NTT Technical Review
December 2015 Vol. 13 No. 12
View from the Top
Hiroshi Nakagawa, Senior Executive Vice President, NTT EAST

Feature Articles: Cybersecurity-related R&D to Counter
Global Threats
Cybersecurity R&D to Counter Global Threats
Trends in Global Security Threats
Security Intelligence for Malware Countermeasures to Support NTT Group’s
Security Business
Security Orchestration with a Global Threat Intelligence Platform
Efforts to Achieve a Joint Risk Management Support System

Feature Articles: Service Design for Attractive Services andTrends in Design Thinking
Service Design for Creating Attractive Services, and Trends in Design
Thinking
Concept Tailor: A Tool for Iteratively Designing Service Concepts Using
Storyboards
Evaluation Methods for Service Design
Methodology for Creating Attractive Services
Training Initiatives for UX Designers
Initiatives Related to the Creation of New NTT DATA Services

Regular Articles
Recent Activities Involving OpenStack Swift
Improving Inter-system Cooperation and User Convenience in Confirming
Personal Safety during Disasters

Global Standardization Activities
Standardization Efforts in IP Number Portability Specifications

Practical Field Information about Telecommunication
Technologies
Wireless LAN Tester Conformable to IEEE802.11ac

New NTT Colleagues
We welcome our newcomers to the NTT Group

External Awards/Papers Published in Technical Journals
and Conference Proceedings
External Awards/Papers Published in Technical Journals and Conference
Proceedings

View from the Top

NTT EAST at a Major Turning Pointin Business Structure—All Employees
Working as One to Reform theBusiness Model toward Sustainable
Management
Hiroshi Nakagawa
Senior Executive Vice President, NTT EAST
Overview

The growth of FLET’S HIKARI—NTT’s optical access broadband service and flagship product—shows signs of slowing down as the demand forhigh-speed Internet eases and competition with optical access services ofother companies intensifies. Under these conditions, NTT EAST is reexamining its business structure and reforming its business model to steer thecompany toward sustainable management while growing its business-user
market. We asked Hiroshi Nakagawa, Senior Executive Vice President of
NTT EAST, to tell us about the aims and rollout of the Hikari Collaboration
Model and specific initiatives such as the new marketing method called ICT
Concierge.
Keywords: optical access, FLET’S HIKARI, Hikari Collaboration

Opening up the future through employee
efforts—turning to profit-oriented management
and reforming the business structure—Mr. Nakagawa, please tell us about the businessenvironment surrounding NTT EAST.
NTT EAST is now at a major turning point. Since
fiscal year 2014, we have been making changes to ourbusiness structure and tackling various tasks inreforming our business model. The history of thecompany up to now has been a history of expanding
FLET’S HIKARI. As you know, NTT EAST is acompany that carries on the work of the former
Nippon Telegraph and Telephone Public Corporation,


which means that the foundation of its business is the
traditional growth-in-numbers model. In line withthis business model, we began the full-scale provisionof our B FLET’S optical access broadband service in
2001. Since then, we have expanded the service coverage area and deployed splitter equipment in condominium buildings, and we have steadily increased ournumber of subscribers while improving the usage
environment for optical broadband services. As aresult of implementing these measures, we havegrown our optical access business to a level that surpassed 10 million subscribers in 2015. I attribute thissuccess to the personal efforts of the employees of the
NTT EAST Group, our subcontractors responsible
for sales and access-line installation, and our research
NTT Technical Review

View from the Topteam that works tirelessly to develop compact equipment and efficient installation methods.
However, the growth in the number of subscribers
has slowed as the demand for high-speed Internet
eases, thereby reducing the number of new lines.
Service terminations have also increased as somecustomers switch to other companies’ services.
This ease in the demand for high-speed Internet canbe attributed to a change in Internet terminals, that is,from connecting to a fixed network with a personal
computer to using mobile broadband via a smartphone, tablet, or other smart device. In younger age
groups dominated by students, it is not unusual forusers to have no personal computer, so the presenceof fixed broadband services is on the wane. At thesame time, severe competition with the optical accessservices of other companies continues as ever, withthe result that our annual operating revenue is on a
downward trend.
We have been striving to make up for this drop in
operating revenue by curtailing operating costs. In
fiscal year 2014, we reduced expenses by more than
1 trillion yen over fiscal year 2000 and managed tomaintain a profit. However, given the costs of discount services and sales promotions, the profit ratioof network services themselves remained low with nofundamental improvements in this area.
We therefore gathered up the courage to steer thecompany in another direction. In short, we abandoned
the model of growing only in terms of numbers. We
are working, for example, to reform the mechanismof paying high commissions to agencies and representatives and to revise the billing system such as byterminating the Omoikkiri Wari discount plan. This isa radical departure from our past marketing method,
so there has been some puzzlement and even backlashfrom the front lines of our sales force. I have therefore
had talks with our staff members who have directcontact with our customers in an effort to obtain theirunderstanding. Thanks to everyone’s hard work, weachieved an operating profit of 109.8 billion yen in
fiscal year 2014, the highest record since the company’s founding.
To hear what our employees at the front lines haveto say, the President, Senior Executive Vice President,
and Executive Vice Presidents make time to visit thevarious NTT EAST regions two or three times a year
to talk with employees. This means hearing somevery strong opinions, but it also provides a great
opportunity to convey each other’s honest feelings.
There are many things that are true in theory that do
not hold in the field, and it is vitally important that weVol. 13 No. 12 Dec. 2015

have a firm grasp of the real situation.
—NTT EAST is transforming itself in a big way andexploring new frontiers. What is the company’s medium-term management strategy for facing these challenges?
The growth-in-numbers era is over. From here on,
all employees will be asked to understand shifts in thebusiness environment, the status of operations, etc.,
and to orient themselves along a new vector, that is,
to change direction. In short, we have to steer ourselves toward sustainable management that emphasizes profit and efficiency.
There are three main elements to this strategy. The
first one is “profit-oriented management.” In addition
to network services such as FLET’S HIKARI, which
is becoming a commodity, we are aiming for an earlylaunch of high-value-added services expected to havea high profit ratio such as datacenters and cloud services.
The second element is “business structure reform.”
I would like to shift our consumer-oriented businessstructure to one centered on business users and the
Hikari Collaboration Model (wholesale fiber accessservice). Our corporate customers are doing businesson a variety of scales, and some have expressed theneed to use the Internet to enhance and expand theirbusiness. However, I don’t believe these needs arebeing adequately met, so for these customers, we are
introducing aggressive reforms including the development of new services and systems and the appropriate allocation of human resources.
Finally, the third element involves making a “contribution to NTT’s consolidated profits.” NTT EAST
is not confined to the business of one company. For
example, we also provide base station circuits forView from the Top

NTT DOCOMO’s LTE (Long Term Evolution)Advanced system, and we undertake facility maintenance for NTT Group companies that benefit fromour many maintenance bases. In this way, I would liketo promote initiatives that contribute to expanding the
NTT Group’s profits.
Serving as a catalyst to roll out services closely
linked to the community and people’s lives—The Hikari Collaboration service was launched in
February 2015. Can you give us a progress report?
Thanks to all concerned, the number of contracts
has been increasing steadily, and as of July of thisyear, that number topped 1 million. Moreover, thenumber of service providers using the Hikari
Collaboration service including initially targetedbusinesses such as mobile operators, home-electronics mass retailers, and Internet service providers
came to more than 150 companies as of September.
Hikari Collaboration is a mechanism for providing
NTT EAST FLET’S HIKARI services to businesses
that, in turn, provide those services to end users combined with their own commercial products. With thismechanism, we can cultivate user layers that we
could not reach in the past, and because it features
composite services intertwined with a company’s

products, we expect end users to make longer use ofsuch optical services.
There have been some misgivings about this mechanism since it prevents us from having any direct
involvement with end users. However, I feel that we
can eliminate such apprehension by building a solid,
trustworthy relationship with these companies inorder to achieve a Win-Win-Win relationship among
three parties that includes end users.
Let me be more specific. The companies using
Hikari Collaboration serve as a business partner of
NTT EAST, and FLET’S HIKARI serves as a catalyst for making the services provided by those companies even better for their customers. In other words,
we are developing a business in which NTT EAST
and its business partners work together on providing
services to end users. For example, companies infields such as caregiving or security provide services
that are seen by their end users as indispensable totheir lives. End users should then continue to usethem unless they become unnecessary or out of date;to put it another way, end users are not likely to quit
using FLET’S HIKARI. In addition, a company using
FLET’S HIKARI can differentiate its services fromthose of other companies in the same industry. At therisk of exaggerating the effects of Hikari Collaboration,
I believe it can foster innovation in all sorts of industries.
Going forward, NTT EAST will support the business endeavors of the companies participating in
Hikari Collaboration while providing them withknow-how that we have accumulated such as knowledge of optical fiber services and methods of consulting with end users.
This is a new B2B2C (business-to-business-to-consumer) approach, which means that our businesssense will be tested as well. I am confident, however,that both young employees with a flexible way of
thinking and veteran employees who have achievedmuch up to now in the B2C (business-to-consumer)
business will do their part diligently.
—How will you approach expansion of the businessuser market?
I would like to intensify our contribution to thevitalization of local economies. Our strengths in thisregard are the branch offices that we have in eachregion and the close relationships that we haveformed with local governments. I would like to leverage these strengths to promote projects in education,
medical care, and other areas.

NTT Technical Review

View from the Top

Since the businesses of our corporate customers areof various scales, we will need to prepare strategies
tailored to businesses of various sizes instead of one
comprehensive approach. Up to now, our standard
business style has been to talk to customers as theneed arose on their end and to then proceed with measures to meet their requests. However, from thisspring, we began to change this approach by proactively visiting customers on our end and asking if
they have any problems or requests. We have named
this new marketing method “ICT Concierge.”
There are as many types of needs as there are typesof customers. Since we also call on customers thathave no particular information and communication
technology (ICT) needs, receiving a response fromthem can be difficult. Thus, it’s not simply a matter ofvisiting customers and getting quick results. For thisreason, I instruct our employees to make frequent
visits to our customers, assess their responses after
each visit, and adjust our activities with an eye to the
future. All in all, I would like to have our customers
entrust us with the task of ICT management that they
have been burdened with up to now.
The dedication to routine and patient effort produces great results—passing on the corporate
DNA of NTT EAST
—Do you have a few words for NTT EAST employees
who are working together to get through this periodof great reform?
We began our reform by making contact with ourcustomers and going out to visit them, and this is anapproach different from the past and requires effort
and patience. I understand that changing what we are
already comfortable and familiar with can causemuch anxiety. It is difficult to make such a switch,
especially after having achieved positive results with
our past approach. Now that we are advancing all
together at NTT EAST in a new direction, I would
like to ask everyone to understand the ideas that we in
top management are promoting and to tell people not
to be discouraged if they cannot achieve good results
right away.
Additionally, I would like everyone to remember
that, while we are a leading ICT enterprise providing
ultrahigh-speed broadband services, we are also a
company doing what might be called routine or unexciting work such as erecting utility poles and connecting cables. In the aftermath of the Great East Japan
Earthquake, this is the type of work that we faithfullyVol. 13 No. 12 Dec. 2015

did around the clock to restore services to our customers. It is this spirit, this corporate DNA, that weshould pass on. There’s hardly any other company
that can say “Don’t worry, leave it to us!” Being
someone that customers depend on and doing workthat is essential to the daily lives of people can be asource of much happiness and satisfaction. The factthat the Hikari Collaboration service launched only in
February of this year is already achieving results issomething that many people didn’t think could be
done. So to everyone, I say “Be confident in yourselves!”—Mr. Nakagawa, can you leave us with a message for
NTT researchers?
My father was a researcher at Nippon Telegraphand Telephone Public Corporation. At that time, heserved in various positions such as head of the Ibaraki
branch of Electrical Communications Laboratories,
and he was involved in the development of opticalfiber manufacturing technology. He would often joinother young NTT researchers living in corporate
housing for evening drinks and lively discussions
after work. Just the other day, I was delighted toreceive a replica of the plaque commemorating therecognition of NTT’s optical fiber research anddevelopment as an IEEE Milestone* [1]. This was
especially moving for me as I would never haveimagined that I would someday be managing the very*

IEEE Milestone: The IEEE Milestone was established by the Institute of Electrical and Electronics Engineers (IEEE) in 1983 asa way of honoring significant historic achievements of innovativetechnologies in the field of electrical and electronic engineering,
information and communication. The technology must be at least
25 years old, and its achievement must have a high global reputation.

View from the Top

work that my father began.
As seen from the business side, there is definitely aneed for the prompt development of “sellable” and“profitable” technology. However, when I think thatit’s been about 40 years since the basic researchbegan in my father’s generation was first commercialized, I can feel the endurance of that research. My
father would often say, “A researcher finds a theme
on one’s own. If that theme can be found, the researchis half done.” Finding one’s research theme is no
doubt difficult, so I would like to ask researchers tolook for their themes and undertake their researchcarefully and patiently to achieve great results.
Reference[1]NTT press release issued on June 9, 2015.
http://www.ntt.co.jp/news2015/1506e/150609a.html

Interviewee profile
Career highlights
Hiroshi Nakagawa joined Nippon Telegraphand Telephone Public Corporation (now NTT) in
1978. After serving as NTT EAST Executive
Manager of the General Affairs and Personnel
Department, Executive Manager of the Corporate
Strategy Planning Department, and Executive
Manager of the Accounts and Finance Department,
and Executive Vice President, he assumed theoffice of Senior Executive Vice President andSenior Executive Manager of Consumer Business
Headquarters in 2012 and took up his present
position in June 2015. He concurrently serves as
President of NTT East Properties and Presidentof NTT Vietnam.

NTT Technical Review

Feature Articles: Cybersecurity-related R&D to Counter
Global Threats

Cybersecurity R&D to Counter
Global Threats
Takeshi Nakatsuru, Yoshiaki Nakajima, Jun Miyoshi,
and Katsumi Takahashi
Abstract

New cybersecurity threats are continuing to expand on a global scale, and Japan is expected to become
the target of cyber-attacks in the run up to 2020. In these Feature Articles, we discuss the key points ofresisting global cybersecurity threats and introduce our research and development strategy for dealing
with them.
Keywords: security, global, R&D strategy

1. Introduction
The NTT Group has aggressively expanded into theglobal business sector to establish global cloud services as a cornerstone of our business. To this end, weare establishing stronger systems to offer to the world
by responding to the needs of our customers who aredeveloping diverse information and communication
technology (ICT) services on a global scale. In the
global business arena, ICT is an essential component
that is used by a wide range of businesses in diverse
fields. Incidents of cyber-attacks on these businesses
can cause serious damage such as service interruptions or information leaks. In recent years, manycases of cyber-attacks directly aimed at exploiting
business secrets or financial assets have been reported, and the financial impact of these attacks is also
increasing.
NTT Group’s managed security service provider
companies are expanding their services in order toaddress these issues in the global business arena.
Cyber-attacks on global businesses raise various concerns, including the risk of theft of business secrets
through industrial espionage and the disruption of
key infrastructures such as electricity, gas, and communications.
Broadly speaking, there are three points that global
businesses must follow to protect themselves fromthe latest security threats and new threats accompany

ing the latest technological developments. We
describe them here and explain our efforts to address
them in section 2.
1.1 T
 echnology and security operations are both
important when responding to targeted
attacks
The NTT Group’s Global Threat Intelligence
Report (GTIR) analyzed common factors in businesses that had suffered losses and found that
although unknown threats that instigate targeted
attacks against businesses and other organizations do
exist, most attacks exploit known vulnerabilities thatare sometimes several years old. To deal with theseincidents, it is essential not only to use advanced
techniques such as attack detection, but also to implement operations to pre-empt attacks by taking steps
such as establishing patch management processes andincident response procedures, and by training people
how to deal with attacks.
1.2 M
 aking use of threat intelligence is essential
to reduce the cost of security operations
Cyber-attacks are becoming more organized, withcorporate spies and even state agencies among theperpetrators in some cases. In these cyber-attacks,
there are clear profits to be made by the attackers,
who may also have considerable financial resourcesat their disposal. When running a global business, it is
NTT Technical Review

Feature Articles

In-housesystems

Proactive security

Communication
Enterpriseservices
systems
Design/operation techniques,
technical support,
etc.
Security quality
management

Reactive security

Capabilities to enhance security level
Fundamental
technology
Data security

Cybersecurity

Fundamental security technology R&D

Fig. 1. R&D efforts focusing on security measures.

difficult to put a cost on security alone, so it is necessary to apply measures efficiently. It is also important
to make use of threat intelligence such as that on new
types of vulnerabilities and the places from whereattacks are originating, which makes it possible tobalance the cost of security measures by pre-emptively blocking access from attack sites and toincrease the efficiency of business operations.
1.3 I ntegration of the real world and cyberspaceis essential when applying security measuresin the IoT era
As technology advances, we are fast approaching
the Internet of Things (IoT) era, where all sorts ofthings will be connected to the Internet. In somerespects, this era has already started. For example, theuse of IoT has been discussed for applications such as
self-driving automobiles and the optimal distributionof electric power. In this sort of world, cyber-attacks
are considered as a possible cause when there is anincident such as a widespread power outage in one
area. In dealing with such cases, it is first necessary to
clarify the relationships between incidents that occur
in the real world (physical accidents) and those that
occur in cyberspace. To respond to these incidents, it
is essential to implement a response that takes bothreal-world and cyberspace factors into consideration.

2. R&D efforts to respond to global
cybersecurity threats
At NTT Secure Platform Laboratories, we areengaged in research and development (R&D) in orderto implement security measures to keep up withchanges in the latest threats and the latest technologies (Fig. 1).
Regarding the first point mentioned in section 1, weare not only studying fundamental security technology aimed at creating the world’s most advanced
systems, but we are also studying how fundamental
security technologies can be used to provide enhanced
security for in-house systems, communication services, and enterprise systems. We are working toenhance the level of security by not only researchingand developing ways of dealing with incidents before
and after they have occurred, but also investigating
security designs that can be easily operated.
Regarding the second point, we have launched initiatives for sharing threat intelligence with global
Group companies including NTT Innovation Institute, Inc. (NTT I3), which was founded in 2013 as aNorth American base for R&D.
Regarding the third point, we are researching anddeveloping integrated risk management solutions thatcombine the know-how of NTT Secure Platform
Laboratories on disaster response systems, and theknow-how of NTT-CERT* in handling incidents in*

Vol. 13 No. 12 Dec. 2015

NTT-CERT: NTT Computer Security Incident Response andReadiness Coordination TeamFeature Articles

response to cyber-attacks.
In these Feature Articles, we first present some casestudies of cybersecurity threats in the global arena[1], and then we discuss two of our activities associated with threat intelligence [2, 3]. Finally, we introduce our efforts aimed at integrated risk management[4].
References[1]

Y. Aragane, K. Ogura, H. Endoh, and K. Takahashi, “Trends in
Global Security Threats,” NTT Technical Review, Vol. 13, No. 12,2015.
https://www.ntt-review.jp/archive/ntttechnical.php?contents=ntr2015
12fa2.html

Takeshi Nakatsuru

Senior Research Engineer, Planning Section,
NTT Secure Platform Laboratories.
He received a B.S and M.S. in computer science and system engineering from Yamaguchi
University in 1998 and 2000. In 2000, he joined
NTT Information Sharing Platform Laboratories,
where he worked on R&D of VOIP (voice over
Internet protocol), location awareness systems,
and NGN (Next Generation Network) subscriber
session control servers. In 2008, he joined NTT
WEST and developed high speed (200M and 1G)
optic network services for consumers. He joined
the R&D planning section in 2012 and was
involved in launching NTT I 3 as the North
American R&D base.

[2]

[3]

[4]

T. Hariu, K. Yokoyama, M. Hatada, T. Yada, T. Yagi, M. Akiyama, T.
Ikuse, Y. Takata, D. Chiba, and Y. Tanaka, “Security Intelligence for
Malware Countermeasures to Support NTT Group’s Security Business,” NTT Technical Review, Vol. 13, No. 12, 2015.
https://www.ntt-review.jp/archive/ntttechnical.php?contents=ntr2015
12fa3.html
T. Koyama, B. Hu, Y. Nagafuchi, E. Shioji, and K. Takahashi, “Security Orchestration with a Global Threat Intelligence Platform,” NTT
Technical Review, Vol. 13, No. 12, 2015.
https://www.ntt-review.jp/archive/ntttechnical.php?contents=ntr2015
12fa4.html
T. Kokogawa, N. Kosaka, A. Koyama, F. Ichinose, F. Tanemo, and Y.
Maeda, “Efforts to Achieve a Joint Risk Management Support System,” NTT Technical Review, Vol. 13, No. 12, 2015.
https://www.ntt-review.jp/archive/ntttechnical.php?contents=ntr2015
12fa5.html

Jun Miyoshi

Senior Research Engineer, Planning Section,
NTT Secure Platform Laboratories.
He received a B.E. and M.E. in system engineering from Kyoto University in 1993 and 1995.
Since joining NTT Telecommunication Networks Laboratories in 1995, he has been researching and developing IP networking technologies.
From 2006 to 2011, he was engaged in developing FLET’S Hikari networks at NTT and NTT
WEST. He has been involved in security R&D
management since 2011. He is a member of theInstitute of Electronics, Information and Communication Engineers.

Katsumi Takahashi
Yoshiaki Nakajima

Senior Research Engineer, Supervisor, Planning Section, NTT Secure Platform Laboratories.
He received a B.S. in information science andan M.S. in mathematical and computing sciencefrom Tokyo Institute of Technology in 1995 and1997. He joined NTT Information and Communication Systems Laboratories in 1997, where heworked on R&D of information security. From2009 to 2013, he was with the Security Strategy
Section of the Technology Planning Department.
He has been involved in R&D of information andcommunication platforms, security platforms,
and other areas.

Executive Research Scientist, Senior Manager
of Planning Section, NTT Secure Platform Laboratories.
He received a B.S. in mathematics from Tokyo
Institute of Technology and a Ph.D. in information science and technology from the Universityof Tokyo in 1988 and 2006. He joined NTT in1988 and has studied information retrieval, data
mining, location information processing, information security sociology, privacy preserving
techniques, and cryptographic techniques. He
has developed several commercial systems
including i-Townpage, Mobile Info Search, andprivango.

NTT Technical Review

Feature Articles: Cybersecurity-related R&D to Counter
Global Threats

Trends in Global Security Threats
Yosuke Aragane, Kenji Ogura, Hitoshi Endoh,
and Kenji Takahashi
Abstract

In this article, to illustrate the trends in global security threats, we examine two ingenious cyberattacks that were recently reported, and we discuss the countermeasures to the attacks. We also introduce
the Global Threat Intelligence Report, an NTT Group initiative related to global security threats. We
believe that sharing this sort of information about security threats will help to raise awareness of cybersecurity and lead to more secure systems.
Keywords: threat information, cyber-attack, global security

1. Introduction
In recent years, massive cyber-attacks haveoccurred that have inflicted damage on a scale that isdifficult to assess. Examples include the JPMorgan
Chase & Co. (a major American financial servicesfirm) data breach targeting its customer information,
the devastating cyber-attack on Sony Pictures that
included the destruction of corporate systems and the
publication of stolen corporate information, a largescale data breach of government employee information from the United States Office of Personnel Management, and the leakage of information from Japan
Pension Service. These cyber-attacks are often notreported in great detail from the viewpoint of ensuring security.
However, people can strengthen the security of
their own systems by using cases such as these tounderstand the deceptive tactics used by attackers andthe measures that can be used to defeat them. Consequently, sharing information about security threats
will become increasingly important in the future.
In this article, we report on some sophisticatedcyber-attacks reported recently, and we explain the
NTT Group’s Global Threat Intelligence Report(GTIR) initiative that aims to accelerate the sharing
of information.



2. FIN4: Secretly stealing confidential
information
FireEye, Inc., a U.S. based network security company, analyzed certain incidents in its clients’ networks as well as data it obtained separately throughtheir products and detected a group that is focused on
secretly stealing confidential company informationthat could affect the stock prices of publicly traded
companies. FireEye named the group FIN4.
The members of this group have not been identified, so the purpose of their attacks is still unclear.
However, FireEye believes that FIN4 is exploiting
this insider information in order to profit on the stock
market. It is very difficult to ascertain the actual damage because there have not been any apparent losses
at the companies targeted in this type of cyberattack.
FIN4’s activities have been observed since mid2013, and FireEye has discovered about 100 targets
consisting of publicly traded healthcare and pharmaceutical companies (68%), firms advising publiccompanies on matters concerning security, legal
issues, and mergers & acquisitions (M&A) (20%),and other publicly traded companies (12%). For
healthcare and pharmaceutical companies, information on the authorization of drugs or the development
and clinical testing of new drugs can have a major
impact on the share prices. Also, M&A consultants
are privy to M&A information before it is madeNTT Technical Review

Feature Articles

Medical diagnostics & research 5%
Healthcare
8%
Drug manufacturing
10%

Others 2%

Medical instruments &equipment
12%
Medical devices
13%

Biotechnology
50%

Source: http://www2.fireeye.com/fin4.html

Fig. 1. Breakdown of the healthcare and pharmaceutical industry sectors targeted by FIN4.

Source: http://www2.fireeye.com/fin4.html

Fig. 2. Fake dialogue box used to steal login credentials.

public. A breakdown of the healthcare and pharmaceutical industry sectors targeted by FIN4 is shown in
Fig. 1.
When FIN4 targets a particular company, it starts
out by targeting other companies that do businesswith it. It then uses the email accounts of these othercompanies to send emails to the target company containing information on transactions that are currently
in progress. These emails are addressed to people
dealing with confidential information of the target
company such as management executives, company
attorneys, and researchers. They include attached
Office*1 documents that are exchanged in actual
transactions but that have embedded macros that display a fake Outlook*1 login prompt when the files are
opened [1] (Fig. 2) and then send the login information to FIN4’s server. For environments where macros are disabled, the email message includes a link toa fake Outlook Web App (OWA) login page fromVol. 13 No. 12 Dec. 2015

where the login information can be stolen. Using thisstolen Outlook authentication information, FIN4
accesses the email accounts of people who work withthe target company’s insider information and obtains
confidential information by intercepting and reading
their email.
FIN4 also creates settings that automatically delete
emails containing terms such as hacking, phishing,and malware from the target’s Outlook account. As aresult, the targeted individual is not able to see warning emails with messages such as “Is your company
being targeted?” from external correspondents.
The U.S. Securities and Exchange Commission(SEC) was reported to have requested detailed reports
on at least eight companies targeted by FIN4 [2], but
as of the end of June 2015, they had not yet released*1	 Office and Outlook are registered trademarks of Microsoft Corporation in the United States and other countries.

Feature Articles

SAME TTLGREAT FIREWALL
INSPECTION
Banned content?
Yes:
INJECT RST
ROUTERTAP
Global Internet
Yes:
INJECT .js

Target Traffic
REROUTED

Chinese Net
NO

ATTACK
Attack criteria
met?
GREAT CANNON
Source: https://citizenlab.org/2015/04/chinas-great-cannon/

TTL: time-to-live

Fig. 3. Schematic model of GFW and GC.

a public statement on the issue.
Steps that can be taken to avoid becoming one of
FIN4’s victims include disabling macros in Microsoft
Office and enabling two-factor authentication for
OWA. Also, since FIN4 uses Tor*2 to conceal the traffic that sends login information to its server, anothereffective measure is to monitor the internal network
logs to check for communication with known Tor
nodes.
3. The Great Cannon of China
A study by the Citizen Lab at the University ofToronto has shown that the Great Firewall (GFW)*3
of China is now partnered with an attack system,
which it calls the Great Cannon (GC). In March 2015,
GreatFire.org and GitHub*4 became the first observed
victims of massive DDoS (distributed denial of service) attacks from GC. In the following, we describe
the GC and GFW mechanisms on which they arebased, as well as a GC attack.
3.1 GFW mechanism
The GFW is shown in the upper part of Fig. 3 [3].
All Internet traffic in and out of China passes throughthe GFW. The traffic is intercepted at the element
labeled TAP, and content that is subject to restrictionsor blockades is identified at the element labeled
INSPECTION. When such content has been identified, the INJECT RST part transmits RST (reset)
packets, which are used when blocking communication or denying access, to the source and destination
servers. A load-balancing mechanism is used in the
GFW so that it can process multiple communication
streams in parallel. In this way, the GFW continuously monitors network traffic in order to block
access to content that the Chinese authorities regard
as undesirable.

*2 Tor: Software that anonymizes the paths of network connections
without encrypting the content of the traffic carried by them.
*3 GFW: A large-scale censorship system used by Chinese authorities to restrict and cut off Internet connections into and out ofChina.
*4 GitHub: A web service provided by GitHub, Inc. as a platform forsharing software development projects. Its basic functionality isavailable for free, and extended features can be used for a fee.

