Many hotels, apartments and long-lease apartments have a delusion before being checked:
“I've already done WiFi real name authentication page and users have filled in cell phone numbers.”
But in actual checkups,A lot of projects that were asked to be modified, exactly.“On the surface, physical name certification, no compliance log at backstage and less audit capability”。
Behind this, the core falls on a key point:
WiFi actual name certification log, by“Export control audit gateway”Real generation.
I. Public security is really concerned about it, not“Authentication Page”But...“Authentication log links”
From the P.S.N. Watch, WiFi's real name never was a“Front Page Behaviour”It's a one.Full network behavioral links：
-
Who?
-
At what time?
-
With what device?
-
Which IP was used
-
Which web resources were visited
-
Is it possible to trace back to the real identity?
This information is fully reflected in the log.
The public security department, when checking WiFi's actual name certification, looks at only three points:
-
Whether Log exists
-
Whether the log is genuine, continuous and unalterable
-
Whether the log matches the authenticated information one to one
The three o'clock.Portal page or AP side log alone cannot be satisfied。
II. What is a WiFi authenticated log? No“Login records”It's so simple.
In the public security standards system, a compliant WiFi authenticated log contains at least three main categories of data:
1 ⁇ Identification Log (who is in use)
By WiFi Real Name Certification System Generates, core fields include:
-
Authentication account (cell number / room number / passport number behind)
-
Certification (text message, room number + cell number, external guest passport certification, etc.)
-
Authentication Time
-
Authentication results (success/ failure)
-
Associated room number / Tenant number / Enterprise number
-
Authentication Device MAC Address
This is **“People”The dimension**.
2 x Internet Behavior Log (What network is it using)
By Audit Gateway (Export Equipment) Generate, the core field is usually required by public security “Five-dollar group.”：
-
Source IP
-
Source Port
-
Purpose IP
-
Destination Port
-
Type of agreement (TCP/UDP)
And also record:
-
Online time
-
Delineation Time
-
Session length
-
NET Address before and after conversion
-
Export public network IP
This is **“Network Behaviour”The dimension**.
3 ⁇ Identity and behaviour binding (key points)
Public security has the following priority:
“This IP accesses the site at this time, corresponding to which authenticated person?”
Only if:
-
Real name certification system
-
Audit gateway
-
Export flow control
The three are on the same road.Logs can do it.“Recoverable, retroactive and reviewable”。
III. Why does WiFi ' s real name certification have to be combined with the audit gateway?
1 ounce because the log must“Exports”Generate
The basic logic of public security is:
Without control of the exit, there's no guarantee that the log is real.
The reason is simple:
-
AP side, AC side only.“Access behaviour”
-
Unable to record full access to net after NET
-
Could not close temporary folder: %s
-
Can not get folder: %s: %s
And...Audit gateways deployed to main router/ main switch exit position, having the following natural advantages:
-
All access traffic must pass.
-
You can not be allowed to access the Internet without authentication
-
Recorded complete session and access to the Internet
-
It can be tied to the real-time authentication system.
This is why the police are conducting a live inspection.Naturally more recognised.“Export control WiFi Real name certification programme”。
IV. NatShell WiFi Relation design to audit gateway
In the light of actual project experience, NATSHEL_BRAND has developed a clear deployment logic in different scales:
Scenario I: AC Support external Portal authentication
Deployment pattern:
-
Use the current AC of clients
-
Connect NatShell WiFi livename authentication system
-
Deployment of log server or audit module on the export side
-
All authentication information is consolidated with the traffic log
Features:
-
Do not destroy the original network structure
-
Low cost, fast line.
-
Meet public security real name certification and log retention requirements
Scenario II: AC does not support external authentication/ no AC architecture
Deployment pattern:
-
Export on main router or main switch
Lower link or side road deployment NATHHELL_BRAND Audit Gateway -
All users authenticate first and release later
-
Audit gateway generation of full web-based behaviour log
-
Real name authentication system generates and binds ID logs
This is the most accepted standard model of public security.
Scene III: Small hotels / Hotels / Residential accommodation
The small scale project for dozens of rooms:
-
Deployment NATSHEL_BRAD Small Audit NATSHEL_AUTH_GATEWAY
-
Inline real name authentication, NATSHEL_LOG_AUDIT, Public Security Interface
-
Purchase of equipment in the first year
-
Only service charges (including text messages + public security interface) for the following year
Without complex configuration, the check can be done by inserting.
V. How the public security scene is usually verified“Log compliance”？
During the inspection process, public security or cyberprospectors usually:
-
Specify a room or user randomly
-
Requesting the transfer of the user's authenticated records
-
View the Internet Behavior Log for the corresponding time period
-
Request Export Log File
-
Verification of field integrity, time continuity
The following issues are generally required to be corrected:
-
Authentication information cannot be matched to IP
-
Logs cannot be quickly searched by time
-
Login only, no access behavior
-
Log source cannot prove production in export
VI. There is no audit gateway, WiFi actual name certification only“Form compliance”
From the point of view of public security compliance:
-
WiFi Real Name Certification System The solution is...“Who is he?”
-
Audit gateway The solution is...“What did this man do?”
-
Export controls The solution is...“Whether the log is genuine and credible”
One cannot be left without the other.
NATSHEL_BRAND 21-year deep-draw WiFi certification field, which was based on a large number of public security inspection and operational experience**“Certification + Audit + Export control”The integrated WiFi Real Name Certification Program** enables the following to be achieved in different contexts, such as hotels, apartments, long-term rentals, talent houses and small hotels:
-
Checkable
-
Retroactivity
-
Explainable
-
It's stable for the long term.
This is the WiFi authenticated system of real names that public security has accepted.