WiMAX - Wirelesswireless.ictp.it/school_2005/lectures/cap/WiMax-Cap.pdf · zIn a nutshell: Using Wimax is programming IP sockets Security is a seperate layer zRecognized by its own

Clemens H. Caphttp://wwwiuk.informatik.uni-rostock.dehttp://www.internet-prof.de

WiMAX

WiMAX

Clemens H. Caphttp://wwwiuk.informatik.uni-rostock.de

http://www.internet-prof.dehttp://www.wimax-prof.de

© 2005 C. Cap


WiMAX

For those believing in acronyms


WiMAX 3

The basic idea

Wireless Microwave Access

Wireless Metropolitan Access

The wireless backbone / MAN

Think of it as Wi-Fi on steroids. Business Week


WiMAX

For the pedestrian


WiMAX 5

Application Modes

In WLANAccess PointAd HocWireless Distribution / Mesh

In WiMAXBasestation Standard WiMAX way of life 802.16Mesh Optional WiMAX way of life 802.16aMobile Future WiMAX way of life 802.16e


WiMAX 6

WLAN Application ModeAccess Point

Access Point

Client Client

Client

All communication uses APAP may serve as bridge to wired worlAP may serve as firewallMay use different channels


WiMAX 7

WLAN Application ModeAd Hoc

Client Client

Client

Direct communicationMust use same channel


WiMAX 8

WLAN Application ModeWireless Distribution System / Mesh

Provide or establish inter-AP linksAtomated routing through the mesh


WiMAX 9

WiMAX Application ModeBasestation

Basestation

Subscriber Station Subscriber Station

Subscriber Station

All communication uses BSBS may serve as bridge to wired worlVery similar to access point mode


WiMAX 10

WiMAX Application ModeBasestation

Basestation

Differences to WLAN:• Its rather a larger area• Its rather sectored• Its rather more clients

Sector 1 Sector 2

Sector 3


WiMAX 11

WiMAX Application ModeMesh

Differences to WLAN:• Std: Mesh Nodes ::= nodes with ext. Connectiv• More complicated routing• More complicated MAC layer for air access


WiMAX 12

WiMAX Application ModeMobile

Properties:• Metropolitan Mobility: ~ 75 km / h speeds• Roaming between Basestations• Meshing with Subscriber Stations


WiMAX 13

Application Areas (1)

Broadband Access: T1 / E1 and better, but without wires, for high end usersOutdoor antenna on the roof, Clear Line of SightStationary applicationBasestation to Subscriber Station Traffic

Wireless Last Mile: Yet another consumer last mile solutionSold as W-DSL in combination with WLANAlso: Dropping WLAN, WiMAX to the home userIndoor antenna, Non Line of SightMeshing

Mobile Universal Serv.: Yet another mobile comm (phone) solutionCompetition for UMTSRoaming

802.16

802.16a

802.16e


WiMAX 14

Application Areas (2)

Dedicated radio link: Standardized technology for a classical problem

Developing Countries: Entry technology into high speed communicationsLow cost equipment, no infrastructure required„Low barrier“ technology

Emergency, Security and SurveillanceEasy, quick field deploymentBandwidth for video surveillance possible(Good ?) encryption includedDoes not require infrastructure operator

closed circuit operations possiblelow cost (only the equipment)


WiMAX 15

Factors for Application Areas

0

++

+

+++

+

+

Standard

+++

+++

+++

+

+++

++

Cost

+++

++

+++

+++

+

+++

Performance

InteroperableScaleability

Area

+++

+

+

++

++

+

0Emergency, Security and Surveillance

+DevelopingCountries

0DedicatedRadio Link

+++Mobile Universal Service

+++WirelessLast Mile

++BroadbandAccess


WiMAX

For the standards people


WiMAX 17

The families

PANPersonal Area Network

LANLocal Area Network

MANMetropolitan Area Network

WANWide Area Network

802.15

802.11

802.16

802.20

802.16e

802.16a

HiperPAN

HiperLAN

HiperMANHiperACCESS

GSMUMTS


WiMAX 18

Standardization Activities (1)

802.16 Original standard10 - 66 GHzLine of sight, Point to point

802.16a Extension to 2-11 GHzNon line of sight, Point to multipoint

802.16REVd Merger of 802.16 and 802.16aErrata andSystem Profiles

802.16e Extension for mobility for vehicular speedsExtension for roaming

802.16c Amendment for 10-66 GHz system profiles

802.21 Media independent handoff ( 802.3, 802.15, 802.11, 802.16 )

802.20 Mobile Broadband Wireless Access MBWA» Compares to 802.16e» Looks at high speed mobile user up to 250 km / h» Standardization lagging behing 802.16