NTT Technical Review

Feature Articles

3.2 GC mechanism
In the GC, the Target Traffic REROUTED component in Fig. 3 reroutes the corresponding traffic, and
the ATTACK component identifies whether or not it
is to be used in an attack. If so, an attack code is sent
to the access source; otherwise it connects to therequested destination server. On receiving an attack
code, the access source becomes a temporary agent
that supports a GC attack. Just as with the GFW, allInternet traffic in and out of China passes through theGC, so it is possible to launch a large-scale attack
even when only a tiny fraction of traffic is used by the
GC. The GC takes over this traffic, which makes it
capable of launching man-in-the-middle (MITM)
attacks. The GC is compatible with high-bandwidthcommunications, so it collects only IP addresses of
the access sources. It also has a mechanism for caching previous traffic so that it can eliminate unnecessary work when the same process is performed
repeatedly on the same traffic. Citizen Lab’s test
results suggest that up to 16,000 access source IP
addresses can be stored in this way.
According to Citizen Lab, the results of sending
traffic configured to respectively operate the GC and
GFW, and the results of analyzing the responses tothis traffic suggest that the GC and GFW do not shareattack facilities but have their own systems. However,there are similarities in the way they rewrite data
packets, so they appear to share parts of the same
program code and are thought to be very closely
related. The GC and GFW have similar load balancer
functions and are thought to distribute traffic basedon the IP addresses of access sources.
A Citizen Lab survey of communication paths set
up to activate the GFW and GC indicated that bothare on the same destination network, so it seems that
the GC and GFW are installed right next to each other[3]. In one test environment, the destination network
was China Telecom, and in another test environment
the destination network was China Unicom. The
research done by security blogger Robert Grahamsuggests that the GC exists in the infrastructure of
China Unicom.
3.3 Attacks on GreatFire.org and GitHub
From March 14 to March 25, 2015, a large-scale
DDoS attack was carried out against GreatFire.org,
which was hit with 2.6 billion requests per hour (2500
times the usual rate). GreatFile.org provides functions that use the Amazon CloudFront CDN (content
delivery network) service to bypass the GFW andallow blocked sites to be viewed. Note that the CyberVol. 13 No. 12 Dec. 2015

space Administration of China has already identified
GreatFire.org as a foreign anti-Chinese organization.
From March 25 to April 7, 2015, GitHub was also
hit by a large-scale DDoS attack, causing the site’s
response times to increase several times over [4].
GreatFire.org has two GitHub repositories that provide technology to users wishing to circumvent Chinese censorship. The attack on GitHub appears tohave been carried out with the aim of forcing theremoval of these repositories from GitHub.
The GC attacked GreatFire.org and GitHub byintercepting and redirecting traffic destined for Baidu
Analytics and Baidu Advertising, which are parts of
the Baidu common platform. However, not all the
traffic to these sites was used in the attack. According
to Citizen Lab’s observations, the majority of traffic(about 98.25%) passed through to Baidu unaffected,
while the remainder (about 1.75%) was used in theattack [3]. The web requests used in the attack included page views of sites containing advertising from
Baidu, so the visitors to these sites were unwittingly
taking part in the attacks on GreatFire.org and
GitHub.
3.4 Who built the GC?
Citizen Lab considers that the GC could not havebeen built or used without the approval of the Chinese
government, since its attacks are too overt to havebeen conducted without government permission. It
also stated that although it is not clear why the GC
was built, it may have resulted from the conflict
between the activities of GreatFire.org and the Chinese Communist Party’s ideology [3]. These destructive acts may be designed not only to block access tocontent that the party finds undesirable but also to set
an example for other organizations engaged in similar
activities.
3.5 Predictions
Since the GC is evidently capable of launchingattacks based on the source of Internet traffic, it isassumed to have latent capabilities for other forms ofcyber-attack besides DDoS, even though they have
not yet been observed. For example, it could be easily
reconfigured to send malware to specific individuals
that access servers in China without using encryption.
Also, since the GC is a complete MITM, it could evenreplace attachments of an unencrypted email withmalware.
It is very difficult for organizations and individual
users to defend themselves against attacks by the GC.
However, due to the way in which the GC works,Feature Articles

these attacks only work on unencrypted traffic, andwill not work on traffic encrypted using the protocol
HTTPS (Hypertext Transfer Protocol Secure) or the
like. The GC can therefore be rendered less effective
by promoting the encryption of traffic and content bymany organizations and users.
4. GTIR
The 2015 edition of GTIR [5] was produced by
NTT Innovation Institute, Inc. (NTT I3) with thecooperation of NTT Group companies (NTT Com
Security, Dimension Data, Solutionary, NTT Secure
Platform Laboratories, and NTT DATA). It contains
detailed descriptions of the following important
trends based on the analysis of about 6 billion attack
events observed by the NTT Group during 2014.
•	The financial industry continues to represent the
number one targeted sector, accounting for 18%
of all detected attacks. Attacks against businessand professional services increased from 9% to15%.
•	Basic controls are still not implemented in allcases; 74% of organizations do not have formal
incident response plans.
•	Incident responses involving malware threats
increased 9% compared to 2013, from 43% to52%.
•	During 2014, 76% of identified vulnerabilities
throughout all systems in the enterprise weremore than 2 years old, and almost 9% of themwere over 10 years old.
•	Over 80% of vulnerabilities in 2014 exploit kits
were published in 2013 and 2014.
•	There was an increase in Adobe Flash*5 exploit
usage in exploit kits from 2012 to 2014.

•	Of the attacks on NTT’s customers worldwide,
56% originated from IP addresses in the US. The
attackers are not necessarily in the US but are
taking advantage of the rich cloud services available there.
•	DDoS amplification attacks using User Datagram Protocol accounted for 63% of all DDoS
attacks observed by NTT Group.
5. Future prospects
The NTT Computer Security Incident Response
and Readiness Coordination Team (NTT-CERT) at
NTT Secure Platform Laboratories is working to
improve security throughout the NTT Group and theinformation network society. NTT-CERT provides
consultation services on information security andalso delivers security-related information.
We will continue with our ongoing incident
response support for NTT Group companies. We alsoplan to continue providing security information withthe aim of expanding the global scale of our activities.
References
[1]
[2]

[3]
[4]

[5]

FireEye, “Hacking the Street? FIN4 Likely Playing the Market.”https://www2.fireeye.com/fin4.html
REUTERS, “Exclusive: SEC Hunts Hackers Who Stole Corporate
Emails to Trade Stocks,” Jun. 23, 2015.
http://www.reuters.com/article/2015/06/23/us-hackers-insidertrading-idUSKBN0P31M720150623
B. Marczak et al., “China’s Great Cannon,” Apr. 10, 2015.
https://citizenlab.org/2015/04/chinas-great-cannon/
XDNet, “Google says Chinese Great Cannon shows need to encryptweb,” Apr. 27, 2015.
http://www.zdnet.com/article/google-says-chinese-great-cannonshows-need-to-encrypt-web/Website of NTT I3 GTIR, http://www.nttgroupsecurity.com*5 Adobe and Flash are registered trademarks or trademarks ofAdobe Systems Incorporated in the United States and other countries.



NTT Technical Review

Feature Articles

Yosuke Aragane

Senior Research Engineer, Supervisor, NTTCERT, Security Risk Management Project, NTT
Secure Platform Laboratories.
He received his M.S. and Ph.D. from Tokyo
Institute of Technology in 1997 and 2005. He
joined NTT Multimedia Network Laboratories in
1997, where he worked on intelligent transportation systems. Since 2003, he has been with NTT
Information Sharing Platform Laboratories and
NTT Secure Platform Laboratories focusing on
cybersecurity research. His current researchinterests include security operation optimization,
security intelligence sharing, and human factor
influences on the information security. He is amember of the Institute of Electrical and Electronic Engineers (IEEE), the Association for
Computing Machinery (ACM), the Information
Processing Society of Japan (IPSJ), and the Institute of Electronics, Information and Communication Engineers (IEICE).

Kenji Ogura

Senior Research Engineer, Security Risk Management Project, NTT Secure Platform Laboratories.
He received a B.E. and M.E. in electrical engineering from Keio University, Kanagawa, in1988 and 1990. He joined NTT LSI Laboratories
in 1990, where he researched and developed
CAD (computer aided design) systems for LSI(large-scale integrated circuit) design. Since joining NTT Secure Platform Laboratories in 2014,
he has been working on security information
analysis at NTT-CERT. He is a member of IPSJ.

Vol. 13 No. 12 Dec. 2015

Hitoshi Endoh

Research Engineer, Security Risk Management
Project, NTT Secure Platform Laboratories.
He received an M.A. in arts and sciences fromthe University of Tokyo in 1997. He joined NTT
Cyber Space Laboratories (now, NTT MediaIntelligence Laboratories) in 1997. During 20002012, he was a member of the Cyber Security
Department at NTT EAST Corporation, where
he developed information system security guidelines and a security vision with medium and longterm action plans. Since joining NTT Secure
Platform Laboratories in 2012, he has been working on computer security incident response team
(CSIRT) activities at NTT-CERT. He is currently
working on information sharing projects withother CSIRT teams and cyber threat analysis.

Kenji Takahashi

VP, Product Management, Security, NTT Innovation Institute, Inc.
He received his B.S., M.S., and Ph.D. in computer science from Tokyo Institute of Technology. He has over 28 years of international experience in the information and communicationindustry. He has led many projects at NTT R&D
in Japan, including those related to cloud computing, software engineering, digital identity
management, collaboration environments, andubiquitous computing. He was previously President and CEO of NTT Multimedia Communication Laboratories, Inc. (NTT MCL) in Silicon
Valley, where he successfully launched and led
open source, open standard based cloud, andsoftware-defined networking projects. He was avisiting scientist at the College of Computing at
Georgia Institute of Technology and a member ofthe Discovery Park Advisory Council at Purdue
University. He received the Kiyasu Special
Industrial Achievement Award from IPSJ for his
pioneering work on federated identity management. He is a member of IEICE, IPSJ, IEEE
Computer Society, and ACM.

Feature Articles: Cybersecurity-related R&D to Counter
Global Threats

Security Intelligence for Malware
Countermeasures to Support NTT
Group’s Security BusinessTakeo Hariu, Keiichi Yokoyama, Mitsuhiro Hatada,
Takeshi Yada, Takeshi Yagi, Mitsuaki Akiyama,
Tomonori Ikuse, Yuta Takata, Daiki Chiba,
and Yasuyuki Tanaka
Abstract

Cyber-attacks caused by malware (malicious software) are becoming a serious social problem in many
parts of the world. In this article, we introduce the security intelligence technology behind our WideAngle global integrated security service.
Keywords: malware, security intelligence, WideAngle

1. Introduction
Cyber-attacks have been causing a number of social
problems in recent years. In particular, malware
infections inflict severe damage and can cause leakage of information at a national level. An example ofa malware attack on a personal computer (PC) isshown in Fig. 1. When a PC with vulnerabilities in its
web browser or plugins visits a portal or relay site thathas been created by an attacker to automatically forward content, it is automatically transferred to an
attack site containing attack codes that cause thebrowser to become infected by downloading malware. A PC that has been infected with malware byaccessing a series of malicious sites in this way will
exchange information with a command site createdby the attackers for purposes such as information
theft.
At NTT’s laboratories, we have been researchingand developing technology to detect infection activity, collect malware, and analyze the infection pathways and malware behavior [1]. By continuously
collecting and analyzing attacks, we have created

techniques for efficiently and accurately characterizing the latest malware infections. Recently, however,it has become difficult to create services that lead toeffective countermeasures using a single technology
alone due to the increasing complexity of attacks andthe emergence of malware attacks with a very shortcycle.
From empirical knowledge obtained in previous
research and development (R&D) and from observing attacks, we realized the importance of the security intelligence and its effect on malicious activity.
The security intelligence includes the destinations oftraffic related to malware infections, which are
obtained through cross-sectional analysis of traffic
data and attacks occurring up to and beyond the pointof malware infection. Therefore, we began conducting R&D on world-leading intelligence creation techniques [2]. Furthermore, in partnership with NTT
Communications, which is a world leader in the
global security business, we expanded our security
intelligence efforts into the WideAngle managed
security service [3].

NTT Technical Review

Feature Articles

Accesses using vulnerable
web browser or plugin

Portal site
Content for automatic
forwarding

Internet

Relay site

Automatic
forwarding
Automatic
forwarding
Sends attack
code

Attack site
Attack code

Ordinaryuser’s PC

Malware distribution site
Forced download andinstallation of malware

MalwareSends information to the attacker,
receives commands from the attacker

Command site
Attacker

Fig. 1. Malware infection attack.

2. NTT security intelligenceIn general, security intelligence refers to information used to defend against cyber-attacks. For example, this includes the originating Internet protocol(IP) addresses of DDoS (distributed denial of service)attacks or spam emails, or the IP addresses of botnet
C&C (command & control) servers or collection sites
for stolen data, and the Uniform Resource Locators(URLs) of phishing sites and fake websites.
A wide variety of cyber-attacks originate from PCs
and servers that have been compromised by attackers
via malware infection. Therefore, to fundamentally
solve the problem of cyber-attacks, it is absolutely
essential to have security intelligence for deploying
malware infection countermeasures. Also, to develop
security intelligence into a business, it is important tohave clear documented information on which to basemalignancy decisions, as well as information on how
it is used.
At NTT’s laboratories, security intelligence
includes information such as the destination IP
addresses and URLs of traffic at the time of malware
infection and the destination of traffic from theinfected victim, as shown in Fig. 2.
Each item of information is associated with eviVol. 13 No. 12 Dec. 2015

dence identified using proprietary techniques such as
decoy systems (honeypots) and dynamic malware
analysis systems. These techniques are applied inparallel to identify the URLs of malware sites thatcannot be collected by other companies. Furthermore, the URLs of these malware sites are analyzed
to identify unknown malware site URLs.
2.1 Honeypots
Malware is collected by using decoy systems calledhoneypots to accept attacks. By analyzing the communication with honeypots, we can gather evidence
about the vulnerabilities that are being used byattackers to spread their malware, and to identify
information that is effective for preventing infection.
We are conducting R&D on honeypots that keep up
with the trends in malware infection activity. We are
currently researching and developing web server honeypots to attract attacks that exploit vulnerabilities in
web applications, and honeyclients to attract attacks
that exploit vulnerabilities in web browsers andplugins. Here, we introduce a honeyclient that performs a key role in intelligence creation.
In general, honeypots are classified into two categories: low-interaction honeypots that securely gather
the minimum amount of information by simulating aFeature Articles

DoS / DDoS attack

Attacker

Malwareinfected hostNTT’s security intelligence• Documented blacklist

Spam email
Information leakage
Phishing• Destination of traffic at the time of malware infection(malignant site URL, attacker’s IP address)• Destination of traffic after infection• Documented evidence of malware(vulnerabilities used, attack codes, malware)

Tampered site

• Public information on the Internet (GeoIP, Whois data,
popular site information, public malignant information)• Vast amounts of log data relating to the above

Malware infection attack

Fig. 2. NTT’s security intelligence.

vulnerable system, and high-interaction honeypotsthat collect a lot more information by using an actual
vulnerable system. Although high-interaction honeypots are said to run the risk of being infected withmalware, we have managed to develop a secure highinteraction honeyclient. Also, low-interaction honeypots are said to be only capable of collecting limited
information, but we have managed to develop one
with improved information-gathering capabilities.
With a honeyclient, it is possible to detect malware
infections and identify the URLs of malware sitesthat infect visitors with malware. Then malware
infections can be prevented by prohibiting access tosuch URLs.
2.2 Dynamic analysis of malware
Malware collected by honeypots is analyzed toshed light on its latent threats by investigating its
functions in detail. Furthermore, by analyzing thetraffic generated by malware infections to discover
information such as the servers they communicate
with when obtaining additional malware and thecommand servers set up by the attackers, it is possible
to identify information that is effective for suppressing the damaging effects of malware.
Malware analysis includes dynamic analysis, whichclarifies the behavior of malware by actually runningit, and static analysis, which deciphers the malware’s
program code. Dynamic analysis is introduced here.
Dynamic analysis can be performed either in aclosed environment, where the malware is operated incomplete isolation, or in an open environment, where
the malware can connect to the Internet. In both typesof environment, a debugger can be used to closelymonitor the malware’s behavior. Furthermore, taintanalysis techniques can be used to track the flow ofdata handled within a system and identify servers
prepared by the attackers to send data causing malicious behavior. For example, PCs that have been
infected with malware can be discovered by identifying the PCs that access the command server or destination server when acquiring additional malware.
2.3 Honeytokens
During the dynamic analysis of malware collectedby a honeypot, it is possible to allow the attacker totamper with a controlled decoy website by deploying
false information for the website administrator’s
account in the analysis environment. This makes it
possible to collect the latest attack information.
As mentioned previously, the greatest threat of malware infection in recent years has been caused byusers unknowingly visiting malware sites. Parts of themalware deployed in these attacks have functions thatcollect and send out various kinds of account information. Therefore, when a website administrator’s
account information is recorded on an infected PC,
this information is leaked to the attacker so the website can be manipulated by the attacker, as shown in
Fig. 3(a). A honeytoken shows nothing but decoy
information. Since the content of a website is often
managed via a File Transfer Protocol (FTP) server,
fake FTP account information is prepared as a honeytoken. The attacker uses the honeytoken information
to log in to a separate fake FTP server and tampers
with its content. Checking the falsified content in thehoneypot makes it possible to collect security intelligence about the latest attacks initiated by the attacker
NTT Technical Review

Feature Articles

Tampered
website3 Decoy accountAttacker
3 FTP password leaked

1 Browsing

leaked

1 Malwarecollected byhoneypot

4 Tampering

2 Infection

2 Malware run by

FTP server/compatible
websiteWebsiteadministrator
5 Browsed bydynamic analysis
system6 Infection

leakagetampering...

other users(a) Typical attack on a PC

4 Decoys FTP server

monitors tamperingto collect information
about unknown
malware sites(b) Our original observation technique using honeytokens

Fig. 3. Honeytokens.

.com

.jp

.co.jpPublic domain

ex1.comex1.jp

URL of known malware site
http://xx.ex1.co.jp/hp1/blog/view.exe

ex1.co.jp
Extracts neighborhood domains(under the same private domain)

Private domainxx.ex1.co.jp
yy.ex1.co.jp
Neighborhood domain
hp2
Search for paths
with similar structure

hp1

blog

view.exe

top

modify.exe

Known malware
site URLs

blog

view.exe

top

hp1

URLs under xx.ex1.co.jp
URLs under yy.ex1.co.jp
Extracts paths with a structure
similar to hp1/blog/view.exe

blog

view.exe

Detects these malware site URLs:
http://xx.ex1.co.jp/hp2/blog/view.exe
http://yy.ex1.co.jp/hp1/blog/view.exe

URLs of unknown malware sites
can be identified from these results.

Fig. 4. Neighborhood search of malware sites.

(Fig. 3(b)).
A paper summarizing this technique [4] was thefirst Japanese-authored paper in ten years to be
accepted at one of the highest-level international conferences and was highly rated all over the world.
2.4 S
 earching the neighborhood of malware
sites
To avoid defenses set up based on security intelligence, attackers construct numerous malignant sites.
Since they are reluctant or unable to spend muchVol. 13 No. 12 Dec. 2015

money on each site, they adopt configurations thatenable new malware sites to be set up without incurring much additional cost. In anticipation of thistrend, we identify malware sites by searching for web
spaces that are highly likely to have been created byattackers.
This search technique is shown in Fig. 4. We firstextract URLs with the same path structures as existing malware site URLs in URL groups that exist in
the same private domains as the URLs of known malware sites, and then we investigate these URLs usingFeature Articles

NTT Communications

NTT Secure Platform
Laboratories

WideAngle
Laboratory
intelligence

Advancedanalysis

NTT Communications
independent
intelligence

Logs
Honeypot

Honeypot

Dynamic
analysis

Dynamic
analysisCreates latest research results,
verifies feasibility

Honeypot

OSS
Honeypot

Dynamic
analysis

Dynamic analysys
products

Combines existing products tocreate commercial intelligence

Equipment
Customers
Internet
Honeypot
Dynamic analysis

Laboratory
technology

OSS: open source software

Fig. 5. Global business development.

honeypots. An attacker who manages a known malignant site URL will be able to generate such URLs
without incurring any cost burden, so with this searchtechnique it is possible to discover malignant URLs
prepared by attackers that are intended to avoid security intelligence. This technique was summarized in apaper that achieved global recognition [5] andreceived the best paper award at a major international
conference.
3. Global business development of security
intelligence
The honeypot and analysis techniques and the security intelligence services created at NTT’s laboratories are being put to use in the services offered by
NTT Communications. By implementing a combination of laboratory techniques, security intelligence,and existing products, NTT Communications is creating its own independent security intelligence, as
shown in Fig. 5.
In business applications, we envisage that security
intelligence could be deployed in services such as log
auditing, user access filtering, or monitoring user
websites. We have been using security intelligence in
NTT Communications’ managed security services
for log auditing since February 2013. In this service,
security intelligence is used to detect security risks byemploying advanced correlation analysis and to automatically assess threat levels. In this way, correlation
analysis is done automatically on vast amounts of
security information such as communication log files
collected using ICT (information and communication
technology) equipment, enabling an advanced andrapid response to any detected threats.
Our managed security services are currently marketed under the WideAngle brand name, and they
provide globally seamless comprehensive security
countermeasures to users by conducting advanced
security monitoring all day, every day based on asecurity provider system that includes over 900 specialists in 14 countries worldwide.
4. Future prospects
In the future, we plan to work on making our global
business more competitive and on developing our
security business while prototyping NTT’s leadingedge security technology.
References
[1]

[2]

[3]
[4]

M. Ito, T. Hariu, N. Tanimoto, M. Iwamura, T. Yagi, Y. Kawakoya, K.
Aoki, M. Akiyama, and S. Nakayama, “Anti-Malware Technologies,”
NTT Technical Review, Vol. 8, No. 7, 2010.
https://www.ntt-review.jp/archive/ntttechnical.php?contents=ntr2010
07sf3.html
T. Hariu, M. Akiyama, K. Aoki, T. Yagi, M. Iwamura, and H. Kurakami, “Detection, Analysis, and Countermeasure Technologies for
Cyber Attacks from Evolving Malware,” NTT Technical Review, Vol.
10, No. 10, 2012.
https://www.ntt-review.jp/archive/ntttechnical.php?contents=ntr2012
10fa2.html
Website of WideAngle,
http://www.ntt.com/wideangle_security_e/
M. Akiyama, T. Yagi, K. Aoki, T. Hariu, and Y. Kadobayashi, “Active
Credential Leakage for Observing Web-based Attack Cycle,” Proc. of
RAID2013 (the 16th International Symposium on Research in

NTT Technical Review

Feature Articles[5]

Attacks, Intrusions and Defenses), Vol. 8145, pp. 223–243, Rodney
Bay, St. Lucia, Oct. 2013.
M. Akiyama, T. Yagi, and M. Itoh, “Searching Structural Neighbor-

Takeo Hariu

Senior Research Engineer, Supervisor, Cyber
Security Project, NTT Secure Platform Laboratories.
He received his M.S. in electro-communications from the University of Electro-Communications, Tokyo, in 1991. Since joining NTT in
1991, he has been engaged in network security
R&D. He is a member of the Institute of Electronics, Information and Communication Engineers (IEICE) and the Institute of ElectricalEngineers of Japan (IEEJ).

hood of Malicious URLs to Improve Blacklisting,” Proc. ofSAINT2011 (the 11th IEEE/IPSJ International Symposium on Applications and the Internet), pp. 1–10, Munich, Germany, Jul. 2011.

Takeshi Yagi

Senior Research Engineer, Cyber Security
Project, NTT Secure Platform Laboratories.
He received a B.E. in electrical and electronicengineering and an M.E. in science and technology from Chiba University in 2000 and 2002. Healso received a Ph.D. in information science andtechnology from Osaka University in 2013.
Since joining NTT in 2002, he has been engaged
in research and design of network architecture
and traffic engineering. His current researchinterests include network security, especiallyhoneypots and security-data analysis based onmachine learning. He is a member of IEICE, theInstitute of Electrical and Electronics Engineers(IEEE) and IEEJ.

Keiichi Yokoyama

Senior Manager, Security Operation Center,
NTT Com Security Corporation.
He joined NTT in 1997 and worked on thedevelopment of security services for the OCN
Internet service. He has led various Ministry ofInternal Affairs and Communications projects
involving NTT R&D technology, including the
Cyber Clean Center project from 2006 to 2010
and the Reputation Database Project from 2009
to 2011. He has been with NTT Com Security
since 2012.

Mitsuaki Akiyama

Research Engineer, Cyber Security Project,
NTT Secure Platform Laboratories.
He received his M.E. and Ph.D. in information
science from Nara Institute of Science and Technology in 2007 and 2013. Since joining NTT in
2007, he has been involved in R&D of network
security, especially honeypots and malware
analysis.

Mitsuhiro Hatada

Senior Manager, Technology Development/
NTT Com-SIRT, NTT Communications Corporation.
He received his B.E. and M.E. in computerscience and engineering from Waseda University,
Tokyo, in 2001 and 2003. He joined NTT Communications in 2003 and has been engaged in
R&D of computer and network security. He is amember of the Information Processing Society ofJapan (IPSJ) and IEICE.

Tomonori Ikuse

Researcher, Cyber Security Project, NTT
Secure Platform Laboratories.
He received an M.E. in information sciencefrom Nara Institute of Science and Technology in2012. Since joining NTT in 2012, he has been
engaged in network security R&D. He is a member of IEICE.

Takeshi Yada

Senior Research Engineer, Supervisor, Cyber
Security Project, NTT Secure Platform Laboratories.
He received an M.S. in engineering from
Tokyo Institute of Technology in 1991. Sincejoining NTT in 1991, he has been conducting
R&D on network architecture, measurement, andinference for network traffic, and network management. His current research interests include
network security. He is a member of IEICE, theOperations Research Society of Japan, and theJapan Statistical Society.

Vol. 13 No. 12 Dec. 2015

Yuta Takata

Researcher, Cyber Security Project, NTT
Secure Platform Laboratories.
He received his B.E. and M.E. in computerscience and engineering from Waseda University,
Tokyo, in 2011 and 2013. He is currently a Ph.D.
student in the Department of Computer Science
and Communications Engineering, Waseda University. Since joining NTT in 2013, he has been
engaged in R&D of network security, especiallyhoneyclients and malicious code analysis.

Feature Articles

Daiki Chiba

Researcher, Cyber Security Project, NTT
Secure Platform Laboratories.
He received his B.E. and M.E. in computerscience and engineering from Waseda University,
Tokyo, in 2011 and 2013. He is currently a Ph.D.
student in the Department of Computer Science
and Communications Engineering, Waseda University. Since joining NTT in 2013, he has been
conducting research on cybersecurity throughdata analysis.

Yasuyuki Tanaka

Manager, Technology Development/NTT
Communications Corporation.
He received a B.E. in physics from Rikkyo
University, Tokyo, in 1995 and an M.E. in informatics from the Institute of Information Security,
Kanagawa, in 2015. He joined NTT in 1995 andhas been engaged in R&D of computer and network security. He is a member of IPSJ.

