June 9, 2023
Mobility Day at TNC23

eduroam/OpenRoaming combined deploymentin Cityroam
Hideaki Goto Tohoku University / NII

A part of this work was supported by the Beyond 5G R&D Promotion program at
National Institute of Information and Communications Technology (NICT) in Japan.

1Nationwide Cityroam deployment in Japan Cityroam is a roaming federation providing secure roaming

system for Public Wi-Fi since 2018.
 All venues provide both eduroam and OpenRoaming (2020-).
 Multi-operator, multi-vendor(as of Apr. 2023)
 Unique venues across the nation.
(90+ spots)

2

Cityroam venues Cafes, hotels, shopping malls, etc.
 Sapporo Gakuin University(for better services for residents)

 Ski resorts (Hakuba47)
 Kita-Kyushu Monorail stations
 Conference venues (temporary deployment)Internet Week 2018 & 2019, AXIES 2018, 2021, 2022,
Comic Market 95th-97th, 99th-101st, etc.

New direction:
Univ.&Schools
should provide
Public Wi-Fi, too.

Cityroam supports quick
deployment of eduroam+ Public Wi-Fi.
Mobile eduroam/OpenRoaming AP(over 4G & VPN)
3

Cityroam venues

Hot Spring facility in Nagano(May 2021)
Conference Center in Nagano(May 2021)
Vending machines inKyoto City Parks(May 2020)

Co-working space in Morioka(OpenRoaming was addedin 2020)
Resort Hotel & Complex in Ise(Feb. 2022)4

eduroam traffic separation – basic (but complex) implementationand otherroaming partners

eduroam JP hub
SSID=“eduroam"

Cityroam hub
SSID=“cityroam"
Cityroam AP

 Require multiple RADIUS connections
 Complex AP configuration5

eduroam traffic separation – This doesn’t work!
and otherroaming partners

eduroam JP hub???

Cityroam hub
All SSIDs

Cityroam AP
 You cannot see whether the access request is for eduroamor not by just looking at the realm.
For example, anonymous@example.jp

6

Access request routing ineduroam/OpenRoaming combined architecture
and otherroaming partners
No backwardroutingXeduroam JP hub

additional directconnections

eduroam-only members

Cityroam hub(in charge of access control)

eduroam&OR members(including W-ISPs)

Forward to eduroam if ("%{Called-Station-Id}" =~ /:eduroam/)7

Using the eduroam.org OpenRoaming proxy (under dev.)

RadSecAccess-Request
for eduroam

eduroam JP hub

RadSecand otherroaming partners

Access-Request
for OpenRoaming

SRV=“openroaming1.
eduroam.org:2083”

openroaming-ap.eduroam.org(RadSec with eduPKI cert.)

eduroam/OR JP hub at NII

additional directconnections

eduroam-only members

eduroam&OR members(including W-ISPs)

8

Renewed “TOKYO FREE Wi-Fi” supports OpenRoaming Released on Apr. 1, 2023
 Tokyo Metropolitan Government + KDDI / Wire & Wireless (Wi2) Enhanced security, safety, and usability. https://wi-fi.metro.tokyo.lg.jp/en/
9OpenRoaming hotspots provided by the Tokyo Met. Govt.
 4 new sites in Apr. 2023
 600+ sites planned in 2023

Smart Poles and Digital Signages
in Nishi-Shinjuku Area (2021-2022)+10Rough access statistics in the eduroam/OpenRoaming
combined deployment
Embedded profiles
 eduroam accesses account for 75%

win!

 Details of the others cannot be disclosed…,
 SIM-based authentication is popular.

The authentication is stable.
 Samsung’s built-in OSU produces high access counts.
The number of authentication failures is relatively high forunknown reasons.
 Cisco OpenRoaming app is popular, but the percentage is
not so high.

It is quite important to lower
onboarding hurdles.

11Outcome
 High access number from the beginning thanks to the eduroam

users (although it’s not actually OpenRoaming).
 eduroam has clearer value proposition.
 Many municipalities take eduroam as a valuable application.
 Some potential operators become interested in eduroam,while others like the “secure Wi-Fi for everyone,” i.e.,
OpenRoaming.
 Existing profiles (SIM) and built-in OSU work quite well.

12

Private 5G experimental AP• A part of the NICT Beyond 5G program– Towards 5G / Wi-Fi convergence– In-door 5G AP with omnidirectional antenna(CU/DU/RU all-in-one)– SIM-based AuthN to be added.

13• Supplementary slides

14

Passpoint Provisioning Tools
 Tools and codes that help operators develop their own

Passpoint profile provisioning systems.
 The CGI perl scripts allow end users to download Passpoint
profiles and configure Wi-Fi without typing in Wi-Fi
ID/password or certificate.

https://github.com/hgot07/PasspointProvisioningTools

15

Profile Provisioning for Android
 Profile in PPS MO format(w/o signing)

16

Profile Provisioning for iOS/iPadOS/macOS MDM using .mobileconfig
 Signing is optional.

17

Profile Provisioning for Windows 10/11
 ms-settings: URI scheme(EAP-TTLS only) Signing is required.

(Windows 11 21H2 and older require EV cert.)

18

Towards OpenWiFi
OpenWrt-based APs (Edgecore EAP101, EAP102)

Hotspot 2.0 configurationis the same as in OpenWrt.

19

Inexpensive Wi-Fi 6 AP for Managed OpenRoaming ?

Fantastic performanceusing WireGuard VPN.
20

eduroam over OpenRoaming eduroam supports three wireless association methods.
 SSID-based, legacy 802.1X(eduroam’s standard) Passpoint using eduroam’s own RCOI.
 Passpoint using RCOI(s) defined in OpenRoaming.
 Fixed SSID is preferred so far. Why?
 Widely adopted.
 Simple and monolithic service.
 Passpoint support on user equipment has not beenmatured.
High QoS is required in R&E.
RCOI: Roaming Consortium Organization Identifier21