Here Type Here Type Here Type Here Type Here Type Here

May 2016doc.: IEEE 802.11-16/0691r1

here] [Type here] [Type here][Type here][Type here][Type here]

IEEE P802.11
Wireless LANs

11.3STAauthenticationandassociation

11.3.1Statevariables

Changeasfollows:

ASTA(local)forwhichdot11OCBActivatedisfalsekeepsanenumeratedstatevariableforeachSTA(remote)withwhichdirectcommunicationviatheWMisneeded.Inthiscontext,directcommunicationreferstothetransmissionofanyclass2orclass3framewithanAddress1fieldthatmatchestheMACaddressoftheremoteSTA.

ASTAforwhichdot11MeshActivatedistrue(i.e.,ameshSTA)doesnotuseproceduresdescribedin11.3.5(Association,reassociation,anddisassociation).Instead,ameshSTAusesameshpeeringmanagementpro-tocol(MPM)oranauthenticatedmeshpeeringexchange(AMPE)tomanagestatesandstatevariablesforeachpeerSTA.See14.3(Meshpeeringmanagement(MPM))and14.5(Authenticatedmeshpeeringexchange(AMPE))fordetails.

ASTAforwhich dot11OCBActivated is truedoesnotuse MACsublayerauthenticationor association anddoesnotkeepthisstatevariable.

FornonmeshSTAs,thisstatevariableexpressestherelationshipbetweenthelocalSTAandtheremoteSTA.Ittakesonthefollowingvalues:

—State1:Initialstartstatefornon-DMGSTAsandforDMGSTAsthatperformIEEEStd802.11authentication.Unauthenticatedandunassociated.

—State2:InitialstartstateforDMGSTAsthatdonotperformIEEEStd802.11authentication.Authenticated(exceptDMGSTAsthatdonotperformIEEEStd802.11authentication,whichareunauthenticated)butunassociated.

—State3:Authenticated(exceptDMGSTAsthatdidnotperformIEEEStd802.11authentication,whichareunauthenticated)andassociated(PendingRSNAAuthentication).TheIEEEStd802.1XControlledPortisunblocked.

Submissionpage 1Michael Montemurro, BlackBerry

May 2016doc.: IEEE 802.11-16/0691r1

here] [Type here] [Type here][Type here][Type here][Type here]

—State4:Authenticated(exceptDMGSTAsthatdidnotperformIEEEStd802.11authentication,whichareunauthenticated)andassociated(RSNEstablishedorNotRequired).TheIEEEStd802.1XControlledPortisunblocked,ornotpresent.

—State5:FILSauthenticatedandunassociatedforFILSSTAonly.

ThestatevariableiskeptwithintheMLME(i.e.,iswrittenandreadbytheMLME).TheSMEmayalsoreadthisvariable.

MeshSTAsmanagethestatevariableasdescribedin14.3.2(Statevariablemanagement).

11.3.2StatetransitiondiagramfornonmeshSTAs

ChangeFigure10-12asfollowswiththeunderstandingthatitisnotpossibletoshowrevisionmarksinthedrawingitself,thusthisrepresentstheendresultofthesechanges

Figure11-13—RelationshipbetweenstateandservicesbetweenagivenpairofnonmeshSTAs

Submissionpage 1Michael Montemurro, BlackBerry

May 2016doc.: IEEE 802.11-16/0691r1

here] [Type here] [Type here][Type here][Type here][Type here]

11.3.3FramefilteringbasedonSTAstate

Changeasfollows:

ThecurrentstateexistingbetweenthetransmitterandreceiverSTAsdeterminestheIEEEStd802.11frametypesthatmaybeexchangedbetweenthatpairofSTAs(seeClause9(Frameformats)).Auniquestateexistsfor eachpair oftransmitter and receiver STAs. Theallowed frame types are grouped into classes andtheclassescorrespondtotheSTAstate.InState1,onlyClass1framesareallowed.InState2,eitheronly Class1orand Class2framesareallowed.InState3andState4,allframesareallowed(Classes1,2,and3).Inthedefinitionofframeclasses,thefollowingtermsareused:

—WithinaninfrastructureBSS:boththetransmittingSTAandtherecipientSTAparticipateinthesameinfrastructureBSS.

—WithinaPBSS:boththetransmittingSTAandtherecipientSTAparticipateinthesamePBSS.

