eduroam

The eduroam initiative started in 2002 when during the preparations for the creation of TERENA's task force TF-Mobility, Klaas Wierenga of SURFnet shared the idea of combining a RADIUS-based infrastructure with IEEE 802.1X technology to provide roaming network access across research and education networks.[3] Initially, the service was joined by institutions in the Netherlands, Germany, Finland, Portugal, Croatia and the United Kingdom.[4] Later, other NRENs in Europe embraced the idea and started joining the infrastructure, which was then called eduroam.[5] Since 2004, the European Union co-funded further research and development work related to the eduroam service through the GN2[6] and GN3[7] projects.[8] From September 2007, the European Union also funded through these projects the continued operation and maintenance of the eduroam service at the European level.[9]

The first non-European country to join eduroam was Australia, in December 2004.[10] In Canada, eduroam started as an initiative of the University of British Columbia, which was later taken over by CANARIE as a service of its Canadian Access Federation.[11] In the United States, eduroam was initially a pilot project between the National Science Foundation and the University of Tennessee (UTK). In 2012, Internet2 announced the addition of eduroam to its NET+ service offerings.[12] AnyRoam LLC, a private company, was formed by former UTK staff to serve as an Internet2 active corporate member administering the top-level servers.

The eduroam service uses IEEE 802.1X as the authentication method and a hierarchical system of RADIUS servers.[13] The hierarchy consists of RADIUS servers at the participating institutions, national RADIUS servers run by the National Roaming Operators, and regional top-level RADIUS servers for individual world regions. When a user visits a remote institution, the user's mobile device presents their credentials to the local RADIUS server. That RADIUS server discovers that it is not responsible for the realm of the user's home institution and proxies the access request to the national RADIUS server. If the visited institution is in a different country than the home institution, the request is in turn proxied to the regional top-level RADIUS server, and then to the national RADIUS server of the user's home country. That national server forwards the credentials to the home institution, where they are verified. The 'acknowledge' travels back over the proxy-hierarchy to the visited institution and the user is granted access.

Because the user's credentials travel via a number of intermediate servers, not under the control of the home institution of the user, it is important that the credentials be protected. This requirement limits the types of authentication methods that can be used. There are two categories of useful authentication methods: those that use credentials in the form of some public-key mechanism with certificates and those that use so-called tunnelled authentication. Most institutions use a tunnelled authentication method that only requires server certificates. These server certificates are used to set up a secure tunnel between the mobile device and the authentication server, through which the user credentials are securely transported.

A complication arises if the user's home institution does not use a two-letter country-code top-level domain as part of its realm, but a generic top-level domain such as .edu or .org. By inspection of such realms, it is not possible to determine which national RADIUS server the request should be routed to. Such domains will thus, by default, fail to work in international roaming. The workaround for this problem involves the creation of exceptions in the international RADIUS request routing tables; however, this workaround does not scale as the number of exception entries grows. Several solutions have been proposed to eliminate this workaround in the future, the most promising of which is RADIUS over TLS with Dynamic Discovery, which does not rely on static routing tables inside a RADIUS server configuration to route requests to their proper destination.[14] Instead, the participating institution adds one single DNS resource record to its own domain's DNS zone, which states by which server eduroam authentication for the domain is handled.

GÉANT has established a lightweight global governance structure.[15] Recognising the large variety in the organisation and funding of research and education (networking) in different countries and regions, rules imposed on the operations of eduroam are limited to technical and administrative requirements that are necessary to ensure the smooth and secure operations of eduroam worldwide. Moreover, the eduroam operators have the leading role in creating and maintaining the rules of the global eduroam governance.

The Global eduroam Governance Committee (GeGC) has the central role in the global eduroam governance structure. While its structure has evolved over time, it presently has three representatives from each of five regions — mirroring those used by the Regional Internet registries — serving a two-year term. In addition, GÉANT may appoint one or more experts as non-voting members of the GeGC.

eduroam is available at selected locations in countries with a National Roaming Operator that has signed the eduroam Compliance Statement.[16] Those sixty-seven countries are listed below. In addition, there may be pilot deployments in countries that are in the process of joining eduroam.

• Fon Wireless

• Official website