Modern hotels are becoming more intelligent, and in addition to the WiFi network used by their occupants, smart passenger control systems (lights, air conditioning, curtains, television controls, etc.), IPTV systems (interactive television, video on-demand, hotel information services, etc.), door closures, surveillance systems, building self-control systems, etc., are deployed. The end-of-pipe equipment of these systems is also usually connected via wireless or cable networks, sharing the same physical network infrastructure with the resident WiFi. How to achieve logical segregation between different systems in the context of shared physical networks, and secure and stable operation of the network of tenants is a priority issue for hotel wireless certification system deployment. Below are details on the network separation program between hotel wireless certification systems and smart passenger control/IPTV, from the five areas of isolation requirements, VLAN segregation, authentication strategy, access control and security protection.
Why network segregation: the dual need for security and stability
The hotel's guest WiFi network shares the same physical network infrastructure (exchange, cabling, possibly including some AP), but they have a fundamental difference in security requirements, communication features and malfunctioning effects that require logical segregation. Security needs are the primary reason. The host WiFi network is an open network.——Any resident can be connected, the occupants have a variety of end types (cell phones, notebooks, tablets, etc.) and security conditions are uneven (possibly virus, wooden horses, malware). If the network is not isolated from smart passenger control systems, IPTV systems, there is a risk that the occupants’ terminals will have direct access to the equipment of these systems.——Malicious tenants may attempt to hack smart passenger control systems (such as illegal control of light air conditioning in other rooms), attack IPTV servers, scan internal network equipment holes, etc. What is more serious is that if intelligent passenger control systems are compromised, it could affect normal hotel operations (e.g. large-area air conditioners are out of control, lights abnormal) and even cause security accidents. It is equally important to stabilize the operation requirements. Smart passenger control systems and IPTV have higher demands on network stability and delay.——Smart client-controlled instructions require real-time responses (the lights should be activated immediately after the guest presses on the switch, and delays of more than one second affect experience), IPTV video streams need a stable bandwidth and low drop-out rates (Carton and flower screens can seriously affect the patient’s experiences). If these systems share the same broadcast area and network resources with the resident WiFi, the host’s large traffic downloads (e.g. high-resolution videos, large file transfers) may lead to web congestion, affecting smart user controls and normal operation of IPTV. In addition, radio storms, ARP fraud, viral transmission, etc. in residential networks can also cause system instability, which can lead to system instability. In case of a malfunction in the host network (e.g. DHCP server failure, authentication system abnormality, virus outbreak leading to network congestion), smart customer control and IPTV systems should not be affected——If the patient cannot access the Internet, he can complain, but if the smart customer is not able to monitor it (air conditioning is unreconciled, light is out of control) or IPTV is unable to view it, the guest experience may be worse and may require a change of residence or refund directly."A system malfunction has led to a complete intellectual paralysis in the hotel."Compliance requirements are also a factor. The hotel’s internal management system (including smart passenger control, IPTV, lockdown, surveillance, etc.) should be isolated from the outside access network (resident WiFi), in order to prevent unauthorized access to the internal system by external users.