NTT Technical Review

Feature Articles: Cybersecurity-related R&D to Counter
Global Threats

Security Orchestration with a Global
Threat Intelligence Platform
Takaaki Koyama, Bo Hu, Yukio Nagafuchi, Eitaro Shioji,
and Kenji Takahashi
Abstract

The NTT Innovation Institute, Inc. has developed a system for collecting and distributing informationon the threats posed by cyber-attacks: the Global Threat Intelligence Platform (GTIP). By connectingwith NTT Secure Platform Laboratories’ security orchestration technologies, GTIP makes it possible torun advanced cyber defenses based on threat data. In this article, we demonstrate how we jointly built
and connected these technologies and discuss their future global deployment.
Keywords: GTIP, security orchestration, network security

1. Introduction
Cyber-attacks against companies and public organizations have continued to evolve in recent years.
Security appliances have been used to detect, filter,and otherwise protect against these attacks—primarily with the help of virus definition files and signature
updates. However, attackers have been able to employ
new techniques to hack into networks while avoiding
detection. As a result, data leaks, tampering, andother damage incurred via the Internet continue to bea problem. To deal with this, we may need security
operations that take a more unconventional approach.
In this article, we introduce these new types of cyberattacks and the initiatives to deal with them at NTT’slaboratories and NTT Innovation Institute, Inc. (NTTI3); we also present our jointly developed cooperative
system along with plans for its global deployment.
2. New types of cyber-attacks andcountermeasures
Attackers use spear phishing emails, watering holeattacks, and other strategies to get their targets todownload malicious programs on the Internet. Once
installed on a victim’s computer, these programs
accept remote commands to leak data, upgrade them

selves, set up command-and-control (C&C) servers,and cause other damage. Because this series of operations is conducted over the Internet and even newer
malicious programs continue to be created, we
believe that the following three-step process is aneffective way to respond to these threats.
(1)	Actively collect external threat intelligence toprevent damage
Threat intelligence includes blacklists of Internet
protocol (IP) addresses and Uniform Resource Locators (URLs) as well as the behavior of the latest malicious programs discovered on the Internet; this information is helpful in preventing both infiltration andsubsequent actions by attackers.
(2)	Automatically configure security operations to
respond quickly
By promptly configuring the appropriate countermeasures as new malicious programs emerge, we canmitigate their effects.
(3)	Choose appropriate appliances and countermeasures using diverse threat intelligence
There are a variety of security appliances installed
within private companies’ intranets as well as at theconnection points between these intranets and theInternet. By configuring the appropriate appliancesand countermeasures, we can stop attackers’ Internetbased actions.
NTT Technical Review

Feature Articles

Threat intelligence
Collaboration with external
threat intelligence
Collect

Judge

Control
Automation framework for
operations

RSE
Optimal decision-making technology
with a variety of sensors and appliances
Datacenter
IDS
Internet
Load balancer

Servers

Firewall
Filtering

WAF

Strengthened monitoring
Quarantining

Vulnerability exploits

Attackers

Brute force attacks
Malware infiltration

IDS: intrusion detection system
WAF: web application firewall

Fig. 1. Resilient Security Engine (RSE).

3. Initiatives at NTT Secure
Platform Laboratories
At NTT Secure Platform Laboratories, we haveresearched and developed security orchestration technologies to automatically respond to cyber-attacks[1]. In the interest of establishing methods of copingwith new and even more sophisticated cyber-attacks
in the future, we are also currently carrying out
research and development (R&D) efforts focused ona Resilient Security Engine (RSE), which implements three technical components (Fig. 1).
3.1 P
 roactive defense technologies incorporating
threat intelligence
We actively collect external threat intelligence toprotect users from Internet-based cyber-attacks. We
specifically collaborate with a threat intelligenceplatform that collects cyber-attack data from aroundthe world, blacklisting IP addresses and URLs associated with attackers to prevent attacks and their subsequent damage before they can occur. For example,
when suspicious behavior is detected, we receive
information about the source of the attack from thethreat intelligence platform; this allows us to makemore accurate decisions.
Vol. 13 No. 12 Dec. 2015

NTT Secure Platform Laboratories is moving forward by connecting the RSE system and the threat
intelligence platform developed by NTT I3. By using
an automation framework for operations (as explainedin the next section) along with a variety of sensors
and appliances, our technology is able to choose optimal countermeasures; we can thus expect attacks andthreats to be handled promptly and appropriately.
3.2 Automation framework for security operations
When an incident occurs, the datacenter’s security
operators determine what course of action to takeafter they confirm the type of attack from logs that areused to detect attacks and threats. The security operators must then find and send commands to the appropriate hardware or software solution (e.g., the firewall) dictated by the network structure. The aforementioned process of collecting data on attacks andthreats is currently consolidated under a Security
Information and Event Management (SIEM)*1 system;*1	 SIEM: A system that collects log data from servers, network devices, and other security-related equipment. When a malfunction,
attack, or other unusual event is detected, the system notifies its
administrators with information on and steps to resolve the situation based on the collected log data.

Feature Articles

dedicated tools provide a simplified interface to thefirewall’s controls. However, operators must manually respond to incidents using multiple administrative systems and control tools with an understandingof security policies and network structures. As aresult, these operations are problematic both in termsof the time and effort they require.
For these reasons, we are proposing an automation
framework that will promptly carry out security
operations—from data collection to decision making
to response. Our proposed framework does not simply define a single program to link multiple administrative systems and control tools with one another; itis also intended to allow users to choose from different methods of responding to the same types ofattacks (e.g., malware infections) for a desired levelof security. Responses can include strengthened
monitoring, filtering, and quarantining; for example,
users should be able to filter network traffic or completely isolate a device from the network. Furthermore, our proposal is intended to implement generalpurpose operations that can make use of different
types of equipment (e.g., physical switches or virtual
switches in a hypervisor) according to the user’s
information and communications technology (ICT)
environment for the same attack response (e.g., network filtering).
3.3 O ptimal decision-making technology with avariety of security sensors and appliances
One effective strategy for dealing with multi-vector
attacks is a layered area defense using several varieties of security sensors and appliances distributed
across a user’s ICT environment. However, intrusion
detection systems (IDSs)*2 and web application firewalls (WAFs)*3—as well as other similar sensors andappliances—have been designed to run independently; they do not give sufficient consideration to sharing
data and working together with other devices.
Although some vendors offer value-added solutions
to connect their own products, attempts to create synergy by improving detection and control capabilities
with products from multiple vendors have not taken
off; this has led us to believe that the effectiveness oflinking products together is limited.
For these reasons, we have been researching anddeveloping technology that collects information on
threats from a wide variety of sensors, determines
what types of attacks or threats it encounters as wellas the best way to deal with them, and finally, makes
use of the most suitable network devices to respondto them. This technology can combine data from mul

tiple sensors to determine when attacks or threats arepresent and how to deal with them appropriately; it
can also manage an attack or threat situation by defining relationships between the sensors’ data. Using
configuration data for the appliances distributed
across a network, the technology can even select alocation close to the root cause of an attack from several candidates and direct its response there.
4. Initiatives at NTT I3This section introduces the Global Threat Intelligence Platform (GTIP) being developed by NTT I3.
GTIP is a comprehensive platform for collecting,analyzing, and distributing actionable intelligence(data) on cyber-threats from around the world. We
intend to use this platform within the NTT Group tocontribute to improving the quality of the entire
group’s security services.
GTIP has three major features: data collection,
which involves gathering diverse threat data fromboth inside and outside the NTT Group; data analysis, which involves employing advanced analytics
based on proprietary technology; and data sharing,which provides flexible input and output interfaces.
By combining these features, we can counteract thecomplex and wide-ranging threats that in recent years
have become difficult to defend against through conventional methods (Fig. 2).
4.1 Data collection
GTIP collects data provided by proprietary commercial web crawlers, large numbers of community
vendors, the NTT Group’s security professionals (e.g.,managed security services providers), and threat sensors (e.g., honeypots) installed around the world. We
plan to continue adding more data sources, such as
those obtained from network traffic.
4.2 Data analysis
Using the advanced program analysis technology(also known as taint analysis*4 technology) developed by NTT I3 in collaboration with NTT Secure*2 IDS: A system that monitors the packets sent over a network andnotifies its administrators when any indication of unauthorizedaccess occurs.
*3 WAF: A firewall that can detect and protect against unauthorized
breaches from external networks (e.g., the Internet) using dataexchanged with web applications.
*4 Taint analysis: An analysis technique that tags important data atruntime and then closely follows data flows so it can detect whendata have been exfiltrated.

NTT Technical Review

Feature Articles

GTIP
Threat data sources

Web portal
Visualization / Analytics tools / Interface

Local TIP
Local GUI
(graphical userinterface)

Partners(e.g., major commercial
vendors and research
institutions)

Admin. tools

Malware taintanalysis(DSAP)

Threatvisualization
and analysis

Local TIP

Commercial
crawlers

Local data sources

Threat sensors

GTIR
Network traffic

GTIP data administration(Hadoop cluster)Threat visualization
via public website

Fig. 2. GTIP.

Platform Laboratories, we can create a list of malicious servers with which malware communicates. By
also calculating reputations and analyzing correlations in the data, we can produce easily actionable
intelligence supported by detailed evidence and maliciousness ratings.
4.3 Data sharing
GTIP stores the enormous amount of data it collects
and analyzes in a Hadoop cluster that restricts accessaccording to permissions configured for individualtypes of data. GTIP provides a web portal, an Apache
Thrift application programming interface, and otheruser-facing interfaces to support many different service patterns and requirements. GTIP also provides aclient-side local TIP that synchronizes GTIP datawith users’ local environments, and we have taken it
upon ourselves to supply information through a public website: the Global Threat Intelligence Report(GTIR) [2].
One of GTIP’s use cases is increasing our ability todetect and defend against attacks by supplying sharedintelligence as input to firewalls, IDSs, and other network security devices. However, it is not easy tointegrate these disparate components because different user environments have different security policies
for making decisions and different interfaces for controlling devices. We expect RSE connections to serveas an intermediate layer for alleviating these obstacles.

Vol. 13 No. 12 Dec. 2015

5. System for connecting GTIP with RSE andfuture global deployment
NTT Secure Platform Laboratories and NTT I3 currently conduct periodic information exchanges. At
the beginning of 2015, we found that the collaboration between RSE and GTIP had allowed us tostrengthen our cyber defenses even further; RSE wasreinforced with threat intelligence for defending
against more advanced cyber-attacks, and GTIP benefited from simpler integrations with user environments. As a result, during the first quarter of 2015 we
jointly developed a proof of concept for connecting
RSE and GTIP.
Although we can think of many different configurations for connecting the systems together, we implemented automatic defenses in our demonstration
based on GTIP data (Fig. 3).
As can be seen in the figure, GTIP first detects an
attack (1) and then notifies RSE with data relevant tothe attack (2). Finally, RSE determines a response
based on the attack data and configures the appropriate network devices to block the attack (3). Automating this series of actions allows us to proactively
defend ourselves. Through this experiment, we
proved that we could successfully connect RSE andGTIP together and could thus expect to make further
progress on implementing and enhancing the combined system. Our next step will be to demonstratethat this solution works in actual user environments
during our GTIP beta trial in the second half of 2015.
We expect to continue discovering issues (somerelated to operational logistics) and considering ways


Feature Articles

RSE

GTIP

Notify2

3

ConfigureNetwork
security appliances1

DetectGTIP data source(e.g., threat sensors)

Internet

Attackers

Fig. 3. System for connecting GTIP and RSE.

to resolve these issues in the future.
References
[2]
[1]



Security Technology for Rapid Recovery from Cyber Attacks,” NTT
Technical Review, Vol. 12, No. 7, 2014.
https://www.ntt-review.jp/archive/ntttechnical.php?contents=ntr2014
07fa3.html
Website of NTT I3 GTIR, http://www.nttgroupsecurity.com

T. Koyama, K. Hato, H. Kitazume, and M. Nagafuchi, “Resilient

NTT Technical Review

Feature Articles

Takaaki Koyama

Senior Research Engineer, Network Security
Project, NTT Secure Platform Laboratories.
He received a B.A. and M.M.G. in media andgovernance from Keio University, Kanagawa, in
1994 and 1996. He joined NTT Software Laboratories in 1996 and began studying software
CALS (client access license). Since 1999, he has
been developing network equipment and studying GMN-CL, a kind of IP-virtual private network technology. His research interests also
extend to enterprise cloud network systems andsecurity orchestration systems. He is a memberof the Information Processing Society of Japan(IPSJ).

Bo Hu

Researcher, NTT Secure Platform Laboratories.
He received an M.S. in wireless network engineering from Osaka University in 2010 andjoined NTT the same year. He has mainly been
engaged in researching network security technology and inter-cloud technology and has developed security orchestration architecture andinter-cloud protocols. He has also worked on
cloud computing standardization activities in the
Telecommunication Standardization Sector ofInternational Telecommunication Union, andother standardization organizations. He received
the Telecommunication Technology Committee
standardization performance award and has contributed to Institute of Electrical and Electronics
Engineers (IEEE)/Institute of Electrical, Information and Communication Engineers (IEICE)
international academic conferences as a memberof the Technical Program Committee or Organizing Committee.

Yukio Nagafuchi

Senior Research Engineer, Network Security
Project, NTT Secure Platform Laboratories.
He received his B.S. and M.S. in science andengineering from Saga University in 1996 and1998. He joined NTT in 1998 and has been
engaged in the design and development of network systems, VoIP (voice over IP) network
systems, and virtual network systems. His current interests include traffic and security issues incomputer networks. He is a member of IEICE
and IPSJ.

Vol. 13 No. 12 Dec. 2015

Eitaro Shioji

Software Engineer, Security, NTT Innovation
Institute, Inc.
He received a B.E. in computer science and an
M.E. in communications and integrated systems
from Tokyo Institute of Technology in 2008 and2010. He joined NTT in 2010 and has been conducting research on network security. Since joining NTT I3 in 2013, he has been developing athreat intelligence platform. His current and past
research interests include vulnerability exploitation and mitigation, mobile security, malware
analysis, and secure network coding. He is amember of IEICE and received the Information
and Communication System Security ResearchAward from IEICE in 2013.

Kenji Takahashi

VP, Product Management, Security, NTT Innovation Institute, Inc.
He received his B.S., M.S., and Ph.D. in computer science from Tokyo Institute of Technology. He has over 28 years of international experience in the information and communicationindustry. He has led many projects at NTT R&D
in Japan, including those related to cloud computing, software engineering, digital identity
management, collaboration environments, andubiquitous computing. He was previously President and CEO of NTT Multimedia Communication Laboratories, Inc. (NTT MCL) in Silicon
Valley, where he successfully launched and led
open source, open standard based cloud, andsoftware-defined networking projects. He was avisiting scientist at the College of Computing at
Georgia Institute of Technology and a member ofthe Discovery Park Advisory Council at Purdue
University. He received the Kiyasu Special
Industrial Achievement Award from IPSJ for his
pioneering work on federated identity management. He is a member of IEICE, IPSJ, IEEE
Computer Society, and Association for Computing Machinery.

Feature Articles: Cybersecurity-related R&D to Counter
Global Threats

Efforts to Achieve a Joint Risk
Management Support System
Tomohiro Kokogawa, Naoko Kosaka, Akira Koyama,
Fumiaki Ichinose, Fumiyuki Tanemo, and Yuji Maeda
Abstract

At NTT Secure Platform Laboratories, we are developing technology to support joint risk management and incident response based on unified chain of command and control in order to respond to the
expanding global threat of cyber-attacks and physical emergencies such as natural disasters and accidents. This article introduces our efforts aimed at implementing a risk management/incident responsemanagement support system that can be applied in the event of risks of any kind.
Keywords: risk management, incident response, WebEOC

1. Introduction
Throughout the world, great losses are suffered dueto the frequent occurrence of large-scale natural
disasters, accidents, and terrorist incidences. It is necessary to achieve cooperation between organizations
and governments, and consequently, there is a growing movement to standardize incident response measures. Thus, in autumn 2011, the ISO*1 22320 international standard was established to define therequirements for incident response [1]. In 2013, thiswas also adopted as a Japanese standard (JIS*2 Q
22320), and it is thought that it will form the basis for
future standardization in Japan’s domestic incident
response measures, which have so far been implemented in a non-unified way by various local governments and institutions. To respond to the threat ofnatural disasters such as floods, volcanic eruptions,and major earthquakes, it is important that government, businesses, and people work together to implement disaster risk reduction and mitigation measures.
With the arrival of the Internet of Things (IoT), in
which more and more objects are being connected to
the Internet, and the cyber-physical integrated society, where cyberspace and the physical world are
integrated in an advanced fashion, the Japanese government is working on the implementation of a newcybersecurity strategy [2]. In particular, during largescale international events such as the Olympic andParalympic Games, there is an urgent need for countermeasures to the increased threat of global terrorist
cyber-attacks that involve both physical-world andcyberspace elements.
In the past, various organizations have responded todifferent types of emergencies such as natural disasters, terrorism, and cyber-attacks, but in the future it
will be necessary to develop risk management andincident response mechanisms that have a broader
outlook and draw no distinction between physicalworld and cyberspace incidents. In this article, we
discuss the concept of joint risk management as theway forward for risk management and incident
response measures, and we introduce our researchand development (R&D) efforts aimed at realizing
systems to support this concept.
2. Preparing for complex crises
Thus far, different types of emergencies have beenhandled by different organizations. For example,
cyber-attacks are handled by security operation centers, natural disasters and accidents are dealt with by
emergency operation centers, and pandemics are*1	 ISO: International Organization for Standardization*2 JIS: Japanese Industrial Standards

NTT Technical Review

Feature Articles

Natural disaster caused by sudden
downpour• Flooding, paralysis of traffic flow

den
Suda
y
he vpour
down

DDo

k

ttac

eted
Targ emailkcat
Falsification ofatdata
Cyber-attack
response
headquarters• Disruption of disaster response
headquarters by DDoS attack• Attack by targeted email (DDoS used asdiversionary attack), e.g., fake damage
reportPhysical- world disaster caused bycyber-attack• Leakage/falsification of important
information, incidents caused by penetrationof infrastructure, etc.

usion

Conf

EOC

Paralysis offunctions

Sa

Cyber-attack taking advantage of thenatural disasterNaturaldisaster
response
headquarters

CSIRT
Event
services

SOC

usion

Conf

eted
Targ email
k
c
atta

Leakage of
personal data,
VIP data, etc.

CSIRT
SOC

usion

Conf
Suspension of event, paralysis ofmunicipal functions, extortion, intimidation, terrorist attacks (assassinations,destruction of key infrastructure, etc.)

are
Malw

ent

Penetration into
infrastructure

Incid

EOC: emergency operation center
CSIRT: computer security incident response team
DDoS: distribute denial of service
SOC: security operation center
VIP: very important person

Fig. 1. Example of physical world/cyberspace complex crises.

dealt with by general affairs departments. However,with the arrival of the IoT and the increasing sophistication of cyber-attack techniques, we can expect tosee an increased incidence of complex crises such as
cyber-attacks launched on top of natural disasters, orcyber-attacks causing other physical-world incidents.
For example, an attacker might take advantage of asudden unexpected downpour (natural disaster) during an event such as the Olympic and Paralympic
Games in order to launch a cyber-attack on the organizations responding to this disaster. This might becarried out by crafting malware designed to attack
infrastructure organizations and sending it in a targeted email supposedly connected with the disaster
response efforts, thereby damaging the infrastructure
facilities and creating further confusion (Fig. 1).
Vol. 13 No. 12 Dec. 2015

Even though these individual events should be dealt
with by the corresponding organizations and departments, the occurrence of this sort of complex crisis
could cause responders to lose focus by making it
impossible to grasp the overall incident situation,
resulting in suspension of the event and huge humanand financial losses.
3. Joint risk management concept
The occurrence of complex crises involving cyberattacks coupled with physical-world events such as
disasters and accidents is expected to increase in the
future, so it is important to deal with this sort of incident with a joint response that takes a bird’s-eye viewof the entire situation beyond the boundaries between
Feature Articles

Operational
information

Cyberattack

Knowledge

Governance

SOC, CSIRTNaturaldisaster

Criminal
incident

Operational
information
EOC

Knowledge• Each organization responds
individually.
• Difficult to coordinate operations
ons
Operationaltionaltio
between organizations
inform tio
information
informatio
General affairs,
internal control officeComplexphysicalworld/
cyberspacecrisesStandard operatingprocedure
Joint Intelligence Center

Cooperation
Joint operational
information

Knowledge

Joint knowledge

Operational
information

Terrorism/ accident

Knowledge
EOC, general affairs(a) Conventional incident responseTechnology(b) Incident response by joint risk management

Fig. 2. Joint risk management concept.

separate organizations.
An illustration of the joint risk management
concept is shown in Fig. 2. By joining and centralizing the handling of operational information (information for the implementation of response measures)and knowledge (external information that adds value
to disaster response efforts) that was previously handled by separate organizations, it is possible toachieve efficient cooperation between these organizations. Furthermore, incorporating the conventional
response organizations into a joint intelligence center
makes it possible to carry out operations under a unified command.
To turn this joint risk management concept into
reality, it is essential to consider the following viewpoints:(1) To achieve unified command through cooperation between multiple organizations, we needto establish management processes to coordinate activities between organizations andimplement effective decision-making andresponse measures based on a standardized
management flow.
(2) To share information efficiently between organizations, we need to establish a standard operating procedure (SOP) for field activities andimplement field operations using unified tools.
(3) To implement a common operational picture(COP) of the situation across multiple organi

zations, it is necessary to present operational
information and knowledge in an integrated
manner.
4. Plan, Do, See system concept
At NTT’s laboratories, we have already developed
an emergency management support system toincrease the efficiency of responding to incidents,
especially natural disasters [3]. This system implements management functions conforming to the ISO
22320 international standard based on crisis management software that runs on the web (WebEOC).
The operational information needed for incident
response is broadly divided into fixed-format (collected using information-gathering forms) and freeformat (free description) types, and is presented as an
overview from three views (Plan, Do, and See) to
support an efficient incident response.
In implementing joint risk management, we should
build on the functions achieved with this system inorder to strengthen the cooperation between organizations by expanding their scope to encompass risksof all kinds (including cyber-attacks). This system
concept is illustrated in Fig. 3.
(1) Plan (What should we do now?)
To support overall management, an Operational
Planning “P” (an international standard incident
response process) is developed with a checklist (SOP)NTT Technical Review

Feature Articles

Plan
What should we do now?

Do
What are we doing now?

See
What is happening now?

Joint operational
information

Jointknowledge
Joint risk management
technology

Cyber-attack information• Common operational picture• Predicting risks of complex crises• Recommended countermeasures etc.

SOP

SOC/CSIRT

Joint Intelligence Center

Infrastructure damage/recovery status

Lifelines

Roads

Cooperation

Status of facilities andspectators

Damage situation
and response status

Status of transportationand security

Police, security
forcesOperations
centers

Government

Local
government

Information fromambulance/fire crews

Fire fighters

Medical institutions

Fig. 3. Example of joint risk management support system.

Top-level target
Meeting schedule(battle rhythm)

Checklist of work to be donein each process

Headquarters’ management
process based on
Operational Planning “P”

Documents & referencematerials (incident actionplans, manuals, etc.)

Fig. 4. Composition of the “Plan” screen.

for each phase (Fig. 4). This process must be organized so that policies and planning decisions can bemade in a unified manner by all related organizations,Vol. 13 No. 12 Dec. 2015

regardless of the type of incident.
(2) Do (What are we doing now?)
By introducing unified management of free-format
Feature Articles

information that was previously conveyed by phones(oral communication), white boards, and the like infield operations, we can provide status checks anddisplays based on an operational flow defined as an
SOP so that the state of progress can be rapidly ascertained. The way in which this information is used isthought to differ according to the characteristics of
the incident. For example, in the case of a natural
disaster, a huge amount of work is created at the timeof the incident, so it is important to support viewpoints that prevent leakage of shared information. In
the case of cyber-attacks, however, small-scale events
have to be dealt with on a daily basis, so it is thought
to be necessary to support objectives such as increasing the efficiency of progress management and optimizing the control of access to shared information.
(3) See (What is happening now?)
An overall view of the damage situation andresponse status is facilitated by presenting information in the form of maps and dashboards. When complex crises occur, there will be a need for information
presentation methods that can provide a joint overview of the current situation to the organizations
responding to each incident.



5. Future prospects
At NTT’s laboratories, in addition to advancing our
R&D aimed at achieving joint risk management bysolving the above issues, we aim to enable the NTT
Group to provide total risk management and incident
response solutions that facilitate efficient cooperation
between organizations by allowing existing NTT
Group products to cooperate with the products ofother vendors that conform to a wide variety of standard specifications. We will also make use of thistechnology and other incident response know-how
cultivated by the NTT Group in order to contribute to
the realization of a society resilient to disasters.
References
[1]

[2]
[3]

M. Higashida, N. Kosaka, and Y. Maeda, “A Comparison ofApproaches to Incident Response in Japan and the United States andan Introduction to the International Standard ISO 22320,” NTT Technical Review, Vol. 11, No. 6, 2013.
https://www.ntt-review.jp/archive/ntttechnical.php?contents=ntr2013
06ra1.html
National Center of Incident Readiness and Strategy for Cybersecurity,“Cybersecurity Strategy (Draft Plan),” May 2015 (in Japanese).
http://www.nisc.go.jp/conference/cs/dai02/pdf/02shiryou01.pdf
N. Kosaka, A. Koyama, F. Ichinose, T. Kokogawa, Y. Maeda, H.
Sakuma, T. Nozaki, M. Wada, N. Sakai, T. Nishimura, M. Sugiyama,
M. Zusho, M. Osada, and K. Minowa, “An Emergency Management
Support System Using WebEOC,” NTT Technical Journal, Vol. 27,
No. 3, pp. 55–58, 2015 (in Japanese).

NTT Technical Review

Feature Articles

Tomohiro Kokogawa

Senior Research Engineer, Security Risk Management Project, NTT Secure Platform Laboratories.
He received a B.E. and M.E. in engineeringscience from Osaka University in 1991 and 1993,
and a Ph.D. in engineering from Wakayama
University in 2013. Since joining NTT Telecommunication Networks Laboratories in 1993, hehas been researching and developing information
sharing systems and public service systems. He
received the IPSJ SIGGN Best Presentation
Award in 2012. He is a member of the Institute ofElectrical and Electronics Engineers (IEEE) andthe Information Processing Society of Japan(IPSJ).

Fumiaki Ichinose

Senior Research Engineer, Security Risk Management Project, NTT Secure Platform Laboratories.
He received a B.E. and M.E. in applied physics
from Osaka University in 1994 and 1996. Sincejoining NTT Kansai branch office in 1996, he has
been integrating the disaster risk reduction system to customers’ emergency operation centers.
He is a member of the Institute of Social Safety
Science.

Fumiyuki Tanemo

Naoko Kosaka

Research Engineer, Security Risk Management
Project, NTT Secure Platform Laboratories.
She received a B.E., M.E., and Ph.D. in engineering from Tokyo Institute of Technology in
1995, 1997, and 2004. She joined NTT Human
Interface Laboratories in 1997 and engaged inresearching and developing image processing
methods for 3D maps and satellite images. She is
now involved in researching and developing
emergency management support systems. She isa member of the Institute of Electronics, Information and Communication Engineers (IEICE)
and the Japan Society for Disaster Information
Studies.

Senior Research Engineer, Supervisor, Security Risk Management Project, NTT Secure Platform Laboratories.
He received a B.E. and M.E. in engineeringfrom Nagoya University in 1991 and 1993. He
joined NTT Information Processing Laboratories
in 1993, where he researched and developed
object-oriented databases and information security management tools. He is now engaged inresearching and developing emergency management support systems. He is a member of IEEE
Computer Society and IPSJ.

Yuji Maeda

Akira Koyama

Research Engineer, Security Risk Management
Project, NTT Secure Platform Laboratories.
He received a B.E. and M.E. in applied chemistry from Hokkaido University in 1998 and2000. Since joining NTT-EAST Tokyo branch
office in 2000, he has been integrating the disaster risk reduction system to customers’ emergency operation centers.

Vol. 13 No. 12 Dec. 2015

Vice President, Senior Manager, Security Risk
Management Project, NTT Secure Platform
Laboratories.
He received a Ph.D. in systems information
science from Future University Hakodate, Hokkaido, in 2013. He joined NTT Telecommunication Networks Laboratories in 1991. He is currently managing projects related to generalemergency management such as those concerning natural disaster response and cybersecurity
involving NTT-CERT. He received the Scholarship Encouragement Award from IEICE in 1998.
He is a senior member of IEICE and a member ofIEEE and the Japanese Telemedicine and Tele­
care Association.

