Managed-site candidate
Qualify the private-site identity and approval workflow first.
Integration at a glance
Partner qualification
Validate identity acceptance and network behavior in both directions.
Future federation
Publish coverage only after validation and service agreements.
External federation remains a qualification and partnership milestone.
Standards in the architecture
EAP-TLS provides certificate-based Wi-Fi authentication. Passpoint can provide supported discovery and network selection. RADIUS and protected federation transport connect authentication infrastructure.
FIDO Device Onboard can complement initial connectivity with ownership transfer and operational provisioning. It is not a replacement for Wi-Fi admission or a guarantee of ongoing Internet service.
Two provider roles
An access provider admits approved external identities onto its network. An identity provider supplies or represents credentials that other participating networks can authenticate.
Operating HotSpotVU hotspots alone does not make our enrolled devices eligible on every external network. The identity role, partner acceptance, supported platforms, policies, and commercial terms must be validated.
What federation does not supply automatically
Manufacturers still need identity lifecycle management and fleet support. Businesses still need appropriate admission and capacity controls. Usage billing and operator compensation need measurement and commercial arrangements.
A visited network controls local packet forwarding and enforcement. HotSpotVU cannot promise that every third-party operator will apply a proprietary policy or supply the same usage and status data.
Qualification path
First qualify certificate authentication and the owner-approval flow at managed sites. Then test external identities on a HotSpotVU test network and our test identities on an agreed partner network.
Publish validated coverage and policy/accounting capabilities only after those tests and agreements. OpenRoaming certification, federation membership, and global service availability are not implied by this software implementation.
WBA’s September 2026 IoT announcement describes initial connectivity and device onboarding. That result does not establish HotSpotVU commercial roaming availability or persistent metered service.
Diagram and flow
- CURRENT SOFTWARE CANDIDATE
Supported HotSpotVU sites
Validate identity, business approval, isolation and device observations.
Next phase → Test interoperability - NEXT · QUALIFICATIONFuture
Test interoperability
Test accepted identities, local enforcement and lifecycle behavior.
After validation → Publish validated coverageIdentity trust → Represent trusted identitiesNetwork policy → Admit approved visitors - AFTER AGREEMENTSFuture
Publish validated coverage
Document accepted networks, support and service arrangements.
- FUTURE · IDENTITY PROVIDERFuture
Represent trusted identities
Establish credential acceptance and identity lifecycle agreements.
- FUTURE · ACCESS PROVIDERFuture
Admit approved visitors
Apply the visited network’s supported policies and service terms.
Read the diagram description
- CURRENT SOFTWARE CANDIDATE — Supported HotSpotVU sites. Validate identity, business approval, isolation and device observations.Next phase → Test interoperability.
- NEXT · QUALIFICATION — Test interoperability. Test accepted identities, local enforcement and lifecycle behavior.After validation → Publish validated coverage.Identity trust → Represent trusted identities.Network policy → Admit approved visitors.
- AFTER AGREEMENTS — Publish validated coverage. Document accepted networks, support and service arrangements.
- FUTURE · IDENTITY PROVIDER — Represent trusted identities. Establish credential acceptance and identity lifecycle agreements.
- FUTURE · ACCESS PROVIDER — Admit approved visitors. Apply the visited network’s supported policies and service terms.
Standards references
Read the WBA 2026 trials overview and the WBA and FIDO onboarding framework for the federation and onboarding work behind this direction.