Sept. 13, 2023
Technical 4 – JANOG session, APNIC56, Kyoto

Next-generation secure public Wi-Fi
supporting the digital society– eduroam/OpenRoaming combined deployment in Cityroam –Hideaki Goto Tohoku University, JapanA part of this work was supported by the Beyond 5G R&D Promotion program at
National Institute of Information and Communications Technology (NICT) in Japan.

1

Public Wi-Fi as an infrastructure WiFi4EU’s case
 Project for EU-wide Free Wi-Fi deployment
 Public Wi-Fi is a society infrastructure like water andelectricity.
 Provide network access means to everyone
including those who cannot have a DSL at home.
 Access to digital government services is crucial.

2

eduroam (RFC 7593)
 Secure Wi-Fi Roaming system for Research &Education institutions.

 Started as a pilot at TERENA (now GÉANT).
 104 countries/territories worldwide (as of 2023)
 De facto standard of campus Wi-Fi in the world.
 Mutual benefit system.
 High security and usability based on 802.1X.

eduroam Companion (Android, iOS)

3

Collaboration with Public WLAN services
 Virtual expansion of campus networks.
401 institutions in Japan
Academic cloud(Sep. 2023)
e-JournalsLibrary/ campus LANInternet
Cityroam since 2018
Enable accesses toacademic NW andcontents fromdowntown areas

Federation
NW accesses using
universities accounts
130+ in-door APs at cafes, conference sites, large
shops in and around Tokyo (2011-2020)

104 countries worldwide

4Off-campus eduroam as digital infrastructureSouth Africa:
eduroam at most universities, addressing digital
divides and COVID-19 (July 2020)“Extended virtual campuses”
in Ireland (Jan. 2021)

RENU in Uganda:
Town-wide eduroam
to help students
learning under COVID-19 (Oct. 2020)

http://www.universitytimes.ie/2021/01/heanet-to-extend-wifiinitiative-for-students-to-90-newlocations/5Off-campus eduroam as digital infrastructure

HEAnet, Ireland: 160 locations + “eduroam on Dublin Buses” (Mar. 2021)

6

Off-campus eduroam as digital infrastructure

Jisc, UK (May, 2021)

TENET, South Africa (July, 2021)

7

Are you connected to the right network?
If Open Wi-Fi is used, there’s no security or privacy.
Anyone can plant an Evil Twin AP.
 If many people are using WPA Personal, sharing a Pre-Shared Key(PSK), the network is also unsecure.
 If you have joined a fake network, many attacks become possible.
E.g., MITM, eavesdropping, malware insertion, and active attacks.
Genuine AP
SSID: niceWiFi

tappinguserInternetFake AP
SSID: niceWiFi

Behind the fake AP,

everything could befake.

Internet’attacker

8Secure Public Wi-Fi Using WPA2/WPA3 Enterprise
Users should check whether the AP is a genuine one provided byan authorized operator.
Server authentication in 802.1X makes it possible.
 Password protection as well as privacy protection is needed.
EAP (Extensible Authentication Protocol) can provide protection.
Genuine AP

RADIUS proxyAAA server

SSID: niceWiFi

EAP tunnel

user

Fake AP

SSID: niceWiFi

attackerInternetAttacker cannot gain access× to the authentication server．
User device fails in the server
authentication before
sending out password.

9

Other aspects of security
 Security for Wi-Fi operators:
 Make clear the responsible bodies.
 Keep user traceability in case of network abuse or crime.

User Verification at the service sign-up is important.
 Security for the society: Suppress crimes such as fraud.
 Suppress organized crimes and terrorisms.
 Disaster prevention and mitigation utilizing user activity

analysis.
 Smart City design through data analysis.
 Securing people’s communication means under disasters.
10WBA OpenRoaming eduroam-like, seamless connection experience foreveryone, not limited to R&E community.
 Inter-connect telcos, ISPs, City Wi-Fi, eduroam, etc.
 Based on Passpoint and Wireless Roaming IntermediaryeXchange (WRIX) framework.
 PKI and RadSec + Dynamic Peer Discovery
 Similar to the eduroam architecture, but in larger scale.
 Two policies using different RCOIs Settled: Accounting and intermediary are required.
 Settlement-free:

No roaming fee. Easier onboarding.

