Versions Compared

Old Version 52

changes.mady.by.user Stefan Winter

Saved on

compared with

New Version 53

changes.mady.by.user Marina Adomeit

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...


eduroam Managed SP Web Frontendeduroam Managed SP RADIUS Servers
Local hotspot
Dataset description:Data required to manage deployment properties of eduroam Managed SP hotspotsLogs from the Managed SP RADIUS ServersLogs from the hotspot's APs/controllers
Purpose of processing:Allowing hotspot administrators to log into the system, add/edit/delete their Managed SP deployment, and to check usage logs of their hotspot

Troubleshooting issues and resolving security incidents.

Recommendation by the eduroam Service Definition.

Troubleshooting issues and resolving security incidents.

Requirement by the eduroam Service Definition is to keep the logs of public IP addresses assigned to users and its relation to users MAC address (no requirement imposed when using NAT).

Data source:

eduroam database - NRO information & institution information (see datasets above), eduroam SP proxy authentication data (see dataset above)

administrator input

web server and application logs

Data is logged in the Managed SP RADIUS servers when a RADIUS authentication or response passes (user accesses eduroam at a hotspot connected to Managed SP)

Data is logged in the equipment when a RADIUS authentication or response passes (user accesses eduroam at that SPs location)
Data storage and access:
  • this needs to be filled in by the sys admins of the servers - not yet decided where exactly the production servers will be,but in principle  same info as for CAT

Data is stored in the Managed SP RADIUS servers, accessible to the eduroam operational team personnel and the registered hotspot operator

Data is stored in the equipment, accessible only to the hotspot operating personnel.

Data transfer:System sends emails with invitation tokens (one variant to institution administrators for sign-up, one variant to end-users for credentialing, one variant to NRO personnel for general status updates)

No

No
Data retention:
  • The authorisation status of administrators who ever logged in is retained permanently.
  • hotspot deployment information is kept until the administrator chooses to delete it (then deleted immediately)
?

Depends on local the policy.

Personal data processed:YesYesYes

Dataset content


Data itemComponentIs personal data ?
1

eduPersonTargetedId or equivalent user identifier

Of NRO or SP administrator

eduroam Managed SP Web FrontendYes
2

First name and Last name

Of NRO or SP administrator

eduroam Managed SP Web FrontendYes
3

email

Of NRO or SP administrator

eduroam Managed SP Web FrontendYes
4

Outer EAP-identity

Users username@institution_domain, username can be anonymised but not all users do that

eduroam Managed SP RADIUS ServersYes
5

Calling-Station-Id

Users MAC address

eduroam Managed SP RADIUS ServersYes
6

Chargeable-User-Identity

Users anonymous ID

eduroam Managed SP RADIUS ServersYes


Description of fields

The details of service related datasets (data collections) should be filled with a list of all kinds of data which is collected or processed by this service. The table should be filled by the Service Manager and afterwards reconciled with the GEANT Data Protection Officer in order to address GDPR requirements. One service often incorporates several datasets.

<dataset_name> - name of dataset (collection of data processed in similar way).

Dataset description: brief explanation of the kind of information or entities the dataset contains.

Purpose of processing: what is purpose of data collecting and processing.

Data source: what are source(s) of data - list of services, systems, applications, databases or similar source components, including user's input, from which data are being received. E.g. RIPE database, service ABC, organisation LDAP directory...

Data storage and access: describe where the data are stored, backup-ed etc. and who has access to the data.

Data transfer: list of other services, systems, applications, databases or similar destinations to which data are being sent. E.g. RIPE database, service ABC, GÉANT's database XYZ...

Data retention: describe data retention policy ie. for how long data are stored before being deleted. E.g. 1 year, 2 years after contract ending, forever...

Dataset content

  • Data item: a specific dataset item. It may be an attribute, component or structure within a dataset that can be clearly described in terms of content. If attribute, it is usually described with the formally assigned name and corresponding explanation of meaning, purpose, expected content or allowed values. Property values characterise all or some items (records, members...) within the dataset.
  • Is personal data (DPO fills in): whether this item is (a part of) personal data. Decided and entered by the GÉANT Data Protection Officer while analysing the GDPR requirements. Answer Yes of No.

...