188
31
97
4

FEATURED TOPIC: GakuNin Academic Access Management Federation

NII Interview

Improving services for researchersamong universities with GakuNin
With commercial web-based e-mail, we can check and send e-mails wherever we are. Still, trying to access in-house networks (intranets)
from home or when outside on business can be troublesome or simply impossible: an inconvenience business people have often experienced.
However, at universities, people are now able to read e-journals and access the university database from anywhere in the world as if in theirown research room. This is made possible with an identity federation called GakuNin.
Taki: I am not familiar with the work of the
Academic Identity Federation. Can you tellme what it does?
Nakamura: The Academic Identity Federation
is a federation of universities and research
institutions around Japan which aims forcollaboration among universities throughacademic access management, or “GakuNin.”
It is an attempt to make it easier for students
and staff to use a range of web-based services
such as e-journals using Single Sign-on (SSO)
technology.
Taki: What is that specifically?
Nakamura: For example, when you are athome, or, are away on business, you canaccess the university database or an e-journalsite that has a contract with your university
library. With SSO you only need one user
ID and password, making a different ID andpassword for each service unnecessary. Also,
once you have logged in with SSO, there is noneed to re-enter your ID and password every
time you start using another service.

universities began to unify IDs using acentralized ID management system, meaning
more and more of them can be accessedwith only a single ID and password. This iswhat is known as authentication integration.
Yet, difficulties remain when using external
services such as e-journals.
Taki: Universities and publishers havecontracts between them, so they have to
confirm that the user is a member of that
university.

Taki: What does Shibboleth mean?
Nakamura: That's right. IP (Internet
Protocol) addresses were used for that
purpose, meaning services could beaccessed from a university computer only,
and not from the user’s home or other offcampus location. That’s inconvenient. While
there are ways to gain access to services
through the university computers from homeor elsewhere, they’re technically difficult andare a chore for the user. We want to facilitateweb-based services that can be used fromanywhere in the world, by successfully
linking on-campus authentication systems
with external services.

Taki: That sounds really convenient. At
the moment we need a number of IDs andpasswords.

Taki: Technically what kind of structure isthat?

Nakamura: There is a range of on-campus
services for students and staff that universities
provide, such as e-mail, course registration,
performance evaluation, budget management
and library catalog search functions. Whenthese services were launched, each requireda different ID and password. However,

Nakamura: We are building a cooperative
authentication infrastructure mainly foracademic institutions based on the SAML
(Security Assertion Markup Language)
standard. Also, from the perspective of
external service providers such as e-journals
a unified authentication system instead ofMotonori Nakamura
Professor by Special Appointment
Academic Authentication Systems Office
Academic Infrastructure Division
Cyber Science Infrastructure
Development Department
National Institute of Informatics

2 NII Today No.44

different ones for each university makes it
easier for them to provide a universal service.
Work on constructing this kind of cooperative
infrastructure began around 2001, mainlyin academic institutions in Europe andthe USA. In Japan, NII began to look into
it in 2006 and made a full-scale launch in2009, thus bringing Japan up to date withthe rest of the world. The standard SAML
software, Shibboleth, is standard in academic
communities.

Nakamura: It is an ancient word taken fromthe Old Testament and meaning "stream" in
Hebrew that was used for identifying friends
and enemies. To find out their enemies, thefleeing Ephramites, the Gileadites made themsay "shibboleth" when they tried to cross theriver. The Ephramites could not pronouncethe "shi" sound, saying "si" instead. The usageof the word—a means of identifying friends
and enemies—originated in this ancient story.
As software, Shibboleth is an authentication
system to determine whether the otherperson can be trusted.
Taki: Yes, that brings to mind similar stories
here in Japan. Besides facilitating the readingof e-journals, what other advantages does
GakuNin have?
Nakamura: GakuNin offers an environment
where a range of services can be used withequal ease, regardless of the user's location,with just a single login. These include
e-learning, teleconferencing, file-sharing,

Junichi Taki
Editorial Writer and Senior Writer
Nikkei Inc.
Joined Nihon Keizai Shimbun (Nikkei) after graduating from the School of Political
Science and Economics, Waseda University.
Held positions in the Industry Department and Washington DC
News Bureau, and was the Senior Staff Writer in the Economics
Department at Osaka Head Office and Head of the Science andTechnology News Department at Tokyo Head Office amongst
other posts, before taking up his present position in March, 2009.
In charge of science and technology, environment and medicine.