RCOI: Roaming Consortium Organization Identifier

11OpenRoaming deployment status

12

Nationwide Cityroam deployment in Japan Cityroam is a roaming federation providing secure roaming

system for Public Wi-Fi since 2018.
 All venues provide both eduroam and OpenRoaming (2020-).
 Multi-operator, multi-vendor(as of Sep. 2023)
 Unique venues across the nation.
(90+ spots)

13

Cityroam venues
 Cafes, hotels, shopping malls, etc.
 Sapporo Gakuin University(for better services for residents)

 Ski resorts (Hakuba47)
 Kita-Kyushu Monorail stations
 Conference venues (temporary deployment)Internet Week 2018 & 2019, AXIES 2018, 2021, 2022,
Comic Market 95th-97th, 99th-102nd, etc.

New direction:
Univ.&Schools
should provide
Public Wi-Fi, too.

Cityroam supports quick
deployment of eduroam+ Public Wi-Fi.
Mobile eduroam/OpenRoaming AP(over 4G & VPN) 14

Cityroam venues

Hot Spring facility in Nagano(May 2021)
Conference Center in Nagano(May 2021)
Vending machines inKyoto City Parks(May 2020)

Co-working space in Morioka(OpenRoaming was addedin 2020)
Resort Hotel & Complex in Ise(Feb. 2022)15

eduroam traffic separation – basic (but complex) implementationand otherroaming partners

eduroam JP hub
SSID=“eduroam"

Cityroam hub
SSID=“cityroam"
Cityroam AP

 Require multiple RADIUS connections
 Complex AP configuration

16

Access request routing ineduroam/OpenRoaming combined architecture
and otherroaming partners
No backward
routingX

eduroam JP hub

additional directconnections

eduroam-only members

Cityroam hub(in charge of access control)

eduroam&OR members(including W-ISPs)

Forward to eduroam if ("%{Called-Station-Id}" =~ /:eduroam/)17

Renewed “TOKYO FREE Wi-Fi” supports OpenRoaming Released on Mar. 31, 2023
 Tokyo Metropolitan Government + KDDI / Wire & Wireless (Wi2) Enhanced security, safety, and usability. https://wi-fi.metro.tokyo.lg.jp/en/
18

OpenRoaming hotspots provided by the Tokyo Met. Govt.
 4 new sites in Apr. 2023
 600+ sites planned in 2023

Smart Poles and Digital Signages
in Nishi-Shinjuku Area (2021-2022)+19

Access analysis in the eduroam/OpenRoaming
combined deployment
Embedded profiles
 eduroam accesses account for 55% (as of 2023)

win!

 SIM-based authentication is the second popular.
 The authentication is quite stable, with few errors.
 Samsung’s built-in OSU produces high access counts.
 Google Pixel’s built-in OSU is easy to use.
 Cisco OpenRoaming app is popular, but the percentage is not

so high.
 TOKYO FREE Wi-Fi profiles are becoming popular.

It is quite important to lower
onboarding hurdles.
20Summary Public Wi-Fi is a necessary infrastructure in the digital era.
 Security and usability are quite important.

OpenRoaming can fulfill the demands.
 Cityroam in Japan developed eduroam/OpenRoaming combinedarchitecture. Nation-wide deployment is ongoing.
 Tokyo has adopted OpenRoaming, and some more municipalities

are about to follow.
Many municipalities take eduroam as a valuable application.
 High access number from the beginning thanks to the eduroam

users (although eduroam is not actually OpenRoaming).
 Existing profiles (eduroam, SIM) and built-in OSU work quite well.

21