Feature Articles: Service Design for Attractive Services
and Trends in Design Thinking

Service Design for Creating
Attractive Services, and Trends in
Design Thinking
Takehiko Ohno, Yasuhisa Kato, and Yoko Asano
Abstract

Terms such as service design and design thinking are receiving a lot of attention as methodologies for
producing attractive services, and the NTT Group is tackling this issue from various perspectives. This
article introduces these initiatives, first discussing what design is, then describing how service design anddesign thinking fit within current design trends. Finally, it introduces three key concepts on which NTT
Service Evolution Laboratories places particular focus: human-centered design, user experience design,and participatory design
Keywords: service design, design thinking, user experience design

1. Introduction
The concept of design is attracting attention invarious fields. Upon hearing the word design, one
tends to think of something stylish or cool, but that is
only part of it. Design derives from the Latin word
designare, meaning to express (de-) a sign or symbol(sign), or to encode a person’s acts. In other words,
design is the process of producing a concrete form
creatively expressing people’s productive activities.
There are many ways to define design, but we haveadopted the following definition (Fig. 1).
Design is a process of adapting products and systems so that resources meet human needs and wants
and solving problems by working creatively anditeratively within various societal, economic, andother constraints.
In other words, in most of our productive activities,
we are actually carrying out design. However, there
are various constraints in implementing excellent
products and services, and the solution for them is notunique. It is also extremely difficult to achieve an
excellent solution in just one try. For these reasons, it
is very important to iterate design, creating something and repeating the process, in order to graduallyreach a concrete solution. The object of design usually begins with some necessities in daily life, develops into a product or service, and then expands
through society, involving cities, the environment,
and energy. Of course, information and communication technology (ICT) is also a product of design.
Terminals, applications, and also networks, clouds,
security, and other aspects have points of contact withpeople, so design can be said to apply to them too(Fig. 2). The NTT Group is addressing this broad
domain. These Feature Articles introduce design initiatives to produce excellent ICT services within the
NTT Group. This article discusses design trends as an
introduction to this topic.
2. From modern design to service design
Formerly, design was closely tied to complex social
systems such as those related to class or occupation.
Where one lived, what one wore, what one used every
day, and other factors were determined by the class towhich one belonged. These ties were broken by modern revolutions such as the French Revolution, theIndustrial Revolution, and the Meiji Restoration.
Then, starting in the latter half of the 19th century,
new designs signifying new social systems, life
styles, and living environments began to appear.
NTT Technical Review

Feature Articles

Social factors, economic factors
Constraints
DesignResources

Products, systems

Creative, iterative

Needs, requirements

HumansFig. 1. What is design?

Application

Service

Application

Service

Application

Service

Terminal

Security

CitiesEnvironment
Cloud
EnergyNetwork
Daily
necessities

ICT services

SocietyFig. 2. Major design domains.

These are in the category referred to as modern
design [1].
The new social systems are closely connected tomarket economies. Initially, manufacturing was basically handcrafted, but soon, the age of mass production began, bringing homogeneous, low-cost products. This enabled enterprises to use design to generate large profits. For example, design took a significant role in the field of automobiles. Henry Ford
produced the Model T—a low-priced, highly reliable
automobile—in 1908, generating explosive sales, andVol. 13 No. 12 Dec. 2015

General Motors attempted to segment the market
with different models in the 1920s. In the 1980s,
design began to have a close connection with ICT.
Apple* is a typical example. As everyone knows, theApple II, Macintosh, and later the iPhone and iPad
have all had a significant impact on people’s lives.
In the 21st century, enterprises generated quite a lotof profit through the design of products, but there was*Apple, Apple II, Macintosh, iPhone, and iPad are trademarks orregistered trademarks of Apple Inc.



Feature Articles

Plan the humancentered design
process.

Understand and specify
the context of use.

Designed solution
meets user
requirements.
Evaluate the designs
against requirements.

Specify the user
requirements.
Produce design
solutions to meet user
requirements.

ISO: International Organization for Standardization

Fig. 3. Human-centered design process (from ISO 9241-210:2010).

also much discussion in relation to design throughproblem solving, innovation, and even management
strategy. In addition to products, services also cameto be considered as something to be designed. Design
thinking and service design are methodologies that
arose in this context. Design thinking is a methodology that uses the basic approach of a designer todevelop services, in other words, thinking deeply
about the people using the product or service, clarifying the various constraints, and then using an iterative, trial-and-error process to arrive at the best solution. It is a human-centered, iterative method used tocreate services. As such, it emphasizes prototyping,and services take form while repeatedly being verified. The U.S. design firm IDEO has recently been
attracting a lot of attention with its proposal of design
as a methodology for innovation. Service design isalmost the same approach [2], but this is more common in Europe and is used more broadly than just in
private enterprise, for example, in public services as
well.
These methodologies focus not only on products
and services produced through design, but also on
design processes and methodologies. Attention ispaid to any new strengths arising from design, which
are then incorporated into innovative products andservices as part of the process within the enterprise.
Design has also greatly exceeded the economic
activity of private enterprises and has become an
essential means of finding solutions to urgent issues
in society and the environment around the world [3].
As such, efforts are producing excellent, breakthrough solutions that demonstrate a deep under

standing of the needs and desires of the relevant
people and that satisfy the various constraints
involved. In Japan, design has not necessarily been
applied in finding solutions to such problems, but
initiatives are gradually beginning to spread. The
importance of design and the range of applications
should continue to expand in Japan in the future.
3. Different design concepts
Here, we introduce three concepts we emphasize
when designing ICT services: human-centered
design, user experience design, and participatory
design.
3.1 Human-centered design
Human-centered design is a methodology fordesigning convenient, usable systems, which focuseson the people that will use the service and their needs,
and uses knowledge of human engineering andusability [4]. Here, system users are not limited tothose directly operating the system but include otherstakeholders surrounding it such as managers andowners deciding whether to purchase the system.
Designers first gain an understanding of the users of
the service and clarify the user characteristics, theconditions under which the service will be used, andthe desires of users in those scenarios. Then, ideas on
how to satisfy those desires are generated and evaluated as to whether the user desires are really satisfied.
It is difficult to achieve an excellent service that truly
satisfies the desires of users in one try, so this process
is repeated (Fig. 3). Often, thinking about services
NTT Technical Review

Feature Articles

begins with a technology or a function, but a major
strength of human-centered design is that it always
maintains a focus on the people that will use the service. Both design thinking and service design are
based on the concept of human-centered design.
3.2 User experience design
User experience (UX) design is a methodology fordesigning attractive services that appeal to users, andit has attracted a great deal of attention in recent
years. UX encompasses the behaviors taken by users
when using the service, the feelings produced indoing so, and the experiences and memories left
afterward. These experiences and memories areformed during the entire process: before, during, andafter use. There are various opportunities at points ofcontact between the user and the service for adding
advertising, support, or other features to the service
itself. Various usage scenarios can also be considered.
They must be considered in an integrated rather thanfragmented way when designing the service so that
all contact between the user and the service leaves a
positive impression on the user.
Deep knowledge of the users is needed to accomplish this. To understand the users, they are interviewed and observed in order to clarify their everyday
activities, interests, and values and the environments
in which they use the service so that a service integrating all of them can be created. It is important tocreate a service that has a user interface with a consistent appearance that is carefully and discretely configured, and it is also vital to determine how the users
feel when operating the service to ensure that they
feel comfortable and content. This requires extra
work, but many leading enterprises have adopted it as
a way to create attractive services.
3.3 Participatory design
Participatory design is the idea of involving thevarious end users and other stakeholders directly inthe design from the initial stages. It has spread aroundthe world from its beginning in Northern Europe. It
has recently attracted much attention as a new
approach to designing ICT systems, and in particular,
applications, infrastructure, and the environments for
those using the systems and the environments forpeople engaged in work using ICT systems. For
example, when developing a service, it is helpful tohold workshops with users in the initial stages of service development in order to draw out any latentissues and ideas from users themselves. There are twomain points that led to the idea of doing this.
Vol. 13 No. 12 Dec. 2015

The first is an ethical factor, the idea that users whowill be using the product or service have a right toparticipate in the design. For example, it is considered important for workers who will be working in aparticular environment to be able to participate in its
design. This idea was introduced into information
systems workplaces in the 1970s in Northern Europe
and arose from concerns that efficiency was the only
thing that mattered, and the value of work andhumanitarian concerns were being ignored.
The second point is related to efficiency. The service is used by users, and ultimately, they are the ones
that best know themselves. The objective is to more
effectively understand users’ needs, evaluate usability, and design services by having them participate
from the initial stages of the design process. This idea
is also emphasized in human-centered design.
These concepts and methodologies are effective forcreating attractive and competitive services and also
in handling societal issues for which solutions are
difficult to find.
4. Service design initiatives within
the NTT Group
These Feature Articles introduce various initiatives
in service design within the NTT Group. In “Concept
Tailor: A Tool for Iteratively Designing Service Concepts Using Storyboards” [5], we introduce the Concept Tailor tool developed by NTT Service Evolution
Laboratories. This tool supports the process ofobtaining user evaluations of and refining a service
concept iteratively. Concept Tailor makes iterative
design easier, which is important for human-centered
design. Note that this laboratory is also engaged invarious other research and design initiatives related toservice design [6].
In “Evaluation Methods for Service Design” [7],we introduce user evaluation methods for service
design in use at NTT Advanced Technologies, including both concepts and practical methods. User evaluation is essential in deciding what is good or bad
about a service and for drawing out issues that need
to be addressed. The article explains what evaluation
methods must be used in line with the objectives atvarious stages of design.
“Methodology for Creating Attractive Services”[8] introduces various service-design methodologies
that NTT IT Corporation is working on and discusses
points that must be considered throughout the processof creating and evaluating ideas based on user understanding.
Feature Articles“Training Initiatives for UX Designers” [9] introduces the results of work done by NTT Communications in organizing the skill set, mind set, and design
processes for training UX designers. Excellent UX
designers are needed to produce excellent services.
This initiative is a first step.
Finally, “Initiatives Related to the Creation of New
NTT DATA Services” [10] introduces initiatives at
NTT DATA to create new services together with corporate customers, centered on and related to service
prototyping, which is based on design thinking. Here,design is based on realizing ideas through prototyping and verifying whether they really are good fromthe customer’s perspective. It is a very important initiative.
5. Future prospects
All of the methodologies discussed—design thinking and service design—and the concepts overviewed—human-centered design, UX design, andparticipatory design—appeared in the context ofmodern design efforts in Europe and the UnitedStates. However, they do not include views, methodologies, or values from Japan. They are closely
related to Western culture and so may not necessarily
work well in Japan as-is. Japan boasts a wonderfulculture and values, including a hospitality culture as
exemplified by the tea ceremony and folk crafts thatfind the beauty in simple everyday things, as well asan acceptance of diversity as shown by the syncretization of Shinto with Buddhism, and an emphasis on
quality as represented in the manufacturing industry.
We believe that to compete globally in service design,
it will be important to think of new design methodologies and concepts based on such Japanese values.
NTT Service Evolution Laboratories will continue toresearch and develop service design, establish new
design methodologies and values in collaboration
with others within and outside the NTT Group, andwork to create excellent ICT services.
References[1]

H. Kashiwagi et al., “Modern Design History,” Musashino Art University Press, Tokyo, Japan, 2006 (in Japanese).
[2] M. Stickdorn and J. Schneider, “This is Service Design Thinking:
Basics, Tools, Cases,” John Wiley & Sons, New Jersey, USA, 2011.
[3] E. Lupton, C. McCarty, M. McQuaid, and C. Smith, “Why Design
Now? National Design Triennial,” Cooper-Hewitt, New York, USA,2006.
[4] ISO 9241-210:2010, “Ergonomics of Human-system Interaction—
Part 210: Human-centred Design for Interactive Systems,” 2010.
[5] K. Kusano and T. Ohno, “Concept Tailor: A Tool for Iteratively
Designing Service Concepts Using Storyboards,” NTT Technical
Review, Vol. 13, No. 12, 2015.
https://www.ntt-review.jp/archive/ntttechnical.php?contents=ntr2015
12fa7.html[6] Y. Asano, T. Ohno, S. Miyahara, M. Watanabe, M. Nakashige, A.
Kimura, and K. Wago, “Towards the Creation of Attractive Services
Based on an Understanding of Users,” NTT Technical Review, Vol.
13, No. 7, 2015.
https://www.ntt-review.jp/archive/ntttechnical.php?contents=ntr2015
07fa5.html[7] X. Chen, “Evaluation Methods for Service Design,” NTT Technical
Review, Vol. 13, No. 12, 2015.
https://www.ntt-review.jp/archive/ntttechnical.php?contents=ntr2015
12fa8.html[8] M. Nakatani, K. Amano, H. Fukuoka, N. Hamaguchi, and C. Saito,“Methodology for Creating Attractive Services,” NTT Technical
Review, Vol. 13, No. 12, 2015.
https://www.ntt-review.jp/archive/ntttechnical.php?contents=ntr2015
12fa9.html[9] J. Kim, H. Tsuchiya, K. Yamada, Y. Sagata, N. Kiyama, and K.
Yoshimi, “Training Initiatives for UX Designers,” NTT Technical
Review, Vol. 13, No. 12, 2015.
https://www.ntt-review.jp/archive/ntttechnical.php?contents=ntr2015
12fa10.html[10] K. Kadoya, “Initiatives Related to the Creation of New NTT DATA
Services,” NTT Technical Review, Vol. 13, No. 12, 2015.
https://www.ntt-review.jp/archive/ntttechnical.php?contents=ntr2015
12fa11.html

NTT Technical Review

Feature Articles

Takehiko Ohno

Director, Heart Touching ICT Design Department, NTT IT Corporation.
He received a B.Sc. and M.Sc. from Tokyo
Institute of Technology in 1992 and 1994. He
joined NTT Basic Research Laboratories in 1994
and studied cognitive science and human-computer interaction. He has been researching
human-computer interaction, human-centeredsystem design, service design, design thinking,user experience design, usability, gaze tracking
technology and its applications, cognitive modeling, and computer-mediated communication. He
moved from NTT Service Evolution Laboratories to NTT-IT in September 2015. He is a member of the Association for Computing Machinery,
the Information Processing Society of Japan(IPSJ), the Human Interface Society, and theInstitute of Electronics, Information and Communication Engineers (IEICE).

Yoko Asano

Executive Research Engineer, Project Director,
Universal UX Design Project, NTT Service Evolution Laboratories.
She received a B.E. in administration engineering from Keio University, Kanagawa, in 1988
and joined NTT Human Interface Laboratories
the same year. She moved to NTT Cyber Solutions Laboratories (now NTT Service Evolution
Laboratories) in 2001. Since then, she has been
conducting research on human interfaces. She isa member of the Human Interface Society, theJapan Ergonomics Society, and IEICE.

Yasuhisa Kato

Senior Research Engineer, Supervisor, Universal UX Design Project, NTT Service Evolution
Laboratories.
He received a B.E. and M.E. in applied systems
science from Kyoto University in 1988 and 1990.
He joined NTT Information Processing Laboratories in 1990. He also received an M.A. in education from Stanford University and his Ph.D.
from Kumamoto University. He has been
engaged in research and development of voiceprocessing systems, educational systems, andsearch systems. He is a director of the JapaneseSociety for Information and Systems in Education, e-Learning Consortium Japan, and theJapan Evaluation Institution for Education andLearning. He is a member of the Japan Society
for Educational Technology, the Japanese Society for Artificial Intelligence, and IPSJ.

Vol. 13 No. 12 Dec. 2015



Feature Articles: Service Design for Attractive Services
and Trends in Design Thinking

Concept Tailor: A Tool for Iteratively
Designing Service Concepts Using
Storyboards
Koki Kusano and Takehiko Ohno
Abstract

To develop services that are attractive to users, it is important to refine the service design iteratively
by obtaining evaluations of the service from users from the earliest stages. NTT Service Evolution
Laboratories has developed Concept Tailor, which supports iterative design and applies a rule that
divides service concepts into four stages. This article introduces the process of realizing a service concept using this tool.
Keywords: service design, prototyping, storyboards

1. Introduction
As information and communication technology(ICT) has progressed, numerous ICT services havebeen created, enabling users to select and use theservices they prefer. To be selected by users, services
must have not only good functionality and performance but also an attractive design. Here, designrefers to more than just the physical design; it includes
the whole process of using the service and the entire
experience until the result is achieved.
To realize an attractive design, it is important to follow an iterative process from the initial stages
throughout the entire development process, which
involves making repeated improvements while continuously receiving user evaluations [1]. In particular,
in the initial stages of service design, it is effective toverify the hypotheses through prototyping, including
whether the assumed user need really exists, andwhether users will empathize with the conceived scenarios of the service.
However, real projects have time and budget constraints, and it is not always possible to allocate
enough time to prototyping [2]. Of course, various
methods have been proposed for performing each
iterative task efficiently [3], but skill is needed tomaster and use them together. The amount of workrequired to reference and use the knowledge gained
from each technique is also an issue. As a result, thedesign process takes time, and it is difficult to verify
the hypotheses through user evaluation, reducing theeffectiveness of iterations. This issue is particularly
noticeable with people who are not expert in iterative
design techniques.
2. Concept Tailor: supporting effective
iterative design
In consideration of the issues described above, wehave developed Concept Tailor, a tool for supporting
iterative design from the initial design stages. The
tool supports an iterative process for implementing
service concepts, as shown in Fig. 1. The general
iterative design process consists of repeated actionsof clarifying the service concept hypothesis, creating
a story (prototype), and getting user evaluations.
Concept Tailor introduces a new rule that divides the
hypothesis into four stages that link each of thesesteps smoothly. Specifically, it provides templates fora four-stage draft hypothesis, creation of storyboards
linked to the hypothesis, and guides for user interviews called hearings. These three templates support
the processes for each task and can be used to manage, reference, and use the information gained fromNTT Technical Review

Feature Articles

Current situation: Designer has difficulty connecting and referring to each step.
2. Creating a story

1. Clarifying hypothesis

Iteration

Hypothesis
1. Background
2. Key concept
3. Method

3. Getting feedback

Storyboard templates
Link

Background

Concept
MethodGoal

Method
Q:... Needs
Q:... Q:...
GoalQ:...
k
Q: Concept
in
L
Q:

User

4. GoalIteration
Four category
Storyboard template
hypothesis template
linked to hypothesis

Interview template
linked to hypothesis

Proposal: Three templates based on four category hypothesis
allows designer to smoothly conduct and connect each step.

Fig. 1. Design process supported by Concept Tailor.

Fig. 2. Using Concept Tailor.

each process. Thus, even non-experts can perform
iterative design effectively within a limited amount oftime.
The tool’s three templates support the three design
processes of (1) clarifying the service concept
hypothesis, (2) creating storyboards to verify the
hypothesis, and (3) analyzing results of user evaluations in the form of hearings using the storyboards. It
also implements interactions that smoothly link eachof the processes. The tool is particularly effective to
use when the service designer or planner conceives anVol. 13 No. 12 Dec. 2015

idea for a new service.
3. Four areas for tailoring concepts
The tool is organized into four areas: the Hypothesis, Storyboard, Hearing, and Revision areas (Fig. 2).
The areas are linked together, and the tool makes it
possible to manage, reference, and use information
among them. The roles of each area are described in
more detail below.

Feature Articles

2 frames: Introducing your service concept with elevator pitch
Background &Key concept

Method &Goal

Examples of linkage
between frame and hypothesis

3 frames: Introducing service concept with first person view
BackgroundKey concept &MethodGoal

4 frames: Introducing your detailed service concept
BackgroundKey concept

MethodGoal

Fig. 3. Various storyboard templates.

3.1 Hypothesis area
When iterating a design, if the user evaluation is
simply “Good” or “Bad,” it is not possible to decide
what improvements should be made in the next iteration. Therefore, it is important to evaluate the hypothesis in different stages, such as whether it matches
service use cases for the target users, whether it fits
the service concept, or whether users desire to use thedevice. The tool makes it easier to clarify the hypothesis by dividing it into four stages with respect to theservice concept: the background, key concepts, methods, and goals.
Each stage of the hypothesis is described below.
(1)	Background: Describes the issues or needs ofthe target users of the service.
(2)	Key concept: Describes the concepts of how theservice to be provided will address the issues inthe background hypothesis.
(3)	Method: Describes specifically what methods
will be implemented for the key concepts.
(4)	User goal: Describes the ideal state of users
whose needs have been satisfied by the service.
3.2 Storyboard area
In the service concept hearings, it is important thatusers imagine specific situations when using the service. Sharing stories is effective for this. Seeing andhearing stories makes it easier to imagine specificconditions when using the service.
The tool supports creation of storyboards by providing templates such as those shown in Fig. 3. Eachframe of the template is associated with the fourstage hypothesis. Also, when a template is selected,
the hypotheses described for each stage are automatically imported into the text of the corresponding
frame. This enables the designer to quickly understand the correspondence between frames andhypotheses. Photos from a smartphone or other camera can also be sent to the tool so that frames of thestoryboard can be created quickly.
3.3 Hearing area
In hearings, it is important to obtain user evaluations for each stage of the hypothesis and lessons thatcan be used in the next iteration. When doing so,
information beyond just “Good” or “Bad” assessments must be obtained, for example, reasons for theevaluation, the basis for it, and specific details of theexperience. This information is used to decide whether each hypothesis is supported or not and can be used
to study what improvements need to be made in thenext design iteration.
However, the information obtained in a hearing
with users can vary greatly based on how users understood the questions (hearing items). For this reason,skill is needed to obtain and analyze each hypothesis
appropriately and to use it in the next design iteration.
Thus, in the hearing area, the user can simply select ahearing template. Hearing items are generated automatically by associating them with the hypotheses
NTT Technical Review

Feature Articles

described in the hypothesis area. Hypotheses are
divided into four stages, so hearing items matching
the stages of the hypothesis can be generated automatically.
When a hearing template is loaded, hearing topics
and entry forms for responses to each topic are displayed, as shown at the lower left in Fig. 2, so evenpeople with little experience can take part in hearings
with confidence.
Finally, the hearing area provides an entry form forsummarizing the results of the hearing. This improves
efficiency when reviewing particular hearings later.
3.4 Revision area
With rapid iterations, the lessons learned and decisions made in the past can fade, and it can become
difficult to perform effective iterations. Therefore, it
is important to make it easy to reference that information and study how to proceed with the design. The
revision area retains a record of each iteration andprovides a function to reference it in one click.
Specifically, in addition to supporting the three
processes of clarifying hypotheses, creating storyboards for hearings, and analyzing the results of hearings, it preserves this information for each revision sothat continuous, effective iterations can be performed.
Revision management simply stores what hypotheses
were established, what stories were conceived forthem, and what hearing results were obtained foreach iteration. Thus, what was learned and what was
decided as a result can be seen at a glance for each

Koki Kusano

Researcher, NTT Service Evolution Laboratories.
He received his M.E. in engineering from the
University of Electro-Communications, Tokyo,
in 2010. Since joining NTT in 2010, he has beenworking in the research areas of human computerinteraction for service design and user experience
design.

Vol. 13 No. 12 Dec. 2015

revision. In other words, any decisions made in pastiterations can be reviewed quickly.
4. Future prospects
We recently implemented a prototype of this tooland began trial use in a collaborative study conductedwith the Graduate School of System Design andManagement at Keio University and in collaborative
projects with NTT Group companies that are creating
new services and improving existing services. It has
so far been found to be effective in supporting iterative design for people with little design experience. In
the future, we will continue to apply prototypes ofthis tool in various cases, repeatedly improving it tomake it more practical. We will also continue togather knowledge through these cases and use it toresearch new ways to extend functionality and techniques.
References
[1]
[2]

[3]

The Bootcamp Bootleg, Stanford University Institute of Design.
http://dschool.stanford.edu/use-our-methods/the-bootcamp-bootleg/
J. Blomkvist and S. Holmlid, “Service Prototyping According to Service Design Practitioners,” Proc. of Serv. Des. 2010 (Second Nordic
Conference on Service Design and Service Innovation), Linköping,
Sweden, Dec. 2010.
T. Maeno, T. Yasui, S. Shirasaka, Y. Tomita, K. Ishibashi, T. Iwata, andH. Yagita, “Official Guidebook to Keio SDM: System and Design
Thinking for Creating Innovation,” Nikkei Business Publications,Tokyo, Japan, 2014.

Takehiko Ohno

Director, Heart Touching ICT Design Department, NTT IT Corporation.
He received a B.Sc. and M.Sc. from Tokyo
Institute of Technology in 1992 and 1994. He
joined NTT Basic Research Laboratories in 1994
and studied cognitive science and human-computer interaction. He has been researching
human-computer interaction, human-centeredsystem design, service design, design thinking,user experience design, usability, gaze tracking
technology and its applications, cognitive modeling, and computer-mediated communication. He
moved from NTT Service Evolution Laboratories to NTT-IT in September 2015. He is a member of the Association for Computing Machinery,
the Information Processing Society of Japan, the
Human Interface Society, and the Institute ofElectronics, Information and Communication
Engineers.

Feature Articles: Service Design for Attractive Services
and Trends in Design Thinking

Evaluation Methods for Service
DesignXinlei Chen
Abstract

Service design is not a direct path but requires repeated creation and improvement in order to makeprogress. Suitable evaluation methods can be used to assess the results of each step (concept plan, mockup, prototype, etc.) to avoid moving in the wrong direction. This article introduces ideas and evaluation
methods used in service design.
Keywords: human-centered design, evaluation methods, prototyping

1. Introduction
The idea of human-centered design*1 is the basic
concept in service design. Everything begins withgaining an understanding of users and having empathy with them and proceeds in steps—defining the
problem, finding a solution, developing a concept
plan, producing mock-ups, and creating prototypes—
until a solution is finally produced and the design isrealized. However, this process is by no means linear
and involves repetitions of creation, improvement,
and selection. As such, decisions have to be madeevery day (concept A or concept B, design 1 or design
2, etc.). Correct decisions are necessary in order toproceed in the right direction, and the correct basis
must be obtained to make them. One important way
to obtain the correct basis is by conducting evaluations. Evaluation of service design has the following
characteristics in contrast to conventional evaluationof existing services.
(1) Diversification of what is evaluatedIn evaluating existing services, the service is usually evaluated in its completed form. However, during
the service design process, most evaluations are doneon intermediate results such as a concept plan, roughmock-up, or prototype. When such results are evaluated, it is important to carefully study how the service
is shown to users and what is actually being evaluatedin order to obtain correct results.

(2) Novelty of what is evaluatedTo understand whether a service will be effective or
acceptable, it can be compared with existing services.
However, for very novel services, there is often no
existing service to compare it with. In such cases,
other effective evaluation methods must be studied.
(3) Repetitiveness of evaluation
Until now, evaluations were basically done before
improvements were made (when problems were
found in an existing service), or when a prototype orservice was completed (checking the effect ofimprovements). Since service design is iterative, it ismore effective to do evaluations at each step and to
feed the results back into the next step.
(4) Acceleration of feedback
The amount of time that can be spent on each stepin service design is limited, so evaluations must be
done quickly. In some cases, there is insufficient time
to gather enough participants. Therefore, a way toobtain evaluation results in a shorter time period isneeded.
NTT Advanced Technology has been providing
consulting services supporting research and development and improvement of products and systems
based on human-centered design for over 20 years.
*1	 Human-centered design: A development approach for making
systems more user-friendly and usable. A detailed definition is
given in ISO 9241-210.

NTT Technical Review

Feature Articles

Table 1. List of evaluation methods.
Design phase

To be evaluatedEvaluation objectives(1) Understanding users––(2) Defining issues––

Evaluation methods–(3) Studying solutions- Scenarios- Storyboards- Concept videos- Checks concept validity- Interviews- Surveys(4) Designing(Rough prototypes)- Sketches- Wireframes- Mock-ups- Paper prototypes- Checks function acceptability- Verifies information architecture(navigation, categories, layout, labeling, etc.)- Verifies usability (effectiveness, efficiency)- Interviews- Expert reviews- User testing- Card sorting- Simple evaluations(5) Development(Advanced prototypes)- Checks service acceptability- Advanced visual mock-ups - Verifies information architecture- Interactive prototypes(hierarchical visual structure etc.)- Verifies usability(effectiveness, efficiency, satisfaction)- Checks price acceptability- Interviews- Expert reviews- User testing- Simple evaluations- Real prototypes- Field testing- Performance measures- Checks effectiveness of use in real or simulated
environments- Checks usability in real or simulated environments

During that time, we have accumulated know-how
regarding characteristics of user behavior, various
interface design patterns, and evaluation methods
such as surveys. In collaboration with people fromthe Universal User Experience (UX) project at NTT
Service Evolution Laboratories, we have applied thisknowledge to service design and have developed
simple evaluation methods that can be performed
efficiently and effectively.
2. Evaluation methods
It is important to select evaluation methods suited
to the type of results and evaluation objectives foreach stage of service design. A list of evaluation
methods is given in Table 1. The details of evaluationin each of the phases are described below.
2.1 Solution study phase
The main evaluation objective in this phase is toverify the solution concept. The various concept
plans being studied are expressed in easy-to-understand text (scenarios), illustrations (storyboards), andvideo (concept videos). These are used to explain thesolution to users, ask their opinions directly, andverify which concept plan evokes the best response.
It is desirable to hear opinions from as many users as
possible, but actual costs (time, money, etc.) are usually limited, so methods that integrate less expensive
web surveys can also be used.

