Aug. 24, 2022
Training :Identity Federation @ APAN54, Virtual / Jinan, China

Introduction of eduroam
and its development as a national
information infrastructure
Hideaki Goto Tohoku University / NII, JapanA part of this work was supported by the Beyond 5G R&D Promotion program at
National Institute of Information and Communications Technology (NICT) in Japan.

1

Identity Federation in Wireless LAN Roaming Separate and interconnect

Identity Providers (IdPs) and Service Providers (SPs)
IdP
IdP

IdP

SP
Identity
FederationNetworkSPSP Not only connectivity…
 Quality of Service (QoS), Security, User Experience Acceptable Use Policy (AUP) User verification and traceability in case of incidents / abuse Roaming agreements
 Legislation and Regulations2
 Business models, settlement, … etc.

What is eduroam?
eduroam (education roaming) is the secure, worldwide roaming access service developed for theinternational research and education community.
eduroam allows students, researchers and staff fromparticipating institutions to obtain Internet connectivity
across campus and when visiting other participating
institutions by simply opening their laptop.
https://www.eduroam.org/Inst. Astudents / staff
Home inst.

Inst. BInternet
eduroam promotion video by AARNet

3

What is eduroam?

https://www.eduroam.jp/about4

eduroam in the world The eduroam service started as a pilot
under the auspices of TERENA (now GÉANT).
 106 countries worldwide (as of 2022)
 Most countries in Europe
 Canada, USA, Russia, South Africa, Latin America, …
 Even Svalbard and New Caledonia! (but Antarctica)

eduroam Companion by Janet, UK
Android and iOS

5Collaboration with Public WLAN services (case in Japan)
 Virtual expansions of campus networks!!
348 institutions in Japan(Aug. 2022)

Academic cloud
Library/ campus LANInternete-Journals
Off-campus eduroam
by NHN TECHORUS

Enable accesses toacademic NW andcontents fromdowntown areasCityroam

Federation
NW accesses using
universities accounts
130+ in-door APs at cafes, conference sites, large
shops in and around Tokyo (2011-2020)

106 countries worldwide

Created a new option
for outsourcing campus WLAN system

6

The world becomes virtual campus!
 130+ eduroam hotspots at rental meeting rooms, cafes, etc.

in the central area of Tokyo (2011-2020)
 eduroam at airports, train stations, etc. in Sweden
 eduroam on HotCity (municipal Wi-Fi) in Luxemburg
 eduroam at 18 airports in Norway eduroam in downtowns of York, Munich, Porto, etc.
 132 hospitals in the UK (2017)7

eduroam basic architecture Various EAP methods such as PEAP, EAP-TLS
 Based on relaying Authentication Requests

 IdPs and proxies need to be alive always!

ID Providers

EUAPANnl

A

Top-level RADIUS proxy(Europe, Asia-Pacific)jp

BC

National RADIUS proxies

DInstitutional
RADIUS servers

RADIUS IdP

WLAN AP

user@univD.ac.jp8How to join and deploy eduroam?
 Establish a National Roaming Operator for eduroam

operation, and inform eduroam APAN team.

APAN proxies

NationalRoaming Operator

HK CityU

APs(WPA2Enterprise)

Institutions

RADIUS IdPRADIUS proxyOperators
APs(WPA2Enterprise)

RADIUS
connections

RADIUS IdP

AARNetRADIUS proxy

Passpoint-capable APs are recommended
for future development.

9Software RADIUS server software FreeRADIUS, Radiator, RADIUS appliances,managed/hosted service, etc.
 radsecproxy (optional) Platform & tools
 Any OS, like Linux, plus HTTP server.
 openssl, etc.
 eduroam database https://monitor.eduroam.org/
 Client-side software OS built-in authenticator(Android, iOS/iPadOS/macOS, Windows, Linux, …)
 geteduroam https://www.geteduroam.app/
 eduroam Configuration Assistant Tool (eduroam CAT)
https://cat.eduroam.org/
10

eduroam (basic)

National RO

Responsible forstable andcontinuous
operation inthe region.
RO should try separating themembership from other services.
eduroam is for any R&E inst.

11

eduroam and off-campus eduroam

National RO

12eduroam + OpenRoaming as society infrastructure

National RO

Technologies in OpenRoaming are compatible with eduroam’s. 13

WBA OpenRoaming eduroam-like, seamless connection experience foreveryone, not limited to R&E community.
 Inter-connect telcos, ISPs, City Wi-Fi, eduroam, etc.
 Based on Passpoint and Wireless Roaming IntermediaryeXchange (WRIX) framework.
 PKI and RadSec + Dynamic Peer Discovery
 Similar to eduroam, but in larger scale.
 Two policies using different RCOIs
 Settled: Accounting and intermediary are required.
 Settlement-free:

No roaming fee. Easier onboarding.

RCOI: Roaming Consortium Organization Identifier

14OpenRoaming deployment status15

Nishi-Shinjuku Smart Pole project by Tokyo Met. Govt.
 PoC and pilot service in the Smart City project.
 eduroam, Cityroam, and OpenRoaming Two poles in Summer, 2021,

and 20 more poles in 2022

Govt.
BuildingShinjuku
Stationeduroam
accesses:
75.4%

16

Summary eduroam is the world standard Wi-Fi roaming system for

Research and Education institutions. (now 106 territories)
 eduroam provides secure and automatic connection.
Visitor access is quite easy.
 Off-campus eduroam is becoming popular.
 School (K-12) eduroam is emerging.
 To get government funding, consider adding OpenRoaming

for citizens use, not limited to R&E.
OpenRoaming will help deploying off-campus eduroam.
17

For more information
about eduroam,Join https://eduroam.slack.com/
and https://apan-network.slack.com/
Please call us if you want todevelop aneduroam/OpenRoaming
combined system.

https://cityroam.jp/en/18• Supplementary slides

19

Our developments in the NICT Beyond 5G project(2022 –)

 Joint project byKyoto Univ., Local24 Inc., Tohoku Univ., NII, and GÉANT.
 Efficient and stable 5G/Wi-Fi convergence together withQUIC multipath.
 eduroam-OpenRoaming integration + SIM/eSIM AuthN.
(2) Associate SIM/eSIM issued
by IIJ with the studentshipthrough authentication atUniversity A.

cell phonecompany
AAA ServerUniversity A(4) Authorized to join the student
network of University B using
the SIM/eSIM associated withthe credential of University A.
OpenRoamingAPUniversity B

LTE(HSS) / 5GC(UDC)
HSS: Home Subscriber Server
UDC: User Data Convergence(5) Automatically connected
to OpenRoaming APs using
SIM authentication.
Mobile terminal

Student at University A(3) Visit University B20