VLAN Separating: The most basic and core means of isolation
VLAN (virtual local area network) is the most basic and central means of achieving network segregation. By installing different VLANs on switches, a physical network can be divided into several logically independent broadcasting areas, equipment between different VLANs cannot communicate directly on the second floor (data chain level), must be relayed by three-storey devices (routing or three-floor switch) and access control strategies can be configured on three-storey devices.——Wireless terminals for residents, the largest VLAN, the largest number of users, security requirements"Isolation + certification + audit";staff WiFi VLAN——Work terminals for hotel staff (e.g. front desk computers, service person mobile phones, management notebooks), security requirements"High-security certification + access to internal systems";smart vLAN——Equipment for smart passenger control systems (e.g. room controllers, gateways, sensors), safety requirements"Only communications with the passenger control server are allowed, and other access is prohibited"；IPTV VLAN——Equipment for IPTV systems (e.g. top-of-the-board box, broadcast server, streaming media server, etc.), security requirements"Secure video bandwidth and ban communication with the host network"VLAN:——Equipment for the restricted doors and video surveillance systems. Security requirements"High security, allowing communication with the management server only"; administering VLAN——Management access for network equipment (exchange, AC, AP, firewalls etc.)"Only IT administrator is allowed access, and other VLAN are prohibited"VLAN ' s exact number and division need to be determined according to the actual situation in the hotel (number of systems, size of equipment, security requirements), but the core principle is that"Networks for different uses are divided into different VLANs, accessed through three layers of strategic control". In wireless settings, VLAN distribution is usually achieved by: the VLAN allocation based on SSIID——Different SSIDs correspond to different VLANs, such as residential connections"Hotel_Guest"SSID is assigned to the resident VLAN, employee connection."Hotel_Staff"SSID is assigned to employee VLAN. This way is simple visual, but requires a different SSID connection between the tenant and the employee.——After the user certification, RADIFUS returns different VLAN-ID properties according to the user ' s identity (resident/employer/manager), and AC or switchboard distributes user dynamics to the corresponding VLAN based on return values. This is more flexible and can be distributed differently according to the user ' s identity under one SSID but requires aAC and an exchange to support VLAN dynamic distribution functions authorized by RADIUS.——For equipment connected by wire (e.g. IPTV top box, smart passenger gateways, security cameras etc.), VLAN is usually classified directly on the basis of exchange port static——The port connecting the top box of IPTV to IPTV VLAN, and the port linking the smart passenger control device to the client controlled VLAN. This is a simple, stable way to fit the fixed location of the wired equipment. In actual deployments, it is usually a combination of these types of devices.——Lined equipment is used in the port-based static VLAN, and wireless devices are distributed in VLAN based on SSIID or RADIUS authorization. It should be noted that VLAN isolation is only a second layer segregation, and communication between different VLANs is possible if they have routing on the three-storey switchboard. Therefore, VLAN separation must be accompanied by a three-tier access control strategy (ACL) to identify which VLAN can communicate between them, which cannot communicate, and which ports and services can be accessed.
Certification strategy segregation: different systems use different authentication methods
In addition to VLAN-level segregation, the differentiation of authentication strategies is also an important component of network segregation. Different types of users and equipment should be certified in different ways, both for their own experience needs and for security. The resident WiFi certification strategy: the host network uses Portal (cell number, micromail, room number etc.) and has been assigned to the guest VLAN after certification, with access only to the Internet and not to hotel internal systems (smart passenger control, IPTV, employee networks, management networks, etc.). The guest accreditation logs and web logs are retained for safety audits according to compliance requirements. The bandwidth of the occupants can vary according to type or level of membership (e.g., ordinary room 5Mbps, administrative floor 10Mbps, suite 20Mbps) and limits the use of large traffics such as P2P for peak periods. The employee WiFi certification strategy: the employee network uses 802.1X+LDAP/AD certification (staff using domain account authentication, high security), which is then assigned to employee VLAN, with access to the in-house business systems (PMS, OA, mailbox, file server, etc.), but cannot access the host network and smart client control/IPTV management interface. The end-of-service system is used to enhance the use of staff by using MAC Seamless Authentication (a follow-up on initial certification release). Staff members can monitor and audit their online behaviour via an online behavior management device (e.g. limit access to work-related sites, logs on the Internet, etc.).——The advantage of the MAC white list is that it is not subject to manual intervention, and automatically connected to the device; the disadvantage is that the MAC address can be forged and its security relatively low. Because of the strict isolation of VLAN from other VLAN (only with a passenger control server), even if equipment exists to forge the MAC address into VLAN, it cannot access other systems and risks are manageable. For scenarios where safety is more demanding, the authentication strategy for IPTV systems can be 802.1X (if a passenger-controlled device supports) or IPsec VPN (where an encryption tunnel is established between a passenger-controlled device and the server). The IPTV top box is usually certified using MAC white list, with equipment automatically distributed to IPTV VLAN after access. IPTV VLAN needs to guarantee sufficient bandwidth and low delay, so it can configure the Qos strategy (setting IPTV video stream tags high priority and forwarding in network congestion). The IPTV broadcast traffic needs to be configured on the switchboard to avoid cluster flood flooding to all ports and affect the performance of other VLANs. The network certification strategy for managing network access (SSH, Telnet, Web-based interfaces etc.) should use strong authentication (e.g. username+code+SSH keys, or double factor authentication), and only allow access from VLAN or a specified administrator terminal, which is prohibited from residents VLAN and other unauthorized VLAN. VLAN management should be strictly isolated from all operations VLAN, with only IT administrator terminals that can access VLAN. Through this differentiated certification strategy, different types of users and equipment are distinguished at the authentication level to develop a multilayered security protection system in line with VLAN isolation and access control strategies.
