iPCF Frame format

This is the second post about the iPCF protocol from Siemens. In the first one I described the working principle and operation modes. I also tried to show the difference between the iPCF and the PCF. In this topic I will go deeper into the iPCF packet format.

 Below is the example of the iPCF communication. I used additional coloring rules to mark the iPCF frames in green.

According to pcap file, the Siemens iPCF use only six types of frames for communication:

The IPCF pool (data) frame, S1G Beacon, the iPCF Association Request, and the iPCF Association Response are belong to the Frame Type 3 (Extension frame)

iPCF frames

Common fields of i

PCF Frames

All iPCF frames have similar frame format:

The iPCF frame consist of:

• Frame control field. All subfields of the Frame Control field are same as in the standard Wi-Fi frame.
• Duration field. (Same meaning as in standard Wi-Fi)
• Receiver MAC Address (only one field)
• Frame body (except the ACK Frame)
• FCS

Actually, the format of the MAC header is very similar to the ACK Frame. The iPCF header has only one MAC address field.

S1G Beacon

The frame rate is about 30 frames per second. The number of tags in the payload is variable.

Unlike the S1G Beacon frame, the standard Beacon in the iPCF mode is broadcasted at one frame per second and has fixed tag fields.

According to the standard PCF protocol, the Beacon must announce the start of the Contention Free communication. In the iPCF neither the Beacon no S1G Beacon have information about the Contention Free time slot. In case an iPCF and a DCF wireless devices are sharing the same medium it can cause collisions.

Pool frame / Data Frame

As mentioned before, the Data Frame has the same format as the ACK frame, and it has the receiver address only.

The Frame has the Frame Type 3, and the Subtype 2.

Association Request

The Association Request has very simple MAC header with only one MAC field. It has also frame body, but the Wireshark cannot decode this information.

Below is the example of the Association iPCF Request Frame.

The example of the Frame Body of the Association Request Frame:

Association Response

Like all iPCF frames, the Association Response frame has very simple MAC header. As with an association request, the frame body of an association response cannot be decoded.

Below is the example of the Association Response Frame

Client Connection

You know that there are four mandatory steps if the wireless client what to connect to a BSSID.

1. Active Probing (two-frame handshake)
2. Authentication (two-frame handshake)
3. 802.11 Association (two-frame handshake)
4. Robust Security Network Association (RSNA) (at least four-frame handshake)

The iPCF use only the Association for client connection. The client sends an Association request, and the AP replies with the Association response. The transmitter confirms the successful receiving of an Association Frame with an ACK frame.

Client Roaming

The roaming procedure of the proprietary Siemens wireless LAN protocol is completely different. 

In the standard Wi-Fi the wireless client uses the Reassociation Frame to inform the target access point about the previous connection. This information can be used to speed up authentication and receive buffered data packets from the first access point. 

Siemens access points are standalone and the is not any cooperation protocol for exchanging information about clients.

The main thing, if we are talking about the roaming, is that it is always the client's decision. The trigger of the roaming depends on the Wi-Fi mode:

• In the iPCF mode the client stay connected to the first access point even the connection is bad. The client goes to the out-of-band passive scanning only if it loses the connection.
• In the iPCF-MC mode the client periodically goes to the MC channel for the passive scanning. If the signal strength of the neighbour access point is higher than the signal strength of the current access point, the client decides to roam. All access points in the iPCF-MC design have two radios in 5 GHz band. 
• One for management communication (MC). All access points use the same MC channel
• Another one is for data communication (DC) is used for data plane.

So, in the iPCF mode the trigger for the roaming is the lost of the signal from the access point; in the iPCF-MC it is the signal level of Beacons on the MC channel.

Data / Pooling

Each client uses its timeslot for uplink and downlink communication with the access point.

The following is an example of communication when two iPCF clients are connected to the same access point.

The I/O graph show us that each client uses about 1300 frames per second to communicate with the access point. 

If we look at the Airtime graph below, we can see that each client requires about 8% of Airtime. 

Conclusions

Traditionally let me summarise all information in a few key points.

