Passpoint‑Based Secure Authentication and Seamless Roaming for Enterprise Networks

With the increasing demand for seamless connectivity and secure wireless access in enterprises and public environments, traditional open Wi-Fi networks and captive portal-based authentication methods can no longer satisfy modern network infrastructure requirements.

These legacy approaches introduce poor user experience due to repeated manual authentication, while also lacking strong encryption protection at the wireless layer, making them vulnerable to Man-in-the-Middle (MITM) attacks.

Wi-Fi Passpoint (also known as Hotspot 2.0) transforms Wi-Fi access into a cellular-like seamless roaming experience by leveraging the IEEE 802.11u standard together with WPA2/WPA3-Enterprise security mechanisms.

This white paper explores how TIP (Telecom Infra Project) OpenWiFi, an open-source and hardware-independent cloud-native wireless platform, enables standardized Passpoint deployment.

Furthermore, this document analyzes the limitations of traditional wireless client isolation mechanisms and introduces advanced security best practices based on the OpenWiFi architecture.

Wi-Fi Passpoint, also known as Hotspot 2.0, is a Wi-Fi Alliance-certified framework designed to provide secure, seamless, and automatic Wi-Fi access. It enables devices to discover trusted Wi-Fi networks, verify network identity, and authenticate users or devices using pre-provisioned credentials without requiring manual SSID selection or captive portal login.

Unlike traditional Wi-Fi access models that rely on SSID selection and shared passwords, Passpoint introduces a user-centric authentication model based on identity credentials. By combining IEEE 802.11u network discovery mechanisms with WPA2/WPA3-Enterprise security frameworks, Passpoint provides a cellular-like Wi-Fi experience with automated network discovery, secure authentication, and seamless roaming.

The key capabilities of Passpoint include:

• Automatic network discovery: Devices can identify available trusted networks before association through standardized discovery mechanisms.
• Credential-based authentication: Users and devices authenticate through enterprise-grade authentication methods such as EAP-TLS, EAP-TTLS, or EAP-SIM/AKA.
• Seamless roaming: Devices can automatically connect to trusted Wi-Fi networks without repeated manual authentication.
• Enhanced security: Each client receives individual authentication and encryption protection instead of relying on shared Wi-Fi passwords.

For example, when a user first connects to a Wi-Fi network at Location A, both traditional Wi-Fi and Passpoint require an initial authentication process.

With traditional Wi-Fi, the user typically selects an SSID and manually enters a password or authentication credentials. When the user later arrives at a different location, such as Location B in another city or organization, the user usually needs to select the new Wi-Fi network and provide credentials again.

With Passpoint, the device already has pre-provisioned credentials, such as enterprise certificates, SIM-based credentials, or a Passpoint profile. When the user arrives at Location B, the device automatically discovers nearby Passpoint-enabled networks and verifies whether the network matches its trusted authentication credentials. If the network is trusted, the device can complete authentication and connect automatically without requiring the user to manually enter any information.

This allows Passpoint to provide a Wi-Fi experience similar to cellular connectivity, where users can access trusted networks across different locations without repeated manual authentication.

Passpoint aims to transform Wi-Fi connectivity from a network-centric model (“manually selecting an SSID”) into a user-centric trust-based access model driven by identity credentials.

Its foundation relies on advanced discovery mechanisms and enterprise-grade authentication technologies.

The seamless connection capability of Passpoint is built upon the IEEE 802.11u amendment.

Before initiating association and authentication, a Passpoint-enabled device can exchange information with an Access Point (AP).

A Passpoint AP advertises an Interworking Element inside beacon frames.

After detecting this indicator, the client uses:

• GAS (Generic Advertisement Service)
• ANQP (Access Network Query Protocol)

to exchange network information with the AP.

The client queries the AP regarding:

• Supported identity providers
• Roaming partners
• Authentication methods
• Network capabilities

The AP responds with roaming information including RCOI (Roaming Consortium Organization Identifier).

If the advertised RCOI matches the credentials stored in the client device profile, the device identifies the network as a trusted Passpoint-enabled network.

After completing the pre-association discovery process, the Passpoint client does not require manual SSID selection or captive portal interaction. Instead, the device automatically initiates authentication based on previously provisioned credentials.

Passpoint primarily relies on WPA2-Enterprise or WPA3-Enterprise security frameworks, using 802.1X authentication and EAP (Extensible Authentication Protocol) methods to establish a secure connection.

The authentication process typically includes:

• EAP-TLS: Certificate-based authentication providing the highest level of security without requiring user passwords.
• EAP-SIM / EAP-AKA: SIM-based authentication mechanisms commonly used by mobile operators.
• EAP-TTLS / PEAP: Credential-based enterprise authentication methods widely deployed in corporate environments.