and promoting collaboration
scheduling and project management.
Taki: That sounds convenient for use
in collaborative research with outside
institutions.
Nakamura: At present, when undertaking
collaborative research with researchers fromother universities, there’s no convenient,
ready-made set service for scheduling or the
like. I suspect that researchers look aroundfor suitable services in most cases, or create
their own. Using a universal authentication
system, we can provide a web environment
for joint use by participants, not only in Japanbut also for those working on international
collaborative projects. However, work still
has to be done to make it into more than justa system for verifying members’ identities.
Researchers involved in identity federation
throughout the world are currently working
on this, and it will bring it to fruition before
long.
Taki: Participation in international collaborative
research without being able to access cloudservices using academic authentication will no
doubt become difficult from hereon in.
Nakamura: Yes, and in the world of e-science
there are signs of that already. Take, forexample, the system can be used forthe transfer of academic credits among
universities. Domestically, there are alreadycredits transfer systems mainly throughregional consortia of universities. However,with approved credit exchanges still being
processed offline, and other similar states ofaffairs, there is still room for improvement
in student-orientated services like these.
Indentity federation is necessary in sharedregistration systems and for distributing
course materials. I believe that GakuNin
will be key to building an environment ofefficient and effective IT-based research andeducation.
Taki: How easy is it for universities to use thecloud?
Nakamura: More and more universities are
consigning their in-house data management
to external data centers on private clouds.
NII provides SINET (Science Information
Network), which connects universities
nationwide and supports academic clouds.

Also, with identity federation among
universities, we should be able to use thecloud even more efficiently and at lower costby sharing data center resources among
universities.
Taki: How many universities are currently in
the Federation?
Nakamura: There are forty-six, including
Hokkaido University and Chiba University.
This number is expected to increase as
there are universities that want to join but
are presently unable to because their oncampus systems haven’t developed to thatpoint yet.
Taki: How about globally, as with universities
in China and other parts of Asia?
Nakamura: China has established a system
similar to that in Japan, but other Asian
countries have yet to do so. In the Asia
region, interest has been focused mainly on
the development of network connectivity.
However, with the push to popularize thesystem in Japan, there has been recent
interest from India, Taiwan, and Malaysia.
It was Europe and the USA that took the
initiative in developing a universal academic
authentication system, and Internet2, a
research organization consisting of American
universities and corporations, is developing
Shibboleth.
Organizations in each country, such as
InCommon in the USA, and the UK Federationin the United Kingdom, are working topopularize domestic identity federation, and
GakuNin is the Japanese version of thosesystems.
Taki: What are the challenges when
promoting the system in Japan?
Nakamura: The system only started recently,
so the issue is that it’s not yet widely known.
There are already around 700 universities
nationwide linked to SINET, which NII
operates, and all these universities are readyto join through the network infrastructure.
Taki: Only 40 participants out of 700 is stillquite small, isn't it?
Nakamura: Yes, many universities are at
the initial stage of wanting to establish an

integrated campus-wide authentication
service. They are working towards that,and then when the time comes to update
the system they hope to join GakuNin.
Understanding of GakuNin is gradually
spreading, and its popularization is mainly aquestion of time.
Taki: It seems the advantages of joining
GakuNin have to be made more widely
known. Regarding the relationship between
GakuNin and SINET, do universities link toe-journal publishers via SINET?
Nakamura: No, it’s not always necessary to
go through SINET. NII supports authentication
by supplying the data relating to the university
and the service in order to determine theconnections to be made, which boosts
security. Also, there are rules which alluniversities have to follow to ensure thatthe authentication can be trusted. Identity
federation facilitates the provision of secureand user-friendly services to students anduniversity staff. Also, the effective use ofacademic clouds reduces costs, and we planto publicize such benefits more.

A Word from the Interviewer
The interview with Professor Nakamura
brought home two points. The first wasthat GakuNin will, without question,
increase user convenience for university
researchers and students. The second
was that if universal academic identity
federation spreads, it will promote crossborder collaboration between universities,
creating a user-friendly IT environment for
researchers and students; however, it mightalso increase the intensity of international
competition between universities. The speedof popularization of new IT services suchas the cloud is often slower in Japan thanin Europe and the USA. IT is essentially across-organizational technology, so in Japan,
where the organizational structure is veryhierarchical, decision-making up to the pointof introduction takes time. A time-consuming
vertical hierarchy like this could well bea barrier to further GakuNin penetration,with professors saying things such as "Thishas nothing to do with our faculty." I hope,
however, that this is just a groundlessapprehension on my part.

NII Today No.44 3

FEATURED TOPIC: GakuNin Academic Access Management Federation

NII Special 1

Improving Content Service User
Single Sign-on (SSO) enables seamless access to a range of services with a single ID and password. Content services such as e-journals canbe accessed at anytime from anywhere. Once logged in to a certain service, there is no need for the user to re-login when going to a different
service. The current user experience of library services has significantly improved thanks to the SSO-enabled GakuNin authentication
service. The following looks into this improvement, and also at related trends in Japan and overseas.

