March 9, 2022
IAM WG Meeting @ APAN53, Virtual / Bangladesh

eduroam/OpenRoaming combined
deployment in Cityroam
Hideaki Goto Tohoku University / NII, JapanA part of this work was supported by the Beyond 5G R&D Promotion
program at National Institute of Information and Communications
Technology (NICT) in Japan.

1WBA OpenRoaming eduroam-like, seamless connection experience foreveryone, not limited to R&E community.
 Inter-connect telcos, ISPs, City Wi-Fi, eduroam, etc.
 Based on Passpoint and Wireless Roaming IntermediaryeXchange (WRIX) framework.
 PKI and RadSec + Dynamic Peer Discovery
 Similar to eduroam, but in larger scale.
 Two policies using different RCOIs
 Settled: Accounting and intermediary are required.
 Settlement-free:

No roaming fee. Easier onboarding.

RCOI: Roaming Consortium Organization Identifier2

vseduroam is only for R&E,
while OpenRoaming is for everyone… Then,Is OpenRoaming alone enough?

No!
Some universities are showing interestin the monetization model in OpenRoaming.
Yes, it might work, but…
3

Why eduroam?
 eduroam has a matured autonomy.
 Virtually monolithic.

If you see “eduroam” SSID, the service is always there.
 Single basic policy + minor variants.
(won’t bother users so much) eduroam can be “a collection of reliable IdPs”
that provides good credentials with strict user verification,
probably accompanied with enlightenment.
 A large number of students and staff are carrying devices
already configured with eduroam.
 OpenRoaming is still new. (improving, hopefully) Pros and cons in its “diversity” in various aspects.
 Multiplexed roaming system. (would make some confusions)4New documents from eduroam.org
 OpenRoaming and eduroam – Useful Information for eduroam

Identity Providers and Service Providers
https://eduroam.org/openroaming-and-eduroam-useful-information-foreduroam-identity-providers-and-service-providers/ OpenRoaming and eduroam – Useful Information for eduroam

National Roaming Operators (NROs)
https://eduroam.org/openroaming-and-eduroam-useful-information-foreduroam-national-roaming-operators-nros/ eduroam + OpenRoaming End-User Information

https://eduroam.org/eduroam-openroaming-end-user-information/

5

Comparison

6

Cityroam, the secure roaming system for Public Wi‐Fi Affordable roaming platform for various Roaming

Consortia and operators (SMB, cities, etc.)
 IdP: eduroam, ANYROAM, Cityroam Cloud IdP, etc.

(planned: telcos/ISPs and cities via OpenRoaming) eduroam/OpenRoaming combined architecture Our strategies:No roaming fee.
(We make the most of the local
ecosystem each Free Wi-Fi has.)Utilize existing accounts
as much as possible.
(roaming with telcos/ISPs)

7

RADIUS routing in the eduroam/OpenRoaming
combined architecture
and, otherroaming partners

X

eduroam JP hub

additional directconnections

eduroam-only members

Cityroam JP hub(in charge ofaccess control)

eduroam&OR members(including W-ISPs)

8

eduroam and OpenRoaming on buses
 First OpenRoaming deployment on buses.
 Sightseeing / chartered buses in Ibaraki Prefecture.
 4G/LTE backhaul network & remote management via VPN.
 Power stabilizer for continuous operation.

Tsubasa‐kanko Co., Ltd.
and Telhi Corporation (a member of Cityroam)Dec. 2021

9

Nishi‐Shinjuku Smart Pole project by Tokyo Met. Govt.
 PoC and pilot service in the Smart City project.
 eduroam, Cityroam, and OpenRoaming Two poles in Summer, 2021,

and more poles since Dec. 2021

Govt.
BuildingShinjukuStationeduroam
accesses:
75.4%

10

How to get on OpenRoaming?
eduroam members (ROs, universities, etc.)
 By simply adding DNS NAPTR records, institutions will beable to accept AuthN requests from OpenRoaming.
 Connection via your national RO, or AP vendor’s solution.
 RO can get the digital certificates from eduroam.org andconnect to the OpenRoaming network directly.
Non-eduroam operators
 Become a WBA member to get the digital certificates foronboarding.
 Membership fee applies. WBAID is assigned.
 Implementer Member is an affordable category.
 Get the digital certificates from a WBA agent.
 WBAID with SubID is assigned.
 Subscription fee applies.

11Please call us if you want todevelop a federation likeCityroam in your region.
https://cityroam.jp/en/

If you are interested in trying
OpenRoaming, please ask
Hideaki (me) or Paul@SURFnet

Join https://eduroam.slack.com/
12• Supplementary slides

13

Our developments in the NICT Beyond 5G project(2022 –)
 Joint project by

Kyoto Univ., Local24 Inc., Tohoku Univ., NII, and GÉANT.
 Efficient and stable 5G/Wi-Fi convergence together withQUIC multipath.
 eduroam-OpenRoaming integration + SIM/eSIM AuthN.
(2) Associate SIM/eSIM issued
by IIJ with the studentshipthrough authentication atUniversity A.

cell phonecompany
AAA ServerUniversity A(4) Authorized to join the student
network of University B using
the SIM/eSIM associated withthe credential of University A.
OpenRoamingAP

University B

LTE(HSS) / 5GC(UDC)
HSS: Home Subscriber Server
UDC: User Data Convergence(5) Automatically connected
to OpenRoaming APs using
SIM authentication.
Mobile terminal

Student at University A(3) Visit University B

14

eduroam–OpenRoaming interconnection
eduroam via OpenRoaming ANPs

Universities providing OpenRoaming
service for visitors and residents.)

IdPs
eduroam ROs

eduroam.org
Default
eduroam-OR
gateway.us.us.jp.jp
via local hubs
or vendors(not necessarilyeduroam’s)

RadSec via hubs
or direct
IdPs

ANP: Access Network Provider

15