After successful RCOI matching, the client initiates authentication through IEEE 802.1X.

Unlike traditional PSK-based Wi-Fi, Passpoint requires enterprise authentication based on:

• WPA2-Enterprise
• WPA3-Enterprise

Authentication is performed through:

• RADIUS Server
• EAP-TLS (certificate-based authentication)
• EAP-TTLS
• EAP-SIM / AKA

Each device establishes an independent encrypted communication tunnel.

This provides:

• Individual identity verification
• Per-user encryption
• Protection against Evil Twin attacks
• Strong enterprise security compliance

OpenWiFi Controller natively supports Passpoint Release 2+ with cloud-based JSON configuration for simplified deployment and management. Supported parameters include:

Venue Information

• venue-name
• venue-group
• venue-type

Authentication Configuration

• auth-type
(for example EAP-TTLS, EAP-TLS)

Network Identity

• domain-name
• nai-realm

ANQP and Roaming Information

• anqp-domain
• roaming-consortium

These configurations can be distributed across thousands of APs through centralized cloud management.

Passpoint enables secure Wi-Fi discovery and credential-based authentication within trusted networks, while OpenRoaming extends this capability into a global trust federation.

Starting from TIP OpenWiFi Release 2.9, OpenWiFi supports WBA OpenRoaming integration. Administrators can enable roaming participation by configuring OpenRoaming RCOIs through uCentral, such as:

• OpenRoaming RCOI: 5A-03-BA

For broader device compatibility, especially with older Android and Samsung devices, it is recommended to broadcast both:

• OpenRoaming RCOI: 5A-03-BA
• Legacy Cisco RCOI: 00-40-96

A comprehensive wireless security evaluation must compare Passpoint with alternative technologies while analyzing potential weaknesses in underlying network isolation mechanisms.

OWE (Opportunistic Wireless Encryption) provides encryption for open Wi-Fi networks through WPA3 mechanisms.

However:

• OWE provides encryption only.
• It does not authenticate user identity.
• Any user can join the network.

Therefore, OWE cannot fully prevent malicious networks from performing MITM attacks.

In contrast, Passpoint requires:

• 802.1X authentication
• Enterprise identity verification
• Strong encryption

making it more suitable for enterprise and carrier-grade guest access networks.

Many vendors rely on client isolation to prevent attacks between wireless users.

However, academic research has demonstrated that traditional client isolation mechanisms may contain weaknesses at Layer 2 and Layer 3.

Potential attacks include:

Shared Group Temporal Key (GTK) Abuse

Wi-Fi security protocols use GTK to protect broadcast and multicast traffic.

Attackers may exploit shared group keys to inject unicast traffic disguised as AP-originated broadcast traffic.

This can bypass traditional isolation mechanisms.

Gateway Bouncing Attack

Attackers can:

• Spoof the destination MAC address as the gateway.
• Use the IP destination address of another client.

If the gateway does not enforce strict IP-level isolation, traffic can be redirected to the victim.

Multi-BSSID Port Stealing

In enterprise AP deployments with multiple SSIDs:

• Employee SSID
• Guest SSID

Each BSSID behaves like a virtual switch port.

An attacker may spoof another client’s MAC address and cause incorrect MAC/PTK mapping updates, allowing traffic interception.

These limitations demonstrate that client isolation alone should not be considered a complete wireless security solution. Traditional isolation mechanisms mainly operate at the forwarding layer and depend on correct MAC address learning and traffic filtering behavior.

A stronger security architecture should combine multiple protection layers, including:

• Per-client encryption keys (PTK) to provide unique traffic protection between each client and the AP.
• Identity-based access control to enforce security policies based on user or device identity rather than only MAC addresses.
• Network segmentation and policy enforcement through technologies such as VLAN, Dynamic Segmentation, and role-based access control.
• Secure authentication mechanisms, such as WPA3-Enterprise and Passpoint, to prevent unauthorized devices from joining the network.

In modern enterprise Wi-Fi environments, security should move from simple traffic isolation toward a zero-trust wireless access model, where every client is authenticated, authorized, and continuously controlled throughout the connection lifecycle.

These risks are not specific to a single vendor implementation and highlight the limitations of relying solely on client isolation mechanisms.

To achieve seamless Passpoint connectivity while maintaining strong security protection, OpenWiFi deployments should adopt defense-in-depth strategies.

Dynamic VLAN and Physical Network Segmentation

Wireless isolation alone is insufficient.

Recommended approach:

• Use OpenWiFi controller policies
• Assign dynamic VLANs through 802.1Q
• Separate different BSSIDs into isolated network domains

Example:

• Passpoint trusted network VLAN
• Open guest network VLAN
• Corporate employee VLAN

This fundamentally reduces:

• Layer-2 spoofing risks
• Port stealing attacks
• Gateway bouncing risks