May 2016doc.: IEEE 802.11-16/0691r1
here] [Type here] [Type here][Type here][Type here][Type here]
IEEE P802.11
Wireless LANs
Date: 2016-05-14
Author(s):
Name / Company / Address / Phone / email
Michael Montemurro / BlackBerry Ltd / 4701 Tahoe Blvd
Mississauga, ON, CANADA L4W 0B4 / +1-289-261-4183 /
Mark Hamilton / Ruckus Wireless / 350 W. Java Dr
Sunnyvale, CA / +1.303.818.8472 /
James Lepp / BlackBerry Ltd / 1001 Farrar Road, Ottawa, Canada /
Mark Rison / Samsung Cambridge Solution Centre / SJH, CB4 0DS, U.K. / +44 1223 434600 / at samsung (a global commercial entity) I'm the letter emme then dot rison
Adrian Stephens / Intel Corporation /
11.3STAauthenticationandassociation
11.3.1Statevariables
Changeasfollows:
ASTA(local)forwhichdot11OCBActivatedisfalsekeepsanenumeratedstatevariableforeachSTA(remote)withwhichdirectcommunicationviatheWMisneeded.Inthiscontext,directcommunicationreferstothetransmissionofanyclass2orclass3framewithanAddress1fieldthatmatchestheMACaddressoftheremoteSTA.
ASTAforwhichdot11MeshActivatedistrue(i.e.,ameshSTA)doesnotuseproceduresdescribedin11.3.5(Association,reassociation,anddisassociation).Instead,ameshSTAusesameshpeeringmanagementpro-tocol(MPM)oranauthenticatedmeshpeeringexchange(AMPE)tomanagestatesandstatevariablesforeachpeerSTA.See14.3(Meshpeeringmanagement(MPM))and14.5(Authenticatedmeshpeeringexchange(AMPE))fordetails.
ASTAforwhich dot11OCBActivated is truedoesnotuse MACsublayerauthenticationor association anddoesnotkeepthisstatevariable.
FornonmeshSTAs,thisstatevariableexpressestherelationshipbetweenthelocalSTAandtheremoteSTA.Ittakesonthefollowingvalues:
—State1:Initialstartstatefornon-DMGSTAsandforDMGSTAsthatperformIEEEStd802.11authentication.Unauthenticatedandunassociated.
—State2:InitialstartstateforDMGSTAsthatdonotperformIEEEStd802.11authentication.Authenticated(exceptDMGSTAsthatdonotperformIEEEStd802.11authentication,whichareunauthenticated)butunassociated.
—State3:Authenticated(exceptDMGSTAsthatdidnotperformIEEEStd802.11authentication,whichareunauthenticated)andassociated(PendingRSNAAuthentication).TheIEEEStd802.1XControlledPortisunblocked.
Submissionpage 1Michael Montemurro, BlackBerry
May 2016doc.: IEEE 802.11-16/0691r1
here] [Type here] [Type here][Type here][Type here][Type here]
—State4:Authenticated(exceptDMGSTAsthatdidnotperformIEEEStd802.11authentication,whichareunauthenticated)andassociated(RSNEstablishedorNotRequired).TheIEEEStd802.1XControlledPortisunblocked,ornotpresent.
—State5:FILSauthenticatedandunassociatedforFILSSTAonly.
ThestatevariableiskeptwithintheMLME(i.e.,iswrittenandreadbytheMLME).TheSMEmayalsoreadthisvariable.
MeshSTAsmanagethestatevariableasdescribedin14.3.2(Statevariablemanagement).
11.3.2StatetransitiondiagramfornonmeshSTAs
ChangeFigure10-12asfollowswiththeunderstandingthatitisnotpossibletoshowrevisionmarksinthedrawingitself,thusthisrepresentstheendresultofthesechanges
Figure11-13—RelationshipbetweenstateandservicesbetweenagivenpairofnonmeshSTAs
Submissionpage 1Michael Montemurro, BlackBerry
May 2016doc.: IEEE 802.11-16/0691r1
here] [Type here] [Type here][Type here][Type here][Type here]
11.3.3FramefilteringbasedonSTAstate
Changeasfollows:
ThecurrentstateexistingbetweenthetransmitterandreceiverSTAsdeterminestheIEEEStd802.11frametypesthatmaybeexchangedbetweenthatpairofSTAs(seeClause9(Frameformats)).Auniquestateexistsfor eachpair oftransmitter and receiver STAs. Theallowed frame types are grouped into classes andtheclassescorrespondtotheSTAstate.InState1,onlyClass1framesareallowed.InState2,eitheronly Class1orand Class2framesareallowed.InState3andState4,allframesareallowed(Classes1,2,and3).Inthedefinitionofframeclasses,thefollowingtermsareused:
—WithinaninfrastructureBSS:boththetransmittingSTAandtherecipientSTAparticipateinthesameinfrastructureBSS.
