Essential Wi-Fi

This month, we will conclude our series of articles on 802.11 security and encryption with a discussion of 802.11i.  In previous months, we discussed the weaknesses of WEP and LEAP and how WPA addresses those weaknesses.  If you haven't read those articles, they will probably provide useful background for this article, and you might want to read them first.  The articles can be found here.

802.11i defines "MAC Layer Security Enhancements for 802.11."  802.11i is intended to address the weaknesses in pre-existing forms of 802.11 authentication and encryption and to provide a single unifying standard for other forms of 802.11-related authentication and encryption.  In other words, some parts of 802.11i describe technologies that are completely new to 802.11 and other parts of 802.11i include technologies that existed before, but were not actual 802.11 standards (such as 802.1x/EAP).

Many of the components of 802.11i existed before 802.11i.  For example, 802.11i allows the use of 802.1X/EAP with EAP-TLS for authentication, as we discussed last month.   This architecture is identical to one that might have been in use before 802.11i was ratified.  Similarly, 802.11i uses EAP messages to allow the RADIUS server to give a unique encryption key to each station.

AES and CCMP are two new terms that 802.11i introduces to the 802.11 space.  AES is a form of encryption that, while more secure than RC4, also requires more processing power.  This means that hardware must be specifically designed to support AES.  Legacy hardware that was designed just for RC4 cannot be upgraded to support AES.  This may not be an issue, since, according to Wi-Fi Network News, most, if not all 802.11 chipsets released in the last few years have the ability to support AES.  CCMP stands for Counter Mode with CBC-MAC Protocol.  CCMP simply refers to a specific way of implementing AES encryption that is particularly suited for encrypting frames of data.  For comparison, the terms CCMP, TKIP, and WEP are roughly analogous - they describe implementations of encryption mechanisms used by 802.11.  The actual ciphers used in these mechanisms are AES, RC4, and RC4 respectively.

As we discussed in a previous month, WPA was a "snapshot" of a pre-release version of the 802.11i standard.  In response to the ratification of 802.11i, the Wi-Fi Alliance released the WPA2 certification, which certifies that a system is compatible with the 802.11i standard.  The terms WPA2 and 802.11i are essentially synonymous.  802.11i currently represents the state of the art in 802.11 security.  At this time, relatively few access points and clients support 802.11i, even though it was ratified in June, 2004.

 Technology and Engineering

We regularly read in literature about 802.11 that 802.11b and 802.11g support 11 channels (14 total, of which only 11 are usable in the U.S., per FCC regulations) of 22 MHz each.  This statement is usually followed by the assertion that this is why only channels 1, 6, and 11 are "non-overlapping."  Until recently, we at Connect802 would have agreed with this statement, but a recent close analysis of the 802.11 standard reveals that this language is imprecise.  This month, we'll examine 802.11b and 802.11g's "channels" more closely and reveal what 802.11 really says about channels.

The definition of an 802.11b/g "channel" starts with a center frequency.  Transmissions on a channel will be most powerful close to the channel's center frequency, and will generally get weaker further from the center frequency.  Technically speaking, the signal power gets alternately weaker and stronger as you move away from the center frequency, but each "peak" gets somewhat lower the further you get from the center frequency.  A picture of the approximate power distribution of an 802.11b channel is pictured below.

802.11b does not define the "width" of a channel.  Rather, it defines the "spectral mask" to which the transmission must conform.  As the picture shows, the spectral mask for 802.11 requires that the signal be at least 30 dB weaker than at the center frequency by plus and minus 11 MHz from the center frequency.  The signal must be and at least 50 dB weaker at plus and minus 22 MHz from the center frequency and beyond.  802.11b does not have any specific requirements beyond that, which, we believe, is a possible explanation for the common "22 MHz channel width" misconception.

Although the 802.11 series of standards never directly talks about the width of a channel in MHz, it does define "non-overlapping channels" based on the required distance between center frequencies for "non-overlapping" status.  Non-overlapping channels are defined as follows, based on the PHY:

802.11 DSSS - 30 MHz spacing (6 channels)
802.11b HR-DSSS - 25 MHz spacing (5 channels)
802.11a OFDM - 20 MHz spacing (4 channels in each of the low, middle, and high UNII bands)
802.11g ERP-OFDM - 25 MHz spacing (5 channels)

What this means for the system designer is that although a standard may imply "non-overlapping" channels there is still signal energy present throughout the entire frequency band. As a result, installation of two (or more) transmitters in close proximity may result in interference even though they are on what would otherwise be considered "non-overlapping" channels. Without a doubt, installing two transmitters so that their antennas were within a foot or so of each other would probably result in co-channel interference without regard for the configuration of the two transmitters. Several feet of separation would probably minimize or eliminate this concern.

To Infinity... and Beyond!

Early WiMAX Deployment by AT&T

Connect802 has been watching the on-going deployment of 802.16 WiMAX data service for quite some time. There's discussion in the industry regarding the potential for using WiMAX as an adjunct or alternative to 802.11 Wi-Fi. In March it was announced that AT&T will be implementing a significant, true 802.16 commercial WiMAX system to usher in what's being called "4G wireless". Connect802's position relative to WiMAX is that the technology will be deployed for point-to-point and point-to-multipoint links but will not have an impact on the in-building Wi-Fi space for several years, if at all. Connect802 has been using "pre-WiMAX" microwave equipment for designs over the past year, and we're looking at the coming onslaught of true 802.16 equipment. Nonetheless, WiMAX was conceived for stationary clients, and pushing the technology into a mobile environment is questionable.