Vol. 13 No. 12 Dec. 2015

2.2 Design phase(1) Rough prototype
In this phase, rough prototypes are created, fromsketches of the idea to wireframes, mock-ups, andpaper prototypes. The main functions and screen
framework of the service can be seen, so the following areas should be verifiable before performing
graphical and interaction design.
1)	Function acceptability: Evaluate whether themain functions to achieve the user’s objectives
are included, and whether these functions seem
attractive. An effective evaluation method is tohave users experience the prototype and thenconduct interviews with them.
2)	Information architecture suitability: Evaluate
the comprehensibility of the overall screen layout, navigation, categories, labels, and otheraspects. Expert review by a specialist in humancentered design and user testing are often used.
Card sorting is also useful for evaluating theappropriateness of categories.
3)	Usability: Evaluate whether objectives areachieved (effect), whether there are wastefulprocedures, and whether objectives can beachieved by the shortest possible path (efficiency). There are indices for usability satisfaction (whether users feel any discomfort), but
evaluating it at this stage is not recommended
because prototypes at this stage are visually
incomplete, and this could introduce some subjective bias. Expert reviews and user testing areFeature Articles

common methods to evaluate usability, and theWizard of Oz method is often used for user
testing, where in place of a computer or smartphone, a human operator runs the prototype
according to user operations. If time is limited,a simple evaluation can be done in three days(not including recruiting of participants), combining expert reviews and user testing with twoparticipants.
(2) Advanced prototype
During this phase, design of overall screen graphics(style, color scheme, icons, etc.) and detailed animations (smartphone screen window swipes andmotions, etc.) are prototyped. Thus, visual and subjective acceptability can be evaluated.
1)	Service acceptability: Check the overall attractiveness of the service, including appearance,and disposition toward using it. Detailed views
can be gained in interviews with users andthrough questions about the conditions andenvironment after they have experienced theprototypes.
2)	Information architecture suitability: Evaluate
visual aspects that could not be evaluated withthe rough prototype (e.g., how color and fontsize in headings make the text structure easierto understand). An expert review by a specialist
and user testing can be used for evaluation.
3)	Usability: Evaluate whether user interface (UI)
elements on the screen are recognizable interms of effectiveness and efficiency (e.g.,whether it is clear that a given element is clickable as a button). Evaluations such as expert
reviews and user testing or a simple evaluation
combining them can be used here as well.
4)	Price acceptability: Pricing is usually evaluatedthrough interviews, but effective answers cannot be obtained by simply asking “How muchdo you think you would pay to use this?” Thisis because users tend not to give high prices,and users have differing standards, so responses
tend to vary greatly. From our experience, we
obtain the most useful responses when we ask
interested users, “We plan to charge around xxx
yen. Do you think you would want to use it?”
2.3 Development phase
In this phase, real equipment can be used in theevaluation based on real data. Effective field testing
can be conducted with real target users in a real environment. The effectiveness of the overall service canbe judged by having users actually experience it,observing changes in behavior before and afterwards,
determining conditions through journaling, andunderstanding users’ views through interviews. Thesemethods can be used even if there is no existing service with which to compare, and significant evaluation data can be obtained. If quantitative data areneeded, user behavior not obtainable from service
logs can be understood from performance measurements. Examples of specific measurements are as
follows.
•	Effect: Achievement rate (task completion rate)•	Efficiency: Work time or numbers of errors, help
requests, steps, etc.
•	Satisfaction: Subjective evaluation of difficulty,
comprehensibility, ease of training, consistency,
and other factors
3. Points for improving evaluation quality(1) Thorough preparation
Preparation before evaluation may be the mostimportant step. Before planning an evaluation, thefollowing should be reconfirmed within the designteam and summarized in a document.
•	Applicable service: Product name, features,main functions, related tasks, enterprise strategy,
development state, user environment•	Relevant users: User class, basic attributes andcharacteristics, skill characteristics, usage objectives(2) Appropriate restraint
What can and must be evaluated during each designphase is fixed. It is important not to rush ahead, andto carefully follow the plan. Missing things that need
to be evaluated can be a problem, but it is even moredangerous to obtain reference data for things that cannot be evaluated. This is because there is a danger thatreferring to inaccurate data can have more influence
on decisions than expected. If relevant evaluation
results cannot be obtained, it is better not to do theevaluation.
(3) Gathering suitable participants
It is important to gather participants that are similar
to the anticipated users, but it is even more importantto gather users that will be interested in the service.
Users with different motivations will not only havedifferent levels of acceptance of and satisfaction withthe service, but they will also have different levels of
acceptance regarding usability. Those that are interested, even if their literacy is low, will not consider
small difficulties troublesome, and they will learn
quickly. Suitable conditions and questions (if recruiting
NTT Technical Review

Feature Articles

through the web) must be set when recruiting participants to understand the motivations of participants
accurately beforehand.
4. Future prospects
Recently, the number of our projects has been
increasing, and they range from requests for evaluation only to requests for total support from prototyping through to evaluation. A feature of NTT Advanced

Technology is that we have teams for both development (web, mobile, IoT (Internet of Things), etc.) andUX design. They communicate easily, so they canmove quickly from rough prototyping to producing
real prototypes. We will continue to utilize thisstrength to meet the demands of customers and toprovide higher quality development and evaluation,
and we will use our entire capacity to support service
design for our customers.

Xinlei ChenUX Consultant, NTT Advanced Technology.
She received an M.E. from the Department ofInformation Management Science at the Graduate School of Information Systems, the University of Electro-Communications, Tokyo, in 2002.
She joined NTT Advanced Technology in 2002
and has been working as a UX consultant. She isalso a Certified Human Centered Design Professional.

Vol. 13 No. 12 Dec. 2015



Feature Articles: Service Design for Attractive Services
and Trends in Design Thinking

Methodology for Creating Attractive
Services
Momoko Nakatani, Kenta Amano, Hikari Fukuoka,
Nana Hamaguchi, and Chinatsu Saito
Abstract

NTT IT Corporation provides consulting services to help companies create services that will appeal
to their customers. In this article, we introduce some of the methodologies employed by the ICT Design
department to design services that capture people’s interest. We also discuss points that need to be considered with respect to user interviews and our interpretations of them as well as the generation andevaluation of ideas.
Keywords: service design, human-centered design, user experience

1. Introduction
An important issue for many companies is the creation of services that appeal to users. Human-centered design and user experience (UX) design represent ways of thinking that are known to be effectivein this regard. Under these approaches, a service’s
users are carefully studied, ideas are brainstormed
based on the users’ needs, prototypes are rapidly
developed, and then the prototypes are repeatedly
evaluated and improved. There are many systematized service development methodologies such as
this one. However, to actually implement a service
that will impress and appeal to people, it is not sufficient to simply apply a methodology as-is. Methods
must be appropriately selected and customized—and
their designs polished—according to each user’s circumstances, reactions, and goals at any particular
moment.
The employees in NTT’s laboratories have accumulated many years of practical expertise along withexperience researching and developing these types ofmethodologies. The ICT Design department of NTT
IT Corporation (NTT-IT) specializes in providing
consulting services that apply these methodologies
and expertise. This is all connected to the creation of
information and communication technology (ICT)

services that appeal to people by using the appropriate methodology for any given context. In this article,
we introduce several methodologies that have been
put into practice by NTT-IT.
2. Understanding the target user
We conduct ethnographic investigations to gain adeeper understanding of the target users. In theseinvestigations, we visit the users, collect data, andanalyze on-site user behavior (eg., at home, at work);
we also conduct interviews to reveal aspects of theunconscious mind. Although these investigations are
said to be an easy way to understand users, we needto interpret and analyze minute details in our data to
avoid being deceived by superficial remarks. For
example, we use the Modified Grounded Theory
Approach (M-GTA), in which everything the subject
says is labeled and structured in detail. We used thissame approach in the past to create a mental model(called NARUTO) of the users of ICT services, as
shown in Fig. 1. The base of this model shows anegative psychological feedback loop in which limited use of the ICT services causes learning to stagnate; this prevents users from feeling confident,
which in turn reduces their interest in the services andtherefore limits their use of the service.
NTT Technical Review

Feature Articles

Expansion ofscope of usage
Assistancefrom others

Positive intention touse services

Improvement ofknowledge/skills

Improvement ofself-efficacy
Opportunity touse/learn about
the services

Information about
the effectiveness/
attractivenessStagnation of usage
Lack ofknowledge/skills
Reluctance touse services

Success/failure
experience

Absence ofself-efficacy

Fig. 1. NARUTO mental model for users of ICT services.

There are four elements that break the negative
cycle and hold the key to encouraging positive feedback loops toward the top of the model: assistancefrom others, opportunity to use/learn about the services, successful experiences, and information about
the effectiveness/attractiveness. If we can find theessential causes influencing people’s actions andthoughts in this way, we can also apply this knowledge when developing services. When we actuallydesigned support services based on this model andprovided them to Internet-averse senior citizens, weobserved some examples of surprisingly positivechange.
It takes a long time to build a model like this fromscratch. As a result, there are also many cases inwhich we proceed to brainstorm ideas and search forsolutions without spending much time on conducting
investigations and analysis; for example, we may
make use of existing models and user data that wehave already collected. By emphasizing the processof evaluating designs we have created in cases likethese, we can understand the users’ needs through theentire service development process and thus refine
our services.
3. Coming up with ideas
Appealing services are not uniquely guided byusers’ needs. We occasionally need innovative ideas
in order to take mental leaps forward. The ICT design
game and cross-boundary methodology are effective
Vol. 13 No. 12 Dec. 2015

techniques for coming up with ideas that start withthe users’ needs.
3.1 ICT design game
The ICT design game is an application of Scandinavian spatial design methods to ICT services. The
game is a type of forced association technique thatpushes ideas for services in a particular direction,
forcing business areas and technology to be associated with the needs of a service’s users (as identified
through user investigations). For example, consider
the price sensitivity of people who would like to exercise more but cannot justify the expense of joining a
gym because they do not believe they would continue
exercising for very long. By associating this needwith medical insurance (a business area), we cancome up with ideas such as a service that reduces theprice of insurance as people get healthier throughexercise.
The ICT design game assumes that several people
will brainstorm ideas together and is also characterized by the inclusion of techniques for bringing out
each participant’s creativity. Specifically, the gameintroduces a variety of rules; for example, each person speaks in order, building upon the idea proposedby the previous speaker.
The rules are intended to leverage the diversity
present among several participants. Left to thinkalone, individuals often follow familiar trains ofthought and thus have a tendency to get stuck on solutions that represent local optimums. By providingFeature Articles

mechanisms that allow people to apply and share
their own cognitive strengths, we combine a varietyof perspectives to increase the probability of coming
up with good solutions. Even people who are not used
to contributing ideas can participate in this method
and we have found that this method can produce awider variety of concrete ideas than unstructured
brainstorming.
3.2 Cross-boundary methodology
NTT-IT has developed the cross-boundary methodology to push the boundaries of diversity even further.
Specifically, by choosing people with a variety ofbackgrounds and values to come up with ideas, weare creating diversity amongst the group’s members
themselves. For example, if we wanted to create a
new service to help people enjoy traveling and commuting, we would hold a session in which a variety ofpeople could exchange ideas—from train fanatics tonight club workers who regularly use taxis to celebrities who must exercise caution when moving about inpublic.
We have often noticed that project members whodevelop a service have strong feelings about the project. Although these feelings can drive the project
forward, they sometimes result in strong assumptions
that make it difficult to get past preconceived notions.
We can think outside the box and increase the probability of coming up with innovative ideas by inviting
people whose cultures and value systems significantly differ from those of the project members.
4. Evaluating service ideas
Once a service’s design has solidified to someextent, we enter the next phase of our methodology:
quickly visualizing our ideas so that we can evaluate
and improve upon them. To get users to ultimately
accept our service, we need to determine which partof the service appeals to them and verify that they are
not encountering any obstacles that prevent themfrom using it; it is important to then steadily improve
the service as necessary. Therefore, NTT-IT is particularly focused on the evaluation step.
Although evaluation methods that collect feedback
directly from the actual (target) users through interviews appear quite simple at first glance, it is actuallyrather difficult to correctly intuit users’ opinions andmake improvements based on them. This is becauseeven if we present the same service to the same user
on different occasions, that person’s reactions willvary based on how questions are asked, how the per

son is feeling, and many other possible factors. For
example, during a past interview to evaluate thedesign of an event recommendation service—specifically, whether people would like to use it—wereceived the following response from a (male) interviewee.
“Sounds good to me. I’ve become more and morereluctant to look for [events], so—for example—if I
have a chance, I could look at my choices and say ‘Iguess I’ll try hiking today.’”
However, when we conducted the same interview
with the same person five months later, we received
the following negative response.
“This app is hard to use, the things I have to tap arereally small, my eyes get tired […] and it’s just a bitof a pain, you know?”
As this anecdote shows, it is dangerous to evaluate
a service at the planning stage by simply taking what
users say at face value; figuring out how to interpretthese responses is important. Specifically, we focus
our attention on listening to what users are evaluating
negatively—and why—to find hints for areas of
improvement. In the first of the two sample responses
given above, the user was focusing on the conceptbehind the service itself; in the second sample
response, on the other hand, the user was focusing on
actual interactions with the service. In other words, if
reactions to the concept behind the service itself arepositive, it is possible that people will actually use theservice. However, given that assumption, we need tosimplify and remove any friction that may exist inuser interactions.
To accurately collect user feedback in the ICT
Design department, we developed a three-step receptivity evaluation method and are finding ways toimprove the process of asking questions itself. Under
this method, we ask questions to identify people’s
needs and to clarify how they will use the service
before we ask for any opinions on the concept behindthe service. We cannot understand why we havereceived a negative reaction to a service’s concept
until we have first determined whether anyone neededthat service in the first place and whether that service
was suited to the context in which it would be used.
Through this process of improving how we ask questions and collecting accurate evaluation results, we
can get many useful hints for improving services.
5. Future work
In this article, we introduced some of our methodologies for creating attractive services. There are
NTT Technical Review

Feature Articles

various other techniques and expertise applicable todesigning services that appeal to users; by ascertaining users’ circumstances and reactions along withmarket conditions and company strategies, we canperfect our designs through repeated trial and error.
The ICT Design department comprises a multidisciplinary team of experienced UX designers and engi-

Momoko Nakatani

neers as well as researchers knowledgeable of humancharacteristics. The department is supported by the
combination of each person’s domain knowledge
with a variety of techniques for applying that knowledge. We plan to continue to develop and deploy
services that both appeal to and are enjoyed by as
many people as possible.

Nana Hamaguchi

Senior Researcher/Senior UX Strategist, Heart
Touching ICT Design Department, NTT IT Corporation.
She received her M.E. and Ph.D. in engineering from Waseda University, Tokyo, in 2003 and2013. She joined NTT Service Evolution Laboratories in 2003. She has been researching human
computer interaction, human-centered design,
manual design, human modeling, usability, andqualitative studies. She moved to NTT-IT todevelop the UX business in 2014 and works as a
UX consultant. She is a member of the Association for Computing Machinery (ACM), and the
Human Interface Society.

UX Designer/Researcher, Heart Touching ICT
Design Department, NTT IT Corporation.
She received her B.E. and M.E. from Osaka
University in 2009 and 2011. She worked at NTT
Service Evolution Laboratories from 2011 to2015. Her research focuses on service design
based on ethnography. She is now working at
NTT-IT as a UX designer.

Kenta Amano

Chinatsu Saito

Researcher/Engineer, Heart Touching ICT
Design Department, NTT IT Corporation.
He received a B.E. from Shibaura Institute ofTechnology, Tokyo, in 2002 and an M.E. fromJapan Advanced Institute of Science and Technology, Kanazawa, in 2004. He has been working
at NTT-IT since 2004 and specializes in Japanese
text processing. He was selected as a starting
member of the UX business in 2014 and is now
working as a UX consultant.

Researcher, Heart Touching ICT Design
Department, NTT IT Corporation.
She received her B.E. and M.E. from Tamagawa University, Tokyo, in 2011 and 2013. She has
been with NTT-IT since 2013 and has been aconsultant in the field of human-centered design
since 2014.

Hikari Fukuoka

Design Consultant/Catalyst, Heart Touching
ICT Design Department, NTT IT Corporation.
She received a Bachelor of Human Sciencesfrom Waseda University, Tokyo, in 2004, and an
Industrial Design degree from Musashino Art
University, Tokyo, in 2007. She specializes in
UX design, UI design, usability design, graphic
design, movie creation, and design education.
She joined NTT-IT in 2015 as a design consultant/catalyst focusing on design and human factors.

Vol. 13 No. 12 Dec. 2015



Feature Articles: Service Design for Attractive Services
and Trends in Design Thinking

Training Initiatives for UX Designers
Jiji Kim, Hana Tsuchiya, Kazunori Yamada,
Yoshie Sagata, Nobuhiro Kiyama, and Kazuo Yoshimi
Abstract

AT NTT Communications, we are actively training user experience (UX) designers. The first step inthis process involves examining the existing skills of UX designers within the company. Another key step
is applying the CHEF model we developed for organizing the design processes, skillsets, and mindsets
required for UX design work within the company. In this article, we present the results of these initiatives
and our plans for future work.
Keywords: UX design, human resources, human-centered design

1. Introduction
In recent years, the diversification of customer
needs and the environmental changes surrounding
companies have been accompanied by a need forcompanies to shift from simply providing products
and features (goods-dominant logic) to providing
services and experiences (service-dominant logic). In
light of these changes, it has become important tounderstand each customer’s context (e.g., environment and emotional state) and then to think aboutboth how to provide value to that customer and what
type of value the customer will perceive from theservice. Furthermore, it has become important forservice providers to design optimal user experiencesby empathizing with, analyzing, and understanding
their users rather than relying on their own theories
alone.
Our Strategic UX Design Unit in NTT Communications’ Technical Development Department wasestablished in October 2011 with the goal of incorporating user experience (UX) design into businessactivities, improving existing projects, and accelerating the creation of projects that will become new
profit centers, all while increasing the number of UX
designers throughout the company.
We are primarily engaged in three types of activities: supporting UX improvements in the services weprovide (application), actively learning how to
become exceptional UX designers (training), and

presenting what we have learned through study andpractice within our company while also promoting
the importance of UX designers internally (osmosis).
2. Background
The UX designer training initiatives introduced inthis article are rooted in an awareness of two problems. The first problem is that to achieve businessresults in the short term, practical activities become
the center of attention, and human resource development (e.g., the systemization and assessment of UX
design-related skills as well as the examination oftraining guidelines among members) cannot be tended to. As a result, new members cannot be trained
effectively.
The second problem is that, institutionally, there are
no designer positions at NTT Communications. This
makes it difficult to improve UX design skills andaccumulate expertise.
3. Overview of activities
Knowing all this, we set out to bring visibility to
UX design skills and techniques and to build guidelines for training UX designers. Our first step was todefine the design process that would guide UX
designers—along with the requisite skillset andmindset—from what we learned by conducting
NTT Technical Review

Feature Articles

Fig. 1. Constructing the design process matrix.

research in various areas so that we could determine
what kind of UX designers were needed at NTT
Communications. We then specified how UX designer positions differed from other types of positions(e.g., management, engineering, and service planning) and also established the UX designer levels
needed for different roles and locations in the company’s organizational structure.
4. CHEF model
We established the CHEF model to describe theskillset, mindset, and design processes required of
UX designers.
Why call the model CHEF? First, we gained adeeper understanding of the act of design by collecting existing design processes, with an emphasis ondesk research. We thought of design as the creation of
new ideas from observing the natural state ofthings—without being prejudiced by existing concepts and viewpoints—and then, based on what was
discovered through observation, perceiving the subject anew. To debate the guiding principles for UX
design, we then created a two-dimensional matrix
with contrasting concepts at each edge: Radical vs.
Emotional and Progressive vs. Traditional. Using thismatrix, we discussed the areas of activity that areconsidered to be necessary for UX designers. Throughbrainstorming sessions based on our image of thewords that correspond to each of these areas, we created and named 24 new UX design processes, which
we applied to the matrix (Fig. 1).
After filling in the matrix, we discussed and voted
Vol. 13 No. 12 Dec. 2015

on each of the ideas to arrive at the idea for the CHEF
model, which uses creative cuisine as a metaphor for
UX design.
We wanted to stress that design processes should beincorporated into a company’s business processes
and also that business results should be linked to theoutcomes of UX design. To further raise awareness of
this, we emphasized Tasting (inspection, prototyping)and Feedback (evaluation, reporting) as parts of ourmodel. We ultimately split our design process into
five steps: Ingredients (Insight), Recipe (Ideation),
Cooking (Implementation), Tasting (Test), andReview (Feedback), as shown in Fig. 2. In the Ingredients (Insight) step, we collect ingredients and gaina deep understanding of each one. This is the processof deeply understanding customers, their environment, and their circumstances to come up with new
insights. In the Recipe (Ideation) step, we define
problems and come up with ideas based on theinsights we obtained so we can create new recipes
inspired by our ingredients. In the Cooking (Implementation) step, we quickly give our ideas shape as achef would in the kitchen. In the Tasting (Test) step,
we examine the implementation of our ideas and collect feedback to determine whether our ideas taste thesame as we expected them to and whether people are
happy to eat them. Finally, in the Review (Feedback)step, we organize our feedback so we can use it forour next challenge. Note that we intend for thesesteps (processes) to be repeated over and over toimprove the accuracy of their results; they are notcomplete after they have been followed only once.

Feature Articles

Ingredients

RecipeCooking

Tasting

Review

Fig. 2. CHEF model.

Table 1. UX designer levels.
LevelsDefinitions

JuniorA designer who precisely understands all of the processes, tools, and skills
related to UX design and handles the actual work.

SeniorA designer who has sufficient general UX design experience to be qualified
to manage projects. Senior designers also plan the actual work and mentor
junior designers.

Lead

A designer who makes decisions and takes responsibility for the design
process. Lead designers are responsible for assigning and hiring teammembers and serve as mentors to junior and senior designers. Leaddesigners may also have received design-related awards outside thecompany.

5. UX designer levels

6. Skillsets

Before establishing detailed skillsets and mindsets,
we defined three levels of designers—Junior, Senior,and Lead—to support structured learning, the transmission of knowledge, and business applications
within our company (as indicated in Table 1). The
levels are determined by UX design proficiency, project experience, and external assessment; we expect
each of these factors to be used as a guideline whileconsidering a combination of team composition andmentoring, which forms the basis for training.

Next, we organized the skillsets (ability to understand the essence of a variety of methods and appropriately use them) used in each step of our design
process, based on current experience (methods
employed and results obtained in a project) andknowledge of known methods gleaned through desk
research (Fig. 3).
We assume that several UX designers will work
together as a team, with the senior designers deciding
and presenting the direction of the project while thejunior designers are tasked with handling more specific details.



NTT Technical Review

Feature Articles

Ingredients

RecipeResearch

Scenario design

Interviews
Online surveys
Desk research
Observation
Personas

Storyboard outlines

Storyboard details

Analysis

Concept design

Storytelling outline(user journey outline)
Touchpoint mapping
Information analysis
and integration
Extracted insights

Ideation
Touchpoint mapping
User journey outline
Blueprint outlines

Stakeholder map
Empathy map
Storytelling details(user journey details)
Touchpoint mapping
Extracted insights

Ideation
Personas
Stakeholder map
Rough sketches
Value propositions
Touchpoint mapping
User journey details
Detailed blueprints

Cooking
Scenario design

Tasting

Frontend web
development

Attractive-effort
analysis
Storyboard outlines
Copywriting
Attractive-effort analysis
Storyboard details

Testing

HTML/CSS
PHP
JQueryJavaScript

Usability testing outlines
Design of A/B testing
templates
Accessibility testing
outlines
Overview of web traffic
analysis
Usability testing
A/B testing
Accessibility testing
Web traffic analysis

Visualization
Wireframes, information architecture
Visual design
Conceptual design
Detailed requirements specifications
Directions

Review
Prototyping

Evaluation

Simple (paper) prototype outline
Video prototype outline
High-precision (digital) prototype outline

Feedback
Quantitative analysis
Interviews
Observation
Expert analysis

Simple (paper) prototype details
Video prototype details
High-precision (digital) prototype details

Senior UX designers

Junior UX designers

CSS: cascading style sheets
HTML: hypertext markup language
PHP: PHP Hypertext Preprocessor

Fig. 3. Skillsets.

Furthermore, NTT Communications does not handle all development in-house; for the most part, systems are implemented in collaboration with designers
and developers at partner companies. As a result, theCooking step of the design process defines the implementation skills sufficient to create prototypes as wellas the direction and detailed requirements specification skillsets for working with technical companies.
7. Mindset
We classified mindsets for UX designers in addition to skillsets (Fig. 4). In summarizing these mindsets, we found that a characteristic job of internal UX
designers is to cut across the structure of an organization and build consensus while empathizing with andunderstanding customers. We were conscious of
explicitly making this a smooth process. As withskillsets, we gave UX designers complementaryroles: the senior designers are responsible for theVol. 13 No. 12 Dec. 2015

team’s accomplishments, and the junior designers arein charge of more detailed work.
We largely categorized mindsets into three types:
the foundational mindset, the core mindset, and thecollaborative mindset.
The foundational mindset is indicative of a person
who is actively interested in business and technicalmatters and also takes a high-level view to plan ways
to integrate those with other fields—all with respect
to design issues.
With the core mindset, we emphasized that designers should be curious about new things and continue
challenging themselves to produce unconventional
creations in order to support design activities, using
their empathy with others as a guide. The core mindset also clearly indicates taking responsibility fortime, which is an important constraint for businesses.
Finally, we use the collaborative mindset to clearly
indicate an aptitude for creating new things while
communicating with people from other fields, otherFeature Articles

Collaborative mindset
Mediator
Bridging the gap between people• Emphasis on letting otherpeople speak• Assisting others to make theirjobs easier• A good intermediary
Core mindset

Co-creation
Collaborative creation• Fearlessness• Communication• Understanding of individual personalities• Cooperativeness• Recognition of one’s role

Professional
Project professionalism

Curiosity
Challenged to create

Empathy
Empathy and understandingof users and clients• Able to reduce waste• Efficiency• Punctuality• Accuracy• Passion• Creativity• Mind for taking on challenges• Acceptance of new challenges• Unrestricted• Mental preservation• Full of curiosity• Entrepreneurial spirit• Visualization of user expectations• Understanding of the overall UX image• Ability to meet customers’ needs• Understanding of perspective• Involvement with stakeholders• Understanding of the importance ofbrand experience• Open mind
• Empathy

Foundational mindset
Business
Integration of design
and business• Capability for structuralization

TechniqueIntegration of design
and technology• Technical skills• Interest in new things

Senior UX designers
Junior UX designers

Fig. 4. Mindsets.

departments, and other companies.
These mindsets are illustrated in Fig. 4 using a tree
metaphor. The foundational mindset is akin to the soilon which the core UX designer mindset is cultivatedlike the trunk of a tree, while the collaborative mindset for working effectively with people both insideand outside a company continues to grow and gain
attention until it sprouts branches full of leaves.
8. Future work
Through this initiative, we were able to compile thedesign processes, skillsets, mindsets, and designerhierarchy required by NTT Communications into the
CHEF model. We hope to use this as a base fromwhich to train UX designers who will improve ourservices. We are also investigating the possibility ofadding human-centered design, UX design, and otherrelated topics to external certifications (which
employees are encouraged to obtain) as well as training programs for the entire company to strengthen
their UX designer skillsets.
Furthermore, we would like to publish the skillsets,
mindsets, and design processes established here on
websites and in other information sources both insideand outside the company.

NTT Technical Review

Feature Articles

Jiji Kim

Yoshie Sagata

UX Designer, Manager, Technology Development Division, NTT Communications Corporation.
He received a Master of Design from the
Kyushu Institute of Design (merged into Kyushu
University in 2003), Fukuoka, in 2005. He joined
NTT Communications in 2005 and has been
engaged in researching and practicing UX designand human-centered design for various NTT
Communications products. He has been a Certified Human Centered Design Professional(HCD-Net) since 2013.

Usability Testing Specialist, Workshop Designer, Technology Development Division, NTT
Communications Corporation.
She received a Master of Information Sciencefrom University of Tsukuba, Ibaraki, in 1994.
She joined NTT Communications in 2013 andhas been conducting usability testing on several
web services and products of NTT Communications. She has been a Certified Human Centered
Design Professional (HCD-Net) since 2014.

Hana Tsuchiya

Nobuhiro Kiyama

Kazunori Yamada

Kazuo Yoshimi

Manager, Technology Development Division,
NTT Communications Corporation.
She received a Master of Media and Governance from Keio University, Kanagawa, in 1997.
She joined NTT in 1997 and has been engaged inresearch and development of web-based services.

UX Designer, Technology Development Division, NTT Communications Corporation.
He received an M.E. from Keio University,
Kanagawa, in 2007. He joined NTT Communications in 2014 and has been engaged in researching and practicing UX design and human-centered design for various NTT Communications
products.

