WCN Netspec

A WINDOWS RALLY SPECIFICATION
Windows Connect NowNET
Abstract Microsoft Windows Connect Now technology enables simple and secure configuration of wireless networks and provisioning of wireless hardware. Windows Connect Now-NET (WCN-NET) is the Microsoft implementation of the Simple Configuration Protocol, a new standard in the Wi-Fi Alliance. WCN-NET supports configuration of devices on out-of-band Ethernet and in-band wireless networks. Windows Connect Now-NET in Microsoft Windows Vista communicates with access points and wireless stations by using Universal Plug and Play (UPnP), authenticates with them by using a personal identification number (PIN), and provides wireless settings that are based on user selection. This specification defines the WCN-NET implementation details for devices that connect with systems running the Windows Vista operating system. WCN-NET is a component of the Microsoft Windows Rally set of technologies.
Version 1.1 December 8, 2006
LICENSE NOTICE. Access to and viewing and implementation of the technology described in this document is granted under the Microsoft Windows Rally Program License Agreement (License Agreement). If you want a license from Microsoft to access, view or implement one or more Licensed Technologies, you must complete the designated information in the License Agreement and return a signed copy to Microsoft. The License Agreement is provided at the end of this document. If the License Agreement is not available with this document, you can download a copy from the Windows Rally Web site at http://www.microsoft.com/rally.
Windows Connect NowNET - 2
Disclaimer
This is a preliminary document and may be changed substantially prior to final commercial release of the software described herein. The information contained in this document represents the current view of Microsoft Corporation on the issues discussed as of the date of publication. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information presented after the date of publication. This White Paper is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS DOCUMENT. Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, no part of this document may be reproduced, stored in or introduced into a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), or for any purpose, without the express written permission of Microsoft Corporation. Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property. Unless otherwise noted, the example companies, organizations, products, domain names, e-mail addresses, logos, people, places and events depicted herein are fictitious, and no association with any real company, organization, product, domain name, email address, logo, person, place or event is intended or should be inferred. 2006 Microsoft Corporation. All rights reserved. Microsoft, Rally, Windows, and Windows Vista are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. The names of actual companies and products mentioned herein may be the trademarks of their respective owners. The current version of this specification is maintained on the Web at: http://www.microsoft.com/rally
Revision History
Date May 8, 2006 December 8, 2006 Revision Version 1.0 Version 1.1
Version 1.1 December 8, 2006 - 2006 Microsoft Corporation. All rights reserved. Access to and viewing and implementation of the technology described in this document is covered under the Microsoft Windows Rally Program License Agreement, provided at the end of this document and also available from the Windows Rally Web site at http://www.microsoft.com/rally.
Contents
Introduction to WCN-NET........................................................................................................5 WCN-NET User Experience....................................................................................................5 Entry Points and Flows........................................................................................................5 Set up a Wireless Access Point or Use the Router Wizard.............................................5 Use the Add a Wireless Device Wizard...........................................................................9 Double-Click the Device in Network Explorer................................................................11 User Experience Pamphlet in the Box for Access Points...................................................12 WCN-NET Architecture..........................................................................................................13 Registration in Windows Vista...............................................................................................13 Registration Protocol..........................................................................................................14 Summary and Classification of Keys.............................................................................16 Key Derivation...............................................................................................................16 Derivation of AuthKey, KeyWrapKey, and EMSK.........................................................17 Message Format................................................................................................................ 19 Registration Message Attributes........................................................................................19 Transportation of Registration Protocol Messages............................................................23 UPnP Transport.............................................................................................................23 EAP Transport of Registration Protocol........................................................................24 EAP Message Framing.................................................................................................25 EAP Message Fragmentation and Reassembly............................................................26 EAP Identity................................................................................................................... 26 EAP Messages..............................................................................................................26 Device Requirements.........................................................................................................27 Resources.............................................................................................................................. 27 Appendix A............................................................................................................................. 28 Master TableData Component Set.................................................................................28 Master Table Definitions....................................................................................................29 Appendix B. WFADevice:1 Device Template Version 1.01..................................................41 B.1 Overview and Scope.......................................................................................................41 B.1.1 Focus and Goals for DCP Version 1.0......................................................................42 B.1.2 Non-Goals for DCP Version 1.0................................................................................42 B.1.3 WLAN Security Requirements and Recommendations............................................42 B.1.3.1 Station Parameter Configuration.......................................................................43 B.2 Device Definitions............................................................................................................44 B.2.1 Device Type..............................................................................................................44 B.2.2 Device Model............................................................................................................44 B.2.2.1 Description of Device Requirements.................................................................44 B.2.3 Theory of Operation..................................................................................................44 B.2.3.1 WLAN Node Requirements...............................................................................45 B.2.3.2 Configuration of New Clients to the WLAN.......................................................45 B.3 XML Device Description..................................................................................................46 B. 4 Test............................................................................................................................. 47 Appendix C. WFAWLANConfig:1 Service Template Version 1.01.......................................48 C.1 Overview and Scope.......................................................................................................49 C.2 Service Modeling Definitions...........................................................................................49 C.2.1 ServiceType..............................................................................................................49 C.2.2 State Variables.........................................................................................................50 C.2.2.1 Message...........................................................................................................50 C.2.2.2 InMessage........................................................................................................50 C.2.2.3 OutMessage.....................................................................................................51 C.2.2.4 DeviceInfo.........................................................................................................51 C.2.2.5 APSettings........................................................................................................51 C.2.2.6 APStatus...........................................................................................................51 C.2.2.7 STASettings......................................................................................................51 C.2.2.8 STAStatus.........................................................................................................52 C.2.2.9 WLANEvent......................................................................................................52 C.2.2.10 WLANEventType............................................................................................52 C.2.2.11 WLANEventMAC............................................................................................52 C.2.3. Eventing and Moderation.........................................................................................52
C.2.3.1. Event Model.....................................................................................................53 C.2.4 Actions...................................................................................................................... 53 C.2.4.1 GetDeviceInfo...................................................................................................53 C.2.4.2 PutMessage......................................................................................................54 C.2.4.3 GetAPSettings..................................................................................................54 C.2.4.4 SetAPSettings...................................................................................................55 C.2.4.5 DelAPSettings...................................................................................................55 C.2.4.6 GetSTASettings................................................................................................55 C.2.4.7 SetSTASettings................................................................................................56 C.2.4.8 DelSTASettings................................................................................................56 C.2.4.9 PutWLANResponse..........................................................................................57 C.2.4.10 SetSelectedRegistrar......................................................................................57 C.2.4.11 RebootAP.......................................................................................................57 C.2.4.12 ResetAP..........................................................................................................58 C.2.4.13 RebootSTA.....................................................................................................58 C.2.4.14 ResetSTA.......................................................................................................59 C.2.4.15 Nonstandard Actions Implemented by a UPnP Vendor..................................59 C.2.4.16 Common Error Codes.....................................................................................59 C.2.5 Theory of Operation..................................................................................................59 C.2.5.1 Establishing a Registrar with an Access Point and Access Point Management ....................................................................................................................................... 59 C.2.5.2 Proxy Function..................................................................................................60 C.2.5.3 Initialization and Configuration of the Ethernet-Connected Wireless Device....60 C.3 XML Service Description.................................................................................................61 C.4 Test.................................................................................................................................. 65
Introduction to WCN-NET
Microsoft Windows Connect Now technology provides solutions for creating secure wireless networks and adding devices to the network. Specifically, Windows Connect Now-NET (WCN-NET) solves two problems that have limited consumer deployment of secure wireless networks: Most users do not realize that the default network configuration is not secure. Many of the remaining users find that the security configuration is too complex. WCN-NET solves these problems by providing a user-friendly, simplified, and consistent way to set up secure wireless networks and add devices to the network. This solution works for both out-of-band Ethernet devices and in-band wireless devices This specification summarizes the architecture and then covers registration in detail: User interface flow Registration Protocol Message format Registration message attributes
Transportation of Registration Protocol messages by using universal Plug and Play (UPnP) or Extensible Authentication Protocol (EAP) Appendix A explains the master table definitions. References and resources discussed in this specification are listed in Resources at the end of this specification.
WCN-NET User Experience

Entry Points and Flows
By using WCN-NET, device configuration and setup can be done through three entry points: Set up a wireless access point or use the Router Wizard. Use the Add a Wireless Device Wizard. Double-click the device in Network Explorer.
Set up a Wireless Access Point or Use the Router Wizard

This wizard is targeted for first-time wireless access point and network setup. It helps users to set up most common network settings and to set up a wireless access point.
To run the wizard:
1. On the taskbar, click Start, click Network, click Network and Sharing Center, and then click Set up a connection or network. The Choose a connection option page appears. 2. Click Set up a wireless router or access point Set up a new wireless network for your home or small business.
3. The introduction page appears, describing the detailed steps of the wizard. Click Next.
4. If the wizard detects a device, a preselected Network Name (SSID) appears. You can edit this field by typing a new name. Click Next.
5. A preselected Passphrase appears. You can edit this field by typing a new name. Click Next.
6. To continue the configuration process, type a device PIN. Click Next.
7. Configure commonly used file and printer sharing settings. Click Next.
8. Configuration is completed successfully. You can save and print these settings. Click Close.
Use the Add a Wireless Device Wizard

This wizard is optimized for adding or setting up wireless devices for an existing network. However, users can also set up a new wireless network.
To run the wizard:
1. On the taskbar, click Start, click Network, and then click Add a Wireless Device. The discovered wireless devices that support WCN-NET appear in this device picker.
2. Choose the device that you want to add.
3. Complete the configuration process by creating a new wireless network and using the device PIN. You can also select existing profiles by using a profile picker.
Double-Click the Device in Network Explorer

A Windows Connect Now device in Network Explorer has a default action of configure. Double-clicking the device allows the user to launch the configuration process and set up the device that supports WCN-NET.
To configure the device
1. On the taskbar, click Start, click Network, and then double-click Access Point.
2. Complete the device configuration process by creating a new wireless network, using the device PIN, or selecting or creating a wireless profile.
3. After the selection of the device, the configuration process can be completed by creating or selecting a wireless network.
User Experience Pamphlet in the Box for Access Points

For Access Points: Instructions should be provided to the user for setting up a new wireless access point. 1. On the taskbar, click Start, click Network, and then click Network and Sharing Center. 2. Click Set up a connection or network, click Set up a wireless router or access point, and then click Next to complete the configuration. For other wireless devices: Instructions should be provided to the user for setting up a wireless device. 1. On the taskbar, click Start, click Network, click Network and Sharing Center, and then click Add a Wireless. 2. Select your wireless device, and then click Next to complete the configuration.
WCN-NET Architecture
Figure 1 shows the logical components of the WCN-NET architecture.
Figure 1. WCN-NET Components
The enrollee is a new device that does not have the settings for the wireless network. The registrar provides wireless settings to the enrollee. The access point provides normal wireless network hosting and also proxies messages between the enrollee and the registrar. In Windows Vista, a new enrollee may exchange messages directly with the Windows Vista registrar (interface E) via UPnP if the enrollee is initially connected to an Ethernet network. Alternatively, a new enrollee may exchange messages over EAP with the Windows Vista Registrar and the access point works as a proxy to convey the messages to UPnP. The message exchange between the registrar and the enrollee to authenticate and provide the enrollee with network settings is called the Registration Protocol.
Registration in Windows Vista

The registrar in Windows Vista is initiated via one of two methods: Opening Network Explorer. From the Network Center, clicking Set up a connection or network and then clicking Set up a wireless router or access point. When the Windows Vista registrar process starts, it discovers all UPnP devices on the network and subscribes to UPnP events from any access points. It waits for UPnP events from access points and lists WCN-NET devices as it finds them. In Windows Vista, Network Explorer presents a list of discovered devices, including WCN-NET-based devices that the user can select to configure. Clicking Add a wireless device in Network Explorer lists only unconfigured wireless devices. Alternatively, if the user chooses to use the Network Center to create a new network by using Set up a connection or network: Windows displays a list of devices that are visible on the network. The user can select one of these devices to configure. Then the user is prompted to enter the devices PIN, which is used when authenticating between the Windows Vista registrar and the device. The user can then either select an existing network profile that contains a service set identifier (SSID) and passphrase or create new network settings if a profile does not already exist for the settings to be provided to the device.
After the PIN and the network settings have been collected from the user, the Registration Protocol then runs between the Windows Vista registrar and the device. The PIN is used for two-way authentication, and the selected and defined profile is provided to the device. Upon successful completion of the Registration Protocol, the Windows Vista registrar displays a message to show that the device was successfully configured for the network. The specifics of the WCN-NET protocol, including registration, are detailed in this specification.
Registration Protocol
The Registration Protocol provides: Two-way discovery Exchange of Diffie-Hellman public keys Lock-step message exchange Two-way authentication Transfer of configuration
Figure 2 describes the Registration Protocol message exchange.