Roots in the e-journal: the
GakuNin authentication
service
According to Kazu Yamaji, Associate
Professor at the NII Academic Access
Development Office, "GakuNin was fullylaunched in 2010 after feasibility studies andpilot operation in 2008 and 2009 respectively.
The first service to be connected to GakuNin
was overseas e-journal access. There are
academic authentication federations in Europe
and the United States, begun before theiradvent in Japan, that operate at the national
level, and numerous e-journal access services
that integrate with them. Our first challenge
was to tie up with the world's largest academic
publishers, such as Elsevier, Springer andThomson Reuters, all of which are alreadyintegrated into academic authentication
federations."
NII therefore formed the GakuNin Taskforce
made up of cooperating university personnel
for academic authentication operations, and a

thanks to integration with GakuNin, and thisall services with just one individual ID andhas spurred a significant change of direction

password. Furthermore, once logged in,in the library services of universities and otherthe user has access to all the services thatorganizations. One member of a library team,

GakuNin is part of. There’s then no need to

Mr. Hideaki Noda of the Chiba University

enter a separate ID and password for each

Library, says the following:

different publishing company.

“Chiba University entered into a licence

SSO works not by the service provider

contract for the e-journal which the library is

holding ID data and personal information,

now providing as part of its overall services.

but by the organization of which the user is

However, up until that time we relied on aa member holding it. The data is processed,

locale-specific, IP address(*)-based service

through GakuNin, by a distributed-model

which was basically limited to on-campus

authentication base. The service provider

use. Access from outside the campus meantpermits access by relying on the veracity

having to get an ID and password from eachof the user authentication result generated

different publishing company and enter themby the IdP (Identity Provider) located at theas appropriate. And that meant having touniversity. Such mutual reliance by institution

manage an ever increasing number of suchand vendor for the purpose of authentication

IDs and passwords as the number of services

makes for a very significant difference fromgrew. Being as complicated as that was, thethe IP address authentication in general use.

number of remote access users never reached

IP address authentication was actuallymore than about 5% of the Chiba University

a problem insofar as absolutely anyone

campus body.”

could access e-journals simply by being on

On the other hand, GakuNin is a Single

campus. On top of that, applying to each andSign On (SSO) system, allowing access toevery publisher for a remote access ID and

Library Team comprising Associate Professor
Yamaji and five other librarians for the task ofintegration with content services. It thereafter
oversaw a process of vendor (publishers,1etc.) selection, negotiation, test operations,through to launch of operations, with the aim

Authenticated and

3 authorized to useof expanding the range of services available.

ARTICLESEARCH

Find the latest publications.

ARTICLESEARCH2

Affiliation with
our university confirmed

There are currently tie-ups with about
forty mainly European and U.S. publishingcompanies.

Content services have further developed

4 NII Today No.44

Personal
information
DB

Authentication server (IdP)
User

4

Look up cited papers
5 Authenticated and authorized to use.

All universities
e-Journals

Please proceed.

Library services and the
GakuNin differenceEnter ID and password

Re-directing
to IdP

6

Update your list of publications.
7 Already authenticated and

REFERENCE
MANAGER

Authentication complete,

So no ID/password
needed hereafter(Single Sign-On)

authorized to use. Please proceed.

SSO enables convenient access to library contents, with a single login. Users can enjoy access not only from research offices
on-campus, but also from their homes and other universities, and when on the move or traveling overseas.

Experience with Single-Sign-On
password and managing those generated
was burdensome, and it was frustrating not
being able to offer users an e-content service
that had the appeal of usability anywhere.
So SSO, besides improving user-friendliness,
also makes it possible to centralize ID andpassword management and reinforce security.
Mr. Noda continues: “Researchers go
through a regular cycle of searching, reading
and stocking publications, which is what every
stand-alone service can cater to. However,with SSO you get to freely and seamlessly
surf multiple such services, which is a very big
advantage.”

The role of JUSTICE
in future service
development
The Japan Alliance of University Library
Consortia for E-Resources (JUSTICE), locatedin the NII offices, was launched in April of2011 and is an indispensable part of the
GakuNin content service. JUSTICE forms thelink between the NII and university libraries,
and is responsible for negotiating contract

Hideaki Noda

Kazu Yamaji

Fumiyo Moriya

LibrarianAcademic Content Division
Chiba University Library of
Health Sciences

Associate Professor
Academic Access Development OfficeCyber Science Infrastructure Division
Cyber Science Infrastructure
Development Department
National Institute of Informatics

Japan Alliance of University Library Consortia
for E-Resources (JUSTICE) Secretariat
Library Liaison Cooperation OfficeCyber Science Infrastructure Development
Department
National Institute of Informatics

conditions and prices with vendors in orderto ensure that each organization can enjoy
stable and ongoing access to e-journals.

more tailored authentication options, cateringvendors are now very keen to provide services

According to Ms. Fumiyo Moriya, seconded

to individual departments or to teaching staff

more finely tuned to the type of user, such as

from the University of Tokyo Library System

in a particular field. The number of options

discounted services for students.”

and now in charge of consortium operations

can no doubt be increased if we target users

Associate Professor Yamaji expresses

at the JUSTICE office:in this way to achieve cost reductions, and if

a desire to break further into the Japanese

we can integrate services.”

vendor market, and speaks of providing new“JUSTICE is focusing much of its effort on
the joint purchase of e-journal subscriptions.

