KMS Microservices

The Key Management Service (KMS) Microservices play a critical role in optimizing client mobility within the wireless network. They facilitate faster and consistent roaming of Stations (STAs) across Access Points (APs), ensuring minimal disruption to connectivity. Additionally, they ensure that STA entries are cleaned up on their home AP after roaming.

This topic contains the following microservices information:

Key Management

  • Facilitates fast roaming of 802.11r and Opportunistic Key Caching (OKC) STAs by pre-synching keycache to AirMatch RF neighbors.

  • Facilitates On-Demand keycache Fetch for 802.11r STAs when the Target AP does not have a STA's Pairwise Master Key (PMK) cached or has a different PMK.

  • Maintains a Synched AP List and limited roam history for 802.11r and OKC STAs.

  • Publishes Enriched Events when On-Demand keycache Fetch is requested by an AP.

  • Learns VAP/BSSID information from the AP State Enricher over Kafka (for computing PMK-R1 from PMK-R0).

  • For 802.11r STAs, the AP securely transports PMK-R0 to Key Management Service by doing the following:

    • A unique RSA key pair is generated and stored in K8s secrets.

    • The AP gets the public key from the Key Management Service upon establishing a WS connection to New Central.

    • In case of a public key mismatch, the Key Management Service pushes the latest public key to the AP.

Nbrapinfo Distributor

  • Assists APs to form DTLS connections with its AirMatch RF neighbors.

  • Learns AP IP and MAC Addresses from AP State Enricher over Kafka and publishes this information to the APs.

  • Periodically polls APs to get the latest neighbor AP information from AirMatch and publishes when there is a change in the RF neighborship.

Cache Synchronization for Non-Fast-Roaming Users

Previously, user cache synchronization included user key information that was exclusively reserved for fast-roaming users like 802.11r users, Opportunistic Key Caching (OKC) users, or Multi Pre-Shared Key (MPSK) users. However, a requirement has emerged to extend cache synchronization to non-fast-roaming users, such as Captive Portal users and MAC authentication users. To address this requirement, cache synchronization between neighboring APs was introduced. Among other things, this enhancement shares context for non-fast clients such as VLAN, Role, and multi-session-ids for accounting. See KMS Microservices for more detailed information.

In HPE Aruba Networking Central, there are two types of cache structures:

  • Key cache structure: This structure is utilized for fast-roaming clients.

  • Partial and full cache structure: This structure is utilized for non-fast-roaming clients.

Cache Classification

To optimize cache distribution, cache entries are classified into three distinct types:

  • Partial Roam Cache: This cache structure exclusively contains essential information necessary during roaming. For non-fast-roaming users, the Partial Roam Cache is synchronized with neighboring APs.

  • Full Roam Cache: In addition to the data found in the Partial Roam Cache, the Full Roam Cache includes supplementary station-related state information that might not be immediately required during roaming. The Full Roam Cache entry is consistently available in Key Management Service (KMS) and on the AP to which the client is currently associated.

  • Key Cache: This specific cache structure is exclusively employed by fast-roaming users. It houses station keys essential for fast roaming, including Pairwise Master Key (PMK), PMKR0, PMKR1 (per-BSSID), Multi Pre-Shared Key (MPSK), and comprehensive Full Roam Cache information.

Roam Cache

The Roam Cache microservice does the following: 

  • Shares wireless STA context between APs as the STAs roam (see Roam Cache Attributes).

  • Synchronizes Partial Roam Cache for non-fast roaming STAs to AirMatch RF neighbors. The Roam Cache service ensures:

    • The AP sends the mobility session request on the correct VLAN.

    • The RADIUS accounting session continues if there is a loss of L3 roam message exchange with the old AP.

A list of Roam Cache Attributes is given below: 

Note:

The AP where the station currently resides will have a Full Roam Cache while the neighboring APs will have a Partial Roam Cache.

Table 1: Roam Cache Attributes

Full Roam Cache Partial Roam Cache

  • ESSID

  • Multi-session-Id

  • Class ID Attributes (multiple)

  • Role

  • Sequence Number

  • Username

  • VLAN

  • Re-auth Interval

  • Accounting Interval

  • Idle Timeout

  • Session Timeout

  • Redirect URL

  • Radius CUID

  • ESSID

  • Multi-session-ID

  • Class ID Attributes (multiple)

  • Role

  • Sequence Number

  • Username

  • VLAN

Cloud Fallback

  • Utilizes Client Roam history maintained by Key Management and Roam Cache services.

  • Requests the Home AP to send session response to the Target AP when the session request/response exchange between APs fails in the network.

  • Assists the Home AP and Target AP to form an Ephemeral DTLS Connection in case DTLS connections are not already formed. This service is needed for APs to exchange STA Move Requests and STA Move Response messages (L3).

  • Assists in STA cleanup on Home APs when the L3 roam message exchange fails.

Key Management API Service

  • Receives and processes API requests, providing the information needed for verification and debugging.