When universities do network adaptations, the two compliance requirements of real name certification and online log retention are always set aside."We'll take care of it later."The project was set up with concern about bandwidth, how the AP is distributed and how the authentication method works. The network was built and students were connected. Public security checked to see that the log system was not well-developed and the actual name certification chain had broken down."Start a function.", but it is to be connected from the authentication entrance to the log to the full link of the search.
Authentication: more than that"I know who you are."
The Public Security Order 82 requirement for authenticated names on the Internet can be summarized as follows:"Retroactivity"This is much more complicated to achieve in the campus on the Internet than in cybercafes or hotels.
First is the question of certification coverage. There are a lot of non-teachers and students on campus: academics attending academic meetings, parents working in the field, logistics outworkers, construction teams, couriers. You can't let all these people go."Get the information department to open a temporary account."The process is not allowed in time, nor is it realistic. But these people connect to the campus WiFi and their Internet activity is also retroactive.
The common solution is a multi-layer system of certification: students and teachers in schools take a uniform campus account (symbol/work), visitors go SMS or micromail scan, and temporary authorized personnel are replaced by staff members who generate the visitor code through the system.——Cellular numbers are also a real name mark, provided that your text-message channel gets the actual cell number.
There's a problem that can be ignored: one person for the terminal. A student uses his cell phone, notebook, and flat-board WiFi to produce three different records in the authentication log, but it corresponds to the same person. If your log system is recorded only at the end MAC address, without connecting to the data, public security requires inquiries."All online records of a student"And you have to manually search his MAC address. A good billing system should automatically be able to connect the endpoints, and all terminal behaviors under a user name are grouped together.
802.1X or Portal, accreditation affects log quality
The campus network WiFi web-based system supports two main types of certification: 802.1X and Web Portal. There are significant differences between the two approaches in actual name authentication and log quality.
802.1X authentication takes place before the network connection is established, and the user links to WiFi enter a password for the user name on the device (or through EAP-TLS certification), which allows the IP address to be obtained. The advantage of this approach is that the authentication information is tied at the web level and does not exist."Change of equipment after authentication". However, 802.1X requires client equipment, some old models of object networking are not supported and are more complex to configure than Portal.
Portal authentication (also called Web certification or Captive Portal) is a user that first gets a restricted IP on WiFi and opens the browser and jumps to the authentication page input voucher. This approach is compatible, almost all devices support it. But there's a problem with the log: Portal certification is particle size"One Web request", if a user does not turn off the browser and continues to network after authentication, he may continue online for several hours but only has one certification log.
The recommendations for physical landing are that the teaching and office areas be 802.1X, the dormitories are Portal (because of the number of types of equipment available to students), public areas (libraries, gyms) are supported by both users. The billing system is designed to handle logs generated by both certification methods simultaneously and is integrated under the same user identity.
Technical details retained by the log
The Cybersecurity Act requires that a logbook be kept for more than six months. A university of 10,000 size, with a daily logbook of behavioral Internet activity between hundreds and millions of items, depends on the particle size you collect."URL per HTTP request", the data will be counted; if only recorded"Authentication event+IP distribution log+DNS query log", the amount of data is much more manageable.
The key is trade-offs. Public security checks are usually not required"Which page did the user visit?"But..."What time period did this user get online, what IPs were used, certified?"The core is therefore to be retained: the authentication log (who uses what end to use for certification), IP distribution log (what IP was assigned after authentication success), session log (when online and when offline)."Full traffic records"One percent of the total, but it's already met the retroactive requirements.
On storage, it is recommended that a dedicated log server be used instead of mixing with the operating database of the billing system. The reason is simple: log data are more or less readable and have grown rapidly, using relationship-type data to store high costs and slow queries. Time series databases such as Elasticsearch, ClickHouse are better suited. Time-separated when written, query can be quickly searched by username, IP, time period, MAC address, etc.
How's the public security check going?
The security services usually check the university once or twice a year, and you are informed about some things before coming: authenticated coverage data, log retention system screens, random checks of several users’ history online."All Internet records of a specified user in the given time period"And this search response speed is critical.
If the system fails to do so, the notification of modification will hardly run. I have seen a case where a college log is in MySQL database, and one query takes two or three minutes, public security has been impatient to open the notice directly. They then went on Elasticsearch, and the same query became millisecond class, and the next check was successful.
And note that the logs are not just raw data, but have to be complete.——For example, regular Hashi checks the logs and separates the check values. This is a very dangerous thing to do when you look at them, although not every time.
Compliance is not a burden. It's the bottom line.
Many people think compliance is a..."Additional workload"But think differently: a perfect physical name authentication and log retention system is not just for checking.——Like a student's computer with blackmail virus or someone who has illegal information on the campus network.——You can quickly position yourself to a specific person and time line, which is the real value of compliance. When you choose the web-based WiFi system for campusing, compliance is used as a hard indicator rather than an option, and much trouble is saved later.