Kazutsuna Yamaji

Privacy Enhancing Proxies in a Federation: Agent Approach and Cascade Approach

In the current network environment, access federations are proving very effective for building trustworthy and efficient service environment. However, operating federations causes some delicate problems regarding trust and security. Among the problems, privacy occupies an essential role in trust building for individual users. Conventionally, privacy aware technologies are concerned with providing anonymity. However, as privacy is understood as the right to control one’s own information, and as better services are provided if some privacy information is provided, appropriate hiding and disclosing one’s own information is considered more significant. Today, there are considered a wide variety of privacy usages for business, and because such scenarios have their own problems which must be separately solved, uniform “privacy aware technologies” are hard to conceive. They tend to be a collection of ad hoc technologies. In this paper, we consider a scenario of newspaper subscription with student discount. The proof that a subscriber is a student is sent to a newspaper provider from a university identity provider. We consider this scenario in order to extend the menu of services available in a university. Specifically, we explore technologies of proxies that include provision of anonymity and building of trust in a federation. We propose two solutions: SII-like agents, and cascading proxies to envision the privacy protection in this scenario. Their Web profiles are defined and implemented. Moreover, it is proved that both approaches effectively work to protect privacy.

Attribute Aggregating System for Shibboleth Based Access Management Federation

In a federation, single sign-on (SSO) for web applications can be achieved by performing authentication at the users home organization called identity provider (IdP) and authorization at the service provider (SP). The IdP provides the users information to the SP though the attribute exchange and the SP assigns the authorized access level for the user according to the data in the attributes. The SP trusts the attributes sent from the trusted IdP. However, the authorized access level of the user is limited in some circumstance when the trusted IdP cannot provide enough users information to the SP. This study develops an attribute aggregating system that integrates users information from different IdPs which is operated by different federated domain. Currently, our developed system is implemented in the Japanese academic society federation called Informatics Square.

Leveraging PKI in SAML 2.0 Federation for Enhanced Discovery Service

The University Public Key Infrastructure (UPKI) project in Japan is developing a national academic inter-institution authentication and authorization infrastructure based on the Public Key Infrastructure (PKI), and it is carrying out a feasibility study on SAML 2.0 federation by building a Shibboleth2.x test-bed called UPKI-Fed with about thirty university participants. Federation usually provides a discovery service (DS, previously called WAYF) to a user since he/she needs to select his/her identity provider (IdP). This IdP selection becomes a serious problem as the number of IdP grows. We solved this problem for a user using client certificate authentication by developing a DS plug-in called DS-PKI Plug-In to leverage securely stored information in a PKI certificate.

Concierge: Personal database software for managing digital research resources

This article introduces a desktop application, named Concierge, for managing personal digital research resources. Using simple operations, it enables storage of various types of files and indexes them based on content descriptions. A key feature of the software is a high level of extensibility. By installing optional plug-ins, users can customize and extend the usability of the software based on their needs. In this paper, we also introduce a few optional plug-ins: literature management, electronic laboratory notebook, and XooNlps client plug-ins. XooNIps is a content management system developed to share digital research resources among neuroscience communities. It has been adopted as the standard database system in Japanese neuroinformatics projects. Concierge, therefore, offers comprehensive support from management of personal digital research resources to their sharing in open-access neuroinformatics databases such as XooNIps. This interaction between personal and open-access neuroinformatics databases is expected to enhance the dissemination of digital research resources. Concierge is developed as an open source project; Mac OS X and Windows XP versions have been released at the official site (http://concierge.sourceforge.jp).

Fusion of E-Textbooks, Learning Management Systems, and Social Networking Sites: A Mash-Up Development

Online education has provided good opportunities for educationally disadvantaged people. However, some traditional learning management systems (LMSs), the base systems of online education, had the limitations in offering standardized education for diversified learners with different skills, objectives, abilities, preferences, and backgrounds. In addition, the traditional LMSs, which required a constant connection of the Internet, could not be used where it is not available, that is, in the half of the world. Thus, we developed a new learning platform for large-scale online courses (LSOC), called “the Creative Higher Education with Learning Object (CHiLO)”. CHiLO is a comprehensive, open-network learning system which can realize e-textbooks, competency-based education (CBE), digital badges, and social learning. CHiLO can contribute to future research on next-generation learning content based on e-books and a flexible, diversified learning environment for people worldwide.

