Hotel wireless certification systems support a variety of authentication protocols, with different protocols characterized by safety, user experience, deployment complexity and application. Understanding the working principles and applicable boundaries of these agreements allows hotels to choose the right combination of authentication methods when planning wireless networks. The accreditation protocols used in hotel settings are mainly Portal certification, RADIUS certification, 802.1X certification, MAC NATSHEL_SEAMLES_AUTH, which is usually used in tandem rather than as an alternative.
Portal Certification: the most frequently accessed authentication method for tenants
Portal certification (also called Web certification) is the most frequently used method of authentication for hotel guests. After the tenant connects WiFi, the browser automatically ejects a certificate page (Portal page), where the guest enters a mobile phone number to get a authentication code or uses micromail scanning, or a house name and surname, to access the Internet after the certification has been completed."Force Redirection": The request for HTTP from an uncertified user is intercepted by AC or Authentication Gateway and reoriented to the authentication page of the Portal server; after a user has submitted authentication information, the Portal server interacts with the RADIUS server to complete the authentication; after validation, the Portal server informs AC to open access to the user.——The Portal certification also supports highly custom-defined authentication pages where hotels can display brands like Logo, promotional information, service references, etc. and turn the authentication page into a marketing touch point. But Portal certification is relatively less secure.——Authentication information is transmitted via Web pages, although encrypted by HTTPS, the overall security level is less than an enterprise-level certification agreement such as 802.1X; furthermore Portal certification relies on browser redirection mechanisms and certain terminals or applications may not be able to correctly eject authentication pages (e.g. some APPs have network requests without a browser, which makes it impossible to trigger redirection). In hotel scenes, Portal certification is the preferred method of authentication for the host network because of the diversity of the user ' s end types (cell phones, notebooks, flatboards, smart devices etc.), and the varying IT skill levels among the occupants, with Portal certifying low threshold characteristics that meet most tenants ' needs. According to the product information of NATSHEL_BRAND V7, Portal pages support PC and mobile phone self-adaptation, custom templates and source-level editing, and 4W+B strategies (send different Portal pages according to time, location, user, content, browser, SSID combination).
RADIUS Agreement: Standard cornerstone for certification authority costing
RADIUS (Remote Agency Dial-In USer Service) is the most widely used standard protocol in the area of network certification licensing, and almost all enterprise level network equipment (AC, switchboard, routers, BRAS, firewalls) supports RADIUS client functions. The RADIUS protocol works under client-server mode: network devices (AC, switch etc.) serve as RADIS clients, forwarding user authentication requests to RADIUS servers; after the RADIUS server has validated the user identity, returns the authentication results and authorization strategy to the client. The RADIAUS protocol contains three core functions, collectively known as AAA (Authentisation, Administration, Accoutration): authentication to verify the legitimacy of users; authorization to send corresponding network access rights (VLAN, bandwidth, ACL, session length etc.) based on user identification; and recording of user time and traffic usage for cost settlement and Log Audit. RADIUS protocols are highly standardized and equipment compatible——The vast majority of network equipment supports RADIS, which does not need to replace existing ACs and exchanges because of the deployment of certification systems; the RADIUS agreement also supports the rich properties (attribute) that can transmit a variety of information such as user identification, terminal information, access location, bandwidth restrictions, VLAN distribution, etc. to meet complex delegation strategy needs. Here is a common error that must be clarified:"AC supports RADIUS"Not equal to"AC supports external Portal"RADIUS only handles backend of the certification authorization billing, while Portal authentication requires AC support"External Portal Redirect"Functions——That is, AC can redirect the uncertified user HTTP request to an external Portal server URL. If AC only supports RADIUS but not external Portal, the user will see a certificate page that is built on the AC and cannot use a custom Portal page provided by an external authentication system, nor will it be able to achieve complex certification processes such as micro-credit authentication, SMS authentication, etc. that require interaction with an external system. In this case, additional Authentication Gateway (single or side-track deployment) will normally be required to perform external Portal functions. According to the Role-5 Technical Advisers Rule, in assessing AC docking capacity, a distinction must be made"Authenticate backend capabilities"and"External Portal Capacity"and"Release control"- Can't be confused.