Enrollee Registrar: Enrollee Registrar: Enrollee Registrar: Enrollee Registrar: Enrollee Registrar: Enrollee Registrar: Enrollee Registrar: Enrollee Registrar: M1 = M2 = M3 = M4 = M5 = M6 = M7 = M8 = Version || N1 || Description || PKE Version || N1 || N2 || Description || PKR [ || ConfigData ] || HMACAuthKey(M1 || M2*) Version || N2 || E-Hash1 || E-Hash2 || HMACAuthKey(M2 || M3*) Version || N1 || R-Hash1 || R-Hash2 || ENCKeyWrapKey(R-S1) || HMACAuthKey (M3 || M4*) Version || N2 || ENCKeyWrapKey(E-S1) || HMACAuthKey (M4 || M5*) Version || N1 || ENCKeyWrapKey(R-S2) || HMACAuthKey (M5 || M6*) Version || N2|| ENCKeyWrapKey(E-S2 [||ConfigData]) || HMACAuthKey (M6 || M7*) Version || N1 || [ENCKeyWrapKey(ConfigData) ] || HMACAuthKey (M7 || M8*)
Figure 2: Registration Protocol Message Exchange
The following defines the conventions that were used in Figure 2: || Concatenation of parameters to form a message. Subscripts When used in the context of a cryptographic function such as HMACKey, a reference to the key that the function uses.
Mn* Message Mn excluding the HMAC-SHA-256 value. Version The type of Registration Protocol message. N1 A 128-bit random number (nonce) that the enrollee specifies. N2 A 128-bit random number (nonce) that the registrar specifies. Description A human-readable description of the sending device (UUID, manufacturer, model number, MAC address, and so on) and device capabilities such as supported algorithms, I/O channels, and Registration Protocol role. Description data is also included in 802.11 Probe request and Probe response messages. PKE and PKR Diffie-Hellman public keys of the enrollee and registrar, respectively. AuthKey An authentication key that is derived from the Diffie-Hellman secret gABmod p, the nonces N1 and N2, and the enrollees MAC address. E-Hash1 and E-Hash2 Precommitments that the enrollee makes to prove knowledge of the two halves of its own device password. R-Hash1 and R-Hash2 Precommitments that the registrar makes to prove knowledge of the two halves of the enrollees device password. ENCKeyWrapKey(...) Symmetric encryption of the values in parentheses by using the key KeyWrapKey. The encryption algorithm is AES-CBC. R-S1 and R-S2 Secret 128-bit nonces that, together with R-Hash1 and R-Hash2, the enrollee can use to confirm the registrars knowledge of the first and second half, respectively, of the enrollees device password. E-S1, E-S2 Secret 128-bit nonces that, together with E-Hash1 and E-Hash2, can the registrar can use to confirm the enrollees knowledge of the first and second half of the enrollees device password, respectively. HMACAuthKey(...) An authenticator attribute that contains an HMAC keyed hash over the values in parentheses and using the key AuthKey. The keyed hash function is HMAC-SHA-256. ConfigData Wireless local area network (WLAN) settings and credentials. The registrar encrypts WLAN settings.
Summary and Classification of Keys

Table 1 lists the different keys that Windows Vista uses. Table 1. Summary and Classification of Keys
Key name PKE PKR Device PIN Type Authentication and key derivation, long-lived or temporary Authentication and key derivation, long-lived or temporary Authentication, temporary if shown on display, may be longlived if on label Authentication and key derivation, temporary Key derivation, temporary Authentication, temporary Key wrap, temporary Authentication, temporary Authentication, temporary Key derivation, temporary Known by Enrollee and registrar Enrollee and registrar Enrollee and registrar Used for Generating session keys Generating session keys Authenticating DiffieHellman exchange Generating session keys Generating session keys Mutual authentication of enrollee and registrar Encrypting WLAN configuration for enrollee Proof-of-possession of device password Proof-of-possession of device password Not used
gABmod p KDK AuthKey KeyWrapKey PSK1 PSK2 EMSK
Enrollee and registrar Enrollee and registrar Enrollee and registrar Enrollee and registrar Enrollee and registrar Enrollee and registrar Enrollee and registrar
Key Derivation
Upon receipt of M1, the registrar has enough information to determine whether to use the in-band or out-of-band method for enrollment. The Registration Protocol message exchange applies the following rules for deriving security keys: If M2 is sent over a physically secure out-of-band channel, then ConfigData can be sent in M2 and the Registration Protocol can terminate at that point. Depending upon the physical security of the out-of-band channel and the registrars policy, the registrar can choose whether to encrypt ConfigData that is sent in an out-of-band M2. Encrypting this data provides an additional measure of security. 1536-bit MODP Group for Diffie-Hellman Exchange The 1536 bit MODP group that WCN-NET uses is taken from RFC 3526. The prime is: 2^1536 - 2^1472 - 1 + 2^64 * { [2^1406 pi] + 741804 } Its hexadecimal value is as follows:
FFFFFFFF FFFFFFFF C90FDAA2 2168C234 C4C6628B 80DC1CD1 29024E08 8A67CC74 020BBEA6 3B139B22 514A0879 8E3404DD EF9519B3 CD3A431B 302B0A6D F25F1437 4FE1356D 6D51C245 E485B576 625E7EC6 F44C42E9 A637ED6B 0BFF5CB6 F406B7ED EE386BFB 5A899FA5 AE9F2411 7C4B1FE6 49286651 ECE45B3D C2007CB8 A163BF05 98DA4836 1C55D39A 69163FA8 FD24CF5F 83655D23 DCA3AD96 1C62F356 208552BB 9ED52907 7096966D 670C354E 4ABC9804 F1746C08 CA237327 FFFFFFFF FFFFFFFF
The generator is: 2. Derivation of KDK

KDK = HMAC-SHA-256DHKey (N1 || EnrolleeMAC || N2)
DHKey is defined as SHA-256(gABmod p). PKE is gAmod p and PKR is gBmod p. The enrollee and registrar know the secret values A and B, respectively. EnrolleeMAC is the 6-byte 802.11 MAC address of the enrollee. The enrollees MAC address is included in the description data that is sent in M1.
Derivation of AuthKey, KeyWrapKey, and EMSK

Additional keys are derived from KDK by using a key derivation function (kdf). The function prf that is used in kdf is the keyed hash HMAC-SHA-256.
kdf(key, personalization_string, total_key_bits) : result := iterations = (total_key_bits + prf_digest_size 1)/prf_digest_size for i = 1 to iterations do result := result || prf(key, i || personalization_string || total_key_bits) return 1st total_key_bits of result and destroy any bits left over
Given KDK and this key derivation function, the Registration Protocol session keys are derived as follows:
AuthKey || KeyWrapKey || EMSK = kdf(KDK, Wi-Fi Easy and Secure Key Derivation, 640)
AuthKey (256 bits) A key that is used to authenticate the Registration Protocol messages. KeyWrapKey (128 bits) A key that is used to encrypt secret nonces and ConfigData. EMSK (256 bits) An extended master session key that may be used to derive application-specific keys. This notation means that 640 bits are generated by the kdf function by using the seed value KDK. These 640 bits are split into three parts that correspond to the two symmetric session keys AuthKey and KeyWrapKey and the EMSK.keying material. Key Wrap Algorithm The following algorithm is used to perform the key wrap function that is used to protect the secret nonces and the ConfigData: 1. First compute KWA = 1st 64 bits of HMACAuthKey(DataToEncrypt) 2. Generate random 128-bit IV. 3. Compute WrappedData = AES-Encrypt-CBCKeyWrapKey(DataToEncrypt || KWA, IV). 4. IV is included along with WrappedData in the Encrypted Settings attribute. To decrypt, use the following algorithm: 1. Data || KWA = AES-Decrypt-CBCKeyWrapKey(WrappedData, IV) 2. If KWA = 1st 64 bits of HMACAuthKey(Data), then output Data or else output failure. Note that the IV must be random, and it must not be copied from any keying material that is used for other purposes. A freshly-generated random nonce must be used. KWA is the Key Wrap Authenticator attribute.
PIN Proof of Possession E-Hash1 is derived from the session parameters and the device password. First, the device password is converted to two 128-bit PSK values as follows: PSK1 = first 128 bits of HMACAuthKey(1st half of DevicePassword) PSK2 = first 128 bits of HMACAuthKey(2nd half of DevicePassword) The enrollee creates two 128-bit secret nonces (E-S1 and E-S2) and then computes: E-Hash1 = HMACAuthKey(E-S1 || PSK1 || PKE || PKR) E-Hash2 = HMACAuthKey(E-S2 || PSK2 || PKE || PKR) The registrar creates two 128-bit secret nonces (R-S1 and R-S2) and then computes: R-Hash1 = HMACAuthKey(R-S1 || PSK1 || PKE || PKR) R-Hash2 = HMACAuthKey(R-S2 || PSK2 || PKE || PKR) The hash values are gradually exchanged and verified in messages M3 through M7. If a verification check of one of the Device Password parts fails, the receiving side must acknowledge the message with a failure indication and the enrollee and registrar must stop the protocol and discard all keys and nonces that are associated with the session. PIN Checksum Windows Vista supports both 4- and 8-digit PINs. Only devices with displays can use the 4-digit PIN. Although the WCN-NET specification supports rekeying, Windows Vista does not. The device password ID must be default, value = 0 (the device password is a PIN). For 8-digit numeric PINs, the last digit in the PIN is used as a checksum of the other digits. The algorithm to validate the checksum is given in the following C code.
bool ValidateChecksum(unsigned long int PIN) { unsigned long int accum = 0; accum += 3 * ((PIN / 10000000) % 10); accum += 1 * ((PIN / 1000000) % 10); accum += 3 * ((PIN / 100000) % 10); accum += 1 * ((PIN / 10000) % 10); accum += 3 * ((PIN / 1000) % 10); accum += 1 * ((PIN / 100) % 10); accum += 3 * ((PIN / 10) % 10); accum += 1 * ((PIN / 1) % 10); return (0 == (accum % 10)); }
The corresponding algorithm to compute the checksum digit, assuming the other seven random PIN digits, is as follows:
int ComputeChecksum(unsigned long int PIN) { unsigned long int accum = 0; accum += 1 * ((PIN / 1000000) % 10); accum += 3 * ((PIN / 100000) % 10); accum += 1 * ((PIN / 10000) % 10); accum += 3 * ((PIN / 1000) % 10); accum += 1 * ((PIN / 100) % 10); accum += 3 * ((PIN / 10) % 10); int digit = (accum % 10); return (10 - digit) % 10; }
Message Format
WCN-NET specifies a message exchange protocolRegistration Protocol between an enrollee and a registrar and several transports over which it can operate. The Registration Protocol is a concatenation of binary format attributes, in which each attribute uses a Type, Length, and Value structure as shown in Table 2. Table 2. Type, Length, Value (TLV) Format for WCN-NET Binary Data
Byte offset 0 2 4 Field length (in bytes) 2 2 0-0xFFFF Field name AttributeType DataLength Data Description Type identifier for the attribute Length in bytes of the attributes data field Attribute data
For a list of the attributes and associated definitions used in Windows Vista, see Appendix A. Windows Vista provides a UPnP-based registrar function. It may be used for configuring access points and devices directly over UPnP as specified in the WFADevice and the WFAWLANConfig service specifications and also for configuring devices via a UPnP proxy function, typically implemented in an access point.
Registration Message Attributes