Vol. 13 No. 12 Dec. 2015

Manager, Technology Development Division,
NTT Communications Corporation.
He completed the Master Program of Innovation for Design and Engineering from theAdvanced Institute of Industrial Technology,
Tokyo, in 2015. Since joining NTT Communications, he has been researching and practicing UXdesign and human-centered design for various
NTT Communications products. He has been a
Certified Human Centered Design Professional(HCD-Net) since 2015.

Senior Manager, Technology Development
Division, NTT Communications Corporation.
He received a B.E. in electrical and electronicengineering from Sophia University, Tokyo, in
1989. He joined NTT Communications in 1989
and has been working on improving the UX ofvarious businesses.

Feature Articles: Service Design for Attractive Services
and Trends in Design Thinking

Initiatives Related to the Creation of
New NTT DATA Services
Kyoichi Kadoya
Abstract

At NTT DATA, we do not limit ourselves to developing systems in response to RFPs (requests for
proposals); we endeavor to create and commercialize innovative new services together with both clientand partner companies in short periods of time. However, thinking about this work and proceeding with
it involve a very different approach than that used in system development projects, and therefore, several departments within the company have been moving forward with a variety of initiatives to facilitate
the process. This article introduces the initiatives related to the creation of new services at NTT DATA.
Keywords: service design, prototyping, co-creation

1. Introduction
Smartphones, big data, and other recent technological innovations have brought enormous changes
to our lives. The providers of these services—NTT
DATA’s customers—need to accurately ascertain
their end users’ needs and efficiently provide services.
Under these circumstances, information technology(IT) vendors such as us need to not only obtain andimplement RFPs (requests for proposals); we alsoneed to co-create businesses and services themselveswith our customers and then engage in open innovation through the adoption of existing solutions andtechnology and the rapid implementation thereof. We
need to make these service initiatives part of the value
provided by NTT DATA.
2. Internal company initiatives related todeveloping new businesses and services
Initiatives for developing new services have been
deployed in a variety of departments at NTT DATA.
Six of these initiatives are introduced here (Fig. 1):
1)	Vision-oriented methods: One of the frameworks for organizing thoughts related to new
business development2)	Human-centered design process: A process forhoning in on users’ subconscious needs toimplement experiences that can satisfy them3)	Service prototyping: A technique that gives adiverse team a common language for developing new services4)	Co-creation workshops: A technique for producing ideas for new services during shortworkshops5)	INFORIUM Toyosu Innovation Center: A
venue for the co-creation of new services withclients6)	Open Innovation Forum—From the Toyosu
Port: A venue for new services emerging
through open innovation
2.1 Vision-oriented methods
NTT DATA maintains two types of methods fordeveloping new services. The first is the vision-oriented method (Fig. 2), which involves searching forbusiness opportunities by breaking large problems
into smaller ones. This method adopts a future-oriented approach and techniques for thinking freely; asa result, mental barriers can be torn down in order tocreate fresh business proposals that have not been
seen before. Also, the goals to be achieved (thevision) and the business opportunities for those goals(the actions) are each split into two levels. This makes
it easy to come up with expansive business plans andis particularly suitable for creating businesses thatNTT Technical Review

Feature Articles

Frameworks
Vision-oriented
methods

Human-centered
design processes

Service
prototyping

Co-creation
workshops

INFORIUM Toyosu
Innovation Center

Open Innovation Forum(From the Toyosu Port)

Methods

VenuesFig. 1. Six initiatives.

Frameworks to use

As isCurrent wall

Current
businesses

Create businessproposals by following
the steps of afuture-oriented
approach.

Conceive business proposals
even more expansive thancurrent businesses.

Actions(business opportunities)

Establish a vision by
thinking freely.

When structured

To be

VisionVision(goal that shouldbe achieved)

Methods for thinking about emergent business activities

LV1

LV2

LV3

LV4

Fig. 2. Vision-oriented method.

address societal problems and also for creating infrastructure services.
The second method for developing new services isthe user-oriented method. This is based on a humancentered design process, as described below.

Vol. 13 No. 12 Dec. 2015

2.2 Human-centered design process
With the diversification of smartphones, tablets,and other consumer devices, we need to be consciousof the many different kinds of end users, including theelderly and technical neophytes. In 2000, NTT DATA
established a dedicated IT accessibility team. Startingin 2009, usability considerations were also taken intoFeature Articles.

rd

Human Resources
Department

Emotionil

Iw

Excavating human resources in a global company

Shiho Harada

FlowProfileICT skills /knowledge

Goal

To create a user-friendly portal site for persons employedoverseas.

I’m

r

to

k!

or

w

So

m

do

il

m

cu

y

an

ng
e.
y .
ki
k m
.
rs
m is
ec
k t th ler ith
ro
ne
ch
er
as u e c w
do
y
r d
o bo
ed s.
is
h
an ut! ve t r a sto tategis rorm o a rio
n
i
i
e
r
n
i r
r
e
nd
If re
So am
I h upeTh ot i
fo
Se
c
s
g

y…

ad

te

ts

pu

n
ti

s

Ju

Operation

AcquireDocument
new item. check

Break

Push
check
button.

Checkmanual.

Input

Check withsupervisor.

Checkscreen.

Send

Close

Break

Call

Interview &observation
results(majorelements)(a) Persona example.

Common item

Forward

Individual item

Purpose of using intra-office system
To implement educational programs for persons
employed outside Japan.

Accomplished in PC operation;
has some knowledge onbuilding websites.

Start aterminal.

Activity

29 / female
Occupation / Profession

y

d
ea

Preparation

Assigned to the human resources department three years
ago and now engaged in overseas recruitment andeducation, primarily in Asian countries.

Hired by a major electronics manufacturer in
2007; has been involved in overseas
recruitment and education for the past two
years. Received a B.S. from Waseda
University.

ha

Advanced
operator B

Beginning
operator A

Assumedpersona.

.

Motivation

Building human networking with people overseas

Age / Sex

k

or

lw

s…

t
en

(b) Journey map

Fig. 3. Example of user modeling in human-centered design process.

account, user interface policies were created to support proposals, screen design documents werereviewed, usability evaluations were conducted, andother similar efforts were implemented. These werelater expanded to cover user experience design as
well, which involved focusing on users’ actual subconscious needs to provide experiences that can satisfy them through systems. User studies, user modeling, for example, personas (Fig. 3(a)) and journeymaps (Fig. 3(b)), prototype construction, and evaluation processes are conducted to place people (users)
front and center.
2.3 Service prototyping
A wide variety of people are involved in developing
new services, from client and partner companies to
NTT DATA’s development and marketing teams. As
the scale of a project grows, so too does its complexity. In other words, project members and teams withdiffering backgrounds share an image of the user
experience and the concept for new services, causing
different opinions and arguments to compete witheach other. It is not uncommon for project memberswith different positions and roles to think that they
are saying the same thing to each other when in actuality the things they imagine differ. A common language is therefore necessary to express concepts, user
experiences, and other abstract ideas as concretely as
possible.
For this reason, the Technical Development Depart

ment’s Service Innovation Center has proposed theservice prototyping method, in which services are
expressed in four stages: concept, scenarios, architecture, and touchpoints. Together, these are called a
prototype and are defined as part of the common language for service development projects.
(1) Concept
The concept for a new service—especially in theearly stages of considering it—is very abstract anddifficult to explain to others. We define a concept
prototype to express a service’s essential value proposition in concrete terms (Fig. 4).
(2) Scenarios
What experiences will end users have as a result of
a new service? What latent needs will the service
satisfy? How will the service provider communicate
with the end users? These questions, along with otheruser actions and user experience flows, are often represented via four-panel comics and other prototypes
called user scenarios.
(3) Architecture
Architecture prototypes are extremely importantbecause newly devised services need to be implemented as IT systems and human processes. We
define the flow of the end user experience as well as
the technological and non-technological features
implementing it; we also provide detailed definitionsof a wide variety of workflows, touchpoints, and theway in which features are structured, covering a wide
variety of situations from the initial use to continued
NTT Technical Review

Feature Articles

Fig. 4. Concept prototypes.

Free trial membership to formal membership
ScenesGather young
people andhold abriefing for
the TED talk.

Action(player A)

Receive
invitation for
TED inhis/her office.

Confirm thepresentersand make areservation.

Go topresentationhall.

······················································································································································································

Find out
there is afree trial
membership.

·······

Action(player B)

Listen to thebriefing for
the TED talk.

Submitentry form
for TED talk.

·······

Humanprocess(front desk)

Organizebriefing atuniversities
and publichalls.

Receiveentry form.

····························
Humanprocess(backend)

Inform thedesiredorganizations.

·······Createwebsite forpresenters’
list andreservation.

Send
invitation tocorporations.

ITsystem················································································································*TED is a registered trademark of TED Conferences LLC.

Fig. 5. Service architecture prototypes.

use of the service (Fig. 5).

2.4 Co-creation workshops
We promote ideas related to our clients’ industries

Vol. 13 No. 12 Dec. 2015



Feature Articles

Fig. 6. INFORIUM Toyosu Innovation Center and co-creation workshops.

and the future of their businesses to discover clues
relevant to new services. When members of the business and research and development departments at
both our and our clients’ companies gather together,
they investigate the essential issues that arise fromtheir discussions to think through the clients’ values
and paint an image of the future. A single person only
has a limited capacity for coming up with ideas, but adiverse group of people can motivate each other toproduce new ideas more easily. The Technical Development Department runs two types of workshops(Fig. 6) that are inspired by future trends in our information society and the technology that supports itthat have been pointed out in the NTT DATA Technology Foresight report.
The first workshop focuses on expressing ideas andemploys forced creative thinking techniques. Scenesof a service in use are combined with technology tocome up with new ideas that answer the question ofwhat would happen if the latest technology was used
for existing work and services. The second workshop
involves examining medium- and long-term policies
and paints a picture of what our company should be
like 10 years hence. By predicting how trends in technology and our information society will change theworld 10 years in the future, we speculate on how theindustry and our own business will be affected. We
also examine what our future course should be,
including what actions we will need to take to getover these expected changes and continue growing.
All of our workshops entail a combination of individual and group work.
2.5 INFORIUM Toyosu Innovation Center
The venue for the co-creation workshops is also
important. It is difficult to effectively disseminateideas in an ordinary conference room. At the INFORIUM, which is run by the Public Relations Department, visitors can at any time readily see creative
content concerning the future as well as demonstrations of the latest technology that is connected to the
future painted by NTT DATA Technology Foresight.
There is also an open area where visitors can watch avideo of NTT DATA’s vision for the future, an exhibition area where visitors can actually try out the latest
technology that NTT DATA has been working on,
and a workshop area that functions as a space forencouraging co-creation with clients via co-creation
workshops and individual informational seminars for
NTT DATA Technology Foresight, which is organized by the Technical Development Department.
2.6 O pen Innovation Forum: From the Toyosu
PortThis open innovation forum is an attempt to create
an emergent business lab for open innovation.
Because it takes a long time for a company to commercialize an idea if it develops new services entirely
in-house, the goal of the open innovation forum is toimplement innovative new services in a short periodof time by combining new technologies and adding
ideas from outside companies as well. We combine
our core services and solutions with those of startups
that have new technologies and services in order toprovide new value to client companies. This forum isnamed From the Toyosu Port and was started in September 2014; regular meetings are held once a month[1] (Fig. 7).
In accordance with the theme of each meeting, several startup companies give presentations and conduct panel discussions with members of our relevantbusiness departments. These meetings are held in
NTT Technical Review

Feature Articles

Advanced researchand case studies(startups)

Client (enterprise)companies

Need to add value
and commercialize
quicklyEnterprise and startup
companies are matchedthrough open innovation.

Few meetings withpotential allies andlittle businessdevelopment

New services emerge and accelerate commercialization.

Fig. 7. Goals of the Open Innovation Forum “From the Toyosu Port.”

front of our own group members and people from ourclient companies. Social gatherings also serve as anopportunity to exchange business cards, have active
discussions, and participate in networking devoted tothe development of new services; this is all linked tobusinesses being matched with each other. Recently,
we have gone one step further by holding open innovation business contests [2] and developing our initiatives involving support services called digital corporate accelerator programs to support our clients’ open
innovation efforts.

multiple departments for emergent new services. We
hope that exchanging the actual results of these
activities will lead to the establishment of standard
methods for service design at NTT DATA in the
future as we strive to make service designers as common as software engineers.
References[1][2]

Website of Open Innovation Forum “From the Toyosu Port” (in Japanese), http://info.jp.nttdata.com/minato/index.html
Website of open innovation business contests (in Japanese),
http://info.jp.nttdata.com/minato/contest.html

3. Future work
NTT DATA is promoting several initiatives acrossKyoichi Kadoya

Manager, Open Innovation Business Development Office, Innovation Promotion Department,
NTT DATA Corporation.
He received a B.E. in system engineering fromMusashi Institute of Technology (now Tokyo
City University) in 1988. Since joining NTT in
1988, his responsibilities have ranged fromdeveloping optical character recognition (OCR)
technology and devices to planning electroniccommerce services. He held a management position in technology development and has also
been involved in user experience and behavior
observation, design thinking based on requirement development activities, and research anddevelopment of IT-ROI (return on investment)
maximization.

Vol. 13 No. 12 Dec. 2015

Regular Articles

Recent Activities Involving
OpenStack Swift
Kota Tsuyuzaki and Masahiro Shiraishi
Abstract

OpenStack Swift is popular open source software used to build very large-scale storage systems.
OpenStack Swift was originally released by Rackspace, and it has been developed with community
effort over the last five years by developers from all over the world. The OpenStack Swift community
recently introduced some major features such as global cluster management and erasure code capability.
NTT has also contributed to the OpenStack Swift community. In addition, NTT developed a proprietary
secret sharing engine called Super High-speed Secret Sharing, which achieves data encryption that iscompatible with erasure code. In this article, we introduce these developments and discuss NTT’s
activities in the Swift community.
Keywords: OpenStack Swift, distributed storage system, object storage

1. Introduction
OpenStack Swift (hereinafter referred to as either
Swift or OpenStack Swift) [1] is one of the most common types of open source software (OSS) used tobuild very large-scale storage systems with Hypertext
Transfer Protocol (HTTP) based application programming interfaces (APIs). OpenStack Swift was
originally released by Rackspace [2], and developers
all over the world have been collaborating on it forfive years with great community effort. OpenStack
Swift is now used in production in various ways. For
example, Rackspace and HP [3] are using OpenStack
Swift for their own public cloud storage services.
Additionally, NTT DOCOMO is using OpenStack
Swift [4] as a 7-petabyte private storage system for its
cloud mail backup system.
Swift’s key features for production use cases havethree main characteristics.
(1) HTTP based APIs
Swift supports HTTP based APIs using HTTP
verbs such as PUT, GET, and DELETE for uploading/downloading and deleting data. This way of using
the cloud storage system is an easy way to share data
among cloud systems because developers do not haveto worry about the actual data location, and they canretrieve their own data whenever they want. Furthermore, the HTTP based APIs are quite useful for handling binary large objects because in recent commonly used Internet technologies, clients such as web
browsers and smartphones transfer content via HTTP
on the Internet.
(2) High reliability
Swift has the capability to ensure that data are
stored with high reliability and to prevent significant
data loss caused by various events (e.g., disk failure).
To prevent the data loss, Swift has a consistency
engine called an object-replicator that works to find alack of data redundancy (three replicas in default) andconsistency. Then it copies valid data if some replicas
are lost or mismatched in the cluster.
Swift also has the capability to store each replica in
as unique a failure domain as possible. For example,
Swift never allows more than one replica to be placedon the same disk to prevent a failure of one device
resulting in reduced data redundancy. These mechanisms ensure that Swift has high reliability and highdurability.
(3) Scale out
An important item to consider when deploying alarge system is scalability. Swift can scale with nosingle point of failure. A typical example of a Swift
NTT Technical Review

Regular Articles

ITsystemBackup

Personalcomputers

Smartphones,
tablets

Photosvideos,imagesMusic,
personal data

(1) File operations by HTTP
(upload, download, deletion, list)

Shared files

Network

Load balancer

Supports increase inrequests

Proxy nodes

Supports increase incapacity

Storage nodes(3) Scale out(Increases number of proxy/storage nodes)(2) High reliability(Saves three copies of data automatically)
IT: information technology

Fig. 1. Example of OpenStack Swift cluster configuration.

cluster configuration is shown in Fig. 1. In this example, the system has proxy nodes that receive requests
from clients and storage nodes that actually store
data. This makes for a highly extendible cluster architecture since proxy nodes can be added if the numberof requests becomes excessive, while storage nodes
can be added if storage capacity becomes insufficient.
In addition to these characteristics, the Swift community has been working on building some major
features, and some of them were achieved in recent
releases. In this article, we introduce two of thesefeatures: global cluster management and erasure code
capability. We also describe the secret sharing engine
and how it is used with Swift. This secret sharing
Vol. 13 No. 12 Dec. 2015engine makes it possible to store data with encryption; it was developed by NTT to be compatible with
OpenStack Swift erasure code capability.
2. Global cluster management
Some companies may want to deploy OpenStack
Swift in more than one datacenter to prevent a large
data loss caused by a disaster such as an earthquake,fire, or tsunami. Our customers must also consider
their requirements for disaster recovery. However,geographically distributed clusters sometimes havephysical issues with network latency. In the worst
case, the network latency will degrade the input/output performance of the storage system.
The Swift community has been working to improveRegular Articles

Region A

Region B

Proxy nodes

Proxy nodes

Affinity: A prior to B
Writes whole
copies in local
region first

Able to retrieve fromcloser storage nodes

Affinity: B prior to A
Copies only once
asynchronously
even if region B
requires 2 copies

Storage nodes

Wide area network between
datacenters(Private network, VPN, etc.)
VPN: virtual private network

Fig. 2. Global cluster.

the inner architecture in order to reduce the effect of
network latency. This is the feature known as a global
cluster.
Swift employs the concepts of region and affinity toachieve the global cluster. A region is a domain thatdefines which datacenters the actual hard drives
belong to. Affinity is an attribute that defines the priority among regions seen by the proxy-server.
By defining these two factors, Swift can accessregions that are as local as possible. In an uploading
sequence, Swift will write all of the replicas into
unique devices in the closest region, and the replicator will then copy the replicas asynchronously tonodes in another region. In a downloading sequence,
Swift will read the object from nodes in the closest
region first. If all nodes are offline in the region, Swiftwill try to retrieve the object from another region.
For example, when we define two regions A and B
and define B prior to A by its affinity at the proxyserver in region B, Swift will try to get the object
from the devices in region B prior to region A, as
shown in Fig. 2. As described in section 1, Swiftstores three copies of replicated data in devices indomains (regions, zones, Internet protocol addresses,
and devices) that are as unique as possible so that the
global cluster mechanism efficiently retrieves datafrom the device in the closest unique domain.
Furthermore, Swift now has the ability to reduce
the number of data transfers among regions by copying the replica only once between regions. This feature was developed mainly by NTT with the Swiftcommunity.
3. Erasure code capability
Since the first major release of OpenStack Swift,
Swift has employed the replicated model to protect
stored objects with high availability and durability.
However, nowadays we need a scheme that is more
efficient than the replicated model in order to reduce
the amount of hardware (especially the number of
hard disks) and the associated costs. Erasure code isa way to reduce the volume of hardware by creating
parity fragments, which refers to smaller amounts ofredundant data than the replicated model. This
scheme uses redundant arrays of inexpensive disks
NTT Technical Review

Regular Articles

Replica

Original file

Erasure code
(ec_k=2, ec_m=1)

AAA

Original file
AAA

BBB

BBB

Proxy nodes

Erasure code engine
Erasure code engine
generates a set consistingof parts of the original fileand parities.

Stores copies ofthe file

Storage nodes
AAA

AAA

BBB

AAA

BBB

BBB

AAA

BBB

ParityFig. 3. Example of Swift erasure code for a PUT request.

(RAID).
In an erasure code scheme as shown in Fig. 3, Swiftslices the original data into “ec_k” data fragmentsthat consist of an aggregation of split original data.
Swift also creates “ec_m” parity fragments, which
are mathematically redundant data of the data fragments. In the erasure code scheme, it is possible torebuild the original data from any “ec_k” fragments
among all the fragments.
For example, we use ec_k=2 and ec_m=1 parameters for Swift erasure code; Swift will create two datafragments and one parity fragment and store a total ofthree fragments in three unique devices. When a user
requests Swift to retrieve original data, Swift respondsby rebuilding the original data from any two of thestored fragments.
For the erasure code feature, the Swift community
added a new consistency engine called object-reconstructor. It works almost the same as the object-replicator to maintain high durability of data redundancy,
but the difference is that it enables the reconstructionof a unique fragment (not a copy) for the node.
The major players in the Swift community havebeen making an effort to implement this feature forapproximately a year and a half, and it was finallypublished as a beta version in the most recent OpenStack release. We are hoping that Swift erasure code
will be ready to release as a production-ready version
Vol. 13 No. 12 Dec. 2015

with the code name Liberty in the next release.
4. Secret sharing
Solutions for security, data durability, and increasing data volume are more important than ever in theinformation technology business market, since theamount of highly confidential information will continue to grow. To manage confidential data, NTT
developed a proprietary secret sharing engine called
Super High-speed Secret Sharing (SHSS) [5] as apluggable backend for the OpenStack Swift erasurecode, and it is expected to be used in secure storage
products as the amount of confidential data increases.
The SHSS engine enables OpenStack Swift toencrypt fragments and to reconstruct the plain datafrom the encrypted fragments (Fig. 4). The reconstruction requires a number of fragments, and OpenStack Swift stores the fragments to unique disks inthe same way as erasure code. This mechanism prevents the system from reconstructing original datafrom insufficient fragments, and it reduces the risk of
information leakage when broken physical drives are
replaced by hard drive vendors.
In addition, the main advantage of SHSS is that it
has the world’s fastest fragmentation and reconstruction performance, which allows OpenStack Swift toRegular Articles

OpenStack Swift integration
Security ensured by secret sharing
Files

Fragment data

Fragmentation/
Reconstruction

Storing/Retrieving

Hard disk
vendorSafe disk
replacement

SHSS
Fragment data

World’s highest-speed
secret sharing
High-speed processing
compatible with
OpenStack Swifterasure code

Fragment data

Proxy nodes

Storage nodes* SHSS is configured in Swift as the only available erasure code engine that achieves security.

Fig. 4. Swift secret sharing.

quickly store/retrieve files. Previously, secret sharing
processing for fragmentation and reconstruction wasmuch slower than erasure code’s encoding anddecoding; therefore, it was difficult to apply secretsharing to storage systems. To improve the performance, NTT developed a new high-performance 64bit processing technique that is faster than the 8-bit
process used in previous mechanisms. This makes it
possible to increase the processing speed so that
SHSS can fragmentize and reconstruct data at about
20 Gbit/s in the case of 24 total fragments, with 20
fragments used for reconstruction.
5. Future work
For three years, NTT has been working to develop
the Swift features as described in this article. In the
future, we will primarily focus on developing two
new features for Swift.
One is a combination of global cluster and erasurecode. As explained, they both have substantial advantages. However, erasure code cannot currently beapplied for global cluster use cases because the lower
data redundancy (in particular, < two times data
redundancy) leads to the possibility of data loss if aregion goes completely offline. In addition, we
noticed from parity calculation constraints that alarge number of parity fragments (i.e., ec_m) for
increasing data redundancy reduced the PUT/GET
performance in our experiment. To achieve the benefits of both global cluster and erasure code, we are
now attempting to develop a new scheme called
global EC (erasure code) cluster, with the Swift community.
The other concept we are trying to develop is storage tiering. Automated tiering has recently become apopular feature in storage system products. It makes
it possible to connect two or more storage tiers
together that are basically different in performanceand cost. With tiering, we can use actual hardware
more efficiently according to the user’s own data
access pattern. Swift currently supports the static
deployment of certain kinds of storage definitions
called storage policies, but we are now researching a
NTT Technical Review

Regular Articles

way to dynamically place each object among the storage policies in the Swift cluster to achieve greater
efficiency.
6. Conclusion
Working with Swift software and the Swift community has improved our software development andenabled us to focus on which areas we should develop
as part of the OSS community. The Swift production
development cycles and community activities provide many opportunities for developers to contribute,and the Swift community has recently finished developing notable features such as global cluster anderasure code. We believe that working together with
the OSS community is a great way to improve our
products. To further speed up our research and devel-

Kota Tsuyuzaki

Software Engineer, NTT Software Innovation
Center.
He received an M.E. in information engineering from Waseda University, Tokyo, in 2010.
Since joining NTT in 2010, he has been engaged
in developing distributed storage systems. He has
been working on OpenStack Swift for approximately three years and has been a member of the
Swift Core Team since June 2015.

Vol. 13 No. 12 Dec. 2015

opment, we will continue to work closely with the
OSS community.
References
[1]
[2]

[3]

[4]
[5]

Website of OpenStack Swift, Documentation.
http://docs.openstack.org/developer/swift/
Website of Rackspace, Knowledge Center, Cloud Files: How to articles & other resources.
http://www.rackspace.com/knowledge_center/article/cloud-fileshow-to-articles-other-resources
HP, “Maintaining and Operating Swift at Public Cloud Scale,” OpenStack Summit, Vancouver, Canada, May 2015.
https://www.openstack.org/summit/vancouver-2015/summit-videos/presentation/maintaining-and-operating-swift-at-public-cloud-scale
NTT DATA press release issued on January 15, 2015 (in Japanese).
http://www.nttdata.com/jp/ja/news/release/2015/011500.html
NTT press release issued on May 18, 2015.
http://www.ntt.co.jp/news2015/1505e/150518a.html

Masahiro Shiraishi

Senior Research Engineer, Supervisor, NTT
Software Innovation Center.
He received an M.E. in mathematics from
Kagoshima University in 1991. He joined NTT
in 1991 and studied and developed operating
system platforms. He is currently studying distributed storage systems.

Regular Articles

Improving Inter-system Cooperationand User Convenience in Confirming
Personal Safety during Disasters
Naoto Hoshikawa, Toru Inaba, Kentaro Kichiyoshi,
and Masatsugu Ohnishi
Abstract

The need for effective ways to check on the safety of persons in times of disaster has been increasing
in recent years. Personal safety information in times of disaster has been handled separately for different
types of user terminals, different media (voice, text, etc.), and different networks. NTT Network Service
Systems Laboratories has been developing a system that integrates those separate services to work
cooperatively and to provide a unified service for simple and certain communication and confirmationof personal safety. Here, we describe the Personal Safety Confirmation System and the functions it
provides.
Keywords: safety confirmation, service providers, disaster response

1. Introduction
The major earthquake disaster that occurred in eastern Japan on March 11, 2011 greatly damaged thetelecommunication infrastructure, and a number oflessons on maintaining communication during adisaster were subsequently learned. As a result, aJapanese Ministry of Internal Affairs and Communications (MIC) study group was formed to study waysof ensuring communication during major disasters
and other emergencies. This study group investigated
how best to deal with network congestion during an
emergency, how to maintain communication when abase station or relay station is damaged, what should
be done with future network infrastructure considering experience from past disasters, how the Internet
can be used in the future, and other such issues related to ensuring communication in emergency situations [1].
In terms of confirming personal safety, those studies found that during the aftermath of the 2011 disaster, only a limited number of people in the disasterarea were easily able to use the Internet, particularlysocial media, and they were thus unable to communicate what was needed in the disaster area in a timely
and accurate fashion. That resulted in a mismatch ofwhat was provided and what was needed. Consequently, it is now necessary to work towards eliminating information disparities and raise information andcommunication technology (ICT) literacy, and todevelop terminals and services that have high usability for the elderly and others.
2. Efforts by the NTT GroupIn response to the social needs described above, wehave been working on a Personal Safety Confirmation System for all NTT Group companies. The
objective with this system is to be able to easily confirm the personal safety of others during a disaster,regardless of network, terminal, or type of media. We
are moving forward with this work guided by the following principles and objectives:1)	Achieving the capability to respond to increases
in mobile network traffic or other such changes
in network conditions
NTT Technical Review

Regular Articles

Safety Confirmation System

171 safety confirmation• Records voice messages• Replays voice messages• Converts web171
messages to speech andplays them on phone

Disaster Message Board(web171)

Disaster Message Dial
(171)

Cooperation
with 171

Sends voice data

Cooperation
with
web171

Stored voice Cooperation
messages

Stored web
messages
Voice
notification

Sends text data
Speech synthesis

Message cross-search
between providers

web171 safety confirmation• Downloads and replays
stored voice messages• Writes messages• Browses messages• Sends notification by email
to pre-registered
destination• Converts text messages
to speech and sends topre-registered
telephone destination

Cooperation with mobile providers• Mutual message search for mobile message services and web171
StoredmessagesforCompany A

StoredmessagesforCompany B

StoredmessagesforCompany C

StoredmessagesforCompany D

Fig. 1. Overview of 171 and web171 services.

