AES128 Mesh Encryption
All communication between tags, anchors, and gateways in the Wirepas mesh network is encrypted using AES128 at the link layer. This is built into the Wirepas stack and cannot be disabled.
Link-layer encryption
Every radio packet between mesh nodes is encrypted and authenticated using AES128-CCM. This prevents eavesdropping, replay attacks, and message injection. An attacker with a radio receiver cannot read or modify mesh traffic.
Key provisioning
Encryption keys are provisioned during tag configuration via NFC. Each network has its own encryption key. Tags that do not have the correct key cannot join the network or decode any traffic.
End-to-end data integrity
Sensor data is encrypted in the mesh and transmitted over TLS from the gateway to the cloud. At no point does data travel unencrypted. The gateway itself does not store data persistently.
AES128 encryption is a property of the Wirepas mesh protocol. TagFinder does not implement its own radio encryption — it relies on Wirepas, which is proven at scale with over 700,000 deployed devices.