Implementation of IPv6 Functions for a Network UserAuthentication System Opengate
Makoto Otani

Katsuhiko Eguchi

Hirofumi Eto

Saga University
1 Honjo-cho, Saga-city,Saga, Japan+81-952-28-8593

Saga University
1 Honjo-cho, Saga-city,Saga, Japan+81-952-28-8563

Saga University
1 Honjo-cho, Saga-city,Saga, Japan+81-952-28-8594

otani@cc.saga-u.ac.jp

eguchi@ai.is.saga-u.ac.jp

etoh@cc.saga-u.ac.jp

Kenzi Watanabe

Shin-ichi Tadaki

Yoshiaki Watanabe

Saga University
1 Honjo-cho, Saga-city,Saga, Japan+81-952-28-8828

Saga University1 Honjo-cho, Saga-city,Saga, Japan+81-952-28-8505

Saga University
1 Honjo-cho, Saga-city,Saga, Japan+81-952-28-8564

watanabe@is.saga-u.ac.jp

tadaki@cc.saga-u.ac.jp

watanaby@is.saga-u.ac.jp

ABSTRACT

Keywords

In Japan, many research networks are implemented with Internet
Protocol Version 4 (IPv4) and Internet Protocol Version 6 (IPv6)
dual stacks, and some ISPs are beginning to provide IPv6 services.
Popular operating systems such as Windows XP, Mac OS X andLinux also support IPv6. Therefore, the user will use IPv6transparently in the near future. From this background, it isimportant to implement a network user authentication system thatcan control both communications of IPv4 and IPv6,simultaneously.

Opengate, IPv6, Internet, Network user authentication system

At Saga University we have been developing and using a network
user authentication system called "Opengate" This system has
functions for user authentication and access control according to
the authentication and logging of their usage. The Opengate has asimple user interface via a Web browser. The system authenticatesusers by authentication mechanism such as POP3, POP3S, FTP,
RADIUS, and PAM. After authentication, the system allows theuser access to the network and places a Java Applet into the user's
Web browser. The applet establishes a TCP connection to theOpengate server. When the connection closes, the server detects
the end of network usage and closes the network.

To use the network effectively, wireless access points, network
sockets and terminals for public use are implemented inorganizations. However, there is a possibility that this publicly
used network suffers network incidents such as computer cracking
and copyright infringement. To identify the user at these incidents,
some authentication and logging systems are required.

1. INTRODUCTION
Dual stacks of IPv4 and IPv6 have been serviced in many
Japanese research networks. Some ISPs are beginning to provide
IPv6 services. IPv6 functions are supported in various types ofpopular operating systems such as Windows XP, Mac OS X andLinux. With those operating systems and network environments,
users will use IPv6 transparently.

We have been developing a network user authentication systemusing Opengate. The system has been used on the campus networkof Saga University for more than 4 years [2]. It has functions foruser authentication, access control according to the authenticationand logging of their usage. Via Web browsers, the Opengatesystem authenticates users by such authentication mechanism as
POP3, POP3S, FTP, RADIUS, and PAM. After authentication,
the system opens its firewall to allow user’s terminal passing
through the firewall.

We implement functions for IPv6 into the Opengate withoutchanging characteristic features of the system. This paper
describes the implementation of the Opengate and its IPv6extension.

We implement functions for IPv6 into the Opengate withoutchanging characteristic features of the system [1]. This paper
describes the implementation of the Opengate and its IPv6extension.

Categories and Subject Descriptors
C.2.3 [Network Operations]: Network management

General Terms: Network management

2. OPENGATE
2.1 Outline

Permission to make digital or hard copies of all or part of this work forpersonal or classroom use is granted without fee provided that copies are
not made or distributed for profit or commercial advantage and that
copies bear this notice and the full citation on the first page. To copy
otherwise, or republish, to post on servers or to redistribute to lists,requires prior specific permission and/or a fee.
SIGUCCS'05, November 6–9, 2005, Monterey, California, USA.
Copyright 2005 ACM 1-59593-173-2/05/0011...$5.00.

The Opengate is a user authentication and logging system applied
to the network environment where many and unspecified users
connect various terminals. It has been developed in Saga
University and been widely used since 2001 on campus.

283

Java Applet does not connect to the watch process, thecommunication path is closed after the predefined time is passed.
The communication path is also closed if the MAC address ischanged, or no communication packets are found.

The system allows user terminals to connect to the Internet,
without a special application forms or software setups.
The operation flow of the Opengate is shown in Figure 1. The
flow is explained in the following subsections.