2)	Achieving cooperation between multiple personal safety information systems (fixed-line
and mobile networks, voice and web services)3)	Providing services that do not require a highlevel of user ICT literacy4)	Achieving higher usability and convenience inregistering and checking information
Here, we explain the functions for message registration, replay, browsing, and search, which are thebasic functions of the Personal Safety Confirmation
System, and we describe the implementation of functions for inter-system cooperation.
3. Service overview
The Personal Safety Confirmation System is basedon the Disaster Message Dial (171) and Disaster
Message Board (web171) services provided by NTT
EAST and NTT WEST. An overview of the system ispresented in Fig. 1.
Disaster Message Dial (171) is a dial-up service
that enables users in areas affected by a disaster toregister messages over a telephone line when it is difficult to place a telephone call. The registered messages can be accessed via the Internet or over thephone. The Disaster Message Board (web171) service makes it possible to register and browse registered messages via the Internet. Interworking between
Vol. 13 No. 12 Dec. 2015

the 171 and web171 services enables mutual confirmation of messages. A service for sending email andtelephone notifications to pre-registered destinations
is also provided. Additionally, cooperation with various mobile providers enables mutual message searchfunctions with the systems they provide.
4. System overview
The operating states and definitions of this systemare explained in Table 1. Voice functions are provided
by the 171 service, and web functions are provided by
the web171 service. Message registration, replay, andbrowsing services are suspended during normal times
when no disaster has occurred, although user information can be registered, updated, and deleted using
the web functions. When the system changes to theoperating state because a disaster has occurred, message registration, replay, and browsing are enabled.
An overview of the system and its functions arepresented in Fig. 2. The system comprises application
functions, platform functions, reference functions,and common functions.
(1) Application functions
Two functions are possible: voice functions andweb functions.
The voice functions implement registration andreplay by 171 users ((a) in Fig. 2). When there is aRegular Articles

Table 1. Operating states of the Personal Safety Confirmation System.
Operating states

Definition

FunctionsOperations for user access

Voice functions

Messages cannot be registered or played back.

Web functions

Messages cannot be registered or browsed.
Only user information registration, updating,and deletion are possible.

Voice functions

Message registration and replay are enabled.

Web functions

Message registration and browsing and user
information registration, updating, and deletionare enabled.

Normal times/situations (whenno disaster has occurred.)

Suspended

The 171 and web171 services
are being provided because adisaster has occurred or
because it is the trial day set by
NTT to allow users to experience
how the services work.

Operating(a) Registration and playback by 171 service users(e) Voice notification

NGN

PSTN

Media server

SNI
Common functions (load balancing etc.)
Platform functions
Reference functions
Application functions
SDP
AP server (voice)(MS)

AP server (voice)

AP server (web)

SDP
(PF)

DB server (voice)

SDP
(DB)

AP server (web)

SDP
(TTS)

DB server (web)Mail server

Web server

DB server (voice) DB server (web)TTS server(voice)Web server

Common functions (load balancing etc.)(d) Mobile provider searchInternet(b) Registration and browsing
by web171 service users(c) Mail notification

Emergency message
boards of mobile
providers

PSTN: public switched telephone network
SNI: application server-network interface

Fig. 2. Functions and system overview.

user request for message registration in the Next Generation Network (NGN), the media servers perform
call termination and conversion of voice message
content to voice files, the application servers (voice)send and receive the voice files, and the database

servers (voice) perform database management. When
there is a user request for a message replay, the voicemessage that corresponds to the specified phone
number is played back.
The web functions implement registration and
NTT Technical Review

Regular Articles

browsing by web171 users ((b) in Fig. 2). When the
web server receives a request, the application servers(web) process the text data and the database servers(web) manage the database. When there is a user
request to browse messages, the text message that
corresponds to the specified phone number is displayed.
(2) Platform functions
The service delivery platform (SDP)*1 includes five
servers that have different roles. Upon a user request
for message registration or replay, the SDP (PF (platform)) server receives requests from the application
server (web) for media conversion, call origination,or another function, and provides additional services.
The SDP (DB (database)) server performs databasemanagement, the SDP (TTS (text to speech)) converts text to voice files, the SDP (MS (media server))plays the voice file on the user terminal, and the mailserver sends and receives email ((c) and (e) in Fig. 2).
(3) Reference functions
These functions store data on the content of thevarious application function servers and handle message search requests from mobile providers ((d) in
Fig. 2).
(4) Common functions
These functions comprise load balancers, which
distribute the load of communication over equipmentthat has a redundant configuration and other suchnetwork devices.
4.1 M
 essage information media (speech and text)
distribution and notification functions
Cross-checking of message data between the 171
and web171 services is possible. For example, thecontent registered as a voice message in the 171 service can be downloaded from web171 to a terminal asa voice file ((a) to (b) in Fig. 2). Also, the content of
web171 text messages can be converted to speech forplayback by the 171 service ((b) to (a) in Fig. 2). A
function for sending notifications by email or phone,even if the user does not access the system to checkfor messages, has also been implemented ((c) and (e)in Fig. 2).
4.2 C
 ooperation with mobile providers for text
message browsing
The web functions also work in cooperation withmobile providers. The improvement described here
makes it possible for a web171 user to check for messages registered in the system of a mobile provider((d) in Fig. 2). If there are messages that correspondto the search keywords, links to the message board ofVol. 13 No. 12 Dec. 2015

the mobile provider are displayed. When a searchrequest from a mobile provider is received, a message
search is performed using the phone number as thesearch key.
This system implements the functions describedabove to realize interworking across media and cooperation with mobile provider systems to provide users
with a unified way to check messages, which previously had to be done independently for each system.
5. Advantages of the system
5.1 System reliability(1)	Handling a heavy concentration of searchrequests from mobile providers
One problem with achieving cooperation amongproviders is handling large numbers of searchrequests (Fig. 3). In implementing this function, there
was concern that search requests from mobile providers, which have many more users than fixed-line
phones, may overwhelm the processing of message
registration and access by users of the 171 andweb171 services. We therefore divided the functions
into a) application functions for registration andsearching of safety confirmation information and b)
reference functions for information referencing andaccess between providers. Disruption can thus becontrolled, even when numerous search requests
from multiple mobile providers are received. This
separation of functions also enables flexibility in handling the addition of mobile providers and changes inservice number ranges.
(2) Site switchover
The process of switching from an active site to a
standby site and switching back when a major disaster has occurred is shown in Fig. 4. When the service
is operating, the system settings, user information,and other data are stored in one of two types of databases according to the frequency of updating. Data
that are updated with high frequency are synchronized between sites as needed; data that are updatedwith low frequency are synchronized periodically. As
a result, site switchover can be done quickly. Also, atechnique for incremental synchronization of the datastored in standby systems for switchback and data
updates makes it possible to bring systems online
faster, allowing active site assignment according to
the disaster situation.

*1	 SDP: A general term for functions and equipment for interworking
with web application functions.

Regular Articles

Safety information
registration

Personal Safety
Confirmation
SystemSearch request

SearchSearch and query

SearchMailnotification
Voice
notification
Access by persons
registering or browsing

SearchRegistered search results

SearchMobile provider B
Search request

Searchtable
Generatesearchtable

Register Browse

User terminal(cell phone)

Mobile provider A

Access bymobile provider

Registered search results

SearchMobile provider D
Search request

Message management DB
Registration notification

Registered search results
Separation of use forregistration andbrowsing and use formobile provider search

Fig. 3. Response to concentrated search requests from mobile providers.

5.2 User convenience(1)	The web171 message registration notification to
fixed-line phone users
When providing a service that does not require ahigh level of user ICT literacy, it is important to consider fixed-line phone users. Data from the major
earthquake disaster that occurred in eastern Japan in
March of 2011 showed that only 36% of the people
who used the disaster voice messaging service*2 hadbeen able to confirm the personal safety of friends or
loved ones [2]. A comparison of the 171 and web171
services indicates that the number of voice messages
registered with the 171 service is smaller than that for
the web171 service. Furthermore, the proportion ofusers that register personal safety information via cell
phone or Internet services is expected to increase, so
in addition to functions enabling the use of different
types of media, we implemented functions for converting the text data registered with web171 to speech
data by the TTS server and sending voice notifications to fixed-line users. The voice notifications
enable users to receive the notifications regardless ofwhether the original message was in text or voiceform.
(2) High-usability user interface
During times of emergency, having the ability tosurely and easily perform the operations needed to

use the service and having a display that is easy toread are important. The use of the 171 service toreplay messages in the order in which they were sent,
regardless of media type, was taken into account in
the interworking between the 171 and web171 services, which was implemented for the first time in thedevelopment reported here. For the web171 service,
we separated the listing of target messages from theopportunities for exchanging message content
between systems so that the target messages could be
displayed quickly even if there was a large number ofregistered messages. Furthermore, we reduced thenumber of display screen transitions by 60% toachieve a more user-friendly interface.
6. Future development
Because the Personal Safety Confirmation System
is connected to the Internet, it is crucial to ensure it issafe from cyber-threats. To further strengthen security, we are implementing a data analysis function forearly detection of repeated access attempts and othersuch indications of cyber-threats. Additionally, we*2 Disaster voice messaging service: A dial-up service that was developed after the major earthquake that occurred in the HanshinAwaji region in 1995. Service began on March 31, 1998 as theDisaster Message Dial (171).

NTT Technical Review

Regular Articles

NTT WEST
Service Network

NTT EAST
Service Network

Standby site

Active site

Former standby site
to active site

Former active site
(down because of disaster)
Switchover

Switchover procedure

Internet

Data are synchronized according
to the frequency of updating
to achieve rapid switchover.

All data

Active site
(service suspended)

Stop

Switch back(isolates system)

Bring online
to standby site.

Difference
data

Initial setup
after recovery

Active site
(service suspended)

Active site
(service suspended)

Switchback procedure

Recovery frommajor disaster

Active site

Initial setup is achieved byexchanging all data whenrecovering from a serious
disaster.

Faster setup is achieved byexchanging difference datawhen bringing a standby
system online.

Active siteStandby site

Fig. 4. Site switchover and switchback during a major disaster.

are investigating the distribution of data among otherproviders as well as interworking with the web171
service, and we plan to further improve the convenience for users.
The Personal Safety Confirmation System must be
easy to use and provide accurate confirmation of personal safety during an emergency, so we will continue
working to make it even more convenient for users
while dealing with changes in network circumstances.

[2]

the Great East Japan Earthquake,” 2011 White Paper on Information
and Communications in Japan (Outline).
http://www.soumu.go.jp/johotsusintokei/whitepaper/eng/WP2011/
part1.pdf
MIC, “Final Report: The Ways of Ensuring Communication during
Major Disasters and Other Emergencies” and MIC Study Group, “TheWays of Ensuring Communication during Major Disasters and Other
Emergencies,” Attachment 3, 2011 (in Japanese).
http://www.soumu.go.jp/main_content/000141084.pdf
http://www.soumu.go.jp/main_content/000141086.pdf

References[1]

MIC, “Part 1: Information and Communications in the Aftermath ofVol. 13 No. 12 Dec. 2015

Regular Articles

Naoto Hoshikawa

Research Engineer, Network Service Platform
Project, NTT Network Service Systems Laboratories.
He received a B.E. in engineering from Chiba
University in 2004, and an M.E. and Ph.D. in
information science from Nagoya University in2006 and 2012. He joined NTT EAST in 2010
and began studying SDPs. He developed thewebsite Safety Confirmation System (Disaster
Message Board web171) using SDP. He has also
been engaged in research and development(R&D) of the telephone and website Safety Confirmation System at NTT Network Service Systems Laboratories. He is a member of the Institute of Electronics, Information and Communication Engineers (IEICE).

Toru Inaba

Senior Research Engineer, Network Service
Platform Project, NTT Network Service Systems
Laboratories.
He received a B.E. in mechanical engineeringfrom Kogakuin University, Tokyo, in 1991. He
joined NTT in 1991 and engaged in developmentof telephone exchange machines, media servers,a unified messaging system, and a SIP server in
PSTN/IP networks. He has also been involved in
R&D of the telephone and website Safety Confirmation System.



Kentaro Kichiyoshi

Senior Research Engineer, Network Service
Platform Project, NTT Network Service Systems
Laboratories.
He received a B.E. in information science from
Kyoto University in 1996 and an M.E. from Nara
Institute of Science and Technology in 1999. He
joined NTT in 1999 and engaged in the study,
development, and maintenance of commercial
network services. He has also been involved in
R&D of the telephone and website Safety Confirmation System.

Masatsugu Ohnishi

Research Engineer, Network Service Platform
Project, NTT Network Service Systems Laboratories.
He received his B.E. in earth and planetarysystems science from Hiroshima University in
2000. He joined NTT COMWARE in 2000 andengaged in the study, development, and maintenance of the NGN service. He is also involved in
R&D of the telephone and website Safety Confirmation System at NTT Network Service Systems
Laboratories.

NTT Technical Review

Global Standardization Activities

Standardization Efforts in IP
Number Portability Specifications
Toshio Norimatsu, Kenjiro Arai, and Tsuyoshi Jocha
Abstract

In the near future, the inter-connections between communications carrier networks that use E.164
numbers are expected to migrate to Internet protocol (IP) technology rather than connecting themthrough the existing public switched telephone network (PSTN). For the migration, IP networks must
support number portability functionalities in order to continue the current service, although such functionalities are currently supported only in the PSTN. We describe in this article the domestic number
portability specification published in August 2015 as well as the NTT initiatives in this area.
Keywords: number portability, IP interconnection, standardization

1. Introduction
Number portability is a service that enables users tochange their contract communications carrier withoutchanging their telephone number [1]. Number portability for fixed telephone numbers is called local
number portability (LNP), and that for mobile numbers is called mobile number portability (MNP). In
Japan, the Ministry of Internal Affairs and Communications (MIC) allocates telephone numbers to communications carriers. The carrier to which the number
is allocated can be identified based on the first five
digits (except the first ‘0’) of a telephone number [2].
Conventionally, an originating carrier network forwards a call to a terminating carrier network based on
the telephone number being called since the originating network can identify the terminating networkfrom the called telephone number. However, withnumber portability, the originating carrier network
cannot determine the terminating carrier network byinspecting the called telephone number; therefore,
carrier networks need to obtain information in orderto route a call to the terminating carrier network.
2. Solutions to number portability
The International Telecommunication Union, Telecommunication Standardization Sector (ITU-T)
E.164 supplement 2 specifies four solutions to number portability:• All Call Query (ACQ)• Query on Release (QoR)• Call Dropback (CD)• Onward Routing (OR)The following database solutions for maintaining
number portability data are also specified.
•	The data of all communications carriers are collected in a common database (common databasesolution).
•	Each communications carrier deploys a databasefor collecting the data of all communications carriers (individual database solution (all data collection)).
•	Each communications carrier deploys a databasefor collecting only its own data (individual database solution (own data collection)).
2.1 M
 ethod of implementing number portability
in current telephone networks (PSTN)
In a public switched telephone network (PSTN),
the destination carrier network of a call destined to anumber portability user is resolved using one of thefollowing methods (see Fig. 1):
1)	CD solution: an originating carrier networkroutes the call to a donor carrier network basedon the telephone number, and the donor network
NTT Technical Review

Global Standardization Activities

CD solution
Originating carrier network
1) Called telephone number(03-3333-4444)

Donor carrier network
Subscriber
switch2) NRN (03-5555-6666)
3) N
RN
, ca
lled
tele
pho
ne
num
b

Number portability

NRN

Called telephone number
03-3333-4444

er

Recipient carrier network
OR solution
Donor carrier network

Originating carrier network
1) Called telephone number(03-3333-4444)

Subscriber
switchNumber portability

NRN2) NRN (03-5555-6666),
called telephone number

Recipient carrier network

Called telephone number
03-3333-4444

Call control signalling

NRN: network routing number

Fig. 1. PSTN number portability implementation method.

provides the routing information to the originating network. Then the originating carrier
network reroutes the call to the recipient carrier
network.
2)	OR solution: an originating carrier networkroutes the call to a donor carrier network basedon the telephone number, and the donor network routes the call to the recipient carrier
network using the routing information in thedonor carrier network.
In routing the call to the recipient carrier network,a network routing number (NRN) is used to identify
the donor carrier network. Fixed carrier networks
store NRNs in the subscriber circuit switches, andmobile carrier networks store them in the home subscriber server or home location register. Also, a connection request from the originating carrier network
Vol. 13 No. 12 Dec. 2015

contains an indication that the originating carrier network requested the call to be routed by using either
the CD or OR solution. The recipient carrier network
determines the routing action based on the information.
2.2 D omestic standardization of IP number
portability
The Mutual Understanding Meeting on PSTN
Migration is a forum hosted by NTT EAST and NTT
WEST that has been held regularly since 2010. In thismeeting, representatives of domestic communications carriers discuss a variety of PSTN-migrationrelated requirements, including number portability.
As a result of these meetings, it was agreed to adopt
the ACQ solution as an Internet protocol (IP) number
portability solution for the following reasonsGlobal Standardization Activities

Donor carrier network

er
umb
ne n
o
h
p
tele 4444)
alled 3331) C (03-3
6),-666
555 umber
5
3(0 one nRNh2) N d telepecall

Originating carrier network

3)

Number database
NRN

Number portability
NR

N,

ca

lled

tel

ep

ho

ne

nu

Called telephone number
03-3333-4444

mb

er

Recipient carrier network
Call control signalling
Database access signallingFig. 2. IP number portability implementation methodology.

(Fig. 2):
•	Because calls are not forwarded to the donor carrier network, codecs and services such as messaging are not affected by the services or capabilities supported by the donor carrier network.
Calls can be connected to the recipient carrier
network even when call control servers of thedonor carrier networks are out of order.
•	Many countries have adopted this solution in
their PSTNs.
An individual database solution (own data collection) was selected for ease of deployment and security of data management.
Based on this conclusion, a liaison statement thatrequests domestic standardization of IP number portability in order to implement the agreed-upon basic
policies was created at the mutual understanding
meeting and sent to the Telecommunication Technology Committee (TTC).
For number portability standardization, it is necessary to standardize the system architecture and function deployment, as well as the signalling that is
implementable on that architecture. To achieve this,the Number Portability Joint Ad Hoc Study Groupwas established as a joint ad hoc group of the Numbering Plan Working Group (responsible for E.164
numbers * ) and the Signalling Working Group(responsible for signalling).
3. NTT initiatives for TTC standardization
Our group in NTT Network Service Systems Laboratories is working on some initiatives for standardizing the interface between communications carriers,
which is called the network-to-network interface(NNI), to enable future IP interconnection between
carriers (Fig. 3).
We studied signalling requirements related to number portability database queries, and to enable fixed
and mobile carriers to be commonly used, we adopted
the carrier E.164 number mapping (ENUM) appliedin the Third Generation Partnership Project (3GPP)
specifications and guidelines of the GSM (Global
System for Mobile communications) Association(GSMA), and thoroughly took the initiative in making a draft of TTC standards related to domain namesystem (DNS) messages exchanged between ENUM
servers and Session Initiation Protocol (SIP) servers
as well as SIP server routing requirements using* E.164 number: A telephone number format specified in ITU-T
E.164.

NTT Technical Review

Global Standardization Activities

ENUM/DNS
Donor carrier
network

NNI (ENUM/DNS)

Originating
carrier network

NNI (SIP)

Terminating
carrier network

UNI

UNI

Fig. 3. Interconnection model of carrier networks.

1) Architecture and function deployment
Technical working group:
Numbering Plan Working Group
Working group responsible for E.164
numbers:
Numbering Plan Working GroupJT-E164 Supplement 22) Signalling (ENUM/DNS)
3) Signalling (SIP)
Technical working group:Technical working group:
Numbering Plan/Signalling Working Group joint ad hoc
SIP-SWG
Working group responsible for signalling:
Working group responsible for signalling:
Signalling Working Group
Signalling Working Group

Refer to asstage 2
specification.

Number portability

JJ-90.31
ENUM/DNS interface specification

ITU-T E.164 Supplement 2

Refer toas stage 3
specification.

JJ-90.30
Common interconnection interface
between IMS carrier networks

ENUM/DNS detailed rules for
implementing LNP/MNP/FNP

Supplement 2: Number portability

JF-IETF-RFC 6116

ITU-T E.164 Supplement 2
option item selections and appendix
Refer toas stage 3
specification.

The E.164 to Uniform Resource Identifiers(URI) Dynamic Delegation Discovery System(DDDS) Application (ENUM)

SIP/SDP internetwork interface
based on 3GPP TS 29.165
ENUM-SIP interwork
SIP-ISUP interwork of
number portability information

ENUM basic procedure

FNP: freephone number portability
IMS: IP multimedia subsystem
ISUP: Integrated Services Digital Network (ISDN) User Part
RFC: Request for Comment
SWG: Sub-Working Group

Fig. 4. Configuration of number portability specification documents.

ENUM. The TTC conducted technical studies, andthe specifications were published in August 2015 as
JJ-90.31. The specification documents for number
portability are indicated in Fig. 4.
Furthermore, with respect to the basic SIP/Session
Vol. 13 No. 12 Dec. 2015

Description Protocol (SDP) NNI specifications,
except those concerning number portability, we proposed the IP interconnection specification to TTC,
and TTC published it in May 2015 as JJ-90.30 [3].
This specification conforms to 3GPP specifications.
Global Standardization Activities

Donor carrier network
ENUM/DNSENUM query
IN NAPTR 9.9.9.9.0.6.2.2.4.1.8.e164enum.net
NNI(ENUM/DNS)ENUM answer
NAPTR 100 10 "u" "E2U+sip" "!^.*$!sip:+81422609999@example2.ne.jp;user=phone!"
NAPTR 100 20 "u" "E2U+pstn:sip" "!^.*$!sip:+81422609999;npdi;rn=+81422610051@example2.ne.jp;user=phone!"
INVITE sip:+81422609999;npdi;rn=+81422610051@example2.ne.jp;user=phone SIP/2.0

Originating
carrier network

INVITE

CSCFs etc.

INVITE

Terminating carrier network(Recipient carrier network)

NNI (SIP)
INVITE tel:0422609999;phone-context=xyz SIP/2.0

CSCFs: call session control functions

Fig. 5. Example call flow of number portability.

4. Overview of number portability
technical specifications
JJ-90.31 specifies basic signalling requirements for
retrieving Uniform Resource Identifiers (URIs) corresponding to the telephone numbers over the NNI
between different communications carrier networks.
Protocols and procedures are also specified in JJ90.31. Furthermore, JJ-90.31 conforms to ENUM/
DNS Request for Comments (RFCs) (e.g., RFC
1034, RFC 1035, RFC 6116) and GSMA ENUM/
DNS guidelines [4], with operating conditions related
to migration from current telephone networks added.
The ENUM is a mechanism by which an application can retrieve one or more applications corresponding to a telephone number in the URI format
through the querying DNS using the telephone number as a search key. The source of an ENUM queryuses a URI in Naming Authority Pointer (NAPTR)
records in order to connect to the application. The
TTC standard includes the following clarifications inregard to the corresponding international standards:•	A priority value described in NAPTR records is
specified, and supplementary rules on option
parameters used in URIs are added.
•	Supplementary rules to ENUM/DNS procedures(iterative and recursive queries) are added.
•	Sequence and message examples are added.
For example, as an ENUM/DNS procedure clarification, the answer condition for an absent number (atelephone number that is not in use) is clarified. For
conformance to international standards and PSTN
function deployment, JJ-90.31 specifies that ENUM/
DNS answers a query by sending a NAPTR record(s)corresponding to the absent number as routing information to the donor carrier network, which is connected to the originating carrier network. Then thedonor carrier network determines whether it is anabsent number in the SIP layer.
Taking into account the coexistence period of the
PSTN and IP networks, we needed to consider thecase in which the originating and donor carrier networks are IP-interconnected, but the originating andrecipient carrier networks are interconnected via the
PSTN. To address this coexistence period, JJ-90.31
specifies that multiple NAPTR records can be conveyed in the answer of an ENUM query to allow
ENUM/DNS to include in the answer the URI information including the NRN, which is needed for the
PSTN in connecting to the recipient carrier network(Fig. 5).

NTT Technical Review

Global Standardization Activities

5. Future prospects
Preparation of TTC standard JJ-90.30, which specifies NNI basic SIP/SDP signalling requirements, andTTC standard JJ-90.31, which specifies the ENUM/
DNS interface needed in SIP routing including number portability, have been completed, and the bilateral
IP interconnection between communications carriers
has shifted to the implementation phase towards commercial service. With the objective of realizing commercialization, we plan to work on achieving timely
and continuous standardization in tandem with thediscussion at the Mutual Understanding Meeting on
PSTN Migration, while covering carrier demands.

Toshio Norimatsu

Research Engineer, NTT Network Service
Systems Laboratories.
He received a B.S. in information sciencesfrom Tokyo Institute of Technology in 1992. He
is currently researching interconnection between
IP multimedia subsystem (IMS) networks.

References
[1]

[2]

[3]

[4]

Website of MIC, “Number Portability for Mobile Phones and PHS”
(in Japanese).
http://www.soumu.go.jp/main_sosiki/joho_tsusin/top/tel_number/
mnp.html
Website of MIC, “Telecommunication Number Designation” (inJapanese).
http://www.soumu.go.jp/main_sosiki/joho_tsusin/top/tel_number/number_shitei.html
S. Sakaya, K. Arai, and S. Kanegae, “Standardization Efforts in IP
Interconnect Specifications,” NTT Technical Review, Vol. 12, No. 9,2014.
https://www.ntt-review.jp/archive/ntttechnical.php?contents=ntr2014
09gls.html
GSMA, “DNS/ENUM Guidelines for Service Providers & GRX/IPX
Providers,” 2012.
http://www.gsma.com/newsroom/wp-content/uploads/2012/11/
IR.67-v8.0.pdf

Tsuyoshi Jocha

Researcher, NTT Network Service Systems
Laboratories.
He received an M.S. in basic science from the
University of Tokyo in 1996. In the same year, hejoined NTT Network Service Systems Laboratories. He is currently researching interconnection
between IMS networks.

Kenjiro Arai

Researcher, NTT Network Service Systems
Laboratories.
He received an M.S. in information sciencesfrom Tohoku University, Miyagi, in 2007. In thesame year, he joined NTT Network Service Systems Laboratories. He is currently researchinginterconnection between IMS networks.

Vol. 13 No. 12 Dec. 2015



Practical Field Information about
Telecommunication Technologies
Practical Field Information about Telecommunication Technologies

Wireless LAN Tester Conformable toIEEE802.11ac
Abstract

This article describes the development and introduction of a wireless LAN (local area network) tester
conformable to the IEEE802.11ac standard. This is the thirty-second article in a bimonthly series onpractical field information on telecommunication technologies. This month’s contribution is from the
EMC Engineering Group, Technical Assistance and Support Center, Maintenance and Service Operations Department, Network Business Headquarters, NTT EAST.
Keywords: wireless LAN tester, IEEE802.11ac, access point

1. Introduction
The proliferation of mobile terminals equippedwith wireless local area network (LAN) functions has
led to the installation of wireless LAN access points(APs) both indoors and outdoors and to the creationof Internet connection environments in diverse places.
In addition, the new IEEE*802.11ac wireless networking standard was approved in January 2014 witha maximum theoretical bit rate of 6.9 Gbit/s. In linewith these trends, NTT EAST has been increasing theprovision of telecommunication services using wireless LAN. For example, it has made its fifth-generation home gateway conformable to IEEE802.11acand begun providing FLET’S HIKARI optical broadband services capable of gigabit-level communications.
However, installing Internet connection environments using wireless LAN can lead to communication problems due to radio wave interference andother factors. In fact, communications by wireless
LAN can be lost in homes and retail establishments
due to the effects of radio waves emitted from a variety of wireless devices. It is desirable that such problems be solved at an early stage, and for this reason,
we developed a wireless LAN tester that can visualize
signal and communication conditions in the radio
interval and expanded its on-site use [1].
In this article, we introduce our development of a

wireless LAN tester conformable to the newIEEE802.11ac standard.
2. Wireless LAN tester functions
The main inspection requests and failure causes inrelation to on-site use of wireless LAN are shown in
Fig. 1 together with corresponding functions deemednecessary for the wireless LAN tester. Here, the maincauses of communication failures are interference
from extraneous noise and inter-channel wireless
LAN interference. In addition to finding solutions forcommunication problems, there is also a need toinspect AP placement and the electromagnetic environment prior to AP installation. To meet these needs,
we have equipped the wireless LAN tester with thefollowing functions.
Function 1: AP detection•	Detect APs conformable to IEEE802.11a/b/g/n/
ac and display a list of APs.
•	Select any AP and display channel number,transmission method, and other details of that
AP.
Function 2: Received signal strength (RSS) measurement•	Continuously measure the RSS of all detectedAPs.
•	Display temporal fluctuation of RSS for any AP.
*

IEEE: Institute of Electrical and Electronics Engineers

NTT Technical Review

Practical Field Information about Telecommunication Technologies

Main failure causes andinspection requests(a) Interference fromextraneous noise(b) Inter-channel interference
for wireless LAN(c) AP placement(d) Electromagnetic
environment inspection

Functions(1) AP detection(2) Received signal strength(RSS) measurement(3) Throughput measurement(4) Display of distribution graphfor RSS and throughput(5) Electromagnetic environment
monitorFig. 1. Main inspection requests in relation to wireless LAN and functions.