Access control policy: clear"Who can interview who?"Rules
VLAN's isolation and authentication strategy is solved."What network does the user belong to?"The access control strategy (ACL) is solved."Who can access who between the different networks?". The access control strategy is usually configured on a three-storey switch or firewall, allowing or rejecting specific network traffic depending on the source VLAN, destination VLAN, source IP, purpose IP, type of protocol, port number, etc. Hotel wireless network access control policy typically includes the following rules: user VLAN access control——The occupants VLAN have only access to the Internet (through firewalls/NAT) and cannot access any internal VLAN (staff VLAN, passenger control VLAN, IPTV VLAN, administration of VLAN etc.)."User-segregated"or"Client quarantine") prevent inter-hostile access (e.g., sharing files, scanning ports of other residential terminals)."User-segregated"function, which allows direct communication between wireless users to be banned under the same SSID.——The employee VLAN can access the internal business system (PMS server, OA server, file server, etc.) and the Internet, but cannot access the guest VLAN, passenger VLAN, IPTV VLAN, and management VLAN.——The control of VLAN can only be communicated to the passenger-controlled server (or the control of cloud platforms), not to the Internet (unless the control system requires a cloud connection, which should limit access to the specified cloud-based server address and port) or to any other VLAN.——IPTV VLAN has access to IPTV stream media servers and broadcast sources, the Internet (unless IPTV requires Internet content, this limit is restricted to any specified content server) and any other VLAN.——Manages VLAN to access all network devices (exchange, AC, AP, firewall, authentication servers, etc.), but manages VLAN itself only by the IT administrator’s terminal and other VLAN cannot access VLAN. The administration of VLAN visits should be configured with strict source IP restrictions (only allow access to specified administrator IP) and robust authentication.——All VLAN Internet access is through firewalls, which are configured with a uniform security strategy (e.g. intrusion defense, virus filtering, URL filtering, application control). The user network's Internet access can be configured with a more looser strategy (only blocking malicious websites and high-risk applications), and the employee network's Internet access can be equipped with a stricter strategy (restriction of work-related applications and websites)."Default denial, allowed as required"——That is, all traffic between VLANs is denied by default and only the required flow is explicitly allowed."Minimum Permissions"The principles minimize security risks and avoid unauthorized access due to an oversight of the configuration.——From each VLAN, try to access other VLAN resources and confirm that only permitted traffic can pass, and the refused flow is correctly blocked. The tests should include both positive (validally passing through the permissible flow) and reverse (correctly interrupted) testing.
