TF Mobility Group 22nd September A comparison of each national solution was made against Del C – “requirements”, the following solutions were assessed 802.1x based authentication solution. VPN based authentication solution. Variation to VPN based authentication solution with client certificates. Web-based redirect authentication solution. Roamnode (PPPoE) authentication solution. Deliverable G

TF Mobility Group 22nd September x based authentication solution –Layer 2 solution, standard is still maturing, some cheaper AP that support 802.1x are appearing on the market. –Uses EAP or EAPOL. –Uses RADIUS for authentication, authorisation and accounting. –Can be scaled using a RADIUS Proxy Hierarchy to enable the visitor to authenticate at their home institution. –Admin overhead involves loading 802.1x client on mobile devices, RADIUS configurations and VLAN assignment. –Non 802.1x client support offered via website support and may look into general web-redirect authentication system. –EAP-TLS and TTLS security support with WPA, TKIP, i extensions). –Accountability via RADIUS logging and user reports to helpdesk (e.g. stolen mobile device). Deliverable G

TF Mobility Group 22nd September VPN based authentication solution –Layer 3 solution, mature standard. –Can be scaled using an overlay network of assigned address space for VPN Gateways or control lists of VPN Gateways. –Admin overhead in loading VPN client on mobile devices, configuration of VPN gateways, access lists & VLANs. –Strong security via encrypted tunnels for each connection. –Accountability via the user’s home institution as the user authenticates and gets their IP address from there, also reports to the helpdesk e.g. stolen mobile device. VPN based authentication solution with client certificates –Admin overhead required to install client certificates on mobile devices and maintain / manage a PKI. Deliverable G

TF Mobility Group 22nd September Web based redirect authentication solution –Requires a http or https supported web browser, no additional client software is likely to be required –Uses RADIUS for authentication, authorisation and accounting. –Can be scaled using a RADIUS Proxy Hierarchy with authentication at visitor user home institution. –Minimum admin overhead as unknown authentication requests are forwarded back across a RADIUS proxy hierarchy. –Less secure than other authentication solutions due to web based login page for authentication and no provision to protect authentication of authorised users in a VLAN from seeing each others traffic –Accountability via RADIUS logging and user reports to helpdesk (e.g. stolen mobile device). Deliverable G

TF Mobility Group 22nd September Roamnode (PPPoE) authentication solution –Uses PPPoE. –Decouples process of establishing a physical network from establishing a logical network connection. –Uses RADIUS back end for AAA service. –Uses an overlay network for visitor users. –Uses a VPN gateway via an IP-in-IP tunnel. –Requires proprietary equipment at the home and visited institution and client operating systems with PPPoE support. –Accountability via RADIUS logging and user reports to helpdesk (e.g. stolen mobile device). Deliverable G

TF Mobility Group 22nd September Conclusion –A European AAA based on one solution is not practical. –A solution that supports the various national solutions is needed. Recommendations: A phased development / testing approach Resolve scaling and interoperability issues for all AAA (802.1x, VPN, VPN +PKI, web- based redirect, PPPoE) Consolidate findings into a trial report Build and scale a RADIUS proxy hierarchy for non-VPN AAA Conduct feasibility tests on creating an scalable VPN solution Subject to feasibility, build the proposed VPN solution Extend solution to agree mechanisms for exchange of credentials (e.g. PKI) Could extend to VPN if possible?

TF Mobility Group 22nd September Revised Recommendations (as a result of discussions in Berlin) - A phased development / testing approach Resolve scaling and interoperability issues for 802.1x, VPN, web- based redirect, PPPoE) Consolidate findings into a trial report Build and scale a RADIUS proxy hierarchy for non-VPN AAA Conduct feasibility tests on creating an scalable VPN solution Subject to feasibility, build the proposed CASG solution Extend to VPN in parallel Work on software changes to PPPoE to facilitate roaming

TF Mobility Group 22nd September Update on inter NREN tests Organizational RADIUS Server C Organizational RADIUS Server C Top-level RADIUS Proxy Server Top-level RADIUS Proxy Server Organizational RADIUS Server E Organizational RADIUS Server E Organizational RADIUS Server D Organizational RADIUS Server D Organizational RADIUS Server G Organizational RADIUS Server G Organizational RADIUS Server F Organizational RADIUS Server F National RADIUS Proxy Server National RADIUS Proxy Server National RADIUS Proxy Server National RADIUS Proxy Server Currently directly linked to the University of Southampton Currently hosted at SURFnet Currently linked to FCCN, Portugal Currently linked to CARNET, Croatia Backup Top-level RADIUS Proxy Server Backup Top-level RADIUS Proxy Server etlr1.radius.terena.nl ( ) etlr2.radius.terena.nl ( ) Organizational RADIUS Server A Organizational RADIUS Server A National RADIUS Proxy Server National RADIUS Proxy Server Organizational RADIUS Server B Organizational RADIUS Server B Currently linked to SURFnet, Netherlands