WLAN Standardization Maximilian Riegel <maximilian.riegel@icn.siemens.de>

1. WLAN StandardizationMaximilian Riegel<maximilian.riegel@icn.siemens.de>

2. Outline • WLAN application architecture • IEEE802.11 standards family • Physical layer • 5 GHz considerations • Configurations • MAC layer functions • Power Management • Roaming • Privacy and access control • 5 GHz Harmonization • WECA • Access control for public hot spots • A last word about WLAN security...

3. Railway Station Airport PublicWLAN Campus WLAN has taken of… • WLAN is more than just cable replacement! • It provides hastlefree broadband Internet access everywhere. • Today’s road worriers require access to the Internet everywhere. • Only coverage in ‘hot-spots’ needed. • IEEE802.11b meets the expectations for easyness, cost and bandwidth. Office Hospital Office Congress hall,Hotel Semi-publicWLAN Corporate WLAN Plant Remote Access HomeWLAN

4. Wireless LAN IEEE802.11 Basic Architecture local distribution network internet Netscape apache http http tcp tcp ip ip ip ip ip 802.2 ppp 802.2 802.2 802.2 802.2 ppp Bluetooth 802.11 802.11 802.3 802.3 802.3 802.3 Bluetooth IEEE802.11 Client Access Point Access Router Server

5. Wireless IEEE802.11 Standard • Operation in the 2.4GHz ISM band • USA: FCC part 15.247-15.249 • Europe: ETS 300-328 • Japan: RCR-STD-33A • Supports three PHY layer types: DSSS, FHSS, Infrared • MAC layer common to all 3 PHY layers • Supports peer-to-peer and infrastructure configurations • High data rate extension IEEE802.11b with 11 Mbps using existing MAC layer • IEEE802.11a for operation in the 5 GHz band using the same MAC layer with up to 54 Mbit/s Approved June 1997 802.11b approved Sept. 1999

6. IEEE802.11 Protocol Architecture LLC = 802.2 • MAC Entity • basic access mechanism • fragmentation • encryption • MAC Layer Management Entity • synchronization • power management • roaming • MAC MIB • Physical Layer Convergence Protocol (PLCP) • PHY-specific, supports common PHY SAP • provides Clear Channel Assessment signal (carrier sense) • Physical Medium Dependent Sublayer (PMD) • modulation and encoding • PHY Layer Management • channel tuning • PHY MIB • Station Management • interacts with both MAC Management and PHY Management MAC Layer Management MAC Sublayer MAC Station Management PHY Layer Management PLCP Sublayer PHY PMD Sublayer

7. IEEE802.11 Architecture Overview • One MAC supporting multiple PHYs • currently Frequency Hopping, Direct Sequence and Infrared PHYs • Two configurations • “Independent” (ad hoc) and “Infrastructure” • CSMA/CA (collision avoidance) with optional “point coordination” • Connectionless Service • Transfer data on a shared medium without reservation • data comes in bursts • user waits for response, so transmit at highest speed possible • is the same service as used by Internet • Isochronous Service • reserve the medium for a single connection and provide a continues stream of bits, even when not used • works only when cells (using the same frequencies) are not overlapping. • Robust against noise and interference (ACK) • Hidden Node Problem (RTS/CTS) • Mobility (Hand-over mechanism) • Power savings (Sleep intervals) • Security (WEP)

8. Frequency Time IEEE 802.11 – 2.4 & 5 GHz Physical Layers • Baseband IR, 1 and 2Mbps, 16-PPM and 4-PPM • 2.4 GHz Frequency Hopping Spread Spectrum • 2/4 FSK with 1/2 Mbps • 79 non overlapping frequencies of 1 MHz width (US) • 2.4 GHz Direct Sequence Spread Spectrum • DBPSK/DQPSK with 1/2 Mbps • Spreading with 11 Bit barker Code • 11/13 channels in the 2.4 GHz band • 2.4 GHz High Rate DSSS Ext. (802.11b) • CCK/DQPSK with 5.5/11 Mbps • 5 GHz OFDM PHY (802.11a) • Basic parameters identical toHiperLAN2 PHY • European regulatory issues unsolved Power Power spreading Frequency Frequency Power Frequency

