eduroam 사용자 대리인증 시스템의 설계 및 구현 = Design and Implementation of eduroam Authentication-Delegation System

다국어 초록 (Multilingual Abstract)

This paper introduces a guest identity provider system for eduroam which is a global Wi-Fi service targeting users enrolled in higher education and research institutions. Developed eduroam AND (AutheNtication Delegation) system enables users to create their eduroam user accounts and to access eduroam regardless of their locations. Users with no organizational eduroam account therefore can freely access eduroam using the system. A federated authentication model is implemented in the system, and thus the system has merits of having high accessibility, indirectly verifying users and organizations possible, saving management overhead. Status monitoring is essential because authentication request and response messages are routed by eduroam network. eduroam AND performs active monitoring to check service availability and visualizes the results, which increases operational and management efficiency. We leveraged open-source libraries to implement eduroam AND and run the system on KREONET (Korea REsearch Open NETwork). Lastly, we present implementation details and qualitively evaluate the system.

참고문헌 (Reference)

1 왕기철, "국내 글로벌 무선랜 로밍 구축 현황 및 발전 방안" 대한전자공학회 52 (52): 15-21, 2015

2 OASIS Std, "sstc-saml-tech-overview-2.0-draft-08, Security assertion markup language (saml) v2.0 technical overview"

3 "pChart – a PHP class to build charts"

4 W. A. Arbaugh, "Your 802.11 Wireless Network has No Clothes" 9 : 44-51, 2002

5 T. Chad, "The security of cryptographic hashes" 103-108, 2011

6 "The Shibboleth Project"

7 "SimpleSAMLphp official homepage"

8 David Recordon, "OpenID 2.0: a platform for user-centric identity management" 11-16, 2006

9 "Linux WPA/WPA2/IEEE 802.1X Supplicant"

10 "KAFE"

11 "IETF RFC 6749, The OAuth 2.0 Authorization Framework"

12 "IETF RFC 6338, Definition of a Uniform Resource Name (URN) Namespace for the Schema for Academia (SCHAC)"

13 "IETF RFC 3748, Extensible authentication protocol (EAP)"

14 "IETF RFC 2865, Remote authentication dial in user service (RADIUS)"

15 "IETF RFC 2798, Definition of inetOrgPerson LDAP Object Class"

16 "FreeRADIUS official homepage"

17 D. W. Chadwick, "Foundations of security analysis and design V" Springer pub 96-120, 2009

18 F. Licia, "Eduroam, providing mobility for roaming users" 2005

19 "EduShib VA (Virtual Appliance)"

20 T. Niizuma, "Centralized Online Sign-up and Client Certificate Issuing System for eduroam" 174-179, 2014