—WithinaPBSS:boththetransmittingSTAandtherecipientSTAparticipateinthesamePBSS.
—WithinanIBSS:boththetransmittingSTAandtherecipientSTAparticipateinthesameIBSS.
—dot11RSNAEnabled:referenceto the settingofdot11RSNAEnabledatthe STAthatneedstodeter-minewhetheratransmissionorreceptionispermitted.
NOTE—Thephrase“withinaBSS”comprises“withinaPBSS,”“withinanIBSS,”“withinaMBSS,”or“withinaninfrastructure BSS.”
STAAparticipatesinthesameinfrastructureBSSasSTABifatleastoneofthefollowingconditionsismet:
—STAAisassociatedwithSTAB,andeitherSTAAorSTABisanAP.
—STAAreceivesaframewith thevalueofitsTAfieldequaltotheMACaddressofSTABandwiththevalueofitsBSSIDfieldequaltotheBSSIDoftheBSSwithwhichSTAAisassociated.
—STA Areceives anInformationResponseframefromthe APwith whichitisassociatedcontaininganexplicitindicationthatSTABisamemberoftheBSSwithwhichSTAAisassociated.
STAAparticipatesinthesamePBSSasSTABifatleastoneofthefollowingconditionsismet:
—STAAisassociatedwithSTAB,andeitherSTAAorSTABisaPCP.
—STAAreceivesaframewith thevalueofitsTAfieldequaltotheMACaddressofSTABandwiththevalueofitsBSSIDfieldequaltotheBSSIDofthePBSSthatSTAAhasjoinedorstarted.
—STAAreceivesaframe,i.e.anInformationResponseframe,fromitsPCPcontaininganexplicitindicationthatSTABisamemberofthePBSSthatSTAAhasjoined.
STAAparticipatesinthesameIBSSasSTABifSTAAreceivesaframewiththevalueofitsTAfieldequaltotheMACaddressofSTABandwiththevalueofitsBSSIDfieldequaltotheBSSIDoftheIBSSthatSTAAhasjoinedorstarted.
Theframeclassesaredefinedasfollows:
a)Class1frames
1)ControlframesiRTS
iiCTS
iiiDMGCleartosend(DMGCTS)ivAck
vGrant
Submissionpage 1Michael Montemurro, BlackBerry
May 2016doc.: IEEE 802.11-16/0691r1
here] [Type here] [Type here][Type here][Type here][Type here]
viSSW
viiSSW-Feedbackviii SSW-Ack
ixGrantAck
xCF-End+CF-AckxiCF-End
xiiInanIBSSandinaPBSSwhendot11RSNAEnabledisfalse,blockack(BlockAck)
xiiiInanIBSSandinaPBSSwhendot11RSNAEnabledisfalse,BlockAckRequest(Block-AckReq)
2)Managementframes
iProbeRequest/ResponseiiBeacon
iiiAuthentication
ivDeauthenticationvATIM
viPublicAction
viiSelf-protectedAction
viiiWithinanIBSS,allActionframesandallActionNoAckframesixUnprotectedDMGActionframes
xInaDMGBSS,LinkMeasurementRequestandLinkMeasurementReportframes
xiInaPBSSwhendot11RSNAEnabledisfalse,allActionandActionNoAckframesexceptthefollowingframes:
1)ADDTSRequest
2)ADDTSResponse
3)DELTS
4)Dataframes
iDataframesbetweenIBSSSTAs
iiDataframesbetweenpeersusingDLSiiiDataframeswithinaPBSS
5)Extensionframes
iDMGBeacon
b)Class2frames
1)Managementframes
iAssociationRequest/Response
iiReassociationRequest/ResponseiDisassociation
c)Class3frames
1)Dataframes
iDataframesbetweenSTAsinaninfrastructureBSSorinanMBSS
2)Managementframes
iInaninfrastructureBSS,anMBSS,oraPBSS,allActionandActionNoAckframesexceptthosethataredeclaredtobeClass1orClass2frames
3)ControlframesiPS-Poll
Submissionpage 1Michael Montemurro, BlackBerry
May 2016doc.: IEEE 802.11-16/0691r1
here] [Type here] [Type here][Type here][Type here][Type here]
iiPoll
iiiSPR
ivDMGDTS
vblockack(BlockAck),exceptthosethataredeclaredtobeClass1
viBlockAckRequest(BlockAckReq),exceptthosethataredeclaredtobeClass1(above)
Class2andClass3framesarenotallowedinanIBSS.IfaSTAinanIBSSreceivesaClass2orClass3frame,itshallignoretheframe.
