Subject: [radext] Additional 802.11 attributes

From: Joe Salowey <[email-masked]>
Date: Tue, 8 May 2012 14:09:51 -0700

I've received a few off list suggestions for additional RADIUS attributes to add to RADIUS Attributes for IEEE 802 Networks.  These include

1.   WLAN-Reason-Code  - used to transmit the reason for authentication failure from AAA to AP in an Access-Reject.  The code is included in reason code of a Disassociation or De-authentication Frame
2.   WLAN-Pairwise-Cipher - communicates the negotiated pairwise cipher from the AP to the AAA.
3.  WLAN-Group-Cipher - communicates the negotiated group cipher from the AP to the AAA. 
4.  WLAN-AKM-Suite - contains information on the authentication and key management suite negotiated buy the AP. 
5.  WLAN-RF-Band - contains information on the RF band used by the AP.  

Below is suggested text for these attributes from Dave Stephenson:

Thanks,

Joe
 
2.9.  WLAN-Reason-Code
 
Description
 
The WLAN-Reason-Code Attribute contains information on the reason for authorization failure subsequent to a mobile device’s authentication request towards a Wi-Fi access network.
 
A WLAN-Reason-Code Attribute MAY be included within an Access-Reject or Disconnect-Request packet.  Upon receipt of an Access-Reject packet, the WLAN-Reason-Code value is copied by the Authenticator / AP into the Reason code field of a Disassociation or Deauthentication frame (see clause 8.3.3.4 and 8.3.3.12 respectively in IEEE 802.11-2012), which is subsequently transmitted to the Supplicant / mobile device.  A summary of the WLAN-Reason-Code Attribute format is shown below.  The fields are transmitted from left to right.
 
  0                   1                   2                   3 
  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 |     Type      |  Length       |             Value             |
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 
Code
 tbd8
 
Length
 =2
 
Value
The Value field is two octets containing a 16-bit unsigned integer drawn from Table 8-36 in clause 8.4.1.7 of IEEE 802.11-2012.  The value’s least significant octet is contained in bits 23-16 and most significant octet in bits 31-24 (network octet order).  Note: not all reason codes defined in the Table 8-36 are expected to be used by an AS.
 
[Note]: the importance of including this attribute is for authentication and authorization of mobile devices in public Wi-Fi access; it is important to inform the mobile when authorization is denied, even though authentication may have been successful.  This can occur for AS policy reasons or for reasons related to the user’s subscription.  The following Reason codes for public Wi-Fi access networks were added by the IEEE 802.11u-2011 amendment:
 
Reason
 Code
 Value   Description
27      Disassociated because session terminated by SP request
28      Disassociated because of lack of SP roaming agreement
29      Requested service rejected because of SP cipher suite or AKM requirement
30      Requested service not authorized in this location

 
2.10.  WLAN-Pairwise-Cipher
 
Description
 
The WLAN-Pairwise-Cipher Attribute contains information on the pairwise cipher suite used to establish the robust security network association (RSNA) between the AP and mobile device.
 
A WLAN-Pairwise-Cipher Attribute SHOULD be included within an Access-Request packet.  A summary of the WLAN-Pairwise-Cipher Attribute format is shown below.  The fields are transmitted from left to right.
 
  0                   1                   2                   3 
  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 |     Type      |  Length       |             Value              
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
            Value                |
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 
Code
 tbd9
 
Length
 =4
 
Value
The Value field is four octets formatted in accordance with Figure 8-187 with values drawn from Table 8-99 of IEEE 802.11-2012.

 
2.11.  WLAN-Group-Cipher
 
Description
 
The WLAN-Group-Cipher Attribute contains information on the group cipher suite used to establish the robust security network association (RSNA) between the AP and mobile device.
 
A WLAN-Group-Cipher Attribute SHOULD be included within an Access-Request packet.  A summary of the WLAN-Group-Cipher Attribute format is shown below.  The fields are transmitted from left to right.
 
  0                   1                   2                   3 
  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 |     Type      |  Length       |             Value              
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
            Value                |
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 
Code
 tbd10
 
Length
 =4
 
Value
The Value field is four octets formatted in accordance with Figure 8-187 with values drawn from Table 8-99 of IEEE 802.11-2012.

 
2.12.  WLAN-AKM-Suite
 
Description
 
The WLAN-AKM-Suite Attribute contains information on the authentication and key management suite used to establish the robust security network association (RSNA) between the AP and mobile device.
 
A WLAN-AKM-Suite Attribute SHOULD be included within an Access-Request packet.  A summary of the WLAN-AKM-Suite Attribute format is shown below.  The fields are transmitted from left to right.
 
  0                   1                   2                   3 
  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 |     Type      |  Length       |             Value             
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
            Value                |
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 
Code
 tbd11
 
Length
 =4
 
Value
The Value field is four octets formatted in accordance with Figure 8-187 with values drawn from Table 8-101 of IEEE 802.11-2012.

 
2.12.  WLAN-RF-Band
 
Description
 
The WLAN-RF-Band Attribute contains information on the RF band used by the AP for transmission and reception of information to and from the mobile device.  This information can be used, for example, to provide a relative quality of experience indication for the mobile device’s user (i.e., some RF bands have more interference than others).
 
A WLAN-RF-Band Attribute SHOULD be included within an Access-Request packet.  A summary of the WLAN-RF-Band Attribute format is shown below.  The fields are transmitted from left to right.
 
  0                   1                   2                   3 
  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 |     Type      |  Length       |     Value     |   Reserved    |
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 
Code
 tbd12
 
Length
 =2
 
Value
The Value field is 1 octet having a value chosen from the table below:
Band ID value     Meaning
      0           TV white spaces
      1           Sub-1 GHz (excluding TV white spaces)
      2           2.4 GHz
      3           3.6 GHz
      4           4.9 and 5 GHz
      5           60 GHz
      6-255       Reserved

[Note]: this table was copied from IEEE 802.11ad-d5.  I’m not sure of the relative publication dates of this internet draft and IEEE 802.11ad-d5.  Since it’s generally not recommended to reference a draft specification in an RFC, I’ve copied the table.  If we discover that the IEEE document will be published in time, then we could deleted the table and instead reference Table 8-53a in IEEE 802.11ad.

_______________________________________________
radext mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/radext