Eduroam: Difference between revisions
→External links: Categories |
Rescuing 1 sources and tagging 0 as dead. #IABot (v1.5.2) |
||
Line 43: | Line 43: | ||
The eduroam initiative started in 2002 when during the preparations for the creation of [[TERENA]]'s task force TF-Mobility Klaas Wierenga of [[SURFnet]] shared the idea of combining a [[RADIUS]]-based infrastructure with [[IEEE 802.1X]] technology to provide roaming network access across research and education networks.<ref>{{Cite web |title= eduroam® celebrates a decade of providing secure roaming Internet access for users |date= 24 May 2012 |url=http://www.terena.org/news/fullstory.php?news_id=3162 |accessdate= 24 August 2013 }}</ref> Initially the service was joined by institutions in the Netherlands, Germany, Finland, Portugal, Croatia and the United Kingdom.<ref>{{cite book|title=TERENA Annual Report 2003|url=http://www.terena.org/publications/files/terena_final_2003.pdf|year=2004|publisher=TERENA|author=Carol de Groot|page=34}}</ref> Later, other NRENs in Europe embraced the idea and started joining the infrastructure, which was then called eduroam.<ref>{{cite journal |authors=Klaas Wierenga and Licia Florio |title=eduroam: past, present and future |journal=Computational Methods in Science and Technology |volume=11 |issue=2 |pages=169–173 |year=2005 }}</ref> Since 2004 the [[European Union]] co-funded further research and development work related to the eduroam service through the GN2<ref>{{Cite web |title= Multi-gigabit European academic network (GN2) |date= 1 September 2004 |url= http://cordis.europa.eu/projects/rcn/80150_en.html |accessdate= 12 August 2012 }}</ref> and GN3<ref name="GN3">{{Cite web |title= Multi-gigabit european research and education network and associated services (GN3) |date= 1 April 2009 |url= http://cordis.europa.eu/projects/rcn/91504_en.html |accessdate= 20 July 2012 }}</ref> projects.<ref>{{cite book|title=TERENA Annual Report 2005|url=http://www.terena.org/publications/files/ap2005.pdf|year=2006|publisher=TERENA|author=Carol de Groot|pages=32–33}}</ref> From September 2007 the European Union funded through these projects also the continued operation and maintenance of the eduroam service at the European level.<ref>{{cite book|title=TERENA Annual Report 2009|url=http://www.terena.org/publications/files/20100511_annual_report_2009.pdf|year=2010|publisher=TERENA|authors=Carol de Groot, Laura Durnford and Karel Vietsch|page=31}}</ref> |
The eduroam initiative started in 2002 when during the preparations for the creation of [[TERENA]]'s task force TF-Mobility Klaas Wierenga of [[SURFnet]] shared the idea of combining a [[RADIUS]]-based infrastructure with [[IEEE 802.1X]] technology to provide roaming network access across research and education networks.<ref>{{Cite web |title= eduroam® celebrates a decade of providing secure roaming Internet access for users |date= 24 May 2012 |url=http://www.terena.org/news/fullstory.php?news_id=3162 |accessdate= 24 August 2013 }}</ref> Initially the service was joined by institutions in the Netherlands, Germany, Finland, Portugal, Croatia and the United Kingdom.<ref>{{cite book|title=TERENA Annual Report 2003|url=http://www.terena.org/publications/files/terena_final_2003.pdf|year=2004|publisher=TERENA|author=Carol de Groot|page=34}}</ref> Later, other NRENs in Europe embraced the idea and started joining the infrastructure, which was then called eduroam.<ref>{{cite journal |authors=Klaas Wierenga and Licia Florio |title=eduroam: past, present and future |journal=Computational Methods in Science and Technology |volume=11 |issue=2 |pages=169–173 |year=2005 }}</ref> Since 2004 the [[European Union]] co-funded further research and development work related to the eduroam service through the GN2<ref>{{Cite web |title= Multi-gigabit European academic network (GN2) |date= 1 September 2004 |url= http://cordis.europa.eu/projects/rcn/80150_en.html |accessdate= 12 August 2012 }}</ref> and GN3<ref name="GN3">{{Cite web |title= Multi-gigabit european research and education network and associated services (GN3) |date= 1 April 2009 |url= http://cordis.europa.eu/projects/rcn/91504_en.html |accessdate= 20 July 2012 }}</ref> projects.<ref>{{cite book|title=TERENA Annual Report 2005|url=http://www.terena.org/publications/files/ap2005.pdf|year=2006|publisher=TERENA|author=Carol de Groot|pages=32–33}}</ref> From September 2007 the European Union funded through these projects also the continued operation and maintenance of the eduroam service at the European level.<ref>{{cite book|title=TERENA Annual Report 2009|url=http://www.terena.org/publications/files/20100511_annual_report_2009.pdf|year=2010|publisher=TERENA|authors=Carol de Groot, Laura Durnford and Karel Vietsch|page=31}}</ref> |
||
The first non-European country to join eduroam was Australia, in December 2004.<ref>{{Cite web|title=eduroam goes global |date=15 December 2004 |url=https://www.terena.org/news/archive/2004/newsflash163.pdf |accessdate=23 August 2013 |deadurl=bot: unknown |archiveurl=https://web.archive.org/web/20110705203504/http://www.terena.org/news/archive/2004/newsflash163.pdf |archivedate=5 July 2011 |df= }}</ref> In Canada, eduroam started as an initiative of the [[University of British Columbia]], which was later taken over by [[CANARIE]] as a service of its Canadian Access Federation.<ref>{{Cite web |title= A million times a month, CANARIE enables mobile research and learning |