WiMAX 19

Certification (1)

Problem: IEEE 802.16 is yet another flawed standardVery broad and occasionally vagueOutlines messages and possibilitiesLacks algorithms, procedures, clear implementation guaranteesDoes not define compliance testsWill not automatically lead to interoperable systems

WiMAX Forum: Goal is „to ensure compatibility and inter operability“Trademark „WiMAX ForumTM Certified“Different from non protected „WiMAX Compliant“Certification Work Group defines interoperability standards & proceduresMore than 230 members (as of Q1 2005)Quarterly growth rate of more than 40%


WiMAX 20

Certification (2)

Certification Process of Wimax ForumFirst „WiMAX ForumTM Certified“ systems available in Q1 2005Ensure interoperability with ETSI HiperMAN standardsCetecom Lab in Spain selected as certification labRevised target date for first certification: July 2005

ProcessForum defines PICS (Protocol Implementation Conformance Statements)Forum defines Test SuitesLab conducts the tests


WiMAX

For the architecture and technical people


WiMAX 22

The three 802.16 Standards

1 – 3 miles3 – 5 miles, max 30 miles1 – 3 miles

Metropolitan MobilityRoaming

FixedFixed

15 Mbps75 Mbps32 – 134 Mbps

2 – 6 GHz2 – 11 GHz10 – 66 GHzNear Line of SightNear Line of SightLine of Sight

802.16e802.16a802.16


WiMAX 23

Compared to 802.11 (1)

ndwidthensing

alability

oor vstdoor

nge

riterion

High75 - 100 Mbps – 134 MbpsEfficiency 5 bps / Hz

Low to medium1 Mbps - 11 Mbps - 54 Mbps - 108 MbpsEfficiency 2,7 bps / Hz peak

Licensed and unlicensed bandsUnlicensed bands

ExcellentVariable bandwidth 1.5 MHz – 20 MHzOnly limit is available spectrum

PoorFixed bandwidth of 20 MHzFixed channelsCertain degree of channel overlap

Indoor (16a) Outdoor (16, 16e)PHY tolerateshigh multi-path delay spread (10 µsec = 3 kmTrees, buildings, persons

Preferably Indoor PHY tolerates only low multi-path delay spreads

Considerably largerOptimized for 7 – 10 kmUp to 50 km range

Very smallOptimized for 100 m

802.16802.11


WiMAX 24

Compared to 802.11 (2)

S

curity

AC Layer

riterion

Supposedly goodNevertheless flawed in principle3DES, AES

Mostly questionableVarious attempts on improvementsWEP, WPA

Grant based MACContention based MAC: CSMA / CA

Good QoS4 QoS classes for voice & video

No QoS802.11e upcoming

802.16802.11


WiMAX 25

Layer Architecture

Physical LayerModulationChannel and frequency selectionPower ControlTransmit & Receive

Security (Standard: Privacy) Layer

Main MAC Layer

MAC Convergence Layer

AuthenticationKey Exchange and Re-KeyingEncryption

FramingSlot ReservationFragmentation & PackingRetransmission (ARQ)Quality of Service (QoS)

ATMEthernet, VLANPPPIPv4, IPv6

Specific Service Access Point

MAC Service Access Point

PHY Service Access Point

User


WiMAX 26

Layer ArchitectureObservations

User will always use a convergence layerIn a nutshell: Using Wimax is programming IP sockets

Security is a seperate layerRecognized by its own right, which is good when compared to 802.11Is placed just above the PHY, which is a good place for encapsulationBut: It has a number of flawsOne of the problems: Many management messages are not encrypted

ProfilesFor every layer there are several variants defined by profiles5 PHY variants2 MAC variants


WiMAX 27

Layer ArchitectureExisting Profiles

MACPoint-to-MultipointMeshing

PHYWirelessMAN-SCWirelessMAN-SCaWirelessMAN-OFDMWirelessMAN-OFDMAWIrelessHuman

What we expect them to beFrom the introduction to this talk

Quite a number of intriguingDifferences regarding supported features


WiMAX

For the open networkers

community networkers


WiMAX 29

Open Source

Linux: We are doing our own operating systemGcc: We are doing out own compilerWiki: We are doing our own contentWikiNews: We are doing our own news

CopyLeft:Everyone has access to the state of the artEveryone can contribute, add and modifyOwn contribution, if distributed, is again „CopyLeft“

Effect:We all participate for our common benefitEveryone can participate on identical conditionsNoone can monopolize or block development

Sufficient proof that it can be d

And it can be done successfull


WiMAX 30

Open Net

OpenNet: We are doing our network

Idea:Every terminal node also is routing nodeEvery additional consumer device builds upon the infrastructureLet us assume a sufficient density of nodes

Result:We have a working network – without a providerWe are structurally autonomousNo bit-tax, no pay-per-use (but no space for illegal stuff as well !)


