY). The packet is scheduled and sent over the air with preamble and PHY headers. If the Endpoint successfully receives the packet, the Endpoint decrypts the packet using the APP_CTR_KEY (and metadata). For flow diagrams see figure 4.24 and figure 4.25.
