Opengate on CloudKenzi Watanabe
Department of Information Science
Graduate School of Sience and Engineering
Saga University
Saga, Japanwatanabe@is.saga-u.ac.jp

Makoto Otani
Computer and Network Center
Saga University
Saga, Japanotani@cc.saga-u.ac.jp

Shin-ichi Tadaki
Computer and Network Center
Saga University
Saga, Japantadaki@cc.saga-u.ac.jp

Yoshiaki Watanabe
Department of Information Science
Graduate School of Sience and Engineering
Saga University
Saga, Japanwatanaby@is.saga-u.ac.jp

Abstract—Opengate is an access control system of the captive
Opengate	
portal type for mobile LAN users. Opengate has beneﬁts suchas simple user interface, easy administration and so on. It
Authentication Server	
supports IPv6 and Shibboleth single-sign-on authentication.
Authentication
WiFi LAN	
for beenwatching.
One method
the periodicof theWe haveoperatingOpengateis over
10 yearscheckwithout
Serverserious DHCP/ARP/SNMP
problems. Opengate entry
is runningvirtualmachineAnto find on
disusedterminals.
environments.
machinecommunication
environments enable
Opengateother isVirtual
the periodic
with theterminal
to be ato cloudfor userof authentication.
The cloudconfirmsystem
the existence
it. But the detection
by theseLogging
Opengate
providesopportunities
for smalltoWireless LAN
methods
is delayed
from actual
usage organizations
end. It is desirable
Server	 Loghave theirown theaccesscontrol
Serverto close
network
as systems
soon as without
possible self-operations.
after usage end toOpen Terminal
The Internet	
decrease the possibility of hijacking.
Network Socket	
We are developing
captive portal typeauthentication
Keywords-Captive
Portal, aAuthentication,
AccessControl,
Intranet/
GatewayInternetsystem namedSingle Sign-On,
Cloud “Opengate” that can detect usage end imNetwork Socket
Figure 1. Conﬁguration of Opengate.
mediately[7,8]. The system is developed to control various
Terminals in Open Environment
terminals connected to the WLAN and the network socket,
I. terminals
I NTRODUCTION
and the public
shared with many users. Since
Fig. 1. An example of the network configuration
2001, it is used in our campus-wide network service[9].
A lot ofPreviously,
universities
LAN Java
for mobile
theoperate
systemWiFi
employedapplet users.
to watch
Authentication
AuthWeb
RequestWeb
Opengate
These mobileLANprovideInternetconnectivity
whereverServer
the authenticated session. After authentication,a Java apBrowser
ServerCGI
we needed
insenta campus.
plet isto the authenticated browser. Then the Java apFork
Log
Ajax CodeLogServer
plet makes
a TCPincluding
connection
with awho
process
However,everyone,peopledo for
notwatching.
haveorWatch
Keepclosedterminating
the browser,
Java Applet
Process
relationWhen
with thethe connection
university,iscan
usebythemobile LAN
if it
Connection
theprocess
detects
theclosure
immediately.
But,as
popudoes not have access control systems. So, many universiControl
lar web browsers remove Java environment from standardNetworkUsageties introduce access control systems such as FEREC [1],Intranet/Firewall
loading module, the terminals compatible to immediate end
Applications
InternetIEEE802.1X[2].
detection have been decreased. In this paper, we propose aWe havebeen developing
an endaccesscontrol
systemfortheGateway
new methodof immediate
detectionthat
employsTerminal
mobile HTTPLAN Keep-Alive
users named“Opengate”[3]. Opengate is afunction.
Fig. 2. The block diagram of the software
Anotherconcern
this paper
is the Opengate
support ofhas
IPv6.
captive portal
type
accessof controlsystem.
Figure 2. Block diagram of software.
use ofuser
IPv6interface,is expanding,authentication
beneﬁtsBecausesuch asthe
simpleeasy theadministration
thewatchprocess
detects it immediately. Then the watch
the networkneeds toofsupport
IPv6.
IPv6
and so system
on. Weforstarted
development
Opengatein The1999.
process
removestheinserted firewall rules.
networkis usually Opengate
implemented
as 10
thewithout
dual stackof IPv4
We havebeen operating
overserious
By modifying the firewall rules, the Opengate can exeand IPv6. It is desirable to open both addresses at the sameproblems. Since 2001, we started to operate the system forvarious access controls. The users of other service thantime. Though an method to acquire both addresses was to cute
cloudareservices.
We aretoableprovideuser authentication
the wholeWiFi
LANof
SagaUniversity.
Opengatealso
webrequired
passtothe
web authentication
proproposed previously[10,11], it requires two domain names services foralso
anyorganizations
asa
cloudservice.
cedureandkeepthepage(Fig.
4).
has supported
IPv6
protocolat[4]
[5].
It
has
supported
thefor one server. It is confused and is expensive at SSL regisimplemented
the gateway
withShibboleth
single-sign-on
authentication
2009[6].normalIn The
this Opengate
paper, weis will
describeinOpengate
andbuilt
Opengate
tration.
Thus we design
the methodsince
workedon theFreeBSD.
Itusesthefirewall
ipfw/ip6fw
andthewebserversetting.
with Shibboleth authentication. We propose cloud based user
SinceDNS
2010,
Opengate has been running on virtual maApache. The control program is coded with C language.
Further, weNamely,
examine theimplementedsystem
in practical authentication
service.
chine environment.
Opengate
becomescompatible
The user authentication can be performed with authentienvironment.
cation servers. Various protocols are supported for authentication, such as POP3, POP3S, RADIUS, LDAP, LDAPS
and PAM. The usage log is recorded by using the SYSLOG
2. Outline of Opengate
function.

