1. Growing eduroam in the Asia Pacific region Neil Witheridge Authentication and Authorisation Services Technical Manager Growing eduroam in the Asia Pacific region Neil Witheridge Authentication and Authorisation Services Technical Manager

2. Current Status of eduroam in APAC eduroam Infrastructure in APAC TEIN funded project: Extending eduroam in the Asia Pacific (“XeAP”) Requirements for eduroam uptake Establishing an eduroam APAC Confederation XeAP NRO and Institutional training considerations –Guiding in right technical direction –Fostering a strong trust federation Beyond XeAP Topics 16th June 2015Growing eduroam in the Asia Pacific2 of 21

3. AU via AARNet eduroam Project Group Countries/Territories already participating: Australia (.au), China (.cn), Hong Kong (.hk), India (.in), Japan (.jp), Korea (.kr), Macao (.mo), New Zealand (.nz), The Philippines* (.ph), Singapore (.sg), Taiwan (.tw), Thailand (.th) * Pending eCS Signing Preparing to participate Malaysia (.my), Pakistan (.pk) Planning to participate Fiji/Oceania (USP) (.fj) (via AARNet) Stalled participation: Papua New Guinea (.pg) (via AARNet) eduroam Uptake in Asia Pacific (APAC) 16th June 2015Growing eduroam in the Asia Pacific3 of 21

4. Result of Survey (? = not understood, n/a = not available, PT = part time resource) APAC eduroam NRO Survey Results AustraliaChinaHong Kong IndiaJapanKoreaMacauNew Zealand The Philippines SingaporeTaiwanThailand NREN as NRO Yes FTE for eduroam operations 1.02.00.23 PT1.020.31.0 (2 PT)1.03 Number of HE institutions 402246 16 (JUCC members) 12122011022 6 Uni, 5 PolyTech 163154 HE Institutions participating 39615112390144 (Uni’s) 2039 Total institutions participating 63615113431 16 (->20) 54139 Typical max auths successful 545,453 (20789) 1,204 (126) 96,953 (3826) n/a 295,411 (n/a) n/a 64 31,884 (1196) 618 19,358 (n/a) 217,956 (3,689) Typical max auths unsuccessful 324,691 (18104) 685 (89) 69,423 (4636) n/a 124,589 (n/a) n/a 115 21,837 (1332) 639 11,173 (n/a) 109,042 (4,460) Adequate GeGC representation? Yes ? NoYesNoYes Would join APAC Confederation? Yes ? MaybeYes National eduroam Policy Yes No (tbd) No (tbd) Yes NoYes 16th June 2015Growing eduroam in the Asia Pacific4 of 21

5. Result of Survey: Uptake –For current NROs, a lot of scope to grow for many Institutional engagement was key for AU APAC eduroam NRO Survey Results AustraliaChinaHong Kong JapanKoreaMacaoNew Zealand SingaporeTaiwanThailand Number of Higher Ed institutions 402246 16 (JUCC members) 12122011022 6 Uni, 5 Poly 163154 Higher Ed Institutions participating 39615112390144 (Uni’s) 2039 Total institutions participating 63615113431 16 (->20) 54139 16th June 2015Growing eduroam in the Asia Pacific5 of 21

6. Result of Survey (n/a = not available) : Usage –Wide variety in usage, and clearly many have scope to grow usage Institutional and user education, service promotion –Large relative number of unsuccessful logins Scope to become proactive to reduce this ratio APAC eduroam NRO Survey Results AustraliaChinaHong Kong JapanKoreaMacauNew Zealand SingaporeTaiwanThailand max auths successful (peak day 2015) 545,453 (20789) 1204 (126) 96,953 (3,826) n/a (n/a) 295,411 (n/a) n/a (64) 31,884 (1,196) 618 (n/a) 19,358 (n/a) n/a (n/a) max auths unsuccessful (peak day 2015) 324,691 (18104) 685 (89) 69,423 (4,636) n/a (n/a) 124,589 (n/a) n/a (115) 21,837 (1,332) 639 (n/a) 11,173 (n/a) n/a (n/a) 16th June 2015Growing eduroam in the Asia Pacific6 of 21

