Connect. Communicate. Collaborate TERENA Networking Conference, 7 june 2005 Eduroam: past, present, and future

Connect. Communicate. Collaborate Contents What is Eduroam? Current status of Eduroam Is anything wrong with Eduroam? Eduroam-ng and Géant 2 Conclusion

Connect. Communicate. Collaborate Users are mobile Access Provid er Cable University A WLA N University B WLA N Access Provid er ADSL Internation al connectivit y Access Provid er WLAN Access Provide r GPRS/ UMTS SURFnet backbone Eduroam enables them to roam seamlessly

Connect. Communicate. Collaborate EduRoam architecture Security based on 802.1X (or web-based redirect) –Identity-based networking –Different authentication mechanisms possible –Prevents session hijacking –Mutual authentication possible –Protection of credentials –Integration with VLAN assignment –Provides basis for new wireless security standards WPA and i Roaming based on RADIUS proxying –Remote Authentication Dial In User Service –Transport-protocol for authentication information Trust fabric based on: –Technical: RADIUS hierarchy –Policy: Documents/contracts that define the responsibilities of user, institution, NREN and the EduRoam federation

Connect. Communicate. Collaborate EduRoam RADIUS server University B RADIUS server University A SURFnet Central RADIUS Proxy server Authenticator (AP or switch) User DB Supplicant Gast Student VLAN Commercial VLAN Employee VLAN data signaling Trust based on RADIUS plus policy documents 802.1X (VLAN assigment)

Connect. Communicate. Collaborate Tunneled authentication (PEAP/TTLS) Uses TLS/SSL tunnel to protect data –The TLS tunnel is set up using the server certificate, thus authenticating the server and preventing man-in-the-middle attacks –The user sends his credentials through the secure tunnel to the server, thus authenticating the user Can use dynamic session keys for ‘in the air’ encryption © Alfa&Ariss

Connect. Communicate. Collaborate Status of EduRoam Over 350 institutions in Europe and Australia USA will follow shortly

Connect. Communicate. Collaborate Limitations Technology –Static trust –Single points of failure –All authN and authZ traffic flows through hierarchy Policy –Not suitable for full service yet Usability –Eduroam comes in many flavours –Where are the access points? Management & Monitoring –Are all servers up and running? –Who is abusing the service? AAI –How to integrate with the European AAI

Connect. Communicate. Collaborate Eduroam-ng

Connect. Communicate. Collaborate Technology: bypassing the hierarchy overhead? European Server.nl uva.nl Access Point Access Point.ac.uk….pl Uni.torun.pl User database AA traffic goes through all intermediate entries All links are peer-to-peer agreements / static routes / p2p secure DIAMETER? DNSsec? (See: Henk Eertink, Future directions in mobility)

Connect. Communicate. Collaborate Roaming policy Minimal security level Levels of assertion SLA’s Incident response Policy board

Connect. Communicate. Collaborate Usability: standardisation, localisation, expansion Standardisation –Limited set of encryption and SSID choices Encryption: 802.1X+WEP, WPA+TKIP, WPA2 SSID: eduroam Localisation –Eduroam-around-the-corner (See: Martijn Arts) Expansion –Integration with commercial roaming services (See: Martin Bech)

Connect. Communicate. Collaborate Managing&Monitoring: usertracking & weathermap (See also : Kostas Kalevras, Large scale WLAN deployments)

Connect. Communicate. Collaborate AAI Integration: offload AuthZ? European Server.nl uva.nl Access Point A-Select.ac.uk….es uclm.es PAPI UCLM user database How do all these applications communicate? (SAML?) Or should we do it inline? (See: Diego Lopez, AAI Infratructures)

Connect. Communicate. Collaborate Conclusions 802.1X plus RADIUS provide a secure and future proof solution for access to the institutional network Infra stucture not perfect yet but… –It works ™ –It is ready for the future –Géant2 JRA5 will make it even better Joining EduRoam is a small step for administrator-kind but a giant leap for the users, so…..

Connect. Communicate. Collaborate Time to join…..

Connect. Communicate. Collaborate More information EduRoam in SURFnet – EduRoam in Europa – TERENA TF-Mobility – Géant2 Joint Research Activity 5 (authorisation and roaming) – (click on research) The unofficial IEEE security page –