The WiFi has a long history of requiring real name certification, but there are not many hotels that actually have a solid WiFi network real name certification system. Many hotels have a virtual accreditation process.——Either the front desk has registered identity cards but the back desk does not link them to online behavior, or the system is old and the log format does not meet the authorities’ requirements. As inspections intensified, hotels began to re-establish the system in these two years.
PMS docking is a core challenge.
The hotel has its own PMS (Property Management System, Hotel Management System), which is built to handle guest room status, in-house information, checkout times."User access to WiFi and check-out"This is the best way to comply.
But in reality, the PMSs are used in various ways domestically, with old hotels using systems that were several decades ago and interface formats privately owned; hotel chains have a unified system but branch privileges limited; economic hotels may not have any PMS at all, and Excel keeps the front desk. Certification system providers can access PMS models only if they are out of support lists, either custom-made development (time-consuming) or downgraded options.——The front desk manually opens accounts for guests.
The manual opening of accounts raises new problems in operational practice: the operation of front desk is irregular, multiple manual openings to the same room lead to duplicates of accounts; customers forget to write off and account numbers are used by other people on the same floor; when security incidents are traced, the number of the system's entries and the actual guests are not matched. These problems are all hard-on during inspections.
Deepness requirements for entry and identification
It's not enough to just have a customer fill out the cell number for authentication."Real name"Request."Real name"The core is to tie up the Internet and the real identity."Real identity."The problem is that the identity card information is usually entered in PMS at the front desk, but this information and WiFi certification system are mutually exclusive, with most hotels breaking up two sets of data.
Some WiFi network real name certification systems support physical identification of the public security population bank, and users enter names and identity numbers on Portal pages, and system backstage calls to verify authenticity. This programme is more compliant, but there are two problems: one is that interfaces require qualifications and general hotels cannot be obtained; and the other is that foreign travellers do not have internal identity cards and need alternatives for passport authentication.
The compromise option is to scan IDs at front desk registration, synchronize document information to the authentication system, and then assign a temporary account number (usually a combination of room numbers + PIN codes) to customers, which they use to authenticate when they are in WiFi. This program reduces friction between their own input and ensures that authentication and identification information are associated. But this process has high regulatory requirements for front desk operators, and there is a instability in the operation of hotels with large mobile staff.
Multilingual Portal page problems
Hotels for guests, Portal pages, need to support multilingualism. This demand sounds basic, but in practice many of the WiFi real-name authentication systems are supported by hard encoding several language versions rather than a true i18n framework. The result is that the Chinese version has been updated and the English version is still old; the Japanese layout is out; the Arabic version does not have RTL (right to left) typesetting support, with all characters disorganized.
Even more problematic is the fact that Portal usually has to display service agreements and privacy policies, which are very long in themselves, with multilingual versions of maintenance costs. Many hotels have a practice of being bilingual and other language guests only reading English. This approach is less likely to be complained about in practice, but compliance concerns a risk if there is regulatory requirements.
Trans-story roaming and certification interruption
Large hotels have large and large floors, with heavy AP coverage, and the equipment often travels between APs when customers move between corridors, elevators, restaurants, and swimming pools. If WiFi’s network real name certification system is not maintained for roaming sessions, each trip triggers a recertification, and the guests are re-scanned for several steps in the corridor, which is disastrous.
The solution is to bind the session at the level of the authentication system, and to bind the authentication status to the user MAC address instead of with AP."This MAC has already been certified.", the authentication server is released without triggering Portal processes. This function is not technically complex but requires support from a certification system and an agreement between ACs, and compatibility under different brand combinations needs to be tested in advance.
There's also a situation where customers use multiple devices.——The mobile phone is certified but not on a tablet, or has changed the cell phone."Same account number multi-equipment"The location, and the decision whether to allow it to be online or not, is limited if restricted. This configuration varies from place to place, and hotels usually need a little more relaxed (as business guests may use both mobile phones, tablets, notebooks) before being configured and confirmed by operators.
Integrity and authenticity of the compliance log
The logbooks of hotels are a key focus for the regulatory authorities. Compliance logs need to include: user real identity (cell number/document number), MAC address, IP address, Internet access time (precise to seconds), and target URL or IP (at least IP field on the public network).
The reality is that many systems have a lack of target URLs in their logs, which only record source IPs and time, without the targeted address. This is because complete traffic mirrors require higher-specific hardware, and involve much more sophisticated and costly technical decrypting of SSL flows. Most hotels choose to record DNS queries instead, but there are gaps between DNS logs and actual access to URLs, and many regulatory settings are not recognized.
Log integrity is also a problem: system time synchronization. If the system time of the authentication server and log server is not synchronized, the same access behaviour may vary for several seconds or even minutes in different logs. This difference can cause confusion at retroactive origin and seriously invalidate the log association analysis. It is recommended that all log-related servers configure NTP synchronisation and regularly verify time consistency.
How do we handle the check?
When the authorities check WiFi compliance, a few things are usually done: live WiFi to see whether Portal pages are popping properly, if there is a service agreement and if the operator shows them; recent logs to sample several records to verify authenticity; to see whether log storage times meet requirements (usually requiring at least six months ' preservation); and sometimes to request on-site demonstrations of Internet records that specify IPs based on a given time.
The core of the WiFi network real name certification system is not how advanced the platform itself is, but whether the details are processed.——These four are basic requirements. If they do, most inspections will be fine.