The following tables list the attributes for registration message exchange that Windows Vista uses. Devices may use additional messages (such as Beacon and Probe Response) for exchange over the wireless network, but Windows Vista does not provide or consume these messages. Message exchange is done as defined in the UPnP WFADevice specification. Table 3. Probe Request
Attribute Version Request Type Config Methods UUID-E Primary Device Type RF Bands Association State R/O R R R R R R R Notes 0x10 = version 1.0, 0x11 = version 1.1, and so on.
Attribute Configuration Error Device Password ID
R/O R R
Notes
Table 4. M1
Attribute Version Message Type UUID-E MAC Address Enrollee Nonce Public Key Authentication Type Flags Encryption Type Flags Connection Type Flags Config Methods Simple Config State Manufacturer Model Name Model Number Serial Number Primary Device Type Device Name RF Bands Association State Device Password ID Configuration Error OS Version Feature ID R/O R R R R R R R R R R R R R R R R R R R R R R O R/O R R R R R R R R R R R R R Notes 0x10 = version 1.0, 0x11 = version 1.1, and so on. Value is 0x04 for M1.
Diffie-Hellman key of enrollee. Key size and group are implied by the attribute data size.
Specific RF band used for this message
Table 5. M2
Attribute Version Message Type Enrollee Nonce Registrar Nonce UUID-R Public Key Authentication Type Flags Encryption Type Flags Connection Type Flags Config Methods Manufacturer Model Name Model Number Notes 0x10 = version 1.0, 0x11 = version 1.1, and so on. Value is 0x05 for M2.
Diffie-Hellman key of registrar, key size, and group are implied by the attribute data size.
Attribute Serial Number Primary Device Type Device Name RF Bands Association State Configuration Error Device Password ID OS Version Feature ID Authenticator
R/O R R R R R R R R O R
Notes
Specific RF band used for this message
The device password ID that the registrar indicates may be different from the ID that the enrollee in M1 sends.
Table 6. M2D
Attribute Version Message Type R/O R R Notes 0x10 = version 1.0, 0x11 = version 1.1, and so on. Value is 0x06 for M2D. Same as M2, except no Public Key, no Encrypted Data, and no Authenticator attribute.
Table 7. M3
Attribute Version Message Type Registrar Nonce E-Hash1 E-Hash2 Authenticator R/O R R R R R R Notes 0x10 = version 1.0, 0x11 = version 1.1, and so on. Value is 0x07 for M3. Hash of first half of device password, DH secret, and secret nonce 1. Hash of second half of device password, DH secret, and secret nonce 2.
Table 8. M4
Attribute Version Message Type Enrollee Nonce R-Hash1 R-Hash2 Encrypted Settings Authenticator R/O R R R R R R R Notes 0x10 = version 1.0, 0x11 = version 1.1, and so on. Value is 0x08 for M4. Hash of first half of device password, DH secret, and secret nonce 1. Hash of second half of device password, DH secret, and secret nonce 2. Encrypted Secret Nonce attribute that contains the registrars secret nonce 1.
Table 9. M5
Attribute Version Message Type Registrar Nonce Encrypted Settings Authenticator R/O R R R R R Notes 0x10 = version 1.0, 0x11 = version 1.1, and so on. Value is 0x09 for M5. Encrypted Secret Nonce attribute that contains the enrollees secret nonce 1.
Table 10. M6
Attribute Version Message Type Enrollee Nonce Encrypted Settings Authenticator R/O R R R R R Notes 0x10 = version 1.0, 0x11 = version 1.1, and so on. Value is 0x0a for M6. Encrypted Secret Nonce attribute that contains the registrars secret nonce 2.
Table 11. M7
Attribute Version Message Type Registrar Nonce Encrypted Settings Authenticator R/O R R R R R Notes 0x10 = version 1.0, 0x11 = version 1.1, and so on. Value is 0x0b for M7. Encrypted Secret Nonce attribute that contains the enrollees secret nonce 2 and current wireless settings if the enrollee is an access point.
Table 12. M8
Attribute Version Message Type Enrollee Nonce Encrypted Settings Authenticator R/O R R R R R Notes 0x10 = version 1.0, 0x11 = version 1.1, and so on. Value is 0x0c for M8. Encrypted wireless settings for enrollee. This attribute may also include a digital certificate.
The Encrypted Setttings attribute in M8 that is sent to access points or stations may contain multiple network keys and associated binding information (SSID, MAC Address, Authentication Type and Encryption Type), but the Windows Vista release to manufacture (RTM) will send only a single network key and associated binding information to access points and likewise, a single Credential to stations. Table 13. Encrypted Settings Attribute in M8 for Access Point
Attribute Network Index R/O O Notes This attribute is used only if the enrollee is an access point and the registrar wants to configure settings for a nondefault network interface. If omitted, the Network Index defaults to 1.
SSID Authentication Type
R R
Attribute Encryption Type Network Key Index Network Key MAC Address Key Wrap Authenticator
R/O R O R R R
Notes If omitted, the Network Key Index defaults to 1. Multiple instances of Network Key and its preceding Network Key Index may be included.
Table 14. Encrypted Attributes in M8 for Station

Attribute Credential Key Wrap Authenticator R/O R R Notes May include multiple instances of Credential.
Table 16. WCN-NET_Ack

Attribute Version Message Type Enrollee Nonce Registrar Nonce R/O R R R R Notes 0x10 = version 1.0, 0x11 = version 1.1, and so on. Value is 0xD for WCN-NET_ACK message.
Table 17. WCN-NET_Nack

Attribute Version Message Type Enrollee Nonce Registrar Nonce Configuration Error R/O R R R R R Notes 0x10 = version 1.0, 0x11 = version 1.1, and so on. Value is 0xE for WCN-NET_NACK message.
Table 18. WCN-NET_Done

Attribute
Version Message Type Enrollee Nonce Registrar Nonce
R/O R R R R
Notes 0x10 = version 1.0, 0x11 = version 1.1, and so on. Value is 0xF for WCN-NET Done message.
Transportation of Registration Protocol Messages

UPnP Transport
Access points that implement the Wi-Fi Simple Configuration Protocol operate as an enrollee by using UPnP when interacting with Windows Vista. The WFADevice and WFAWLANConfig service documents specify UPnP behavior for Ethernetconnected enrollees. Wi-Fi Simple Configurationcapable enrollees can exchange Registration Protocol messages with Windows Vista either directly over UPnP or via a proxy function in a Wi-Fi Simple Configurationcapable access point. The WFADevice and WFAWLANConfig service documents specify UPnP behavior for Ethernetconnected enrollees. Note that when connected to Ethernet and advertising the
Wi-Fi Simple Configurationcapable UPnP device and service, enrollees must turn off wireless-based discovery. A device must not simultaneously advertise itself over UPnP and 802.11. If an enrollee is using its Wi-Fi interface for running the Registration Protocol, it should continuously scan all available wireless networks with Probe request messages.
EAP Transport of Registration Protocol

WCN-NET uses 802.1X and EAP to transport in-band Registration Protocol messages. This protocol is mapped onto a custom EAP method that is described later in this specification. WCN-NET does not require the access point to support RADIUS, and the network is not required to include an authentication server. In fact, many WCN-NETcapable access points may support 802.1X only to configure WPA-Personal Credentials via WCN-NET. Enrollees that use WCN-NET are not granted direct access to the WLAN through the WCN-NET custom EAP method. The EAP method is used to configure the enrollee with a credential that can be used subsequently with whatever access method that WLAN supports. For example, if the access point supports only WPA-Personal with a network-wide shared PSK, then the enrollee would run the WCN-NET EAP method to obtain the PSK, disassociate, and then reconnect and use WPA-Personal to access the WLAN. Alternatively, if the access point supports 802.1X authentication, the enrollee may first run the WCN-NET EAP method to obtain a shared secret credential and then reconnect by using that secret in conjunction with another EAP method to access the WLAN. The WCN-NET EAP method can be used for discovering a registrar or enrollee or for establishing a credential. The first time that the enrollee encounters a new WLAN, it sends out its discovery information and executes the EAP method with each access point it finds that supports WCN-NET. In both the discovery message and in M1, the enrollee provides information about itself to the WLAN. The M2 and M2D messages sent to the enrollee likewise provide information about the available registrars. When the enrollee first discovers and attempts to connect to the WLAN, the WLANs registrars may not yet know the enrollees device password. Therefore, registrars without the device password respond with M2D messages. Although these M2D messages are unauthenticated, they can help enrollees with rich user interfaces to guide the user through the enrollment process and can also help a headless enrollee select a particular registrar that may support optional or vendor-extended functions. As the enrollee scans the M2D messages that registrars in the network sent, it may discover that none of them possesses its device password. Therefore, the enrollee can prompt the user to perform a trust bootstrapping operation such as connecting an available out-of-band channel or entering a device password into one of the available registrars. If the user decides to enter the enrollees device password into the registrar, the enrollee discovers this the next time it connects and reruns the EAP method. It can then perform the complete Registration Protocol. If the enrollee has no user interface to lead the user through the enrollment, it is likely that one or more of the WLANs registrars can do this. Both the registrar and the enrollee are given sufficient information about each other's capabilities through the EAP method to successfully lead the user through the enrollment. If the user decides to use an out-of-band channel for registration, then M2 is implicitly authenticated by the channel and can carry the network configuration data. An enrollee with a limited user interface should continue to scan the available WLANs
for a registrar that returns M2 or sees a selected registrar flag in an access points Beacon.
EAP Message Framing

The access point functions as the EAP authenticator on the WLAN. Thus, the access point generates EAP request messages, and enrollees and registrars generate EAP responses. If the registrar is external to the access point, then it uses UPnP (rather than RADIUS) to exchange Registration Protocol messages with the access point. A registrar may also function in the role of an 802.1X authenticator in ad-hoc mode. This latter mode is useful for networks with legacy access points. The following section contains a brief summary of the WCN-NET EAP method. Figure 3 shows the EAP packet format for request and response messages. For a more complete discussion of these fields and EAP, refer to RFC 3748.
0 1 2 3 01234567890123456789012345678901 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Code | Identifier | Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Type | Vendor-Id | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Vendor-Type | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Op-Code | Flags | Message Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Message data +-+-+-+-+-+-+-+-+-+-+-+-+-+Figure 3: EAP Packet Format
The Code field is set to 1 for EAP-Request messages and to 2 for EAP-Response messages. The Identifier field is used to correlate request and response messages. The Length field gives the overall length of the EAP packet. The Type field indicates the EAP method type. For WCN-NET, it is set to 254 (expanded type). The Vendor-Id is the WFA SMI code 0x00372A, and the Vendor-Type is 0x0000 0001 (SimpleConfig). The Op-Code field is one of the following values: 0x01 : WCN-NET_Start 0x02 : WCN-NET_ACK 0x03 : WCN-NET_NACK 0x04 : WCN-NET_MSG 0x05 : WCN-NET_Done 0x06: WCN-NET_FRAG_ACK The sequence of the messages that correspond to these Op-Code values is defined by the appropriate state machine that is associated with the scenario (adding an enrollee or adding an external registrar).
EAP Message Fragmentation and Reassembly

