The same web-based WiFi certification system, which is located in university dormitories and chains of restaurants, has a different problem. University dormitory units are closed three minutes before 11 p.m., thousands of people dial up their own numbering certificates, and the RADIUS server requests queues are filled at once.
School scenesThe challenge is to focus on three words: high density. A 10,000-sized campus, with its buildings, libraries, dormitories, canteens, stadiums and a wide variety of WiFi coverage needs. Students use a highly consistent pattern of behaviour: they pour into the building at 8 a.m., they gather in the cafeteria at 12 noon, they return to the dormitory at 10 p.m., each time node corresponds to a tidal eruption of certification requests.High-match delivery capacityThe RADIAUS server must use a cluster deployment, with load balance devices mounted on the front end and distribution of authentication requests evenly to multiple nodes. The individual node certification processing capacity usually varies from hundreds to thousands per second, but the campus landscape can be 10 times higher than the peak valley and is too expensive to support by stacking hardware. In practice, the most common optimisation means is to enable the certificate result cache: when the WiFi link is repeated in short time at the same terminal, the RADIUS server returns directly to the certifier results and saves the full authentication interactive process.
The campus network WiFi certification system is also typically designed to have multi-SSIDs. School and office areas are certified with 802.1X, and students and teachers are automatically connected after first-time configuration of certificates and accounts without having to operate. Public areas such as canteens and squares use Portal authentication, supporting text message identification codes and micromail scanning. The complex structure is based on a single identity data source, usually connected to the school ' s teaching system or a cartoon system, automatically creates an Internet account when students enter school, automatically cancels upon graduation and the status of contributions is linked to access rights in real time.Automation of account life cycle managementThe campus scene is the most diverse of the business scenes, and less so, managers handle hundreds of open-account work orders manually every day.
Business sceneThe focus is not on co-production, but segregation of powers. WiFi traffic in Treasury cannot be mixed into the R & D network, visitors' phones cannot access intranet servers, and attendance and surveillance cameras only need to be connected but not online.Identity-based access controlThe typical deployment scenario is to divide multiple SSIDs, each of which binds different authentication methods and access strategies. Office SSID uses 802.1X certification, matching enterprise AD domain controllers, employee login using a domain account, release VLAN and access control lists for the employee through the Radius server, financial staff automatically classified as finance VLAN, and research and development personnel as R&D VLAN. Visitors use Portal authentication, visitors enter mobile phone numbers to access Internet but only access to Internet exports and are completely isolated from the Intranet. The Internet-based SSID uses MAC authentication, which allows access to fixed equipment such as printers and time-serving aircraft only, and limits access to specific servers.
One of the most easily overlooked elements of a business deployment isCertificate Administration802.1X authentication relies on server end certificates to create encryption tunnels, the certificate expired without timely updating and the WiFi network was paralysed. Many enterprises deployed the WiFi certification system with a loss in its management, first using self-signed certificates that were valid for one year, and then one Monday morning after one year hundreds of people found that WiFi was not connected, and IT departments only took an morning to locate the certificate until it expired.
Business sceneThe primary objective of the WiFi certification system for commercials, hotels, restaurants is not security and control.Flux and retentionThe user-connected WiFi process is itself a marketing opportunity. The microwiFi program is almost marked in this scene: users click"One key to the net."The commercials can also be used as advertising places. The malls can display their seasonly promotions, branding activities, each of which is branded as a brand exposure.
The business scene also faces a problem of less concern on campus and in the company:Public Security ComplianceThe public WiFi provider is required to certify the user’s name, as required by the cybersecurity law. The local market WiFi certification system requires real-time uploading of real-name information such as connection with local security netting systems, cell phone numbers and authentication times. If the system breaks or fails to access the interface, the real-name information may be subject to administrative sanctions. In practice, this chain is more stable than the certification function itself, and the first standard for receiving and inspection of many commercial WiFi projects is not a certification success rate but rather a complete and timely rate for uploading the real-name message.
Government and medical scenesThe security level is set up on a further step. The three-tier system, which covers insurance, requires two or more identifications, with logs retained for no less than six months and key data for offsite backup. Government Administration WiFi usually uses the structure of physical isolation from internal and external networks: Office Inner Networks are certified using 802.1X plus EAP-TLS certificates, and terminals must have digital certificates issued by units to access them and be verified both in terminal and network; visitors to Public Areas WiFi use independent Internet exports, completely disconnected from the Intranet, and visitor authentication and office data are physically segregated. On this basis, there are additional patient privacy protection requirements in medical institutions and the logs generated by WiFi certification systems that contain patient-related information require desensitivity and encryption storage according to personal information protection law standards.
The deployment of the WiFi certification system is not a set of configurations. To be able to handle it together, businesses must have access to their rights, businesses must catch traffic and government should be secure.