TLDR: WPA3-SAE - How does it work

• WPA3 - SAE - stands for simultaneous authentication of equals. This is a more secure mechanism than the previous WPA2-PSK [1].
• This relies on 3 fundamental components:
• DH - Diffie-hellman key exchange - Helps to generate a common shared key between the two WiFi entities e.g. station and client.
• ECC (elliptic curve cryptography) - Elliptic-curve cryptography (ECC) is an approach to public-key cryptography based on the algebraic structure of elliptic curves over finite fields. ECC allows smaller keys compared to non-EC cryptography (based on plain Galois fields) to provide equivalent security [2]. ECC is used once a common pairwise key is generated using the DH key exchange.
• Dragonfly key exchange is a mechanism for key exchange using discrete logarithm cryptography [3]. This is used with the two components above to setup SAE. See the reference for details on how it is setup [3]. Also covered in RFC7664.

labels: WiFi, TLDR, summary article, WPA3, SAE, security, 

Reference:

[1] WPA3-SAE Cisco Meraki reference

[2] Elliptic curve cryptography - Wikipedia

[3] Dragonfly key exchange in WPA3-SAE

WiFi: What is phy restart? Why is it important in dense RF environments?

 Phy restart on radio drivers typically means if the hardware (radio) is able to sync to the preamble of a packet which has a stronger signal strength while it is already in the process of decoding a packet.

This is typically useful in noisy environments to achieve a "capture effect", where the stronger packet is finally decoded at the rx. radio. If the radio does not support PHY restart then typically such a reception would result in a collision on the rx-side at the radio.

WiFi: Difference between single and multiple protection settings in the duration ID

A single protection setting is used to protect the transmission until the end of any following data management or response frame. In multiple protection setting the NAV protects until the estimated end of multiple sequence of frames.

WiFi: One line difference between delivery enabled and trigger enabled in U-APSD

Excerpt from wikipedia:

Queues may be configured to be trigger enabled, (i.e. a receipt of a data frame corresponding to the queue acts as trigger), and delivery enabled, (i.e. data stored at those queues will be released upon receipt of a frame). Queues refer to the four ACs defined for WMM.

WiFi: A Short Introduction to 802.11ax

Citation info:
Gautam Bhanage, "A Short Introduction to 802.11ax", Technical report GDB2018-001, published at bhanage.com, 2018

Download PDF

802.11ax support for Uplink MU-MIMO

Who should read these?
At the time of writing this blog post the 802.11ax standard is in the process of getting ratified and we are at the version 2.0. Are you intrigued about what makes this standard different from the previous 802.11ac standard?

Download PDF of the TR.

Disclosure:
Slides from a talk I recently presented on 802.11ax technology.
These slides are purely based on my reading of the standards and other free documents available on the internet.
Copyright for the images are held by the owners. I have only used the ones which were labeled for reuse.

Tech report: GDB2018-001

Linux: Why use MSI over the GIC mechanism (Brief)

MSIs are implemented as a write from the device rasising the interrupt to a special memory location which causes raising of the MSI.

Two main reasons to consider MSI over PICs:

1. Speed: Pin based PCI interrupts are usually shared across devices and hence we would typically need to invoke each associated interrupt handler. MSIs are not shared so this does not arise.

Another case is that PCI can only support single interrupt per function. In this case drivers have to explicitly check what event happened (e.g. tx done, rx etc for a single MAC interrupt in case of Wifi radios). Using MSI, there could be a dedicated interrupt for each type of event (from the MAC).

2. Consistency: In case of pin based interrupts, the interrupt may be raised before the complete data has arrived in memory. There are ways to work around this. However, in case of MSIs this is not a concern since MSI writes cannot pass data writes on the bus.

Reference:
Linux Kernel Documentation - https://www.kernel.org/doc/Documentation/PCI/MSI-HOWTO.txt

WiFi: PER based adaptive AMSDU aggregation worth the effort?

This has been a lingering question. A lot of studies (including one of ours) in the past has delved into the support for AMSDU aggregation - and the ability to consider PER as a factor for adaptively controlling AMSDU aggregation. But is it worth the computational effort? Can this be simplified by making AMSDU aggregation static and using other mechanisms for limiting PER?