The first non-European country to join eduroam was Australia, in December 2004.<ref>{{Cite web|title=eduroam goes global |date=15 December 2004 |url=https://www.terena.org/news/archive/2004/newsflash163.pdf |accessdate=23 August 2013 |deadurl=bot: unknown |archiveurl=https://web.archive.org/web/20110705203504/http://www.terena.org/news/archive/2004/newsflash163.pdf |archivedate=5 July 2011 |df= }}</ref> In Canada, eduroam started as an initiative of the [[University of British Columbia]], which was later taken over by [[CANARIE]] as a service of its Canadian Access Federation.<ref>{{Cite web |title= A million times a month, CANARIE enables mobile research and learning |date= 29 November 2012 |url= http://www.canarie.ca/templates/news/releases/CAF_million_logins_en.pdf |accessdate= 24 August 2013 |deadurl= yes |archiveurl= https://web.archive.org/web/20131224090002/http://www.canarie.ca/templates/news/releases/CAF_million_logins_en.pdf |archivedate= 24 December 2013 |df= }}</ref> In the United States, eduroam was initially a pilot project between the [[National Science Foundation]] and the [[University of Tennessee]] (UTK). In 2012 [[Internet2]] announced the addition of eduroam to its NET+ service offerings.<ref>{{Cite web |title= Over 220 Universities and Research Labs Gain Easy and Secure Wi-Fi Access to the Internet |date= 2 October 2012 |url= http://www.internet2.edu/news/detail/2509/|accessdate= 23 August 2013 }}</ref> AnyRoam LLC, a private company, was formed by former UTK staff to serve as an Internet2 active corporate member administering the top-level servers. |
||
== Technology == |
== Technology == |
Revision as of 19:59, 17 September 2017
![]() EDUcation ROAMing | |
Purpose | International authentication infrastructure |
---|---|
Region served | Worldwide |
Parent organization | GÉANT |
Website | www |
eduroam (education roaming) is an international roaming service for users in research, higher education and further education. It provides researchers, teachers and students easy and secure network access when visiting an institution other than their own. Authentication of users is performed by their home institution, using the same credentials as when they access the network locally, while authorization to access the Internet and possibly other resources is handled by the visited institution. Users do not have to pay for using eduroam.
The service is provided at the local level by the participating institutions (universities, colleges, research institutes etc.). At the national level it is organised by National Roaming Operators, which are in many cases the National Research and Education Networks (NRENs) of their countries. At the global level, the organisation of the eduroam service is under the auspices of TERENA, which is also the holder of the eduroam® trademark. The eduroam Architecture for Network Roaming is defined in RFC 7593.
In some countries, Internet access via eduroam is also available at other locations than the participating institutions, e.g. in libraries, public buildings, railway stations and airports.[1][2]
In Belgium, Belnet uses the eduroam technology to provide a similar service to Belgian public administrations under the name govroam.[3] A govroam service for municipalities in the Netherlands was launched in October 2013.[4] govroam® is a registered trademark of Belnet.
History
The eduroam initiative started in 2002 when during the preparations for the creation of TERENA's task force TF-Mobility Klaas Wierenga of SURFnet shared the idea of combining a RADIUS-based infrastructure with IEEE 802.1X technology to provide roaming network access across research and education networks.[5] Initially the service was joined by institutions in the Netherlands, Germany, Finland, Portugal, Croatia and the United Kingdom.[6] Later, other NRENs in Europe embraced the idea and started joining the infrastructure, which was then called eduroam.[7] Since 2004 the European Union co-funded further research and development work related to the eduroam service through the GN2[8] and GN3[9] projects.[10] From September 2007 the European Union funded through these projects also the continued operation and maintenance of the eduroam service at the European level.[11]
The first non-European country to join eduroam was Australia, in December 2004.[12] In Canada, eduroam started as an initiative of the University of British Columbia, which was later taken over by CANARIE as a service of its Canadian Access Federation.[13] In the United States, eduroam was initially a pilot project between the National Science Foundation and the University of Tennessee (UTK). In 2012 Internet2 announced the addition of eduroam to its NET+ service offerings.[14] AnyRoam LLC, a private company, was formed by former UTK staff to serve as an Internet2 active corporate member administering the top-level servers.
