7.4 Security and Privacy
The data payloads transported using the Sidewalk File Transfer protocol are encrypted and authenticated using the Application layer key and the network layer keys.
The application layer file fragments are encrypted with the per device application layer key and the network layer payload chunks are encrypted with the per device network keys.
This allows for added security even in cases where an end-device might been physically compromised. The protocol also uses a hash integrity checking at the application layer to ensure the overall integrity of the file delivered.
The diagram below describes the security flow of the file fragmented payloads transported between the cloud and the device.
The File is initially fragmented into fragment_size fragments and encrypted by AWS IoT using the per device application keys. A hash of the fragment is also calculated and passed to the network Server. The network server further splits each fragment into MTU size chunks and also encrypts each chunk with the per device network layer keys and sends each chunk to the gateway to the end device.
The received chunks on the end nodes are decrypted and re-assembled into a fragment and decrypted and integrity validated using the hash sent from AWS IoT. Upon successful validation, the fragment is sent to the user application to write to flash and re-assemble the file.
