The promise of network convergence is one network for everything. Delivering it comes down to authentication: a single identity that works the same across Wi-Fi, broadband, and cellular.
Alan DeKok, CEO and Founder, InkBridge Networks
Convergence usually gets described as a plumbing project: collapse voice, video, data, and now fixed and mobile access onto a single network and reap the savings.
For an operator, the consolidation is worth chasing. The WBA Industry Report 2026 found that 60% of respondents agree that combining Wi-Fi and 5G will increase flexibility for their enterprise.
The part that decides whether convergence works in practice sits underneath the plumbing. It is authentication: whether a single identity can follow a user across Wi-Fi, broadband, and cellular without anyone noticing the handover.
If you run an internet service provider (ISP) or operator network, and you are weighing Wi-Fi offload, fixed mobile convergence, or a roaming partnership, this is a decision that determines success.
Get the authentication foundation right and the rest is engineering. Get it wrong and you inherit latency, support tickets, and an architecture you cannot extend. Much of my working life has gone into building and maintaining FreeRADIUS, and into the standards work that sits behind it, so what follows is a practitioner's view.
What network convergence requires
The Wireless Broadband Alliance (WBA) describes successful convergence as needing a common authentication and policy-enforcement framework, with each connected device carrying a single, unified identity.
That sentence is easy to write and hard to build. A unified identity means a user authenticates once, with one credential, and is recognised whether they land on a home broadband line, a public Wi-Fi access point, or a 5G cell. Every network in that chain has to trust the same identity and agree on what the user is allowed to do.
Federation is the mechanism that makes that trust portable, and federation runs on standards. That is why the authentication layer, rather than the transport, is the real foundation of network convergence.
For a buyer, the practical consequence is simple. When a vendor sells you a converged network, the first question to press on is how identity travels across the networks you are joining, and which standards it depends on. You can ask about the bandwidth and the boxes later.
RADIUS never left
Mobile networks historically authenticated with Diameter, while the rest of the connectivity world used RADIUS. The Third Generation Partnership Project (3GPP) has now deprecated Diameter in favour of REST API calls.
I was there as Diameter took off, and I’m still there as it looks to be winding down. In my opinion, it was more complicated than it needed to be, which contributed to both its cost and to the lack of open-source Diameter servers.
RADIUS, by contrast, never went anywhere. DSL has always been essentially 100% RADIUS. Wi-Fi and access-point authentication is all RADIUS. It has grown year on year, and I see nothing that will ever stop that.
So when Wi-Fi offload puts RADIUS back in the convergence conversation, it is worth being precise. The federation that convergence depends on is, in practice, a RADIUS-based federation. If you have already built your network on RADIUS (and as an ISP you almost certainly have), then you are building convergence on a foundation you already own and understand.
If you want the ground-up version of why that foundation is sound, we cover it in how the RADIUS protocol works and why it is secure.
Why a single identity across networks is so hard
If RADIUS is the foundation, why is convergence still difficult? Because the systems that hold mobile identity were never designed for the speed and volume that Wi-Fi demands.
Authenticating a SIM-based identity, using EAP-SIM or EAP-AKA, generally means talking to the Home Location Register (HLR), the carrier back end that performs the authentication. Those systems run at carrier scale, which in practice often means that they are slow. Our benchmark in RADIUS is that if a server does not respond within a millisecond, something is wrong. In contrast, HLRs often take seconds to respond.
That mismatch causes a problem for convergence. If you are providing Wi-Fi access to another operator’s customers, which is what roaming and offload require, your systems are now only as fast as their back end. And there are far more Wi-Fi authentications than cellular ones, simply because Wi-Fi access points sit much closer together than cell towers.
To make it worse, there is no way to push session resumption information to the visited network. That is, a device cannot say, “I am the same person from five minutes ago,” so every authentication has to go through the full process, across the entire network. That is overhead, expense, and load, multiplied across millions of devices.
OpenRoaming deployments are teaching the industry how to soften this. They lean on TLS-based EAP methods, which helps, and they use a different architecture: the interconnect carries data back to your home system rather than forcing every query through a carrier HLR. It is a genuinely useful model, although it is still smaller than cellular roaming and there is learning left to do.
(I go into what Wi-Fi offload and OpenRoaming deployments teach us in a companion piece.)
The same forces show up whenever authentication has to work at full production scale, as in our case study on network authentication at scale.
For an operator, the bottleneck in a converged design is rarely the Wi-Fi side. It is the integration with carrier-scale identity systems. Knowing that before you sign a roaming agreement tells you where your latency and your expense will actually come from.
Worth subscribing to.
Worth reading.
Our weekly newsletter covers network authentication tips, how-tos, security vulnerabilities, free resources, standards updates, and industry news. (All stuff you should stay up to date on!)