HTTP Request

Authentication
Data

After opening the gateway, the user terminal will continue tocommunicate to the Internet. The Opengate system observed thepackets to/from the terminal passing the gateway. If no packet isobserved for a long time, the system judges the termination ofusage.

FirewallWeb Browser WWW Server

Forwarding

AuthenticationPage

2.6 Watching Communication State

AuthenticationInternetServerOpengate

User Terminal

CGI

POP3FTP, etc.

IPv4address

Page of finishingauthentication+Java Applet
Java AppletOpen

2.7 Logging User Information

WatchProcess（fork）

The Opengate records the user's information using a SYSLOGfunction. The stored Information is the ID, terminal IP address,
MAC address, start time and end time of the user.

TCP Connection
Use of Internet (Including except for HTTP)

End of use
Close

Figure 1. Operation Flow of the Opengate

2.2 System Requirements
The Opengate is developed on FreeBSD. Its firewall function ipfw
was used for controlling communications and Apache was used asa Web server. A CGI program is coded with C language. TheOpengate servers can use DHCP and NAT as well depending on
network composition. Java Applet is desirable to operate on theWeb browser of a user terminal.

Figure 2. Authentication interface

2.3 Authentication
To connect to the Internet through the Opengate service, a userneeds to communicate to a Web servers using HTTP first. At thistime, the gateway forwards the request of HTTP to the Web serverof the Opengate server using the forwarding function of thefirewall. An authentication page will be displayed on the userterminal by this forwarding.
The user inputs his/her user ID and the password through thisauthentication page. The Opengate, started as CGI, gets the user
ID and the password which is authenticated by an external
authentication server. The Opengate supports authentication
mechanism such as POP3, POP3S, FTP, RADIUS, and PAM.

2.4 Getting the IP Address of User Terminal
The Opengate gets the (IPv4) IP address of the user terminal fromthe Web server through the environment variable(REMOTE_ADDR), and opens and closes the communication
path using the terminal’s IP address.

Figure 3. The page after authentication

3. IMPLEMENTATION OF IPv6
OPENGATE
3.1 System Requirements

2.5 Watching A User Terminal
The completion page of authentication is displayed on the user
terminal after authentication, and a Java Applet is downloaded tothe user terminal. This Java Applet establishes a TCP connection
to the watch process forked from the CGIs. When the TCP
connection is lost or when the Java Applet does not answer aresponse message from the watch process, the system judges thetermination of use and the communication path is closed. If theThe Opengate system supporting IPv6 (IPv6 Opengate in short) isalso developed on FreeBSD as the (IPv4) Opengate. The IPv6Opengate needs to control the communication paths of both IPv4and IPv6. Therefore, it is designed to use ipfw for IPv4
communication as in the IPv4 Opengate, and ip6fw for IPv6communication. The system uses DHCP for assignment of IPv4284

authentication data, IPv4 address is obtained from this POST
method by the IPv6 Opengate.

addresses. A router advertisement daemon (rtadvd) is used for
assignment of the IPv6 addresses.
In addition, as needed to get the IPv6 address of a user terminalfrom the Web server on the IPv6 Opengate, the system uses
Apache having IPv6 support.

User Terminal

Opengate

Web Browser WWW Server

The authentication interface of the IPv6 Opengate is shown inFigure 2. The page after authentication is shown in Figure 3.

Retry

3.2 Getting the IP Address of User Terminal

HTML Refresh

A user terminal supports IPv4 and IPv6 has two types ofaddresses. In order to get the IPv4 and IPv6 addresses of the user
terminal by an environment variable (REMOTE _ADDR) inHTTP protocol, it is necessary for the terminal to communicate
with the Web server through both IPv4 and IPv6 addresses,respectively. Many Web browsers (Internet explorer 6, Firefox,Opera, etc.) use IPv6 initially, and if IPv6 communication fails,
those Web browsers will use IPv4 communication instead. The
IPv6 Opengate gets two types of addresses based on thosebehaviors of Web browsers.

Authentication
Page+
IPv4 Address

InternetFirewall
IPv4 IPv6

IPv6 HTTP Request

Timeout

IPv4 HTTP Request

Forwarding

AuthenticationCGI

IPｖ４HTTP
IPv4 address

Opengate CGIAuthenticationdata+
IPv4 Address

IPｖ6 HTTP
IPv6 address
IPv4 address(hidden tag)

Figure 4. Getting terminal information in the IPv6 Opengate
The flow of getting the user terminal information on the IPv6Opengate is shown in Figure 4.

