Japanese Page

OpengateM Home Page

OpengateM - A MAC address based network user authentication system for campus-wide network
Summary | Characteristics | What's New | Archive | Overview | Block diagram | Registration and usage of terminals without Web | Difference to Opengate | Difference to Simple Restriction by MAC | Sub systems | Usage | Q and A | Publications | Another System | Contact

Caution: Project main page is moved to http://opengatem.osdn.jp. This page may not follow the main page.

Summary


The procedure is shown in the figure below.  The user accesses any Web page.  If the terminal is registered and valid, the page is normally displayed.  If the terminal is unregistered or expired, the authentication is requested and the registration or updating page is displayed.  The procedure for the terminals without Web function is also prepared. Other protocol can be used under the system, if the terminal is registered with some method.

MAC Regisration Page MAC Updating Page

Characteristics


What's New

Archive

Following link has download files. The code "****" in "opengatem****.tar.gz" indicates the version.
Please download the newest version. Refer to the documents linked to this page for the installation procedure.

Download Files

We link the construction procedure and the system image using VirtualBox below.
Please use it for inspection and the system construction.

Trial of Opengate/OpengateM on VirtualBox Trial of Opengate/OpengateM on VirtualBox

The Main Projecct Page is http://en.osdn.jp/projects/opengatem/. It includes Git repository.



Overview

Th following figure shows the overview of the system.  The terminal with Web can be registered by oneself.  The terminal without Web needs the operation of the administrator. The updating can be done by oneself by using a PC or other Web based device.


Block diagram

The following figure shows the block diagram of the system.  A daemon captures the packet and opens the firewall when the database knows the address in the packet.  The firewall is closed when no packet is detected for a while.  There are several management systems for the database.


Registration and usage of terminals without Web

The registration of the terminal without Web is supervised by the administrator.  The administrator identifies the terminal by access trials.  The updating of the registration is done by oneself by using a PC having the Web function.

MAC Check Page MAC Regisration Page

Difference to Opengate

Opengate
OpengateM
Applicable to public terminal for plural users and Personal terminal for one user
Applicable to personal terminal for one user
Needs functions of standard Web and background watching page
Needs functions of internet connection only
Needs to enter password at every usage
Needs to enter password at address registration/updating time
Close network immediately - Usage termination is detected by watching page
Close network after time delay - When no packet is detected for a while

Difference to Simple Restriction by MAC

Simple Restriction by MAC
(General case. Different cases may exist)
OpengateM
Limits number of users by maximum registration for a control device.
Includes many users, as rules are controlled dynamically.
Has no usage log for each user
Has usage log for each user
(UserID, MAC address, IP address, Time)
Needs the operation of many control devices.
Controlled by a central database.
Has no usage expiration.
Includes usage expiration and expansion.
Difficult to find the abuse
Includes confirmation of usage log at periodic expiration.
Requires some procedure to get and register MAC address
Includes procedures to get and register MAC address.
May includes typo in MAC address string
Includes automatic MAC address acquisition.
Needs administrator's burden at registration.
For terminals with Web, needs no administrator's burden.
Has NO guide for unregistered users
Can forward unregistered users to registration page or other authentication.
Controls all users uniformly (Only narrowing down by firewall).
Can pass/deny specific sites/ports by using firewall.
(E.g., a site/port can be accessed without restriction)

Sub systems

The system consists of the following subsystems.

Usage
Installation place
Summary
Documentation
System for opening and closing network
All of gateways A daemon to check packets and to open/close the network OpengateMd
Management database
A server which can be accessed from gateways
Database to store the MAC address and userid for acceptable users
OpemgateMsql
System for MAC address registration
Some of gateways
A Web system to register MAC address of Non-Web device(Needed if non-web terminals are included in the service)
OpengateMreg
System for MAC address updating
A server which can access to database
A Web system to update MAC address registration
OpengateMup
System for owner to manage MAC address
Some of gateways A Web system for the owner to manage MAC address without administrator.
OpengateMown
Misc system for management
A server which can access to database Optional misc programs with PHP
OpengateMphp


Usage

  1. Registration
    1. Registration by owner without administrator (terminals with web)
      1. An user accesses registration page, and registers the authentication information and the MAC address acquired automatically.  The page can be shown as Captive Portal.
    2. Registration by administrator
      1. An user with a terminal goes to the registration area, and request the registration to the administrator.
      2. The administrator acquires the MAC address of the terminal automatically, and registers it to the database with the user ID.
    3. Batch registration
      1. SQL script sample for batch registration is included in archive.
  2. Usage
    1. When the user starts to use, the daemon on the gateway confirms the MAC address, inserts a pass rule into the firewall, and logs the usage.
    2. The daemon deletes the pass rule from the firewall, if there is no network use for a while (e.g., 3 hours).
    3. At Web accessing from no-admittance MAC address, the registration/update page is displayed after confirming ID/password(in proper setting). Opengate page is displayed in other setting.
  3. Update
    1. The usage permission expires for a certain period (e.g., 1 month). A warning email arrives before the limit date.
    2. The user updates the limit date by Web.

Q and A

Some questions and their answers are described in Q and A.

Publications

Another System : Opengate

Opengate is a Web based network user authentication system. Refer Opengate Homepage. Opengate Homepage.


If you have any questions or advice regarding this page, please send a message to the following address:
Yoshiaki Watanabe : watanaby(at)users.osdn.me
Makoto Otani : otani(at)cc.saga-u.ac.jp