Dynamic VLAN Assignment for Local Users Under External IdP Management in RADIUS-Based Wi-Fi Roaming

In a RADIUS-based Wi-Fi roaming architecture such as eduroam, a guest user is authenticated by his home Identity Provider (IdP) based on the Radius hierarchy, while a local user of the Service Provider (SP), the organization which serves the access points, is authenticated by an internal RADIUS server. Using this, it's possible to configure settings such that local users are connected to dedicated local VLANs for them through the dynamic authenticated VLAN technique. However, when ID management is outsourced to an IdP operated by an external organization, there is no mechanism to securely identify local users from guest users, making it impossible to give them local access. In this paper, we propose a mechanism for RADIUS-based Wi-Fi roaming architecture that allows local users to access local network resources while preserving the privacy of guest users. An IdP entrusted with identity management sends the authenticated user's identifier encrypted with the shared key of the home organization of the user as CUI (Chargeable User Identity) attribute, so that the RADIUS proxy of the home organization can securely identify local users, while the identifier appears as if it were a temporary random value to RADIUS proxies that do not have the encryption key.