Aug. 5, 2020
IAM WG Meeting @ APAN50, Virtual / Hong Kong

Cityroam and OpenRoaming,Providing Secure Public Wireless LAN
Services with eduroam
Hideaki Goto Tohoku University / NII1

Why City/Free Wi‐Fi & off‐campus eduroam?
 Tourism Smart Cities, IoT
 Provide citizens with access means for various

digital services.
 “Wi-Fi for all.” (WiFi4EU by European Commission)
resolving digital divides
 Community supports for Research & Education.

What are needed?
 Secure connections with good usability Free roaming User identity verification and traceability(for security, trusts between operators, and compliance) 2

eduroam / Free Wi‐Fi amid the COVID‐19 pandemic Campuses and mobility have been heavily affected.
 eduroam traffic drops, but is active at some places

like hospitals.
 Would Wi-Fi roaming help students refrain from
commuting far to their own universities?
 Students & staff suffer from telecommunication fees.
 Improving the learning environment in the digitalera is crucial.
 Free Wi-Fi at nearby facilities must be useful.
 Security and roaming are important.
3

How can we deploy off‐campus eduroam services?
 Ask Free Wi-Fi operators to add “eduroam” SSID.

 conventional way w/ minimal impact to the users
 costly as many Free Wi-Fi systems require

additional supports for dot1X
 enabling a lot of SSIDs hits the AP’s limit andalso deteriorates the performance
Newscheme Enable roaming with secured Free Wi-Fi
 much easier in negotiating with the operators  simple system, lower cost  different SSIDs Passpoint/NGH is a hope.
4

Passpoint (aka Hotspot 2.0)
OSU

Online Sign-Upsystem (Rel. 2)

Venue URL, For better UI/UX (Rel. 3)
etc.

IEEE 802.11u
GAS: Generic Advertisement Service
ANQP: Access Network Query Protocol

IEEE 802.1x
EAP‐SIM/AKA, EAP‐TLS, EAP‐TTLSProfiles matching
between AP and terminal.
(key: NAI realm, OI, or
MCC/MNC)
Automatic SSID selection.
(SSID no longer acts asa service selector.)
Same as theconventional dot1X,
enabling automatic &secure connections.

Next Generation Hotspot (NGH):
Passpoint + Roaming (+ something sophisticated)

5

Passpoint is gaining popularity
 Some operators provide secure Wi-Fi option:
 San Francisco & San Jose Wi-Fi (2014)
 Orange Romania (2014)
 LinkNYC (2016), InLinkUK (2017)
 Boingo Passpoint Secure at

40+ airports in US, Brazil, Portugal, UK, ...
 Some US phones come with built-in
Passpoint, enabling automatic
Look!
connection to Wi-Fi OpenRoaming (2020)
Wi‐Fi Alliance andWireless Broadband Alliance(WBA) are promoting
Passpoint/NGH.

6

What we have been doing…
 Next Generation Hotspot Special Interest Group(NGHSIG) (since Jan. 2017)https://nghsig.jp/en/ Participation in the WBA City Wi-Fi Roaming trial 2017 The first eduroam on the NGH in the world.
 Cityroam federation in Japan (since 2018)
 Participation in the WBA City Wi-Fi Roaming trial 2018 eduroam NO, NL, and US joined, too.
 WBA OpenRoaming launched (2020)

 Cityroam/eduroam JP - OpenRoaming development
 eduroam - OpenRoaming development(GÉANT)
7

Cityroam, the secure roaming system for Public Wi‐Fi
 Passpoint/NGH as well as dot1X
 Affordable roaming platform for various Roaming

Consortia and operators (SMB, cities, etc.)
 IdP: eduroam, ANYROAM, Cityroam Cloud IdP, etc.

(planned: telcos/ISPs and cities via OpenRoaming) Strategies:No roaming fee.
(We make the most of the local
ecosystem each Free Wi-Fi has.)Utilize existing accounts
as much as possible.
(roaming with telcos/ISPs)

8

The Cityroam system in Japan
Complex-realm fed.

Simple-realm operators/fed.

WBA/City Wi-Fi, etc.

govroamJP hubSP
Shopping Mall
Wi-Fi,IdP
Seaport Wi-Fi,
Hotel Wi-Fi, etc.

Cityroam
Cloud IdP

TohokuUniversity

IdP/SP

IdP/SP
IdP/SP

Basic
connections
Optional
connections(bilateral)

eduroam & cityroam SSIDs
with Passpoint enabled9Cityroam sites
 Passpoint services on the Cityroam APs in 12 cities/towns.

Cafes, hotels, shopping malls, etc.
Sapporo Gakuin University (for better services for citizens)
Ski resorts (Hakuba47)
Kita-Kyushu Monorail stations
Conference venues (temporary deployment)Internet Week 2018 & 2019, AXIES 2018,
95th-97th Comic Market, etc.
Cityroam supports quick
deployment of eduroam+ Public Wi‐Fi.

New direction:
Univ.&Schools
should provide
Public Wi‐Fi, too.

Mobile eduroam/Passpoint AP

10

Vending machines supporting eduroam & Passpoint• Coca-Cola Bottlers Japan Inc. (May 1, 2020)in collaboration with Kyoto University and NII• Installed in some city parks in Kyoto.
• Available for various organizations including universities
and schools.

New!

https://en.ccbji.co.jp/news/detail.php?id=777

11

https://wballiance.com/openroaming/

12

WBA OpenRoaming Roaming system framework rather than a monolithic federation
 Developed as Cisco OpenRoaming in 2019
 Now, under the full control of the WBA (since Mar. 2020)
 Inter-connect telcos, ISPs, City Wi-Fi, etc.
 Based on the Passpoint and the Wireless Roaming

Intermediary eXchange (WRIX) framework.
 PKI and RadSec + Dynamic Peer Discovery
 Similar to eduroam, but in larger scale.
 Two policies using different RCOIs
 Settled: Accounting and intermediary are required.
 Settlement-free:No roaming fee. Easier onboarding.

RCOI: Roaming Consortium Organization Identifier

13How to join OpenRoaming?
 Become a WBA member to get the digital certificates foronboarding.
 Membership fee applies. WBAID is assigned.
 Implementer Member is a new and affordable category.

 Get the digital certificates from a WBA agent.
 WBAID with SubID is assigned.
 Subscription fee applies.
 Connection via an operator / federation.

eduroam? Yes!

 eduroam is already a member!  Each institution needs to configure DNS NAPTR record.
 Passpoint profiles need to be issued.
 If you prefer, set up a country’s RadSec endpoint.

14

How to develop “eduroam on Public Wi‐Fi” in yourregion?
 Find some Free Wi-Fi operators and municipal

governments that would be interested in better Tourist
Attractions and/or Smart City.  Emitting the “eduroam” SSID is the best practice.

(The eduroam via Passpoint is the second best.)
 Set up an inter-federation hub in the region.

(RADIUS proxy, IPsec, RadSec)

Please call us if you want todevelop a federation like
Cityroam in your region.
https://cityroam.jp/

15