“Recently we have had more contact fromservices in Japan that have not been seen

Currently, each university undertakes theoverseas publishing companies, academic

to date, and using GakuNin to help breathebusiness of making contracts and payments,societies and platform vendors. One of them

new life into that market. He anticipates the

but we are in the position of coordinating

was HighWire, an e-journal platform operated

integration of ever fuller content with everthe needs of universities and approachingby Stanford University Libraries in the United

more diversified services.

publishing companies on their behalf. At that

States. Says Associate Professor Yamaji, “Bytime we first find out whether or not they

connecting with HighWire in March 2012,

are in GakuNin and, if not, try to solicit their

the number of service content titles instantly

participation.

rose to almost one hundred. This being the“From here on in we plan to maximize thecase, vendors in Japan are starting to consider

benefits of GakuNin and provide an array ofconnecting with GakuNin to coincide with

options. For example, we want to provide

their next upgrade. It’s apparent that Japanese(Written by Madoka Tainaka)* IP address
An identification number assigned to each computeror communication device connected to an IP network
such as the internet or intranet. In other words, it is an"address" in web space.

NII Today No.44 5

FEATURED TOPIC: GakuNin Academic Access Management Federation

NII Special 2

The dawn of a new era in resource
SINET cloud connection services
There has been an increase over recent years in individual universities’ launching of cloud services. Using the cloud enables a reductionin the operating costs and management tasks involved in the email, web and storage services provided by individual universities to date.
Furthermore, linking to the SINET academic information network and GakuNin makes application sharing among multiple universities easierand further reduces costs. The potential of the academic cloud is being further developed with the progressive integration of services offered
to universities by commercial service providers.

Commercial cloud services
for universities provided
through SINET

the current move to reduce costs, calls began

Integration using the GakuNin authentication

to be heard for SINET to host of a variety of IT

system’s global single sign-on feature will

services. In response, NII changed its rules ininvolve the added advantage of being able to

July 2011 to allow connectivity to commercial

use multiple services with just a single ID/

services so long as they were made available

password combination.

SINET(*1) is an academic information

to SINET subscribers. A new environment is

network built and operated by NII,1 andthus being built whereby users can accesswhich serves as an academic information

the cloud services of commercial service

infrastructure for all of Japan’s universities

providers via SINET alone. (Seven providers

and research organs. SINET provides thesehave connected to date.)

Services over the low-cost
cloud

Shunji Abe, SINET Promotion Office

Looking at the current state of cloudwith nodes throughout Japan, for theManager, says: “In the past year, Internet2

services at universities, Shizuoka University

purpose of creating academic communities

launched NET+ (“net plus”), which reinforces

rented a commercial data center in Marchand promoting the circulation of academic

application services by way of integration with2010 and set up a private cloud using thedata. SINET is also compatible with overseas

commercial service providers. I believe we will

SINET network. Virtual machines(*4) wereorganizations with a cutting edge network

research networks such as Internet 2(*2)

see more and more of this happening all overinstalled on it and terminals for administrationin the United States and GÉANT3(*3) inthe world. By bringing together commercial

were changed into thin clients(*5) on every

Europe.

service providers that can provide a variety ofcampus. It also provides on-campus users

cloud services, SINET will bring down costswith commercial cloud services for free.

To date, individual universities createdtheir own clouds and cloud services, but withand offer a superior service.”

Kyoto University of Education also set up
a private cloud service at a commercial data
center in Gunma prefecture, launching it in
September 2011, to which it migrated its email
system, authentication system, file server andwebsite server.
As for the SINET cloud connection service,
one example of use is that of Tokyo Universityof Agriculture and Technology. In December
2011, the university began using a new SINET
frame which commercial enterprises could
link to directly. It switched its email service,with about 11,000 users, to A-Cloud Mail
operated by Itochu Technosolutions and also
outsourced its customer service and security.
In this way it achieved a reduction in tasks,
better spam handling, and greater mailbox

Madoka Aihara

Shunji Abe

Masayoshi Setoyama

Assistant Manager
Service & Tariff Planning Section
Corporate Planning Department
UQ Communications Inc.

SINET Promotion Office Manager
Associate Professor
Architecture Science Research Division
National Institute of Informatics

Solution Manager/Section Leader
Public Business Department
First Business Division
NTT Data Kyushu Corporation

6 NII Today No.44

capacity.
Then there is Hyogo University of Teacher
Education which connects to the ePort
Folio System on NTT Data Kyushu’s cloudservice as part of an academic administration

utilization withand GakuNin
system that it had already adopted. The
ePort Folio System is a service that supports
the verification of qualifications and abilities

IP address is assigned fromthe university-specified range.

based on the university’s teacher training

GakuNin SP
Provides a private service forusers authorized by university IdP.

Connection from UQ is on L2VPN,
as on-campus.

