1. doc.: IEEE 802.11-04/1191r5 Submission November 2004 Mike Moreton, STMicroelectronicsSlide 1 AP Architecture Thoughts Mike Moreton, STMicroelectronics

2. doc.: IEEE 802.11-04/1191r5 Submission November 2004 Mike Moreton, STMicroelectronicsSlide 2 Introduction 802.11 defines terms such as Integration Function, Portal, DS, DSM etc. Definition is deliberately vague –To allow different implementations Hence different companies have different views of what these terms actually mean –Almost any diagram is likely to be unacceptable to a majority of companies

3. doc.: IEEE 802.11-04/1191r5 Submission November 2004 Mike Moreton, STMicroelectronicsSlide 3 3.20 distribution system (DS): A system used to interconnect a set of BSSs and integrated LANs to create an ESS. 3.21 distribution system medium (DSM): The medium or set of media used by a DS for communications between APs and portals of an ESS. 3.25 extended service set (ESS): A set of one or more interconnected BSSs and integrated LANs that appears as a single BSS to the LLC layer at any station associated with one of those BSSs. 3.29 integration: The service that enables delivery of MSDUs between the DS and an existing, non-IEEE 802.11 LAN (via a portal). 3.39 portal: The logical point at which MSDUs from a non- IEEE 802.11 LAN enter the DS of an ESS. Definitions

4. doc.: IEEE 802.11-04/1191r5 Submission November 2004 Mike Moreton, STMicroelectronicsSlide 4 Position of Portal

5. doc.: IEEE 802.11-04/1191r5 Submission November 2004 Mike Moreton, STMicroelectronicsSlide 5 DS and Integrated LAN (1999) Integrated LAN Portal (Integration Function) 802.11 MAC (AP STA) DSM DS AP STA BSS Non 802.11 Endpoint ESS 802.11 MAC (AP STA)

6. doc.: IEEE 802.11-04/1191r5 Submission November 2004 Mike Moreton, STMicroelectronicsSlide 6 DSM MAC Integrated LAN Portal 802.11 MAC Relay Entity 802.11 MAC (AP STA) DSM DS 802.11 MAC (AP STA) DS and Integrated LAN (1999) – missing blocks filled in 802.11 MAC Relay Entity AP STA BSS Non 802.11 Endpoint ESS DSM MAC

7. doc.: IEEE 802.11-04/1191r5 Submission November 2004 Mike Moreton, STMicroelectronicsSlide 7 802.1D Architecture

8. doc.: IEEE 802.11-04/1191r5 Submission November 2004 Mike Moreton, STMicroelectronicsSlide 8 DSM MAC Integrated LAN Portal 802.11 MAC Relay Entity 802.11 MAC (AP STA) DSM DS AP STA BSS Non 802.11 Endpoint ESS DSM MAC 1999 including LLC LLC Higher Layer Entities 802.11 MAC Relay Entity LLC Higher Layer Entities 802.11 MAC (AP STA)

9. doc.: IEEE 802.11-04/1191r5 Submission November 2004 Mike Moreton, STMicroelectronicsSlide 9 802.X MAC Virtual Integrated LAN Virtual Portal 802.11 MAC Relay Entity 802.11 MAC (AP STA) 802.X LAN DS AP STA BSS 802.X Endpoint ESS 802.X MAC 1999 with 802.X DS LLC Higher Layer Entities 802.11 MAC Relay Entity LLC Higher Layer Entities 802.11 MAC (AP STA) Frame Routing

10. doc.: IEEE 802.11-04/1191r5 Submission November 2004 Mike Moreton, STMicroelectronicsSlide 10 Integrated LAN (ILAN) Portal 802.11 MAC Relay Entity 802.11 MAC (AP STA) DS AP STA BSS Non 802.11 Endpoint ESS ILAN MAC 1999 – portal in AP LLC Higher Layer Entities 802.11 MAC Relay Entity LLC Higher Layer Entities 802.11 MAC (AP STA) Frame Routing Portal ILAN MAC Frame Routing DS Frame Routing