Technology
The eduroam service uses IEEE 802.1X as the authentication method and a hierarchal system of RADIUS servers.[15] The hierarchy consists of RADIUS servers at the participating institutions, national RADIUS servers run by the National Roaming Operators and regional top-level RADIUS servers for individual world regions. When a user A from institution B in country C with two-letter country-code top-level domain xy visits institution P in country Q, A's mobile device presents his credentials to the RADIUS server of institution P. That RADIUS server discovers that it is not responsible for the Institution_B.xy realm and proxies the access request to the national RADIUS server of country Q. If C and Q are different countries, it is in turn proxied to the regional top-level RADIUS server, and then to the national RADIUS server of country C, which has a complete list of the participating eduroam institutions in that country. That national server forwards the credentials to the home institution B, where they are verified. The 'acknowledge' travels back over the proxy-hierarchy to the visited institution P and the user is granted access.
Because the user's credentials travel via a number of intermediate servers, not under the control of the home institution of the user, it is important that the credentials are protected. This requirement limits the types of authentication methods that can be used. Basically there are two categories of useful authentication methods: those that use credentials in the form of some public-key mechanism with certificates and those that use so-called tunnelled authentication. Most institutions use a tunnelled authentication method that only requires server certificates. These server certificates are used to set up a secure tunnel between the mobile device and the authentication server, through which the user credentials are securely transported.
A complication arises if the user's home institution does not use a two-letter country-code top-level domain as part of its realm, but a generic top-level domain such as .edu or .org. By inspection of such realms, it is not possible to determine which national RADIUS server the request should be routed to. Such domains will thus by default fail to work in international roaming. The workaround for this problem involves the creation of exceptions in the international RADIUS request routing tables; however, this workaround does not scale as the number of exception entries grows. Several solutions have been proposed to eliminate this workaround in future, the most promising of which is RADIUS over TLS with Dynamic Discovery, which does not rely on static routing tables inside a RADIUS server configuration to route requests to their proper destination.[16] Instead, the participating institution adds one single DNS resource record to its own domain's DNS zone which states by which server eduroam authentication for the domain is handled.
Governance
TERENA has established a lightweight global governance structure.[17] Recognising the large variety in the organisation and funding of research and education (networking) in different countries and regions, rules imposed on the operations of eduroam are limited to technical and administrative requirements that are necessary to ensure the smooth and secure operations of eduroam worldwide. Moreover, the eduroam operators have the leading role in creating and maintaining the rules of the global eduroam governance.
The Global eduroam Governance Committee (GeGC) has the central role in the global eduroam governance structure. Its members are nominated by the European eduroam confederation, respectively by the National Roaming Operators in other world regions, and are appointed by TERENA. The GeGC is composed of three members representing Europe, two representing Asia-Pacific, two representing North America, two representing Latin America and two representing Africa. In addition, TERENA may appoint one or more experts as non-voting members of the GeGC.
Geographical deployment
eduroam is available at selected locations in countries with a National Roaming Operator that has signed the eduroam Compliance Statement.[18] Those sixty-seven countries are listed below. In addition, there may be pilot deployments in countries that are in the process of joining eduroam.
Europe
The NRENs that are members of the consortium of the GN3 project[9] have joined the European eduroam confederation by signing the confederation's policy[19] that requires its members to comply to a set of technical and organisational requirements, which are more specific than those in the global eduroam Compliance Statement.
As a consequence, eduroam is deployed in the following countries: Austria (ACOnet), Belgium (Belnet), Bulgaria (BREN), Croatia (CARNet), Cyprus (CYNET), Czech Republic (CESNET), Denmark (NORDUnet, operated by DeIC), Estonia (EENet), Finland (NORDUnet, operated by FUNET), France (RENATER), Germany (DFN), Greece (GRNET), Hungary (NIIF), Iceland (NORDUnet, operated by RHnet), Ireland (HEAnet), Israel (IUCC), Italy (GARR), Latvia (SigmaNet), Lithuania (LITNET), Luxembourg (RESTENA), Macedonia (MARNET), Malta (University of Malta), Montenegro (MREN), Netherlands (SURFnet), Norway (NORDUnet, operated by UNINETT), Poland (PSNC), Portugal (FCCN), Romania (RoEduNet), Serbia (AMRES), Slovakia (SANET), Slovenia (ARNES), Spain (RedIRIS), Sweden (NORDUnet, operated by SUNET), Switzerland (SWITCH), Turkey (ULAKBIM), United Kingdom (Janet).
