Eduroam


eduroam is an international roaming service for users in research, higher education and further education. It provides researchers, teachers, and students easy and secure network access when visiting an institution other than their own. Authentication of users is performed by their home institution, using the same credentials as when they access the network locally, while authorization to access the Internet and possibly other resources is handled by the visited institution. Users do not have to pay for using eduroam.
The service is provided at the local level by the participating institutions.
In some countries, Internet access via eduroam is also available at other locations than the participating institutions, e.g. in libraries, public buildings, railway stations, city centres and airports.
In Belgium, Belnet uses the eduroam technology to provide a similar service to Belgian public administrations under the name govroam. A govroam service for municipalities in the Netherlands was launched in October 2013.

History

The eduroam initiative started in 2002 when during the preparations for the creation of TERENA's task force TF-Mobility Klaas Wierenga of SURFnet shared the idea of combining a RADIUS-based infrastructure with IEEE 802.1X technology to provide roaming network access across research and education networks. Initially the service was joined by institutions in the Netherlands, Germany, Finland, Portugal, Croatia and the United Kingdom. Later, other NRENs in Europe embraced the idea and started joining the infrastructure, which was then called eduroam. Since 2004, the European Union co-funded further research and development work related to the eduroam service through the GN2 and GN3 projects. From September 2007, the European Union also funded through these projects the continued operation and maintenance of the eduroam service at the European level.
The first non-European country to join eduroam was Australia, in December 2004. In Canada, eduroam started as an initiative of the University of British Columbia, which was later taken over by CANARIE as a service of its Canadian Access Federation. In the United States, eduroam was initially a pilot project between the National Science Foundation and the University of Tennessee. In 2012, Internet2 announced the addition of eduroam to its NET+ service offerings. AnyRoam LLC, a private company, was formed by former UTK staff to serve as an Internet2 active corporate member administering the top-level servers.

Technology

The eduroam service uses IEEE 802.1X as the authentication method and a hierarchical system of RADIUS servers. The hierarchy consists of RADIUS servers at the participating institutions, national RADIUS servers run by the National Roaming Operators and regional top-level RADIUS servers for individual world regions. When a user visits a remote institution, the user's mobile device presents their credentials to the local RADIUS server. That RADIUS server discovers that it is not responsible for the realm of the user's home institution and proxies the access request to the national RADIUS server. If the visited institution is in a different country than the home institution, the request is in turn proxied to the regional top-level RADIUS server, and then to the national RADIUS server of the user's home country. That national server forwards the credentials to the home institution, where they are verified. The 'acknowledge' travels back over the proxy-hierarchy to the visited institution and the user is granted access.
Because the user's credentials travel via a number of intermediate servers, not under the control of the home institution of the user, it is important that the credentials are protected. This requirement limits the types of authentication methods that can be used. Basically there are two categories of useful authentication methods: those that use credentials in the form of some public-key mechanism with certificates and those that use so-called tunnelled authentication. Most institutions use a tunnelled authentication method that only requires server certificates. These server certificates are used to set up a secure tunnel between the mobile device and the authentication server, through which the user credentials are securely transported.
A complication arises if the user's home institution does not use a two-letter country-code top-level domain as part of its realm, but a generic top-level domain such as.edu or.org. By inspection of such realms, it is
not possible to determine which national RADIUS server the request should be routed to. Such domains will thus by default fail to work in international roaming. The workaround for this problem involves the creation of exceptions in the international
RADIUS request routing tables; however, this workaround does not scale as the number of exception entries grows. Several solutions have been proposed to eliminate this workaround in future, the most promising of which is RADIUS over TLS with Dynamic Discovery, which does not rely on static routing tables inside a RADIUS server configuration to route requests to their proper destination. Instead, the participating institution adds one single DNS resource record to its own domain's DNS zone which states by which server eduroam authentication for the domain is handled.

Governance

TERENA has established a lightweight global governance structure. Recognising the large variety in the organisation and funding of research and education in different countries and regions, rules imposed on the operations of eduroam are limited to technical and administrative requirements that are necessary to ensure the smooth and secure operations of eduroam worldwide. Moreover, the eduroam operators have the leading role in creating and maintaining the rules of the global eduroam governance.
The Global eduroam Governance Committee has the central role in the global eduroam governance structure. Its members are nominated by the European eduroam confederation, respectively by the National Roaming Operators in other world regions, and are appointed by TERENA. The GeGC is composed of three members representing Europe, two representing Asia-Pacific, two representing North America, two representing Latin America and two representing Africa. In addition, TERENA may appoint one or more experts as non-voting members of the GeGC.

Geographical deployment

eduroam is available at selected locations in countries with a National Roaming Operator that has signed the eduroam Compliance Statement. Those sixty-seven countries are listed below. In addition, there may be pilot deployments in countries that are in the process of joining eduroam.

Europe

The NRENs that are members of the consortium of the GN3 project have joined the European eduroam confederation by signing the confederation's policy that requires its members to comply to a set of technical and organisational requirements, which are more specific than those in the global eduroam Compliance Statement.
As a consequence, eduroam is deployed in the following countries: Austria, Belgium , Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Israel, Italy, Latvia, Lithuania, Luxembourg, Macedonia, Malta, Montenegro, Netherlands, Norway, Poland, Portugal, Romania, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland, Turkey, United Kingdom.
In addition, three NRENs that are associate members of the consortium of the GN3 project without voting rights joined the European eduroam confederation; they represent Belarus, Moldova and Russia.
Finally, five NRENs not involved in the GN3 project joined the European eduroam confederation on a voluntary basis, enabling the deployment of the service in Andorra, Armenia, Azerbaijan, Kazakhstan and Kyrgyzstan.
The European top-level RADIUS servers are operated by SURFnet and Forskningsnettet.

Asia-Pacific

eduroam is deployed in the following countries and economies: Australia, China, Hong Kong, India, Indonesia, Japan, Macau, Malaysia, New Zealand, Fiji, Saudi Arabia, Singapore, South Korea, Sri Lanka, Taiwan and Thailand.
The Asia-Pacific top-level RADIUS servers are operated by AARNet and by the University of Hong Kong.

North America

eduroam is deployed in Canada and the United States. It is also deployed in Mexico.

Latin America

eduroam is deployed in Argentina, Brazil, Chile, Colombia, Costa Rica, Ecuador, Mexico and Peru.

Africa

eduroam is deployed in Kenya, Morocco, Ghana and South Africa.

See Also