2.2.8. Anti-theft Command Class, version 2 [DEPRECATED]

Warning

THIS COMMAND CLASS VERSION HAS BEEN DEPRECATED

New implementations SHOULD use the Anti-theft Command Class, version 3.

The Anti-theft Command Class MUST NOT be supported unless the Device Class or Device Type implemented by the device explicitly allows for support of the Anti-theft Command Class.

The Anti-theft Command Class is intended for devices operating in public locations such as hotel rooms or a conference center. The purpose of the Anti-theft Command Class is to render a device useless if it is removed from its actual network without being unlocked by the owner or a service provider.

The Anti-theft Command Class is used to disable all command classes related to the actual application functionality of a device if is it excluded and later included in another network. It does not matter if the device implements a single resource addressed via the Root Device or a collection of resources addressed via individual Multi Channel End Points Enabling anti-theft protection in a device MUST NOT change any operation with respect to supported/controlled command classes as long as the device stays in the actual network.

If a locked device is excluded, it MUST enter the protected state. When in the protected state, the node information frame (NIF) MUST NOT advertise support of the protected command classes.The NIF MUST however continue advertising support of the Anti-theft Command Class and all other non-application specific command classes; just as when the device operates in its home network.

The device MUST NOT respond to application commands while in the protected state. A device in protected state MUST NOT leave its protected state if it is re-included into its home network. Another Anti-Theft Set command MUST be used to either disable locking or to clear the protected state.

The following non-device specific command classes must not be protected by the anti-theft functionality (i.e. will always be available in the device regardless of protection state):

  • Manufacturer Specific Command Class

  • Version Command Class

  • Anti-theft Command Class

  • Security Command Class (optional)

    Security encapsulated command classes are allowed to be protected. In that case they must be removed from the Security Commands Supported Report Command when in the protected state in a foreign network.

The protection state may be updated by sending the set command with the correct magic code to the device at any time and in any network. When the protection state is updated the device must return to normal operation, regardless of whether the update is to disable or re-enable protection. However, it is not possible to update protection state when device is excluded because it must be able to receive a command.

The Anti-theft protection state must be preserved in the following situations:

  • Exclusion of a network

  • Reset to factory default

  • OTA update of firmware

If secure device, supports Anti-theft Command Class, Security Command Class needs to be supported regardless of anti-theft protection state. A security enabled device MUST be able to join any secure Z-Wave network regardless of its anti-theft protection state.

It is RECOMMENDED for a device that supports anti-theft protection to have physical mark that indicates that this device is capable of being locked. It is further RECOMMENDED that the device is capable of signaling via a LED or other means if the device refuses inclusion in a network because the device is locked to another network. Finally, the user guide and installation manual MUST advertise support of anti-theft protection.

2.2.8.1. Anti-theft Set Command

This command is used to enable/disable anti-theft protection in a device already included into a Z-Wave Network by sending a magic code to device in question. The same magic code MUST be used to disable anti-theft protection again. A new magic code may be used the next time to enable anti-theft protection in the device, but only if protection is disabled at the time. A new device MUST have anti-theft protection disabled. Enabling anti-theft protection in an already-enabled device restores it to normal operation if it is in reduced functionality mode, but otherwise has no effect.

Table 2.41 Anti-theft Set Command

7

6

5

4

3

2

1

0

Command Class = COMMAND_CLASS_ANTITHEFT (0x5D)

Command = ANTITHEFT_SET (0x01)

Enable

Number of Magic Code bytes

Magic Code 1

…

Magic Code N

Manufacturer ID MSB

Manufacturer ID LSB

Anti-theft Hint Number Bytes

Anti-theft Hint Byte 1

…

Anti-theft Hint Byte N

Enable (1 bit)

The value MAY be 0 (Attempt to disable anti-theft protection in device) or 1 (Attempt to enable or re-enable anti-theft protection in device). It is not necessary to first disable an exclude device having protection enable; it can be re-enabled directly in a new network by using correct magic code again.

Number of Magic Code bytes (7 bits)

Indicates the Number of Magic Code fields N used in bytes. Maximum number of Magic Code fields MUST NOT exceed 10 bytes.

Magic Code (N bytes)

The Magic Code fields hold the code to enable/disable the Z-Wave device in question.

Manufacturer ID (2 bytes)

The Manufacturer ID of the company’s product having a central role in the application requiring anti-theft protection enabled. Device should report 0xFFFF if anti-theft protection is disabled.

Manufacturer identifiers can be found in [33].

Number of Anti-theft Hint bytes (8 bits)

Indicates the Number of Anti-theft Hint fields N used in bytes. If length is 0 no Hint provided. Maximum number of Anti-theft Hint fields MUST NOT exceed 10 bytes.

Anti-theft Hint Byte (N bytes)

Anti-theft Hint Bytes that may be used as an identifier or key value for retrieving the Magic Code. The exact format and meaning of these Bytes is specific to the product or service that enabled anti-theft protection on the device, as identified by the Manufacturer ID above. If it is necessary to render the Hint Bytes for display, each byte should be interpreted as an unsigned integer value and represented in hexadecimal.

