This chapter is from the book
This chapter is from the book
This chapter is from the book
IEEE 802.11 Services
The 802.11 standard defines services that provide the functions that the LLC layer requires for sending MAC Service Data Units (MSDUs) between two entities on the network. These services, which the MAC layer implements, fall into two categories:
Station Services These include Authentication, Deauthentication, Privacy, and MSDU delivery.
Distribution System Services These include Association, Disassociation, Distribution, Integration, and Reassociation.
The following sections define the station and distribution system services.
Station Services
The 802.11 standard defines services for providing functions among stations. A station may be within any wireless element on the network, such as a handheld PC or handheld scanner. In addition, all access points implement station services. To provide necessary functionality, these stations need to send and receive MSDUs and implement adequate levels of security.
Authentication
Because wireless LANs have limited physical security to prevent unauthorized access, 802.11 defines authentication services to control LAN access to a level equal to a wired link. Every 802.11 station, whether part of an independent BSS or an ESS network, must use the authentication service prior to establishing a connection (referred to as an association in 802.11 terms) with another station with which it will communicate. Stations performing authentication send a unicast management authentication frame to the corresponding station.
The IEEE 802.11 standard defines the following two authentication services:
Open system authentication This is the 802.11 default authentication method. It is a very simple two-step process. First the station wanting to authenticate with another station sends an authentication management frame containing the sending station's identity. The receiving station then sends back a frame indicating whether it recognizes the identity of the authenticating station.
Shared key authentication This type of authentication assumes that each station has received a secret shared key through a secure channel independent from the 802.11 network. Stations authenticate through shared knowledge of the secret key. Use of shared key authentication requires implementation of the Wired Equivalent Privacy algorithm (WEP).
Deauthentication
When a station wants to disassociate from another station, it invokes the deauthentication service. Deauthentication is a notification and cannot be refused. A station performs deauthentication by sending an authentication management frame (or group of frames to multiple stations) to advise of the termination of authentication.
Privacy
With a wireless network, all stations and other devices can hear data traffic taking place within range on the network, seriously affecting the security level of a wireless link. IEEE 802.11 counters this problem by offering a privacy service option that raises the security level of the 802.11 network to that of a wired network.
The privacy service, applying to all data frames and some authentication management frames, is based on the 802.11 Wired Equivalent Privacy (WEP) algorithm that significantly reduces risks if someone eavesdrops on the network. This algorithm performs encryption of messages, as shown in Figure 3.9. With WEP, all stations initially start unencrypted. Refer to the section "Private Frame Transmissions," in Chapter 4, "IEEE 802.11 Medium Access Control (MAC) Layer," for a description of how WEP works.
){kind=link}
Figure 3.9 The Wired Equivalent Privacy (WEP) algorithm produces ciphertext, keeping eavesdroppers from listening in on data transmissions.
NOTE
The WEP protects RF data transmissions using a 64-bit seed key and the RC4 encryption algorithm. When enabled, WEC protects only the data packet information. Physical layer headers are left unencrypted so that all stations can properly receive control information for managing the network. Some companies today are offering 128-bit encryption.
Distribution System Services
Distribution system services, as defined by 802.11, provide functionality across a distribution system. Access points provide distribution system services. The following sections provide an overview of the services that distribution systems need to provide proper transfer of MSDUs.
Association
Each station must initially invoke the association service with an access point before it can send information through a distribution system. The association maps a station to the distribution system via an access point. Each station can associate with only a single access point, but each access point can associate with multiple stations. Association is also a first step to providing the capability for a station to be mobile between BSSs.
Disassociation
A station or access point may invoke the disassociation service to terminate an existing association. This service is a notification; therefore, neither party may refuse termination. Stations should disassociate when leaving the network. An access point, for example, may disassociate all its stations if being removed for maintenance.
Distribution
A station uses the distribution service every time it sends MAC frames across a distribution system. The 802.11 standard does not specify how the distribution system delivers the data. The distribution service provides the distribution system with only enough information to determine the proper destination BSS.
Integration
The integration service enables the delivery of MAC frames through a portal between a distribution system and a non-802.11 LAN. The integration function performs all required media or address space translations. The details of an integration function depend on the distribution system implementation and are beyond the scope of the 802.11 standard.
Reassociation
The reassociation service enables a station to change its current state of association. Reassociation provides additional functionality to support BSS-transition mobility for associated stations. The reassociation service enables a station to change its association from one access point to another. This keeps the distribution system informed of the current mapping between access point and station as the station moves from one BSS to another within an ESS. Reassociation also enables changing association attributes of an established association while the station remains associated with the same access point. The mobile station always initiates the reassociation service.
