1. AP Architecture Thoughts
Month 2002
doc.: IEEE /xxxr0
November 2004
AP Architecture Thoughts
Mike Moreton, STMicroelectronics
Mike Moreton, STMicroelectronics
John Doe, His Company

2. November 2004
Introduction
defines terms such as “Integration Function”, “Portal”, “DS”, “DSM” etc.
Definition is deliberately vague
To allow different implementations
Hence different companies have different views of what these terms actually mean
Almost any diagram is likely to be unacceptable to a majority of companies
Mike Moreton, STMicroelectronics

3. Month 2002
doc.: IEEE /xxxr0
November 2004
Definitions
3.20 distribution system (DS): A system used to interconnect a set of BSSs and integrated LANs to create an ESS.
3.21 distribution system medium (DSM): The medium or set of media used by a DS for communications between APs and portals of an ESS.
3.25 extended service set (ESS): A set of one or more interconnected BSSs and integrated LANs that appears as a single BSS to the LLC layer at any station associated with one of those BSSs.
3.29 integration: The service that enables delivery of MSDUs between the DS and an existing, non-IEEE LAN (via a portal).
3.39 portal: The logical point at which MSDUs from a non-IEEE LAN enter the DS of an ESS.
Expansion of abbreviations removed.
Note ESS includes the integrated LAN
Mike Moreton, STMicroelectronics
John Doe, His Company

4. Position of Portal Month 2002 doc.: IEEE 802.11-02/xxxr0 November 2004
Note this describes an integrated 802.X LAN, but definition of integrated LAN is “non ” so could in theory also be non 802.x.
Mike Moreton, STMicroelectronics
John Doe, His Company

5. DS and Integrated LAN (1999)
Month 2002
doc.: IEEE /xxxr0
November 2004
DS and Integrated LAN (1999) DS
DSM
MAC
(AP STA)
Portal (Integration Function)
MAC
(AP STA)
Integrated LAN
Any frame received from the MAC is passed to the DS. It is then forwarded to the appropriate MAC, be it remote or local.
The DS is constructed from the collection of APs and the DSM (Distribution System Medium – the physical medium used to connect APs).
Non endpoints must be connected to an “integrated LAN” which is connected to the DS via a “Portal”. The “Integration Function” lives within the “Portal” – it seems very difficult to make any useful distinction between the “Integration Function” and the “Portal”. I’ve tended to use “Portal” on the diagrams just because it takes up less space…
The green boxes are undefined by – clearly the MAC and DSM can’t connect directly together. AP AP
Non Endpoint
STA
STA
BSS
BSS
ESS
Mike Moreton, STMicroelectronics
John Doe, His Company

6. DS and Integrated LAN (1999) – missing blocks filled in
Month 2002
doc.: IEEE /xxxr0
November 2004
DS and Integrated LAN (1999) – missing blocks filled in DS
MAC Relay Entity
MAC Relay Entity
DSM MAC
DSM MAC AP AP
DSM
MAC (AP STA)
MAC (AP STA)
Portal
Need some sort of MAC to access the DSM
Relay Entity is analogous to 802.1D Relay Entity – forwards frames between MACs as appropriate.
Note integration function is still not part of the AP – it’s on the other side of the DSM.
Integrated LAN
STA
STA
Non Endpoint
BSS
BSS
ESS
Mike Moreton, STMicroelectronics
John Doe, His Company

7. November 2004
802.1D Architecture
Mike Moreton, STMicroelectronics

8. 1999 including LLC 802.11 MAC Relay Entity 802.11 MAC Relay Entity LLC
Month 2002
doc.: IEEE /xxxr0
November 2004
1999 including LLC
Higher Layer Entities
Higher Layer Entities
MAC Relay Entity
MAC Relay Entity
LLC
LLC
LLC
LLC
DSM MAC
DSM MAC AP AP
DSM
MAC
(AP STA)
MAC
(AP STA)
Portal DS
This position of the LLC is copied from the 802.1D standard. Presumably, in 802.1D LLC needs to be at this position in the diagram so that Higher Layer Entities (such as STP) know which port a frame came from – it can’t be another virtual port off the MAC Relay Entity. While we could do it differently for which doesn’t have any concept of link specific LLC level configuration protocols, a little foreknowledge of i stops us going down that route…
Integrated LAN
Non Endpoint
STA
STA
BSS
BSS
ESS
Mike Moreton, STMicroelectronics
John Doe, His Company

9. Virtual Integrated LAN
Month 2002
doc.: IEEE /xxxr0
November 2004
1999 with 802.X DS
Higher Layer Entities
Higher Layer Entities
MAC Relay Entity
MAC Relay Entity
LLC
LLC
LLC
LLC
Frame Routing
802.X MAC
802.X MAC
Frame Routing AP AP
802.X LAN
MAC
(AP STA)
MAC
(AP STA)
Virtual Portal DS
Frame Routing not described in any standard, but is part of MAC that routes received frames to either LLC or the Relay Entity. Logical place in for intra-BSS forwarding.
In this case MAC Relay Entity can be functionally the same as an 802.1D MAC Relay Entity. (Can learn the location of the associated STAs in the same way as the rest of the DS).
Every 802.X endpoint can be considered as containing a Virtual Portal and Virtual Integrated LAN, as in combination they are a null function.
Virtual Integrated LAN
802.X Endpoint
STA
STA
BSS
BSS
ESS
Mike Moreton, STMicroelectronics
John Doe, His Company

