A customer who was a hotel chain asked me how many certifications your system could support. I said 12. He snuck out and said he thought it was just two kinds of code and password. I said you used only two, that's your choice, not the system.
Network access certification systemThe more ways they do it, the more adaptive to special needs is the more appropriate scenario. But, in turn, many of them also mean that implementation is more complex, and if firms focus on the two most familiar ways, they are actually wasting their capabilities.
The NATSHEL_BRAND unified accreditation platform supports 12 types of authentication, and I will break down into four groups based on actual usage frequency and site suitability.
Foundation group: starting point for most enterprises
First, three basics: SMS authentication, Portal authentication account password, and PPOE account code. These three approaches cover basically more than 90% of the wireless network of domestic firms.
The benefits of SMS authentication are that users do not need to keep a password, the cell phone number is an account, and the text message certification code allows them to access the Internet. This experience is very friendly for visitors, and businesses do not have to open separate accounts for each visitor.
The Portal account code is more traditional and suitable for internal employees. Employees log in their own work or OA account, the system can be connected to the enterprise's AD domain or LDAP, and the existing password can be authenticated without a separate account system being maintained in the certification system.
Social Accreditation Group: a public view
Micro-credit authentication and enterprise micro-credit certification are two ways to design for different scenarios.
The WiFi company is not unfamiliar with the micro-letter: connect WiFi to pop out the authentication page, select a micro-mail authorization, and log in on one key. This approach is almost zero for users, takes up a mobile phone, and the certification process allows us to access the micro-mail OpenID, which businesses can use to make accurate marketing or trace.
The system uses a micro-mail sweep or authorization to get information directly from the members of the enterprise’s micro-letter, without having to enter any more account code. This is particularly appropriate for an enterprise that has already used its micro-mail as an office portal, and an application solves all problems, so that employees do not need to keep any additional login information.
The logic of nail certification and fly book certification is similar to that of company micro-credits, which are suitable for companies that have already used nail or flybooks in depth. Both types of certification are more useful in Internet companies and technology firms, because the employees of these companies themselves work on nails or fly books every day, and it is logical to use this entry to access WiFi.
Network Level Certification Group: a vision for dumb terminals and high safety
As mentioned in the previous article, LDAP certification and PEAP-SIM are highlighted here.
LDAP certification is used to interface with the enterprise ' s AD domain. The Windows domain environment in an enterprise is at the bottom of the LDAP protocol.Network access certification systemIf you can directly connect to LDAP, then it means that the account number is already in AD when the staff joins the domain, and WiFi authenticates directly with an AD account, without the need for a separate user database.——Either you can read it only, or you have problems with the compatibility of the new version AD, or the delay in synchronisation is too high to make your user experience worse. The NatShell platform supports LDAP two-way synchronization, which is relatively complete in domestic manufacturers.
The PEAP and EAP-SIM are the operator-level certification methods, with few contact with ordinary people, but they are not an alternative to a given scenario. For example, the operator’s base station is connected to the company’s WiFi network, which is used for SIM card certification, and PEAP/SM certification is the only way to interface.
Special scene groups: addressing the problem of the edges
The remaining three are specific scenarios: MAC Seamless Authentication, Seamless Authentication, third-party data source authentication.
MAC NATHELL_SEAMLESS_AUTH addresses a very specific pain: each time WiFi is certified, it is cumbersome, but security controls are disabled if not. The MAC NATHELL_SEAML_SEAMLES_AUTH process of NATSHEL_BRAND is that after the first manual authentication success of users, the system records the terminal ' s address and corresponding accreditation status, followed by automatic requests for certification from AC when re-accessing the terminal, which will determine that MAC is released directly during its lifetime. Users do not know about the authentication process, but have records at the back desk. This function is particularly relevant in a situation where the office environment is fixed and staff mobility is low.
Second Seamless Authentication is another idea: after a user first authenticates for a certain period of time, every access passes automatically during the specified period; it needs to be re-certified only after the validity period. This validity can be set by hours, days, weeks, or depending on the group of users. For example, visitors have two hours, internal staff 30 days, VIP visitors 7 days and individual strategies.
Third-party data source authentication is the most flexible type. It means that the certification system does not maintain its own user database, but rather search third-party data in real time for judgement. For example, hospitals can use HIS databases as a source of authentication data, new staff are placed on HIS, and WiFi certifications provide real-time access to the HIS database, release it when found, decoded account numbers and WiFi automatically fail.
The way you authenticate is not an advantage. You can use it.
So much, not to say that the business needs these 12 ways of authentication. In fact, the more time it uses, the more complex the system, the higher the cost of carrying a leg. Most companies use real high frequency, focusing on text messages, Portal accounts, 802.1X and micromails.
The problem is not.Network access certification systemHow many types of support can be supported, but when you actually deploy, do you spend enough time collating: which kind of terminals are in business, which scenes need to be controlled, which ones need to be convenient and which systems already exist?