# A Novel Protocol Using Captive Portals for FIDO2 Network Authentication +
## 5 Prototype Development and Validation
### Test Deployment and Improvements
#### 5.3.1 Environment Configuration of a Mock Use Case: Wi-Fi Connectivity in a Hotel  
Our environment setup can be summarised in four pieces of equipment, mocking a use case of a hotel providing connectivity to the hotel network for their hosts. The FIDO2 security keys are registered beforehand, and they are provided to the clients. As shown in Figures 6 and 7, the setup consists in the following:  
1. The **User Equipment** and the **FIDO2 security keys**. They are the personal devices of the hotel clients, used to connect to the Wi-Fi for Internet connectivity.
2. The **Registration Equipment** for the administrator. Using this device, the hotel personnel register security keys for their clients.
3. The developed **WAWA server**. Running in a physical server, the WAWA application is configured properly to work with the OpenNDS instance.
4. The **OpenWRT router running OpenNDS**. For validating our solution with real hardware, we used the ASUS RT-AC1200 router, which is compatible with OpenWRT. OpenNDS should be properly configured to work with the WAWA.  
The environment was configured by installing the OpenWRT firmware in the ASUS router, using the firmware restoration tool. We configured a WAN interface as a DHCP client for providing Internet connection to the router through another network. Also, the client network was configured using Wi-Fi with the WPA3 open network.  
Moreover, as shown in Figure 6, the example topology divides the corporate networking into three networks attached to the OpenWRT router, namely, (1) Internet, (2) management, and (3) clients network. For simplicity, our WAWA server is placed in Internet, although it could be in a DMZ within the corporate network. Following our mock example of a hotel network, the clients are restricted to access Internet and some hotel services until successful connection to the Wi-Fi network. This provides the proper segmentation of the network, and access control to clients via FIDO2 CAP authentication.  
Finally, as mentioned before, configuring the captive portal in the router relies in OpenNDS configuration with the WAWA server. As said, in our example environment, the  
Figure 6: Example environment diagram: Wi-Fi connectivity in a hotel using the developed prototype. The network is divided in three zones: (1) a client wireless network; (2) a management network; and (3) Internet through NAT. The WAWA server is placed in a public server for simplicity. Clients have restricted access to Internet until successful FIDO2 CAP authentication.  
Figure 7: Physical deployment of the example environment. From left to right: the Registration Equipment (Windows 10), the FIDO2 Authenticator (Yubikey Security Key), the User Equipment (Android 13), and the ASUS Router (OpenWRT). The WAWA server is publicly hosted at our servers (running the prototype [24]).  
WAWA server is deployed in a public domain with a specific unique IP address. A unique IP address is necessary so OpenNDS can configure the Enforcement Device (or firewall) properly to allow the User Equipment initial request for the WAWA UI. Also, we apply compatible configuration of the server and the router, so the router can serve as a gateway of the authentication server. The configuration steps are included in Github [24].