10. 1999 – portal in AP 802.11 MAC Relay Entity 802.11 MAC Relay Entity
Month 2002
doc.: IEEE /xxxr0
November 2004
1999 – portal in AP
Higher Layer Entities
Higher Layer Entities
MAC Relay Entity
MAC Relay Entity
LLC
LLC
LLC
LLC
Frame Routing
Portal
Portal
Frame Routing DS DS
Frame Routing
Frame Routing
MAC
(AP STA)
MAC
(AP STA)
ILAN MAC
ILAN MAC
More common way of drawing the picture when an 802.X LAN is used to connect the APs.
Often the Portal/Integration Function and MAC Relay Entities are combined
Personally I don’t like it because it splits the DS. AP AP
Integrated LAN (ILAN)
STA
STA
Non Endpoint
BSS
BSS
ESS
Mike Moreton, STMicroelectronics
John Doe, His Company

11. 802.1X Port Model (not controlled and uncontrolled!)
November 2004
802.1X Port Model (not controlled and uncontrolled!)
802.1X authenticates the device connected to a port
For 802.3, the security association between the authentication and frames is provided by the physical limitations of the port
Switch
STA
Apologies to 802.1X experts for any errors…
Mike Moreton, STMicroelectronics

12. November 2004
802.1X and Broadcast LANs
One STA authenticating doesn’t prove anything, as frames could come from another STA.
Switch
STA
Mike Moreton, STMicroelectronics

13. November 2004
802.1X and i
Use encryption with pairwise key to create virtual links between the switch and a single STA.
As long as encryption is enabled before controlled port is enabled, can’t “steal” someone else’s authentication.
Correspondence between pairwise key and “virtual port”
Switch
STA
Mike Moreton, STMicroelectronics

14. 11i Separate port created for each STA at association
Month 2002
doc.: IEEE /xxxr0
November 2004
11i DS
Separate port created for each STA at association
802.1X controls communication to relay entity
Relay entity similar to 802.1D, but not identical.
DS Update at Controlled Port Authentication?
MAC Relay Entity
Controlled / Uncontrolled Port Filtering
Frame Routing
Frame Routing
Frame Routing
Port for STA 1
Port for STA 2
Port for STA 3
Mike Moreton, STMicroelectronics
John Doe, His Company

15. Month 2002
doc.: IEEE /xxxr0
November 2004
11i with broadcast DS
Broadcast frames have their own key – so surely they have their own virtual port?
Relay Entity has different rules for forwarding frames to ports depending on type
Controlled port authorised at first association?
MAC Relay Entity
Frame Routing
Frame Routing
Frame Routing
Frame Routing
Port for STA 1
Port for STA 2
Port for STA 3
Broadcast Port
Mike Moreton, STMicroelectronics
John Doe, His Company

16. 11i with broadcast, single MAC
Month 2002
doc.: IEEE /xxxr0
November 2004
11i with broadcast, single MAC DS
Reality is more like this.
The different “ports” share a MAC
One MAC can handle multiple ports as port is identified by MAC address.
MAC Relay Entity
Frame Routing
Frame Routing
Frame Routing
Frame Routing
Port for STA 1
Port for STA 2
Port for STA 3
Broadcast Port .
MAC
Mike Moreton, STMicroelectronics
John Doe, His Company

17. 11i with broadcast plus WDS
Month 2002
doc.: IEEE /xxxr0
November 2004
11i with broadcast plus WDS
WDS links are AP to AP links
Will probably have pairwise keys (TGs to define)
Relay treatment is like standard 802.1D Relay DS
MAC Relay Entity
Frame Routing
Frame Routing
Frame Routing
Frame Routing
Frame Routing
Frame Routing
Frame Routing
Port for STA 1
Port for STA 2
Port for STA 3
Broadcast Port
WDS Port 1
WDS Port 2
WDS Port 3
MAC
Mike Moreton, STMicroelectronics
John Doe, His Company

18. 802.11i Relay Entity Port Types
Month 2002
doc.: IEEE /xxxr0
November 2004
802.11i Relay Entity Port Types
Unicast
Address comes from association, not learnt
No flooding of unknown frames
No forwarding of broadcast frames
Broadcast
No forwarding of any unicast frames (known or unknown)
Forward copy of each broadcast frame
WDS
Learn addresses at remote end
Flood unknown frames
Run STP
WDS port is a conventional 802.1D port!
Mike Moreton, STMicroelectronics
John Doe, His Company

19. November 2004
Question
Should define it’s own (enhanced) Relay Entity, or should the standard 802.1D Relay Entity be enhanced to support i?
Mike Moreton, STMicroelectronics