COMPSAC SDIM2022 Workshop (Virtual)
27 June – 1 July, 2022

Disruption‐tolerant Local Authentication Method forContinuous and Secure In‐Flight Wireless LAN
Hideaki Goto
Tohoku University, Japan(Supported in part by JSPS KAKENHI No.19H04090)

1

Evolving In‐Flight Wi‐Fi service
Internet connection used to be the main application ofIn-Flight Wi-Fi many years ago.
 Now, In-Flight Wi-Fi provides a wide range of services
including: internet connection
 flight map/information
 venue information
 audio/video streaming
using onboard mediaserver
 shopping

In-Flight Wi-Fi is becomingan indispensable service,especially in longhaul
flights.

2

Problems in current In‐Flight Wi‐Fi service

Lack of security due to “open network”.
 Evil-Twin APs.
 Man-in-the-Middle (MITM) attacks, etc.

Low usability (manual Wi-Fi configuration).
 Find the right SSID,
 figure out how to connect, (& troubleshooting,)
 read Terms of Service, and type in ID/password for paid service.

Disruption of internet connection.

Wi-Fi industry has been working on these problems.
OpenRoaming will provide secure, seamless andautomatic connection means.
3Introducing a secure Wi‐Fi roaming
WPA2/WPA3 Enterprise can solve the security problems,
allowing users to “roam” securely between different ISPs.
 RADIUS servers are used to deliver the access requests
from user devices to users’ home IdPs (Identity Providers).
 The current roaming systems in In-Flight Wi-Fi, based on
open network (unsecure), will be upgraded.
Wi-Fi roaming using phones’ SIM cards will be available.
 Network disruption is still a great problem.
User authentication is dependent on the authentication
server on the ground.
user
ISP A


Home ISP
ISP B

Internet

4

Research Objectives
Sort out prospective use cases and problems of future
In-Flight Wi-Fi with roaming capability.

Develop user authentication and roaming system
tolerant of network disruption in order to realize
continuous and secure In-Flight Wi-Fi service.

5

User journey with current In‐Flight Wi‐Fi
Boarding

Taxi & Take-off

Reach 10,000 ft.

Internet connection isturned on.
Some disruptions may
occur inevitably.
Cruising

You are requested to turn off the cellular.
You have to manually configure Wi-Fi.
No internet connection. (local contents only)
Landing

Internet connection is turned off.
In a foreign country, you would lose
network until you buy a SIM card.

You enjoy various local
contents & the internet.

6

In‐Flight Wi‐Fi and backhaul network
Satellite & ATG networks are evolving, but network
disruption is inevitable. (weather cond., regulations, etc.)
 We want to avoid interruption of in-flight services suchas audio/video streaming, shopping, etc.
Even at a cruising altitude,
network disruption is inevitable.
satellite communication

10,000 ft.
No internet service below,but continuous in-flight service
is in demand.
Air-To-Ground (ATG)
communication

7

In‐Flight Wi‐Fi with roaming
Roaming is supposed to improve security and usability, but…
Pros
 Roaming involves user authentication.
 Per-user encryption of wireless communication can beachieved by 802.1x-based user authentication.
 Airlines and ISPs can provide better network service tothose who pay more.
Cons User authentication does not work during network
disruption. Passengers are unable to use local services.
 Local services may be interrupted when the “reauthentication” of 802.1x runs and fails during network
disruptions.