802.1X Certification: enterprise-level programme for high safety scenarios
802.1X is the port-level network access control standard defined by IEEE and one of the most secure ways to authenticate enterprise-level networks. The working principles for 802.1X certification are that, after a terminal (Supplicant) connects to an portal of the network device (Authenticator, usually a switch or AC), the network equipment requires the end-user to verify it; the terminal sends authentication information (user password, digital certificate etc.) through the EAP (Extensible Agency Process Protocol) protocol to the network equipment; The network equipment is sealed in the RADIUS report and forwarded to the RADIUS server for validation; after certification, the network device opens up the port's network access. 802.1X authentication is highly secure——The authentication process is based on the EAP protocol and can support a variety of security certification methods (e.g., using digital certificates for EAP-TLS, encrypted tunnels for PEAP-SIM, SIM cards for EAP-SIM), which are encrypted during transmission and not easily intercepted or falsified; 802.1X also supports port-based access controls, which are completely closed without authentication, with no access to the inner network and much more secure than Portal authentication. However, 802.1X authentication users experience less well.——Terminals require 802.1X clients (although mainstream operating systems such as Windows, MacOS, iOS, Android are built into 802.1X client but user manual configuration of network parameters is required), the configuration process is relatively complex and unsuitable for low IT skill tenants; 802.1X certification requires terminal support to EAP protocols and some object networking terminals (e.g. printers, cameras, IPTV topboxes) may not support 802.1X. In hotel scene settings, 802.1X certification is usually not used for residential networks, but for staff networks and office networks.——The endpoints are configured by the IT department to be 802.1X parameters, and the employees use domain accounts (incorporated through LDAP/AD) for certification, which is highly secure and manageable. For hotel management and administrative office areas, 802.1X+LDAP certification is a more recommended option. According to product information from NATSHEL_BRAND V7, the system supports enterprise-level certification methods such as 802.1X certification, PEAP certification, EAP-SM certification, etc., that meet the needs of hotel network and high safety requirements.
MAC NATHELL_SEAMLESS_AUTH: Effective ways to enhance fixed user experience
MAC Seamless Authentication (also known as MAC by-pass authentication or MAC certification) is an automatic authentication based on the terminal ' s MAC address, which after first authentication by the user records the end ' s MAC address and when it reconnects to the network, the system automatically identifies the MAC address and releases it without requiring a further input of authentication information. The working principle for MAC NATSHELL_SEAMLES_AUTH is that the end address and user identification log are completed through Portal or otherwise when the terminal first accesss the network; AC or NATHHEL_AUTH_GATEWAY detected the terminal's MAC address at the time of follow-up access"Authenticated MAC List", automatically send a request for MAC authentication to the RADIS server (using the MAC address as user name), and when the RADIFUS server validates the MAC address, returns the result of the authorization and the terminal is automatically granted access. The process is completely transparent to users and the user does not feel that authentication exists.——Fixed users (e.g. long-stayers, hotel staff, frequent conference clients) need only first certification, follow-up access is automatically released without reloading cell phone numbers or authentication codes; for object network terminals (e.g. IPTV topbox, smart passenger control devices, printers), because these equipment usually do not have a browser interface to complete Portal certification, MAC NATSHELL_SEAMLES_AUTH is an effective alternative——The MAC addresses are pre-recorded and automatically certified and released after the device has been connected. However, the security of MAC Seamless Authentication is relatively low——The MAC address can be forged (although the threshold for forgery of a MAC address in the actual scene is not low), and if an authenticated terminal ' s MAC address is forged, the counterfeiter may bypass the authentication directly by accessing the Internet. Therefore, the MAC NATSHEL_SEAMLES_AUTH usually does not use it alone but in conjunction with other authentication methods.——Initial authentication must be completed by mobile phone number, micromail or 802.1X, and the use of MAC is not perceptible; while MAC Seamless Authentication usually has a validity period (e.g. 24 hours, 7 days or during the stay), it needs to be re-certified after expiry. In hotel scenes, MAC Seamless Authentication is used frequently for long-stayers or long-lease apartments (long-term exemption after initial certification), hotel employee terminals (following automatic release of access after the first use of a domain account by an employee), object network terminals (a device that cannot be certified as Portal, such as IPTV, smart client control, printer etc.) and fixed equipment in conference rooms (e.g. videoconferencing terminal, pre-into-map MAC white list). Based on the product information of NATSHEL_BRAND V7, the system supports Seamless Authentication and secondary waivers based on the MAC address, supports the MAC address white list management and is capable of meeting the automatic certification needs of fixed user and object network terminals in hotel scenes.