—WithinanIBSS:boththetransmittingSTAandtherecipientSTAparticipateinthesameIBSS.

—dot11RSNAEnabled:referenceto the settingofdot11RSNAEnabledatthe STAthatneedstodeter-minewhetheratransmissionorreceptionispermitted.

NOTE—Thephrase“withinaBSS”comprises“withinaPBSS,”“withinanIBSS,”“withinaMBSS,”or“withinaninfrastructure BSS.”

STAAparticipatesinthesameinfrastructureBSSasSTABifatleastoneofthefollowingconditionsismet:

—STAAisassociatedwithSTAB,andeitherSTAAorSTABisanAP.

—STAAreceivesaframewith thevalueofitsTAfieldequaltotheMACaddressofSTABandwiththevalueofitsBSSIDfieldequaltotheBSSIDoftheBSSwithwhichSTAAisassociated.

—STA Areceives anInformationResponseframefromthe APwith whichitisassociatedcontaininganexplicitindicationthatSTABisamemberoftheBSSwithwhichSTAAisassociated.

STAAparticipatesinthesamePBSSasSTABifatleastoneofthefollowingconditionsismet:

—STAAisassociatedwithSTAB,andeitherSTAAorSTABisaPCP.

—STAAreceivesaframewith thevalueofitsTAfieldequaltotheMACaddressofSTABandwiththevalueofitsBSSIDfieldequaltotheBSSIDofthePBSSthatSTAAhasjoinedorstarted.

—STAAreceivesaframe,i.e.anInformationResponseframe,fromitsPCPcontaininganexplicitindicationthatSTABisamemberofthePBSSthatSTAAhasjoined.

STAAparticipatesinthesameIBSSasSTABifSTAAreceivesaframewiththevalueofitsTAfieldequaltotheMACaddressofSTABandwiththevalueofitsBSSIDfieldequaltotheBSSIDoftheIBSSthatSTAAhasjoinedorstarted.

Theframeclassesaredefinedasfollows:

a)Class1frames

1)ControlframesiRTS

iiCTS

iiiDMGCleartosend(DMGCTS)ivAck

vGrant

Submissionpage 1Michael Montemurro, BlackBerry

May 2016doc.: IEEE 802.11-16/0691r1

here] [Type here] [Type here][Type here][Type here][Type here]

viSSW

viiSSW-Feedbackviii SSW-Ack

ixGrantAck

xCF-End+CF-AckxiCF-End

xiiInanIBSSandinaPBSSwhendot11RSNAEnabledisfalse,blockack(BlockAck)

xiiiInanIBSSandinaPBSSwhendot11RSNAEnabledisfalse,BlockAckRequest(Block-AckReq)

2)Managementframes

iProbeRequest/ResponseiiBeacon

iiiAuthentication

ivDeauthenticationvATIM

viPublicAction

viiSelf-protectedAction

viiiWithinanIBSS,allActionframesandallActionNoAckframesixUnprotectedDMGActionframes

xInaDMGBSS,LinkMeasurementRequestandLinkMeasurementReportframes

xiInaPBSSwhendot11RSNAEnabledisfalse,allActionandActionNoAckframesexceptthefollowingframes:

1)ADDTSRequest

2)ADDTSResponse

3)DELTS

4)Dataframes

iDataframesbetweenIBSSSTAs

iiDataframesbetweenpeersusingDLSiiiDataframeswithinaPBSS

5)Extensionframes

iDMGBeacon

b)Class2frames

1)Managementframes

iAssociationRequest/Response

iiReassociationRequest/ResponseiDisassociation

c)Class3frames

1)Dataframes

iDataframesbetweenSTAsinaninfrastructureBSSorinanMBSS

2)Managementframes

iInaninfrastructureBSS,anMBSS,oraPBSS,allActionandActionNoAckframesexceptthosethataredeclaredtobeClass1orClass2frames

3)ControlframesiPS-Poll

Submissionpage 1Michael Montemurro, BlackBerry

May 2016doc.: IEEE 802.11-16/0691r1

here] [Type here] [Type here][Type here][Type here][Type here]

iiPoll

iiiSPR

ivDMGDTS

vblockack(BlockAck),exceptthosethataredeclaredtobeClass1

viBlockAckRequest(BlockAckReq),exceptthosethataredeclaredtobeClass1(above)

Class2andClass3framesarenotallowedinanIBSS.IfaSTAinanIBSSreceivesaClass2orClass3frame,itshallignoretheframe.