WiMAX 31

OpenNet and ClosedNet compared

The net belongs to the provider / carrierThe net belongs to its users

Monopolists and investors which must be regulated and watched carefullyNo monopolists, no investors, no market dominance

Commercial profiling of users, big brother is watching us, data harvesting on citizenNo centralized provider, less chance for big brother

Return on investment for the investorCreating and using value by the user

Communication as supervised, regulated and deregulated, commercialized goodCommunication by us all and for us all

Every bit pays (for the provider)Its out net, out infrastructure and our bits


WiMAX 32

Djursland.net


WiMAX 33

MIT Roofnet


WiMAX 34

BerlinBackbone


WiMAX 35

BrisbaneMesh


WiMAX 36

SidneyWireless


WiMAX 37

and of course at Rostock ☺www.opennet-forum.de (up)

www.opennet-initiative.de (to come)


WiMAX 38

Just a thought

Imagine WiMAX attached anonymous storage

For WLAN it‘s already there:Asus Spacelink 802.11g with 500 GB USB drive and anonymous ftp

Now add Freenet concepts encryption and anonymity

Question: How could one possibly & practically censor or „regulate“ this?


WiMAX 39

The big chance is Wimax

Yesterday: CableLarge investmentsLarge distancesLarge data rates

Today: WLANLow investmentsMedium distancesMedium data rates

Tomorrow: WIMAXLow investments (hopefully; shared)Large distancesLarge data rates

100,- Euro50 Km2 - 70 Mbit / sec

100,- Euro200 Meter2 - 54 Mbit / sec

2004: First prototy2005: Chipset by I2007: In every Lap

But not at the same time


WiMAX 40

What we can do (1)

Embrace technologyUnderstand standard (complicated & solid 900+ pages)Educate ourselvesMake experiences with base stations (not only with subscriber stations)Write OO model for APIDanger: WiMAX stays closed & controlled know how (such as in GSM & UMTS)

Develop applicationsVoice over WiMAXGames over WiMAX (use broadcast features)Community content over WiMAXFree, open, anonymous layers for WiMAXMust have many open source – open content applications


WiMAX 41

What we can do (2)

Regulatory discussionMust obtain sufficient open spectrum for meshing and roamingMust prevent further regulation of applications

eg: VoIP, key escrow, content censorshipMust deploy anonymous & free content networks (Freenet, Eternity service, etc.)

Opensource WiMAXExperiment with MAC and PHY APIsWrite OO model / simulator for MAC and PHY APILinux driver for WiMAX adaptersLinux enhanced WiMAX equipment (presently: FPGA & DSP, ASIC)WiMAX enabled Linux equipment


WiMAX 42

Just a thought

Imagine WiMAX attached anonymous storage

For WLAN it‘s already there:Asus Spacelink 802.11g with 500 GB USB drive and anonymous ftp

Now add Freenet concepts encryption and anonymity

Question: How could one possibly & practically censor or „regulate“ this?


WiMAX

Let us peek into the standard


WiMAX 44

PHY Layer

OFDMWhich is a topic by itself

Dynamic Frequency SelectionChose a channel to combat interferenceIn certain bands mandatory (military, radar)

Transmit Power ControlReduce EIRP so far as possible


WiMAX 45

Frequencies (1)

Not so easy– even if restricted to the US view

– and restricted to 2 – 11 GHz


WiMAX 46

Frequencies (2)

Licensed 2.5 GHzAlready allocated in US, Mexico, Brazil, AsiaOngoing efforts in other countries

License exempt 5 GHzLicense free in the USOngoing efforts for opening this in other countries

Licensed 3.5 GHzLicensed in more than 100 countriesGenerally requires license

Others to be harmonized soon


WiMAX 47

Frequencies (3)

Just what is a license?