The Flags field is a bit-wise OR of flags. 0x01 : More fragments (MF) 0x02 : Length field (LF) 0x04 0x80 : reserved If the MF flag is set, the original packet-required fragmentation and additional fragments still must be transmitted. The MF flag is not set if no additional packet fragments are expected. After receiving each packet with MF set, the receiving party responds with a WCN-NET_FRAG_ACK message. To reassemble the original packet, the receiving party concatenates the MessageData parts of each fragment. If the LF flag is set, the Message Length field is included in the header to indicate the number of bytes of the entire message data being conveyed. If the LF flag is not set, then the Message Length field is omitted. The LF flag and Message Length field are included in the first EAP packet only for a fragmented EAP message. The LF flag must not be set for later fragments. EAP fragmentation is specific to the EAP connection. If a message is fragmented for transmission over EAP, the supplicant and authenticator must handle fragmentation and reassembly of the frame. The proxy function that is required in access points must provide a completely assembled message to the UPnP interface.
EAP Identity
If the supplicant intends to add itself as an external registrar, it must use the EAP Identity WFA-SimpleConfig-Registrar-1-0. If it intends to acquire WLAN credentials as an enrollee, it must use the EAP Identity WFA-SimpleConfigEnrollee-1-0.
EAP Messages
WCN-NET_Start WCN-NET_Start is sent by the access point when it receives an EAP Response/Identity that contains the NAI WFA-SimpleConfig-Enrollee-1-0. The Message Data field of this message is empty. WCN-NET_ACK WCN-NET_ACK is sent by the supplicant or the authenticator when it successfully processes a message but does not have a message to send in response. For example, WCN-NET_ACK is sent by either the supplicant or authenticator when it has processed a message fragment and is ready for the next fragment. WCN-NET_ACK is also sent in response to M2D messages. WCN-NET_NACK WCN-NET_NACK is sent by the supplicant or the authenticator if it encounters an error when it authenticates or processes a message. If the supplicant is an enrollee, then this message is sent by the access point to all external registrars via a UPnP event. The Message Data field of this message is specified in EAP Message Framing earlier in this specification. WCN-NET_MSG WCN-NET_MSG may be sent by the supplicant or authenticator. Its MessageData payload contains a Registration Protocol message. The authenticator state machine does not examine these messages to determine their contents. It simply passes them along to the registrar or enrollee.
WCN-NET_Done WCN-NET_Done is sent by the enrollee after it has successfully processed a WCN-NET_M8 message. It indicates that the enrollee believes it has correctly received a credential for the WLAN. The Message Data field of this message shown in the Done message in Table 18. WCN-NET_FRAG_ACK WCN-NET_FRAG_ACK is sent by the supplicant or the authenticator when it successfully processes a fragmented EAP message and is ready for the next fragment.
Device Requirements
See the Windows Vista Logo Program requirements on the WHDC Web site.
Resources
E-mail: [email protected] Code Coverage Tools From Intel: http://cache-www.intel.com/cd/00/00/21/92/219280_compiler_codecoverage.pdf Batch command files to invoke Build on MSDN: http://g.msn.com/9SE/1? http://msdn2.microsoft.com/enus/library/hefydhhy.aspx&&DI=6066&IG=94c2612141b9477096df2027e35c022 e&POS=3&CM=WPU&CE=3&CS=AWP&SR=3 Debugging Tools for Windows and Windows Symbols WinDbg and other kernel debuggers, extensions, and tools http://www.microsoft.com/whdc/DevTools/Debugging/default.mspx Microsoft Developer Network Checked builds of Windows and other developer resources http://msdn.microsoft.com Verbose Debug Tracing - Microsoft Knowledge Base How to enable verbose debug tracing in various drivers and subsystems http://support.microsoft.com/default.aspx?scid=kb;en-us;314743 www.ietf.org/rfc/rfc3748.txt - RFC 3748 http://www.ietf.org/rfc/rfc3748.txt UPnP Web Resources http://www.upnp.org Wi-Fi Alliance Certification (and WFADevice and WFAWLANConfig service documents) http://www.Wi-Fi.org Windows Driver Kit http://www.microsoft.com/whdc/driver/WDK/aboutWDK.mspx Windows Vista Logo Program http://www.microsoft.com/whdc/winlogo/hwrequirements.mspx
Appendix A
Master TableData Component Set
The following tables enumerate the various attribute types that are defined for WCN-NET and used in Windows Vista. The sizes given in the Length column correspond to the Data part of the attribute. The overall size occupied by each attribute includes an additional 4 bytes (2 bytes of ID and 2 bytes of Length). Table A1. Attribute Types Defined for WCN-NET
Description 802.1X Enabled AP Setup Locked Application Extension AppSessionKey Association State Authentication Type Authentication Type Flags Authenticator Config Methods Configuration Error Connection Type Connection Type Flags Credential Device Name Device Password ID EAP Type E-Hash1 E-Hash2 E-SNonce1 E-SNonce2 Encrypted Settings Encryption Type Encryption Type Flags Enrollee Nonce Feature ID Initialization Vector Key Identifier Key Provided Automatically Key Wrap Authenticator MAC Address Manufacturer Message Counter Message Type Model Name Model Number Network Index Network Key ID (Type) 0x1062 0x1057 0x1058 0x1063 0x1002 0x1003 0x1004 0x1005 0x1008 0x1009 0X100C 0X100D 0X100E 0x1011 0x1012 0x1059 0x1014 0x1015 0x1016 0x1017 0x1018 0X100F 0x1010 0x101A 0x101B 0x1060 0x101F 0x1061 0X101E 0x1020 0x1021 0x104E 0x1022 0x1023 0x1024 0x1026 0x1027 Length Bool 1B <= 512B <= 128B 2B 2B 2B 8B 2B 2B 1B 1B <= 32B 2B <=8B 32B 32B 16B 16B 2B 2B 16B 4B 32B 16B Bool 8B 6B <= 64B 8B 1B <= 32B <= 32B 1B <= 64B
Description Network Key Index OS Version Primary Device Type Public Key R-Hash1 R-Hash2 R-SNonce1 R-SNonce2 Registrar Nonce Request Type Response Type RF Bands Secondary Device Type List Selected Registrar Serial Number Simple Config State SSID UUID-E UUID-R Version WEPTransmitKey <Reserved for WFA> <Unavailable>
ID (Type) 0x1028 0X102D 0x1054 0x1032 0X103D 0X103E 0X103F 0x1040 0x1039 0x103A 0x103B 0x103C 0x1055 0x1041 0x1042 0x1044 0x1045 0x1047 0x1048 0x104A 0x1064 0x1065 0x1FFF 0x000 0x0FFF, 0x2000 0xFFFF
Length 1B 4B 8B 192B 32B 32B 16B 16B 16B 1B 1B 1B <= 128B Bool <= 32B 1B <= 32B 16B 16B 1B (int) 1B
Master Table Definitions

