eap Mailing List: Re: Issue 376: Proposed Resolution (Section 2.1)

[Bernard Aboba (bernard_aboba]

2.1.  Discovery of the Point of Attachment to the Network

  "The discovery of points of attachment" problem has been extensively
  studied, see for instance the IEEE specifications on 802.11 wireless
  LAN beaconing and probing process, studies (such as [Fixingapsel]) on
  the effectiveness of these mechanisms, specifications on GSM network
  discovery, results of the IETF Seamoby WG, and so on.

  Traditionally, the problem of discovering available point of
  attachment has been handled as a part of the link layer attachment
  procedures, or through out-of-band mechanisms.

[BA] The above two paragraphs could be combined and tightened up.  See
suggests below.

  RFC 2194 [RFC2194] describes the pre-provisioning of dialup roaming
  clients, which typically included a list of potential phone numbers,
  updated by the provider(s) with which the client had a contractual
  relationship.  RFC 3017 [RFC3017] describes the IETF Proposed
  Standard for the Roaming Access XML DTD.  This covers not only the
  attributes of the Points of Presence (POPs) and Internet Service
  Providers (ISPs), but also hints on the appropriate NAI to be used
  with a particular POP.  The RFC supports dial-in and X.25 access, but
  has extensible address and media type fields.

  In IEEE 802.11 WLANs, the Beacon/Probe Request/Response mechanism
  provides a way for Stations to discover Access Points (APs), as well
  as the capabilities of those APs.  Among the Information Elements
  (IEs) included within the Beacon and Probe Response is the SSID, a
  non-unique identifier of the network to which an Access Point is
  attached.  By combining network identification along with
  capabilities discovery, the Beacon/Probe facility provides the
  information required for both network discovery and roaming decisions
  within a single mechanism.

[BA] The Beacon/Probe Request provides the SSID, as well as the capabilities
of individual APs.  It does not provide for discovery of network wide
capabilities, per se.  For example, the capabilities of all APs advertising
an SSID need not be identical.  So while this mechanism might enable 
discovery
of a network, it does not enable discovery of the capabilities of that
network, only the discovery of the capabilities of selected APs within that
network.


  As noted in [Velayos], the IEEE 802.11 Beacon mechanism does not
  scale well; with a Beacon interval of 100ms, and 10 APs in the
  vicinity, approximately 32 percent of an 802.11b AP's capacity is
  used for beacon transmission.  In addition, since Beacon/Probe
  Response frames are sent by each AP over the wireless medium,
  stations can only discover APs within range, which implies
  substantial coverage overlap for roaming to occur without
  interruption.

  A number of enhancements have been proposed to the Beacon/Probe
  Response mechanism in order to improve scalability and roaming
  performance.  These include allowing APs to announce capabilities of
  neighbor APs as well as their own, as proposed in IEEE 802.11k
  [IEEE.802.11k].

  Typically scalability enhancement mechanisms attempt to get around
  Beacon/Probe Response restrictions by sending advertisements at the
  higher layers which are enabled once the station has associated with
  an AP and gained IP connectivity.  Since these mechanisms run over
  IP, they can utilize IP facilities such as fragmentation, which the
  link layer mechanisms may not always be able to do.  For instance, in
  IEEE 802.11, Beacon frames cannot use fragmentation because they are
  multicast frames, and multicast frames are not acknowledged in
  802.11.

  Another issue with the Beacon/Probe Request/Response mechanism is
  that it is either insecure or its security can be assured only after
  already attaching to this particular network.

  When considering access systems such as 802.11 WLANs networks it is
  important to take into account different deployment options.  For
  example, a WLAN deployment may include a number of VLANs in order to
  separate UAM (Universal Access Method) and 802.1X [IEEE.8021X] users
  or users accessing network from different geographical/organizational
  locations.  It is also possible that a larger network spans multiple
  ESSes and prefixes.  It is also possible that users authenticating to
  different realms are able to do so via the same SSID.

[BA] This paragraph needs to tie the various options back to the different
sub-problems.

Suggest rewriting to:

  Traditionally, discovery of points of attachment has been handled
  by link layer or out-of-band mechanisms.   For example, the
  IEEE 802.11 specification [IEEE-802.11] provides support for both
  passive (Beacon) and active (Probe Request/Response) discovery
  mechanisms; [Fixingapsell] studied the effectiveness of these
  mechanisms.  The GSM specifications [GSM] also provide for
  discovery of points of attachment, as does the CARD [RFC4066]
  protocol developed by the IETF SEAMOBY WG.

  RFC 2194 [RFC2194] describes the pre-provisioning of dialup roaming
  clients, which typically included a list of potential phone numbers,
  updated by the provider(s) with which the client had a contractual
  relationship.  RFC 3017 [RFC3017] describes the IETF Proposed
  Standard for the Roaming Access XML DTD.  This covers not only the
  attributes of the Points of Presence (POPs) and Internet Service
  Providers (ISPs), but also hints on the appropriate NAI to be used
  with a particular POP.  The RFC supports dial-in and X.25 access, but
  has extensible address and media type fields.

  In IEEE 802.11 WLANs, the Beacon and Probe Request/Response mechanism
  provides a way for Stations to discover Access Points (APs), as well
  as the capabilities of those APs.  Among the Information Elements
  (IEs) included within the Beacon and Probe Response is the SSID, a
  non-unique identifier of the network to which an Access Point is
  attached.  The Beacon/Probe facility therefore enables network
  discovery, as well as the discovery of points of attachment and
  the capabilities of those points of attachment.

  As noted in [Velayos], the IEEE 802.11 Beacon mechanism does not
  scale well; with a Beacon interval of 100ms, and 10 APs in the
  vicinity, approximately 32 percent of an 802.11b AP's capacity is
  used for beacon transmission.  In addition, since Beacon/Probe
  Response frames are sent by each AP over the wireless medium,
  stations can only discover APs within range, which implies
  substantial coverage overlap for roaming to occur without
  interruption.  Another issue with the Beacon and Probe
  Request/Response mechanism is that it is either insecure or
  its security can be assured only as part of authenticating
  to the network (e.g. verifying the advertised capabilities
  within the 4-way handhskae).

  A number of enhancements have been proposed to the Beacon/Probe
  Response mechanism in order to improve scalability and performance
  in roaming scenarios.  These include allowing APs to announce
  capabilities of neighbor APs as well as their own [IEEE.802.11k].
  More scalable mechanisms for support of "virtual APs" within
  IEEE 802.11 have also been proposed [];  generally these proposals
  collapse multiple "virtual AP" advertisements into a single 
advertisement.

  Higher layer mechanisms can also be used to improve
  scalability, since by running over IP they can utilize facilities
  such as fragmentation which may not be available at the link layer.
  For example, in IEEE 802.11, Beacon frames cannot use fragmentation
  because they are multicast frames.

  While a single IEEE 802.11 network may only utilize a single SSID,
  it may cover a wide geographical area, and as a result, may be segmented,
  utilizing multiple prefixes.  It is possible that a single SSID
  may be advertised on multiple channels, and may support multiple
  access mechanisms, including Universal Access Method (UAM) and
  IEEE 802.1X.  A single SSID also may support dynamic VLAN access
  as described in [RFC3580], or may support authentication to multiple
  home AAA servers supporting different realms.  As a result, users
  of a single point of attachment, connecting to the same SSID may
  not have the same set of services available.