1. Not all in formation of iPCF frames can be decoded by standard Wi-Fi radio. This can course problems in mix operation of the iPCF and the DCF Wi-Fis. I recommend using different frequency domains for different systems.
2. Use the iPCF mode for RCoax antennas only. Otherwise, it can course roaming issues.
3. Take in account that the coverage of the MC channel should be the same or even a bit less than the coverage of the DC channel.
4. Avoid DFS channels to protect your Wi-Fi from the radar interference.

Siemens iPCF vs 802.11 PCF

This blog post will explain basic working principle and operation modes of the Siemens iPCF and compared to 802.11 PCF medium access technologies. The next post will take a detailed look at the iPCF frame format.

Before we go deeper into the Siemens iPCF Wi-Fi, let’s review what we know about the PCF technology.

PCF

The PCF is short for Point Coordination Function. It is the medium access control (MAC) technology for a deterministic Wi-Fi communication. Two well-known Wi-Fi coordination techniques are DCF (Distributed coordination function) and EDCA (Enhanced Multimedia Distributed Control Access). Both this medium access technologies are based on CSMA/CA (Carrier-sense multiple access with collision avoidance) access method to coordinate the access to the RF-medium. In other words, all Wi-Fi devices are making the “transmit or not transmit” decision based on CSMA/CA rules. It is very important to understand that the main idea of the distributed coordination – there is no decision-making device. All participants are equal. The downside of this model is that it impossible to predict who will be the next.

Unlike DCF and EDCA, in a PCF access point coordinates the communication within the Basic Service Set (BSS). Like in the TDM (Time-division multiplexing), every client device has a time slot in the communication cycle. It means that every Wi-Fi client, connected to the AP in the PCF mode get a predicted chance to communicate with the AP.

The PCF has higher priority over the common DCF/EDCA Wi-Fi because the PIFS (Point coordination function interframe spacing) duration is shorter as than DIFS or AIFS.

Fig.1 interframe spacing

The Access Point announces in the Beacon two intervals: one for Contention Free (or PCF) and another one for Contention Based (or DCF) communication. The CF intervals begins right after the beacon and ends after the CF-End frame. During the CF time, no station is allowed to transmit without getting CF-Pool frame. The AP sends the CF-Poll frame to the PCF capable station to permit it to transmit a frame.

Fig2. PCF cycle

The PCF is less efficient compared to DCF, but the PCF has other advantages. This technology is more suitable for low data rate, low latency, low Jitter communication. 

Comparison of PCF and DCF Wi-Fi:

Despite its advantages, PCF was newer implemented in the real world. 

• Wait! What about the iPCF from Siemens? 
• No. Honestly, the iPCF has nothing to do with PCF except time slots. Well, let’s go deeper into the iPCF from Siemens.

iPCF

iPCF is the proprietary Wi-Fi protocol from Siemens for real time deterministic wireless communication. The typical use case of the iPCF is not WLAN, but WSN (Wireless Sensor Network). The iPCF is very good compatible with the industrial Ethernet-based protocol PROFINET IO for communication between PLC and I/O stations. The main difference between the Siemens iPCF and classical WSN based on IEEE 802.15.4 Standard is the bandwidth. The 802.15.4 based communication uses 2 or 5 MHz channels and has the throughput up to 250 kbps (PHY). The iPCF has 19 Mbps (PHY). Besides this, the iPCF use channels in the 5 GHz frequency band. The 802.15.4 is designed for Sub-1GHz and 2.4 GHz frequencies.  Thus, in some cases, iPCF can be more useful and more stable than the WSN based on 802.15.4, especially if clients have no power limitation.

iPCF medium access

In opposite to the PCF, the iPCF does not support the Contention Based communication.

When an iPCF client joins an iPCF access point, it is given a time slot in the iPCF cycle. It is up to AP in which order the client will be served. 