802.1X Enabled This variable specifies if the network uses 802.1X for network authentication. AP Setup Locked This variable indicates that the access point has entered a state in which it refuses to allow an external registrar to attempt to run the Registration Protocol by using the access points PIN (with the access point acting as enrollee). The access point should enter this state if it believes a brute force attack is underway against the access points PIN. When in this state, the access point must continue to allow other enrollees to connect and run the Registration Protocol with any external registrars or the access points built-in registrar (if any). Only the use of the access points PIN for adding external registrars is disabled in this state. The AP Setup Locked state can be reset to FALSE through an authenticated call to SetAPSettings. Access points may provide other implementation-specific methods of resetting the AP Setup Locked state as well.
Application Extension The Application Extension attribute is used to pass parameters for enabling applications during the WSC exchange. It is similar to the Vendor Extension attribute except that instead of a 3-byte Vendor ID prefix to the Vendor Data field, a 16-byte UUID (as defined in RFC 4122) is used. This provides a virtually unlimited application ID space with a regular structure that can be easily mapped onto a generic application extension API. Furthermore, the 16-byte UUID value can be used to derive application-specific AMSKs as described in Section 6.3 or pass any necessary keying directly. The enrollee may, for example, send two Application Extension attributes to the registrar in the Encrypted Settings of M7, one with UUID-A and one with UUID-X. If the registrar supports the application that corresponds to UUID-X but not UUID-A, the registrar may indicate to the enrollee that it also supports application X by sending an Application Extension with UUID-X in the Encrypted Settings of M8. Given this exchange, the enrollee and registrar can exchange application-specific information in the Data field such as application-specific keying or they can derive an AMSK for application X as follows: AMSK = kdf(EMSK, N1 || N2 || UUID-X, 256)
0 1 2 3 01234567890123456789012345678901 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Attribute ID | Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | UUID (1-4) | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | UUID (5-8) | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | UUID (9-12) | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | UUID (13-16) | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Data... +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
One use of this Application Extension mechanism is to permit a Simple Config exchange to simultaneously set up connections for multiple wireless technologies (such as Wi-Fi or Bluetooth). To accomplish this setup, each network type would specify a UUID value for this purpose and define a corresponding Data element (to exchange data such as the devices MAC address on the other network). A network setup application on each device would exchange the Application Extension data by using the Simple Config Registration Protocol and then set up the other network connections by using that data with the native pairing mechanisms of the other networks.
Furthermore, if device pairing takes place first with another network type, it is possible to use the other network pairing mechanism as an out-of-band channel comparable to UFD or NFC. If this is done, the UUID and Data value to use for Simple Config are: UUID=0xA6F6D81FB26941e2A72EC0B702248E90 Data=TLV attribute list below:
Attribute Version OOB Device Password SSID <other> R/O R O O O Notes As defined in section 11. May be omitted if OOB Device Password has already been received from peer device. Included if SSID is known by sender.
Note that this approach passes the OOB Device Password directly in the Data field or can be used to pass transport specific parameters and keying directly to eliminate the requirement to rerun the Registration Protocol a second time. AppSessionKey The AppSessionKey attribute allows the exchange of application-specific session keys and may be used as an alternative to calculating AMSKs. Association State This component shows the configuration and association state that the wireless station is in when sending out a discovery request. Table A2. Association State Values
Value 0 1 2 3 4 Description Not associated Connection success Configuration failure Association failure IP failure
Authentication Type This variable contains a specific value from the authentication types table for the enrollee (access point or station) to use. Authentication Type Flags This variable indicates the network authentication capabilities of the enrollee (access point or station). It provides a bitwise OR of the fields in the following table. Table A3. Authentication Type Values
Value 0x0001 0x0002 0x0004 0x0008 0x0010 0x0020 Description Open WPAPSK Shared WPA WPA2 WPA2PSK
Authenticator This component is a keyed hash of data. The specific data in the hash calculation depends upon the processing context. The hash algorithm for Easy Setup version 1.0 is HMAC-SHA-256. In the context of the Registration Protocol, the default key that is used in the HMAC is AuthKey. If a nondefault key is used, the key is specified in the Key Identifier attribute immediately preceding the Authenticator attribute. To reduce message payload size, the Authenticator attributes Data component includes only the first 64 bits of the HMAC-SHA-256 output. Config Methods This component lists the configuration methods that the enrollee or registrar supports. The list is a bitwise OR of values from the following table. In addition to Config Methods, access points and stations that support the UPnP Management Interface must support the permitted Config Methods attribute, which is used to control the Config Methods that are enabled on that access point. Table A4. Config Methods Values
Value 0x0001 0x0002 0x0004 0x0008 0x0010 0x0020 0x0040 0x0080 0x0100 Hardware interface USBA (flash drive) Ethernet Label Display External NFC token Integrated NFC token NF interface PushButton Keypad
Configuration Error This component shows the result of the device attempting to configure itself and associate with the WLAN. Table A5. Configuration Errors Values
Value 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 Description No error OOB interface read error Decryption CRC failure 2.4 channel not supported 5.0 channel not supported Signal too weak Network authentication failure Network association failure No DHCP response Failed DHCP configuration IP address conflict Could not connect to registrar Multiple PBC sessions detected Rogue activity suspected Device busy Setup locked
Value 16 17 18
Description Message timeout Registration session timeout Device password authentication failure
The device busy error is returned if the sending device cannot respond to the request due to some internal conflict or resource contention issue. For example, if a device can perform only a single instance of the Registration Protocol, it may return this error in response to attempts to start another instance in the middle of an active session. Connection Type This attribute contains a specific value from the connection type flags table for the enrollee (access point or station) to use. Connection Type Flags This variable represents the capabilities of the enrollee. Table A6. Connection Type Flags Values
Value 0x1 0x2 Description ESS IBSS Required/optional R R
Credential This compound attribute contains a single WLAN credential. The subattributes in credential are shown in the following table. Table A7. Credential Attributes
Attribute Network Index SSID Authentication Type Encryption Type Network Key Index Network Key MAC Address EAP Type EAP Identity Key Provided Automatically 802.1X Enabled R/O R R R R R R R O O O O Notes, allowed values SSID of access point or ad-hoc network
Member devices MAC address
Device Name This component is a user-friendly description of the device encoded in UTF-8. Typically, this would be a unique identifier that describes the product in a way that is recognizable to the user. The device must have this field populated from the factory, and it is recommended that it indicate the manufacturer and model. Device Password ID This attribute is used to identify a device password. There are six predefined values and ten reserved values. If the Device Password ID is Default, then the enrollee should use its PIN password (from the label or display). This password may correspond to the label, display, or a user-defined password that has been configured to replace the original device password.
"User-specified" indicates that the user has overridden the password with a manually selected value. "Machine-specified" indicates that the original PIN password has been overridden by a strong, machine-generated device password value. The Rekey value indicates that the devices 256-bit rekeying password will be used. The PushButton value indicates that the PIN is the allzero value that was reserved for the PushButton Configuration method. The registrar-specified value indicates a PIN that has been obtained from the registrar (via a display or other out-of-band method). This value may be further augmented with the optional Identity attribute in M1. This augmentation is useful when multiple predefined UserID/PIN pairs have been established by a registrar such as an authenticator used for Hotspot access. If the Device Password ID in M1 is not one of the predefined or reserved values, it corresponds to a password that was given to the registrar as an OOB Device Password. Table A8. Device Password ID Values
Value 0x0000 0x0001 0x0002 0x0003 0x0004 0x0005 0x0006 0x000F Description Default (PIN) User-specified Machine-specified Rekey PushButton Registrarspecified Reserved
EAP Type This attribute contains the binary representation of an EAP type as found in an EAP packet. If it is a standard EAP type, it is only a single byte. Extended EAP types, such as the Wi-Fi Simple Config Registration Protocol (refer to EAP transport section), may be up to 8 bytes (1-byte Type, 3-byte Vendor-ID, and 4byte Vendor-Type). E-Hash1 This component is the HMAC-SHA-256 hash of the first half of the device password and the enrollees first secret nonce. E-Hash2 This component is the HMAC-SHA-256 hash of the second half of the device password and the enrollees second secret nonce. E-SNonce1 This component is the first nonce that the enrollee uses with the first half of the device password. E-SNonce2 This component is the second nonce that the enrollee uses with the second half of the device password. Encrypted Settings The Data field of the Encrypted Settings attribute includes an initialization vector (IV) followed by a set of encrypted Simple Config TLV attributes. The last attribute in the encrypted set is a key wrap authenticator computed according to the procedure described in Master Table Definitions. In the context of the Registration Protocol, the default key that is used for the encryption is the KeyWrapKey.
The encryption algorithm is AES in CBC mode. In other contexts, the key is specified in a Key Identifier attribute that immediately precedes the Encrypted Settings attribute. The data structure of the Encrypted Settings attribute is as follows.
0 1 2 3 01234567890123456789012345678901 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Attribute ID | Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | IV (1-4) | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | IV (5-8) | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | IV (9-12) | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | IV (13-16) | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Encrypted data... +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
If an alternative key wrap algorithm is later preferred, it can be added by defining a new attribute with a different attribute ID. The key wrap authenticator is 96 bits long (32 bits of attribute ID and length, and 64 bits of the HMAC-SHA-256 output). This implies that the total overhead for an Encrypted Settings attribute is 256 bits (32 bits of attribute ID and length, 128 bits of IV, and 96 bits of key wrap authenticator). Encryption Type This attribute contains a specific value from the encryption type flags table for the enrollee (access point or station) to use. Encryption Type Flags This attribute is a binary OR set of WLAN encryption types that are supported by the enrollee (one or more from the following table). Table A9. Encryption Type Flags Value
Value 0x0001 0x0002 0x0004 0x0008 Description None WEP TKIP AES
Enrollee Nonce This component is a randomly generated binary value that the enrollee creates for setup. Feature ID This attribute indicates a particular feature build for an operating system that is running on the device. It is a 4-byte field, with the most significant bit reserved and always set to 1. Initialization Vendor A randomly generated block of bits that is combined with the data to be encrypted to provide entropy to the encryption process.
Key Identifier This attribute contains a 128-bit key identifier. If this attribute immediately precedes an Encrypted Data or Authenticator attribute, then the key that corresponds to the 128-bit identifier should be used to decrypt or verify the Data field. Key Provided Automatically This variable specifies whether the network provides the key. Key Wrap Authenticator This attribute contains the first 64 bits of the HMAC-SHA-256 computed over the data to be encrypted with the key wrap algorithm. It is appended to the end of the ConfigData before encryption, as described earlier in the Registration Protocol section. MAC Address This attribute is a 6-byte value that contains the 48-bit value of the MAC address. An example is 0x00 0x07 0xE9 0x4C 0xA8 0x1C. Manufacturer This component is an ASCII string that identifies the manufacturer of the device. Generally, this field should allow a user to make an association with a device with the labeling on the device. Message Counter This variable contains a 64-bit counter that is included in certain messages to prevent replay attacks. It is not required in Registration Protocol messages, but it is used in many of the UPnP-based management interface messages. Message Type This variable identifies the specific message being sent by the enrollee or registrar, as shown in the following table. Table A10. Message Type Values
Value 0x01 0x02 0x03 0x04 0x05 0x06 0x07 0x08 0x09 0x0A 0x0B 0x0C 0x0D 0x0E 0x0F Description Beacon Probe request Probe response M1 M2 M2D M3 M4 M5 M6 M7 M8 WCN-NET_ACK WCN-NET_NACK WCN-NET_DONE
Model Name This attribute is an ASCII string that identifies the model of the device. Generally, this field should allow a user to make an association with a device with the labeling on the device.
Model Number This attribute provides additional description of the device to the user. Network Index This variable is used to get and set network settings for devices that host more than one network. The default value is 1 and refers to the primary WLAN network on the device. Network Key This variable specifies the wireless encryption key for the enrollee to use. This field is interpreted as shown in the following table. Table A11. Network Key
Authentication None WPAPSK (Passphrase) WPAPSK Shared/Open Encryption None TKIP/AES TKIP/AES WEP Network key type 0 ASCII characters 863 ASCII characters 64 Hex characters 5 or 13 ASCII characters 10 or 26 Hex characters
Network Key Index This variable specifies a particular Network Key instance. OS Version This component indicates what operating system is running on the device. It is a 4-byte field, with the most significant bit reserved and always set to 1. Primary Device Type This attribute contains the primary type of the device. This following shows its format:
0 1 2 3 01234567890123456789012345678901 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Attribute ID | Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Category ID | OUI (1-2) | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | OUI (3-4) | Sub Category ID | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Vendor-specific subcategories are designated by setting the OUI to the value that is associated with that vendor. Note that a 4-byte subdivided OUI is used. For the predefined values, the Wi-Fi Alliance OUI of 00 50 F2 04 is used. The predefined values for category ID and subcategory ID are as shown in the following table. Note that there is no way to indicate a vendor-specific main device category. The OUI applies only to the interpretation of the subcategory. Table A12. Category ID and Subcategory ID Values
Category Computer ID value 1 Subcategory PC Server Media Center Printer Scanner Digital Still Camera ID value 1 2 3 1 2 1
Input Device Printers, Scanners, Faxes, and Copiers Camera
2 3 4
Category Storage Network Infrastructure
ID value 5 6
Displays
Multimedia Devices
Gaming Devices
Telephone
10
Subcategory NAS Access point Router Switch Television Electronic Picture Frame Projector DAR PVR MCX DMR Xbox Xbox360 Playstation Windows Mobile
ID value 1 1 2 3 1 2 3 1 2 3 4 1 2 3 1
Public Key This variable represents the senders Diffie-Hellman public key. The length of the attribute indicates the size of the key as well as the specific generator and prime. R-Hash1 This variable is the HMAC-SHA-256 hash of the first half of the device password and the registrars first secret nonce. R-Hash2 This variable is the HMAC-SHA-256 hash of the second half of the device password and the registrars second secret nonce. R-SNonce1 This variable is the first nonce that the registrar uses with the first half of the device password. R-SNonce2 This variable is the second nonce that the registrar uses with the second half of the device password. Registrar Nonce This component is a randomly generated binary value that the registrar creates for setup. Request Type This component specifies the mode in which the device operates for this setup exchange. If the device is an enrollee, it may send out only discovery messages or may also request that the registrar proceed with opening a data connection. This allows enrollees to more efficiently discover devices on the network. If the device indicates that it wants to engage setup as a registrar, the access point must indicate that it will operate as an access point in the response. The Request Type attribute is carried throughout the 802.1X data channel setup process in the Simple Config IE. There are two subtypes of registrars: A WLAN manager registrar indicates that this registrar intends to manage the access point or station settings by using UPnP. This means it will derive a UPnP AP or STA management key.
The ordinary registrar type indicates that this registrar does not intend to subsequently manage the enrollees settings. Access points must not derive access point management keys for an ordinary registrar. If a registrar does not need to be a WLAN manager registrar, it should set the Request Type to Registrar. This avoids needlessly consuming resources on the access point. Table A13. Request Type Values
Value 0x00 0x01 0x02 0x03 Description Enrollee, Info only Enrollee, open 802.1X Registrar WLAN manager registrar
Response Type This component specifies if the mode in which the device operates for this setup exchange. The Response Type IE is carried throughout the 802.1X data channel setup process. Table A14. Response Type Values
Value 0x00 0x01 0x02 0x03 Description Enrollee, Info only Enrollee, open 802.1X Registrar Access Point
RF Bands This attribute indicates a specific RF band that is used during message exchange to permit end points and proxies to communicate over a consistent radio interface. Table A15. RF Bands Values
Value 0x01 0x02 Description 2.4GHz 5.0GHz
Secondary Device Type List This attribute contains a list of secondary device types that the device supports. OUI and standard values for Category ID and Sub Category ID fields are defined in the Primary Device Type attribute. The Secondary Device Type List format is as follows:
0 1 2 3 01234567890123456789012345678901 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Attribute ID | Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Category ID | OUI (1-2) | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | OUI (3-4) | Sub Category ID | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Additional secondary device types (8 bytes each)... +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Selected Registrar This field indicates that a user has selected a registrar and that an enrollee should proceed with setting up an 802.1X uncontrolled data port with the registrar. Serial Number This component identifies the serial number of the enrollee. Simple Config State This variable indicates if a device has been previously configured (or settings actively accepted) by a user. A device's default factory behavior is "Not configured" and the device reverts to this setting when it has been reset to factory settings. After being successfully configured by a Windows Vista registrar, a device changes from "Not configured" to "Configured." Table A16. Simple Config State Values
Value 0x1 0x2 Description Not configured Configured
SSID This variable represents the service set identifier or network name. The client uses this to connect to the wireless network. This variable is read/write, and the field is always 32 bytes long. UUID-E The universally unique identifier (UUID) element is a unique globally unique identifier (GUID) that the enrollee generates. It uniquely identifies an operational device and should survive reboots and resets. The UUID is provided in binary format. If the device also supports UPnP, then the UUID corresponds to the UPnP UUID. UUID-R The UUID element is a unique GUID that the registrar generates. It uniquely identifies an operational device and should survive reboots and resets. The UUID is provided in binary format. If the device also supports UPnP, then the UUID corresponds to the UPnP UUID. Version This variable specifies the Easy Setup version. The 1-byte field is divided into a 4-bit major part that uses the top most significant bits (MSBs) and 4-bit minor part that uses the least significant bits (LSBs). As an example, version 3.2 would be 0x32. WEPTransmitKey This attribute identifies the Key Index that is used as the access point transmit key for WEP configurations.
Appendix B. WFADevice:1 Device Template Version 1.01

For UPnP Version 1.0 January 23, 2006 Authors: David Roberts, Microsoft Corporation Victor Lortz, Intel Corporation Notice THE SPECIFICATION IS PROVIDED "AS IS," AND INTEL CORPORATION AND MICROSOFT CORPORATION (AUTHORS) MAKE NO REPRESENTATIONS OR WARRANTIES, EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, OR TITLE; THAT THE CONTENTS OF THE SPECIFICATION IS SUITABLE FOR ANY PURPOSE; NOR THAT THE IMPLEMENTATION OF SUCH CONTENTS WILL NOT INFRINGE ANY THIRD PARTY PATENTS, COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS. NEITHER INTEL NOR MICROSOFT SHALL BE LIABLE FOR ANY DIRECT, INDIRECT, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF ANY USE OF THE SPECIFICATION OR THE PERFORMANCE OR IMPLEMENTATION OF THE CONTENTS THEREOF. The name and trademarks of the authors may NOT be used in any manner, including advertising or publicity pertaining to the Specification or its contents without specific, written prior permission. Title to copyright in the Specification will at all times remain with the authors. No other rights are granted by implication, estoppel or otherwise. Copyright 2005, 2006 Intel Corporation and Microsoft Corporation This submission is subject to the Wi-Fi Alliance IPR policy, if adopted as a specification by the Wi-Fi Alliance. Contents
B.1. Overview and Scope B.1.1. Focus and Goals for DCP Version 1.0 B.1.2. Non-Goals for DCP Version 1.0 B.1.3. WLAN Security Requirements and Recommendations B.1.3.1. Station Parameter Configuration B.2. Device Definitions B.2.1. Device Type B.2.2. Device Model B.2.2.1. Description of Device Requirements B.2.3. Theory of Operation B.2.3.1. WLAN Node Requirements B.2.3.2. Configuration of New Clients to the WLAN B.3. XML Device Description B.4. Test
B.1 Overview and Scope