UQ WiMAX network

standard. It can also be used to verify student

University campus LAN

self-assessments and reports.
Masayoshi Setoyama, Solutions Manager
at NTT Data Kyushu Corporation, talked
about how they can provide a service that

On-campus
firewall

Network Center

supports GakuNin with a lighter burden:“This service can be viewed as a “second
Connection to the data center isconducted by configuring VLAN ofeach university to the line set up by UQ.

campus” in that it doesn’t require the placingof a server on campus but connects to SINET

GakuNin IdP

Access to off-campus goes throughthe same firewall as ordinary
on-campus computers.

through a server inside a data center. Our
company provides the cables to connect toIllustration of campus LAN extension to mobile, using the cloud connection framework.

SINET greatly reducing the initial installationand operational outlay for universities. Our

integrates with SINET and GakuNin achieves

leverage outside resources. That is the key tolibrary management system and educational

high value with few resources. Participating

expanding services in the future.

affairs system is now integrated within Gakunin brings cost reductions over the

GakuNin, and using the knowledge acquired

existing service as well as newly createdduring that process the ePort Folio System isservices, all of which strengthens the position

set to be integrated with it by 2013.”

of both the university and the commercial
enterprise.

(Written by Yuko Sakurai)*1: Science Information Network (SINET)
A science information network established and operated

Expected improvements in
IT services through SINET
and GakuNin collaborationsuch as email and storage also need catering

Keio University’s Shonan Fujisawa Campus

Associate Professor Abe says “We are

adopted UQ Communications’ Mobile

currently looking at services that cater to the

WiMAX Campus Network Connection

special needs, the new needs, of universities

Service as early as April 2011. This made an

and similar institutions. We are sounding“on-campus” experience possible from evenout what is needed and soliciting proposals

by Internet2. For further details please visit http://www.

off campus by assigning the university’s IP

to try and ensure the most user-friendly andinternet2.edu/

address to a mobile terminal for access to theefficient use of SINET and GakuNin.“on-campus LAN.

Yet, what are considered ordinary services
to with services that take into account theby NII.
Reference: NII Today No.38 [SINET4 The Next Stage ofInformation Lifelines] (Issued July 2011)

needs of universities and research institutions.

We can look forward to a vitalization of*2: Internet2
A next-generation internet research project in the UnitedStates in which over 200 universities and other tertiary
institutions and over 60 enterprises participate. The
Shibboleth application used by GakuNin was developed*3: GÉANT
A next generation network for internet research andMadoka Aihara, Assistant Manager at UQ

research and education and further progress

Communications says: “Next, we approachedin academia if universities can link to each

It covers over 40 countries and connects over 8,000

Kyoto University about providing it theother through GakuNin, by way of sharing the

research and educational institutions.

service and were asked if GakuNin would besame online system, and opinion exchanges

For further details, please visit http://www.geant.net/

available on it for the user who had completed

in research communities. Regional consortia

authentication registration. We appreciatedof universities, such as in Ishikawa, Shinshu,

the fact that this would eliminate the need for

Kyoto and Shikoku, are already looking intomachines can be constructed in a single computer anda separate authentication system on our part,and preparing for integration with the cloud,operated independently.

and proceeded with GakuNin integration.”and utilization of Gakunin. Universities and

The WiMAX service, integrated with SINET

enterprises need to think about what can be

and GakuNin, was also adopted by Kyushu

achieved by mutual utilization of university

University. Creating a cloud service that

resources, and get a sense of the need todevelopment in Europe.

*4: Virtual machine
A virtual computer built of software. Multiple virtual*5: Thin client
A system that runs application software and manages
files and other resources on the server side, with thecomputer only having the minimum number of functions.

NII Today No.44 7

That's Collaboration 1

NII

Campus Services

Enabling IT service improvement
by university collaboration throughIT service improvement and cost reduction is an issue for universities and research institutions. IT managers from various educational
institutions—national, public, private universities and colleges of technology (Kosen)—all with different perspectives on participation in
GakuNin, gathered and told us about initiatives at their institutions and about how GakuNin helps solve problems. We also heard from IT
managers’ about their current challenges and requests they had for new services.

Compensating for
few resources by
joining GakuNin
At present, there are forty-six schools
participating in GakuNin. Can you tell us the
background to your participating?
Tadaki: In 2000, Saga University began tointegrate authentication information anduser management. You see, at the time, there
were only one or two full-time teachers at
the Center in charge of administering about
10,000 people. Also, as well as the UNIXsystem we used then, we also started using
Windows, and had to synchronize the two
accounts. We heard about GakuNin when wewere examining the Single Sign-On function in
the course of a system update, and joined at
the trial stage, which made for good timing.
Jin: In 2004, fifty-one Kosen colleges came
together to form an independent body, theInstitute of National Colleges of Technology,
which is developing a unified information
infrastructure over the mid to long term.
This April, the same authentication
infrastructure was set up in each Kosen,
and administration of the accounts was
integrated. Not wanting to fall behind what
the universities are doing, we are currently
preparing for participation in GakuNin. Ouraim from hereon in is not only to reduce costs
and optimize, but also to develop humanresources for network management. In thecourse of standardizing the information
infrastructure and devices, we also plan touniversalize services.
Maeda: I am affiliated with the Faculty ofInformation Sciences and Graduate Schoolof Information Sciences, at Hiroshima City
University, and am also the Information
Processing Center Manager, although theCenter doesn’t have any full-time staff.
We don't have much in the way of humanresources, so were interested in GakuNin,
with its range of services provided at low cost,and so we joined last year. The specific reason