Security protection and surveillance: ongoing security of the separation programme
Network isolation program is not."It's a good thing to be configured."There is also a need for sustained security protection and surveillance to ensure the effectiveness of isolation strategies and timely detection and response to security incidents. Firewalls and intrusion defences: all VLAN Internet exports and three layers of transmission between VLAN should be through firewalls, which open up security features such as invasion defense (IPS), virus filtering, application recognition, and detect and disrupt malicious traffic. For residential networks, emphasis should be placed on preventing viral transmission, port scanning, DDoS attacks, etc.; for internal systems (passport control, IPTV, employee network) emphasis should be placed on avoiding unauthorized access and leakage. Wireless security: AC and AP should open wireless security functions, including illegal AP detection (detection and warning unauthorized AP access), wireless intrusion defence (disruption of malicious wireless attacks such as decertification attacks, forgery of AP etc.), user isolation (prohibition of direct communication between users under the same SSID), encryption transmission (management traffic and staff traffic is encrypted using WPA2/WPA3 and residential networks can use open +Portal authentication or WPA2 encryption). NATSHEL_LOG_AUDIT and centralized management: The logs of equipment such as authentication systems, AC, switchboards, firewalls, servers should be collected centrally on the log server (or SIEM). Logs include the certification log (who authenticates success/failure from where at what time), access logs (who visits which resources), security logs (which attacks or anomalies are detected), system logs (equipment running status, configuration changes, etc.). Log retention times should meet compliance requirements (usually not less than six months). Regular log analysis can detect unusual behaviour (e.g., frequent scanning of inner-network ports by a resident terminal, large downloads of data from an employee account during off-time hours, etc.) and provide timely warning of security incidents. Network monitoring and alerts: deployment of network surveillance systems (e.g. Zabbix, PRTG, SolarWinds, etc.), real-time monitoring of the functioning status of all network equipment and servers (CPU utilization, memory usage, port flow, online user count, authentication success rate, etc.), setting reasonable alarm thresholds to notify IT administrators in time for anomalies (e.g., CPU use exceeding 90%, certification success rates suddenly dropping, one device is offline). Rapid failure detection and response can reduce the impact time of security incidents and failures. Periodic security assessments: it is recommended that network security assessments be conducted semi-annually or annually, including gap scanning (for all network equipment and servers, and timely repair of high risk gaps), configuration audits (to check VLAN configurations, ACL strategies, certification strategy compliance with safety requirements, configuration oversights), penetration tests (mocking attackers attempt to break through the passenger network to access internal systems in isolation and verify the effectiveness of segregation programmes). Problems identified by security assessments should be modified in a timely manner and quarantine tactics and security protection measures updated. Emergency response preparedness: Develop emergency response plans for cybersecurity incidents, identifying the processes, responsible persons and contact details of security incidents (e.g. virus outbreaks, hacking, DDoS attacks, data leaks, etc.). Periodic emergency exercises are conducted to ensure rapid response and reduce losses in case of real security incidents. Through continued security protection and surveillance, the effectiveness of network isolation programmes is ensured, and hotel wireless networks and smart systems can operate in a secure and stable environment.
The wireless hotel certification system is an important measure to ensure the safe and secure operation of the network. Core requirements for segregation include security needs (preventing passenger access to internal systems), stabilization needs (avoiding a significant passenger flow impact on intelligent systems), failure isolation needs (restricting the range of malfunction effects) and compliance requirements (satisfactory insurance and related regulatory requirements). Certification strategy is segregated from users and equipment at the certification level through differentiated authentication (residents with Portal, employees with 802.1X, and the MAC White List for the network devices); access control strategy is clarified through ACL"Who can interview who?"The rules, which provide three layers of sophisticated access control; security protection and surveillance, which guarantee the effectiveness of isolation programmes on a continuous basis through firewalls, IPS, NATSHEL_LOG_AUDIT, network monitoring, regular security assessment and emergency response preparedness."Optional"It's..."Organisation"——In today's increasingly intelligent world, a well-developed network separation programme can protect hotels from the influence of their network, safeguard the lives and normal operation of hotels and are an essential component in the construction of hotel IT infrastructure.