Group Management System for Federated Identities with Flow Control of Membership Information by Subjects

Federated identities are rapidly spreading, especially in the academic world. Some services in identity federations need ID groups to provide the collaborative work and/or access control based on contracts with groups. Some existing group management systems in identity federations can provide services with group membership information, but they lack support for contracts and flow control of the membership information. It is important that the group administrators can control the group membership information to avoid unintentional information disclosure. We propose the concept of Member Attribute Provider (mAP) with membership information control by group administrators and service administrators, which provides membership information of groups to services within an identity federation. We have made an implementation in Japanese academic access management federation called GakuNin, and make sure that it works properly with several production-level services.

Development and Deployment of the Open Access Repository and Its Application to the Open Educational Recourses

Worldwide activities on open access have triggered many universities to operate institutional repositories (IRs). The National Institute of Informatics (NII) has led a Japanese IR project since 2014 and, developing homegrown repository software named WEKO as a module for the content management system NetCommons (NC). Concepts of WEKO are “High Functionality”, “Easy” and “As you like”. WEKO has almost all functionalities you need as a repository system, and these can be customized and operated by browser. In addition, not only the repository functions but also variety of add-on can be utilized for designing your own web page. More than 250 universities in Japan are now operating WEKO as their IR. Since the WEKO has multilingual functionality, some of the Malaysian university has decided to employ it. In this paper, we summarize the repository related activity in Japan and point out the possible collaboration between open educational and repository.

Design and Implementation of a Functional Extension Framework for Authn a Authz Federation Infrastructure Using Web Browser Add-on

GakuNin is a federation for constructing an academic authn & authz infrastructure by using single sign-on (SSO) technology in Japan and it consists of academic eresource providers and consumers, e.g. Universities, Electric Journal Publishers and so on. The expansion of SSO target systems causes several issues in its infrastructure. In this paper, we focus on the issues, (1) rapidly increasing the importance of the user credential at the identity provider, (2) its phishing risk at service providers and (3) the difficulty of choosing own identity provider from the large number of federated providers. We propose a framework to solve the problems using web browser add-on. We have implemented a prototype of the framework. We also discuss the issues in the current implementation.

User consent acquisition system for Japanese Shibboleth-based academic federation (GakuNin)

Shibboleth provides a federated single sign-on and an attribute exchange framework through its use of the security assertion markup language (SAML). One of major challenges for Shibboleth is the release of the user|s information from an identity provider (IdP) to the service provider (SP) without prior consent of the user, and this may not comply with the privacy laws in some countries. This paper presents the requirements of a user consent acquisition system (UCAS) and a discussion on the existing UCASs for utilising GakuNin (Japanese academic federation) and the UCAS that we developed and call uApprove.jp. uApprove.jp is an extension of uApprove to enable users to control the release of optional attributes (user-attribute-filter) and to re-request the user consent if his/her information has changed (attribute-value check).

Learning System based on Decentralized Learning Model using Blockchain and SNS.

Learning needs to transcend traditional school education to cover the whole array of learning available, such as advanced technology, arts, or sports so that people can keep learning, training, and practicing at their own pace throughout their life. To fulfill these needs for learning, we have constructed CHiLO, a decentralized learning system, which utilizes e-books. We are now developing an entirely new learning system using blockchain to solve the issue regarding the copyright of CHiLO and to build a new learning model utilizing virtual currency. This paper reports the first phase of the implementation details of the new system, which allowed the ownership rights of the blockchain assets to be managed to create e-books by combining the posts on the SNS and paying in virtual currency.