9. Upcoming IEEE802.11gFurther Speed Extension for the 2.4GHz Band • PBCC proposal for 22 Mbit/s from Texas Instruments • CCK-OFDM proposal for up to 54 Mbit/s from Intersil • Selection process showed only a 55:45 majority for CCK-OFDM;>75 % necessary for acceptance as IEEE standard. Range vs. throughput rate comparison of • CCK (802.11b), • PBCC, • OFDM(802.11a), • CCK-OFDM (Batra, Shoemake; Texas Instruments; Doc: 11-01-286r2)

10. 5.150 5.250 Japan 5.150 5.350 5.725 5.825 Max peak Tx power USA Indoor 200 mW / Outdoor 1 W EIRP Outdoor 4 W EIRP DFS & TPC DFS & TPC 5.350 5.150 5.470 5.725 Max mean Tx power Europe Indoor 200 mW EIRP Outdoor 1W EIRP 5.100 5.300 5.400 5.500 5.600 5.700 5.800 5.900 5.200 DFS: Dynamic Frequency Selection TPC: Transmit Power Control Spectrum Designation in the 5 GHz range Freq./GHz

11. Upcoming IEEE802.11hSpectrum and Transmit Power Management • TPC (Transmission power control) • supports interference minimisation, power consumption reduction, range control and link robustness. • TPC procedures include: • AP‘s define and communicate regulatory and local transmit power constraints • Stations select transmit powers for each frame according to local and regulatory constraints • DFS (Dynamic Frequency Selection) • AP‘s make the decision • STA‘s provide detailed reportsabout spectrum usage at theirlocations. AP 2 AP 1 AP 3 STA

12. When will 5 GHz WLANs come... • IEEE802.11b (2.4 GHz) is now taking over the market. • There are developments to enhance IEEE802.11b for • more bandwidth (up to 54 Mbit/s) • QoS (despite many applications do not need QoS at all) • network issues (access control and handover). • 5 GHz systems will be used when the 2.4 GHz ISM band will become too overcrowded to provide sufficient service. • TCP/IP based applications are usually very resilient against ‘error proune’ networks. • Issues of 5 GHz systems: • Cost: 5 GHz is more expensive than 2.4 GHz • Power: 7dB more transmission power for same distance • Compatibility to IEEE802.11b/g necessary

13. IEEE802.11 Ad Hoc Mode • Independent networking • Use Distributed Coordination Function (DCF) • Forms a Basic Service Set (BSS) • Direct communication between stations • Coverage area limited by the range of individual stations Peer-to-Peer Network

14. IEEE802.11 Infrastructure Mode Wired Network • Access Points (AP) and stations (STA) • BSS (Basic Service Set): a set of stations controlled by a single coordination function • Distribution system interconnects multiple cells via access points to form a single network • Extends wireless coverage area and enables roaming Server BSS-A BSS-B

15. Upcoming IEEE802.11fInter-Access Point Protocol (IAPP) across Distribution Systems • IAPP defines procedures for • automatic configuration of additional access points • context transfer between APs when stations move Wired Network Server IAPP-ADD IAPP-MOVE

16. Busy Medium CSMA/CA Explained IFS: Inter Frame Space Free access when medium DIFS is free longer than DIFS • Reduce collision probability where mostly needed. • Stations are waiting for medium to become free. • Select Random Backoff after a Defer, resolving contention to avoid collisions. • Efficient Backoff algorithm stable at high loads. • Exponential Backoff window increases for retransmissions. • Backoff timer elapses only when medium is idle. • Implement different fixed priority levels Contention Window PIFS DIFS SIFS Backoff-Window Next Frame Slot time Select Slot and Decrement Backoff as long as medium is idle. Defer Access

17. IEEE802.11 Distributed Coordination Function (DCF) Station 1 Tx Data to STA 2 Short interval ensures ACK is sent while other stations wait longer Short deferral Station 2 Rx data from STA 1 ACK to STA1 STA 3’s back-off is shorter thanSTA 4’s therefore it begins transmission first Distributed inter-frame deferral Random back-off Distributed inter-frame deferral Station 3 Detects channel busy Detects channel busy Tx Data Distributed inter-frame deferral Random back-off Distributed inter-frame deferral Detects channel busy Detects channel busy Detects channel busy Station 4

