Industrial parks are a typical application of the WiFi network real name certification system, but they are more complex than schools and hotels. This is reflected in the fact that companies with multiple independent legal entities live in them, each having different network needs, management competencies, compliance obligations.
Conflict between multitenant segregation and uniform certification
The industrial park has a basic need: the WiFi of the public area (circles, corridors, conference centres, canteens) is managed in an integrated manner, but the WiFi of the tenant's office district is segregated and tenants A's staff are not able to access the Inner Network of Tenant B.
This requirement makes a special requirement for the structure of the WiFi web real name certification system: the authentication platform needs to support multi-tenant models, with separate accounts, stand-alone Portal pages and independent access strategies for different tenants, while public area certification is uniform across the campus. Most small and medium campuses have no such design, only one single certificate, all users take the same Portal page, and then go into the same section after certification has been successful.
The structure is ostensibly functional, but there are several hazards: first, that visitors to tenants have theoretical access to VLAN equipment throughout the campus after certification in a public area; secondly, that managers of different tenants cannot view user authentication records from their own businesses at the backstage and only IT from the park can see it, which is not enough for an enterprise requiring independent compliance audits; and thirdly, when a tenant requests customizing Portal pages (e.g. adding his own Logo), the system does not have multiple tenant brand customization capability.
The actual multi-tenant segregation requires a certification system to support VLAN-based certification, which automatically is assigned to the corresponding VLAN on the basis of the certified user's own tenant, while limiting cross-tenant communication through strategy. This programme has high requirements for web equipment and versions of the authentication platform, with no need for this requirement in the procurement reference phase, and the cost of retrofitting it at a later stage is not low.
Residency management account requirements
The campus operator usually has only one small IT team, and it is not possible to manage the account for all tenants.
This requirement is not technically complex, but many systems have flat backstage rights design, either superman or regular viewer. No."Tenant-level Manager"This role. The result is either to give super admin privileges to the tenant (insecure), or all operations are stacked in the park area at IT (inefficiency).
The system needs to support Excel or CSV batch imports, preferably from AD/LDAP. But the functionality is improved by a wide variety of vendors, some systems support import but not synchronization, and accounts change will be manually operated.
The speciality of the visitor accreditation process in the park
There are a lot of visitors in the estate every day.——The ideal way to authenticate visitors is to receive scanning visitor identification (or enter a mobile phone number) at the front desk, automatically generate a temporary account for a limited period of time, and with this account authentication, visitors have access only to the Internet, not to the Intranet, and are unable to access it.
The process is technically mature, but there are several friction points in practice: what is the front receptionist operating system (computer, iPad, mobile phone)? Is there a cleanup gun at the reception desk? Is there a temporary account number for texting visitors or printing out? Do you have access to every entry platform in the park? These details are often not discussed when the system is selected. It only comes online when it is available that the front desk of an entrance is using an iPad interface, and the system has only PC interfaces, or if the SMS channel is not open, it is impossible to send the account number.
Another problem is the management of construction personnel’s accounts. The construction team may work in the park for several months, have to access the Internet every day, but it has high mobility and changes in the list. If a temporary account is used, there will be a heavy workload of opening new accounts per day; if an old account number after a change in staff is kept in the system, it will be a security risk.
Extension of the park or access to new blocks
Many industrial parks are built in stages, one on-line and two and three on a continuous basis. Each new block access requires the incorporation of AP and network equipment into the existing certification system. If the authentication system does not have an extension interface in place when it is first online, each access to a new block will require a larger renovation effort and sometimes even an upgrade (the system pays for the number of APs or users, with additional costs associated with expansion).
This question is clear in advance of the signing of contracts: are the authorized model to be issued simultaneously or as a number of APs? What are the costs of future expansion? Is hardware nodes supporting horizontal expansion? If systems are structured single-node and when they reach their maximum, they can only be replaced by hardware instead of adding nodes, the cost of extension would be high.
Connected to the restricted doors and visitors management system
The top-end industrial park usually has a door lockup system and a visitor management system (VMS). When visitors visit, they register in VMS to generate two-dimensional codes that can be used to access the gate.
This type of access scheme has high end campuses, but is not costly. VMS and certification systems are usually products of different suppliers, requiring both parties to open interfaces and coordination of interface formats and competency models. If the two systems are not delivered by one integrated provider, interface coordination often takes a lot of time. Sometimes the last landing scenario is a manual compromise: when the front desk registers visitors in VMS, it manually opens another account number in the authentication system.
Data sovereignty and cloud issues
Some new industrial parks were built with the selection of SaaS-based WiFi certification platforms, and there are cloudy authentication data and logs. The program is simple and low-cost for deployment, but companies that require sovereign data (e.g. affiliated enterprises, financial institutions) will refuse to be in place because their employees cannot have uncontrollable clouds online.
The form of deployment of the WiFi network real-name certification system (local servers, private clouds, public cloud SaaS) needs to be thought out at the recruitment stage because it directly affects what types of enterprises can be introduced. It is not unusual that a purely SaaS programme campus has been selected and a firm with stringent data compliance requirements will have to be introduced at considerable cost for structural changes.