Function 3: Throughput measurement•	Connect to any AP and continuously measure its
throughput in the radio interval.
•	Display temporal fluctuation of measured
throughput.
Function 4: Display of distribution graph•	Display a distribution graph of RSS and throughput for any AP.
Function 5: Electromagnetic environment monitor•	Display RSS of all detected APs by channel.
•	Display noise affecting wireless LAN communications by channel.
Function 6: Interference analysis•	Quantify possibility of throughput degradation
due to inter-channel interference by channel.
•	Display channels having low possibility of interchannel interference as recommended channels.
Function 7: Pass/fail judgment•	Set targets (RSS and throughput) and automatically make a pass/fail judgment on measured
values.
Function 8: Report preparation•	Output reports on measurements and judgment
results.
Our wireless LAN tester equipped with the above
functions consists of a personal computer (PC), dedicated wireless LAN adapter, and dedicated software.
In addition, a USB (universal serial bus)-type spectrum analyzer can be used to measure noise affecting
wireless LAN communications.
3. Conformity with IEEE802.11ac
3.1 AP detection
A wireless LAN AP periodically transmits a beacon
signal to notify the surrounding area of its existence.
This signal includes information that is needed for aVol. 13 No. 12 Dec. 2015

terminal to connect to the wireless LAN network
such as the channel number and security information.
The AP detection function can detect and analyze thisbeacon signal and display detailed information onthat AP. The function can also display a list of all
detected APs classified by channel or service set
identifier (SSID) and can be used to check for available channels and the interference with other APs.
A screenshot of the AP detection function is shownin Fig. 2. Detailed information on an AP selectedfrom the left of the screen is displayed on the upper
right of the screen. It can be confirmed that the target
AP conforms to IEEE802.11ac.
The IEEE802.11ac standard achieves high-speed
communications through a channel-bonding functionthat binds multiple channels. The AP details in Fig. 2
indicate that communication that binds four channels(for a total bandwidth of 80 MHz) is possible enablinga maximum bit rate of 1.3 Gbit/s.
3.2 RSS measurement
The function can display the signal strength of APs
in real time. A screen shot of this function is shown in
the lower part of Fig. 2. The function can be used to
examine the temporal fluctuation of RSS and to checkthe RSS of wireless LAN signals at any position.
3.3 Throughput measurement
This function continuously transmits User Datagram Protocol packets generated by dedicated software on the wireless LAN tester to the wireless LAN
adapter and measures throughput on the radio interval
between the AP and the tester. This requires a connection with the AP targeted for measurement and apassword to make that connection.
A screenshot of throughput measurement for an
IEEE802.11ac-conformable AP is shown in Fig. 3.
Practical Field Information about Telecommunication Technologies

RSS

Throughput

AP distribution

Noise distribution

Electromagnetic
environment monitor

Channel conditions

Optical ST(omnidirectional)

Optical ST (directional)

Help

AP details

AP listBy channel By SSID

Quit (M)SSID
MAC address
AP manufacturer
Encryption
Communication method
Maximum link speed
Bandwidth
Channel
RSS
RSS (average)
RSS (max.)
Communication mode: Infrastructure mode
Beacon interval

RSS (dBm)

Save results (S)RSS of selected AP(temporal fluctuation)

Screenshot
Read results (R)Details of IEEE802.11ac-conformable AP selected from list
RSS [dBm]

Max.

Avg.

Min.
Time

MAC: media access control
ST: station

Fig. 2. Screenshot of AP detection function.

Max. throughput
RSS

AP listThroughput

AP distribution

Noise distribution

Electromagnetic
environment monitor

Channel conditions

Optical ST(omnidirectional)

Optical ST (directional)

Help

Throughput by AP
MAC address

By channel By SSID

ChannelAvg. (Mbit/s)

Max. (Mbit/s)

Min. (Mbit/s)

Display of RSS and throughput
RSS of selected IEEE802.11ac-conformable AP (temporal fluctuation)Time

RSS Throughput

RSS [dBm]

Max.
Avg.
Min.

Time

Throughput [Mbit/s]
Max.
Avg.
Min.

Time

AP list Update

Read results (R)Auto-scale

Quit (M)Save results (S)Screenshot

Throughput of selected IEEE802.11ac-conformable AP (temporal fluctuation)

Fig. 3. Screenshot of throughput measurement function.



NTT Technical Review

Practical Field Information about Telecommunication Technologies

Wireless LAN Tester
Select AP and connect.

Wireless LAN Tester

Connection to wireless LAN AP
By channel By SSID

Channel usage

Targeted wireless LAN AP (router) is
encrypted. Please enter WEP (Wired
Equivalent Privacy) key.

RSS, throughput
Encryption mode
Internet-based speed
measurement

Encryption key

Other(all functions)
OK

CancelQuit(1) Select Internet-based speed measurement.

Update(3) Enter encryption key.

Connect to AP(2) Select AP to be measured.

Wireless LAN Tester

Service information site

Enter URL of website for performing speed tests
and open site.

About speed measurement site
Open website

The “intra-area speed measurement site (Tokyo metropolitanarea)” set up in the service information site enables speeds fromthe customer’s PC to the service information site (server installedin Tokyo) to be measured.

(4) Select URL of speed measurement site.

(5) Measure speed. (Website of FLET’S HIKARI service information)

Fig. 4. Screenshots of Internet-based speed measurement.

These results show that a maximum throughput of
239 Mbit/s was measured. Displaying the measurement results for RSS and throughput on one screen inthis way enables the user to examine the correspondence between these two characteristics. Furthermore, in an environment enabling an Internet connection, throughput can be measured by connecting to a
website for measuring speed as shown in Fig. 4.
3.4 Electromagnetic environment monitor
This function can be used to examine the level ofnoise affecting wireless LAN communications oneach channel. It can also be used to confirm the channels set for a wireless LAN AP and associated bandwidth and RSS. A screenshot of the electromagnetic
environment monitor is shown in Fig. 5. It can be
confirmed that a noise level is extremely high inchannels 4–6 in the 2.4-GHz band, while it isextremely low in the 5-GHz band. In addition, while
Vol. 13 No. 12 Dec. 2015

the channel set for this AP in the 5-GHz band is channel 100, communications using four channels
becomes possible through the channel bonding function.
4. Application
We describe here AP placement as an application of
the wireless LAN tester. We tested the signals transmitted from an AP installed outside an apartment
room for achieving shared use of wireless LAN inthat apartment. We used the distribution graph function of the wireless LAN tester. The results are shownin Fig. 6. The AP was set to channel 100 in the 5-GHz
band. These results show that the RSS and throughput
were greater than –67 dBm and 53 Mbit/s, respectively, which indicates that wireless LAN communications were possible in all rooms within the apartment. Thus, the wireless LAN tester was effective forPractical Field Information about Telecommunication Technologies

RSS

Throughput

AP distribution

Noise distribution

Electromagnetic
environment monitor

Channel conditions

Optical ST(omnidirectional)

Optical ST (directional)

Help

Select target AP
Quit (M)5-GHz wireless LAN signal

2.4-GHz wireless LAN signal

Save results (S)Screenshot
WLAN
signal level[dBm]

Signal of IEEE802.11
ac-conformable AP(uses four channels
through channel
bonding)

Hold peakLong-termmonitoring mode
Read results (R)Channel

2.4-GHz noise

5-GHz noise

Noise
level
[dBm]

Switch display
Channel bonding

ChannelFig. 5. Screenshot of electromagnetic environment monitor.

APAP

RSS [dBm]–67 dBm(a) RSS

Throughput [Mbit/s]

53 Mbit/s(b) Throughput

Fig. 6. RSS and throughput measurement results.

visually confirming the signals transmitted from anAP.
5. Conclusion
In this article, we introduced the functions of an
IEEE802.11ac-conformable wireless LAN tester anddescribed an application including a distribution
graph for RSS and throughput.
We made this wireless LAN tester conformable toIEEE802.11ac with respect to the functions of AP
detection, RSS measurement, throughput measure

ment, and electromagnetic environment monitoring.
We also devised a display format that shows the measurement results of RSS and throughput on one
screen to speed up troubleshooting of the causes offailures. We plan to improve and expand the functionsof this tester and to make it conformable to any new
wireless LAN standards.
The EMC Engineering Group of the Technical
Assistance and Support Center is committed toachieving prompt resolution of failures related towireless LAN and to contribute to the smooth provision of communication services. To this end, it is
NTT Technical Review

Practical Field Information about Telecommunication Technologies

actively engaged in technology dissemination activities through technical support, development, andtechnical seminars.

Smooth Provision of Wi-Fi Services,” IEICE Communications Society Magazine (B-plus), Vol. 7, No. 25, pp. 38–43, 2013 (in Japanese).

Reference[1]

K. Okamoto et al., “Introduction of Wireless LAN Tester toward

Vol. 13 No. 12 Dec. 2015



New NTT Colleagues––We welcome our newcomers to the NTT Group
This is a corner of the NTT Technical Review where we introduce our new affiliate companies.

PT. Cyber CSF
Largest datacenter service provider in Indonesia; established in 2012; headquartered in Jakarta
Founded in 2012, PT. Cyber CSF (renamed PT. NTT Indonesia Nexcenter), is Indonesia’s largest datacenter
service provider. It operates a high-quality facility equipped for 24 MVA of power and 2800 racks in 7700 square
meters of space in the heart of Jakarta (Photo 1). The Indonesian ICT (information and communication technology) market is expected to average about 10% annual growth through 2017, exceeding growth in most other
Southeast Asian countries. Datacenter outsourcing in Indonesia is expected to expand beyond 2016, triggered by
new laws and regulations, as well as administrative guidance by the central bank, Bank Indonesia, regarding
datacenter quality and the use of such services by financial companies.
In October 2015, NTT Communications Corporation announced that it had wholly acquired PT. Cyber CSF
and renamed the company PT. NTT Indonesia Nexcenter. The acquisition further strengthens NTT Communications’ NexcenterTM datacenter capabilities in the Asia-Pacific region, where it serves major local andPhoto 1. External view of datacenter in Jakarta.

NTT Technical Review

New NTT Colleagues

multinational customers, especially in the fields of finance, information technology, and manufacturing.
Contact:
Public Relations Department
NTT Communications Corporation
http://www.ntt.com/aboutus_e/news/data/20151007_2.html

Vol. 13 No. 12 Dec. 2015



External Awards
METI-KANSAI Director-General’s Award
Winner: Kenta Niwa, Hisashi Uematsu, and Kazunori Kobayashi,
NTT Media Intelligence Laboratories
Date: March 27, 2015
Organization: The Kansai Bureau of Economy, Trade and Industry(METI-KANSAI)
For their demonstration of the zoom microphone system, which
can pick up target sounds from a distance, at The Lab. in Grand Front
Osaka.

array aptasensor. We used the modified aptamer with 10 and 30 basepair (bp) double-stranded DNA spacers. The signal with a 30-bp
spacer was about twice as strong as that with a 10-bp spacer for boththrombin and prostate specific antigen detection. The improvement in
the sensitivity was supported by a model calculation that estimatedthe effect of spacer length on fluorescence recovery efficiency.
Published as: Y. Ueno, K. Furukawa, A. Tin, and H. Hibino, “Onchip FRET Graphene Oxide Aptasensor: Quantitative Evaluation of
Enhanced Sensitivity by Aptamer with a Double-stranded DNA
Spacer,” Analytical Sciences, Vol. 31, No. 9, pp. 875–879, 2015.

IIEEJ Research Encouragement Award
Winner: Shuhei Tarashima, NTT Media Intelligence Laboratories
Date: June 28, 2015
Organization: The Institute of Image Electronics Engineers of Japan(IIEEJ)

Young Scientist Presentation Award
Winner: Kota Okazaki, NTT Nanophotonics Center/NTT Device
Technology Laboratories
Date: September 13, 2015
Organization: The Japan Society of Applied Physics (JSAP)

For “Fast Web Image Object Cosegmentation with Region Matching.”
Published as: S. Tarashima, G. Irie, H. Arai, and Y. Taniguchi, “Fast
Web Image Object Cosegmentation with Region Matching,” Proc. ofMedia Computing Conference 2014 (the 42nd Annual Conference of
the Institute of Image Electronics Engineers of Japan), R4-2, Tokyo,
Japan, Jun. 2014.

For “A Low-loss SiON Optical Waveguide Fabricated by ECR-PE
CVD with SiD4 Gas.”
Published as: K. Okazaki, H. Nishi, T. Tsuchizawa, T. Yamamoto,and K. Yamada, “ A Low-loss SiON Optical Waveguide Fabricated by
ECR-PE CVD with SiD4 Gas,” Proc. of the 62nd JSAP Spring Meeting 2015, 11p-A16-2, Kanagawa, Japan, Mar. 2015 (in Japanese).

IPSJ Yamashita SIG Research Award
Winner: Takeshi Yamamuro, NTT Software Innovation Center
Date: August 3, 2015
Organization: The Information Processing Society of Japan (IPSJ)
For “LZE++: Fast Random Access for Shared Dictionary Compression.”
Published as: T. Yamamuro, M. Onizuka, and T. Honjo, “LZE++:
Fast Random Access for Shared Dictionary Compression,” Proc. of
DEIM2015 (the 7th Forum on Data Engineering and Information
Management), G3-3, Fukushima, Japan, Mar. 2015 (in Japanese).
Analytical Sciences Hot Article Award
Winner: Yuko Ueno, Kazuaki Furukawa, Andrew Tin, and Hiroki
Hibino, NTT Basic Research Laboratories
Date: September 10, 2015
Organization: The Japan Society for Analytical Chemistry
For “On-chip FRET Graphene Oxide Aptasensor: Quantitative
Evaluation of Enhanced Sensitivity by Aptamer with a Doublestranded DNA Spacer.”
We propose a molecular design for a biomolecular probe to realize
an on-chip graphene oxide (GO) aptasensor with enhanced sensitivity. Here, GO works as an excellent acceptor for fluorescence resonance energy transfer. We inserted rigid double-stranded DNA as aspacer between the GO surface and the aptamer sequence to extend
the distance between a fluorescence dye and the GO surface duringmolecular recognition. We examined the dependence of the sensitivity on the length of the spacer quantitatively by using a 2×2 linear-JSAP Young Scientist Award
Winner: Daiki Hatanaka, NTT Basic Research Laboratories
Date: September 13, 2015
Organization: The Japan Society of Applied Physics (JSAP)
For “Mechanical Random Access Memory in a Phonon Circuit.”
A phonon waveguide (WG) constructed via a one-dimensional
array of mechanical resonators is used to access a localized mechanical resonator. This resonator plays the role of a memory node inwhich binary information can be written, stored, and read via themobile mechanical excitations in the phonon WG. The phonon WGlocalized resonator architecture demonstrates the viability ofmechanical circuits for information processing applications.
Published as: D. Hatanaka, I. Mahboob, K. Onomitsu, and H. Yamaguchi, “Mechanical Random Access Memory in a Phonon Circuit,”
Appl. Phys. Express, Vol. 7, No. 12, p. 125201, 2014.
Encouragement Award (Industrial Science and Technology Policy and Environment Bureau Director-General’sAward) in FY2015 Industrial Standardization Awards
Winner: Takashi Matsui, NTT Access Network Service Systems
Laboratories
Date: October 5, 2015
Organization: Ministry of Economy, Trade and Industry
For his supportive role in international standardization activities
for IEC (International Electrotechnical Commission) TechnicalCommittee 86 (fibre optics) and the expectation to make further contributions in the future.

NTT Technical Review

Papers Published in Technical Journals andConference Proceedings
Visual Attention Driven by Auditory Cues: Selecting Visual
Features in Synchronization with Attracting Auditory
EventsJ. Nakajima, A. Kimura, A. Sugimoto, and K. Kashino
Proc. of MMM 2015 (the 21st Anniversary International Conference on MultiMedia Modeling), pp. 74–86, Sydney, Australia, January 2015.
This paper proposes a novel computational model of human visual
attention driven by auditory cues. Founded on the Bayesian surprisemodel that is considered to be promising in the literature, our model
uses surprising auditory events to serve as a clue for selecting synchronized visual features and then emphasizes the selected features
to form the final surprise map. Our approach to audio-visual integration focuses on using effective visual features alone—but not allavailable features—for simulating visual attention with the help ofauditory information. Experiments using several video clips showthat our proposed model can better simulate eye movements ofhuman subjects than other existing models even though our model
uses a smaller number of visual features.

Virtual Network Embedding across Multiple Domains with
Secure Multi-party Computation
T. Mano, T. Inoue, K. Mizutani, and O. Akashi
IEICE Transactions on Communications, Vol. E98-B, No. 3, pp.
437–448, March 2015.
Network virtualization is a promising technology that can increase
flexibility, diversity, and manageability of networks. The concept ofbuilding optimal virtual networks across multiple domains is gettingmuch attention, but existing studies are based on the unrealistic
assumption that providers’ private information can be disclosed; as iswell known, providers never actually do that. In this paper, we propose a new method that solves this multi-domain problem without
revealing the providers’ private information. Our method uses anadvanced secure computation technique called multi-party computation (MPC). Although MPC enables existing unsecured methods tooptimize virtual networks securely, it requires a very long time tofinish the optimization due to the MPC’s complex distributed protocols. Our method, in contrast, is designed to involve only a small
number of MPC operations to find the optimal solution, and it allows
providers to execute a large part of the optimization process.

Analysis of Process Assignment in Multi-tier Mobile Cloud
Computing and Application to Edge Accelerated Web
Browsing
N. Takahashi, H. Tanaka, and R. Kawamura
Proc. of IEEE Mobile Cloud 2015 (the 3rd IEEE International
Conference on Mobile Cloud Computing, Services, and Engineering), pp. 233–234, San Francisco, USA, March/April 2015.
This paper discusses multi-tier mobile cloud computing architecture, where small IT (information technology) servers in the users’
proximity are utilized to execute part of the application processing.
The partitioning method changes the distribution of processing loads
and traffic and affects the processing delay or battery usage. The
problem is that it is unclear which partitioning method brings a betterVol. 13 No. 12 Dec. 2015

result. This paper introduces an abstract model of application execution in a multi-tier mobile cloud, discusses performance metrics, andexamines various trade-offs. A prototype named Edge Accelerated
Web Browsing is also presented.

Geometric Interpretation of Fisher’s Linear Discriminant
Analysis through Communication Theory
J. Fujiki, M. Tanaka, H. Sakano, and A. Kimura
Proc. of MVA 2015 (the 14th IAPR International Conference on
Machine Vision Applications), pp. 333–336, Tokyo, Japan, May
2015.
This paper provides a geometrical aspect of Fisher’s linear discriminant analysis (FLDA), which has been widely used owing to its
simple formulation and low computational costs. Our approach isbased on a new framework of pattern recognition that can be modeledby communicating class information. This model is quite different
from a commonly used framework of pattern recognition as a mapping from the set of patterns to the set of classes. In the new framework, patterns can be regarded as class information with redundantencoding. We show that the geometry of two-class FLDA can be
described via a communication theory of noisy channels.

Path Accommodation Design and Reconfiguration for Different Reliability Classes in Virtualized Multi-layer Transport Network
A. Kadohata, T. Tanaka, A. Watanabe, A. Hirano, H. Hasegawa,
and K. Sato
Proc. of OECC 2015 (the 20th OptoElectronics and Communications Conference), Shanghai, China, June/July 2015.
We propose differenced accommodation design and reconfiguration in virtualized multi-layer transport networks. Numerical evaluation shows that when the number of classes allowing reconfiguration
is dominant, the number of transponders is reduced up to 12%.

Mode Dependent Loss Equaliser and Impact of MDL on
PDM-16QAM Few-mode Fibre Transmission
T. Mizuno, H. Takara, K. Shibahara, Y. Miyamoto, M. Oguma, H.
Ono, Y. Abe, T. Matsui, S. Matsuo, K. Saitoh, and Y. Kimura
Proc. of the 41st European Conference on Optical Communication(ECOC 2015), Valencia, Spain, September/October 2015.
We experimentally evaluate the relationship between mode dependent loss (MDL) and Q penalty for few-mode fibre transmission. We
employ a low-MDL recirculating loop and free-space optics type
MDL equaliser and transmit 3-mode signals with PDM (polarizationdivision multiplexed)-16QAM(quadrature amplitude modulation).

Dense Space Division Multiplexing Long Haul Transport
System Using Multi-core / Multi-mode Fibre
T. Mizuno, H. Takara, A. Sano, and Y. Miyamoto
Proc. of ECOC 2015, Valencia, Spain, September/October 2015.

Papers Published in Technical Journals and Conference Proceedings

We review recent dense space division multiplexing (DSDM)
transmission technologies for multi-core/multi-mode fibre and discuss issues toward future DSDM long haul transport systems.

Pre-adjustment Rerouting for Wavelength Defragmentation in Optical Transparent WDM Networks
A. Kadohata, A. Watanabe, A. Hirano, H. Hasegawa, and K. Sato
IEICE Transactions on Communications, Vol. E98-B, No. 10, pp.
2014–2021, October 2015.
We propose a new extension to reconfiguration algorithms used toaddress wavelength defragmentation to enhance the path accommodation efficiency in optical transparent wavelength division multiplexing networks. The proposed algorithm suppresses the number offibers employed to search for a reconfigurable wavelength channel by
combining routes between the target path and the existing path in areconfigured wavelength channel. This paper targets three main
phases in reconfiguration: i) the reconfiguration trigger; ii) redesignof the wavelength path; and iii) migrating the wavelength paths. The
proposed and conventional algorithms are analyzed from the viewpoints of the number of fibers, the accommodation rate, and thenumber of migrating sequences. Numerical evaluations show that the
number of fibers is suppressed by 9%, and that the accommodation
efficiency is increased by approximately 5–8% compared to whenreconfiguration is not performed.

Acoustic Event Detection in Speech Overlapping Scenarios Based on High Resolution Spectral Input and Deep
Learning
M. Espi, M. Fujimoto, and T. Nakatani
IEICE Transactions on Information and Systems, Vol. E98-D, No.
10, pp. 1799–1807, October 2015.
Acoustic event detection techniques are typically based on derived
features that reduce resolution and detail when we are targeting otherkinds of events. We propose a method that learns features in an unsupervised manner from high resolution spectrogram patches, andintegrates within the deep neural network framework to detect andclassify acoustic events.

Adaptive Post-filtering Method Controlled by Pitch Frequency for CELP-based Speech Coding
H. Chiba, Y. Kamamoto, T. Moriya, N. Harada, S. Miyabe, T.
Yamada, and S. Makino
IEICE Transactions on Information and Systems (Japanese Edition), Vol. J98-D, No. 10, pp. 1301–1311, October 2015.
Most speech codecs utilize a post-filter that emphasize pitch structures to enhance perceptual quality at the decoder. Particularly, thebass post-filter used in ITU-T G.718 performs a pitch enhancement
technique for a lower fixed frequency band. This paper describes a
new post-filtering method which adaptively controls the frequency
band and the gain of the post-filter frame-by-frame depending on thepitch frequency of the decoded signal to improve the quality. We haveconfirmed the enhancement of the speech quality with the developed
method through objective and subjective evaluations. This devised
technology can be easily applied to most of CELP-based speech
codecs.

Comparison of the Photodegradation Behavior of LDPE
Using Accelerated Weathering Instruments
T. Miwa, Y. Takeshita, Y. Akage, M. Watanabe, M. Takaya, and T.
SawadaCorrosion Engineering, Vol. 64, No. 4, pp. 99–106, October
2015.
Samples of low-density polyethylene (LDPE) were photodegradedusing accelerated weathering instruments and outdoor exposure. The
physical properties and chemical structures of the photodegradedsamples were studied through a tensile test, gel chromatography, andinfrared spectroscopy. The molecular weight distribution of a sample
photodegraded by using a fluorescent ultraviolet lamp at a high black
panel temperature (80°C) was more similar to that of an outdoordegraded sample than that of other artificially samples photodegradedby using a xenon lamp at the standard black panel temperature(63°C). It is estimated that accelerated weathering tests at a highsample temperature can accelerate cross-linking more than chain
scission, consequently recreating molecule-enlargement in a similar
way to the outdoor-degraded sample.

Optical DP-high Order-QAM Transmission System for
High-speed Short Links Utilizing Copropagating Twin
Local Lights
H. Kawakami, T. Kobayashi, and Y. Miyamoto
Proc. of the 21st Asia-Pacific Conference on Communications(APCC2015), pp. 94–97, Kyoto, Japan, October 2015.
A novel optical high order quadrature amplitude modulation(QAM) transmission system for high-speed short links is described.
Dual-polarization (DP) QAM and twin local lights are generated
from one light source in the system, and these light waves are simultaneously transmitted via standard single-mode fiber. The receivercan be constructed simply because it does not require a coherent lightsource under wavelength control. The system enables a 3.1-Gbaud
DP-16-QAM signal to be successfully demodulated after 80-km
transmission without using an optical dispersion compensator. It alsoachieves high tolerance against phase noise in the signal lightsource.

High Capacity Dense SDM Transmission Using Multi-core
Few-mode Fiber
T. Mizuno, H. Takara, A. Sano, and Y. Miyamoto
Proc. of the 2015 IEEE Photonics Conference, Virginia, USA, pp.
259–260, October 2015.
We review recent progress in space division multiplexed (SDM)
transmission, and our proposal and the first demonstration of dense
space division multiplexing (DSDM) towards ultra-high capacity
optical transport systems.

Comparison of Subscriber Assignment Methods on Scalable Distributed Pub/Sub Systems
R. Banno, T. Kawano, S. Takeuchi, M. Takemoto, and M. Matsuo
Proc. of APCC2015, pp. 632–636, Kyoto, Japan, October 2015.
Scalable messaging methods for IoT services are needed to accommodate a vast number of devices. Skip Graph based, topic based
pub/sub (SG-TPS), which utilizes multiple brokers composing a
structured overlay network, is a promising candidate. In SG-TPS, thedistribution delay time is widely influenced by the way subscribers
are assigned to each broker. There are two possible approaches:

NTT Technical Review

Papers Published in Technical Journals and Conference Proceedings

intensive assignment, by which subscribers having the same topic areaccommodated on the same broker, and extensive assignment, bywhich the subscribers are accommodated on different brokers as far
as possible. In this paper, we formulate the difference in the distribution delay time between these two approaches and discuss optimization of subscriber assignment.

Identifying Attractive News Headlines for Social MediaS. Kourogi, A. Kimura, H. Fujishiro, and H. Nishikawa
Proc. of CIKM 2015 (the 24th ACM International Conference on
Information and Knowledge Management), Melbourne, Australia,
pp. 1859–1862, October 2015.
This paper provides a novel solution to this problem by identifying
attractive headlines as a gateway to news articles. We performed oneof the first investigations of news headlines on a major viral medium.
Using our investigation as a basis, we also propose a learning-to-rank
method that suggests promising news headlines. Our experimentswith 2000 news articles demonstrate that our proposed method canaccurately identify attractive news headlines from the candidates andVol. 13 No. 12 Dec. 2015

reveals several promising factors in making news articles go viral.

Linewidth-tolerant Dual Polarization QAM Transmission
System Using Twin Local Lights
H. Kawakami, T. Kobayashi, and Y. Miyamoto
IEEE Photonics Technology Letters, Vol. 27, No. 22, pp. 2375–
2378, November 2015.
A novel digital coherent transmission system based on dual polarization quadrature amplitude modulation (DP-QAM) is proposed. In
this system, a DP-QAM signal and twin local lights are generated
from one continuous wave (CW) light source and transmitted simultaneously. Because optical phase noise is canceled in the proposed
receiver, linewidth tolerance is improved without using a coherent
light source in the receiver. The proposed scheme successfully
demodulates a 3.125-GBd DP-quadrature phase shift keying (i.e.,
DP-4-QAM) signal. After 50-km transmission, no degradation in bit
error rate was observed even at the linewidth of 45 MHz.