18. IEEE802.11 Point Coordination Function (PCF) CFP repetition interval • Optional PCF mode provides alternating contention free and contention operation under the control of the access point • The access point polls stations for data during contentionfree period • Network Allocation Vector (NAV) defers the contention traffic until reset by the last PCF transfer • PCF and DCF networks will defer to each other • PCF improves the quality of service for time bounded data Contention Period Contention Free Period Access Point Beacon D1+Poll D2+Poll CF end U1+ACK U2+ACK Stations

19. CSMA/CA + ACK protocol DIFS • Defer access based on Carrier Sense. • CCA from PHY and Virtual Carrier Sense state. • Direct access when medium is sensed free longer then DIFS, otherwise defer and backoff. • Receiver of directed frames to return an ACK immediately when CRC correct. • When no ACK received then retransmit frame after a random backoff (up to maximum limit). Data Src SIFS Contention Window Dest Ack DIFS Other Next MPDU Backoff after Defer Defer Access

20. Access Point “Hidden Node” Provisions Problem – Stations contending for the medium do not Hear each other Solution – Optional use of the Duration field in RTS and CTS frames with AP CTS-Range STA “B” cannot receive data from STA “A” RTS-Range STA “B” STA“A” DIFS Data RTS STA A Ack CTS AP STA “B” cannot detect carrier from STA “A” Next MPDU STA B Time period to defer accessis based on duration in CTS Back off after defer

21. Upcoming IEEE802.11eMedium Access Control Enhancements for Quality of Service • EDCF (Enhanced Distributed Coordination Function) • differentiated DCF access to the wireless medium for prioritized traffic categories (8 different traffic categories) • output queue competes for TxOPs using EDCF wherein • the minimum specified idle duration time is a distinct value • the contention window is a variable window • lower priority queues defer to higher priority queues

22. Upcoming IEEE802.11eMedium Access Control Enhancements for Quality of Service • HCF (Hybrid coordination function) • only usable in infrastructure QoS network configurations (QBSS). • allow a uniform set of frame exchange sequences to be used during both the contention period (CP) and contention free period (CFP) • uses a QoS-aware point coordinator, called a hybrid coordinator (HC) • by default collocated with the enhanced access point (EAP) • uses the point coordinator's higher priority to allocate transmission opportunities (TxOPs) to stations • provides limited-duration contention free bursts (CFBs) to transfer QoS data. • meets predefined service rate, delay and/or jitter requirements of particular traffic flows. • QoS traffic from the EAP/HC can be based on the HC's QBSS-wide knowledge of the traffic • ... • „Quite complex method still under definition“

23. Power Management Approach • Allow idle stations to go to sleep • station’s power save mode stored in AP • APs buffer packets for sleeping stations. • AP announces which stations have frames buffered • Traffic Indication Map (TIM) sent with every Beacon • Power Saving stations wake up periodically • listen for Beacons • TSF assures AP and Power Save stations are synchronized • stations will wake up to hear a Beacon • TSF timer keeps running when stations are sleeping • synchronization allows extreme low power operation • Independent BSS also have Power Management • similar in concept, distributed approach

24. Infrastructure Power Management TIM-Interval DTIM interval • Broadcast frames are also buffered in AP. • all broadcasts/multicasts are buffered • broadcasts/multicasts are only sent after Delivery Traffic Indication Message (DTIM) • DTIM interval is a multiple of TIM interval • Stations wake up prior to an expected DTIM. • If TIM indicates frame buffered • station sends PS-Poll and stays awake to receive data • else station sleeps again Time-axis Busy Medium TIM TIM DTIM TIM TIM DTIM Broadcast AP activity Broadcast PS Station Tx operation PS-Poll

25. Access Point B Station 6 Station 2 Station 5 Access Point A Access Point C Station 4 Station 7 Station 3 Station 1 Roaming Approach • Station decides that link to its current AP is poor • Station uses scanning function to find another AP • or uses information from previous scans • Station sends Reassociation Request to new AP • If Reassociation Response is successful • then station has roamed to the new AP • else station scans for another AP • If AP accepts Reassociation Request • AP indicates Reassociation to the Distribution System • Distribution System information is updated • normally old AP is notified through Distribution System

26. IEEE802.11 privacy and access control • Goal of 802.11 is to provide “Wired Equivalent Privacy” (WEP) • Usable worldwide • 802.11 provides for an authentication mechanism • To aid in access control. • Has provisions for “OPEN”, “Shared Key” or proprietary authentication extensions. • Shared key authentication is based on WEP privacy mechanism • Limited for station-to-station traffic, so not “end to end”. • Uses RC4 algorithm based on: • a 40 bit secret key • and a 24 bit IV that is send with the data. • includes an ICV to allow integrity check.

