SMS authentication codes are one of the most common assistive authentication tools in WiFi certification systems, which is almost impossible to bypass under Portal certification. But this is what seems simple, and it may be more than a piece of paper that has been stepped on in actual projects than the authentication agreement itself. SMS access is not well chosen, and costs eating up your months-long budget for dhows; arrival rates are poorly controlled, and user complaints can crush the customer service team.
Which one of the SMS channels is not so simple as to see a single price?
I was stupid when I first got in, and I took a bunch of SMS service providers' offers against the unit. And then the second week on line went up to the problem: every day at the peak of 5-7 p.m., text messages fell from 90 to 60 direct. Users filled out their cell numbers without the code, and they called them several times."Reassign"Eight certification codes were issued within 10 minutes for the same cell number on the back desk, and none of the seven requests were received.
Later on, I realized that the rate of access to SMS channels was highly correlated with several factors: operators (mobile, connected, telecommunications) had different quality coverage, customs resources in different provinces and peak periods were more than natural. The route you chose might have a high arrival rate for mobile users, but telecommunications users were poor. The unit price was cheap, but if you could have 30% of them without the code to get it, that cost would be meaningless if you failed.
So when I did the WiFi certification system project, SMS channels were selected for at least two backups and they were asked to provide a report on their arrival rates according to operator dimensions. There was also one more thing: automatic switching logic in text messages channeling in authentication systems. If the user does not submit the code, automatically switch back-up channels again within 15 seconds of sending the first message. Both channels use different signatures and different code numbers to reduce the probability that they will be intercepted simultaneously.
The security of the authentication code is not just blast-proof.
Speaking of the security of text message authentication codes, most people think about preventing violent cracks.——The same cell number limits the number of deliveries within a short time, and the same IP limit the frequency of requests. These are basic operations, but they are more than just security concerns.
Once we had a security audit, we found that the SMS signal transmission interface was being watched by a script. This script did not break the same cell number violently, but used hundreds of different cell numbers, each requesting only one. Because each cell phone number is sent once and the frequency limit is simply not stopped. It does so to cover the cost of texting.——We'll just brush our text lines and sell these cell numbers to the data black.
We added two additional safeguards. One is a graphics validation check before sending the authentication code, blocking automatic scripts with slide-based verification. The other is to introduce behavior analysis: change the password for cell phone numbers at short notice by the same client and require real name authentication before triggering wind control rules.
And one easy to ignore is the validity and re-entry strategy of the authentication code. Some WiFi certification systems have default validity for five minutes, which is no problem in a good signal setting, but in some remote areas it may take a minute or two for users to receive the code, and one or two more minutes for input, easily expires. We later extend the validity period to ten minutes, but we keep the interval between tests.——The first re-resign takes 60 seconds, the second 120 seconds. This is a balance between experience and security.
Cost control is not just about the cheapest way.
SMS costs control is a matter of fine flow. A WiFi certification system with an average daily authentication of 3,000 times, if each certificate code is calculated at five cents, it's 45 million per month alone. Over 50,000 in the next year. That figure is not big, but if you can optimize that by cutting 30 or even half of it through some strategy, it would be a real cost to the operator.
We've made a few improvements. One is introduced."Trust equipment"Concept: The same device has been certified three times in a row, and the next authentication will be replaced by a click confirmation, which will save the cost of text messages directly. Another is to direct fixed users such as internal employees to scan or certificate certification, thereby reducing their reliance on texts altogether. There is another easy to ignore optimisation: weighting in the authentication code sending interface. If an unexpired authentication code exists, the same mobile phone number within three minutes will simply re-use the original authentication code instead of reissue one.
After these optimizations, we have calculated the cost of texting a project, which is about 45 percent lower than the baseline that does not. It saves money for use elsewhere, more than anything else.