1 / 15

Segregated Data Services in 802.11

Explore the need and implementation of VLANs for segregated data services in 802.11 networks, ranging from home setups to complex enterprise systems. Discover scenarios, requirements, and mechanisms for adding segregated services to IEEE 802.11 networks.

cynthias
Download Presentation

Segregated Data Services in 802.11

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. July 2007 Segregated Data Services in 802.11 Authors: Date: 2007-07-16 Slide 1 Donald Eastlake 3rd, Motorola

  2. July 2007 Abstract Essentially all 802.11 networks need VLANs or a similar mechanism for segregated data services. The need varies from a mild requirement to distinguish “visitors” from “residents” in a one AP home network to much stronger and more complex requirements in enterprise, municipal, and other systems. Scenarios and requirements for adding segregated services / VLANs to IEEE 802.11 are presented along with some comments on existing or prospective mechanisms. Slide 2 Donald Eastlake 3rd, Motorola

  3. July 2007 Motivation • Segregating traffic for “visitors” who should only have access to the Internet and limited facilities, from “insider” traffic. • Provision of different services for free and subscriptions services in Hot Zone or Municipal systems. (May also segregate subscription service through different carriers.) • In mesh environments, ability to safely forward data through nodes with limited trust. • To enable aggregation of traffic over a single infrastructure for efficient deployment. • Dedicated traffic segregation by type, such as VoIP Slide 3 Donald Eastlake 3rd, Motorola

  4. Protected Services Firewall MAP 1 AP 2 Example Scenario I(unified infrastructure, single interface end stations) Internet MAP 2 Local Station Local Station Local Station Guest Station Local VLAN Guest VLAN Wired Connection Local Station Guest Station

  5. Organization 1 Infrastructure Organization 2 Infrastructure Local Mesh Service Organization 1 Service Organization 2 Service Org 1MPP Org 1MP Org 2MP Org 2MP Org 2MPP Org 2MP Org 1MP Org 3MP Org 1MP Example Scenario II(diverse mesh, multi-interface mesh points) Internet

  6. July 2007 Tentative Requirements • Advertising Availability of Services • Associating/Authenticating/Authorizing for One or more Specific Services • Multiple Service Security Channels Between Two Stations • Transit Frame Labelling • Protection of Segregated Data from Unauthorized Access • Configuration and Management Slide 6 Donald Eastlake 3rd, Motorola

  7. July 2007 1. Advertising Availability of Services • Current practice: Transmit multiple Beacons, as is done at IEEE 802 meetings. • Work in progress: General Advertisement Service (GAS) mechanisms in 802.11 TGu (Interworking with External Networks). • Includes SSIDC (SSID Container IE) for transmission of multiple SSIDs (with or without multiple BSSIDs) in a single beacon. • Possible new work: • Extensions to TGu GAS. • Other mechanisms. Slide 7 Donald Eastlake 3rd, Motorola

  8. July 2007 2. Associating/Authenticating/Authorizing for a Specific Service • Current practice: Only one association, 802.11i security. • Work in progress: • TGw (Protected Management Frames) to extends security to some control messages • TGs (Mesh Networking) with authentication to mesh distinguished from authentication to an AP • TGu (Interworking with External Networks) different credentials/authentication for different back end carriers • Possible new work: Different credentials/authentication for different Services/VLANs. Slide 8 Donald Eastlake 3rd, Motorola

  9. July 2007 3. Multiple Service Security Channels Between Two Stations • Current Practice: • AP can have multiple security associations but each with a different end station. • Two stations can have multiple IPsec security associations or the like at the application level. • Work in Progress: TGs (Mesh Networking) permits multiple associations but each with a different mesh point. • Possible new work: • Different security associations for different services/VLANs • Development of a new Authenticator PAE function that can manage multiple SAs with a given neighbor Slide 9 Donald Eastlake 3rd, Motorola

  10. July 2007 4. Transit Frame Labelling • Current Practice: • Current standard explicitly permits 802.1Q-Tag in payload (802.11-2007 Annex M) but Q-Tag’s priority and VLAN ID fields are otherwise ignored. • Only obvious way is to use different MAC addresses. • Work in Progress: none...(?) • Possible new work: • Header addition to distinguish Service/VLAN • Other mechanisms Slide 10 Donald Eastlake 3rd, Motorola

  11. July 2007 5. Protection of Segregated Data from Unauthorized Access • Current Practice: Have to use IPsec or some similar application level mechanism to protect data at intermediate hops. • Work in Progress: none... • Possible new work: • Optional edge-to-edge security between original source station and final destination station. But not all services would require this. (If VLAN mapping is possible, authentication should be keyed to SSID, not VLAN ID.) Slide 11 Donald Eastlake 3rd, Motorola

  12. 6. Configuration and Management Current Practice: SNMP (Simple Network Management Protcol) GVRP (GARP VLAN Registration Protocol) Proprietary command line interfaces and protocols Work in Progress: SNMP MIB (Management Information Base) additions by TGu (Interworking with External Networks) Possible new work: MIB additions or other mechanisms for configuration and management including setting-up and deleting VLANs July 2007 Slide 12 Donald Eastlake 3rd, Motorola

  13. July 2007 Straw Poll • Should the 802.11 WNG SC proceed at this time to vote on a motion to set up a Study Group?Yes: No: • Should 802.11 receive further presentations on the topic of segregated data services for the purpose of exploring the creation of a Study Group at a later time? Yes: No: Slide 13 Donald Eastlake 3rd, Motorola

  14. Motion Moved, To request the IEEE 802.11 Working Group to approve and forward to the IEEE 802 Executive Committee the creation of a “WLAN Multiple Segregated Data Services” Study Group to draft a PAR and 5 Criterion for the provision of secure segregated data services in 802.11, such services to include some or all of the following: advertising and associating with such services; labeling frames per service; security of data within a service; and the configuration and management of such services. Moved: Seconded: Yes: No: Abstain: July 2007 Slide 14 Donald Eastlake 3rd, Motorola

  15. July 2007 References • Standard 802.11-2007 – WLANs • Standard 802.1Q-2005 – VLANs, GVRP • Draft 802.11s D1.05 – ESS Mesh Networking • Draft 802.11u D1.0 – Interworking with External Networks • Draft 802.11w D2.0, – Protected Management Frames • IETF STD 62 (IETF RFCs 3411 through 3418) – SNMP Slide 15 Donald Eastlake 3rd, Motorola

More Related