The WIFI of the hotel serves a wide range of people: guests, visitors to the lobby, guests, conference attendees, and hotels' own office and business systems. These flows are both security hazards and unmanageable if they are all mixed in a network. Internet segregation is an inexcusable topic when making a real-name WIFI system.
The network must be completely separate from the Internet.
The PMS, door locking systems, surveillance, cash collection and the network of customers must be physically or logically isolated from the network. It must not give clients any opportunity to access their equipment. Imagine the risks of a customer being able to clean up the hotel's money-collection system if they are connected to the WIFI. Access between the business network and the Internet is strictly prohibited. This line is a security bottom line, and no certification system can break it.
There's a terminal quarantine between the residents.
Also, the hotel WiFI guests should be separated by default from each other, and one customer cannot see or access another. This is called terminal isolation or user segregation. If not, a malicious user can scan other guest devices in the section of the net, even launch an attack. The terminal isolation is opened, as if each client was on his own space, only Internet access is available. It is usually configured on wireless controllers or Authentication Gateway. For most hotels, there is no need for inter-hosting, and it has to be done with the benefit of separating them.
The visitors' network needs to be more secure.
Visitors to public areas such as the lobby, restaurant, and other public areas are more temporary and uncontrollable than their occupants. The visitors’ network should be given a tighter mandate, such as restricted access resources, bandwidth and length of time. Visitors also need real name certification to meet compliance, but they can be treated differently from residents.
Meetings and dinner scenes may require ad hoc independent networks
Hotels often receive meetings, dinners, and sometimes have special web requirements such as a live segment of an independent network, internal demonstrations or temporary opening of accounts. This setting can support temporary independent networks or temporary accounts, open during meetings, and recover after they are closed. The independent network is also separated from the guest, regular visitor network, so that the flow of meetings does not affect other guests, and so does the network of other visitors. Flexibility in supporting such temporary scenarios while maintaining isolation is a practical feature of the hotel certification system.
Isolation cannot be at the expense of online experience.
Solitary confinement is a safe, but it can't be separated from the regular Internet access of customers. For example, clients want to use their cell phones to throw on room television, to share files with flatboards and notebooks, and if terminal isolation is too dead, the equipment interconnection needs of these same guests are cut off and the experience is compromised. It is reasonable to isolate between residents, between zones of confidence, while multiple devices under one residence can communicate within controlled limits. The quarantine grain size is well packed to ensure both secure boundaries and normal usage requirements. This requires certification systems that recognize the equipment’ belonging."We're all connected. We're separated."。
Wireless and wired isolation strategies need to be consistent.
Some hotel rooms have wire access to the web, except for WIFI. Business guests use a web-based laptop. Cable and wireless isolation strategies are consistent. Wireless isolation strategies cannot be separated. The net access is open.
Isolation configurations are checked regularly.
The equipment changes, network adjustments, and new APs can inadvertently destroy the old isolation. The transporter regularly checks whether the separation strategy is still complete and operational networks and passenger networks are strictly separate, and end-segregation is not compromised. It would be better to check with a simple sample that the user network can access it or visit one another.
The network is isolated by the WIFI authenticated Internet system, with a core of cyberspace divided by trust level: operational network independence, residential isolation, tight visitors, temporary independence of meetings, wireless alignment and common equipment. This system is designed and maintained so that hotel networks are safe and useful. Safety and experience are not opposing; isolated particle sizes are right, and both can be balanced.