This device template complies with the UPnP Architecture, Version 1.0, as a vendor extended UPnP device.
This document defines the REQUIRED ROOT device: urn:schemas-wifialliance-org:device:WFADevice The WFADevice encapsulates services for the WCN-NET Device Control Protocol (DCP). The Wi-Fi Alliance (WFA) device implements IP-based transports (such as Ethernet/802.3 wired standards) to provide an out-of-band mechanism to configure IEEE 802.11 (a, b, and g) settings on the device so the device may authenticate and associate with a secured wireless network and on access points so that the access point may host secure wireless networks.
B.1.1 Focus and Goals for DCP Version 1.0

WCN-NET has specific requirements for creating and extending wireless networks and adding wireless stations: Setup that is simple, a task that a typical consumer can complete Setup process that is secure and must maximize security of the WLAN A consumer focus with some attention to small business cases
B.1.2 Non-Goals for DCP Version 1.0

The following work items were considered to be beyond the scope of this version of the DCP. Replacing or enhancing the link security mechanism of the WLAN Configuration services for access points for "hotspot" and enterprise networks
B.1.3 WLAN Security Requirements and Recommendations

Link security is critical for wireless home network because connectivity is not restricted by the reach of wires or availability of physical ports. The likelihood of unintentional cross-links and malicious drive-by attacks will likely increase along with the popularity of WLANs. This will be detrimental to the user experience with wireless networks and will impede introduction of new product categories and usage models. Consumers and service providers will demand link security as part of the WLAN package. An alternative to link security is to protect specific resources with security mechanisms involving higher (network or application) layers of the networking software stack. However, the average home user cannot be expected to be technically savvy and to take the time to identify all the vulnerable points (data/devices) in the home network for protecting himself or herself individually with appropriate methods. Currently the most common way to secure 802.11 links in the home involves WiredEquivalent Privacy (WEP)based encryption and authentication. The security risks when using WEP are well known. An attacker can crack the WEP key by collecting packets with a wireless packet sniffer and running widely available utilities to determine the WEP key. If the WLAN owner becomes aware of the security compromise, the WEP key on all the clients and access point must be updated because the same WEP key is used for all nodes.
To build consumer confidence and expand usage of wireless applications, it is important for the home WLAN devices to adopt stronger security mechanisms such as Wi-Fi Protected Access (WPA) that has become available in the market. Longer term, it is expected that the security specification being worked on in the 802.11i working group would be the widely adopted and appropriate solution for a strong security mechanism on the access point. The security enhancements provide peruser based authentication, per-session keys, frequent rekeying, and stronger encryption methods such as Advanced Encryption Standard (AES). One of the main issues with the use of security in WLAN is the process of setting up the security parameters. Current mechanisms for initializing link security on an access point device are not very user friendly. For example, with the WEP-based model, the user must retrieve a long WEP key for the access point either through a secure/wired connection first and enter it on the new client correctly. This problem of bootstrapping also exists with the mechanisms proposed as an improvement on the plain WEP-based security. Because of this, users are likely to not enable security in their network, leading to several vulnerabilities. The objective of the 802.11 security initialization mechanism using UPnP as proposed in this document is to reduce user involvement and introduce an intuitive usage model for users to take advantage of the higher level of security. An overall security solution should protect the user from "man-in-the-middle" attacks by preventing the users client from associating with an unfriendly access point and the users access point from associating with a foreign client. It should prevent session-hijack attacks by making sure all messages between the access point and station are authenticated. The objective of the DCP is to enable a secure WLAN solution with combined Wi-Fi and IP-connected devices that implement the required elements specified in the DCP. The following figure shows the major functional components of the WFADevice.
WFADevice WFAWLANConfigService
required
Figure B.1: Functional Components of WFADevice
B.1.3.1 Station Parameter Configuration

The WFAWLANConfig service, a required service of WFADevice, provides state variables for some of the wireless station parameters. They provide the ability to easily configure security and operation parameters, and offer diagnostic information. In addition, UPnP also provides event notification capability to inform clients that are responsible for Wi-Fi device configuration on the status of the Wi-Fi station. The WCN-NET protocol that is imbedded in the exchange between the control point and the WFADevice perform authentication and encryption so that the UPnP actions do not require any additional security. The state variables in any WFADevice service must not return directly the binary data that is contained. If requested for a state variable action, the device may return a null or may choose to
follow the WCN-NET rules and encrypt the contents with an arbitrary SID or the SID of the requesting control point if known.
B.2 Device Definitions

B.2.1 Device Type
The following device type identifies a device that complies with this template:
urn:schemas-wifialliance-org:device:WFADevice:1
B.2.2 Device Model

WFADevice must be implemented with support for the WCN-NET secure association protocol.
B.2.2.1 Description of Device Requirements

The following table briefly describes the purpose of the services that are used in WFADevice.
Service name WFAWLANConfig Service description Configuration parameters associated with a WLAN device that must be accessed programmatically. Req. or opt.1 Service type WFAWLANConfig:1 Nonstandard services embedded by an UPnP vendor go here. 1 R = Required, O = Optional, X = Nonstandard. . 2 Prefixed by urn:wifialliance-org:serviceId: . Req. or opt.1 R X Service ID2 WFAWLANConfig1 TBD
Table B.1: Device Requirements for Stand-alone WFADevice

Device type Root
Figure B.2 shows the logical structure of the device and the single service defined for UPnP-enabled WLAN devices.
WFADevice WFAWLANConfigService
required
Figure B.2: WFAWLANConfig Service within WFADevice
B.2.3 Theory of Operation

This section describes the general usage model of the services defined in the WFA interface device. This section starts by listing the requirements and optional features of the WLAN nodes. This is followed by a section describing the various scenarios reflecting the use of these features. For each of these, the benefits that are enabled by the UPnP services are explicitly highlighted.
B.2.3.1 WLAN Node Requirements

From the perspective of requirements, a WFADevice is a WLAN node that also has an Ethernet or other established IP interface for, at a minimum, the purpose of discovering the device and configuring the WLAN settings of the device. The WLAN node requirements are listed below: The device must be addressable via the Internet Protocol (IP) protocol by using the Ethernet interface. The device must provide a user the ability to physically reset it to factory default settings. The device must implement the WCN-NET protocol. This involves use of a predefined password (typically a PIN) and a public-private key pair and a cryptographic library for encryption and authentication. The device may implement the proxy function as defined in the WFAWLANConfigService v1.0 specification. This service allows for any WLAN station to send an event when a new WLAN enrollee is requesting WLAN configuration. Note that the proxy function is required for access points. B.2.3.1.1 Client Requirements for Configuration of WLAN Parameters If configuration of WLAN parameters over the UPnP/IP channel is desired, at least one client in the LAN should have an interactive user interface. Other WLAN clients may be UPnP enabled or not, and they may be able to execute UPnP control point functionality to send UPnP actions to the WLAN station.
B.2.3.2 Configuration of New Clients to the WLAN

WFAWLANConfig service provides a set of actions to query and modify a set of 802.11 parameters on the WLAN client over an IP interface. Acquisition of the WLAN settings by the registrar performing configuration is performed in several ways: Using the actions defined in the WFAWLANConfigService v1.0 or associated vendor extensions. From a local store on the registrar, possibly from a previous wireless client configuration for networks that use a single PSK. Current wireless settings of the registrar (for a WLAN attached device). Input from the user.
The PSK is encrypted by using the public keybased protocol that is specified the WCN-NET specification. Settings are sent by using the action specified in the WFAWLANConfig service. The data sets are validated and the settings are encrypted by using the WCN-NET exchange mechanism. The WFADevice attempts to associate with the WLAN and reports state.
B.3 XML Device Description

<?xml version="1.0"?> <root xmlns="urn:schemas-upnp-org:device-1-0"> <specVersion> <major>1</major> <minor>0</minor> </specVersion> <URLBase>base URL for all relative URLs</URLBase> <device> <deviceType>urn:schemas-wifiallianceorg:device:WFADevice:1</deviceType> <friendlyName>short user-friendly title</friendlyName> <manufacturer>manufacturer name</manufacturer> <manufacturerURL>URL to manufacturer site</manufacturerURL> <modelDescription>long user-friendly title</modelDescription> <modelName>model name</modelName> <modelNumber>model number</modelNumber> <modelURL>URL to model site</modelURL> <serialNumber>manufacturer's serial number</serialNumber> <UDN>uuid:UUID</UDN> <UPC>Universal Product Code</UPC> <iconList> <icon> <mimetype>image/format</mimetype> <width>horizontal pixels</width> <height>vertical pixels</height> <depth>color depth</depth> <url>URL to icon</url> </icon>  </iconList> <serviceList> <service> <serviceType>urn:schemas-wifiallianceorg:service:WFAWLANConfig:1</serviceType> <serviceId>urn:wifiallianceorg:serviceId:WFAWLANConfig1</serviceId> <SCPDURL>URL to service description</SCPDURL> <controlURL>URL for control</controlURL> <eventSubURL>URL for eventing</eventSubURL> </service>  </serviceList> <deviceList> Description of embedded devices added by UPnP vendor (if any) go here </deviceList> <presentationURL>URL for presentation</presentationURL> </device> </root>
B. 4 Test
No semantic tests are defined for this device.
Appendix C. WFAWLANConfig:1 Service Template Version 1.01

For UPnP Version 1.0 Date: January 23, 2006 Authors: David Roberts, Microsoft Corporation Victor Lortz, Intel Corporation Notice THE SPECIFICATION IS PROVIDED "AS IS," AND INTEL CORPORATION AND MICROSOFT CORPORATION (INTEL AND MICROSOFT) MAKE NO REPRESENTATIONS OR WARRANTIES, EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, OR TITLE; THAT THE CONTENTS OF THE SPECIFICATION IS SUITABLE FOR ANY PURPOSE; NOR THAT THE IMPLEMENTATION OF SUCH CONTENTS WILL NOT INFRINGE ANY THIRD PARTY PATENTS, COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS. NEITHER INTEL NOR MICROSOFT SHALL BE LIABLE FOR ANY DIRECT, INDIRECT, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF ANY USE OF THE SPECIFICATION OR THE PERFORMANCE OR IMPLEMENTATION OF THE CONTENTS THEREOF. The name and trademarks of Intel and Microsoft may NOT be used in any manner, including advertising or publicity pertaining to the Specification or its contents without specific, written prior permission. Title to copyright in the Specification will at all times remain with Intel and Microsoft. No other rights are granted by implication, estoppel or otherwise. Copyright 2005, 2006 Intel Corporation and Microsoft Corporation This submission is subject to the Wi-Fi Alliance IPR policy, if adopted as a specification by the Wi-Fi Alliance. Contents
C. 1. Overview and Scope C. 2. Service Modeling Definitions C. 2.1. ServiceType C. 2.2. State Variables C. 2.2.1. Message C. 2.2.2. InMessage C. 2.2.3. OutMessage C. 2.2.4. DeviceInfo C. 2.2.5. APSettings C. 2.2.6. APStatus C. 2.2.7. STASettings C. 2.2.8. STAStatus C. 2.2.9. WLANEvent C. 2.2.10. WLANEventType C. 2.2.11. WLANEventMAC C. 2.3. Eventing and Moderation C. 2.3.1. Event Model C. 2.4. Actions C. 2.4.1. GetDeviceInfo C. 2.4.2. PutMessage C. 2.4.3. GetAPSettings
C. 2.4.4. SetAPSettings C. 2.4.5. DelAPSettings C. 2.4.6. GetSTASettings C. 2.4.7. SetSTASettings C. 2.4.8. DelSTASettings C. 2.4.9. PutWLANResponse C. 2.4.10. SetSelectedRegistrar C. 2.4.11. RebootAP C. 2.4.12. ResetAP C. 2.4.13. RebootSTA C. 2.4.14. ResetSTA C. 2.4.15. Nonstandard Actions Implemented by a UPnP Vendor C. 2.4.16. Common Error Codes C. 2.5. Theory of Operation C. 2.5.1. Establishing a Registrar with an Access Point and Access Point Management. C. 2.5.2. Proxy Function C. 2.5.3. Initialization and Configuration of the Ethernet-Connected Wireless Device C. 3. XML Service Description C. 4. Test
C.1 Overview and Scope