11. doc.: IEEE 802.11-04/1191r5 Submission November 2004 Mike Moreton, STMicroelectronicsSlide 11 802.1X Port Model (not controlled and uncontrolled!) 802.1X authenticates the device connected to a port For 802.3, the security association between the authentication and frames is provided by the physical limitations of the port Switch STA Apologies to 802.1X experts for any errors…

12. doc.: IEEE 802.11-04/1191r5 Submission November 2004 Mike Moreton, STMicroelectronicsSlide 12 802.1X and Broadcast LANs One STA authenticating doesnt prove anything, as frames could come from another STA. Switch STA

13. doc.: IEEE 802.11-04/1191r5 Submission November 2004 Mike Moreton, STMicroelectronicsSlide 13 802.1X and 802.11i Use encryption with pairwise key to create virtual links between the switch and a single STA. As long as encryption is enabled before controlled port is enabled, cant steal someone elses authentication. Correspondence between pairwise key and virtual port Switch STA

14. doc.: IEEE 802.11-04/1191r5 Submission November 2004 Mike Moreton, STMicroelectronicsSlide 14 11i Separate port created for each STA at association 802.1X controls communication to relay entity Relay entity similar to 802.1D, but not identical. DS Update at Controlled Port Authentication? 802.11 MAC Relay Entity Port for STA 1 Frame Routing Port for STA 2 Frame Routing Port for STA 3 Frame Routing DS Controlled / Uncontrolled Port Filtering

15. doc.: IEEE 802.11-04/1191r5 Submission November 2004 Mike Moreton, STMicroelectronicsSlide 15 11i with broadcast Broadcast frames have their own key – so surely they have their own virtual port? Relay Entity has different rules for forwarding frames to ports depending on type Controlled port authorised at first association? 802.11 MAC Relay Entity Port for STA 1 Frame Routing Port for STA 2 Frame Routing Port for STA 3 Frame Routing DS Broadcast Port Frame Routing

16. doc.: IEEE 802.11-04/1191r5 Submission November 2004 Mike Moreton, STMicroelectronicsSlide 16 11i with broadcast, single MAC Reality is more like this. The different ports share a MAC One MAC can handle multiple ports as port is identified by MAC address. 802.11 MAC Relay Entity Port for STA 1 Frame Routing Port for STA 2 Frame Routing Port for STA 3 Frame Routing DS Broadcast Port Frame Routing 802.11 MAC

17. doc.: IEEE 802.11-04/1191r5 Submission November 2004 Mike Moreton, STMicroelectronicsSlide 17 11i with broadcast plus WDS WDS links are AP to AP links Will probably have pairwise keys (TGs to define) Relay treatment is like standard 802.1D Relay 802.11 MAC Relay Entity Port for STA 1 Frame Routing Port for STA 2 Frame Routing Port for STA 3 Frame Routing DS Broadcast Port Frame Routing 802.11 MAC WDS Port 1 Frame Routing WDS Port 2 Frame Routing WDS Port 3 Frame Routing

18. doc.: IEEE 802.11-04/1191r5 Submission November 2004 Mike Moreton, STMicroelectronicsSlide 18 802.11i Relay Entity Port Types Unicast –Address comes from association, not learnt –No flooding of unknown frames –No forwarding of broadcast frames Broadcast –No forwarding of any unicast frames (known or unknown) –Forward copy of each broadcast frame WDS –Learn addresses at remote end –Flood unknown frames –Forward copy of each broadcast frame –Run STP

19. doc.: IEEE 802.11-04/1191r5 Submission November 2004 Mike Moreton, STMicroelectronicsSlide 19 Question Should 802.11 define its own (enhanced) Relay Entity, or should the standard 802.1D Relay Entity be enhanced to support 802.11i?