The IPv6 Opengate also needs two FQDNs (FQDN_4 andFQDN_64) for connecting the gateway by terminals. For example,
FQDN_4 is opengate4.saga-u.ac.jp (IPv4 address: 192.168.55.1).
And FQDN_64 is opengate_64.saga-u.ac.jp (IPv6 address:
2001:e38:3661:1a5::1, IPv4 address: 192.168.55.1).

By using HTML Refresh mechanism, we implement the way ofgetting two types of addresses, without changing the interface
provided in the (IPv4) Opengate.
As described in (1), the first IPv6 HTTP request to a IPv6 Web
server cannot be forwarded to the Web server of IPv6 Opengate.
This is because the forwarding function is not implemented to theIPv6 firewall (ip6fw) on FreeBSD. For this reason, a user has towait for the timeout of IPv6 HTTP request. Though the waitingtime for timeout varies with Web browsers, the waiting time is
only about 5 - 15 seconds.

3.2.1 Case of the IPv4 and IPv6 dual stacks Webserver.
Here we describe the process of getting addresses of user
terminals in case of Web servers with IPv4 and IPv6 addresses.
The case of the Web servers only with IPv4 will be described in
3.2.2.
(1) The Web browser transmits an IPv6 HTTP request to a Webserver (IPv4 and IPv6 dual stacks Web server). Because thecommunication path is closed, however, the IPv6 HTTP
request is timeout.
(2) Next, the Web browser transmits an IPv4 HTTP request tothe same Web server. Here, this IPv4 HTTP request isforwarded to the Web server on the IPv6 Opengate(http://opengate4.saga-u.ac.jp) by a firewall forward function.
(3) By the HTML refreshing function, the Web browser requests
the CGI to display the authentication page. At this time, theURL of the destination is specified by FQDN_4(http://opengate4.saga-u.ac.jp). The IPv4 address of the user
terminal can be obtained through the environment variable.
(4) The user inputs his/her user ID and the password into theauthentication page. In this page, the IPv4 address of the user
terminal is embedded by the CGI using the hidden tag. The
embedded IPv4 address is transmitted (POST) to the IPv6
Opengate CGI together with authentication data. At this time,
the URL of the IPv6 Opengate CGI is specified by
FQDN_64 (http://opengate64.saga-u.ac.jp).
(5) Because the URL of the IPv6 Opengate CGI is specified by
FQDN_64 (http://opengate64.saga-u.ac.jp), the Web browser
communicates to the IPv6 address (2001:e38:3661:1a5::1).
So, the IPv6 Opengate gets the IPv6 address of the user
terminal by the environment variable (REMOTE_ADDR).
As, the IPv4 address is transmitted (POST) together with

3.2.2 Case of the IPv4 Web server
If the Web server, the terminal tries to connect first, is a IPv4server, the IPv6 Opengate behaves as follows.
(1) The Web browser transmits an IPv4 HTTP request to a Webserver. Here, this IPv4 HTTP request is forwarded to theWeb server on the IPv6 Opengate (http://opengate4.sagau.ac.jp) by the firewall.
The remaining process is the same as process of Section 3.2.1 (3)(5). Because the first HTTP request is IPv4, The IPv6 HTTP
request of Section 3.2.1 (1) is not performed.
The above descriptions are based on the assumption that, the IPv4
address must be assigned at least to FQDN of the Web server thata user terminal tries accesses first and may have the IPv6 address.
When only the IPv6 address is assigned to the Web server, theIPv6 Opengate cannot forward communication. However, because
there are still few such Web servers, I think that it is not an issue.

3.3 Opening a Communication Path
After finishing authentication, the communication path for theuser terminal is opened by adding rules to two firewalls (ipfw andip6fw).

3.4 Watching a User Terminal
In order to watch the use status of the user terminal, a TCP
connection is established between the watch process and the JavaApplet downloaded to the user terminal. When the TCP285

connections is lost, or when the Java Applet does not answer aresponse message from the watch process, the system judges thetermination of use and the communication path is closed. ThisTCP communications is established only using IPv4, becausesome Java VM on the Web browser might not support IPv6.

When operating the IPv6 Opengate, the dividing the network
under control to a proper size might be desirable. Optimal address
assignment to the user terminals with IPv4 and IPv6 dual stacks
are a future task, and needs to verify the IPv6 Opengate on alarger experiment network.

3.5 Watching a Communication State

4.2 Restrictions

The IPv6 Opengate also observes the communication state of theterminal. The number of the packets (IPv4 and IPv6) passing theIPv6 Opengate is watched. If no packet (IPv4 or IPv6) transmitted
from the user terminal is found for a long time, the system judges
the termination of use and IPv4 and IPv6 communication paths
are closed.

