1. doc.: IEEE 802.11-08/114r1 Submission January 2008 D. Eastlake (Motorola)Slide 1 Segregated Data Services Date: 2008-01-14 Authors:

2. doc.: IEEE 802.11-08/114r1 Submission January 2008 D. Eastlake (Motorola)Slide 2 Abstract 802.11 networks frequently handle different communities that need to be provided separate services. This is typically done by VLANs in wired networks. The need varies from distinguishing between “visitors” and “residents” in a home network to much stronger and more complex requirements in enterprise, municipal, and other systems. This presentation provides scenarios and requirement areas for adding segregated data services to IEEE 802.11.

3. doc.: IEEE 802.11-08/114r1 Submission January 2008 D. Eastlake (Motorola)Slide 3 Example Scenario Ia (unified infrastructure, single interface end stations) MAP 1 Guest Station MAP 2 AP 2 Guest Station Local Station Internet Local Station Protected Services Local Station Local VLAN Guest VLAN Wired Connection Firewall

4. doc.: IEEE 802.11-08/114r1 Submission January 2008 D. Eastlake (Motorola)Slide 4 Example Scenario Ib (unified infrastructure, single interface end stations) MAP 1 Infected Station MAP 2 AP 2 New Station Healthy Station Normal VLAN Assessment and Remediation VLAN Wired Connection Other Services End Point Assesment and Remediation

5. doc.: IEEE 802.11-08/114r1 Submission January 2008 D. Eastlake (Motorola)Slide 5 Example Scenario II (diverse mesh, multi-interface mesh points) Org 1 MP Internet Org 1 MP Org 2 MP Org 3 MP Org 1 MP Organization 1 Infrastructure Org 1 MPP Local Mesh ServiceOrganization 1 ServiceOrganization 2 Service Organization 2 Infrastructure Org 2 MPP

6. doc.: IEEE 802.11-08/114r1 Submission January 2008 D. Eastlake (Motorola)Slide 6 Scenario II without segregated data services Org 1 MP Internet Org 1 MP Org 2 MP Org 3 MP Org 1 MP Organization 1 Infrastructure Org 1 MPP Organization 1 ServiceOrganization 2 Service Organization 2 Infrastructure Org 2 MPP

7. doc.: IEEE 802.11-08/114r1 Submission January 2008 D. Eastlake (Motorola)Slide 7 Areas Work Done or in Process? 1.Advertising Availability of Services In 802.11, “service” = SSID TGu is adding facilities to advertise multiple SSIDs 2.Transit Frame Labelling Just use VLAN ID in an 802.1 C-tag (formerly called Q-tag)? New Work? 3.Portal/Link Mapping of Services/VLANs & Priority Must be configurable but should have reasonable defaults 4.Service Location & Multi-Service Connections Primarily relates to mesh and mesh peer links 5.Security Tunnelling a frame through nodes not fully trusted by the end points.

8. doc.: IEEE 802.11-08/114r1 Submission January 2008 D. Eastlake (Motorola)Slide 8 Advertising Availability of Services Work in progress: General Advertisement Service (GAS) mechanisms in 802.11 TGu (Interworking with External Networks). –Includes SSIDC (SSID Container IE) for transmission of multiple SSIDs (with or without multiple BSSIDs) in a single beacon.

9. doc.: IEEE 802.11-08/114r1 Submission January 2008 D. Eastlake (Motorola)Slide 9 Transit Frame Labelling Current Practice: –Base 802.11 standard explicitly permits 802.1 C-Tag (formerly Q-Tag) in payload (802.11-2007 Annex M) but C-Tag’s priority and VLAN ID fields are currently ignored. VLAN ID seems reasonable for distinguishing frames belonging to different services.

10. doc.: IEEE 802.11-08/114r1 Submission January 2008 D. Eastlake (Motorola)Slide 10 Portal/Link Mapping of Services/VLANs & Priority Possible new work: –VLAN IDs can probably be coordinated in a BSS or across an ESS. But in a mesh this would be very difficult. So maybe in a mesh the VLAN ID is just a local abbreviation mapped on each peer link hop? –Should portals have a configurable mapping, with reasonable defaults, between external priority and 802.11 TID?

11. doc.: IEEE 802.11-08/114r1 Submission January 2008 D. Eastlake (Motorola)Slide 11 Service Location & Multi-Service Connections Possible new work: –A legacy station to AP link is almost by definition limited to carrying one service. But mesh peer links might carry any service that is transiting the mesh… –How does a mesh station (which might have just joined the mesh) find a new service that was not previously transiting the mesh but is offered by some other station/portal?

12. doc.: IEEE 802.11-08/114r1 Submission January 2008 D. Eastlake (Motorola)Slide 12 Security Current Practice: Use IPsec or some similar application level mechanism to protect data end-to-end. Possible new work: –Optional edge-to-edge security between original source 802.11 station and final destination 802.11 station.

13. doc.: IEEE 802.11-08/114r1 Submission January 2008 D. Eastlake (Motorola)Slide 13 Results in Waikoloa 11-07/2941r1 Presented In WNG Standing Committee Vote in WNG –Moved, To request the IEEE 802.11 Working Group to approve and forward to the IEEE 802 Executive Committee the creation of a “WLAN Segregated Data Services” Study Group to consider how best to meet requirements as follows and how best to coordinate such activities with 802.1: labeling frames per service; security of data within a service; and the configuration and management of such services. –Moved: Donald Eastlake 3rdSeconded: Guido Hiertz –Yes: 22No: 0Abstain: 4(100% approval) Vote In 802.11 Working Group at Closing Plenary –Yes: 19No: 9Abstain: 24(67.85% approval)

14. doc.: IEEE 802.11-08/114r1 Submission January 2008 D. Eastlake (Motorola)Slide 14 Results in Atlanta 11-07/2491r2 Presented In Mid-Week Plenary Motion in 802.11 Closing Plenary –Moved, To approve and forward to the IEEE 802 Executive Committee for their approval the creation of a “WLAN Segregated Data Services” Study Group to consider how best to meet requirements as follows in 802.11 and how best to coordinate such activities with 802.1: labeling 802.11 frames per service; security of data within such services; and the configuration and management of such services. –Moved: Donald Eastlake 3 rd Seconded: Stephen McCann –Withdrawn due to several objections that the scope was be to broad and unspecific, proposed Study Group needs to be rethought, etc. (This presentation, 11-08/114 in Taipei, tries to be narrower and more specific.)

15. doc.: IEEE 802.11-08/114r1 Submission January 2008 D. Eastlake (Motorola)Slide 15 References IEEE Standard 802.11-2007 – WLANs IEEE Standard 802.1Q-2005 – VLANs Draft 802.11s D1.07 – ESS Mesh Networking Draft 802.11u D1.02 – Interworking with External Networks