1 / 7

Enhancements in Security for Direct Link Protocol in 802.11e-D4.3

In this document, we present critical modifications to the Direct Link Protocol (DLP) specified in 802.11e-D4.3 to enhance security for non-Access Point (AP) stations (QSTAs). The DLP now includes new action frames allowing QSTAs to communicate directly while maintaining a Basic Service Set (BSS) association. These changes incorporate essential security elements, enabling secure mutual authentication and establishing encrypted links. This transformation not only preserves the simplicity of DLP but also integrates robust security mechanisms, making the AP both a facilitator and a "security chief".

paco
Télécharger la présentation

Enhancements in Security for Direct Link Protocol in 802.11e-D4.3

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Security Related Modifications to 802.11e-D4.3 Direct Link Protocol • Carlos Rios • RiosTek LLC

  2. D4.3 DLP Summary • DLP per 802.11e-D4.3 is a simple protocol to allow non-AP QSTAs to communicate directly while actively maintaining a BSS association • Adds just three new Action Frames to 802.11-1999DLP-Request, relayed through AP, lets QSTA1 ask QSTA2 to dance DLP-Response, relayed through AP, provides QSTA1 with an answerDLP-Probe optionally allows QSTAs to gauge the direct link • The AP serves as a “Gatekeeper and Facilitator” in setting up the DLP • However, this protocol has a serious shortcoming • Essential security elements consistent with ongoing activities in TGi are not incorporated

  3. Proposed DLP Modifications DLP Request/Response AP 1b 1a • QSTA-1 sends DLP-Request to QSTA-2 via AP (1a) • DLP-Request contains STA-1 Capabilities, Supported Rates, RSN Information Element • AP forwards the DLP-Request to QSTA-2 (1b) • If QSTA-2 is in Power Save mode, then AP buffers the frame, and announces pending traffic to QSTA-2 in the TIM, so that QSTA-2 can retrieve it as desired • Else: If BSS policy disallows DLP, AP returns DLP-Response to QSTA-1 with status code “Not Allowed” • Else: If QSTA-2 not in the BSS, then AP returns DLP-Response to STA-1 with status code “Not Present” • QSTA-2, agreeing to DLP, transmits a DLP-Response to AP with Status Code “Success” (2a) • DLP-Response contains QSTA-2 Capabilities, Supported Rates, RSN IE • Else: If QSTA-2 refuses to DLP, returns DLP-Response with status code “Refused” • AP forwards the DLP-Response frame to QSTA-1 (2b) 2b 2a QSTA-1 QSTA-2

  4. DLP Protocol Security Modifications AP DLP-Request/Response 2b 1b 1a DLP-Key 2a • DLP enabled, but QSTAs don’t possess keys to establish a secure RSN/TSN session • The AP, knowing both QSTAs’ RSNIEs, selects highest-security-level common authentication and cipher suites • The AP calculates an appropriate QSTA-1/QSTA-2 DLP Pairwise Master Key • The AP distributes selected authentication and cipher suites and the DLP PMK to QSTA-1 (3a) and QSTA-2 (3b) in (encrypted Authentication frame) DLP-Key messages • The AP then promptly clears its DLP PMK register and “forgets” the key • QSTA-1 and QSTA-2 then immediately execute direct mutual authentication and encryption key derivation/management handshake, and establish a secure DLP link • QSTA-1/QSTA-2 “Link Quality” can be gauged during the authentication handshake, or by using the optional DLP-Probe frames • STAs shall stay awake for a “no-activity” timeout period following every reception. • If either STA times out further data exchange shall be routed through the AP until and if another DLP session is established • Stations maintain a cache with the side channel capabilities on a per destination STA basis (Optional) Probe, Mutual Authentication, Direct Traffic 3a 3b 4 STA-1 STA-2

  5. Why do this? • QSTAs associated with a common AP may nevertheless implement different security protocols (WEP, TKIP, CCMP)- So which should they implement with each other? • The AP can serve as a “security facilitator”, since it already knows the QSTAs’ security capabilities, thereby authorizing the DLP • It automatically determines the strongest security protocol common to both and “suggests” they implement it • As a nice incentive, the AP also generates and distributes appropriate key material so the QSTAs can derive necessary encryption keys • AP uses one encrypted Authentication frame for this purpose, sent independently to both stations • Otherwise the QSTAs need to “authorize” their session by manually exchanging encryption keys outside of 802.11 • The QSTAs, authorized to DLP via either mechanism, above, then begin a mutual authentication exchange • Mutual Authentication successful, QSTAs can immediately thereafter exchange secure traffic

  6. Proposed DLP Modifications Summary • The modified DLP remains a simple protocol, but now allows ready incorporation of TGi security. • DLP-Key Authentication frame, transmitted from the AP to each QSTA, provides the essential security elements • The AP still serves as a “Gatekeeper and Facilitator” in setting up the DLP, but now is also “Security Chief” • The herein modified DLP is a more comprehensive and robust solution • Candidate normative text revisions to 802.11e-D4.3, as it has been or may subsequently be modified per ongoing TGe direction, are contained in 03/050r3

  7. Motion • “Move to instruct the Technical Editor to work with the submitter to incorporate the security related DLP Modifications contained in document 03/50r3 into the successor document to 802.11e-D4.3”

More Related