This service definition complies with the UPnP Device Architecture, Version 1.0. This service enables the configuration of IEEE 802.11 wireless stations and access points by using IP-based channels such as Ethernet and provides a proxy function between the IP network and 802.11 WCN-NET frames. It leverages the data structure and protocols defined for WCN-NET to reduce device complexity for supporting the UPnP methods. This service-type enables the following functions: Device type and information. Proxy function on access points and optionally other devices to enable IPbased registrars to configure WLAN enrollees. Device information and capabilities. Secured exchange with UPnP devices for retrieving and configuring wireless parameters for access point management and wireless setup of Ethernet-attached stations.
C.2 Service Modeling Definitions

C.2.1 ServiceType
The service is required as specified in:
urn:schemas-wifialliance-org:device:WFADevice:1
The following service type identifies a service that complies with this template:
urn:schemas-wifialliance-org:WFAWLANConfig:1
This service does not support the QueryStateVariable action.
C.2.2 State Variables

Table C.1 shows all of the state variables of the WFAWLANConfig service. These variables are represented in the following order: The first set of variables is for message exchange. The second set shows the device capabilities message. The third set has the device configuration messages. The last set lists evented messages.
Req. or opt.1 R R R R C C C C C C C Data type Bin.base64 Bin.base64 Bin.base64 Bin.base64 Bin.base64 ui1 Bin.base64 ui1 Bin.base64 ui1 String Allowed value1 See WCN-NET See WCN-NET See WCN-NET Default value2 N/A N/A N/A N/A N/A 0 N/A 0 N/A N/A N/A Eng. units N/A N/A N/A N/A N/A N/A N/A
Table C.1: State Variables

Variable name Message InMessage OutMessage DeviceInfo APSettings APStatus STASettings STAStatus WLANEvent WLANEventType WLANEventMAC
See Table C.2 See Table C.2 See WCN-NET See Table C.3 MAC Address, xx:xx:xx:xx:xx:xx, case-independent, 17 char TBD
Nonstandard state X TBD TBD TBD variables implemented by an UPnP vendor go here. 1 R = Required, O = Optional, C = Conditional, X = Nonstandard 2 Values listed in this column are required. To specify standard optional values or to delegate assignment of values to the vendor, reference a specific instance from the appropriate following table.
C.2.2.1 Message
This variable contains the TLV format for the data components passed in the message exchange between the registrar and the enrollee. The message identification (M2 through M8) is contained in the TLV binary format. Messages received from WLAN devices via Probe requests and WCN-NET 802.1X/EAP methods are evented.
C.2.2.2 InMessage
This variable contains the TLV format for the data components passed in the message exchange between the registrar and the enrollee. The message identification (M2-M8) is contained in the TLV binary format. Messages received from WLAN devices via Probe requests and WCN-NET 802.1X/EAP methods are evented. This provides separation of state variables for actions that use both input and output messages, such as PutMessage.
C.2.2.3 OutMessage
This variable contains the TLV format for the data components passed in the message exchange between the registrar and the enrollee. The message identification (M2-M8) is contained in the TLV binary format. Messages received from WLAN devices via Probe requests and WCN-NET 802.1X/EAP methods are evented. This provides separation of state variables for actions that use both input and output messages, such as PutMessage.
C.2.2.4 DeviceInfo
This variable contains the WCN-NET data components in TLV format that are provided in message M1. The allowed list is defined in the WCN-NET specification.
C.2.2.5 APSettings
This variable contains the TLV format for the data components passed in the management interface between the registrar and the access point and carries a message that is defined based on the action. This variable is required for access points. APSettings are authenticated, and some parts are also encrypted. The symmetric keys for authentication and encryption are derived during the registrar configuration process. The SID attribute included in the messages enables the access point and registrar to determine which keys to use. The APSettings data components are transported in the Encrypted Settings data component value field. The APSettings data components are described in the WCN-NET specification. Attributes retrieved by GetAPSettings are described as a GetAPSettings output message. Those set by SetAPSettings, are described as a SetAPSettings message. Those removed by DelAPSettings are described as a DelAPSettings message.
C.2.2.6 APStatus
This variable represents changes in the status of an access point. It is used in eventing to indicate changes on the access point that are related to configuration and attack mitigation. Table C.2 indicates the flag values of this field. It is required for access points. Table C.2. Allowed Value List for APStatus
Value Req. or opt.1 Description 0x00000001 R Configuration change 0x00000010 R Failed auth threshold reached (APLocked) 1 R = Required, O = Optional, C = Conditional, X = Nonstandard
C.2.2.7 STASettings
This variable contains the TLV format for the data components passed in the configuration interface between the registrar and an established station on the WLAN and carries a message that is defined based on the action. This variable is required for 802.11 stations that support Ethernet configuration. STASettings are encrypted and authenticated. The symmetric key is derived during the registrar configuration process and is referenced by using the Key Identifier data component. The STASettings data components are transported in the Encrypted Settings data component value field (preceded by a Key Identifier). The STASettings data components are described in the WCN-NET specification in the section entitled "STASettingsMessage."
C.2.2.8 STAStatus
This variable represents changes in the status of a station. It is used in eventing to indicate changes on the station that are related to configuration and attack mitigation. Table C.2 indicates the flag values of this field. It is required for 802.11 stations.
C.2.2.9 WLANEvent
This variable represents the concatenation of the WLANEventType, WLANEventMac, and the 802.11 WSC message received from the enrollee and forwarded by the proxy over UPnP. It is required for access points and other proxies. WLANEvent is represented as base64 (WLANEventType || WLANEventMAC || Enrollees message).
C.2.2.10 WLANEventType
This variable represents the type of WLANEvent frame that was received by the proxy on the 802.11 network. Table C.3 shows the options for this variable. This variable is required for access points and any other device that implements the proxy function. Table C.3. Allowed Value List for WLANEventType
Value Req. or opt.1 Description 1 R 802.11 WCN-NET Probe Frame 2 R 802.11 WCN-NET 802.1X/EAP Frame 1 R = Required, O = Optional, C = Conditional, X = Nonstandard
C.2.2.11 WLANEventMAC
This variable represents the MAC address of the WLAN enrollee that generated the 802.11 frame that was received by the proxy. This variable is required for access points and any other device that implements the proxy function.
C.2.3. Eventing and Moderation

Table C.4 lists the events generated in this service where the first three are generated as part of a single propertyset and the remainder are independently generated. A single event is generated by each WCN-NET probe and 802.1X/WCN-NET EAP frame that is received on the 802.11 network. The remaining state variables are not evented. Table C.4. Event Moderation
Variable name Evented Moderated event Max. event rate1 .2 .5 .5 TBD Logical combination OR OR OR TBD Min delta per event2
WLANEvent Yes Yes APStatus Yes Yes STAStatus Yes Yes Nonstandard state TBD TBD variables implemented by an UPnP vendor go here. 1 Determined by N, where Rate = (Event)/(N secs). 2 (N) * (allowedValueRange Step).
TBD
C.2.3.1. Event Model

Three state variables in the WFAWLANConfig service are evented: WLANEvent: This state variable event indicates that a WCN-NET Probe request or an 802.1X/WCN-NET EAP frame was received on the 802.11 network. The proxy service issues the event. APStatus: This state variable event indicates that the access point has either had a configuration change or that the access point has had too many failed authentications against its PIN/password and has locked itself out of enrollee mode. STAStatus: This state variable event indicates that the station has either had a configuration change or that the station has had too many failed authentications against its PIN/password and has locked itself out of enrollee mode. The events are moderated.
C.2.4 Actions
Table C.5 lists the required and optional actions for the WFA device WFAWLANConfig service. This is followed by detailed information about these actions, including short descriptions of the actions, the effects of the actions on state variables, and error codes defined by the actions. Table C.5. Actions
Name Req. or opt.1 GetDeviceInfo R PutMessage R GetAPSettings C SetAPSettings C DelAPSettings C GetSTASettings C SetSTASettings C DelSTASettings C PutWLANResponse C SetSelectedRegistrar C RebootAP O ResetAP C RebootSTA O ResetSTA C 1 R = Required, O = Optional, C = Conditional.
C.2.4.1 GetDeviceInfo
This action retrieves the devices M1 data. It is required for access points and Ethernet-attached stations. Arguments Table C.6. Arguments for GetDeviceInfo
Argument NewDeviceInfo Direction Out relatedStateVariable DeviceInfo
Dependency on State (if any)
Effect on State (if any) Errors

errorCode 402 errorDescription Invalid Args Description See UPnP Device Architecture section on Control.
C.2.4.2 PutMessage
This action continues the WCN-NET exchange over UPnP to permit establishment of a registrar with an access point and to configure an Ethernet (IP)-attached wireless station. A PutMessage is issued only after receiving M1 from a device from a GetDeviceInfo. PutMessage is used first to send M2 from the registrar to the device (for which a M3 response is expected). Additional round trips in the Registration Protocol are accomplished with subsequent calls to PutMessage. Arguments Table C.7 Arguments for PutMessage
Argument NewInMessage NewOutMessage Direction In Out relatedStateVariable InMessage OutMessage
Dependency on State (if any) Effect on State (if any) Errors

errorCode 402 501 ErrorDescription Invalid Args Action Failed Description See UPnP Device Architecture section on Control. See UPnP Device Architecture section on Control.
C.2.4.3 GetAPSettings
This action is used to directly retrieve settings from an access point for which the registrar already has established a secure association with. The input message is the GetAPSettings input message in the WCN-NET specification. The output message is the GetAPSettings output message in the WCN-NET specification. This action is required for access points. Arguments Table C.8. Arguments for GetAPSettings
Argument NewMessage NewAPSettings Direction IN OUT relatedStateVariable Message APSettings

C.2.4.4 SetAPSettings
This action is used to set settings on an access point for which the registrar already has established a secure association with. The input message is the SetAPSettings message in the WCN-NET specification. This action is required for access points. Arguments Table C.9. Arguments for SetAPSettings
Argument NewAPSettings Direction IN relatedStateVariable APSettings

C.2.4.5 DelAPSettings
This action is used to delete settings or entries on an access point for which the registrar already has established a secure association. The input message is the DelAPSettings message in the WCN-NET specification. This action is required for access points. Arguments Table C.10. Arguments for DelAPSettings
Argument NewAPSettings Direction In relatedStateVariable APSettings

C.2.4.6 GetSTASettings
This action retrieves the settings from an Ethernet-attached wireless device for which a registrar has already established a secure association. The input message is the GetSTASettingsInput message in the WCN-NET specification. The output message is the GetSTASettings output message in the WCN-NET specification. It is required for Ethernet-attached wireless stations. Arguments Table C.11. Arguments for GetSTASettings
Argument Message NewSTASettings Direction In Out relatedStateVariable Message STASettings

C.2.4.7 SetSTASettings
This action sets settings on an Ethernet-connected wireless device for which a registrar has already established a secure association. The input message is the SetSTASettings input message in the WCN-NET specification. It is required for Ethernet-attached wireless stations. Arguments Table C.12. Arguments for SetSTASettings
Argument NewSTASettings Direction In relatedStateVariable STASettings

C.2.4.8 DelSTASettings
This action is used to delete settings or entries on an access point for which the registrar already has established a secure association. The input message is the DelSTASettings input message in the WCN-NET specification. This action is required for Ethernet-attached wireless stations. Arguments Table C.13. Arguments for DelSTASettings

C.2.4.9 PutWLANResponse
This action is used to send messages to a wireless enrollee via the proxy function. The registrar must subscribe to events from the proxy function that forwards enrollee requests and the registrar responds via PutWLANResponse to continue the registration protocol exchange. Arguments Table C.14 Arguments for PutWLANResponse
Argument NewMessage NewWLANEventType NewWLANEventMAC Direction In In In relatedStateVariable Message WLANEventType WLANEventMAC

C.2.4.10 SetSelectedRegistrar
This action is used to inform the proxy that the registrar has been selected (such as the registrar button has been pushed) and that the proxy indicates to enrollees that a registrar subscribed to its events has been selected. It is required for proxies. The input message is the SetSelectedRegistrar message in the WCN-NET specification. Arguments Table C.15. Arguments for RebootAP
Argument NewMessage Direction In relatedStateVariable Message

