Although all three beamforming technologies provide SNR gain, they are quite different. In addition, all types of beamforming can exacerbate the following problems:

Dynamic beamforming focuses RF energy in a particular direction and with a particular shape in order to increase the Signal to Noise Ratio (SNR). In a sense, it is like static beamforming in that it focuses RF energy, but it is different because the antenna array’s radiation pattern can change from frame to frame (see Figure).

Figure 1: Dynamic Beamforming (Source: Ruckus Wireless)

Dynamic beamforming is also different from TxBF in several ways because it can:

• Dynamically change the propagation pattern on a frame-by-frame basis in order to optimize the pattern for every STA over time
• Provide SNR gain for both legacy and 802.11n STAs without requiring any changes in the STA
• Be used in conjunction with other 802.11n performance-enhancing techniques such as spatial multiplexing
• Improve both downlink and uplink performance
• Provide interference rejection

Dynamic beamforming has the potential to offer the highest SNR gain of the three beamforming technologies. Note that broadcast traffic, such as Beacon frames, will usually be transmitted using an omnidirectional pattern in order to communicate with nearby STAs in all directions. The only vendor currently offering an enterprise class dynamic beamforming technology is Ruckus Wireless.

Next time we will compare all three beamforming methods.

Transmit beamforming (TxBF) is a method of transmitting two or more [...]]]> In this post, we continue my discussion of beamforming by focusing on transmit beamforming. As previously mentioned, beamforming is a method of concentrating radio frequency (RF) energy in order to improve the signal to noise ratio (SNR) at the receiver, thereby improving network performance and predictability.

Transmit beamforming (TxBF) is a method of transmitting two or more phase-shifted signals so that they will be in-phase at particular points in space where the transmitter believes the receiver to be, thereby increasing SNR. Two forms of TxBF are optional components of the IEEE 802.11n draft amendment to the 802.11 standard.  Explicit and implicit TxBF require feedback from 802.11n stations (STA) and thus will not operate with legacy stations at all. Enterprise WLAN vendors do not support implicit and explicit TxBF at this time because the 802.11n chipsets do not currently support either form of TxBF.

Cisco has introduced a proprietary form of TxBF called ClientLink. ClientLink can work with 802.11 g/a STAs because it requires no modifications in the STA. ClientLink is designed to improve the SNR for legacy STAs in the downlink (AP-to-STA) direction only. A boost in SNR can improve the STA’s “rate over range” performance because the modulation rate for 802.11 STAs will increase as the SNR increases. Improving rate over range performance is particularly important for legacy STAs because they can consume considerably more airtime than 802.11n STAs, and therefore can reduce the achievable throughput of 802.11n STAs. Alternatively, Air Time Fairness (ATF) mechanisms can also regulate legacy STA airtime consumption.

TxBF changes the phase of the original signals in relation to each other and transmits the phase-shifted signals using two or more antennas to the STA (see figure). As the signals propagate through the air, they additively combine at various points in space.  The figure shows an example of two out-of-phase signals propagating from an AP to a legacy STA. The green dots represent the points in space where the two out-of-phase signals combine to form a signal with an SNR that is up to 3 dB higher than (i.e., twice as high as) the original signal. In a multipath-rich environment, even higher levels of gain are theoretically possible. Cisco is the first enterprise WLAN vendor to implement TxBF, and it claims it can achieve 4 to 6.5 dB of SNR gain in a multipath-rich environment. A 6.5 dB gain is an increase of approximately 4.5 times the original signal.

Figure 1: Transmit beamforming (source: Cisco Systems)

The challenge with TxBF is figuring out how to modify the transmit signal phases for the greatest possible gain. In the ClientLink implementation, the AP uses frames received from the STA in the uplink direction to determine how to modify the phase in the downlink direction. TxBF assumes that the uplink channel characteristics and the downlink channel characteristics are “reciprocal” (i.e., the same) in both directions. In reality, the uplink and downlink channels may not be reciprocal, especially when the STA is moving. So, in practice, TxBF performance gains will vary from moment to moment and STA to STA.