Austria: Auctioned License17 Frequency allocations (3.5 Ghz band)Held by 4 companiesAuctioning yields total amount of 464.000 Euros

Germany: Licensing LightNo auctioning (too expensive)No formalized process (too inflexible)In case of frequency conflict: Look for local, pragmatic solution


WiMAX 48

Modulation Schemes Used

hannelandwidths

t Rate

odulation

20, 25 and 28 MHzSelectable1.25 to 20 MHz

20, 25 and 28 MHz

< 15 Mbps at5 MHz Channelization

< 75 Mbps at20 Mhz Channelization

32 – 134 Mbps at28 MHz Channelization

QPSK16 QAM64 QAM

OFDM 256QPSK16 QAM64 QAM

QPSK16 QAM64 QAM

802.16e802.16a802.16


WiMAX 49

Downlink Frames

Downlink Frame consists of1. A preamble for synchronization2. A downlink map telling the subscriber which part of the payload is intended for it3. An uplink map telling the subscriber when it may access the air4. A payload


WiMAX 50

MAC Layer

Generic MAC HeaderPayload Optional CRC (32 bit CCITT standard)

Payload can containAdditional headers (depends on type field in Generic MAC Header)MAC management messagesUser Data


WiMAX 51

MAC LayerGeneric Mac Header

Distinguish from other headers

Payload encrypted?

MPDU Length (max 2047 Bytes)

Optional CRC present at end of PDU

Index of key to be used

Additional subheaders in payload?

Connection Id

Additional Header Checksum


WiMAX 52

MAC LayerOberservations based on Generic Header

MAC PDU length less than 2k BytesBut fragmentation and packing options are available

More than one encryption key can be activeWe have to say which one we want to useWe must change keys from time to timeBut during the change of one key we always have another valid keySo we do not spend (much) time on rekeying overhead

Basic item of management is the connectionCompare TCP: Connection ID is 4-tuple of (IP1, Port1, IP2, Port2)


WiMAX 53

MAC LayerBandwidth Request Header

Distinguish from other headers

Is never encrypted

Bandwidth Request inNumber of Bytes

Type of request0 incremental1 aggregate

Connection Id

Additional Header Checksum


WiMAX 54

MAC LayerObservations based on Bandwidth Request Header

Bandwidth requests come as a headerAs part of an empty payloadPiggyback as part of a payload (even of a different connection id to the same subscriber)

Bandwidth requests are never encryptedWhich is not a safe idea (and they are not authenticated either !)Which is more convenient since everyone sees the bandwidth requests

Note: A bandwidth request is given in bytes not in bytes per time unitWhich is an abuse of language, but otherwise fine

Request type can be incremental or aggregateincremental (what subscriber needs in addition)or aggregate (what subscriber needs in total)Choice makes life easier for the streaming people


WiMAX 55

MAC LayerPacking and Fragmentation

Fragmentation (Splitting MAC level packets)A MAC SDU can be broken into individual partsThe parts are transmitted independentlyIndication is done by a special subheader

Packing (Aggregating MAC level packets)Multiple MAC SDUs or even fragments can be packed into one SDUIndication is done by a special subheader

AdvantagesMore efficient use of available slotsBandwidth requests can be issued earlier


WiMAX 56

Network Entry

Getting access to the networkSubscriber scans for downlink from Base and synchronizes PHYSubscriber identifies free uplink slotSubscriber informs Base of its capabilities and presencePrimary management connections are establishedSubscriber provides proof of authorizationKey exchange protocols establish valid keysSecondary management connections are establishedAdaption layers are configured (eg: IP)

Keeping access to the networkPeriodic exchange of management messagesCheck channel conditionIf necessary, switch PHY or start handoff (for mobile users)


WiMAX 57

Security Sublayer

Identification of the SubscriberAsymmetric keys with PKI and certificate structure

Authentication Key AKSymmetric key for distributing and deriving further keys

Key Distribution Key KEKDerived from Authentication KeyUsed to distribute Traffic Encoding Key

Traffic Encryption KeyUsed to encrypt traffic


WiMAX 58

Double Layer Hybrid Approach

Problem 1: Asymmetric encryption takes too much CPU powerSolution 1: Encrypt symmetric key with asymmetric method

Symmetric methods are fasterOccasionally provide a new symmetric key

Problem 2: Providing a new symmetric takes too much CPU powerSolution 2: Introduce another layer of indirection

Key redistribution is fasterOccasionally provide a new key at both levels

ResultNeed a two layered key-distribution / re-keying approachThat is esenntially the contents of the Privacy sublayer


