The WiFi certification system cannot use a code for the account in high-security areas (research and development, treasury, data centre entrance) but must be used with a second factor. Double-causing authentication is simple, account codes plus SMS authentication codes, but there are pits where it actually landed: text message access is unstable, the code is delayed, users are troubled, and how existing identification systems work together.
What scene must have double-factors?
The normal office area has a code and MAC is not perceptible enough, forcing the two factors to allow staff to lose the authentication codes on a daily basis and experiencing multiple complaints. There are three types of scenes that must be used: the first is high-security areas, research and development departments, finance rooms, data centres, machine rooms, network access in these areas involves core data, account password leaks are highly risky. The second category is remote access, VPN or teleoffice access enterprise inner networks, with double factors.
V7 dual factor realization
The two-digit authentication for NATSHEL_BRAND V7 system is a six-bit random checker code obtained by username combinations with cell number and text message. Users enter the user name and password on Portal page, send a six-digit authentication code to their tied mobile phone number after system validation has been adopted, and users enter the authentication code to complete secondary authentication. Both factors are released only, and any failure is rejected. The authentication code is valid, usually set at five minutes, expiry and prevents long-term use of the authentication code when intercepted.
The stability of the text-message channel.
The single-point failure of the two factors is a text message channel. SMS switches are off, the authentication code cannot be sent out, and all users cannot access it. A stable SMS service provider is to be selected when deployed. It is desirable that there are two main channels for deployment. The main channel fails to automatically cut back-up.
Delayed processing of authentication code
The SMS code delay is the most common problem for users."The authentication code is valid in 5 minutes. Please do not repeat it.". Second, you set the interval for sending it only once in 60 seconds. Third, you provide a voice-verified option, and text messages are not received to allow an optional voice-phone transmission. Fourth, the SMS channel is delayed by automatic alarms exceeding 10 seconds and a backup channel is switched in time.
The LDAP/AD domain
The first factor of the double factor (account code) for enterprise employees in AD domain is LDAP certification to domain control, and the second factor (text message authentication code) is handled locally by V7. What is the user's cell number? Two ways are: where there is a user attribute in AD domain, and where V7 reads mobile phone numbers through LDAP. Second, there is a V7 local database that binds the cell number when users first log in. It is recommended that the AD area be stored because personnel systems are synchronized with the AD domain update on change of sign or exit, and V7 automatically acquires the latest cell number without separate maintenance. To confirm whether the cell number fields in the AD field are complete, some enterprise AD fields have empty cell numbers.
Double factor exemption mechanism
The two factors are not a single-size cut. Senior managers, VIP users, special jobs may need to be exempted or the device function set up: after the user has successfully certified a double factor on a device, no secondary factor is required for re-entry within seven days and only an account number password is needed. Remember that the device function is based on MAC addresses or device fingerprints, and that public equipment cannot be opened, otherwise the next user can log in directly. Exemptions and memory strategies are configured according to the user group, ordinary staff do not exempt, high safety areas do not open the memory device.
Hardware token as a second factor
For scenarios where security requirements are extremely high, SMS authentication codes may not be sufficient because text messages are at risk of being hijacked (SIMC cloning, pseudo-based stations). Hardware tokens (Devocard) are a second safer factor, generating a six-bit dynamic code every 30 seconds and cannot be remotely stolen. V7 supports hardware medal certification, managers bind serial numbers to users backstage, users enter dynamic codes on their login. Hardware badges have a high cost, each card can be worth tens to hundreds and the user may lose them and require a supplementary process.
Double factor-on-line propulsion strategy
The company-wide double factor is not changed at one time. The objective of the IT sector is to optimize the process by collecting problems, and then extend it to high safety areas, eventually covering other regions as needed. User training is required before going online to explain why the two factors are used, how they operate and how they fail to receive the code.
The WiFi certification system of enterprises uses two-dimensional authentication to the extent that it is really needed, high safety areas, remote access, administrator accounts must be up and running, and normal office space should not be mandatory. SMS channels need to be owned, calibration codes have to be retested and voice options, cell numbers are synchronized with AD domain, exemptions and remembering devices are designed for user groups, hardware commands for high security requirements.