8 NII Today No.44

we joined was that Hiroshima University, theHiroshima Institute of Technology, and ouruniversity, had embarked on a collaborative
Program for Biomedical Technology andInformatics, and we were looking for a way tohandle e-learning and account management.
Igarashi: I manage the information
infrastructure at Seijo University. My wish isfor students to have successful experiencesof IT use at university that will help theirprofessional development once they graduate.
Private universities are different from national
universities in that they don’t have a leader
like NII, so getting to the point of actually
implementing things is difficult. It was whileconsidering adopting an SSO service that
we heard about GakuNin and the improved
service it made possible on a low budget, andjoined.

Security strengthening
and the added benefit ofregional collaboration
One of the advantages of GakuNin is that it
uses the on-campus authentication service
to link to external services. What otherbenefits have you found?
Tadaki: Cost reduction is a huge benefit.
With information systems, operating costs
are more of an issue than construction costs,
but integrated authentication management
eliminates the user management part ofthose costs. With SSO, there is no need tomake an authentication page for each system,and there’s no handing on of passwords
to the other systems, meaning security isalso improved. Not having to change eachorganization's ID system also makes GakuNin
easy to join.
Igarashi: Differentiation from other universities
has to happen at a layer higher than that of
IT infrastructure, and at that level GakuNin's
Shibboleth authentication is a big advantage.
Jin: All our Kosen can use our own accounts,
which enhances collaboration between eachone and creates opportunities for further

regional collaboration.
Maeda: We also use it for regional
collaboration.
In the future, we can expect to see
authentication collaboration between public
universities and local authorities. Whatkinds of challenges do institutions trying to
introduce GakuNin face?
Maeda: One issue is that building an IdP(authentication server) is really hard. Anotheris that the benefits are not easily understoodby the office. The gap in understanding
between the recipients of GakuNin services
and those who set up the environment is one
hurdle to adoption. But in the future, I thinkthat the provision of services directly related
to management and administration will leadto understanding.
Igarashi: System replacement is notstraightforward at universities that alreadyhave SSO systems. Having some kind ofconnector like an IdP filtering service would, I
think, make joining easier.
Maeda: There are universities whereindividual faculties have contracts withe-journals. GakuNin support is technicallypossible in these cases too; so an increasein case studies tuned to such needs would
no doubt see a wider range of universities
participating.

Expectations for academic
system authentication
integration and e-learning
services.
Tadaki: From a researcher's perspective, I
would like to see nationwide systems likean electronic application system for Grantsin-aid for Scientific Research, and basic
information on research results, as well as
authentication integration for academic
conferences. I would like to make all out useof the infrastructure for academic research,and information distribution and sharing. It
would be good too if national universities’at low cost
GakuNinKaori Maeda

Kazuhiro Igarashi

Shinichi Tadaki

Tomoya Jin

Deputy Director (Information Manager) andInformation Processing Center Manager
Professor
Faculty of Information Sciences and Graduate
School of Information Sciences
Hiroshima City University

Assistant Manager
Media Network Center
Seijo University

Professor
Director of Computer andNetwork Center,
Saga University

Assistant Manager, Information Planning
General Affairs Division
Headquarters Administration OfficeInstitute of National Colleges ofTechnology