Unlike static and dynamic beamforming, TxBF does not change the antenna radiation pattern. Cisco’s TxBF implementation uses omnidirectional antennas that cause the signals to radiate in a doughnut-shaped pattern. Therefore, referring to TxBF as “beamforming” is somewhat misleading because it does not actually form a directed beam. Cisco’s TxBF achieves an SNR gain at “points in space” (i.e., the green dots in the figure). So the receiving STA must be located at the right point in space in order to achieve the maximum SNR gain. In contrast, static and dynamic beamforming achieve SNR gain throughout the radiated coverage area because both techniques focus the radiated energy.

TxBF and spatial multiplexing are mutually exclusive. This is because spatial multiplexing transmits different signals on each antenna, whereas TxBF transmits the same (phase-shifted) signals on each antenna. So, it is impossible to use TxBF and spatial multiplexing at the same time. That is why enterprises should use TxBF to provide SNR gain for legacy STAs only. In contrast, static and dynamic beamforming can operate in conjunction with spatial multiplexing.

Next time, we will look at dynamic beamforming.

Static beamforming provides a fixed radiation pattern by using a directional antenna. Virtually every [...]]]> This post continues my discussion on beamforming which is a method of concentrating radio frequency (RF) energy in order to improve the signal to noise ratio (SNR) at the receiver, thereby improving network performance and predictability.  In this post, we discuss static beamforming.

Static beamforming provides a fixed radiation pattern by using a directional antenna. Virtually every vendor provides APs with removable antennas so it is easy to swap an OMNI antenna for a directional antenna. Some vendors, such as Xirrus, use an array of static beamforming antennas to create densely packed multiple channels in much the same way that a cellular tower uses directional antennas to create cellular sectors. By assigning a different channel to each beam, many non-overlapping channels can be densely packed together within a single array (see Figure).

Figure 1: Static beamforming (source: Xirrus Networks)

Static beamforming can provide an signal-to-noise (SNR) benefit to both legacy wirless protocols like 802.11a/b/g and newer 802.11n stations.  Since the antenna propagation pattern is static, the AP cannot adjust the radiation pattern on a frame-by-frame basis in order to track a station as it moves through the enterprise. Therefore, unlike transmit beamforming and dynamic beamforming, it does not take advantage of knowledge of the WLAN channel between the AP and the station in order to further optimize signal propagation. An array of directional antennas, such as the Xirrus Array, can improve SNR in 360 degrees.

Next time we’ll look at Transmit beamforming.

Does anyone really care that the IEEE finally ratified the 802.11n wireless standard…anyone…anyone…Bueller?

The sorry fact is that the final ratification will have virtually no impact on the wireless industry. This is because what customers care about most is product interoperability. The Wi-Fi Alliance stepped into the standards void in 2007 and began certifying product [...]]]>

Does anyone really care that the IEEE finally ratified the 802.11n wireless standard…anyone…anyone…Bueller?

The sorry fact is that the final ratification will have virtually no impact on the wireless industry. This is because what customers care about most is product interoperability. The Wi-Fi Alliance stepped into the standards void in 2007 and began certifying product interoperability based upon IEEE 802.11n draft 2.0. The fact of the matter is that the Wi-Fi Alliance did such a great job with their 802.11n certification program as to make the final IEEE standard a non-event. The evidence for my statement is that the wireless industry currently ships over 1 million Wi-Fi products PER DAY, and well over 50% of those products are based upon 802.11n!

You can relax in knowing that no driver updates (or hardware changes!) are required for compatibility with the 802.11n standard. This is because the Wi-Fi alliance announced that they would not need to make any changes to the baseline requirements of its 802.11n certification program. So, any Wi-Fi CERTIFIED products based upon 802.11n draft 2.0 are automatically certified as interoperable with products based upon the final 802.11n standard.

… I’m still waiting…Bueller?