7. Result of Survey (PT = part time resource) : NRO Resourcing –Typically NRENs operate eduroam, with a wide variety of FTE devoted to operating eduroam Resourcing limits achievable service improvement APAC eduroam NRO Survey Results AustraliaChinaHong Kong JapanKoreaMacaoNew Zealand SingaporeTaiwanThailand FTE for eduroam operations 1.0 (3 PT) 2 (n/a) 0.2 (n/a) n/a (3 PT) 1.0 (n/a) 2 (n/a) 0.3 (n/a) 1 (2 PT) 1 (n/a) 3 (n/a) 16th June 2015Growing eduroam in the Asia Pacific7 of 21

8. Result of Survey (? = not understood) : Would join APAC eduroam Confederation –Typically APAC NROs support establishment of APAC eduroam Confederation Communications path to GeGC, shared knowledge and resources APAC eduroam NRO Survey Results AustraliaChinaHong Kong JapanKoreaMacauNew Zealand SingaporeTaiwanThailand Would join APAC Confederation? Yes ? MaybeYes 16th June 2015Growing eduroam in the Asia Pacific8 of 21

9. Decision to run APAN Top-Level RADIUS Server (TLRS) early in eduroam history Hong Kong PolyTech Uni and AARNet each operate an APAN TLRS, providing geographical diversity. –Both running FreeRadius –Manual syncing of TLRS configuration Rationale –Reduce network latency for auth requests –HK central to Asia, ‘close’ (network-wise) to EU –AU central to Oceania, ‘close’ (network-wise) to US Any advantage in having just one TLRS, EU? APAC Top-Level RADIUS Servers 16th June 2015Growing eduroam in the Asia Pacific9 of 21

10. APAC Top-Level RADIUS Servers 16th June 2015Growing eduroam in the Asia Pacific10 of 21 Canada NRSs eTLRS National RADIUS servers (Proxy) (NROs) Institutional eduroam IdPs and/or SPs Top Level RADIUS servers (Proxy) APAC NRSs APAC Country/Territory Institutions Canadian Institutions.ca.hk.jp.mo.ph.tw.cn.in.kr.sg.th APAN TLRS HKPolyU AARNet.au.nz Africa NRSs Latin America NRSs Europe NRSs US NRSs US Institutions.edu Catch-all African Country/Territory Institutions European Country/Territory Institutions Latin American Country/Territory Institutions

11. AARNet proposed project to TEIN to increase eduroam footprint in the Asia Pacific –Funding of €350K –Collaborating with APAC mature eduroam NROs –Project acronym “XeAP” (pronounced “zeep”) Five “Target Countries” to be selected for ‘guided and assisted deployment of eduroam NRO and institutional operational capabilities’ –Eligible countries include: Afghanistan, Bangladesh, Bhutan, Cambodia, Indonesia, Laos, Malaysia, Mongolia, Myanmar, Nepal, Pakistan, Sri Lanka and Vietnam Intent to create resources that may be shared with all current and prospective eduroam NROs e.g. The Philippines, Thailand, Malaysia Extending eduroam in the Asia Pacific 16th June 2015Growing eduroam in the Asia Pacific11 of 21

12. TEIN funded “XeAP” Project Extending eduroam in the Asia Pacific Project Team –Project Lead AARNet –TEIN*CC representative –Project Partners (x2, currently in process of invitation ) Contribute to and execute plan for NRO and Inst. –Workshops –Deployment –Project Technical Partners (x1, currently in process of invitation ) Deliver eduroam OA&M tools –AdminTool, basic metrics, basic monitoring, device configuration, automated auditing. 16th June 2015Growing eduroam in the Asia Pacific12 of 21