8Similarity with the use case in natural disasters
Disaster-affected areas may suffer from communication
isolation due to the disruption of the backhaul network.
 People want to use public Wi-Fi even on a local network.
 But, the public Wi-Fi cannot be used since the user
authentication is dependent on a remote server.
X

X
X

Internet

X
X Internet
9

Certificate‐based local authentication
 Originally developed for disaster- and disruption-tolerant

Wi-Fi system for disaster-affected areas. (COMPSAC 2013)
 Local user (client) authentication is realized by EAP-TLS.
 For scalability, 47 prefectures in Japan were supposed toact as Issuers.
Issuer’s
private key

IssuerClient certificate
IssuerUser nameissue Certificate
User attributes
Signature

Signature verification for authentication.
User attributes for authorization.
Issuer’s
public key

Issuer’s
public key

Local RADIUS

Local RADIUS

APs

APs

Site A
user

Site B

10Local authentication for In‐Flight Wi‐Fi A limited number of operator groups, such as airline

alliances, provide CA certificates and issue client certificates.
 A challenge exists in secure operation and handling of the
CA certificates as many aircrafts are carrying them.

Alliance A

Alliance B

Alliance F
In‐Flight system

CA certificates for
EAP‐TLS AuthN.

Local AAA serverwith Online Sign‐Up(OSU) system

11

Certificate chains
Well‐known public CA
EAP-TLS comprises• Server AuthN.
• Client AuthN.

Private CA, and I‐CA for the
Airline Roaming Federation

CA cert.

CA cert.

I‐CA cert.

I‐CA cert.

(issue certs.)

Alliance A

Alliance F

Server cert. I‐CA cert.

Server cert. I‐CA cert.

(load all certs.)
In‐Flight system
CA/I‐CA certs. &server certs./keys
for Server AuthN.

All CA/I‐CA certs.
for Client AuthN.

anotheraircraft

Local AAA server
Client certs.

12Public CA or Private CA?
Server authentication phase: It is technically possible to install a CA certificate together

with a client certificate on user devices.
Adding CA certificates frequently is not so safe.
 User devices have built-in CA certificates from many publicCAs.
We prefer public CA to ease device configuration, avoiding
complexities.
Client authentication phase: We should use private CA.

If a public CA were used, an attacker would obtain a clientcertificate from the same CA and enforce the client
authentication to succeed.
13

Wi‐Fi profile issuing and roaming
In-Flight Wi-Fi needs to provide various means forpassengers to obtain a profile electronically.
 Users download a profile at airline websites uponreservation.
 Airline app automatically downloads a profile and configures
the user device.
 Unprepared passengers use Online Sign-Up (OSU) systemonboard an aircraft.
 Local profiles without roaming capability may be issued.
 User verification without internet connection is a challenge.

 Users receive or buy a voucher and use the OSU.

Passengers may use connection flights.
If the airlines are participating in the federation,
roaming is possible even between different airlines.

14Security considerations
Leakage of CA/I-CA certificates leads to security risks.
 Use of CRLs is difficult, although a caching mechanism

would be useful.
 Shorter lifetime of I-CA certificates is preferred to mitigate
the impact from potential certificate/key leakage.
(e.g. 90 days in Let’s Encrypt)
 Lifetime of client certificates is affected.

Automatic certificate renewal will help users keep Wi-Fi
profile always updated.
Development of a PoC app is under way.

15

PoC system and functionality tests
 We developed a Proof-of-Concept roaming system.
 2 virtual alliances.
 Server certificate issued by Let’s Encrypt.
 openssl command for certificate issuing.

FreeRADIUS 3
Server key &Server cert. fromLet’s Encrypt

Confirmed
successful AuthN
for both alliances.
= Roaming works.

Federation’s
private CA cert.
made by openssl
Alliance I‐CA certs.
made by openssl

Client certs.
in PKCS#12• Windows 10• Android 1016Summary
 We have analyzed some prospective use cases of In-Flight

Wi-Fi and technical challenges.
 We have developed a disruption-tolerant user authentication
method for realizing continuous and secure In-Flight Wi-Fi.
 Roaming is possible, accepting user credentials fromsome operator groups (alliances).
 The roaming system is based on the popular EAP-TLS.
It would be easy to combine it with other systems.
 We have built a Proof-of-Concept system and confirmed thatthe developed framework works well as designed.

Future work
 Develop an app for automatic profile handling.
 Develop a method for profile association with telco/ISP ones.

17