The standards work that makes convergence possible
Convergence only works if the standards bodies that own different pieces of it agree. Last year I went from a WBA meeting to a Wi-Fi Alliance meeting to an IETF meeting inside a single month: three week-long gatherings, with the same 15 to 20 people in the room each time. When those people agree, things integrate cleanly. The slow part is that everyone else has opinions too, and every opinion has to be heard. That negotiation, more than any single piece of code, is what sets the pace at which convergence arrives.
One concrete example of what we are working on is updating the underlying EAP standards so that a device can re-provision its own credentials over the air, without the user noticing. We are pushing this for the Wi-Fi enterprise and convergence case, alongside Cisco, who is using it for the Internet of Things.
Once a device is configured, it should be able to renew its own credentials on a schedule: issue a client certificate valid for a month and quietly renew it, or do it weekly, or daily. Today, that is difficult or impossible. With updated standards, it becomes routine, and routine renewal is better security. For example, when a phone is lost or an employee moves on, there is far less to chase down, because credentials expire and renew on their own.
Another example: the work coming out of our RADIUS Conference in 2025 turned into multiple IETF documents, and we have carried it forward at the next conference in Helsinki in 2026. There is never a single magic fix - one problem needs a RADIUS change, another needs an EAP change - so the effort runs across several standards at once. Much of it continues the roadmap we set out in making RADIUS more secure.
The other half of the work is interoperability. Standards exist, but everyone still likes to do things their own way, so most of the effort is people talking to people: I have to change what I send you, and you have to change what you send me. That is why, within the WBA, we are building a RADIUS interoperability capability around the WBA’s RADIUS interconnect standard, WRIX, so two operators can exchange sample traffic and get a thumbs up or thumbs down before committing to a full integration.
For an operator, this is the difference between an investment that lasts and one that strands.
Build
toward automated credential lifecycle and interoperability testing now,
and you are aligned with where the standards are heading rather than
fighting them later.
Fixed mobile convergence: one identity across Wi-Fi and 5G
The milestone that the WBA has flagged for 2026 captures the whole ambition of fixed mobile convergence: using an OpenRoaming identity on a cellular network, so a single identity works across both Wi-Fi and 5G. It is the right goal. It is also genuinely hard, for two different reasons.
The first is technical. RADIUS roaming is built around the network access identifier (NAI) - think of it as an e-mail address, someone@example.com. The 3G world uses identifiers too, but differently. For OpenRoaming systems to accept 3G identities, they have to implement a stack of 3G standards that are large and complicated, and then integrate with the 3G networks themselves on the RADIUS side. That is a great deal of detailed work, and it does not happen quickly.
The second obstacle is organizational, and it is the one operators underestimate. Most of our customers are ISPs, and many have telco arms, so there is genuine interest in gluing it all together. But the Wi-Fi side and the 3G side usually sit in different departments that find it hard to talk to each other, let alone integrate their systems.
The benefit to the operator is clear; the standards work and the internal coordination are what make it take time. If you are planning toward that single-identity future, the honest answer to “when will it work reliably at scale” is this: as fast as the standards mature and the large device vendors and operators implement them. Some move faster than others.
What this means if you are building toward convergence
Pulling the threads together, here is what I would tell any operator architect mapping a path to convergence:
Build on RADIUS-based federation. It is the through-line that connects everything from DSL to Wi-Fi offload to fixed mobile convergence, and you almost certainly run it already.
Design for the interoperability problem from the start: assume you will need to negotiate and test against partners, and use WRIX-style checks before you commit.
Plan for an automated credential lifecycle, with provisioning and deprovisioning that renew on their own, rather than the manual processes that quietly become unmanageable at scale. The universities we work with hit these problems of scale and turnover early, which is why their experience is instructive, and we explore it in the unique challenges of campus networks.
Track the standards trajectory, because the decisions being made at the IETF, the WBA, and the Wi-Fi Alliance over the next two years will determine what your network can do.
Convergence is complicated. There are many moving parts, across multiple standards and multiple companies, and fixing these things takes time. But the foundation itself is not a mystery. It is authentication, it is federated, and it is built on standards that have been proven for 25 years and are now being extended for the converged networks taking shape.
Need more help?
If your team is wrestling with network configuration, a troubleshooting problem you cannot resolve, or a system that needs to be more resilient, we can help. InkBridge Networks has 25 years of expertise: we wrote the standards, maintain FreeRADIUS, and have seen every failure mode there is. Reach out to request a quote.
Related Articles
Enterprise Wi-Fi standards and authentication
From Paris to Amsterdam, we spent October at the forefront of
enterprise Wi-Fi standards development - here's what carriers and
enterprises need to know about the future of network authentication. 
Client Case Study: Network authentication at scale
65% fewer authentication failures. 40% drop in support tickets. How InkBridge Networks is helping educational institutions by transforming their eduroam experience with protocol-level fixes.