Since the IPv6 Opengate opens first only the communication pathof the address used for authentication, the communication paths ofother IPv6 addresses are closed. So, The NDP entry is watched foradding other IPv6 addressed later. Delivery of NDP is restricted
only in the same sub network. Therefore, in order to use the NDP
protocol in the IPv6 Opengate, you must be composed such that
other routers are not installed between the IPv6 Opengate anduser terminals.

3.6 Watching Multiple IPv6 Addresses
In IPv6, a user terminal may have multiple global IPv6, such as inmulti-homed environment, the case where the anonymous address
is used.

User terminal only using IPv6 also exists. The IPv6 Opengate
always uses IPv4 for getting the address and watching theconnection state. This is not the serious restriction, because
almost all terminals use IPv4 protocols currently.

In the IPv6 Opengate, communication paths are opened only for
the IP addresses used for HTTP requests at the authentication.
And, for the addresses which was not used at the authentication
are closed.

4.3 Application of the Proposed Technique
Various types of authentication systems for network usage havebee studies. The IPv6 Opengate controls the communication in thenetwork layer. In many other systems for network authentication,communication paths are controlled in the date link layer or in thenetwork layer. The system that controls communication in thedata link layer does not use the IP address for control. So, such asystem does not need to take IPv6 into consideration.

Therefore, the NDP (Neighbor Discovery Protocol) entries arealso watched for adding multiple IPv6 addresses. If a new IPv6
address of the user terminal is added into the NDP entries, theIPv6 Opengate opens the communication path for the new IPv6address. When a IPv6 address is deleted from the NDP entries, theIPv6 Opengate closes the communication path for this IPv6address. So, the IPv6 address that was not used at theauthentication can also be used later.

Those systems that controls communication in the network layer
needs to consider IPv6. When supporting IPv6 in such systems,
the following techniques used in our research might be effective.

3.7 Logging a User Information

Getting the IPv4 and IPv6 addresses of user terminal

The IPv6 Opengate records user information using a SYSLOG
function as in the (IPv4) Opengate. If a user terminal uses IPv4and IPv6, the IPv6 Opengate records user ID and both IPv4 andIPv6 addresses, a MAC Address, usage start time, and usagefinish time. In addition, the IPv6 Opengate records IPv6 addressthat is not used for authentication. If the user terminal supports
only IPv4, it records only IPv4 address.

Control of communication path
Watching the communication state
Support of multiple IPv6 global addresses

5. CONCLUSION
We have been developing a network user authentication system
Opengate, and been using it in campus network of Saga
University. This system has functions for user authentication,access control according to the authentication and logging of theirusage. After the authentication, the system allows the user to use
the network for communication to the Internet.

3.8 About the Web Browser Using IPv4Before IPv6
Many Web browsers use IPv6 before IPv4. The IPv6 Opengate
uses this sequence for getting IPv4 and IPv6 addresses.
However, some Web browsers (safari on Mac OS X 10.3, forexample) use IPv4 before IPv6. Therefore, the NDP entry is also
watched for adding IPv6 addresses used after authentication.

We extend the Opengate system to the IPv6 Opengate. By theIPv6 Opengate, user terminals are able to use of both IPv4 andIPv6 for connection. Moreover, user terminal can use multiple
global IPv6 addresses.

3.9 About the Web Browser Only Using IPv4
The user terminal that uses only IPv4 may be connected to thenetwork. In such a case, only the IPv4 address is obtained by theIPv6 Opengate. Therefore, the IPv6 Opengate controls only thecommunication path of IPv4.

Because IPv6 will be popular in the near future, this researchmight be useful for IPv6 support in other network authentication
systems.

4. DISCUSSION
4.1 Scalability[1] Katsuhiko Eguchi, Kenzi Watanabe, Implementation of IPv6

6. REFERENCES
Functions for Opengate, IPSJ’s SIG DSM Meeting, No.2004-DSM36, pp.7 - 12, 2005

The IPv6 Opengate starts one CGI process to one user terminal asin (IPv4) Opengate. Currently, many Opengate servers have been
operating in Saga University so that at most each the Opengate
server can manage the 256 IPv4 addresses.

[2] Shin-ichi Tadaki, Hirofumi Eto, Kenzi Watanabe, Yoshiaki
Watanabe, Implementation and Operation of Large Scale Network
for Users’ Mobile Computers by Opengate, IPSJ’s SIG DSM journal,
Vol.46, No.4, pp. 922-929, 2005.

286