ASTAshallnottransmitClass2framesunlessinState2orState3orState4.
Anon-FILSSTAshallnottransmitClass3framesunlessinState3orState4.
AFILSSTAshallnottransmitClass3framesunlessinState4.
AmultibandcapabledevicethatusesOCTtomovefromState2toeitherState3orState4shallnottransmitframesbeforethetransmittingSTAbecomeson-the-airenabled(see11.33.4(On-channelTunneling(OCT)operation)).
11.3.4Authenticationanddeauthentication
11.3.4.1General
Changeasfollows:
ThissubclausedescribestheproceduresusedforIEEEStd802.11authenticationanddeauthentication.Thestatesusedinthisdescriptionaredefinedin11.3.1(Statevariables).
Successfulauthenticationsetsthenon-FILSSTA’sstatetoState2,ifitwasinState1.Unsuccessfulauthen-ticationleavestheSTA'sstateunchanged.
DeauthenticationnotificationsetstheSTA’sstatetoState1.DeauthenticationnotificationwheninState3or4impliesdisassociationaswell.ASTAmaydeauthenticateapeerSTAatanytime,foranyreason.
If STA A in an infrastructure BSS receivesa Class 2 orClass 3frame fromSTAB thatis not authenticatedwithSTAA(i.e.,thestateforSTABisState1),STAAshalldiscardtheframe.Iftheframehasanindivid-ualaddressintheAddress1field,theMLMEofSTAAshallsendaDeauthenticationframetoSTAB.
SuccessfulFILSauthenticationsetstheSTA’sstatetoState54 iftheSTA’sstatewasState1.
AuthenticationisoptionalinanIBSS.Inanon-DMGinfrastructureBSS,authenticationisrequired.InaDMGinfrastructureBSSandPBSS,theOpenSystemauthenticationalgorithmisnotused(see12.3.3.1(Overview)).APsdonotinitiateauthentication.
Submissionpage 1Michael Montemurro, BlackBerry
May 2016doc.: IEEE 802.11-16/0691r1
here] [Type here] [Type here][Type here][Type here][Type here]
11.3.4.2Authentication-originatingSTA
Changeasfollows:
UponreceiptofanMLME-AUTHENTICATE.requestprimitivethatispartofanon-channeltunneling(see
10.33.4(On-channelTunneling(OCT)operation)),theoriginatingSTAshallfollowtherulesin11.33.4(On-channelTunneling(OCT)operation)inadditiontotheauthenticationproceduredescribedbelow.
UponreceiptofanMLME-AUTHENTICATE.requestprimitive,theoriginatingSTAshallauthenticatewiththeindicatedSTAusingthefollowingprocedure:
a)IftheSTAisinanIBSStheSMEshalldeleteanyPTKSA,GTKSA,IGTKSAandtemporalkeysheldforcommunicationwiththeindicatedSTAbyusingtheMLME-DELETEKEYS.requestprim-itive(see12.6.18(RSNAsecurityassociationtermination)).
b)TheSTAshallexecuteoneofthefollowing:
1)FortheOpenSystemorSharedKeyauthenticationalgorithm,theauthenticationmechanismdescribedin12.3.3.2(OpenSystemauthentication)or12.3.3.3(SharedKeyauthentication),respectively.
2)ForthefastBSStransition(FT) authenticationalgorithminanESS,the authenticationmecha-nismdescribedin13.5(FTProtocol),or,ifresourcerequestsareincluded,13.6(FTResourceRequestProtocol).
3)ForSAEauthenticationinaninfrastructureBSS,IBSS,orMBSS,theauthenticationmecha-nismdescribedin12.4(Authenticationusingapassword).