ASTAshallnottransmitClass2framesunlessinState2orState3orState4.

Anon-FILSSTAshallnottransmitClass3framesunlessinState3orState4.

AFILSSTAshallnottransmitClass3framesunlessinState4.

AmultibandcapabledevicethatusesOCTtomovefromState2toeitherState3orState4shallnottransmitframesbeforethetransmittingSTAbecomeson-the-airenabled(see11.33.4(On-channelTunneling(OCT)operation)).

11.3.4Authenticationanddeauthentication

11.3.4.1General

Changeasfollows:

ThissubclausedescribestheproceduresusedforIEEEStd802.11authenticationanddeauthentication.Thestatesusedinthisdescriptionaredefinedin11.3.1(Statevariables).

Successfulauthenticationsetsthenon-FILSSTA’sstatetoState2,ifitwasinState1.Unsuccessfulauthen-ticationleavestheSTA'sstateunchanged.

DeauthenticationnotificationsetstheSTA’sstatetoState1.DeauthenticationnotificationwheninState3or4impliesdisassociationaswell.ASTAmaydeauthenticateapeerSTAatanytime,foranyreason.

If STA A in an infrastructure BSS receivesa Class 2 orClass 3frame fromSTAB thatis not authenticatedwithSTAA(i.e.,thestateforSTABisState1),STAAshalldiscardtheframe.Iftheframehasanindivid-ualaddressintheAddress1field,theMLMEofSTAAshallsendaDeauthenticationframetoSTAB.

SuccessfulFILSauthenticationsetstheSTA’sstatetoState54 iftheSTA’sstatewasState1.

AuthenticationisoptionalinanIBSS.Inanon-DMGinfrastructureBSS,authenticationisrequired.InaDMGinfrastructureBSSandPBSS,theOpenSystemauthenticationalgorithmisnotused(see12.3.3.1(Overview)).APsdonotinitiateauthentication.

Submissionpage 1Michael Montemurro, BlackBerry

May 2016doc.: IEEE 802.11-16/0691r1

here] [Type here] [Type here][Type here][Type here][Type here]

11.3.4.2Authentication-originatingSTA

Changeasfollows:

UponreceiptofanMLME-AUTHENTICATE.requestprimitivethatispartofanon-channeltunneling(see

10.33.4(On-channelTunneling(OCT)operation)),theoriginatingSTAshallfollowtherulesin11.33.4(On-channelTunneling(OCT)operation)inadditiontotheauthenticationproceduredescribedbelow.

UponreceiptofanMLME-AUTHENTICATE.requestprimitive,theoriginatingSTAshallauthenticatewiththeindicatedSTAusingthefollowingprocedure:

a)IftheSTAisinanIBSStheSMEshalldeleteanyPTKSA,GTKSA,IGTKSAandtemporalkeysheldforcommunicationwiththeindicatedSTAbyusingtheMLME-DELETEKEYS.requestprim-itive(see12.6.18(RSNAsecurityassociationtermination)).

b)TheSTAshallexecuteoneofthefollowing:

1)FortheOpenSystemorSharedKeyauthenticationalgorithm,theauthenticationmechanismdescribedin12.3.3.2(OpenSystemauthentication)or12.3.3.3(SharedKeyauthentication),respectively.

2)ForthefastBSStransition(FT) authenticationalgorithminanESS,the authenticationmecha-nismdescribedin13.5(FTProtocol),or,ifresourcerequestsareincluded,13.6(FTResourceRequestProtocol).

3)ForSAEauthenticationinaninfrastructureBSS,IBSS,orMBSS,theauthenticationmecha-nismdescribedin12.4(Authenticationusingapassword).

4)ForFILSauthenticationinanESS,theauthenticationmechanismdescribedin12.11(Authen- ticationforFILS).An AP may provide estimated association response latency to a non-AP STA using the Association Delay Info field in the Association Delay Info element. ( 9.4.2.175 (Association Delay Info element)). The value of the Association Delay Info field shall be larger than dot11HLPWaitTime.

c)IftheauthenticationwassuccessfulwithintheAuthenticateFailureTimeout,thestatefortheindi-catedSTAshallbesettoState2ifitwasState1;thestateshallremainunchangedifitwasotherthanState1.

d)TheMLMEshallissueanMLME-AUTHENTICATE.confirmprimitivetoinformtheSMEoftheresultoftheauthentication.