The combination of authentication protocols is suitable for the scene
In the actual hotel wireless network, it is not usually only one certification agreement but a variety of authentication methods based on different regions and user groups. A typical combination of high-end hotels can be as follows: Portal certification (cell number or micromail) for guest room areas, MAC insensitive awareness (recertification during the stay), after initial accreditation, and different bandwidths (higher bandwidth for administrative floors and suites) for different type of tenants; Portal certification (microletters, cellular numbers) for lobby and public areas, and Portal page displaying hotel sales and service recommendations; Conference rooms use temporary or fixed password authentication (conference organizers obtain the conference WiFi account at the front desk, participants use the account certification) and during meetings guarantee high bandwidth and low delay to support videoconferencing; staff areas use 802.1X+LDAP authentication (staff use domain account authentication, high security), employee terminals are first certified with MAC unconscious; and network area (IPTV, smart client control, door block, surveillance, etc.) uses MAC white list authentication, limiting access to dedicated VLANs only, and cannot access the guest network and Internet (or allow access only to specific server addresses); Foreign guests can use international SMS authentication (though it requires attention to the cost and arrival rate of international text messaging, which is not usually preferred) or obtain temporary authorization codes through front-office registration. This multi-agreement combination strategy maximizes user experience while safeguarding safety, using the most appropriate authentication method for different settings. The selection and combination of authentication methods need to be linked to hotel realities.——The ability of the current network AC equipment (whether to support external Portal, 802.1X, MAC certification), PMS interface openness, characteristics of the population (business/save/outer ratio), hotel IT-viability and compliance requirements all influence the design of a certification strategy. According to the Role-5 technical adviser’s rules, a definitive certification programme cannot be given directly when information is incomplete, but it should be stated that there is a need to identify on-site equipment and systems before specific programmes are developed. For the old hotel renovation project, since some certification agreements may not be supported by existing equipment, a site survey is required to identify branding and solid-ware versions of the equipment before a programme can be determined. It cannot be assumed that all equipment supports standard protocols.
Hotel Wireless Certification supports multiple authentication protocols, each with its application and boundaries. Portal certification has a good experience, low threshold, and suitable for the host network; RADIUS is the standard cornerstone of the certification authorization billing, supported by almost all network equipment, but needs to be differentiated."Support for RADIUS"and"Support external Portal"The two things are the most secure; 802.1X is the highest for employee networks and high security requirements, but complex configurations are not suitable for tenants; MAC NATSHEL_SEAMLESS_AUTH has best experience, which is suitable for fixed user and object network terminals, but needs to be used and set in force in conjunction with other authentication methods. In actual deployments, multiple certification protocols are usually used based on a combination of regions and user groups, balancing safety and user experiences. The selection and combination of authentication agreements require an integrated assessment of hotel current network equipment capabilities, PMS interfaces, residential characteristics and compliance requirements, depending on the results of field surveys. For hotels, the selection of a certification agreement that supports a comprehensive and equipped-to-synchronous wireless certification system provides sufficient space for subsequent certification strategy design and expansion.