4)ForFILSauthenticationinanESS,theauthenticationmechanismdescribedin12.11(Authen- ticationforFILS).An AP may provide estimated association response latency to a non-AP STA using the Association Delay Info field in the Association Delay Info element. ( 9.4.2.175 (Association Delay Info element)). The value of the Association Delay Info field shall be larger than dot11HLPWaitTime.
c)IftheauthenticationwassuccessfulwithintheAuthenticateFailureTimeout,thestatefortheindi-catedSTAshallbesettoState2ifitwasState1;thestateshallremainunchangedifitwasotherthanState1.
d)TheMLMEshallissueanMLME-AUTHENTICATE.confirmprimitivetoinformtheSMEoftheresultoftheauthentication.
11.3.4.3Authentication-destinationSTA
Changeasfollows:
UponreceiptofanAuthenticationframewithauthenticationtransactionsequencenumberequalto1,thedestinationSTAshallauthenticatewiththeoriginatingSTAusingthefollowingprocedure:
a)IfOpenSystemorSharedKeyauthenticationalgorithmisbeingused,theSTAshallexecutetheproceduredescribedin12.3.3.2(OpenSystemauthentication)or12.3.3.3(SharedKeyauthentica-tion),respectively.TheseresultinthegenerationofanMLME-AUTHENTICATE.indicationprimi-tivetoinformtheSMEoftheauthenticationrequest.
b)IfFTauthenticationisbeingused,theMLMEshallissueanMLME-AUTHENTICATE.indicationprimitivetoinformtheSMEoftheauthenticationrequest,includingtheFTAuthenticationEle-ments,andtheSMEshallexecutetheprocedureasdescribedin13.5(FTProtocol)or13.6(FTResourceRequestProtocol).
Submissionpage 1Michael Montemurro, BlackBerry
May 2016doc.: IEEE 802.11-16/0691r1
here] [Type here] [Type here][Type here][Type here][Type here]
c)IfSAEauthenticationisbeingusedinaninfrastructureBSS,IBSS,orMBSS,theMLMEshallissueanMLMEAUTHENTICATE.indicationprimitivetoinformtheSMEoftheauthenticationrequest,includingtheSAEAuthenticationElements,andtheSMEshallexecute theprocedureasdescribedin12.4(Authenticationusingapassword).
d)IfFILSauthenticationisbeingusedinanESS,theMLMEshallissueanMLME-AUTHENTI-CATE.indicationprimitivetoinformtheSMEoftheauthenticationrequest,andtheSMEshallexe-cutetheproceduredescribedin112.11(AuthenticationforFILS).
e)IftheSTAisinanIBSSandmanagementframeprotectionwasnotnegotiatedwhen the PTKSA(s)werecreated,theSMEshalldeleteanyPTKSA,GTKSA,IGTKSAandtemporalkeysheldforcom-municationwiththeoriginatingSTAbyusingtheMLME-DELETEKEYS.requestprimitive(see
12.6.18(RSNAsecurityassociationtermination)).
f)UponreceiptofanMLME-AUTHENTICATE.responseprimitive,iftheResultCodeisnotSUC-CESS,theMLMEshalltransmitanAuthenticationframewiththecorrespondingstatuscode,asdefinedin9.4.1.9(StatusCodefield),andthestatefortheoriginatingSTAshallbeleftunchanged.TheAuthenticationframeisconstructedusingtheappropriateprocedurein12.3.3.2(OpenSystemauthentication),12.3.3.3(SharedKeyauthentication),13.5(FTProtocol)or13.6(FTResourceRequestProtocol).Ifdot11FILSFDFrameBeaconMaximumIntevalisnotequalto0,andifaBeaconframeorFDframehasnotbeentransmittedbyanAPforaperiodthatisequaltodot11FILSFD-FrameBeaconMaximumInterval,thatAPshallqueuefortransmissionaFDframeoraBeaconframeunlessthenextTBTTiswithinadurationindicatedbythevalueofdot11FILSFDFrameBeaconMin-imumInterval.
g)Upon receiptofanMLME-AUTHENTICATE.responseprimitive,iftheResultCodeisSUCCESS,theMLMEshalltransmitanAuthenticationframethatisconstructedusingtheappropriateproce-durein12.3.3.2(OpenSystemauthentication),12.3.3.3(SharedKeyauthentication),13.5(FTProto-col)or13.6(FTResourceRequestProtocol),withastatuscodeofSuccessful,andthestatefortheoriginatingSTAshallbesettoState2ifitwasinState1.