operations systems could be shared. Even if
it couldn’t be implemented in unison, a few
universities could start using a frameworkthat enabled participation later on.
Maeda: I’d like a security education system inthe e-learning context.
Jin: At Kosen we use e-learning to carryout information security education for theteaching staff. It was when we first looked intodeveloping this independently that we heard
about GakuNin as a means of implementing
it. And now we are taking part in the GakuNin
early assessment.
Igarashi: We introduced English e-learningat our university. It would be good if services
like this could be used on the cloud so that all
the universities participating in GakuNin could
use them together.
Jin: What about safety confirmation systems?
Since the 2011 earthquake, safety confirmation
systems have become ever more important,and I think there are ways in which GakuNin
can support them.
Tadaki: The cloud is vital for safety
confirmation, considering how devices can getdamaged in disasters. Mails sent en masse,such as when informing students that theuniversity is closed because of a typhoon, areoften interpreted by mobile carriers as spam,so we need to realize that e-mail is no longer
effective for such purposes. It would be muchbetter if safety confirmation and emergency
communication could be done over the web.
Using Twitter or other platforms for safety
confirmation involves the issue of personal
information.
Igarashi: I hope that collaboration with SNS
can develop, and that it becomes possible
to attach and send individual user attributes
when necessary. I’d also like to see increased
collaboration with overseas universities. Thatwould require raising GakuNin's security level,but if that could be done it could serve as astandard for the enhancing of the on-campus
security environment. It would also be good
if there were more services available that
increased motivation to learn like discounts
offered by electronic library-linked services
on e-journal purchases by collecting GakuNin
points.
Tadaki: Or, I wonder if it would be possible toconsider authentication in regard to physicalobjects, such as books that can be borrowed
from other university libraries?
The incorporating of device authentication
could extend to biometric authentication.
Maeda: In the USA, Massachusetts Instituteof Technology opens classes to the public, andthat kind of opening of content and enablingof sharing leads to service improvement. It
would be good to see developments like thatin Japan, too.
Igarashi: In the past, we were delighted justto have Internet access. Now, with GakuNin,
it is great to have a connection on a higher
layer. Also, if numerous universities andcorporations participate, the possibilities forthe introduction of superior services also
increases.
Tadaki: If over 100 universities join, thepossibilities will increase even further. In
universities overseas systems like GakuNin
are used to secure excellent IT humanresources. I hope that the GakuNin systemand technology will attract young techniciansin Japan, too.
(Written by Yuko Sakurai)

NII Today No.44 9

That's Collaboration 2

NII

Trust

The possibilities of identity federation
Once GakuNin can function as a

explains as follows:collaborative infrastructure, seamless"A readily recognizable example of a trust

collaboration with overseas parties andframework is the JAS (Japan Agriculturalcommercial services will also becomeStandards) mark on foodstuffs. When we

possible. For this to happen requires thebuilding of a trust framework throughwhich user information can be safely
shared among participants. A trust
framework enables identity federation
in industry and academia, making it thepotential foundation of a more secure andhighly reliable online service.

Mutual guarantee of user
authentication reliability

see the JAS mark, we know that a third
party organization has warranted that the
ingredients are displayed in accordance withJAS standards; we trust it, and purchase theproduct. Technically speaking, credit granting
by a third party resolves asymmetry, and thisconcept is now being made a reality in the
online context."

Enabling international
service collaborations
So what will the construction of a trust
framework enable?

Authentication structure is a major issue"If a trust framework can be constructedwhen operating GakuNin, and proper use ofproperly, it will be possible to provide andthe system can only begin once a safe, reliable

use a variety of online services securely andand usable authentication infrastructure has

conveniently," says Associate Professor

been established. The issue can be addressed

Sato. Online trust frameworks are already inby way of a trust framework. Hiroyuki Sato,

operation in the United States, and services

Associate Professor at The University of Tokyo,

are expanding. The provider of this framework

and a key figure in GakuNin trust construction,in the U.S. is Open Identity Exchange (OIX)

explains what a trust framework is:(*1), a private, non-profit organization.

Hiroyuki Sato Takeshi Nishimura
Associate Professor
Information Technology
CenterThe University of Tokyo
OIX LoA 1 Assessor for
GakuNinSpecially Appointed Researcher
Academic Access Development OfficeCyber Science Infrastructure Division
Cyber Science Infrastructure
Development Department
National Institute of Informatics“The idea is simple. It is a system that

GakuNin has received OIX certification, andproperly, having an appropriate operational

provides some warranty of user authentication

access with the same ID is possible evenstandard (or policy) and the supporting

reliability in an online service. An IdP (Identity

for services provided by the US National

technology is essential. One example of this is

Provider) confirms who the users are, andInstitutes of Health, the National Library of

the uApprove.jp software. Takeshi Nishimura

supplies each user with an ID. Then, with theMedicine, and the Library of Congress.

is a project researcher at NII who wasuser’s consent, his or her personal information"This means that GakuNin meets international

is securely transmitted to the service provider

standards of reliability," says Mr. Sakimura, a(SP), which then provides online service toboard member of OIX. "That is to say, once the"With a trust framework, the IdP which

the user. This whole structure is called a trust

standards have been met, seamless global use

issues IDs and conducts authentication

framework."

involved in its development; he describes its
features as follows:

becomes a reality. It also solves the extremely

provides the SP with only that personal

On networks, individuals are normallyinefficient operational problem of each service

information which the user has agreed can be

identified by an ID and password, yet there isprovider having to enter into a contract withsent. The uApprove.jp software enables thisno way to confirm that the person using theeach user, issue IDs, and conduct authentication.

function. After getting the user’s agreement at

ID is the person actually registered. However,So, there are huge advantages for the service

the time of online authentication, it forwards

if a trusted body can properly warrant the ID

providers, too."

the required personal information to the SP

as belonging to the actual person trying to log
in, this concern can be resolved.
Natsuhiko Sakimura, a leading figure
in digital identity research and SeniorResearcher at Nomura Research Institute Ltd.,

10 NII Today No.44

from the data held by the IdP.”Supported byboth rules and tools
For the trust framework to operate

Mr. Sakimura talks about the function
whereby the IdP lets the user choose what
information is sent:"Compliance with regard to privacy hasthrough trust frameworks
Collaboration with uApprove.jp
Used as the first filter

Informs of the required personal information categories in advanceTaro Kokujo

IdP

SP

3 Only the agreed personal information is sentuApprove.jp
1

Name and e-mail address required

Information selection andconsent to send

Personal information
to be sent is displayed2□ Taro Kokujo□ abc@example.jp□ Taro Kokujo□ abc@example.jp

User

Agree to only name being sent

By collaborating with the IdP plug-in uApprove.jp,
the user is able to decide which information is sent.

