Nov. 15‐16, 2018
RTUWO’18, Riga, Latvia

Cityroam, Providing Secure Public Wireless
LAN Services with International Roaming
Hideaki Goto Tohoku University, Japan1

Security threats in the current Public Wi‐Fi
 No doubt, open Wi-Fi is unsecure!

 Vulnerable to Eavesdropping, MITM attacks.
 Anyone can set up Evil Twin Access Points.

(Even with WPA-PSK)
 Malicious scripts may be screwed in by the
Captive Portal and/or AP itself.
 No means to check if the AP is genuine or not.
Genuine AP Who is the actual user?
SSID: XXopenInternetHey,use dot1X orPasspoint!

Fake APuser

SSID: XXopenattacker

2

Next Gen Public Wi‐Fi with Passpoint (Hotspot 2.0)
 Some operators provide secure Wi-Fi option:
 San Francisco & San Jose Wi-Fi (2014)
 Orange Romania (2014)
 LinkNYC (2016), InLinkUK (2017)
 Boingo provides Passpoint Secure at27+ airports in US, Brazil, Portugal
 US phones come with built-inLook!
Passpoint, enabling automaticconnection to Wi-Fi ...
Wi‐Fi Alliance andWireless Broadband Alliance(WBA) are promoting
Passpoint/NGH.

3

What is eduroam?
eduroam (education roaming) is the secure, world‐wideroaming access service developed for the international
research and education community.
eduroam allows students, researchers and staff fromparticipating institutions to obtain Internet connectivity
across campus and when visiting other participating
institutions by simply opening their laptop.
https://www.eduroam.org/Inst. A

students / staff
Home inst.

Inst. BInternet
eduroam promotion video by AARNet4

The world becomes a virtual campus!
• 130+ eduroam hotspots at rental meeting rooms, cafes, etc. in
the central area of Tokyo since 2011• eduroam at airports, train stations, etc. in Sweden• eduroam on HotCity (municipal Wi‐Fi) in Luxemburg• eduroam at 19 airports in Norway• eduroam in downtowns of York, Munich, Porto, etc.
• 132 hospitals in the UK (as of 2017)55

Why City/Free Wi‐Fi & off‐campus eduroam?
 Tourism Smart Cities
 Provide citizens with access means for various

electronic services.
 Wi-Fi for all. (WiFi4EU by European Commission)(resolving digital divide) Community supports for Research & Education.

What do we need?
 Secure connection means with high usability
 Roaming User’s identity verification and traceability(for security, trust between operators, and compliance) 6

Roaming System for City/Free Wi‐Fi Conventional roaming systems are not scalable

as they are often based on bilateral agreements.
 No large-scale roaming system for City/Free WiFi yet.
 eduroam is the largest, but only for R&E use.
City1

eduroam RC
OP1
OP3

govroam RC

City2
City3

OP2

OP4

Current roaming system

Large‐scale
Roaming System
connecting RCs

XXroam RC7

Routing problem in DNS-based realms• Service Providers (SPs) cannot find which
Roaming Consortium to send the authn request
by looking at the realm only.
– eduroam/govroam use realms like:<UserName>@<InstName>.ac.jp<UserName>@<InstName>.jp<UserName>@<InstName>.org
DNS‐based realms
govroamOpName‐based realms
Wireless ISPs, telcos, etc.
<UserName>@<OpName>??
hub(proxy)Realm-consortium list
(cannot hold all realms)

8

NGH Special Interest Group (NGHSIG) Since Jan. 2017
• Push forward dot1X adoption and Hotspot 2.0
deployment to make Public Wi-Fi secure.
• Exchange and accumulate technical info. about RADIUS,
roaming, and HS2.0.
• Provide NGH testbed for development and pilot service(now as Cityroam).
• Develop an inter-roaming architecture,“eduroam/govroam on NGH”
• Survey on legal aspects and compile rules.

https://nghsig.jp/en/9

Cityroam, the secure roaming system for Public Wi‐Fi
 Passpoint/NGH as well as dot1X
 Affordable roaming platform for various RCs andoperators including small ones and cities.
 IdP: eduroam, ANYROAM, NGHSIG Cloud IdP, etc.

(planned: telcos/ISPs and cities via NGH hub)
 SP: Free Wi-Fi operators supporting 1X/Passpoint Strategies:No roaming fee settlement.
(Each City/Free Wi-Fi has its
own local ecosystem.)Utilize existing accounts
as much as possible.
(roaming with operators)

10

NGH testbed system in Japan
DNS-based realms

OpName-based realms

govroam ANYROAM, WBA/City Wi-Fi, etc.

JP hubSP
Shopping Mall
Wi-Fi,
Seaport Wi-Fi,etc.

NGHSIG
Cloud IdP

TohokuUniversity

IdP/SP

IdP

IdP/SP
IdP/SP

Basic
connections
Optional/example
connections(bilateral)11Inter-roaming Hub layer for connecting Roaming Consortia

NGHhubNGHhubNGHhubNLUKUKNGH hub operators

NGHhubNGH
hubNL
NLNOJPBEJPBEUS
NLNOJPAll AuthN requests
with .jp realms except
the known operators’.
Inter‐roaming
Hub layer

XXroamgovroam

12

City Wi‐Fi Roaming 2017
 NGH trial program by WBA

 Period: World Wi-Fi Day (June 20) – Aug. 20
 40 carriers, some Wireless ISPs, and about 20 cities
 Tohoku University became the first academic
institution participating in the trial.
(NGHSIG as the first NGH operator in Japan)

eduroam/NGH-readyhotel in Kyoto.

Five spots inthe country.

13

eduroam on NGH
 Roaming tests during the City Wi-FI Roaming trial,

enabling eduroam service on City Wi-Fi.
 Connected the eduroam JP proxy to the NGH
infrastructure.
 RADIUS test from ER Telecom in Russia.
 Connection tests in Birmingham and Leeds in the UK.

It works!
Successful connection using eduroam
credentials on the Briggate Street, Leeds.

14Conclusions
 Established the NGH Special Interest Group.
 Developed an inter-roaming architecture forlarge-scale roaming and an NGH testbed,
 Started a pilot service “Cityroam”,
combined with eduroam.

Future Current development work Passpoint Onboarding System for guests.
 World-wide roaming system for secured Public

Wi-Fi.

15