The Opengate is a system to authenticate network users
and to record the usage log. Figure 1 shows an example

Access to any Web site	

Holding TCP for detecting	termination of 	the browser with Ajax orJavaApplet	

Input user-id and	Password	

Internet access is disabled	
as soon as the browser is closed	
Internet access is enabled	

Authentication page appears	

Figure 3.

Use ﬂow of Opengate.

II. O PENGATE
Opengate is a captive portal type access control system
for mobile LAN.
Opengate is conﬁgured as a gateway of a LAN for terminals (Figure 1). Authentication is provided by an external
server, which uses one of FTP, POP3, Radius, and LDAP
protocols. Operation logs can be sent to an external syslog
server.
The block diagram of the software is shown in Figure
2. Opengate consists of four components: local Web server,
Opengate CGI, watch process and ﬁrewall.
Figure 3 shows use ﬂow of Opengate. When a user wants
to connect to the Internet, the user only needs to launch Web
browser on his/her PC. Opengate catches HTTP access fromthe users’ Web browser. The Opengate CGI returns an Web
page for user authentication. After user inputs his/her user-id
and password, Opengate CGI tries to authenticate the user
with the authentication server. During the process above,Opengate gets IPv4 and IPv6 addresses of the user’s PC.
If the authentication successes, Opengate inserts allow rules
into the ﬁrewall for both IPv4 and IPv6 addresses. After
that, Internet access become enabled for the user. The Watch
process establishes and holds a TCP connection between
the Opengate server and user’s Web browser using Ajax orJavaApplet. Opengate watches this TCP connection. Whenthe user closes his/her Web browser or LAN connection, thewatch process recognizes the end of the use. Then Opengate
removes the corresponding ﬁrewall rules. The Internet access
is turned to be disabled for the user.
Opengate records all information such as authenticateduser-id, ﬁrewall open and close time and so on into log ﬁlesusing the syslog function. The administrator can track users’

