The school has two original aims for the WiFi network certification system: first, to meet compliance requirements and second, to control students' online behaviour. Both are right in direction, but achieving this is more complicated than many IT managers expect.——A certification system alone often fails to achieve the desired control effect and requires a combination of certification, billing, behavioural control and parent notification modules to function.
What's the speciality of a web-based subject in school scenes?
The school network uses different groups and business places——The user identity is fixed, and most students with a school degree can be tied to the account number without requiring each recertification. This fixedness enriches the administrative dimensions of the certification system: it allows for sub-classing based on a school number, different grades, different accommodation buildings with different hours and bandwidth limits.
The fixed user group also poses a problem: students will try to bypass the restrictions. Agent tools, VPNs, and shared accounts, are quickly distributed among the student population as they deal with controls. A certification system that only IPs and account numbers bind limits is difficult to achieve real control, requiring additional mechanisms such as MAC binding and behavioural testing at the certification level.
Account management and cadets docking
SchoolWiFi web certification systemAccount management, ideally with the PAS. At entry, the SAS creates an account and the authentication system simultaneously generates a network account; at graduation or drop-out, the SAS cancels the account number and the SIS is disabled."Graduated students"The account number remains in the system as a security risk.
In this case, there are several common alternatives: a regular export of the API data files and manual import of the authentication system by IT personnel; an intermediate layer between the ACI and the certification system to process data format conversions and synchronization; and a database view (record-only) requiring that the accreditation system be able to read the API.
Either way, clear synchronization frequency, conflict-handling rules (who has higher priority when the accounts of the registry and certification systems are not in a consistent state) and an unusual warning mechanism need to be defined.
Time control and bandwidth distribution on the Internet
Time control is one of the most frequently used functions in school settings. The ban on access to residential areas between 10 p.m. and 6 a.m. is the basic requirement for many boarding schools. The time control of the certification system requires several points: restrictions can be set by the accommodation block, without affecting the teaching area at all; when restrictions come into effect, online connections should be broken instead of waiting for their next authentication; and there must be an operating log to avoid being modified without going back.
The bandwidth distribution is also a major issue in the school landscape.WiFi web certification systemIt's a traffic control that works with the network equipment.——Control of the certification system itself"Who can access the Internet, when?"QoS Control"Whose traffic priority is high?"The combination of the two would allow for fine management.
Governance of equipment binding and shared accounts
Shared accounts are a persistent problem in the management of school networks. A single account is shared by many students, not only consuming more bandwidth but also causing problems with accountability.——The incident did not know which equipment was acting on.
The common means of preventing shared accounts is the binding of equipment: each account can only bind a fixed number of items (e.g. three), and the entry of an item beyond that number will be refused or prompted to untie the old device. This mechanism effectively limits the borrowing of the account, but it should be implemented with one question: students may modify their MAC address in the system settings of the equipment (MAC fraud) and rely solely on MAC bindings for which they are not fully reliable.
Use of Internet behavioural data and privacy boundaries
The logbooks of the certification system contain records of students’ online behaviour.
Reasonable use: Statistics of traffic trends in teaching and dormitories, judging whether network resources are adequate; identification of sources of unusual flows and screening for equipment to contract the virus for extensive outreach; statistics on the number of attempts to access the Internet during restricted hours in accommodation buildings as a basis for management improvement.
Unreasonable use: Specifically, to which websites a student visits as a basis for disciplinary action. Such use is legally and ethically controversial and the school faces considerable responsibility when data are disclosed or misused.
And the parents' notification system.
Some schools wish to automatically inform their parents when they do not have access to the Internet at night (for example, late in the evening beyond the time limit).——The certification system can be equipped with warning rules that can be communicated to parents by text or push at the time of triggering. But a few questions need to be considered before implementation: did the parents expressly agree to this type of notification? How would the particle size of the message be known? Is it reasonable (e.g., if a message to parents at 2 a.m. could cause even greater controversy)?
These details are technically easy to achieve, but design at the operational level requires joint discussions between school management, parent committees and IT teams and cannot be decided unilaterally by IT.
School scene.WiFi web certification systemUltimately, it is not a purely technical issue. Technology provides only control, how and to what extent and where borders are used, and requires clear norms at the level of school management systems that are targeted for their realization.