Of course, labeling WiMax a "standard" is something of a misnomer. The actual standard for the MAN-scale wireless solutions that WiMax is based on is IEEE 802.16, which has never been fully adopted. In fact, WiMax is the creation of the WiMax Forum, which is a group of loosely affiliated vendors, suppliers, and engineers worldwide who are trying to standardize a wireless broadband technology for last-mile applications based on the IEEE 802.16e-2005 specification.

When you buy a "WiMax" product you are actually procuring an IEEE 802.16e-2005 compliant device that has been tested and certified as interoperable by the WiMax Forum -- not a truly IEEE 802.16 compliant device. The WiMax Forum maintains a rigid certification program that ensures standards of conformance and interoperability for "WiMax Forum Certified" products. Only four laboratories worldwide are approved to conduct this certification testing: AT4 Wireless, Telecommunications Technology Association, China Academy of Research of Telecommunication Research, and Advance Data Technology Corporation.

How WiMax Works

At the 65,000-foot level, WiMax looks remarkably like a traditional IEEE 802.11x implementation. Subscriber nodes use network access cards to wirelessly connect to a base station, which is typically connected to some accessible network or the Internet.

The primary differences are under the hood. For one, WiMax was designed from the ground up to provide quality of service (QoS) in order to ensure a reliable minimum data rate and availability. To provide QoS, WiMax certified equipment is designed to implement a scheduling algorithm to ensure each subscriber station competes for access only once. From that point forward, the base station provides a time slot that is allocated to each unique subscriber station. This schedule-based solution is far different from that of WiFi, which uses a contention-based media access control scheme where all subscriber stations compete for the same base station's attention on a random, interrupt-driven basis. This is one reason bandwidth varies so much with range from the base station in WiFi implementations: subscribers closer to the base station can simply be heard better, and pre-empt those at more distant ranges. WiMax still suffers from bandwidth degradation over extended ranges, but not nearly as significantly. The inclusion of QoS makes applications such as voice-over-IP (VoIP) much easier to implement, because a relatively constant bandwidth and QoS can be assumed at any given range.

Spectrum usage is significantly different in WiMax applications when compared to WiFi. The IEEE 802.16 specification supports both 2-to-11 GHz and 10-to-66 GHz ranges. Lower frequencies generally provide greater range in the kind of urban environments WiMax is targeted, so frequency ranges above 66 GHz have never been considered suitable for IEEE 802.16 or the WiMax implementation. Also, since IEEE 802.16 remains in draft, there is no globally licensed spectrum at this point. The WiMax Forum, in its quest to ensure interoperability, has licensed three spectrum profiles: 2.3 GHz, 2.5 GHz, and 3.5 GHz. In the United States, the most common implementation is expected to be centered on 2.5 GHz. Outside of the United States, spectrum profiles vary with the radio-frequency spectrum licensing supported by the geopolitical unit in which WiMax implementations are deployed.

From a security perspective, WiMax offers several key advantages over traditional WiFi implementations. WiFi truly revolutionized the way we deliver bandwidth to subscribers, especially mobile ones, but it has always lacked key security features. This lack of security enabled attackers to ruthlessly exploit early adopters of the technology and even today, most access points are unsecured and a large amount of traffic passes in the clear, allowing any casual passers-by or attacker to sniff sensitive information over the air.

Worse, in its native configuration, WiFi does not implement robust authentication at the base station, allowing attackers to deploy rogue access points that they control, which can collect or modify every packet traversing the access point. While remedies do exist (such as WEP and WPA/WPA2), they were bolted on to WiFi to remedy these vulnerabilities.

WiMax was developed from scratch with security in mind. First, every subscriber station uses X.509 certificates to uniquely identify its subscribers. This effectively prevents attackers from spoofing the identity of legitimate subscribers. The goal in adopting this paradigm was to make theft-of-service more difficult. Second, the WiMax supports two robust encryption standards: DES and AES. In a secure implementation, WiMax is designed to use EAP (or IEEE 802.1x) for strong mutual authentication and can enable RSA for data link encryption, although this requires additional hardware within the enterprise (a RADIUS server, etc.) coupled with the use of WiMax.

Potential WiMax Applications

Originally envisioned as a wireless alternative for fixed, MAN-scale networks, WiMax is now being considered for a variety of applications, ranging from last-mile connectivity to a replacement for 802.11x mesh networks. Thanks to the commitment of vendors to the proposed IEEE 802.16x-2005 mobile standard (considered "WiMax Compatible"), WiMax technology is being pushed out to handsets and laptops. Intel in particular has made a major push for early WiMax adoption, but more than 30 companies provide WiMax Forum Certified fixed implementation technology.