WiFi: Load balancing through probe response control

Basic Idea:

Clients use probe requests as one of the first frames before connecting to an access point (AP). If the AP does not respond with a probe-response frame, the client will not proceed with the connection. We leverage this condition to control how clients are distributed across multiple access points in the network. This approach to client - balancing has the advantage that:

1. Load both RF and CPU are balanced across the APs.

2. No disconnect/connect is required for load balancing.

3. Leverages the fact that typical WLAN mobility is pseudo-static. So clients will not move significantly from the places where they connect. Even in case of mobility, the disruption is minimal.

Download Full patent PDF

WiFi: What are control response frames?

I have pasted some snippets from the standard which describe how rate control has to work for these special frames. This blog post is based on excerpts from section 9.7 of the 802.11 standard.

What are control response frames?
Following table shows all control frames, with the control response frames highlighted in bold:

Type description	Subtype value	Subtype description
01	Control	0000-0111	Reserved
01	Control	1000	Block Ack Request
01	Control	1001	Block Ack
01	Control	1010	PS-Poll
01	Control	1011	RTS
01	Control	1100	CTS
01	Control	1101	ACK
01	Control	1110	CF-end
01	Control	1111	CF-end + CF-ack

ACK or CTS or block-ack frames are referred to as control response frames by the WiFi standard. These are referred so because they are control frames sent in response to other frames.

How is rate selected for these frames?

Dynamic Load Balancing for WiFi

With WLANs and WiFi architecture moving more towards software than a "burnt in the silicon" approach, it is possible to have different software components running at different points in the network. 

Consider for example the following functions that need to be done in the typical transmit lifecycle of a packet received on the ethernet interface that is supposed to go out on a WiFi interface:

1. Ethernet receive handling
2. Basic ethernet classification and fowarding
3. Stripping of headers
4. Attaching LLC headers
5. Attaching WiFi headers
6. Queening frames for transmission
7. DMA'ing frames
8. Scheduling frames for transmission
9. Aggregation at different layers
10. Encryption

WiFi: AMSDU vs AMPDU: A Brief Tutorial on WiFi Aggregation Support

• WiFi MAC architecture supports aggregation at two layers. 
• The MAC service data  units (MSDUs) can be aggregated to form AMSDUs. 
• Each AMSDU serves as a single MAC protocol data unit (MPDU). 
• Another layer of aggregation is introduced when MPDUs can be packed together

WiFi Aggregation 

Wireless Channel Power Control

Our ideas for a hybrid approach for channel power control have been discussed here:

S. Ganu, G. Bhanage, P. Narasimhan, "System and Method for Computing Coverage Set and Resource Allocations in Wireless Networks", US Patent App. 13/563,500, 2014.

The key difference as noted in the application is that in some cases we propose using a combination of centralized and de-centralized channel power control i.e. the main channel allocation is done centrally and the local channel flips (based on radar etc) are done locally by the access point.

We propose doing a 2 phase channel allocation strategy:
1. Anchor channels: The baseline RF characteristics of a deployment rarely change i.e. the relative position of the infrastructure APs does not change, the other architecture of the building and basic coarse grained pathloss do not change over large time frames. We use this knowledge to come up with a coarse grained anchor channel assignment for each access point. This anchor channel will be a home channel based on the available

Download PDF
Download Citation info

Introduction to WiFi Packet Captures

If you are a beginner who is just starting to use WiFi with wireshark and want some sample captures to look at here are a few from the wireshark site:

Simple wireless join:

File: Network_Join_Nokia_Mobile.pcap Description: 802.11 capture of a new client joining the network, authenticating and activating WPA ciphering

File: wpa-Induction.pcap Description: 802.11 capture with WPA data encrypted using the password "Induction".

File: wpa-eap-tls.pcap.gz 

Difference between Active and passive beamforming mechanisms

Active beamforming is the mechanism used in WiFi access points and clients where the beamforming is done with different chains on a transmitting radio (usually using active components like transistors). Passive beamforming on the other hand is achieved by using passive components (resistors, capacitors, and inductors) to introduce phase and amplitude variations across different path such that we are able to achieve constructive addition in some cases which results in beamforming.

