IEEE 802.11n - Design Details & Protocol Analysis

• The IEEE 802.11 Alphabet
  
  • IEEE 802.11-1999
    
  • IEEE 802.11b
    
  • IEEE 802.11g
    
  • IEEE 802.11a
    
  • IEEE 802.11e
    
  • IEEE 802.11i
    
  • IEEE 802.11n
    
• The Physical Resource
  
  • The ISM Band in 2.4 GHz and 5 GHz
    
  • Channel Numbers and Allocation / 2.4 GHz
    
  • Channel Numbers and Allocation / 5 GHz
• Network Architecture
  
  • Infrastructure Mode
    
  • Ad-hoc Mode
• Protocol Stack of IEEE 802.11 in Context
  
  • PDU-Types in the Protocol Stack
    
    • MSDU, MPDU, PPDU
      
  • Example of an IEEE 802.11 MPDU
    
• Operation of IEEE 802.11
  
  • CSMA/CA - Resource Sharing and Network Access
    
    • Principle Operation, Format and Content of the PLCP-PDU, Physical vs. Virtual Carrier Sensing
      
  • The Different MAC-Access Coordination Functions
    
    • Overview, Distributed Coordination Function / Example Operation, Point Coordination Function (PCF), Enhanced Distributed Channel Access (EDCA), HCF Controlled Channel Access (HCCA)
      
• OFDM in IEEE 802.11
  
  • Introduction
    
  • Normal OFDM Symbol
    
  • Short OFDM-Symbol
    
    • Generation
      
  • Long OFDM-Symbol
    
    • Generation, Distinction in case of different Channel Bandwidth (5, 10 and 20 MHz)
      
  • Format of the PPDU with OFDM-PHY
    
    • PLCP Preamble, L-SIG (SIGNAL-Field), SERVICE-Field, PSDU, Tail Bits / Padding
      
• Association Process to an Access Point
  
  • Passive Scanning
    
  • Active Scanning
    
  • Beacon Frame
    
  • Exchange of Association Request / Response Frames

Overview of 802.11n and its Enhancements

• Introduction to 802.11n-Enhancements
  
  • The Big Picture
    
  • Smart Antenna related Enhancements
    
  • Packet Aggregation related Enhancements
    
  • Channel Bonding related Enhancements
    
  • Other Enhancements
    
    • More Data Subcarriers / Smaller Guardband, Short Guard Interval (GI), FEC Changes, Power Saving Enhancements, Reduced Inter Frame Space (RIFS), SERVICE-Field
      
• Operation with 40 MHz Bandwidth
  
  • Overview
    
  • Number of Subcarriers and Pilot Allocation
    
  • Phased Coexistence Operation (PCO)
    
• Transmit Beamforming
  
  • ... with Implicit Feedback
    
  • ... with explicit Feedback
    
• Antenna Selection

Detailed Analysis of the 802.11n MAC

• Reviewing MAC-Frame Types and IE's
  
  • Generic MAC Frame (Data Frame)
    
    • Frame Control field, Duration ID field, Address fields, Sequence Control field, QoS Control field, Frame Body, FCS field, Details of the Frame Control Field
      
  • Control Frame Subtypes
    
    • BlockAckReq and BlockAck, PS-Poll, RTS and CTS, Ack, CF-End and CF-End+CF-Ack
      
  • Management Frame Subtypes
    
    • Association request and Association response, Reassociation request and Reassociation response, Disassociation, Probe request and Probe response, Beacon, Announcement Traffic Information Message, Authentication and Deauthentication, Action, Action No Ack
      
  • Data Frame Subtypes
    
    • Data frames, Null frames, CF-Ack frames, CF-Poll frames, QoS frames, Usage of the Address Fields in Data Frames
      
  • Action Frames
    
    • Spectrum management Action frames, QoS Action frames, DLS Action frames, Block Ack Action frames, HT Action frames
      