usage history from this log ﬁles.
Opengate is running on FreeBSD with ipfw [7] andApache [8]. Opengate is distributed as open source softwareon the Opengate’s Web [9].
III. O PENGATE WITH S HIBBOLETH
Shibboleth is a Single Sign-On mechanism for Web based
systems developed by MACE (Middleware ArchitectureCommittee for Education) of Internet2 [10]. Shibboleth has
two components: IdP (Identity Provider) and SP (ServicePovider). IdP provides user authentication function for SP.
SP provides services for users.
We have implemented Shibboleth functions into Opengate. We call shibbolized Opengate “SSO-Opengate”.
Figure 4 shows system conﬁguraton of SSO-Opengate.
SSO-Opengate works as SP of Shibboleth.
A user launches Web browser on his/her PC. This HTTP
request is diverted to Opengate. The directory containing
Opengate system is protected by Shibboleth. As the result,the HTTP request is forwarded to the IdP. IdP shows theauthentication page (Figure 5). The user inputs his/her userid and password. After the authentication, Opengate shows
two pages. The one is authentication notiﬁcation page (Fig.
X), which contains user ID and time stamps of checking
the connection. The second is a university portal site. Opengate starts watching the use of the network. To close thisauthentication notiﬁcation page, SSO-Opengate understands
the user ﬁnish to use network. SSO-Opengate closes theﬁrewall immediately.
After authentication with SSO-Opengate, users can use
SPs without requiring any additional authentication procedures.

"!
!
,*-. %&!!
!"#$ %&#$

Figure 4.

%'#$%"#$(!#$(#$"#$!&#$)*#+!'#$The number of user of SSO-Opengate per hour.

Authentication Server	(IdP)	
Logging Server	
SSO-Opengate(SP)	

University Portal	(SP)	

research activ
networks forstudents andfor identifyin
constructed aSaga Univers
By implem
SSO-Opengat
information scomputers anticated by SS
information s
the most fun
Almost 90%

SPs	

The author
implementing
The Internet	

Conﬁguration of SSO-Opengate.

Status screen of virtual server

Status of SSO-Opengates on virtual environment.

users do not enter user Id and passwordSSO-­‐Opengate	  pairs fbecause
theor	  B	  University	  or	  SSO-­‐Opengate	authentication bySSO-­‐Opengate	  IdPis fstillvalid. The numberof accesses toA	  University	  external services, such as e-journals, is increasing gradually.
IdP	  for	  B	  university	  Cloud	(hosDng)	   theThese external
accesses become to be possible through
GakuNin federation.
VLAN
/VPN	

Figure 4.

Figure 5.

Figure 6.

VLAN/

Table II
T HE USE COUNT OF SP FOR ONE MONTH .
VPN	(2)	  AuthenDcaDon	

Internal SP(3)	  Access	
SSO-Opengate
56,258Computer and Network
Center Portal Campus
37,026
Campus LAN	LAN	
Curriculum system, Portal
24,529e-Learningsystem
11,162
IdP	  for	  A	  university	  Groupware
8,616
Library
PortalIdP	
1,331
B	  University	A	  university	
Small-scale Web server
487
Users management system
379
Figure
7. Opengate on cloud.
Evaluationsystem
199
Research performance DB
113
External SP (e-journals)
Cinii
71
Meta Press services for some hundred PCs.
19
factory for providing
Science Direct
12
Thomson Reuters
6
V. O PENGATE ON CLOUD
Total
140,208(1)	  HTTP	  access	

Figure 5.

Window for Shibboleth authentication.

IV. O PENGATE ON VIRTUAL ENVIRONMENT
Recently, virtual machine technologies are growing
rapidly. Many operating systems are running on virtualenvironment on a single physical machine. Each operating
system connected to virtual networks with virtual switches.
Physical networks and virtual networks are integrated.
We have been operating SSO-opengate on a virtual environment with virtual networks. We are using VMWare ESX
4.0 as the virtual environment in Saga University’s network
systems. Nine SSO-Opengates are running on one plysicalmachine with Xeon E5540 2.53GHz (Quad Core) × 2 CPU,
20GB main memory, 2 ports of CNA (Converged NetworkAdapter) and 2 ports of 10/100/1000BASE-T Ethernet. Figure 6 shows virtual machine status for SSO-opengate.
Even though SSO-Opengate is running on virtual machine, the performance of SSO-Opengate is entirely satis-

