IEEE 802.11i
Data Frames
802.11i encrypts the whole data frame with AES. AES stands for Advance Encryption Standard. AES supports key length of up to 256 bits, but not compatible with older hardware. It also supports stronger encryption than WPA/TKIP.
How does it work
1. The wireless client and the AP engage in an exchange to determine the security capabilities of the two devices. If the wireless client and AP are not IEEE 802.11i or Wi-Fi Protected Access (WPA) version 2 capable, they fall back to WEP.
2. If both are IEEE 802.11i capable, the wireless client enters the second phase and engages in an authentication procedure. It first establishes an Extensible Authentication Protocol over LAN (EAPOL) connection to the AP, and the AP in turn establishes a RADIUS connection to the authentication server. At this point the AP becomes nothing more than a relay, ensuring that the traffic being passed on to the RADIUS server is indeed coming from the initial client. Over these two connections, the wireless device and the RADIUS server establish a Transport Level Security (TLS) tunnel, where the client is challenged for its authentication credentials and is authenticated by the RADIUS server. The two systems then independently generate an identical, large, pseudo-random number known as the pairwise master key (PMK) which represents the authenticated relationship.
3. The RADIUS server distributes this key to the AP.
4. Now that the AP and the wireless client have a shared master key, they use the PMK to derive a set of three keys collectively called the pairwise transient key (PTK). The PMK derived earlier is never used to actually encrypt data, and is never conveyed across the wireless link. This provides it with protection against attack. The keys derived from the PMK, however, are used to manage key distribution and to encrypt data.
5. The wireless client and the AP would then secure the data that they have just exchanged
802.11r
Data frames
The 802.11r standard applies to a 3-tier reference architecture that divides the access network into mobility zones. A mobility zone is defined as the collection of lightweight access points connected to a central management unit, referred to as a controller. In general, neighboring access points covering a certain geographic zone are grouped into a single mobility zone.
When an 802.11r compliant station enters a mobility zone, it first performs authentication using EAP. The resulting MSK is used by the station and the controller to derive a key called PMK-R0. PMK-R0 is then used to derive per-access-point PMKs. The name for such keys is PMK-R1. The controller finally sends the PMK-R1 keys to their corresponding access points. The mobility zone controller that holds the PMK-R0 key is called R0 Key Holder (R0KH), while the access points to which PMK-R1 keys are delivered are R1 Key Holder (R1KH).
The key structure specified by the IEEE 802.11r standard is shown in the figure below.
How does it connects
802.11k
Data FramesThe data frame request/report pair returns a picture of all the channel traffic and a count of all the frames received at the measuring STA. For each unique Transmitter Address, the STA reports the Transmitter Address, number of frames received from this transmitter, average power level (RCPI) for these frames, and BSSID of the transmitter.
How does it works
802.11w
Data frames
The IEEE 802.11w standard aims to avoid certain types of WLAN DoS attacks. 802.11w extends strong cryptographic protection to specific management frames (in a manner that is similar to what 802.11i/RSN defines for data frames). A select set of management frames transmitted after 802.11i/RSN key derivation is protected. MFP is provided for a category of management frames called “Robust Management Frames”. Deauthentication frames, Disassociation frames, and certain categories of Action Management frames are defined as Robust Management Frames. Action Management Frames are special types of management frames that carry WLAN operation related information – e.g., QoS Management, Spectrum Management or BlockAck session management.
References:
http://www.tech-faq.com/80211i.html
http://csrc.nist.gov/archive/wireless/S10_802.11i%20Overview-jw1.pdf
http://www.eetimes.com/discussion/other/4025006/IEEE-802-11i-and-wireless-security
http://www.networkworld.com/details/7559.html
http://www.networkworld.com/graphics/2005/0822tu.gif
http://www.networkworld.com/news/tech/2005/082205techupdate.html
http://www.codealias.info/_media/technotes/80211r-key.jpeg?w=450&h=&cache=cache
http://www.intel.com/standards/case/case_802_11.htm
http://www.networkworld.com/news/tech/2004/0329techupdate.html
http://www.networkworld.com/graphics/2004/0329tu.gif
http://www.networkworld.com/columnists/2006/052906-wireless-security.html
http://www.cwnp.com/cwnp_wifi_blog/wireless-lan-security-and-ieee-802-11w
http://www.hill2dot0.com/wiki/index.php?title=802.11i
http://www.windowsecurity.com/articles/80211i-wpa-rsn-wi-fi-security.html
http://www.codealias.info/technotes/the_ieee_802.11r_standard_for_fast_wireless_handoffs
http://ux.brookdalecc.edu/fac/engtech/mqaissaunee/netw125/student%20presentations/Brian%20Carey%20IEEE%20802.11r.pdf
www.cs.tut.fi/~83180/83180_05_S11b.ppt
http://voiplab.niu.edu.tw/IEEE/802.11/802.11k-2008.pdfhttp://www.cwnp.com/cwnp_wifi_blog/wireless-lan-security-and-ieee-802-
