Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Evaluation of EAP Usage for Authenticating Eduroam Users in 5G Networks

Leonardo Azalim de Oliveira, Edelberto Franco Silva

TL;DR

This work addresses securing Eduroam authentication over converged 5G and WiFi networks by analyzing EAP methods, 3GPP releases, and the EAP-AKA' protocol, then validating a practical testbed based on free5gc and UERANSIM to explore WiFi/5G convergence via DN-AAA. It provides a comparative view of EAP-AKA' and 5G-AKA, details a convergence architecture leveraging ATSSS, and documents open-source artifacts to enable reproducibility. Key technical aspects include anchor-key derivation and subsequent keys ($K_{ausf}$, $XRES$, $K_{seaf}$) within the EAP-AKA' flow, and the role of DN-AAA in enabling RADIUS-based device authentication for Eduroam. The findings offer a practical baseline for expanding Eduroam into 5G-enabled environments and guide future work on roaming, alternative EAP methods, and integrated WiFi-5G-RADIUS deployments, with attention to identity mapping and privacy concerns in cross-domain credentials.

Abstract

The fifth generation of the telecommunication networks (5G) established the service-oriented paradigm on the mobile networks. In this new context, the 5G Core component has become extremely flexible so, in addition to serving mobile networks, it can also be used to connect devices from the so-called non-3GPP networks, which contains technologies such as WiFi. The implementation of this connectivity requires specific protocols to ensure authentication and reliability. Given these characteristics and the possibility of convergence, it is necessary to carefully choose the encryption algorithms and authentication methods used by non-3GPP user equipment. In light of the above, this paper highlights key findings resulting from an analysis on the subject conducted through a test environment which could be used in the context of the Eduroam federation.

Evaluation of EAP Usage for Authenticating Eduroam Users in 5G Networks

TL;DR

This work addresses securing Eduroam authentication over converged 5G and WiFi networks by analyzing EAP methods, 3GPP releases, and the EAP-AKA' protocol, then validating a practical testbed based on free5gc and UERANSIM to explore WiFi/5G convergence via DN-AAA. It provides a comparative view of EAP-AKA' and 5G-AKA, details a convergence architecture leveraging ATSSS, and documents open-source artifacts to enable reproducibility. Key technical aspects include anchor-key derivation and subsequent keys (, , ) within the EAP-AKA' flow, and the role of DN-AAA in enabling RADIUS-based device authentication for Eduroam. The findings offer a practical baseline for expanding Eduroam into 5G-enabled environments and guide future work on roaming, alternative EAP methods, and integrated WiFi-5G-RADIUS deployments, with attention to identity mapping and privacy concerns in cross-domain credentials.

Abstract

The fifth generation of the telecommunication networks (5G) established the service-oriented paradigm on the mobile networks. In this new context, the 5G Core component has become extremely flexible so, in addition to serving mobile networks, it can also be used to connect devices from the so-called non-3GPP networks, which contains technologies such as WiFi. The implementation of this connectivity requires specific protocols to ensure authentication and reliability. Given these characteristics and the possibility of convergence, it is necessary to carefully choose the encryption algorithms and authentication methods used by non-3GPP user equipment. In light of the above, this paper highlights key findings resulting from an analysis on the subject conducted through a test environment which could be used in the context of the Eduroam federation.
Paper Structure (8 sections, 5 figures)

This paper contains 8 sections, 5 figures.

Table of Contents

  1. Introduction
  2. Background
  3. EAP Framework
  4. 3GPP Releases
  5. Analysis of 5G Core Projects
  6. EAP-AKA' Protocol Detailed
  7. Results and Discussion
  8. Conclusion

Figures (5)

  • Figure 1: Main aspects of the available EAP methods for 5G. Source: eap.
  • Figure 2: Reference architecture for authentication-related network functions according to the Release 17. Source: 3gpp1.
  • Figure 3: Main procedures of EAP-AKA' algorithm in 5G environments. Based on eapaka and 5gauth.
  • Figure 4: Testing environment for 5G networks.
  • Figure 5: Convergence architecture between WiFi and 5G based on the specification 3gpp1 and suitable to be applied in the Eduroam federation.