Protocol
The WPS protocol consists as a series of EAP message exchanges that are triggered by a user action and relies on an exchange of descriptive information that should precede that user's action.
The descriptive information is transferred through a new Information Element (IE) that is added to the beacon, probe response and optionally to the probe request and association request/response messages. Other than purely informative type-length-values, those IEs will also hold the possible, and the currently deployed, configuration methods of the device.
After the identification of the device's capabilities on both ends, a human trigger is used to initiate the actual session of the protocol. The session consists of 8 messages that are followed, in the case of a successful session, by a message to indicate the protocol is done. The exact stream of messages may change when configuring different kinds of devices (AP or STA) or using different physical media (wired or wireless).
Read more about this topic: Wi-Fi Protected Setup