13. Trusted protocols, infrastructure and operators –Trust model that meets the requirements of the service. Technical & administrative capability of NRO –eduroam relies on NRO competencies –Willingness and ability to devote required resources Technical & administrative capability of Institutions –eduroam relies on institutional competencies –Identity Management at institutions –Wireless infrastructure operability ‘Customer-demand’ for eduroam –eduroam relies on institutional & end-user demand –Appropriate strength/energy of R&E sector eduroam pre-requisites & requirements 16th June 2015Growing eduroam in the Asia Pacific13 of 21

14. A TEIN beneficiary country Not yet a recognised eduroam NRO Mature NREN willing operate as eduroam NRO and as an institutional participant (IdP+SP roles) Agreement by the NREN to sign the eduroam Compliance Statement and commit required resources to operate eduroam Demonstrable national demand for eduroam 3 R&E institutions willing to operate as institutional eduroam operators (IdP+SP roles) Target Country Selection Criteria 16th June 2015Growing eduroam in the Asia Pacific14 of 21

15. Eduroam deployed and operational in the 5 Target Countries in APAC –1 x NRO + institutional eduroam deployment –3 x Institutional eduroam deployment NRO and Institutional workshops and training Establishment of APAC eduroam Confederation Shared resources available for APAC countries –Adoption of resources from EU eduroam where possible Contribution to eduroam globally –Promote improvement of global resources –Liaising with GeGC throughout project Project Deliverables 16th June 2015Growing eduroam in the Asia Pacific15 of 21

16. eduroam Admin Tool “adminTool” eduroam NRO Admin Tool “adminTool” delivers Institutional Self-Administration reduces NRO admin burden Global database APAC eConfed database & website Localisation (for target countries) Upgrades/Mods: Installation support Public inform’n on National eduroam Institutional eduroam admin Interface eNRO admin Interface eNRO Customisable database schema Data collected can be extended to cover national eduroam operational objectives Data source (URL) of XML file for ingest into global and APAC databases Database schema Revision* & extensibility Protected access implementations Documentation (modified DjNRO) * Support for various institutional models (3 rd party IdP/SP behind institutional IdP/SP, use of load-balancer) NRO Website NRO RADIUS configuration SQL Query response Email: - reports - alerts & notifications Reports, notifications, alerts via email 16th June 2015Growing eduroam in the Asia Pacific16 of 21

17. 2015 –2Q15 TEIN Project approval and funding agreement Create project team (invite partners) –3Q15 APAN40 Select Target Countries Gather resources required, Upgrade admin tool Establish eduroam APAC eduroam Confederation –4Q15 NRO Workshops (end Oct/early Nov) Deploy eduroam at NROs Engage with Institutions 2016 –1Q16 Institutional Workshops (around APAN41) –2Q16 Deploy eduroam at Institutions Operability Testing and Auditing, Final Report Project Schedule 16th June 2015Growing eduroam in the Asia Pacific17 of 21

18. APAC eduroam not a “confederation” –Recognition by GeGC as grouped under “APAN” label –GeGC representatives have no formal responsibilities What is an ‘eduroam confederation’ –Currently subject of debate within the GeGC Basic role is to achieve global representation by the GeGC –Formalise info flow from Confederation NROs to GeGC Optionally (following are done by EU eduroam Confederation) –Common eduroam Confederation Policy –Organisational structure: Steering Committee, Operational Team –Shared resources, Confederation website APAC Confederation Proposal 16th June 2015Growing eduroam in the Asia Pacific18 of 21

19. XeAP emphasis: eduroam operation is a lot more than operating RADIUS servers Trust is based on policy compliance, IdPs taking responsibility for users –Accountability (established AUPs, user agreement) –Traceability (adequate logging) –Action (prompt response to abuse reports) Improved standards of eduroam deployment –Operability auditing as integral part of on-boarding –Delivering OA&M resources required to deliver a strong “trust federation” Fostering eduroam Trust Model 17th June 2015Growing eduroam in the Asia Pacific19 of 21

20. Focus on Ancillary Services to add value & trust –Further develop Monitoring, Metrics, and Troubleshooting tools Beyond XeAP... 16th June 2015Growing eduroam in the Asia Pacific20 of 21

21. Thank you Questions? Neil.Witheridge@aarnet.edu.au