• Aggregation through A-MSDU
  
  • Practical Exercise: Evaluate a PPDU with A-MSDU inside
    
  • Detailed Operation and Constraints
    
    • From LLC-Frame to A-MSDU - Mapping Rules, Limitation of Frame Sizes (A-MSDU)
      
• Aggregation through A-MPDU
  
  • Example of an A-MPDU
    
  • Detailed Operation and Constraints
    
    • From LLC-Frame to A-MPDU - Mapping Rules, Limitation of Frame Sizes (A-MPDU)
      
  • Combination of A-MSDU and A-MPDU Aggregation
    
  • Practical Exercise: A-MSDU vs A-MPDU Aggregation
    
• BlockAck-Procedures
  
  • Reviewing Acknowledgement Policies
    
    • Normal Ack, No Ack, No explicit Ack, Block Ack
      
  • Option 1: Immediate BlockAck Procedure
    
    • Setup BlockAck, Transmission of data frames, Block Ack Request – Block Ack exchange, ermination of Block Ack
      
  • Option 2: Delayed Block Ack Procedure
    
    • Setup of Delayed BlockAck's, BlockAck Request – BlockAck exchange, Switch back to normal Ack procedure in the BlockAck period, Termination of Delayed BlockAck
      
  • Important Changes with 802.11n
    
    • New Format of the BlockAck Request Frame, New Format of the BlockAck Frame
      
  • Practical Exercise: Analyze a Real-Life BlockAck Session
    
• Power Save Multi Poll (PSMP)
  
  • Operation of PSMP
    
  • Format and Content of the PSMP-Frame

Advanced Security through EAP (Bonus Material)

• Security Challenges
  
  • Unauthorized use
    
  • Forgery attacks
    
  • Man in the middle attacks (eavesdropping)
    
  • Replay attack
    
  • Data truncation, concatenating, and splicing
    
  • Iterative guessing against the key
    
  • Redirection by modifying the MPDU DA or RA field
    
  • Impersonation attacks by modifying the MPDU SA or TA field
    
  • Denial of service attack
    
• Overview Security
  
  • Keys
    
  • Ciphering
    
  • Deciphering
    
  • Authentication
    
  • Integrity protection
    
• Security Technologies for IEEE 802.11 194
  
  • Overview
    
    • Wired Equivalent Privacy (WEP), Robust Security Network (RSN), 802.1X, Extensible Authentication Protocol (EAP), Virtual Private Network
      
  • Pre - RSNA Procedures
    
    • Open System Authentication, Shared Key Authentication, The “Wired Equivalent Privacy” Procedure
      
  • RSNA Procedures
    
    • RSNA Policy Selection, Key Hierarchy – How to Create the TK's, Types of Security Associations, RSNA Encryption and Integrity Protection Protocols,
      
  • Advanced Authentication
    
    • Network Overview: Supplicant, Authenticator, Authentication Server, Redirection, Variants of EAP
      
  • Secure Session Overview
    
    • Different Phases, Session Phase 1: Probing & Association, Session Phase 2: EAP Authentication, Session Phase 3: EAPOL 4-Way Handshake, Session Phase 4 & 5: Active Session & Disassociation
      
  • EAP Frame Formats
    
    • EAP Request and EAP Response Frames, EAP Success and EAP Failure Frames
      
• Analysis of EAP-TLS
  
  • EAP-TLS Protocol Structure
    
  • EAP-TLS Procedure
    
    • Detailed Description
      
  • Practical Exercise: Analysis of Real-Life EAP-TLS Logfile
    
  • EAP-TLS Procedure – Fast Reconnect
    
    • Detailed Description
• Analysis of EAP-AKA
  
  • EAP-AKA Protocol Structure
    
  • EAP-AKA Procedure
    
    • Initial Conditions, Applicability of this Procedure, Detailed Description
      
  • EAP-AKA Procedure – Fast Re-Authentication