27. Secret Key IV IV WEPPRNG IV WEPPRNG TX Secret Key Plaintext + + Ciphertext Ciphertext Plaintext Integrity Algorithm ICV'=ICV? ICV ICV Integrity Algorithm PLCPHeader Preamble MAC Header Payload CRC Encrypted IV(4) K-ID Cyphertext ICV (4) WEP privacy mechanism • WEP bit in Frame Control Field indicates WEP used. • Each frame can have a new IV, or IV can be reused for a limited time.

28. Station sends authentication request AP sends challenge text generatedwith the WEP algorithm Station encrypts challenge textand sends it to the AP AP decrypts the encrypted challenge text.Authentication successful if text matches original Shared key authentication Station Access Point • Shared key authentication requires WEP • Key exchange is not specified by IEEE802.11 • Only one way authentication Secret Key Loaded Locally Secret Key Loaded Locally

29. Shortcomings of plain WEP security • WEP unsecure at any key length • IV space too small, lack of IV replay protection • known plaintext attacks • No user authentication • Only NICs are authenticated • No mutual authentication • Only station is authenticated against access point • Missing key management protocol • No standardized way to change keys on the fly • Difficult to manage per-user keys for larger groups • WEP is no mean to provide security for WLAN access, • … but might be sufficient for casual cases.

30. Associate AuthenticationServer EAP Identity Request EAP Identity Response Access Request EAP Request Access Challenge EAP Response Access Request EAP Success Access Accept Upcoming IEEE802.11i Enhanced security • Enhanced encryption • WEP2 w/ increase IV space to 128bit, key length 128bit • optional: Advanced Encryption Standard (AES) • Authentication and key management by adoption of IEEE802.1X Standard for Port Based Network Access Control

31. Wireless LAN Standardization ETSI BRAN IEEE 802.11 UMTS Integration 802.11f: Inter Access Point Protocol HiperLAN/2 DFS & TPC 5 GHz 54 Mbit/s 802.11e: QoS Enhancements MAC 802.11i: Security Enhancements IEEE 802.11 802.11h DFS & TPC 802.11a 5 GHz 54Mbit/s 802.11g 2,4 GHz >20Mbit/s 802.11b 2,4 GHz 11Mbit/s PHY 2,4 GHz 2 Mbit/s Current standardization topics

32. Upcoming Harmonization of 5 GHz WLAN Standards • HiperLAN/2 • MAC • PHY 5GSG „coexistance issues“ • IEEE802.11a • MAC • PHY 5GWING -MAC -PHY • MMAC • MAC • PHY

33. WECA • Mission- Certify interoperability of IEEE 802.11 products- Promote Wi-FiTM as the global Wireless LAN standard for home, enterprise and public applications • Wi-Fi certification started in March 2000. • More than 80 certified products within 1 year. • Founding organizations:Lucent, Aironet (Cisco), 3Com, Intersil, Nokia, Symbol • 78 member companies today.

34. Office Hospital Railway Station Airport Campus Serving customers in public hot spots... Congress hall,Hotel • Do not touch customer equipment • Address all customers • Make access procedure self explaining

35. Probably to consider … • How does your favorite storefront look like? To much security might hinder your business!

36. Using a web page for initial user interaction Free local content services Authentication for Internet access Selection of billing method

37. Username: hello@wlan.d1.de html Password: ********** auth RADIUS client auth N Mobile Client Web based authentication DHCP Server Access Gateway internet AAA Server

38. WEP/WEP2 is probably not sufficient in public hot-spots: Only VPN technologies (IPSEC, TLS, SSL) will fulfil end-to-end security requirements. VPN technologies might even be used in corporate networks. IPSEC, TLS, SSL 802.11 WEP 802.11 802.11 802.11 802.11 802.11 A last word about WLAN security: Netscape apache http http tcp tcp ip ip ip ip ip ppp 802.2 802.2 802.2 802.2 802.2 ppp 802.3 802.3 802.3 802.3 Bluetooth

39. The end • Thank you for your attention. • Questions and comments? • Maximilian Riegel<maximilian.riegel@icn.siemens.de> • http://www.max.franken.de