How far does WiFi certification system go to be compliant? Many operators are still understanding that"Users need a real name for online connection"But real compliance is much more than that. In particular, Public Security Order No. 82 and the Cybersecurity Act have clear requirements for keeping a log, and not many of these things are actually being done in the project.
Clear regulatory requirements first, and then how to do it.
What's the core requirement for public security compliance?
According to Order No. 82 of the Ministry of Public Security, places providing Internet access (including hotels, cafés, airports, businesses and other places where WiFi is open) must record users ' logbooks for a period not less than six months and can cooperate with inquiries by public security authorities.
The core fields in the log that need to be recorded include: time of access by users (upline, downlink time), true identity information by users (phone number or other real name information), end-of-life information (MAC address, IP address), target accessed by users (URL or IP address).
Watch out for this."Real ID information"If you use the WiFi authentication system for text messages, your cell phone number is a proof of compliance.
The logs are six months old, and it's not just that."6 months."
The mere starting point is six months of savings, and several conditions are easily ignored.
First, the log cannot be tampered with. If a log is in an ordinary MySQL database, it can be modified manually by the administrator, which is not compliant. Compliance is done by allowing no changes after the log has been written, only additionals are allowed, or separate storage using a dedicated NATSHEL_LOG_AUDIT system.
Second, the logs are searched and exported. Public security does not want you to get out of the database, but to be able to quickly search it in readable format by time, cell number or IP address. The logs are stored but cannot be checked, and they are virtually non-existent.
Some provinces require log systems to be able to access local public security audit platforms, regularly upload summaries or support real-time queries.
What about the NatShell NATSHEL_LOG_AUDIT scheme?
The log-collection module is installed in the V7 authentication system and automatically records these fields after certification has been successful. But the certification system alone is not enough, as the certification system can only record"Who's on the log?", to record"What did you visit?"There is also a need for the Log Audit gateway.
Specific architecture: NATSHEL_AUTH_GATEWAY is responsible for identification and user access, NATSHEL_LOG_AUDIT equipment is deployed in export locations, traffic mirrors or internal grab packages are made, user access behaviour is recorded. The logs of the two systems are linked to the user's IP or MAC address, and they are returned"Who's using any cell phone number at what time?"This is the map.
The NATSHEL_LOG_AUDIT interface is also completed by the system, which has a nationwide network monitoring platform and a local interface agreement with public security systems. This docking process is not minimal and does not automatically operate when equipment is purchased.
Local deployment and cloud storage options
Where does the log exist? Two mainstream options: local storage and cloud-end storage.
The advantage of local storage is that there are no data sites and the manager has full control; the disadvantage is that local servers need to be maintained, storage space needs to be planned. Six months of logs depend on the size of users, 500 of which produce hundreds of MB logs per day, and six months from now it takes dozens of GBs to hundreds of GBs, not so big for storage, but with respect to the maintenance of a carrier, server hardware being checked regularly and backup mechanisms in place.
The advantage of cloud storage is that it is flexible and does not require local hardware input. The SAAS cloud platform at NatShell supports cloud logs, which are collected in one place or another, the administrator sees all the logs on a backstage, and public security queries only need to open a platform. For such distribution scenarios as hotel chains, door chains, and so forth, cloud storage is obviously more economical.
However, there are industries or sites that have concerns about the cloud, especially government and military-industrial-related units, which usually require logs to be stored locally and not out of the country. Local deployment is the only option in this case, with dedicated log servers for storage in isolation.
The real name confirms the landing details.
SMS authentication is the simplest compliance method currently accepted, with mobile numbers being real names. But there is a boundary: SMS certification is for cellular numbers and does not verify whether they are personal. If someone borrows another person ' s cell phone number certification, the ID information in the log is for that cell phone number, not for actual users. How does this work in practical enforcement, standards vary from place to place, but technically it is already the bottom line of compliance for most current scenarios.
If a stronger real name is needed, such as airports and high-speed stations, it is usually used to verify double certification by text message plus ID: users fill in cell phone numbers and identification numbers, and the system checks for matching (combining public security real names). This approach is the most compliant but also the highest cost of reception, not easy for ordinary hotels or businesses.
Micromail is a bit more complex in the real name. The micro-letter itself is a real name, theoretically traceable, but it is actually possible to cooperate with public security inquiries involving the willingness of the micro-credit platform to work together, which is not controlled by the operator itself.
A few questions were often asked during compliance checks.
Where do you keep the logs? You need to be able to say, local server or cloud, specific storage location and backup strategy.
How long has the log been kept? Six months is the minimum requirement, and if you set a system for automatic clean-up for three months, it is not compliant.
If you can search the Internet at a certain time, the public order will check the logs of a mobile phone number.
Does the authentication have a real name? If you only have a password for the account number, there is no cell phone number or ID information in the account library, it has no real name and needs to be supplemented.
A risk point that can be easily ignored.
Many sites have WiFi certification systems, the real names are done and logs are stored, but no public security checks have been carried out. Log compliance inspections are random, undetected as non-compliance, and when detected, they are legally liable. Periodic self-checking of the log system ' s state, whether there is a full storage space, whether log writing has broken down or how many authenticated are, should be included in daily traffic guard inspections and cannot wait to check them out.