C.2.4.11 RebootAP
This action requests the access point to reboot and may optionally provide a new configuration instead of an existing configuration to be set before reboot. This command requires a previously established secure association between the access point and the registrar. The access point must confirm the validity of the request by checking the hash of the message before performing a reboot. The input message is the ResetAP message in the WCN-NET specification. Arguments Table C.16 Arguments for RebootAP
Argument NewAPSettings Direction In relatedStateVariable APSettings
Dependency on State (if any)
Effect on State (if any) Errors

C.2.4.12 ResetAP
This action requests the access point to reset its configuration to factory settings. The APSetting variable is provided to authenticate the source of the request. This action requires a previously established secure association between the access point and the registrar. The access point must confirm the validity of the request by checking the hash of the message before performing a reboot. The input message is the ResetAP message in the WCN-NET specification. This action is required for access points. Arguments Table C.17. Arguments for ResetAP

C.2.4.13 RebootSTA
This action requests the UPnP station to reboot and may optionally provide a new configuration instead of an existing configuration to be set before reboot. This action requires a previously established secure association between the station and the registrar. The input message is the ResetAP message in the WCN-NET specification. The station must confirm the validity of the request by checking the hash of the message before performing a reboot. Arguments Table C.18. Arguments for RebootSTA

C.2.4.14 ResetSTA
This action requests the station to reset its configuration to factory settings. The STASettings variable is provided to authenticate the source of the request. This action requires a previously established secure association between the station and the registrar. The input message is the ResetAP message in the WCN-NET specification. The station must confirm the validity of the request by checking the hash of the message before performing a reboot. This action is required for stations that implement the WFAWLANConfig service. Arguments Table C.19. Arguments for ResetSTA

C.2.4.15 Nonstandard Actions Implemented by a UPnP Vendor

To facilitate certification, nonstandard actions implemented by UPnP vendors should be included in this service template. The UPnP Device Architecture lists naming requirements for nonstandard actions (see the section on Description).
C.2.4.16 Common Error Codes

Table C.20 lists error codes common to actions for this service type. If an action results in multiple errors, the most specific error should be returned. Table C.20. Common Error Codes for all actions
ErrorCode 401 402 404 501 600-699 701-799 800-899 TBD errorDescription Invalid Action Invalid Args Invalid Var Action Failed TBD Description See UPnP Device Architecture section on Control. See UPnP Device Architecture section on Control. See UPnP Device Architecture section on Control. See UPnP Device Architecture section on Control. Common action errors. Defined by UPnP Forum Technical Committee. Common action errors defined by the UPnP Forum working committees. (Specified by UPnP vendor.)
C.2.5 Theory of Operation

C.2.5.1 Establishing a Registrar with an Access Point and Access Point Management
When an access point initializes on the network, it advertises the WFADevice and the WFAWLANConfig service to the UPnP network. A device detects the notification and retrieves the DeviceInfo (M1 message in the Registration Protocol) to determine an access point with which it wants to establish itself as a registrar and follows the same WCN-NET process, validating with the access point via a PIN (or password if set) over the PutMessage UPnP action. After the secure association is
established between the pair, the registrar may add or remove station configurations or reconfigure the WLAN by using the TLV over UPnP methods defined herein, referencing the secure association via the Session ID (SID) by using the various access point configuration actions.
C.2.5.2 Proxy Function

The proxy function bridges the UPnP network and the UPnP network to forward notification of the existence of a device that wants to receive WLAN configuration. A registrar receives the requests by subscribing to the UPnP event service provided by the proxy function and performs the WCN-NET exchange with the enrollee over UPnP by using the WLANEvent/WLANEventType/WLANEventMAC event and the PutWLANResponse action. The proxy function must cache registrar responses to Probe request events and to EAP message exchanges so that the enrollee may get information serially for each registrar that is using the proxy function on a device. The 802.11 mechanisms are described in the WCN-NET specification.
C.2.5.3 Initialization and Configuration of the Ethernet-Connected Wireless Device

When an Ethernet-connected wireless device initializes on the network, it advertises WFADevice and the WFAWLANConfig service to the UPnP network. A device detects the notification and retrieves DeviceInfo to determine that it is a wireless station that needs wireless settings over Ethernet and follows the WCN-NET process, validated the station with a PIN (or password if set) over the UPnP GetMessage and PutMessage actions. After the secure association is established between the pair, the device can be accessed directly via GetSTASettings and SetSTASettings at a later time if returned to the Ethernet network or optionally over the wireless network by referencing the Session ID (SID).
C.3 XML Service Description

<?xml version="1.0"?> <scpd xmlns="urn:schemas-upnp-org:service-1-0"> <specVersion> <major>1</major> <minor>0</minor> </specVersion> <actionList> <action> <name>GetDeviceInfo</name> <argumentList> <argument> <name>NewDeviceInfo</name> <direction>out</direction> <relatedStateVariable>DeviceInfo</relatedStateVariable> </argument> </argumentList> </action> <action> <name>PutMessage</name> <argumentList> <argument> <name>NewInMessage</name> <direction>in</direction> <relatedStateVariable>InMessage</relatedStateVariable> </argument> <argument> <name>NewOutMessage</name> <direction>out</direction> <relatedStateVariable>OutMessage</relatedStateVariable> </argument> </argumentList> </action> <action> <name>GetAPSettings</name> <argumentList> <argument> <name>NewMessage</name> <direction>in</direction> <relatedStateVariable>Message</relatedStateVariable> </argument> <argument> <name>NewAPSettings</name> <direction>out</direction>
<relatedStateVariable>APSettings</relatedStateVariable> </argument> </argumentList> </action> <action> <name>SetAPSettings</name> <argumentList> <argument> <name>APSettings</name> <direction>in</direction> <relatedStateVariable>APSettings</relatedStateVariable> </argument> </argumentList> </action> <action> <name>DelAPSettings</name> <argumentList> <argument> <name>NewAPSettings</name> <direction>in</direction> <relatedStateVariable>APSettings</relatedStateVariable> </argument> </argumentList> </action> <action> <name>GetSTASettings</name> <argumentList> <argument> <name>NewMessage</name> <direction>in</direction> <relatedStateVariable>Message</relatedStateVariable> </argument> <argument> <name>NewSTASettings</name> <direction>out</direction> <relatedStateVariable>STASettings</relatedStateVariable> </argument> </argumentList> </action> <action> <name>SetSTASettings</name> <argumentList> <argument> <name>NewSTASettings</name> <direction>out</direction>
<relatedStateVariable>STASettings</relatedStateVariable> </argument> </argumentList> </action> <action> <name>DelSTASettings</name> <argumentList> <argument> <name>NewSTASettings</name> <direction>in</direction> <relatedStateVariable>STASettings</relatedStateVariable> </argument> </argumentList> </action> <action> <name>PutWLANResponse</name> <argumentList> <argument> <name>NewMessage</name> <direction>in</direction> <relatedStateVariable>Message</relatedStateVariable> </argument> <argument> <name>NewWLANEventType</name> <direction>in</direction> <relatedStateVariable>WLANEventType</relatedStateVariable> </argument> <argument> <name>NewWLANEventMAC</name> <direction>in</direction> <relatedStateVariable>WLANEventMAC</relatedStateVariable> </argument> </argumentList> </action> <action> <name>SetSelectedRegistrar</name> <argumentList> <argument> <name>NewMessage</name> <direction>in</direction> <relatedStateVariable>Message</relatedStateVariable> </argument> </argumentList> </action> <action> <name>RebootAP</name> <argumentList> <argument> <name>NewAPSettings</name> <direction>in</direction>
<relatedStateVariable>APSettings</relatedStateVariable> </argument> </argumentList> </action> <action> <name>ResetAP</name> <argumentList> <argument> <name>NewMessage</name> <direction>in</direction> <relatedStateVariable>Message</relatedStateVariable> </argument> </argumentList> </action> <action> <name>RebootSTA</name> <argumentList> <argument> <name>NewSTASettings</name> <direction>in</direction> <relatedStateVariable>APSettings</relatedStateVariable> </argument> </argumentList> </action> <action> <name>ResetSTA</name> <argumentList> <argument> <name>NewMessage</name> <direction>in</direction> <relatedStateVariable>Message</relatedStateVariable> </argument> </argumentList> </action> </actionList> <serviceStateTable> <stateVariable sendEvents="no"> <name>Message</name> <dataType>bin.base64</dataType> </stateVariable> <stateVariable sendEvents="no"> <name>InMessage</name> <dataType>bin.base64</dataType> </stateVariable> <stateVariable sendEvents="no"> <name>OutMessage</name> <dataType>bin.base64</dataType> </stateVariable> <stateVariable sendEvents="no"> <name>DeviceInfo</name> <dataType>bin.base64</dataType> </stateVariable> <stateVariable sendEvents="no"> <name>APSettings</name> <dataType>bin.base64</dataType> </stateVariable> <stateVariable sendEvents="yes">
<name>APStatus</name> <dataType>ui1</dataType> </stateVariable> <stateVariable sendEvents="no"> <name>STASettings</name> <dataType>bin.base64</dataType> </stateVariable> <stateVariable sendEvents="yes"> <name>STAStatus</name> <dataType>ui1</dataType> </stateVariable> <stateVariable sendEvents="yes"> <name>WLANEvent</name> <dataType>bin.base64</dataType> </stateVariable> <stateVariable sendEvents="no"> <name>WLANEventType</name> <dataType>ui1</dataType> </stateVariable> <stateVariable sendEvents="no"> <name>WLANEventMAC</name> <dataType>string</dataType> </stateVariable> <stateVariable sendEvents="no"> <name>WLANResponse</name> <dataType>bin.base64</dataType> </stateVariable> </serviceStateTable> </scpd>
C.4 Test
No semantic tests have been defined for this service.
Microsoft Windows Rally Program License Agreement September 2006 A 1

WCN Netspec

Uploaded by

Copyright:

Available Formats

WCN Netspec

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

WCN Netspec

Uploaded by

Copyright:

Available Formats

A WINDOWS RALLY SPECIFICATION

Windows Connect NowNET

Version 1.1 December 8, 2006

Windows Connect NowNET - 2

Windows Connect NowNET - 3

Windows Connect NowNET - 4

Windows Connect NowNET - 5

WCN-NET User Experience

Set up a Wireless Access Point or Use the Router Wizard

Windows Connect NowNET - 6

To run the wizard:

Windows Connect NowNET - 7

Windows Connect NowNET - 8

6. To continue the configuration process, type a device PIN. Click Next.

Windows Connect NowNET - 9

Use the Add a Wireless Device Wizard

Windows Connect NowNET - 10

To run the wizard:

2. Choose the device that you want to add.

Windows Connect NowNET - 11

Double-Click the Device in Network Explorer

Windows Connect NowNET - 12

User Experience Pamphlet in the Box for Access Points

Windows Connect NowNET - 13

Figure 1. WCN-NET Components

Registration in Windows Vista

Windows Connect NowNET - 14

Figure 2 describes the Registration Protocol message exchange.

Figure 2: Registration Protocol Message Exchange

Windows Connect NowNET - 15

Windows Connect NowNET - 16

Summary and Classification of Keys

gABmod p KDK AuthKey KeyWrapKey PSK1 PSK2 EMSK

Windows Connect NowNET - 17

The generator is: 2. Derivation of KDK

Derivation of AuthKey, KeyWrapKey, and EMSK

Windows Connect NowNET - 18

Windows Connect NowNET - 19

Registration Message Attributes

Windows Connect NowNET - 20

Attribute Configuration Error Device Password ID

Specific RF band used for this message

Windows Connect NowNET - 21

Specific RF band used for this message

Windows Connect NowNET - 22

SSID Authentication Type

Windows Connect NowNET - 23

Table 14. Encrypted Attributes in M8 for Station

Table 16. WCN-NET_Ack

Table 17. WCN-NET_Nack

Table 18. WCN-NET_Done

Version Message Type Enrollee Nonce Registrar Nonce

Transportation of Registration Protocol Messages

Windows Connect NowNET - 24

EAP Transport of Registration Protocol

Windows Connect NowNET - 25

EAP Message Framing

Windows Connect NowNET - 26

EAP Message Fragmentation and Reassembly

Windows Connect NowNET - 27