A mall, a school, a hotel, if you provide public WiFi, you can answer one question: What is the way to authenticate it? The right program, user connections are smooth, back-office data are clear and compliance checks easy. Wrong program, users complain about not being online, sending fireproofs, and the regulatory department interviewing.
Portal authenticationThe bottom logic of the mechanism is that, when a user connects WiFi, the browser will automatically jump to an authentication page and enter a cell phone number, authentication code or account password before it can be connected to the Internet. The bottom logic of this mechanism is that AC controllers or routers intercept uncertified terminal HTTP requests and redirect them to Portal servers, where the user completes the identification check on Portal pages, the Portal server initiates validation to the RADIUS server and issues line rules down to AC after they have been passed.Zero Client, the user does not need to install any software; the cell phone, tablet, laptop are authenticated. It is also obvious that the Portal page itself could be a target. If the HTTPS encryption is not enabled on the Portal page, the attackers can forge an identical fishing page and send the mobile phone code without knowing it. Another pain point in practice is Portal authentication.HTTPS Interruption Problem, modern browsers and APPs generally default to use HTTPS, and AC cannot redirect encryption traffic, resulting in users not having access to WiFi after they have access to an authentication page and requiring manual access to a HTTP address to trigger the jump. This is an unobstructed scenario at the user experience level.
802.1X CertificationThe end connection to WiFi requires the identification of the RADIUS server for access to the network. 802.1X supports a wide range of EAP subtypes, PEAP being the default selection in the Windows environment, using server-end certificates to create encrypted tunnels that can be authenticated by user input code on domain accounts.Security is much more than Portal certification.Support for encryption transmission, two-way identification, and anti-intermediary attacks are recommended methods of identification in the 2.0 level III system. But the cost is a significant increase in deployment complexity: PKI certification systems need to be maintained, terminals have to be configured with 802.1X parameters and IT administrators are more demanding. In such scenarios as university dormitories and office buildings, 802.1X’s first configuration experience often makes users look at it, especially students and staff from unskilled backgrounds, and its failure rate is high.
MAC CertificationThe idea is different: since it's too difficult to have a user enter an account every time, can you make the system remember the device? MAC certifies the end-of-pipe MAC address as an identification, managers pre-install the legal MAC address to a white list, and the end-link WiFi automatically compares the MAC address to the MAC address, so that the matching is done directly. Users do not sense the whole way, and don't even get out of the browser. This is very useful in the stationary settings, such as printers in offices, attendance machines, AGV cars, sensors, which are neither required nor suitable for Portal or 802.1X authentication. But MAC certifies one hard wound:The MAC address can be forged.The attackers can use the MAC address of their own equipment to access the network by using a fake identity when they smell the MAC address of the legal device. Therefore, instead of using it separately, the MAC certification is used as part of a secondary check or NATHELL_SEAMLES_AUTH.
WiFi, WeissLiThe micro-letter sends a confirmation reminder, clicks on it."One key to the net."The program is a double-edged project for business: both the WiFi certification problem and the private domain flow are settled. For users, it is fluid and does not require a mobile phone number or waiting to be certified, but WiFi has limitations: one must open the micro-mail platform and requires a commercial person to have a certified micro-public or small program; two are successful with a strong stability of interfaces at the end of the authentication service, which may fail once there is a limit to streaming or volatility; three are users who must install micro-letters and login, or visitors from abroad cannot use them without having access to them.
Text authenticationThe most public scene."Marvelous oil."The user enters the cell number, clicks to get a authentication code, enter the certification code, completes the authentication. This process is used by almost all people and has zero learning costs. And SMS certification naturally meets the legal requirements for public WiFi real name registration, the mobile phone number is in itself a real name information, and the authentication record can be reported directly to the Public Security Network security system.It's not low.Another risk is the stability of SMS channels, which occasionally jams operators’ SMS gateways, and users who cannot access the code to repeat it, experiencing a straight drop. There are problems with SMS hijackings, where attackers intercept the code through pseudo-based stations or SIM card clones, although this is a small probability event, but there is still a need for vigilance in financial and political scenes.
Back to the reality of selective decision-making, few scenarios follow only one certification.Mixed authentication is normal.A university may deploy 802.1X certifications in the teaching buildings and dormitories, Portal certifications in libraries and canteens, MAC certifications for instrumentation equipment in laboratories, campus wireless servers on the same set of RADIUS servers and user management systems. A mall may open WiFi and SMS certification to both micro-fi and SMS customers, with users freely chosen. A mature web WiFi certification system should allow managers to mix different authentication modes as needed and be flexible enough to match the needs of different regions and user groups. The system's structural flexibility ultimately determines whether the transport team can sleep safely.