The biggest difficulty in the WiFi certification system project for a chain of firms is not often technical selection, but rather to figure out how much headquarters is and how much the door shop can handle itself. Too many controls, the door office IT has no authority to deal with local emergencies, a small problem goes down to headquarters, and it's cool to go through the process. Less rules, different store standards, and security incidents are completely unknown to HQ. This is a bad cut, and then the system is on line with endless skins.
Uniform or hierarchical, with clear accounting.
First, a decision: whether to place certification in the headquarters or the door shop? The advantage of being at Headquarters is that it will be strategic, secure and manageable. All users return to the WiFi certification system node at Headquarters, where they keep AP and AC as authentication agents. The problem is that if the line between headquarters and the door is broken, WiFi becomes a setup.——All users are unable to certify, including the shop ' s own staff.
The advantage of being at the door shop is that it will be network autonomy, even if a dedicated line breaks off the local WiFi. But the problem is also clear: the local store’s certification log and audit records cannot be traced back to headquarters without timely uploading them.
We later adopted a hybrid approach: the decision logic of authentication is placed at the central node of headquarters, but there is a local cache policy on each store AC. When the line is normal, the certification request goes to Radius; when the line breaks, the AC automatically switch to the local cache validation strategy——Only the equipment in the white list is allowed to access and export bandwidth is severely restricted. This guarantees minimum business continuity in case of a network break, while security risks are kept within acceptable limits.
Headquarters' strategy is to be grey and roll back.
One of the biggest risks to Headquarters is that if a wrong global strategy was sent out, all the shops were affected. This is no joke. Once we changed the time spent on a Portal certification backstage from three minutes to one minute in order to upgrade security. The next day, the doorkeeper blew up: many elderly customers or parts of the network with bad signals had never been able to complete their accreditation process at any point.
The lesson led us to add two insurances to the WiFi certification system strategy. First, it was released as a greyscale: any changes in global strategies were implemented at several pilot shops, after observing no abnormal complaints for 24 hours before they were gradually rolled back to sector stores. Second, one key rollback: all changes of strategy were kept in the previous version and when an anomaly was discovered, the department could roll back to the previous state on the backstage at one key, without having to log down to the shop.
The local administrator's boundaries need to be clear.
The store has a local administration that needs to handle the daily security.——For example, helping clients with Internet access problems, adding a visitor account on a temporary basis, and checking the store's authentication log. But there are more privileges and perhaps misapplications; less, everything has to be done by headquarters, too inefficient.
We have a role-based classification of competencies. The doorman can see all the store's certified records and equipment, create temporary visitor accounts (which are valid for up to 24 hours), and reboot the shop's AP. But he cannot modify authentication strategy parameters, export logs that exceed seven days, or delete any audit records. All store manager's operating logs upload to headquarters in real time, and any ultra vires operation is automatically alerted.
The system of privileges took a lot of time to design, but it worked well online. The door office has enough autonomy to handle day-to-day problems and the headquarters doesn't have to worry about people running things down there. After all, the core contradictions in the multi-branch WiFi certification system are not technical, they're managerial.——You have to give every level their rights, and they also have responsibilities. Add a more easily overlooked detail: the network environment between branches. Some use corporate broadband, others use ordinary household wide, or even 4G/5G CPE as an export. The most extreme situation we have encountered in the project is that one of the three broadbands has been taken by a door shop to balance loads, that one user's request for certification may go through different exports, and that source IPs seen on the Radius server are constantly changing and almost being intercepted as an attack. So multi-branch structures do not just consider the hierarchy of regulatory powers but also the specificities of each branch network environment, leaving enough flexibility in the network strategy of authentication systems. Also, multi-language support and localization of Portal pages are a necessity in the context of a chaining environment, especially with regard to foreign hotels or joint ventures. The certification page should at least support bilingual Chinese-English switching and the SMS transmission channel during overseas visits must automatically switch to international lines, otherwise customers abroad will not receive their authentication codes.