Many offices have a misperception of WiFi's real name, and all WiFi have to go through the strict identification system. In one place, there is a very different claim by staff members who are physically at home, with easy WiFi, ViP clients, and pure visitors who comply with WiFi.
The two models are different in nature.
The core of the real-name model is compliance, and to trace it to true identity, there must be collection and verification in the process. The core of the visitor model is easy, allowing the quickest connection. In a mall, customers come in to give WiFi a circle of friends, you let him upload his ID card and he moves; but the net visitor mode does not leave any real name and steps on the red line. So it's not one by one, but by scene: public areas are named outside, internalized, and certain partners go ahead with preauthorization. The WiFi real name certification system is to support multiple SSIDs, multicertification strategies and different regional models rather than a full-scale set.
SSID is the cleanest way to divide physics.
The safest way to coexist is to match different models with different SSIDs."Store_Guest"The blogger says:"Store_Staff"I'm going to go with the employee account."Store_VIP"The two-dimensional code for pre-authorization. Users are separated from the network level, and they do not interfere with each other. We basically use this approach to business and hotel projects, much clearer than to make a logical stream in the same SSID. Logical diversion has the advantage of less networking, but the bad side is that strategy can be easy to string and difficult to locate. Small and medium-sized sites can also be used as a single SSID role drain if their equipment is limited, but it must have strict logical boundaries and test coverage.
The visitor's mode needs to be known as a regularity.
Say it."Visitors mode is easy."The public WiFi, even if it is a visitor, has to meet the legal requirements for a real name, but it can be collected in a lighter way. It's usually mobile phone number plus authentication code, or micro-mail authorization with a real name (the letter itself is known). We stress that the visitors mode is just a simple one."Certification process is light"No, it's not."Exonym exemption". Design to confirm the minimum requirements for local supervision of visitors WiFi, and then to put the flow mode of visitors on that line without cutting down. Some units make the visitor pattern."Light it up and get it online."That's a violation. Control found the penalty.
Staff mode is to match internal identities. Don't repeat real names.
The problem is that some units’ WiFi real-name certification system only supports the same type of physical name, and employees are forced to take the code. In the scheme, staff SSID connects to internal identification sources, authenticates account codes or certificates, without text messages. Both models separate from the account number system but enter the backstage of a single real-name authentication system, which operates on a platform that is not used for retangulation.
The temporary vouchers and the 2-D code are the middle flexible layers.
In addition to strict physical names and internal accounts, there is an intermediate pattern: temporary vouchers or two-dimensional codes for collaborators, guests, short-term field personnel, a network of designated networks that can be used as controls. This is easier than giving them a complete real name and more controllable than purely open. WiFi's real name certification system supports the opening of provisional accounts, setting them up for validity and closing them at any time. We often use this technique in our show and launch projects, giving them valid documents on the day they are sent, which automatically disables the resting area."Internal staff"and"Pure visitors"The gap between the two, making the coexistence programme more complete.
The mode switch needs to be smooth. Don't let the user reconnect.
Users may move from the public to the staff area, or VIP guests will temporarily enter the backstage network. The mode is supposed to smooth the transition instead of disconnecting the network every time. Technically, it can be done by using the same account multi-network authorization, or a memory of the device and then going over SSID for reuse. We suggest that we think about this at the design stage."User Moves"The scene is not to wait for the people to move and fall. The ultimate goal of the coexistence is not that several systems are separate, but rather that users do not feel a few models behind them, so they can be connected and the boundary becomes silently operative at the back.
Retention and audit of the respective models are met
The logs and real names data of different models are then stored to meet their respective retention and audit requirements. Visitors ' patterns are kept in public places, employees ' models are maintained in internal security management, temporary vouchers are issued with a buffer. WiFi's real name certification system is designed to be based on model models that allow for different retention strategies and reporting calibres, not one size fits all. We have seen all model logs mixed into a table, which controls visits the names of people, and exposes staff members to Internet access.
The plan for the parallel is to draw it and make it clear.
Two or even three models coexist, which sounds complicated, but one is the map on the programme: which SSIDs, what authentications each have to take, how data are left, who has access to it. This figure is meant to make managers, carriers, regulators understand it at first glance. When we deliver the scheme, we must be accompanied by a map of networks and certification patterns, with descriptions of their configuration. It is clear that implementation is not incoherent, robust, and checks are not flawed.