When you get a WiFi reform list from a hotel chain, the first sentence is:"We've been checked once before, fined and now we need to be corrected."That's the point of setting the whole project.——Not to function, to comply. After a few hotel WiFi certification projects, I found that most of the holes on which such projects were stepped were not technically, but yes."Compliance"Two words are misread.
Compliance criteria are not a document.
Many people mention the hotel WiFi's compliance, and first reaction is"Make it real."The Ministry of Public Security requires more than just identification, including: retention of the user logs on the Internet for a period of not less than six months, filing of network access providers and auditability of key equipment. Together, these four items constitute a complete framework for compliance.
I've seen a hotel program like this: the front desk has an ID number when you register for your residence, but WiFi connection is not certified and there are no logs. The guests use any equipment, what they visit, nothing. In such cases, even if you have an ID number, it is impossible to trace back."Who visited what equipment at what time?". If something happens, this data is worthless.
The first step in compliance is to find out what the subject of regulation is."Internet service providers"No, it's not."WiFi Device"As long as the hotel provides network access, even if it is an Internet service provider, a user identification registry will be needed to keep a log. This does not change because of the size of the hotel and the 50-room small hotels have the same chain brand as 500 rooms.
Common error area for authenticating a real name
When you do the certification, you get a problem: the hotel front desk says"The guest has already entered the house. Why do you still need WiFi certification?"This logic is itself correct, and the registration does capture identity information. But the problem is that the system of admission to the Register (PMS) and WiFi certification are two separate systems with no data links between them.
You know that room 101 is occupied by Zhang San, but you don't know if the phone connected to WiFi is three. The device attached to WiFi may be either Zhang San or his companions, visitors, or even people who are outside of the network.
The real compliance approach is to link PMS residential information to WiFi authentication: guests access the Internet using room number plus mobile phone identification code, certification systems record rooms number, ID number, equipment MAC, authentication time, downline moment, logs and PMS logs. In this way, every online record can be traced back to specific people.
Some hotels have been able to use their own names and ID numbers for a little bit of economy.——You can fill it out."Zhang San""Li Qi"The system has no verification capacity and such logbooks are ineffective at the enforcement level.
Technical details retained by the log
The logs are a weakness in many hotel systems. For six months, the data is quite significant for a medium-sized hotel. A 500-room hotel has an average occupancy rate of 60 per cent, 300 guests per day, with an average of dozens of online behavior records each, and hundreds of thousands every month. Six months is millions.
The log must contain fields: user identification (identity or authentication account number), equipment identification (MAC address), assigned IP addresses, authentication time, downline time, upstream traffic, downflow. If conditional, access to the target domain name or IP should also be recorded. These fields are not required and any missing field may be considered incomplete at verification.
In storage, many hotels use local storage and logs are stored only on AC devices or local servers. This risks: equipment malfunctions or power outages, which may result in the loss of logs. It is more prudent to have logs clouded or pushed to an independent log server while doing local backups, with two sets of storages being redundant.
There is another detail: the log time stamp must be accurate. If the clock is wrong, the time shown in the log is wrong and there will be problems with the timing line when checking it later. NTP clock synchronization is a basic requirement, but many small hotels have no NTP equipment and have no time to know it for an hour or two.
Cross-brand chains are difficult to comply with.
The WiFi compliance certification for the chain hotel has a special level of complexity: headquarters management, doorman execution, brand consistency. Headquarters wants to be managed uniformly, but the network varies widely from one door to another.——Some have built broadband themselves, some are hosted by operators and others have been using equipment for 10 years.
In this case, the difficulty of compliance is not so much in single-store design as in how to achieve uniform certification standards and log standards without harmonizing network infrastructure. One feasible option I have seen is that the accreditation system will be cloudy, with only one light gateway deployed locally for each door store, and authentication logic and log storage will be managed in a cloud. This allows headquarters to have a unified view of all the stores’ accreditation status and logs, which would require local equipment access.
But cloudization presupposes that the door-to-wind network link must be stabilized. If the door-to-door broadband is of poor quality, certification of cloud-dependent programs will have problems with high certification delays and lack of access to the Internet.
Acceptance criteria for modification projects
The difficulty is that the project will be different from the new one."Complete the renovation without interruption of service". Hotels cannot close down to make changes, but must operate on the side. This means that: old and new systems must have a parallel period; switch times must be selected for periods with low occupancy rates (usually working hours); and there must be adequate exit options before switching.
The acceptance criteria should include several dimensions: the technical level——Certification process accessible, log searchable and field complete; operational level——No significant increase in client complaints rate, front office operating process updated; compliance level——A complete system architecture can be produced to indicate how regulatory requirements are met.
Some hotels, once the renovation is completed, are willing to contact local cyber-security offices for an informal compliance check.
The WiFi compliance certification is not a one-time project, but a continuous operation mechanism.