Skip to main content
For the complete documentation index, see llms.txt.

Hubble Network developer documentation: integrate Bluetooth devices with terrestrial and satellite connectivity.

Network Security

Hubble Network is designed for end-to-end data security, from anonymous, encrypted device broadcasts to protected cloud storage.

  • Devices remain anonymous on the network through KBKDF (Key-Based Key Derivation Function) and secure key management on the device.
  • Each transmission is encrypted using AES (Advanced Encryption Standard) counter mode, with CMAC (Cipher-based Message Authentication Code) providing message authentication to ensure integrity. Hubble's backend validates message sequence numbers to prevent replay attacks.
  • On the cloud, data is encrypted at rest and protected with authentication-based access control for your organization, following industry best practice security standards.

Each packet transmitted using the Hubble protocol can also carry a customer-defined encrypted payload, enabling double envelope encryption as a best practice. If encrypted by you, the network user, your private data is never visible to Hubble Network.

Learn more about Hubble's encyrption process and secure key management on the Terrestrial Network module Security Overview.

End-to-End Data Security​

"Dual layered network encryption"

1. Optional customer-managed encryption at payload creation​

To achieve full end‑to‑end encryption, you can add your own encryption layer between the device and your server. For example, your device can retrieve a nonce from the Hubble Device SDK and apply proprietary encryption. You also control the retention period of your encrypted data, managing how long it persists outside your systems.

2. From the Bluetooth® device to the Hubble Terrestrial Network Partner Gateway​

The Hubble SDK encrypts each packet using AES in counter mode. Except for the Hubble identifier in the advertisement payload (16‑bit Service UUID), the entire payload is encrypted and unreadable to the partner gateway.

3. From the Hubble Partner backend to the Hubble Cloud​

Data remains encrypted with AES in counter mode. The partner backend does not store the data—it is immediately forwarded to the Hubble Cloud.

4. Decryption and validation in the Hubble Cloud​

Payloads are decrypted using the key provisioned at device registration. CMAC authentication tags are verified to ensure message integrity and authenticity. If customer‑managed encryption was applied, the payload content remains encrypted.

5. From the Hubble Cloud to your cloud​

Decrypted packets are delivered to your server. If you applied your own encryption layer, you perform the final payload decryption using your key. On the Hubble backend, all data at rest is stored in encrypted storage and access is authenticated.