The hotel, which provides public WiFi access to the Internet, has important responsibility for cybersecurity compliance. Under such laws and regulations as the Law of the People’s Republic of China on Cybersecurity, the Regulations on Technical Measures for the Security of the Internet, etc., public places providing WiFi services must implement a real name system, record and retain identity information and logbooks from users who have accessed the Internet for at least six months. The hotel WiFi certification system’s security compliance and Log Audit functionality are central safeguards to help hotels meet regulatory requirements, protect against safety risks, and protect the privacy of their residents.
Safety compliance requirements for the Hotel WiFi
The security compliance requirements of the Hotel WiFi are derived mainly from laws and regulations and industry norms in the following areas: first, the Law of the People ' s Republic of China on Cyber Security (implemented on 1 June 2017), article 21 of which requires network operators"Take technical measures to monitor, record network operations and network security incidents and retain relevant web logs for a minimum of six months as required"Article 24, paragraph 1, of the Covenant"Web operators provide user services such as information dissemination, instant messaging and so on, and when entering into agreements with users or confirming service provision, they should request the user to provide real identity information"The hotel, as a network operator providing WiFi access, must implement the real name and log retention requirements."Units providing Internet access should install and operate a security management system that meets national standards and implement technical security protection measures"The third is the Technical Requirements of the Wireless Access Security Management System (GA/T 1159-2014, Ministry of Public Security Industry Standards), which provides detailed technical specifications for the security management system in WiFi, public places, including user identification, log records on Internet, encryption of data transmission and interface with audit platforms of public security organs. Fourth: The Personal Information Protection Act of the People ' s Republic of China (implemented on 1 November 2021) imposes strict requirements for the collection, storage, use and sharing of personal information. In collecting personal information such as cellular numbers, micro-mail OpenIDs, Internet access etc. of residents, hotels must follow"Legal, legitimate, necessary"The principle is to clearly inform the purpose and scope of collection and use, obtain the consent of the occupants, take security measures to protect personal information from disclosure and abuse. Five are specific requirements for local public security organs, which may require more specific requirements for the safety management of WiFi in public places, such as requiring that the WiFi security management system be connected with the audit platform of local public security authorities, regularly report online logs, receive security checks, etc. These compliance requirements are legal bottom lines operating at WiFi, where violations of these requirements may face administrative sanctions such as warnings, fines, suspension or rehabilitation, and may also incur criminal liability if they have serious consequences. Therefore, when the hotel deploys WiFi certification systems, safety compliance must be a primary consideration in selecting products that meet national standards and industry norms to ensure that the system meets compliance requirements.
Network real name implementation
The WiFi system is a central requirement for security compliance in the hotel. Its goal is to ensure that every user who uses it has an authentic and retroactive identity. The second is the WiFi certification for the micro-mail company, where residents connect to WiFi via a micro-letter and access the host's micromail OpenID. Although the micro-mail OpenID is not a real name or cell number, the micro-mail account itself has been authenticated (with a mobile phone number or bank card attached), and OpenID can be used as an identification mark for retroactive purposes. In practical applications, public security authorities usually accept the micro-name OpenID as a real-name identifier, but in some areas it may require additional cell number information. The residence information in PMS is registered at the time of entry (including ID number, name, etc.), so that a residence registration can be linked to the real identity of the occupants. This type of real name system has high credibility because the residence identification information was verified by the hotel front desk when it entered. Regardless of the authentication method, the system must store the identity of users on the Internet (cell number, micromail OpenID, home code corresponding to the residence number, membership number, etc.) in connection with the log and ensure that each access record is traced back to a specific user identity."In accordance with national laws and regulations, this WiFi network is managed by a real name system, and your online identity information and logbooks are recorded and maintained for the purposes of cybersecurity management and back-to-back violations."The system should deny requests for Internet access to tenants who refuse to provide real identity information, which is a necessary measure to implement the name system.
