wMBus Protocol & AES Decryption: How Smart Water Meters Communicate

Wireless M-Bus (wMBus) is the European standard for reading utility meters wirelessly. Combined with AES-128 encryption, it ensures secure transmission of consumption data from smart water meters. This technical guide explains how wMBus works and how MeterSync decrypts meter data in real-time.

Understanding wMBus Protocol

wMBus operates in the 868 MHz (Europe) or 169 MHz bands with variants for different use cases: Mode S (Stationary, one-way), Mode T (Frequent transmit, short range), Mode C (Compact, bidirectional). Kamstrup FlowIQ meters use Mode C1 with 16-second transmission intervals, achieving ranges up to 1000m in open areas.

wMBus Frame Structure

Each wMBus telegram contains: L-field (length), C-field (control), M-field (manufacturer ID), A-field (meter address), CI-field (control info), and the encrypted data payload. The manufacturer ID for Kamstrup is 'KAM' (0x2D2C). Understanding frame structure is essential for developing custom gateways and parsers.

AES-128 Encryption in Meters

Kamstrup meters use AES-128 CBC (Cipher Block Chaining) mode with a unique encryption key per meter. The 16-byte key is provided by Kamstrup during procurement. Without the correct key, meter data appears as random bytes. This prevents unauthorized reading and ensures only authorized systems can access consumption data.

MeterSync Decryption Process

MeterSync mobile app receives raw wMBus frames via BLE from our gateway or directly from BLE-enabled meters. The app extracts the encrypted payload, retrieves the meter's AES key from secure storage, and performs CBC decryption. The decrypted data includes volume (total and flow rate), water temperature, error codes, and timestamps.

Data Fields Decoded

After decryption, MeterSync parses: VIF (Value Information Field) identifying the data type, DIF (Data Information Field) specifying format and units, and the actual value. Kamstrup meters report volume in liters with 0.001L resolution, instantaneous flow in L/h, and various status flags for leak detection, reverse flow, and tamper alerts.