The main differences between these two mechanisms: 

• Butler matrices are a passive beamforming and channel model rendering mechanism.
• Beamforming can be useful against jamming attacks to increase SNR at client.
• Passive beamforming networks are better because active components are more susceptible to change in temperature and other environmental factors.
• Compared to active beamforming networks, passive beamformers can be made electrically stable and reliable across a wide range of operating conditions, although a great deal of flexibility in the physical layout may be needed to accommodate a large variety of connector interfaces for different antenna arrays.

References

* Miscellaneous articles on butler matrices

* Understanding Passive Beamforming Networks http://defenseelectronicsmag.com/military-defense-electronics/understanding-passive-beamforming-networks

WLAN Interference control through Antenna Selection (ASEL)

In this work, we present a novel, robust scheme for high density WLAN deployments. This scheme uses well known selection diversity at the transmitter. We show that our scheme increases the number of simultaneous transmissions at any given time without excessive overhead (compared to other schemes such as Multi-user MIMO). Furthermore, this scheme can be easily implemented using existing standards.

The main contributions that come out of this report are:

1. a simple method to tackle interference in the network by selecting the best antenna during 

transmission. 

2. A high potential to reduce the collisions for hidden node terminals. 

3. Further, we also proposed a mechanism to account for the next wave of 802.11ac by allowing simultaneous transmission from multiple APs on the same channel.

Important Links

Citation information

PDF of pre-print

WiFi: PP-AMSDU versus SPP-AMSDU a brief comparison

Before we jump into the different type of AMSDUs supported, let us do a quick recap of where AMSDUs fit in with the aggregation hierarchy. Here is an image from Wikipedia:

MSDU, MPDU and PPDU

Multiple MSDUs aggregate to form an AMSDU. Multiple of these will form an AMPDU. The different type of AMSDUs are defined in the WGs documents:

3.114n Payload Protected A-MSDU (PP A-MSDU): An A-MSDU that is CCMP protected but does not include the A-MSDU Present field (bit 7 of the QoS control field) in the construction of the AAD. 

3.135n Signaling and Payload Protected A-MSDU (SPP A-MSDU): An A-MSDU that is CCMP protected and does include the A-MSDU Present field (bit 7 of the Qos control field) in the construction of the AAD.

WiFi: What is beacon bursting? What are the tradeoffs?

Beacon bursting is a mechanism by which beacon frames for all the BSSs (Virtual APs) running on that radio are sent out one after the other instead of spreading them out equally in time over the beacon interval. The other approach to sending beacons is to spread them out equally over the beacon interval.

For example, consider the beacon interval is 100msec and you have 5 VAPs beaconing, then, with bursting all the beacons are sent back to back after the beacon interrupt. However, if you are not using bursting, beacons are spread across the 100msecs. Hence, every 20msec the radio will send out the beacon of a different VAP.

WiFi: Comparison of WiFi Direct vs WiFi Aware vs BLE vs Adhoc mode (802.11)

Summary
WiFi Aware - service discovery that helps setup WiFi Direct links.
BLE - service discovery and P2P connection.
WiFi Direct - P2P connection
WiFi Adhoc mode - basic P2P connection (legacy mechanism)

We will now differentiate between each of these protocol suites and their applications.

WiFi Aware vs BLE
- WiFi Aware has a longer range (because of wifi power limits)
- works with existing WiFi chips (protocol overlay - Phy is mostly the same)
- higher bandwidth than BLE (faster for gaming etc) - this is because it will use WiFi Direct once wifi aware discovers the service.

- WiFi aware works across brands of phone vs ibeacons which will work only on iPhones for e.g.

Reliable Multicast for Enterprise WLANs

In this work, we have presented a complete end-end architecture to employ the rate-less codes. We have developed a new architecture Rate-less Codes Multicast (RCNC). This architecture is shown to provide high throughput gains, reliability and near optimal throughput performance.

Important Links

Citation information

PDF of pre-print

Uplink Airtime Fairness Control

Problem statement:
There is currently no direct way to control uplink airtime usage of wireless clients on a WLAN without actually implementing something on the client. This is not always possible because of multiple reasons:
Diversity in the operating systems and hardware of client devices.
Privacy issues
General aversion to install 3rd party control software.

Abstract of the idea:
In this case, we address the issue of limiting the airtime used the clients in the uplink direction by controlling the TCP window size in the uplink direction. We do this by doing a deep packet inspection of open TCP sessions for every client and then appropriately limiting the advertised TCP window based on bandwidth consumption by the clients.
Download PDF

Download Citation