Natsuhiko Sakimura
Senior Researcher
Nomura Research Institute Ltd.
Open Identity Exchange Chairman

by appropriate policies and cutting edge

goes beyond just academic use to become ainformation technology, but the reliability ofpotential base for connecting society at large.

the framework itself originates in having a

The shape of the information society of thereliable identity provider. GakuNin users being

future lies here, in this system, with its highstudents and researchers, it is the universities

levels of security and convenience.
(Written by Akiko Seki)

that warrant identity and issue IDs, whichmakes for a very high level of reliability.
Associate Professor Sato anticipates new

become an extremely important issue,

functions for GakuNin:*1: Open Identity Exchange (OIX)OIX is an organ that provides an authenticationand each institution has various policies"This means that GakuNin is a trust

regarding it. It’s important to guarantee

framework that can enable online

compliance effectiveness with a tool such as

authentication not only for universities, butuApprove.jp. Yet it is not limited only to this.

for commercial service providers as well. Such

Identity federation is made up of a range ofa framework covers education and research,*2: Communications protocol

technologies, such as formats in accordance

but can also extend to student welfare. Also,

A communications protocol is a set of mutuallywith international standards, technology thata connecting gateway function has been

determined rules for when computers communicate

protects transmitted data from falsification ordeveloped for the different communications

theft, and technology that lets the recipient

protocols(*2) of GakuNin and generaluse the other party’s signature to verify thatcommercial services which gives usersthat other party and the content are genuine.

seamless access to commercial SP services

Trust frameworks are supported by thisusing only their GakuNin ID."

combination of rules (policies) and tools(technology)."framework for the Federal government of the UnitedStates, certifying ID management providers using theFederal Standard.

through a network. Many commercial services use Open
ID for authentication-related communication. GakuNin
uses SAML, which has a different authentication
structure.

For example, there has been a dramaticincrease in accessibility to student discountservices. As the university warrants the

Expanding services withseamless ID collaboration
between industry andacademia.

identity, there is no need for cumbersome

The trust framework itself is made possible

federation, the GakuNin trust framework

procedures such as sending copies of student
ID cards, and student discount services canbe easily accessed online.
By enabling industry and academia identity

NII Today No.44 11

NII Today Back Issue

NII Today provides readers with the latest National Institute of Informatics news from a variety of perspectives. Contents include
reports on the latest research trends in informatics, collaborative projects with other educational institutions and corporations,and the voices of dedicated researchers working at the forefront of their fields.
This issue marks the 44th issue of NII Today, since its previous incarnation as the National Institute of Informatics News.

FeatureNo.

Issue date

43

October, 2012

Multimedia Sensing

42

July, 2012

The Academic Cloud

41

April, 2012

Web Data-Driven Information Flow

40

January, 2012

Green Innovation through ICT

39October, 2011

Information and Human Society: The New Relationship Between Society and Media

38

July, 2011

SINET4: The Next Stage of Information Lifelines

37

April, 2011

Security: Towards a Safe, Secure Society

36

January, 2011

GridXe-Science35

October, 2010

Artificial Intelligence: From Personal to Societal Knowledge

34

July, 2010

Language: Using language as knowledge

33

April, 2010

New Trend of Software Engineering

NII will continue to produce high quality publications that appeal to the thinking reader.
Back numbers can be viewed and downloaded at the following address:
http://www.nii.ac.jp/en/about/publications/today/

Weaving Information into Knowledge

NII Today No.44, Jan. 2013This English language edition NII Today
corresponds to No. 58 of the Japanese edition

Published by National Institute of Informatics, Research Organization of Information and Systems
http://www.nii.ac.jp/
Address: National Center of Sciences
2-1-2 Hitotsubashi, Chiyoda-ku, Tokyo 101-8430
Chief editor: Yoh’ichi Tohkura Cover illustration: Makoto Komori
Photography: Yuki Akiyama and Takashi Arai Copy Editor: Madoka Tainaka Production: inscape Inc.
Contact: Publicity Team, Planning Division, General Affairs Department
Tel: +81-3-4212-2164 Fax: +81-3-4212-2150
E-mail: kouhou@nii.ac.jp

Cover Illustration
GakuNin will make it possible toaccess any content or service anytime,
anyplace. Imagine the convenienceand comfort of cruising, as if on air,through a giant library, with any book
you want right there for the taking.