Wi-Fi Roaming Security - Best Practices for Providers

What Changed

The Wireless Broadband Alliance has introduced new guidelines aimed at enhancing the security of public Wi-Fi roaming networks. These networks often transfer authentication credentials across various administrative domains, and the security of these processes can vary widely. The guidelines focus on best practices for authentication, encryption, and credential handling, particularly for networks using Passpoint and OpenRoaming.

Why This Matters

As more users rely on public Wi-Fi, the need for robust security measures becomes critical. By implementing these guidelines, operators can ensure a higher level of security and consistency, which is essential for protecting user data during roaming and offloading scenarios. Cameron Dunn from AT&T Services emphasized that applying established best practices can significantly improve security in these environments.

Authentication Methods

The guidelines specify that Passpoint-certified equipment must support multiple authentication methods. These include:

• EAP-TLS for certificate-based authentication.
• EAP-SIM and EAP-AKA for SIM credentials.
• EAP-TTLS with MSCHAPv2 for username and password credentials.

EAP-TLS is recognized as the most secure method, though it has limitations under TLS 1.2. The guidelines recommend using TLS 1.3 to mitigate exposure of client certificate details.

Identity Privacy

To protect user privacy, the guidelines state that the Network Access Identifier (NAI) used in Passpoint roaming must not contain personally identifiable information. Instead, it should use an anonymous identifier format, ensuring that user data remains confidential during authentication exchanges. This is crucial for maintaining user privacy in a public network environment.

Encryption Standards

Encryption practices are also addressed, with WPA2-Enterprise and WPA3-Enterprise specifications being the standards for data protection. WPA3 introduces enhanced security features, such as larger key sizes and mandatory protection for management frames. However, the transition mode that allows older devices to connect poses a security risk, as it can lead to outdated security practices being mistakenly perceived as current.

Physical and Backhaul Security

The guidelines recommend that access points be installed in secure locations to prevent physical tampering. Additionally, traffic between access points and controllers should be encrypted to safeguard against interception. RADIUS transport protocols, which have known vulnerabilities, should be replaced with more secure options like RADIUS/TLS or RADIUS/DTLS.

Future Considerations

Looking ahead, the potential impact of quantum computing on Wi-Fi security is acknowledged. Current cryptographic methods may become vulnerable as quantum technology advances. The IEEE 802.11 group is actively exploring post-quantum cryptography solutions to enhance future security measures.

By adopting these guidelines, access network providers and identity providers can significantly improve the security of public Wi-Fi roaming networks, ensuring a safer experience for users.