Our expectation is that WiMAX will become the link between a Telco point of presence and a customer's premises and 802.11 will provide higher speed connectivity in the building. WiMAX offers up to 6 Mbps to each subscriber in a coverage area of up to 2 miles (obstructed) and even greater distances in unobstructed implementations. A single, point-to-point WiMAX link may be able to support up to 75 Mbps. Compare this with the promise of true 100 Mbps data rates coming in the 802.11n standard for Wi-Fi. As technology improves the data rates for WiMAX may increase, and WiMAX may offer service to mobile users. As WiMAX technology improves, however, in-building 802.11 technology will improve as well. Today it's possible to implement up to 1 Gigabit per second across a wireless point-to-point link. There's every reason to believe that 802.11 client connectivity will continue to provide increased speed as the years go by. The essence of the discussion goes back to the underlying physics of RF technology. There's a trade-off between distance, power, and bandwidth. The long distances offered by WiMAX forces the speeds down, while the short distances for in-building Wi-Fi allows designers to increase the bit rate. As they say, "There's no free lunch."

It's a matter of choosing the right technology for the job at hand. Connect802 will be pleased to discuss wireless requirements that may involve multiple technologies like 802.16 WiMAX, unlicensed microwave, and Wi-Fi. "We've Got You Covered"

AT&T will be installing their systems both in New Jersey and for another (undisclosed) customer in the retail space.

Read the InfoWorld Article about AT&T WiMAX

Read the Connect802 web page discussing WiMAX

Read more about the history and inner-workings of WiMAX

"Where did I put that thing?" Practical RFID; Here Today.

RFID "tagging" of merchandise is recognized as a probable replacement for UPC bar coding in the supply chain. Another emerging use for RFID tags is asset tracking in the enterprise, even to the level of finding file servers in the rack in complex data centers. A number of years ago, Connect802 engineers were at a customer's site trying to solve a performance problem on the customer's large, multi-building corporate network..

Our engineer, using network analysis tools, was suspicious of a particular server to which user's were attached when problems were reported. Our engineer asked to go to the console for the suspect server to continue the troubleshooting. The reply was, "Oh, THAT server... well, we don't know where that server is anymore..." It was in a closet somewhere on the corporate campus, but no one knew which closet. They backed it up over the network and lost track of its physical location!

The use of RFID technology to track assets in large sites is becoming another area into which RFID is being deployed. In fact, if you haven't done so, we recommend that you use your favorite search engine to search the Web for articles on "RFID implementation" and "RFID deployment". You'll find that the RFID marketplace is maturing quickly, with RFID systems in place across the country and around the world.

Connect802's role in the RFID space is as a design and equipment provider for the Wi-Fi backhaul systems that support RFID readers. For example, employees may use hand-held RFID readers (that look like bar code scanners) to take inventory in a store or warehouse. These hand-held devices need to communicate back to the database, and that's where the Wi-Fi backhaul network comes into play. Readers may be manufactured into shelving units (called "smart shelves") and the shelving units themselves may be movable (as when they're repositioned for seasonal merchandising in retail stores). Again, it's the in-building Wi-Fi network that links the smart shelves to the database.

The design of a Wi-Fi network with a consideration for RFID backhaul is different than that for a network where users connect with their notebook computers. It's really an obvious difference: People use their computers on desks or tables, and usually not on the floor. RFID readers may be used at floor level, behind merchandise stacked on pallets in a warehouse, and in any number of locations where a person would never put their notebook computer or cell phone. It necessary, during the design of the Wi-Fi network, to ascertain how the RFID system will be used and make sure proper coverage is provided for reader backhaul.

Read about datacenter asset tracking with RFID

What's New at Connect802?

Mesh router technology is a hot topic of discussion in many circles. There's disagreement about the applicability of a mesh infrastructure in contrast to the more simplistic (read, "less expensive") Wireless Distribution System or bridging capabilities in most commercial access points. One thing that's certain is that mesh systems automatically select new forwarding paths if an existing link goes down.

We applied this aspect of mesh technology to implement a communication system on an airfield. The challenge was to interconnect two hangar buildings for Ethernet connectivity. Computer systems in the two hangars had to communicate and their was no question that trenching a cable between the two buildings was not possible.

We designed the system using four FireTide mesh routers on the roof of the two hangars to create a 4-point mesh. The key consideration was that a large, transport category airplane could move on the ramp area between the hangars and the vertical stabilizer could interpose itself between two radios, breaking the link. By building a mesh we allowed for any link to be obstructed while the mesh routers forwarded data around the obstruction.

Inside the hangars we used high-gain, directional antennas to penetrate the 115 dB loss through the roof of the building and attach in-building systems to the mesh. Power-over-Ethernet made it easy to power the mesh routers even though they were mounted 45-feet up on the walls of the hangars, with 10-foot antenna cables going to the antennas on the roof.

Connectivity was required between the two hangar buildings, but consideration had to be made for the possibility that an airplane's vertical stabilizer might create an obstruction on the ramp area between the buildings.