NOTE
IEEE 802.11 allows a client to roam among multiple access points that may be operating on the same or separate channels. To support the roaming function, each access point typically transmits a beacon signal every 100ms. Roaming stations use the beacon to gauge the strength of their existing access point connection. If the station senses a weak signal, the roaming station can implement the reassociation service to connect to an access point emitting a stronger signal.
Case Study 3.5: Using Reassociation for Improved Signal Transmission
A grocery store in Gulf Port, Mississippi, has a bar code–based shelf inventory system that helps the owners of the store keep track of what to stock, order, and so on. Several of the store clerks use handheld scanners during the store's closed hours to perform inventory functions. The store has a multiple-cell 802.11-compliant wireless LAN (ESS) consisting of access points A and B interconnected by an ethernet network. These two access points are sufficient to cover the store's entire floor space and backroom.
In the frozen meat section at one end of the store, a clerk using a handheld device may associate with access point A. As he walks with the device to the beer and wine section on the other end of the store, the mobile scanner (that is, the 802.11 station within the scanner) will begin sensing a signal from access point B. As the signal from B becomes stronger, the station will then reassociate with access point B, offering a much better signal for transmitting MSDUs.
NOTE
The 802.11 standard specifies the following optional MAC functions:
- Point Coordination Function (PCF) Implemented in the access point and (in addition to the mandatory DCF) provides delivery of time-bounded data via synchronous communications using station-polling mechanisms.
- Contention-Free Pollable Implemented in an independent station to enable time-bounded data transfers defined in the PCF.
- Wired Equivalent Privacy (WEP) Provides frame transmission privacy similar to a wired network by generating secret shared encryption keys for source and destination stations.
- Multiple Outstanding MSDUs An option that restricts the number of outstanding MSDUs to one in order to avoid reordering or unnecessarily discarding MSDUs between two LLCs.
NOTE
When two peer LLCs communicate over a network through the MAC and PHY layers, the capability to transmit multiple MSDUs (packets) and the presence of finite propagation delay make it possible for stations to reorder or unnecessarily discard the MSDUs. This problem becomes more significant as propagation delay or data rate increases because of the capability to have a greater number of outstanding MSDUs. Because of the higher potential data rates of 802.11a and the high potential for outdoor implementations, companies are likely to need the multiple outstanding MSDU option in 802.11 MAC software.
NOTE
Most end users of 802.11 and 802.11b radio cards and access points choose not to implement WEP. However, the transmission of unprotected data outdoors offers a greater risk than within a closed facility such as an office building. It is very likely that the high demand today for implementing wireless metropolitan networks will drive a significant need for information security mechanisms.
Station States and Corresponding Frame Types
The state existing between a source and destination station (see Figure 3.10) governs which IEEE 802.11 frame types the two stations can exchange.
){kind=link}
Figure 3.10 The operation of a station depends on its particular state.
The following types of functions can occur within each class of frame:
Class 1 Frames
Control frames
Request to send (RTS)
Clear to send (CTS)
Acknowledgment (ACK)
Contention-free (CF)
Management frames
Probe request/response
Beacon
Authentication
Deauthentication
Announcement traffic indication message (ATIM)
Data frames
Class 2 Frames
Management Frames
Association request/response
Reassociation request/response
Disassociation
Class 3 Frames
Data frames
Management frames
Deauthentication
Control frames
Power Save Poll
To keep track of station state, each station maintains the following two state variables:
Authentication state Has values of unauthenticated and authenticated.
Association state Has values of unassociated and associated.
NOTE
The IEEE 802.11e working group is in the process of enhancing the 802.11 MAC to support QoS (quality of service) requirements. This effort is also providing improvements to 802.11 security and efficiency.
NOTE
Keep up to date on the IEEE 802.11 working group activities by periodically visiting its Web site at http://grouper.ieee.org/groups/802/11/index.html.
As mentioned in this chapter, the 802.11 wireless LAN standard certainly has benefits that an organization should consider when selecting components that provide LAN mobility. IEEE 802 is a solid family of standards that will provide much greater multiple-level interoperability than proprietary systems. The 802.11 standard has the backing of IEEE, having an excellent track record of developing long-lasting standards, such as IEEE 802.3 (ethernet) and IEEE 802.5 (token ring).
Chapters 4 and 5 cover the details of the 802.11 standards.