There are two cycle types: the fixed cycle time and the flexible (not fixed) cycle time.

iPCF with fixed cycle time

The duration of the fixed cycle time can be 8, 16, 32, 64, or 128ms. Every client get about 2ms time slot. It means that no more than 4 clients can be connected to the iPCF with the fixed cycle 8ms, no more than 8 clients per 16ms cycle, and so on. If less clients are connected as the cycle time allows, than some clients get additional time slot per cycle. The figure illustrates how the 8ms cycle looks like if three clients are connected. Note that there is a slot in the middle of the cycle, which is reserved for Broadcast and Multicast traffic.

Fig3. iPCF fixed cycle

The iPCF with fixed cycle has more practical application because the compatibility with the PROFINET protocol. 

The iPCF cycle cannot be more than the PROFINET cycle.

iPCF with flexible cycle time

The iPCF with the flexible cycle time works different. The duration of the cycle is theoretically unlimited (I did not check it) and is equal the sum of time slots for all clients connected to the AP. In our example it is equal to 6ms. If a new Client joins the Access Point, the duration of the cycle is 2ms more.

Fig4. iPCF flexible cycle

There is the time slot 1ms for broadcast and multicast after every third cycle.

NOTE: In my lab I have tested only one client with one Access Point. It would be interesting to test the iPCF in case at last two Access Points use the same channel. 

Conclusions & Suggestions

PCF vs iPCF

• PCF and DCF can co-exist. iPCF cannot operate simultaneously with DCF.
• the PCF cycle is divided into two intervals: contention based and contention free. The iPCF support only contention free communication.
• The iPCF is proprietary Siemens protocol.

Suggestions

• Avoid busy channels. Remember, the iPCF is not compatible with standard Wi-Fi!
• I would avoid U-NII-1 channels from 36 to 48 for following reason:
•  The channel 36 is the default channel for most Wi-Fi vendors. The 80 MHz channel width is very oft the default value. The likelihood that someone will put their mobile phone into hotspot mode and the channel will be 36@80 is very high.
• In case a standard Wi-Fi access point measures a radar signal it must change the channel. Some vendors use the channel 36 as the default
• Never, never, never use 2,4 GHz channels for iPCF!
• Do not use DFS channels (U-NII-2C band). 
• Siemens does not have a RRM feature. Use static channel design.
• I would recommend using of U-NII-3 channels. In most cases this band is free. Remember about EIRP limitations for this band. It is 14dBm only

References

1. Point coordination function - Wikipedia
2. http://wireless-center.net/WLANs-WPANs/1436.html
3. WLAN DCF vs PCF-Difference between DCF and PCF medium access types
   
4. Siemens. Industrial Network Education. Wireless LAN in Industrial Networks. Version V21.1
5. Microsoft Word - CG_1710_Industrial_Wireless.docx (controlglobal.com)

Wi-Fi Perfomance issues | Optimisation and Troubleshooting

WLAN Roaming | Optimisation, configuration, and troubleshooting

Wi-Fi Security Standards and Certifications

Wenn I learn something new, the most difficult and important point for me is to understand the whole picture and create a short description or a pivot table for the topic. While preparing for the CWSP exam I took a lot of notes and now is a good time for the final part.
I took as a basis the table 1.2 Security Standards and Certifications at the page 20 of the book CWSP Certified Wireless Security Professional Study Guide: Exam CWSP-205, 2nd Edition (ISBN-10: 1119211085). 
The main reason why I decided to create a new table is that I didn't find in the Internet similar table with include information about the WPA3. So simple is that.

Security Standards

The history of Wi-Fi security standards can be divided into two parts: pre-RSNA (before the the 802.11i was established) and RSNA (IEEE 802.11i) 
The RSNA stands for Robust Security Network Association. Don’t confuse the 802.11 Association and the RSN Association. The 802.11 Association is the compatibility check between two STAs. The 802.11 Association is like the green LED of the switch port for a wired network. The successful 802.11 Association means that the transport protocols are up and working and both STAs can transmit data frames to each other.
The RSN Association is as an extension over the legacy 802.11 security. The RSNA provides data encryption with secure integrity protocols TKIP, CCMP and GCMP, a secure STA’s authentication and association, and creation and management of dynamic encryption keys. If the RSNA is done, both STAs have been authenticated and can securely transmit data to each other.