IftheSTAisinanIBSS,iftheSMEdecidestoinitiateanRSNA,andiftheSMEdoesnotknowthesecuritypolicyofthepeer,itmayissueanindividuallyaddressedProbeRequestframetothepeerbyinvokinganMLME-SCAN.requestprimitivetodiscoverthepeer’ssecuritypolicy.
AnAPmayprovideneighborreportinformationtoaSTAthatrequestsauthenticationorassociationbyresponding withanAuthenticationor(Re)AssociationResponseframe thatincludestheReasonCode fieldsettoREJECTED_WITH_SUGGESTED_BSS_TRANSITIONandthatincludesoneormoreNeighborReportelements.
AnAPmayprovideestimatedassociationresponselatencytothenon-APSTAasAssociationDelayInfoparameter(9.4.2.175(AssociationDelayInfoelement)).TheAssociationDelayInfoparametershallbelargerthandot11HLPWaitTime.TheAssociationDelayInfoisprovidedintheAssociationDelayInfoele-ment(9.4.2.175(AssociationDelayInfoelement)).Whenanon-APSTAreceivestheAuthenticationframeincludingAssociationDelayInfoelement,thenon-APSTAsetsthedot11AssociationResponseTimeOutequaltoorlargerthanthecontentoftheelement.
Whenanon-APSTAreceivesanAuthenticationframethat includes an AssociationDelayInfoelement,thenon-APSTAsetsthedot11AssociationResponseTimeOutequaltoorlargerthanthevalue ofthe Association Delay Info field.
11.3.5Association,reassociation,anddisassociation
11.3.5.1General
Changeasfollows:
Submissionpage 1Michael Montemurro, BlackBerry
May 2016doc.: IEEE 802.11-16/0691r1
here] [Type here] [Type here][Type here][Type here][Type here]
May 2016doc.: IEEE 802.11-16/0691r1
here] [Type here] [Type here][Type here][Type here][Type here]
Subclause11.3.5(Association,reassociation,anddisassociation)describestheproceduresusedforIEEEStd802.11association,reassociationanddisassociation.
Thestatesusedinthisdescriptionaredefinedin11.3.1(Statevariables).
SuccessfulassociationenablesaSTAtoexchangeClass3frames.Successfulassociationsetsthenon-FILSSTA’sstatetoState3orState4. Successful association sets the state for andforFILSSTAstoState4.
SuccessfulreassociationenablesaSTAtoexchangeClass3frames.UnsuccessfulreassociationwhennotinState1leavestheSTA’sstateunchanged(withrespecttotheAPorPCPthatwassenttheReassociationRequest(whichmaybethecurrentSTA)).Successfulreassociationsetsthenon-FILSSTA’sstatetoState3orState4(withrespecttotheAPorPCPthatwassenttheReassociationRequestframe).SuccessfulreassociationwhennotinState1setstheSTA’sstatetoState2(withrespecttothecurrentAPorPCP,ifthisisnottheAPorPCP that wassentthe Reassociation Requestframe).Successful reassociationsetsaFILS STA’sstatetoState4andenablesittoexchangeClass3frames.ReassociationshallbeperformedonlyiftheoriginatingSTAisalreadyassociatedinthesameESS.
DisassociationnotificationwhennotinState1setstheanon-FILSSTA’sstatetoState2.Disassociationnotification whennotinState 1sets a FILS STA’sstatetoState 1. TheSTAshall becomeassociatedagainpriortosendingClass3frames.ASTAmaydisassociateapeerSTAatanytime,foranyreason.
Ifnon-DMGSTAAinaninfrastructureBSSreceivesaClass3framefromSTABthatisauthenticatedbutnotassociated withSTAA(i.e., thestateforSTABisState2),STAA shalldiscardtheframe.IftheframehasanindividualaddressintheAddress1field, theMLMEofSTAAshallsendaDisassociationframetoSTAB.
IfDMGSTAAinaninfrastructureBSSreceivesaClass3framefromSTABthatisnotassociatedwithSTAA(i.e.,thestateforSTABisState2),STAAshalldiscardtheframe.IftheframehasanindividualaddressintheAddress1field,theMLMEofSTAAshallsendaDisassociationframetoSTAB.