In addition, three NRENs that are associate members of the consortium of the GN3 project without voting rights joined the European eduroam confederation; they represent Belarus (UIIP), Moldova (RENAM) and Russia (Joint Supercomputer Center of the Russian Academy of Sciences).
Finally, five NRENs not involved in the GN3 project joined the European eduroam confederation on a voluntary basis, enabling the deployment of the service in Andorra (Universitat d'Andorra), Armenia (ASNET-AM), Azerbaijan (AzScienceNet), Kazakhstan (KazRENA) and Kyrgyzstan (KRENA).
The European top-level RADIUS servers are operated by SURFnet and Forskningsnettet.
Asia-Pacific
eduroam is deployed in the following countries and economies: Australia (AARNet), China (CSTNET), Hong Kong (Harnet), India (ERNET), Japan (NII), Macau (University of Macau), Malaysia (UPM), New Zealand (REANNZ), Saudi Arabia (KAUST), Singapore (SingAREN), South Korea (KREONET), Sri Lanka (Lanka Education and Research Network, University of Kelaniya, University of Moratuwa), Taiwan (Ministry of Education) and Thailand (UniNet).
The Asia-Pacific top-level RADIUS servers are operated by AARNet and by the University of Hong Kong.
North America
eduroam is deployed in Canada (CANARIE) and the United States (Internet2, operated by AnyRoam LLC).
Latin America
eduroam is deployed in Argentina (Innova-RED), Brazil (RNP), Chile (REUNA), Colombia (RENATA), Costa Rica (RedCONARE), Ecuador (CEDIA),[20] Mexico (CUDI) and Peru (RAAP).
Africa
eduroam is deployed in Kenya (KENET), Morocco (MARWAN) and South Africa (TENET).
References
- ^ "600,000 students and researchers in Sweden go mobile with eduroam and The Cloud". 2 October 2012. Retrieved 17 September 2016.
- ^ "eduroam at Norwegian airports". 4 July 2013. Retrieved 23 August 2013.
- ^ "Belnet govroam service". Retrieved 23 August 2013.
- ^ "govroam: het nieuwe zusje van eduroam". 6 November 2013. Archived from the original on 2014-07-09. Retrieved 7 November 2013.
{{cite web}}
: Unknown parameter|dead-url=
ignored (|url-status=
suggested) (help) - ^ "eduroam® celebrates a decade of providing secure roaming Internet access for users". 24 May 2012. Retrieved 24 August 2013.
- ^ Carol de Groot (2004). TERENA Annual Report 2003 (PDF). TERENA. p. 34.
- ^ "eduroam: past, present and future". Computational Methods in Science and Technology. 11 (2): 169–173. 2005.
{{cite journal}}
: Unknown parameter|authors=
ignored (help) - ^ "Multi-gigabit European academic network (GN2)". 1 September 2004. Retrieved 12 August 2012.
- ^ a b "Multi-gigabit european research and education network and associated services (GN3)". 1 April 2009. Retrieved 20 July 2012.
- ^ Carol de Groot (2006). TERENA Annual Report 2005 (PDF). TERENA. pp. 32–33.
- ^ TERENA Annual Report 2009 (PDF). TERENA. 2010. p. 31.
{{cite book}}
: Unknown parameter|authors=
ignored (help) - ^ "eduroam goes global" (PDF). 15 December 2004. Archived from the original (PDF) on 5 July 2011. Retrieved 23 August 2013.
{{cite web}}
: Unknown parameter|deadurl=
ignored (|url-status=
suggested) (help) - ^ "A million times a month, CANARIE enables mobile research and learning" (PDF). 29 November 2012. Archived from the original (PDF) on 24 December 2013. Retrieved 24 August 2013.
{{cite web}}
: Unknown parameter|deadurl=
ignored (|url-status=
suggested) (help) - ^ "Over 220 Universities and Research Labs Gain Easy and Secure Wi-Fi Access to the Internet". 2 October 2012. Retrieved 23 August 2013.
- ^ Building the Mobile Internet. Cisco Press. 2011. pp. 45–48. ISBN 978-1-58714-243-7.
{{cite book}}
: Unknown parameter|authors=
ignored (help) - ^ Transport Layer Security (TLS) Encryption for RADIUS. RFC 6614. The Internet Society. 2012.
{{cite book}}
: Unknown parameter|authors=
ignored (help) - ^ Karel Vietsch (2010). Global eduroam Governance (PDF). TERENA.
- ^ eduroam Compliance Statement (PDF). TERENA. 2011.
- ^ eduroam Service Definition and Implementation Plan (PDF). DANTE. 2008.
{{cite book}}
: Unknown parameter|authors=
ignored (help) - ^ https://www.cedia.org.ec/