Key points of the RSNA are:

• Key hierarchy: MSK (Master Session Key); Master Keys for unicast (PMK) and multicast (GMK) derivative; and encryption keys for unicast (PTK) and multicast (GTK)
• The 4-way handshake and the group key handshake to establish PTK and GTK
• dynamic keys

Wi-Fi Security Certification

Whereas IEEE standards describe technologies, Wi-Fi Protected Access (WPA) certifications specify mandatory and optional requirements to be met by any certified device.

At this moment the Wi-Fi Alliance developed three generation of the certification programs – WPA, WPA2, and WPA3. Each program consists of at least one Personal and at least one Enterprise certification. 

• WPA is based on the draft of the IEEE 802.11i. It was a temporary solution to cover security risks of the WEB. The reason for the designing of the temporary solution was that in most cases it could be implemented through a firmware update. The WPA implements the Temporal Key Integrity Protocol (TKIP).
• WPA2 is an implementation of the full version of the IEEE 802.11i. The WPA2 includes mandatory support for CCMP, an AES-based encryption mode
• WPA3 replaces direct derivation from PSK through SAE key generation and provides more secure encryption protocol GCMP and cypher modes for Enterprise deployments. The WPA3-Enterprise 192 uses the Cipher Suite B (AES-256 in GCM mode with SHA-384 as HMAC). Also, all WPA3 certifies devises have to support the Protected Management Frames (PMF) standard, which was described in the IEEE 802.11w. 

802.11 authentication

As you know there are two mandatory steps in case a client wants to join the wireless network: the 802.11 authentication and the 802.11 association. 

The 802.11 authentication is like physically plug in to a switch port for a wired network. There are fore types of the 802.11 authentication:

• Open System – means a NULL authentication. There are three use cases for this type of authentication:
• You have an open network and use neither identity verification no wireless traffic encryption or you authenticate users over a WEB portal only.
• You have an upper layer security, for example VPN.
• You have a Robust Security Network (RSN) for identity verification, data privacy and key management.
• Shared WEP key authentication (SK) – four-way 802.11 authentication frame exchange. Due to the WEP authentication sends the challenge text in clear and in hashed text within the handshake, the passphrase can be easily cracked.
• Fast BSS Transition authentication. It is used for fast roaming. Since it is not used for initial authentication, it is not listed in the table.
• The Simultaneous Authentication of Equals (SAE) Authentication. The SAE was originally designed for use between peers (for instance for MESH networks) and later was adopted for the WPA3-Personal security standard. The biggest advantage of the SAE that password isn’t used as a credential in the authentication. As a result, the SAE has high protection against dictionary and/or brute‐force attacks. Unlike WPA/WPA2 the PMK is secretly calculated by both parties without sharing key data used in the process.
  

RSN Authentication

The Robust Security Network support three authentications:

• Pre-shared key (PSK) authentication. Do not confuse the WPA2-PSK authentication with the SK authentication for the WEP. In both cases the authentication is used to check that both the client and access point possess the correct pre-shared password. Both authentications use the 4-frame exchange. But:
• The WPA-PSK use open 802.11 Authentication and the 4-Way Handshake for authentication and key generation.
• The WPA-PSK generate unique dynamic encryption keys for the session between WLAN devices, while the WEP use static keys
• Encryption keys of WPA-PSK are secretly calculated by both parties without sharing key data, unlike in WEP
• The WPA-PSK passkey is not used to encrypt the frame, unlike in WEP.
• Extended Authentication Protocol (EAP) described in the IEEE 802.1X standard. The EAP authentication requires a RADIUS server to check client identity.
• Simultaneous Authentication of Equals (SAE) was first described in the IEEE 802.11s standard and then became part of the WPA3-Personal certification.
  

Encryption Protocols and Cipher Suite

I have tried to put all information I have about this topic into one table.

The WEP and TKIP should not be used in wireless RSN design.

The CCMP and GCMP are secure protocols used to provide authentication and data confidentiality. More information about these protocols you will find in the my blog post: CCMP vs GCMP