IfanMM-SMEcoordinatedSTAreceivesanAssociationResponseframewitharesultcodeequalto SUC-CESSandwiththeSingleAIDfieldwithinMMSelementequalto1,then
—ForeachofitsMACentitiesadvertisedwithintheMMSelementandforwhichdot11RSNAEnabledistrue,thestateis setto State3.Progressfrom State 3 toState 4 occurs independentlyin each suchMACentity.
—ForeachofitsMACentitiesadvertisedwithintheMMSelementandforwhichdot11RSNAEnabledisfalse,thestateissettoState4.
IftheMM-SMEcoordinatedSTAinState3isassignedanAIDforonlytheMACentityidentifiedbytheRAfieldoftheAssociationResponseframewithresultcodeequaltoSUCCESS,theMM-SMEmayrepeattheassociationprocedureforanyotherMACentitycoordinatedbytheMM-SME.
Associationis notapplicable in an IBSS. In an infrastructure BSS,associationis required. In aPBSS, asso-ciationisoptional.APsdonotinitiateassociation.
11.3.5.2Non-APandnon-PCPSTAassociationinitiationprocedures
Changeasfollows:
May 2016doc.: IEEE 802.11-16/0691r1
here] [Type here] [Type here][Type here][Type here][Type here]
g)IfanMLME-ASSOCIATE.confirmprimitiveisreceivedwithaResultCodeofSUCCESS,andRSNAisrequired,andFILSauthenticationwasnotused,thentheSMEshallperforma4-wayhandshake toestablishanRSNA.Asapartofasuccessful4-way handshake,theSMEshall enableprotectionbygeneratinganMLME-SETPROTECTION.request(Rx_Tx)primitive.IfanMLME-ASSOCIATE.confirmprimitiveisreceivedwithaResultCodeofSUCCESS,andFILSauthenticationwasused,thentheSMEshallenableprotectionbygeneratinganMLME-SETPROTECTION.request(Rx_Tx) primitive.
11.3.5.3APorPCPassociationreceiptprocedures
Changeasfollows:
n)IftheResultCodeintheMLME-ASSOCIATE.responseprimitiveisSUCCESSandRSNAestablishmentisrequired,andFILSauthenticationwasnotused,theSMEshallattempta4-wayhandshake.Uponasuccessfulcompletionofathe4-wayhandshake,theSMEshallenableprotectionbyissuinganMLME-SETPROTECTION.request(Rx_Tx)primitive.andthestatefortheSTAshallbesettoState4..IfFILSauthenticationwasused,theSMEshallenableprotectionbygeneratinganMLME-SETPROTECTION.request(Rx_Tx)primitive.Ineithercase,uponreceiptoftheMLME-SETPROTECTION.request(Rx_Tx),theMLMEshallsetthestatefortheSTAtoState4.
11.3.5.4Non-APandnon-PCPSTAreassociationinitiationprocedures
Changeasfollows:
g)IfanMLME-REASSOCIATE.confirmprimitiveisreceivedwithaResultCodeofSUCCESS,andRSNAisrequired,andFILSauthenticationwasnotused,andtheSTAisinState3,thentheSMEshallperforma4-wayhandshaketoestablishanRSNA.Asapartofasuccessful4-wayhandshake,theSMEshallenableprotectionbygeneratinganMLME-SETPROTECTION.request(Rx_Tx)primitive.IfanMLME-REASSOCIATE.confirmprimitiveisreceivedwithaResultCodeofSUC-CESS,andFILSauthenticationwasused,andtheSTAisinState3,thentheSMEshallenable pro-tectionbygeneratinganMLME-SETPROTECTION.request(Rx_Tx)primitive.
11.3.5.5APorPCPreassociationreceiptprocedures
Changeasfollows:
r)IftheResultCodeintheMLME-REASSOCIATE.responseprimitiveisSUCCESS,RSNAestab-lishmentisrequired,thereassociationisnotpartoftheBSStransition,andFTandFILSareisnotinuse,theSMEshallattempta4-wayhandshake.Uponasuccessfulcompletionofathe4-wayhand-shake,theSMEshallenableprotectionbyissuinganMLME-SETPROTECTION.request(Rx_Tx)primitiveandthestatefortheSTAshallbesettoState4.IfFILSauthenticationwasused,theSMEshallenableprotectionbygeneratinganMLME-SETPROTECTION.request(Rx_Tx)primitive.Ineithercase,uponreceiptoftheMLME-SETPROTECTION.request(Rx_Tx),theMLMEshallsetthestatefortheSTAtoState4.