2.2.8.2. Anti-theft Get Command

This command is used to get an Anti-theft Report Command showing status of the Z-Wave device in question.

The Anti-theft Report Command MUST be returned in response to this command.

This command MUST NOT be issued via multicast addressing.

A receiving node MUST NOT return a response if this command is received via multicast addressing. The Z-Wave Multicast frame, the broadcast NodeID and the Multi Channel multi-End Point destination are all considered multicast addressing methods.

Table 2.42 Anti-theft Get Command

7

6

5

4

3

2

1

0

Command Class = COMMAND_CLASS_ANTITHEFT (0x5D)

Command = ANTITHEFT_GET (0x02)

2.2.8.3. Anti-theft Report Command

This command is used to report status of the Z-Wave device in question.

Table 2.43 Anti-theft Report Command

7

6

5

4

3

2

1

0

Command Class = COMMAND_CLASS_ANTITHEFT (0x5D)

Command = ANTITHEFT_REPORT (0x03)

Anti-theft Protection Status

Manufacturer ID MSB

Manufacturer ID LSB

Anti-theft Hint Number Bytes

Anti-theft Hint Byte 1

…

Anti-theft Hint Byte N

Anti-theft Protection Status (8 bits)

Anti-theft Protection Status specifies the actual status of Z-Wave device in question. Refer to the table below with respect to defined status values.

Table 2.44 Anti-theft Protection Status

Value

Anti-theft Protection Status

0x00

Reserved.

0x01

Anti-Theft Protection is currently DISABLED, and the Z-Wave Device is fully functional.

0x02

Anti-Theft Protection is currently ENABLED, and the Z-Wave Device is fully functional.

0x03

Anti-Theft Protection is currently ENABLED, and the Z-Wave Device is NOT fully functional (i.e., the Device was excluded from a network without disabling protection, and an ANTITHEFT_SET command with the correct Magic Code has not yet been received in the current network).

0x04..0xFF

Reserved

Manufacturer ID (2 bytes)

The Manufacturer ID of the company’s product having a central role in the application requiring anti-theft protection enabled. Device should report 0xFFFF if anti-theft protection is disabled.

Number of Anti-theft Hint bytes (8 bits)

Indicates the Number of Anti-theft Hint fields N used in bytes. If length is 0 no Hint provided. Maximum number of Anti-theft Hint fields MUST NOT exceed 10 bytes.

Anti-theft Hint Byte (N bytes)

Anti-theft Hint Bytes. See the Anti-Theft Set Command for more details.

2.2.8.4. Examples

Following examples are for reference only.

2.2.8.4.1. Example of a non-secure Thermostat

Below is shown an example of the Node Information Frame (NIF) content for a non-secure thermostat. The first NIF shows a device having anti-theft protection disabled. The device may never been included into a network or reside in a network or excluded from a network:

Table 2.45 Disabled Anti-theft Protection

Disabled anti-theft protection

Manufacturer Specific Command Class

Version Command Class

Anti-theft Command Class

Thermostat Operating State Command Class

Thermostat Mode Command Class

Association Command Class

Battery Command Class

The second NIF shows a device having anti-theft protection enabled. The device may be excluded from network in which it was originally anti-theft protection enabled or re-included into a network. This also applies in case device is re-included into the network, which device originally was anti-theft protection enabled:

Table 2.46 Enabled Anti-theft Protection

Enabled anti-theft protection

Manufacturer Specific Command Class

Version Command Class

Anti-theft Command Class

2.2.8.4.2. Example of a security enabled Thermostat

Below is shown an example of the Node Information Frame (NIF) content for a security enabled thermostat. The first NIF shows a device having anti-theft protection disabled. The device may never been included into a network or reside in a network or excluded from a network:

Table 2.47 Disabled Anti-theft Protection, example 2

Disabled anti-theft protection

Manufacturer Specific Command Class

Version Command Class

Security Command Class

Finally, the Security Commands Supported Report Command reports support of the following command classes:

  • Anti-theft Command Class

  • Thermostat Operating State Command Class

  • Thermostat Mode Command Class

  • Association Command Class

  • Battery Command Class

The second NIF shows a device having anti-theft protection enabled. The device may be excluded from network in which it was originally anti-theft protection enabled or re-included into a network. This also applies in case device is re-included into the network, which device originally was anti-theft protection enabled. The NIF is unchanged because all application oriented command classes are security encapsulated except the default command classes:

Table 2.48 Enabled Anti-theft Protection, example 2

Enabled anti-theft protection

Manufacturer Specific Command Class

Version Command Class

Security Command Class

Finally, the Security Commands Supported Report Command reports support of at least the Anti-theft Command Class to be able to disable anti-theft protection:

  • Anti-theft Command Class

The Anti-theft Command Class is supported securely making malicious attempts to enable anti-theft protection very difficult.