WiMAX 59

Problems left

Base not authenticated, allows man-in-the-middleMAC header not encrypted, allows attacks & fakes on MAC headersMAC Management Messages not encrypted, allows attacks & fakes on MessagesMain (or only?) focus is protection against theft of servicePermissions bound to MAC address of subscriber instead of to userSubscriber based production of certificates not described, allows attacks on

randomization scheme and key generatorSubscriber may have factory installed keys (which might be escrowed)Security generally is handled by the operator and by the base station

thus scheme requires trusting the operator and the base stationStandard is not fully clear and not sufficiently formally defined

There are not yet fully compliant and certified products... but there are already papers describing the weaknesses of the security


WiMAX 60

Angry remark concerning security

IEEE did not get WEP security rightIEEE did not get Wimax security rightNSA must love the security guys from IEEE,

since they make their work much easier

The newest standard documents in PDF format are sold for $$$and are protected by a node locked digital rights management

The department bought one for my computer at workThe department bought a second one after my motherboard went deadI bought a third for my first computer at homeI would need a fourth one to take along with my laptopAnd after a minor reconfiguration of my two PCs at home I spent 2 hours undoing the relevant changes to be able to read my third copy again


WiMAX 61

Why?

Why does a professional institution

living from the dues of their members

seem to

always

get the wrong things right

and the right things wrong

when it comes to security


WiMAX

For the marketing people


WiMAX 63

Tons and tons of marketing studies

Found on the web:„Wimax presently is discussedin terms of dollars and marketopportunities, not in terms ofequipment or solutions“

Presently the best way to makemoney on Wimax is to publisha study on how to make moneyon Wimax


WiMAX 64

Why Wimax will be a success

Why Wimax will not be a success


WiMAX 65

Why Wimax will be a success

Good Standard: IEEE Standard and Wimax interoperablility Certification

Well regulated: Development accompanied by evolution of frequency regulation

Technics:Broadband speed for NLOSHigh number of simultaneous sessionsSupport for mobility, roaming and meshingHigh spectral efficiencyGood quality of service

DemandDemanded by carriersSolves last mile problemNew deployment models


WiMAX 66

Why Wimax will not be a success

No products: The products are coming too lateNo proof of product yet

Regulation: Is going on but no clear cut and reliable results yet

Counter demand:The UMTS guys and the license / auction fees they had to pay

Development: Yet another hype to break down early enough to ruin many?Expectations already risen too high? (NLOS to 70 km at 100 Mbits for 1$)

Unresolved issues:Free spectrum applications?High frequency devices (66 GHz)?Handoff into WLAN, UMTS, GSM


WiMAX 67

Market Expectationsfor wired broadband

World Wide Number of Broadband Wires


WiMAX 68

Market Expectationsfor wireless broadband

World Wide Revenues from Point to Multipoint Broadband Wireless Access


WiMAX 69

Market Expectationsfor number of subscribers


WiMAX 70

Equipment

Basestations and Subscriber StationsRedline Communications First Base StationAlvarion BreezeMAX ETSI HiperMAN compliant

ForthcomingChipset (Intel Rosedale / Centrino 2; Wavesat)AdaptersMotherboard ModulesMobile phones, laptops, PDAs


WiMAX 71

Alvarion

Product Line BreezeMAX

Base Station EquipmentModular concept: Several components for a 19“ rackOne component for every sector servedSeparation indoor access unit and outdoor amplifier unitMicro base station available for rural areas

Customer Premises Equipment (CPE)Broadband Data CPEBroadband Voice CPE


WiMAX 72

Redline Communications

30 series50 series

Pre 802.16 systen

100 seriesClaims to be first fully 802.16 compatible systemPresently only basestation


WiMAX 73

Time Line

Q3 / 2004Outdoor installations for 802.16Spectrum discussions

2005Q1: WiMAX certification startsIndoor installations for 802.16aFirst implementations with 802.16eNomadic installation witout roamingIntel Chipset Rosdale and Centrino 2First USB / Cardbus adapters

2006Higher speeds for 802.16Roaming for 802.16eWiMAx Laptops and PDAs

2007WiMAx phones and appliances

Corporate, make money approachMay be bad for SME & community nets

NOT MET

NOT MET

Documents

WiMAX - Wirelesswireless.ictp.it/school_2005/lectures/cap/WiMax-Cap.pdf · zIn a nutshell: Using Wimax is programming IP sockets Security is a seperate layer zRecognized by its own