Introduction

Back in November of 2008 I wrote about the Wi-Fi Protected Access (WPA) attack by the German graduate students Erik Tews and Martin Beck. They discovered a limited method to crack WPA, or more specifically, to crack the TKIP component of WPA.  Their paper describes the attack and their tkiptun-ng tool carries out the [...]]]>

Introduction

Back in November of 2008 I wrote about the Wi-Fi Protected Access (WPA) attack by the German graduate students Erik Tews and Martin Beck. They discovered a limited method to crack WPA, or more specifically, to crack the TKIP component of WPA.  Their paper describes the attack and their tkiptun-ng tool carries out the attack.

Now, Japanese researchers Toshihiro Ohigashi and Masakatu Morii have taken the Tews-Beck attack one step further. Their paper describe how they can reduce the attack time from 12-15 minutes down to 1 minute and how they can eliminate the requirement that the station under attack support the IEEE 802.11e QoS mechanism.

Some articles have sensationalized this attack and have even implied that AES-CCMP could be next.

Bottom line:

1. The vulnerability exposed by the Ohigashi-Morii attack is no different from the vulnerability exposed by the Tews-Beck. The Ohigashi-Morii attack essentially just speeds up the Tews-Beck attack process. More specifically, neither the Tews-Beck nor the Ohigashi-Morii attacks discover the encryption key. Instead, they systematically decrypt an individual packet of short length (e.g., ARP packet)
2. The attacker cannot decrypt all the packets on a WLAN.
3. The attack only exploits TKIP, which is the older “band-aid” feature created to fix WEP (WEP used RC-4 encryption). The attack does not exploit AES-CCMP.
4. If you use certificates on both your stations and your access points (e.g., you use EAP-TLS) then your network is not vulnerable to the Ohigashi-Morii man-in-the-middle attack but your network may be vulnerable to the Tews-Beck attack.

Recommendations:

1. Use AES-CCMP encryption to protect against this attack. All certified WPA2 systems must support AES-CCMP.
2. Check to see if your WPA-certified systems support AES-CCMP. If so, you should configure your WPA equipment to use AES-CCMP.
3. Begin a program to phase out your older Access Points and stations that do not support AES-CCMP.

Terminology

There is some confusion over the difference between the Wi-Fi Alliance certification and the actual features supported by the vendor equipment.

WPA certification: The older Wi-Fi Alliance WPA certification designation means that the equipment was certified to support: 802.1X, EAP, TKIP, and RC4.

WPA2 certification: The newer (and now mandatory) WPA2 certification designation means that the equipment was certified to support: 802.1X, EAP, and AES-CCMP.

Vendor equipment: Some vendors chose to support both TKIP-RC4 and AES-CCMP irrespective of how the equipment was certified. It is therefore possible to configure some WPA-certified equipment to support AES-CCMP. It is also possible to configure WPA2-certified equipment to support TKIP-RC4.

More detailed information:

1. Erik Tews and Martin Beck paper
2. Toshihiro Ohigashi and Masakatu Morii paper
3. Glenn Fleishman article

Summary:Wireless local area network (WLAN) vendors have developed [...]]]> My new report entitled “Demystifying Radio Management“ is now published. Thank you to everyone who provided feedback on my drafts.  Fortunately, Burton Group has decided to make this report available for free.  Below is a summary and also a link to the free report.  As always, comments are welcome.

Summary:Wireless local area network (WLAN) vendors have developed a variety of solutions to deal with the challenge of controlling WLAN radio signals. They include: WLAN architecture, beamforming, and air Time fairness (ATF). Single channel architecture (e.g., Meru Networks) has several important technical advantages over multiple channel architecture (e.g., Cisco Systems or Aruba Networks), but multiple channel architecture (MCA) is deployed in over 95% of the enterprise market. Transmit beamforming will become the most dominant form of beamforming because the IEEE 802.11 committee will standardize this approach. ATF will be widely deployed because it helps enterprises deliver predictable wireless performance.

Click to read Demystifying Radio Management