Recording and retention of web logs
The recording and retention of the logs is another core requirement for WiFi security compliance in the hotel. The web logs that the system needs to record include the following categories: a user identification log, which records the identity information of each user on the Internet (cell number, micromail OpenID, house number, membership number, etc.), authentication time, authentication method, certification results, terminal MAC address, terminal IP address, access to AP location, VLAN, etc.; and a network connection log, which records the connection times, break-off time, online duration, acquired IP address, DHCP lease, connected AP and SSIDs; Third, traffic logs that record each user/endpoint ' s up-and-down flow, total traffic, peak traffic, average speed, etc., can be measured by hours, days and months; fourth, access logs that record the user ' s access to a site domain name or IP address, visit times, access methods (GET/POST, etc.), protocols used (HTTP/HTTPS/FTP, etc.), data transfers etc.. For HTTPS encryption traffic, it is not possible to record specific access content because of content encryption but it can record the searchable domain name (recording through SNI or DNS) and volume of traffic; Fifthly, the use of logbooks to identify user-use types (e.g. micro-letters, tremors, ecclesiasticity, thunder, etc.) and record application usage times, traffic consumption, hours spent, etc.; sixthly, the security incident logbooks, which document safety incidents detected by the system such as unusual login, violent cracking, port scanning, virus transmission, violation access, assault behaviour, etc., including event time, event type, source IP/endpoint, target IP/web site, event description, outcome, etc. Retention requirements for logs: All weblogs must be retained for not less than six months (in some parts a year is required), log data must be stored encrypted, tampered with and deleted, log queries and export must have strict authority control and operational audit. Log storage: For hotels with larger log capacity (e.g. large hotels and chains), it is recommended that dedicated log servers or cloud log storage services be used to ensure sufficient storage space and reliable backup of data. Log data should be backed up regularly (e.g., by daily back-up off site) to prevent loss of logs due to hardware failure. Log queries and export: The system should provide a convenient log query interface to support multi-dimensional queries and filter logs, such as time frames, user identification (cell number/house number/member code), terminal MAC/IP, access area, site domain name, application type, event type, etc., and support the export of search results into CSV, Excel or PDF formats. When public security authorities need access to Internet logs because of their investigation of cases, hotel safety administrators can quickly search and export relevant logs through the system to cooperate with investigations by public security authorities. (b) Integrity protection of logs: the system should take technical measures to ensure the integrity of log data, such as digital signature or Hashi verification of log files, which can be detected once a log has been tampered with; removal operations of logs should be strictly restricted and only by authorized administrators in specific circumstances (e.g. beyond retention), and deletions must be recorded.
Security protection capability
In addition to compliance requirements, the hotel WiFi certification system requires basic security protection against various cyber-security threats. First, without authorized access, the system ensures that Internet access is only available to certified users and that all HTTP/HTTPS access by uncertified users is redirected to Portal pages and cannot be accessed directly. The system can also set up a white list of MAC addresses, allowing only known, authorized end-to-end access networks (for employee network and material networking devices) to prevent unauthorized access to equipment. The system isolates the host network, the employee network, the management network, the object network (IPTV, smart passenger control, door block, etc.) and the default is not to exchange visits between different VLANs. The client separates themselves through client isolation functions, preventing direct communication and attacks between the occupants’ terminals (e.g. ARP fraud, port scanning, shared folder access, etc.). Intranet segregation effectively prevents horizontal infiltration of one terminal into other terminals or hotel core business systems after it has been invaded. Third, attack detection and protection, systematic real-time monitoring of network traffic, detection of common cyberattacks such as DDoS attacks (distributed denial of services), port scanning, violent cracking (SSH/RDP/database), ARP fraud, DNS hijacking, malicious software communications such as Zombie Network C&C-communications, blackmail software communications, etc.) are available to the system automatically when attacks are detected. The system can respond by separating attack terminals, blocking traffic from attacks, notifying managers, etc. The fifth is the detection of viruses and malware, which can be connected to a poison-killing engine or threat intelligence platform, detect malicious files transmitted on the network, scan downloads, block downloads and alert when malicious documents are found. The sixth is management security, the system must be managed using HTTPS encryption transmissions, administrator accounts must have strong passwords and multifactor authentications, and management operations must have complete audit logs to prevent misuse of the management account or unauthorized access to the management interface. Security protection is a multi-layered system, and WiFi certification provides basic security for access and network layers. Hotels should also deploy equipment such as firewalls, intrusion defense systems (IPS), Web safety gateways in export to form an advanced defence system. The WiFi certification system can connect with these security devices, share threat information and respond to security incidents in a coordinated manner.
