The public WiFi-based Internet access service scenes offered by hotels are typical, and real name compliance is a prerequisite for being bypassed. But in actual projects, many of the network builders have a vague understanding of compliance boundaries: what information should be collected? How long will the logs be kept? Which certification is required to be compliant?
Main applicable current compliance basis
The basis for compliance with the public WiFi real name system in hotels is derived mainly from several levels: the requirements of the Cybersecurity Act for the verification of user identity by providers of public Internet sites; the requirements for retention of Internet logs under the Ministry of Public Security's Technical Measures for Security of the Internet; the requirement for the management of account number physical names under the Information Management Rules for Internet User Accounts; and local requirements for WiFi, a public place, issued by some local governments.
At the regulatory level, core requirements are concentrated on two points: first, that users must be authenticated before being online and second, that Internet logs must remain for a certain period (usually not less than six months).
Which certifications meet the requirements for real name
From an implementation perspective, the following types of authentication are more clearly appropriate for real name requirements: mobile phone number plus SMS certification (the cell phone number itself is registered in a real name), which is currently the most widely-compliant way; use of identification numbers to verify names and to match some high security requirements with authentication; and certification through hotel membership accounts, provided that the actual name has been verified by the time the member is registered.
The authentication of the micro-mails can be implemented by real names, but it is necessary to match the conditions for the completion of authenticated names with the account itself, otherwise only the micro-letter OpenID is obtained and does not amount to a genuine user identity.
Pure."Click on the Internet"The public WiFi setting is not sufficient for real names, even if they are more experienced and experienceably smooth.
Practical implementation standards retained by the log
Log retention is a vulnerable component of many hotels, usually considering only authentication functions and not planning for the storage and management of logs. From the regulatory inspection, the required logs include: user accreditation records (when, where and in what capacity to be certified); user behaviour logs online (target IP/domain name accessed, time stamp); user ' s web session records (equipment MAC address used, IP address, top-down time).
Log storage time is usually six months and some locality may be longer. Logs must be stored in a controlled system, not just locally but centrally managed, or history logs will be lost if the equipment is reset or malfunctioned.
Resident ' s access information and WiFi-certified data boundaries
The hotel has collected the identity information of its occupants when it is checked in. Many hotel IT personnel ask: Can you use the ID information registered at the front desk directly for WiFi certification and save residents from re-entering their cell phone numbers on Portal page?
The answer to that question is not simple."Yes."or"No, I can't."The use of identity information collected in the register is usually authorized for hotel operations (e.g. security responsibility determinations) and, if it is to be transferred to a WiFi certification site, residents need to be clearly informed and agreed on in privacy policies or entry terms.
From a practical point of view, it is more prudent to separate the in-house information from WiFi certified data stream and independently verify the WiFi authentication side by means of SMS code instead of directly reading PMS ID data. This would satisfy both the name requirements and avoid disputes over data authorization.
Foreign guests and non-cell certified border processing
SMS certification is highly covered in the country, but there are two special types of situations on the hotel scene: foreign residents, mobile phone numbers may be offshore and domestic SMS authentication services cannot send them; and some occupants may not have a cell phone or be unwilling to provide it.
For outside guests, the usual treatment is to produce a one-time authentication code (room number + temporary password) from the front desk for them, whereby the certificate record is tied to the entry information and meets the real name requirements. In the case of tenants who refuse to provide cellular numbers, the hotel can be handled by means of a membership account or temporary code; if the occupants insist on anonymity, the hotel should not actually provide WiFi access to them under compliance.
A few practical check points that comply with the self-checking
For sites where the WiFi certification system has been deployed, self-checking of the following check points can be performed on a regular basis: whether the authentication process did complete identification before users could access the Internet and there were no gaps in the authentication page that could be bypassed; whether the logs were actually recorded and filed on time without loss or interruption; whether the log queries function was normal and able to respond to requests for access within the regulatory timeframe required; and whether the version and leak patches of the system were updated in a timely manner, and the certification system itself did not become a security gap entry.
Compliance is not a one-time matter, but a continuous state of compliance in daily carriers. The system’s WiFi certification system is managed at the institutional and operational levels, not just technical deployment.