11.3.4.3Authentication-destinationSTA

Changeasfollows:

UponreceiptofanAuthenticationframewithauthenticationtransactionsequencenumberequalto1,thedestinationSTAshallauthenticatewiththeoriginatingSTAusingthefollowingprocedure:

a)IfOpenSystemorSharedKeyauthenticationalgorithmisbeingused,theSTAshallexecutetheproceduredescribedin12.3.3.2(OpenSystemauthentication)or12.3.3.3(SharedKeyauthentica-tion),respectively.TheseresultinthegenerationofanMLME-AUTHENTICATE.indicationprimi-tivetoinformtheSMEoftheauthenticationrequest.

b)IfFTauthenticationisbeingused,theMLMEshallissueanMLME-AUTHENTICATE.indicationprimitivetoinformtheSMEoftheauthenticationrequest,includingtheFTAuthenticationEle-ments,andtheSMEshallexecutetheprocedureasdescribedin13.5(FTProtocol)or13.6(FTResourceRequestProtocol).

Submissionpage 1Michael Montemurro, BlackBerry

May 2016doc.: IEEE 802.11-16/0691r1

here] [Type here] [Type here][Type here][Type here][Type here]

c)IfSAEauthenticationisbeingusedinaninfrastructureBSS,IBSS,orMBSS,theMLMEshallissueanMLMEAUTHENTICATE.indicationprimitivetoinformtheSMEoftheauthenticationrequest,includingtheSAEAuthenticationElements,andtheSMEshallexecute theprocedureasdescribedin12.4(Authenticationusingapassword).

d)IfFILSauthenticationisbeingusedinanESS,theMLMEshallissueanMLME-AUTHENTI-CATE.indicationprimitivetoinformtheSMEoftheauthenticationrequest,andtheSMEshallexe-cutetheproceduredescribedin112.11(AuthenticationforFILS).

e)IftheSTAisinanIBSSandmanagementframeprotectionwasnotnegotiatedwhen the PTKSA(s)werecreated,theSMEshalldeleteanyPTKSA,GTKSA,IGTKSAandtemporalkeysheldforcom-municationwiththeoriginatingSTAbyusingtheMLME-DELETEKEYS.requestprimitive(see

12.6.18(RSNAsecurityassociationtermination)).

f)UponreceiptofanMLME-AUTHENTICATE.responseprimitive,iftheResultCodeisnotSUC-CESS,theMLMEshalltransmitanAuthenticationframewiththecorrespondingstatuscode,asdefinedin9.4.1.9(StatusCodefield),andthestatefortheoriginatingSTAshallbeleftunchanged.TheAuthenticationframeisconstructedusingtheappropriateprocedurein12.3.3.2(OpenSystemauthentication),12.3.3.3(SharedKeyauthentication),13.5(FTProtocol)or13.6(FTResourceRequestProtocol).Ifdot11FILSFDFrameBeaconMaximumIntevalisnotequalto0,andifaBeaconframeorFDframehasnotbeentransmittedbyanAPforaperiodthatisequaltodot11FILSFD-FrameBeaconMaximumInterval,thatAPshallqueuefortransmissionaFDframeoraBeaconframeunlessthenextTBTTiswithinadurationindicatedbythevalueofdot11FILSFDFrameBeaconMin-imumInterval.

g)Upon receiptofanMLME-AUTHENTICATE.responseprimitive,iftheResultCodeisSUCCESS,theMLMEshalltransmitanAuthenticationframethatisconstructedusingtheappropriateproce-durein12.3.3.2(OpenSystemauthentication),12.3.3.3(SharedKeyauthentication),13.5(FTProto-col)or13.6(FTResourceRequestProtocol),withastatuscodeofSuccessful,andthestatefortheoriginatingSTAshallbesettoState2ifitwasinState1.

IftheSTAisinanIBSS,iftheSMEdecidestoinitiateanRSNA,andiftheSMEdoesnotknowthesecuritypolicyofthepeer,itmayissueanindividuallyaddressedProbeRequestframetothepeerbyinvokinganMLME-SCAN.requestprimitivetodiscoverthepeer’ssecuritypolicy.