Privacy protection and data security
The hotel WiFi system collects and stores information on the identity of tenants and data on online behaviour, which are personal information and is strictly protected by laws and regulations such as the Personal Information Protection Act. First, it is essential that hotels should take effective measures to protect their privacy and data security. WiFi only needs to get OpenID, and does not need additional information on micronoms, headers, friends lists, etc. Second, the principle of informed consent requires hotels to inform their guests in a significant way on Portal page: what personal information is collected, what purpose is collected, how data will be used and stored, how long the data will be retained, what rights of the occupants (such as searching, deleting, withdrawing consent, etc.)."Agree and online."Buttons are only considered to be informed of the occupants. The consent of the guardian is required for minors to use WiFi in hotels. Third, data encryption, personal information must be encrypted during transmission (HTTPS/TLS), encryption (e.g. database encryption, file encryption) should be stored, encryption keys should be managed safely to prevent key disclosure from leading to data declassified. Fourth, access control, personal information and Internet logs must have strict access rights, only authorized security administrators can search and export, and querying and export operations must be recorded (who asks who's data at what time). The data-sharing restrictions prevent hotels from selling or illegally providing their personal information to third parties. The hotel should respond to the customer’s request within a reasonable time. The privacy protection performance of hotels directly affects the choice of residence and brand evaluation of high-end customers (especially dignitaries, celebrities, business executives). Hotels should integrate privacy protection into the design and operation of WiFi, conduct periodic privacy compliance assessments and security audits, and ensure that their personal information is adequately protected.
Interfacing with public security audit platforms
In many areas, public security organs require that the public WiFi service be provided by places where Internet logs are connected to the local security authority’s WiFi security audit platform, which allows real-time uploading and central monitoring of online logs. The interface with the Public Security Audit Platform is an important part of the hotel WiFi’s safety compliance. The WiFi certification system of hotels, as required by the interface agreement, uploads online logs (user identification information, authentication logs, access logs, traffic logs, etc.) to the Public Security Audit Platform in real or quasi-real time. The public security audit platform interface agreements may differ from region to region, and WiFi certification system manufacturers usually develop standardized docking plugins for local public security platforms, which are deployed only if they have parameters such as addresses, port, account number, etc. Reciprocal content: Logs that are usually required to be reported include user certification logs (cell number/OpenID/Room number, authentication time, authentication results, terminal MAC/IP, AP location etc.), user logs (accessed site domain name/IP, access time, traffic size etc.), user logs up and down (online time, offline time, online time, etc.). Some public security platforms also require the reporting of end-of-pipe information (equipment type, operating system, browsers, etc.) and security incident logs. Requirement for incoming: logs must be reported in a timely manner (usually within minutes of the user ' s Internet activity), data must be complete (not missing key information), channels reported must be secure (often VPN lines or encrypted transmissions) and systems must have network breakout cache capacity (when network connections with public security platforms are interrupted, local cache logs are automatically re-tweeted after connection is restored, ensuring that logs are not lost). Test and acceptance of docking: Once docking is completed, tests and acceptances need to be performed in conjunction with public security authorities, including timeliness, completeness, accuracy tests, post-restoration reconnection tests, abnormal case processing tests etc. After the test is passed, the public security organs issue a certificate of acceptance and certification that the WiFi system of the hotel will officially meet local security compliance requirements. For hotel chains, because the doorways are located in different regions and require support for interface with public security platforms in different regions, WiFi should have flexible docking configurations that will allow it to accommodate different public security platform interface parameters at different hotels.
The hotel WiFi certification system’s security compliance and NATSHEL_LOG_AUDIT are the legal base and safety building blocks for the hotel WiFi. By implementing a web-based real name system, each user’s identity is ensured retroactively, legal requirements are met through complete recording and retention of Internet logs, multiple levels of security protection against cyberattacks and information leaks are used to protect the personal information of tenants through strict privacy measures, and local regulatory requirements are satisfied by matching with public security audit platforms."Additional burden"But..."Legal liability to be fulfilled"and"The necessary inputs to protect brand credibility"A fully functional and secure WiFi certification system that meets national standards will help hotels avoid legal risks, protect against security threats, protect the privacy of their guests and provide solid security for hotel operations and branding.