Many ask what means of authentication WiFi supports, thinking that it is a text message and account code. In fact, mature certification systems support more than ten different ways, and the logic behind each method, security levels, user experience are different. Knowing which options are one thing, knowing when to use is the key.
Take the NATSHEL_BRAND V7 certification system, for example, to complete it.
Account password authentication
The most basic approach is the user input account numbers and passwords, which are then cleared after system verification. A set of settings suitable for the user community to fix, administrator uniform issue numbers such as company employees, school teachers and students. The disadvantage is that the code is easily forgotten or shared, and several items of an account number are used simultaneously, a problem common in actual deployment. V7 supports setting up single-account units online at most, exceeding the one that kicked out the first login.
Text authentication
User fills in the cell number, sends down a system authentication code and checks to be online. The biggest value is real name——The cell number is a real identity and can be traced to the public security NATSHEL_LOG_AUDIT.
A common error area: SMS authentication is not safe because cell phone numbers can be filled in. In fact, SMS certification is not secure."- It's not a cell phone."And it's..."I'm gonna leave a trace of the Internet to the real phone number."This is the bottom line for public security auditing compliance.
Micromail Authentication
Users complete their authentication by micromail sweep or micro-public, without the need to fill in the account code or wait for text messages. User experience is best in all ways.——Cleaning up is the end of the story. It suits hotels, malls, scenes like this one with a high level of micro-broadcast.
But a prerequisite for micro-credit certification is that it needs to be public and the process should go into the micro-trust ecology.
APP authentication
The business micro-letters, nails, flybooks are all supported as a certification portal. An employee opens an APP, scans it or confirms in the APP that he/she completes the authentication and is suitable for an enterprise already using these office systems.
LDAP authentication
Connect to Windows domain certification, using the AD area account. The typical scenario is a organization with a Windows field such as an enterprise, government agency, and higher education institution.
One thing to note is that LDAP docking requires a seamless network between the authentication server and the AD domain server, and that the LDAP portal needs to be opened by the AD domain server. This sometimes comes with obstacles in units with strict network security strategies, requiring early coordination of network privileges.
MAC Seamless Authentication
After the first manual authentication by a user, the system records the MAC address of this device. The equipment is then re-connected and automatically recognizes the MAC, which is exempted from certification and released directly, and users are completely unaware of the existence of this authentication component.
The fixed user scene is well used: employees of the company work daily, hotel guests stay for several nights and students in the campus go to their dormitory every day.
Note that the MAC validity period is set. If the valid date is too long, the employee leaves the equipment on a white list and continues to be connected if IT cancels it.
Second decertification
Similar to the MAC's unconsciousness, but somewhat different in judgment logic. Users reconnect after they have been downlined during active life, and the system automatically releases.
802.1X Certification
802.1X is based on a network port authentication, which is not accessible through the portal and contains data. The highest level of security is appropriate for a strictly web-security scenario: financial institutions, government intranets, core R&D environments.
The deployment of 802.1X requires network equipment and client configuration of the authentication client (Supplicant), with a much higher threshold for transport than Portal certification. For small and medium-sized enterprises without safety teams, 802.1X often fails to keep up with it and is prone to a large number of unusual connections that cannot be solved.
PEAP and EAP-SIM certification
These are higher security certifications, mainly in the context of high-security requirements for 5G networks, object networking, and financial institutions. PEAP supports high-level security certification for mobile terminals, and EAP-SIM is one of the most difficult ways to forge in theory. Both approaches are not used much in ordinary businesses, but are necessary in particular industries.
Double factor authentication
The code for the account plus mobile phone is one factor that cannot be certified. It suits the highest security level: banks, government core systems, high-security enterprises. The disadvantage is that users experience relatively cumbersome, requiring two steps at a time to log in, and it varies from one step to another for ordinary employees. If you have an average office area, there are a bit of over-designed double factors.
Third-party data source authentication
This is the most flexible way to connect to any third-party system: a cartoon system (campus/enterprise), an OA system, human resources systems and even custom databases.
Typical scenario: students in schools have a school number plus a cartoon certification, with accommodation buildings, libraries and canteens having the same account number; workers in factories have a work card certification, attendance system and network certification.
How to choose, from a few practical questions.
Is the user fixed or mobile? Fixed users (staff, students) fit account codes, LDAP, MAC unconscious; mobile users (hotel guests, shop visitors) fit text messages and micromails.
How much security is required? The common office account code plus the MAC's insensitive are sufficient; high security requirements are coupled with a factor or 802.1X; and top level EAP-SIM or EPAP.
Do you have a system of account numbers? LDAP for AD domain; APP certification for enterprise micro-letter/clinic; and a cartoon or OA to access third party data sources, so stop creating a new account number.
Users' experience is a priority or security priority? The best MAC insensitive experiences; the best double-factor safety; text messages and micro-letters. Different areas can be mixed, staff areas use LDAP plus MAC unconscious, visitors’ areas use text messages, as long as authentication strategies are well located and there is no interference between them.