Virtual networks can be expanded ﬂexibly with VLAN orL2VPN technologies.
We propose “Opengate on Cloud” in Figure 7, which is a
cloud based user authentication system for mobile LAN for
any organizations.
The advantage of this style of the service is that any organizations need not to operate SSO-Opengate by themselves.
This style reduces cost for installation and operation. We
think this is good for small organizations. This style may
have the disadvantage of long turn around time if clientsuse slow network connection.
VI. C ONCLUSION
In this paper, we described Opengate and its extension
with Shibboleth authentication. We also proposed cloud typeservices with Opengate.
Among various access control systems of a captive portal
type, Opengate has advantages: simple user interface, easyadministration, ﬂexible authentication, quick disconnection
responding user’s ﬁnish of use, expandability, and so on. The[1] H. Eto, K.
authenticattructure, I
2003.

[2] Y. Watanaauthenticat
administrat
42, no. 12,[3] S. Tadaki,tation andcomputers. 929, 2005

[4] Home - shAvailable:[5] M. Otani,
Watanabe:
User Auth2005, Mon

[6] Saml xml.
markup la
http://saml[7] National In
ated access
Available:

expandability enables us to introduce IPv6 and Shibboleth
single-sign-on features into Opengate.
Currently, we operate Opengate gateways on a virtual
machine environment. Namely Opengate can be exported
as a cloud base service. The cloud-based Opengate provides
user authentication for organizations without having theirown Opengate systems. User organizations do not needto pay their cost for installation and operation for user
authentication.
SSO-Opengate is ready to be SP in the GakuNin project
led by NII [11]. The cloud base SSO-Opengate must be
beneﬁt for joining GakuNin.
ACKNOWLEDGMENT
Opengate and SSO-Opengate are developed by the Opengate development team [9].
R EFERENCES[1] NetSpring Inc., FEREC,
http://www.ferec.jp/ (05/01/2012 access).
[2] Institute of Electrical and Electronics Engineers, Inc.,
IEEE802.1X-2004,
http://www.ieee802.org/1/pages/802.1x-2004.html (05/01/2012 access).
[3] Yoshiaki Watanabe, Kenzi Watanabe, Hirofumi Eto and Shinichi Tadaki, An User Authentication Gateway System With
Simple User Interface, Low Administration Cost And WideApplicability, IPSJ Journal, Vol. 42, No. 12, pp. 2802 - 2809
(2001.12) (In Japanese).
[4] Makoto Otani, Katsuhiko Eguchi, Hirofumi Eto, Kenzi
Watanabe, Shin-ichi Tadaki and Yoshiaki Watanabe, Implementation of IPv6 Functions for a Network User Authentication System Opengate, ACM SIGUCCS 2005 Fall Conference(held in Monterey, California, November 6 - 9, 2005), pp.283286 (2005.11).
[5] Makoto Otani, Katsuhiko Eguchi and Kenzi Watanabe, Development of a Network User Authentication System for
IPv4/IPv6 Dual Stack Network, IPSJ Journal, Vol. 47, No.
4, pp. 1146 - 1156 (2006.4) (In Japanese).
[6] Makoto Otani, Hirofumi Eto, Kenzi Watanabe, Shin-ichi
Tadaki and Yoshiaki Watanabe, Development of the Network
User Authentication System Supporting Single Sign-On, IPSJJournal, Vol. 50, No. 3, pp. 1031 - 1039 (2010.3) (InJapanese).
[7] The
FreeBSD
Documentation
Project,IPFW,FreeBSD
Handbook,
http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/firewalls-ipfw.html(06/01/2012 access).
[8] The Apache Software Foundation, Apache HTTP SERVER
PROJECT, http://httpd.apache.org/ (06/01/2012access).

[9] Yoshiaki
Watanabe,
OpengateHome
http://www.cc.saga-u.ac.jp/opengate/index-e.html (06/01/2012 access).

Page,[10] Internet2, Shibboleth,
http://shibboleth.internet2.edu/ (05/01/2012access).
[11] National
InstituteofInformatics,
GakuNinAcademic Access Management Federation in Japan
https://www.gakunin.jp/docs/en/fed/about(06/01/2012 access).