What exactly does the WiFi authenticated do to meet?
The WiFi certification is not a rule that the hotel itself has come up with, but it is a legal requirement. But many hotels do not know what they are required to meet, what degree of compliance they are able to achieve, or what consequences they cannot achieve before deploying their certification system.
Source of legislation: which provisions are the main basis
The legal basis for the WiFi authenticated hotel is derived mainly from three levels.
First level is the Regulation on Technical Measures for Security Protection of the Internet issued by the Ministry of Public Security (known as the " Regulations " )."Order 82"This is the direct basis for hotel implementation of WiFi real name certification.
The second level is the Cybersecurity Act and the Data Security Act. These two laws require network operators at a higher level to take technical measures to prevent the disclosure or destruction of data on the Internet, and must cooperate when the authorities are legally conducting supervisory inspections.
The local public safety network monitoring service will refine specific requirements based on national standards, such as length of time for keeping logs, format for reporting and docking.
First requirement: Retroactivity of true identity
This is the most basic requirement: every person who enters the WiFi hotel must be able to trace his or her true identity.
What do you mean?"Real identity."♪ In the hotel scene, it is mainly achieved through several ways.
The first is a mobile SMS authentication. Residents enter their cell phone numbers, send random identification codes and have them online with the same ones. This way they can lock in cell phones, which are real names, and theoretically connected to specific people. But in practice, only mobile phones are controversial as to legal effect.——The cell phone number is a real name proof that the hotel does not have it, but the operator has it.
The most direct way is to use the identity card and to access the network when you read it. This way, the evidence chain is the most complete, but the process is relatively cumbersome, the patient’s experience has an impact, and the front desk of a hotel will increase its workload.
The third is the certificate of residence number + password. This is most common in hotels with PMS systems. When residents enter, they automatically generate a room number + password (or six places after the ID) and use this to connect WiFi.
In either way, the key requirement is that the authentication record match the real identity of the resident.——The real name number is checked through the operator; if PMS docks, the log will have a room number, an authentication account, and a back-to-back time.——The number of the dwelling corresponds to the information on the occupants in PMS.
Second requirement: logs are retained for not less than six months
This is the second hard indicator.
The hotel logs must be kept for a period of not less than six months, in accordance with Order No. 82 and the relevant implementing regulations."6 months"Not after six months, but rather during those six months, the logs must be complete, searchable and not tampered with.
What is to be recorded in the log? Commonly available are: terminal MAC addresses, assigned IP addresses, top-down and downline times, visited sites or applications, resulting data flow, and the authentication account number used.
Many hotels ignore this requirement when deploying certification systems."Can you authenticate the Internet?"I didn't think about it."Where, how long, safe and secure are the logs?". It is the most difficult to wait until a web-based check to find that the log is incomplete or that the log format does not meet the requirements.
Third requirement: logs to be submitted to Webmaster
The logs were not enough and needed to be reported as required.
Many cities’ web-based monitoring authorities require hotels to report online logs on a regular basis or to search in real time when they need it.
This step is often ignored. Many hotels feel that they have a certification system and kept a log, but only when the actual acceptance is done do they find that their log formats and standard forms required by cybermonitoring are not compatible and cannot be connected to them.
The first is to confirm to the manufacturer whether the system supports local web monitoring platforms and what the interface criteria are. The second is to contact the local network monitoring service proactively after deployment, to confirm whether log formats and reporting methods meet the requirements and identify gaps as early as possible.
What are the circumstances?"Fake compliance"
In the industry, there are a few things that look like"Authentication"However, incomplete compliance in practice requires attention.
The first is that the password has no identity information. For example, the hotel WiFi only sets a password to access the Internet at the front desk, but there are no records of who uses it at what time. This way does not even have the most basic identification connection and is clearly inconsistent.
The second is that the certified logs are not stored or retained for less than six months. The system can eject the certification page and the occupants have completed the authentication, but the logs either remain unin place or have been automatically cleared after less than six months."It's certified.", but the retention requirement is not legally met.
The third is that the logs are stored but the format does not meet the reporting criteria. The memory log does not mean that they can be connected to the web. If the log fields are incomplete (e.g. without a MAC address or IP address), or if the log formats cannot be interpreted by the Web-based platform, they may still be found in actual inspections as non-compliant.
The key to compliance is not buying anything, it's whether or not it's a closed ring.
The requirements for WiFi's actual name certification are described as three chains: the chain of accreditation (whose web access is to be demonstrated by a log), the retention chain (the log is stored for six months and not tampered with), and the chain of reporting (the log is to report to ISP as required).
The following is a regular check of logs' normality, adequacy of storage and validity of the interface.