AnAPmayprovideneighborreportinformationtoaSTAthatrequestsauthenticationorassociationbyresponding withanAuthenticationor(Re)AssociationResponseframe thatincludestheReasonCode fieldsettoREJECTED_WITH_SUGGESTED_BSS_TRANSITIONandthatincludesoneormoreNeighborReportelements.

AnAPmayprovideestimatedassociationresponselatencytothenon-APSTAasAssociationDelayInfoparameter(9.4.2.175(AssociationDelayInfoelement)).TheAssociationDelayInfoparametershallbelargerthandot11HLPWaitTime.TheAssociationDelayInfoisprovidedintheAssociationDelayInfoele-ment(9.4.2.175(AssociationDelayInfoelement)).Whenanon-APSTAreceivestheAuthenticationframeincludingAssociationDelayInfoelement,thenon-APSTAsetsthedot11AssociationResponseTimeOutequaltoorlargerthanthecontentoftheelement.

Whenanon-APSTAreceivesanAuthenticationframethat includes an AssociationDelayInfoelement,thenon-APSTAsetsthedot11AssociationResponseTimeOutequaltoorlargerthanthevalue ofthe Association Delay Info field.

11.3.5Association,reassociation,anddisassociation

11.3.5.1General

Changeasfollows:

Submissionpage 1Michael Montemurro, BlackBerry

May 2016doc.: IEEE 802.11-16/0691r1

here] [Type here] [Type here][Type here][Type here][Type here]

May 2016doc.: IEEE 802.11-16/0691r1

here] [Type here] [Type here][Type here][Type here][Type here]

Subclause11.3.5(Association,reassociation,anddisassociation)describestheproceduresusedforIEEEStd802.11association,reassociationanddisassociation.

Thestatesusedinthisdescriptionaredefinedin11.3.1(Statevariables).

SuccessfulassociationenablesaSTAtoexchangeClass3frames.Successfulassociationsetsthenon-FILSSTA’sstatetoState3orState4. Successful association sets the state for andforFILSSTAstoState4.

SuccessfulreassociationenablesaSTAtoexchangeClass3frames.UnsuccessfulreassociationwhennotinState1leavestheSTA’sstateunchanged(withrespecttotheAPorPCPthatwassenttheReassociationRequest(whichmaybethecurrentSTA)).Successfulreassociationsetsthenon-FILSSTA’sstatetoState3orState4(withrespecttotheAPorPCPthatwassenttheReassociationRequestframe).SuccessfulreassociationwhennotinState1setstheSTA’sstatetoState2(withrespecttothecurrentAPorPCP,ifthisisnottheAPorPCP that wassentthe Reassociation Requestframe).Successful reassociationsetsaFILS STA’sstatetoState4andenablesittoexchangeClass3frames.ReassociationshallbeperformedonlyiftheoriginatingSTAisalreadyassociatedinthesameESS.

DisassociationnotificationwhennotinState1setstheanon-FILSSTA’sstatetoState2.Disassociationnotification whennotinState 1sets a FILS STA’sstatetoState 1. TheSTAshall becomeassociatedagainpriortosendingClass3frames.ASTAmaydisassociateapeerSTAatanytime,foranyreason.

Ifnon-DMGSTAAinaninfrastructureBSSreceivesaClass3framefromSTABthatisauthenticatedbutnotassociated withSTAA(i.e., thestateforSTABisState2),STAA shalldiscardtheframe.IftheframehasanindividualaddressintheAddress1field, theMLMEofSTAAshallsendaDisassociationframetoSTAB.

IfDMGSTAAinaninfrastructureBSSreceivesaClass3framefromSTABthatisnotassociatedwithSTAA(i.e.,thestateforSTABisState2),STAAshalldiscardtheframe.IftheframehasanindividualaddressintheAddress1field,theMLMEofSTAAshallsendaDisassociationframetoSTAB.

IfanMM-SMEcoordinatedSTAreceivesanAssociationResponseframewitharesultcodeequalto SUC-CESSandwiththeSingleAIDfieldwithinMMSelementequalto1,then

—ForeachofitsMACentitiesadvertisedwithintheMMSelementandforwhichdot11RSNAEnabledistrue,thestateis setto State3.Progressfrom State 3 toState 4 occurs independentlyin each suchMACentity.

