大学 WiFi 安全吗？学生指南

IEEE 802.1X

一种网络认证协议，只有在用户的身份通过集中式服务器成功授权后，才会打开用于网络访问的端口。

将场所从共享密码升级到企业级、单用户安全防护的基础标准。

RADIUS (Remote Authentication Dial-In User Service)

一种网络协议，为连接和使用网络服务的用户提供集中式的认证、授权和计费（AAA）管理。

用于验证凭证并告知接入点将用户分配到哪个 VLAN 的后端服务器。

EAP (Extensible Authentication Protocol)

一种常用于无线网络和点对点连接的认证框架，支持证书或安全密码等多种认证方法。

在登录过程中，用户设备与 RADIUS 服务器之间交互的 "语言"。

eduroam

一项针对科研、高等教育和继续教育用户的国际漫游服务，为参与机构提供安全的网络访问。

联盟化 802.1X 架构如何实现全球化扩展的主要案例研究。

Supplicant

终端用户设备（笔记本电脑、智能手机）上的客户端软件，用于与网络协商 EAP 认证。

一个常见的故障点；如果操作系统客户端配置错误，用户将无法安全连接。

Evil Twin Attack

一个恶意的无线接入点，它伪装成合法的 WiFi 网络，以窃听无线通信或窃取凭据。

正确的 EAP 证书验证旨在防御的主要威胁向量。

VLAN Steering (动态 VLAN 分配)

RADIUS 服务器根据用户的身份或角色，指示接入点将特定用户放入特定虚拟网络分段的过程。

对于网络分段至关重要，确保访客设备无法将流量路由到管理服务器。

OpenRoaming

由 WBA 创建的联盟标准，允许移动用户在 WiFi 网络和蜂窝网络之间自动、安全地漫游，无需 Captive Portal。

eduroam 的商业同等方案，允许零售和酒店场所提供安全、无缝的连接。

Is university WiFi safe for students and campus visitors?

Yes, university WiFi is safe when students connect to secure 802.1X networks such as eduroam using valid configuration profiles and encrypted protocols. Most universities operate two primary wireless tiers: an authenticated enterprise network (eduroam or university staff/student SSID) with individual WPA2 or WPA3-Enterprise encryption, and an unencrypted guest portal network. While eduroam encrypts wireless transmissions between your device and the access point, connecting to open university visitor networks leaves transmissions visible to local eavesdroppers unless protected by end-to-end TLS encryption or a VPN.

How do rogue access points and evil twin attacks target eduroam on campus?

Rogue access points mimic legitimate campus networks by broadcasting identical SSIDs such as eduroam or University-Guest. When student devices attempt to connect without certificate validation, an attacker-controlled RADIUS server captures MSCHAPv2 password hashes or prompts users to accept untrusted identity certificates. To defend against evil twin attacks, students should configure connections using official eduroam Configuration Assistant Tool (CAT) profiles, which pin the institution's root Certificate Authority (CA) and server common name, preventing connection to unauthorized access points.

Why is client isolation critical in university residence halls?

Residence halls feature dense student populations with high concentrations of laptops, gaming consoles, smart TVs, and IoT hardware. Without Layer 2 client isolation or Private VLANs (PVLANs), infected student computers can scan local subnets, propagate malware, or intercept unencrypted broadcast traffic from neighboring dorm rooms. Enterprise campus networks enforce isolated switch ports and access point station separation, preventing direct peer-to-peer communication between dorm rooms while still allowing access to campus gateways and the internet.

Can university IT administrators monitor student browsing history and personal files?

University network administrators can observe destination IP addresses, DNS queries, domain names, and data consumption volumes across campus gateways, but they cannot read encrypted message content or stored personal files. Over 95 percent of modern web traffic uses HTTPS (TLS 1.3), meaning web pages, login credentials, and form entries are shielded in transit. Universities track connection logs, RADIUS authentication records, and device MAC addresses in compliance with institutional acceptable use policies and regulatory obligations such as FERPA or UK GDPR.

How does Purple enable universities to deliver secure guest and visitor WiFi?

Purple provides cloud-managed guest WiFi that integrates seamlessly alongside academic eduroam infrastructure. For visiting scholars, event attendees, prospective students, and conference delegates, Purple automates captive portal onboarding with social logins, SMS verification, or sponsored access. Purple isolates guest traffic from sensitive academic research networks, enforces bandwidth quotas to safeguard airtime, and delivers campus footfall and dwell time analytics without collecting confidential student records or compromising student privacy.