Each end point has a network key registered at the Service Center, and messages are authenticated with a CMAC computed from that key, so telegrams from an unregistered device are not accepted. One nuance worth stating precisely, since the security guideline flags it itself: this is a symmetric key scheme, so any party holding the key, including a base station the device has attached to, could in principle also produce a message that authenticates as genuine. That is authenticity, not the stronger guarantee of non-repudiation you would get from a certificate-based system. Bidirectional devices reduce the exposure by deriving a fresh session key on every attachment, so a compromised session key does not expose the device’s entire lifetime of traffic.