—ForeachofitsMACentitiesadvertisedwithintheMMSelementandforwhichdot11RSNAEnabledisfalse,thestateissettoState4.

IftheMM-SMEcoordinatedSTAinState3isassignedanAIDforonlytheMACentityidentifiedbytheRAfieldoftheAssociationResponseframewithresultcodeequaltoSUCCESS,theMM-SMEmayrepeattheassociationprocedureforanyotherMACentitycoordinatedbytheMM-SME.

Associationis notapplicable in an IBSS. In an infrastructure BSS,associationis required. In aPBSS, asso-ciationisoptional.APsdonotinitiateassociation.

11.3.5.2Non-APandnon-PCPSTAassociationinitiationprocedures

Changeasfollows:

May 2016doc.: IEEE 802.11-16/0691r1

here] [Type here] [Type here][Type here][Type here][Type here]

g)IfanMLME-ASSOCIATE.confirmprimitiveisreceivedwithaResultCodeofSUCCESS,andRSNAisrequired,andFILSauthenticationwasnotused,thentheSMEshallperforma4-wayhandshake toestablishanRSNA.Asapartofasuccessful4-way handshake,theSMEshall enableprotectionbygeneratinganMLME-SETPROTECTION.request(Rx_Tx)primitive.IfanMLME-ASSOCIATE.confirmprimitiveisreceivedwithaResultCodeofSUCCESS,andFILSauthenticationwasused,thentheSMEshallenableprotectionbygeneratinganMLME-SETPROTECTION.request(Rx_Tx) primitive.

11.3.5.3APorPCPassociationreceiptprocedures

Changeasfollows:

n)IftheResultCodeintheMLME-ASSOCIATE.responseprimitiveisSUCCESSandRSNAestablishmentisrequired,andFILSauthenticationwasnotused,theSMEshallattempta4-wayhandshake.Uponasuccessfulcompletionofathe4-wayhandshake,theSMEshallenableprotectionbyissuinganMLME-SETPROTECTION.request(Rx_Tx)primitive.andthestatefortheSTAshallbesettoState4..IfFILSauthenticationwasused,theSMEshallenableprotectionbygeneratinganMLME-SETPROTECTION.request(Rx_Tx)primitive.Ineithercase,uponreceiptoftheMLME-SETPROTECTION.request(Rx_Tx),theMLMEshallsetthestatefortheSTAtoState4.

11.3.5.4Non-APandnon-PCPSTAreassociationinitiationprocedures

Changeasfollows:

g)IfanMLME-REASSOCIATE.confirmprimitiveisreceivedwithaResultCodeofSUCCESS,andRSNAisrequired,andFILSauthenticationwasnotused,andtheSTAisinState3,thentheSMEshallperforma4-wayhandshaketoestablishanRSNA.Asapartofasuccessful4-wayhandshake,theSMEshallenableprotectionbygeneratinganMLME-SETPROTECTION.request(Rx_Tx)primitive.IfanMLME-REASSOCIATE.confirmprimitiveisreceivedwithaResultCodeofSUC-CESS,andFILSauthenticationwasused,andtheSTAisinState3,thentheSMEshallenable pro-tectionbygeneratinganMLME-SETPROTECTION.request(Rx_Tx)primitive.

11.3.5.5APorPCPreassociationreceiptprocedures

Changeasfollows:

r)IftheResultCodeintheMLME-REASSOCIATE.responseprimitiveisSUCCESS,RSNAestab-lishmentisrequired,thereassociationisnotpartoftheBSStransition,andFTandFILSareisnotinuse,theSMEshallattempta4-wayhandshake.Uponasuccessfulcompletionofathe4-wayhand-shake,theSMEshallenableprotectionbyissuinganMLME-SETPROTECTION.request(Rx_Tx)primitiveandthestatefortheSTAshallbesettoState4.IfFILSauthenticationwasused,theSMEshallenableprotectionbygeneratinganMLME-SETPROTECTION.request(Rx_Tx)primitive.Ineithercase,uponreceiptoftheMLME-SETPROTECTION.request(Rx_Tx),theMLMEshallsetthestatefortheSTAtoState4.