The campus network has a much more complex user base and access site than the general enterprise: students, teaching staff, visitors, temporary trainers have different identities; accommodations, teaching buildings, libraries, office areas, public areas require different forms of certification; cable and wireless terminals coexist. The campus network certification system supports multiple types of authentication, which depends on how to combine design so that different groups can perform certification in the most appropriate way in different regions, taking into account safety, experience and transportation costs.
The usual way of certifying the campus network and its application
According to the product information of NATSHEL_BRAND V7, the system supports authentication by account code, key login, text message, micromail, APP certification, ID card, MAC insensitive, LDAP, 802.1X, third-party data source authentication (a cartoon, OA, database of any third party), PEAP and EAP-SIM, and PPPOE. This approach has the advantage of aligning the account system with the existing identity systems in schools and managing them easily; it is a disadvantage that students can easily forget their passwords and that the security level of the pure account code is relatively low, generally recommended to match the authentication codes or connect to the unified identification system. A cartoon certification is a unique way of using campus cards or entering card numbers for validation. A cartoon system is already tied to the student ' s identity, which uses an interface to authenticate cards and identities through a cartoon system, leading to a uniform identification without requiring additional registration of a network account by the student. SMS certification is a real name for the cell phone, and students enter it to get a valid code and access it. The identity is traceable and meets the requirements of a public security audit. It is suitable for visitors and temporary users. LDAP certification is integrated into the unified identification system (or AD domain) of schools, and teaching employee domain account authentication to facilitate uniform identity management and distribution. PPOE certification is a standard operator accreditation method that is commonly used in campus network interfaces with operators, fee-paying operating sites (e.g., the school-based PPOE proxy model). Third-party data source authentication allows for the matching of a cartoon, OA, any third-party database and the reuse of existing systems to avoid multiple account codes.
Combining strategy for authentication: by region, by population, by end
The campus network certification methodology is designed in combination, with a mix of areas by region, population and end-level three dimensions rather than a whole school approach. By region: student dormitories are the area where the most pressure for accreditation is greatest, with students ' boarding areas being recommended to use a school number plus password or a cartoon certificate, which will be used after first validation to enable MAC unconscious (non-reaccredited during stay at school) and will provide a uniform certification strategy for different accommodation buildings; teaching areas (learning buildings, libraries) have a learning code plus a cathedron authentication that will match shorter session hours (students are released on leaving their conversations promptly and avoid using online user resources); office areas have 802.1X plus LDAP certification (domainroom number certification, high security); Public areas (cooking halls, auditoriums, sports fields) are certified by micro-mail or text messages and can be accessed without opening an account. Identity is retroactive; visitors ' areas (rooms, reception rooms) are certified by text message or visitor accounts with valid deadlines. Designed by population: students use a school code plus a cartoon to interface with the school ' s unified identification system; teaching workers use LDAP domain account numbers or 802.1X; visitors and temporary personnel use SMS or micro-mail; special groups (e.g. foreign teachers, students who remain in the room) can be assigned temporary account numbers or international mobile phone number certification (high cost of international messaging, unstable arrival rates, usually not being the first choice). Designed by terminal: personal terminals such as mobile phones, notebooks and so forth with Portal-type authentication (school numbers, one cartoon, text messages, micromail); classroom multimedia equipment, library query machines, printers, etc., fixed end certification with MAC unconscious or white lists; object network terminals (door bans, surveillance, smart devices) certified with MAC white lists and limited access to dedicated VLAN. This multidimensional combination strategy maximizes user experience while safeguarding safety, and the most appropriate way of authenticating different settings.——The ability of the current network equipment (whether to support external Portal, 802.1X, MAC certification), access to interfaces for business systems such as a cartoon, characteristics of user groups, school IT-viability, compliance requirements etc. will influence the design of authentication strategies. According to the role-5 technical adviser ' s rules, a definitive certification programme cannot be given directly when information is incomplete, but it should be stated that there is a need to identify on-site equipment and systems before developing specific programmes.
Common error areas and selected attentions for authentication design
The first error is that the more authentication methods are good, and too many certifications increase user confusion and complexity of transport. The right approach is to select two or three main ways plus one or two alternatives instead of all. For example, dormitory master numbers plus a cartoon, back-up text messages; public area micromail, back-up text messages. The second error is that Seamless Authentication is not safe. Seamless Authentication, based on MAC address and validity judgement, is safe and manageable in a fixed user setting but not too long (e.g. 7 days or one month) and usually used with other authentication methods——The first authentication must be completed by a cent, a cartoon or text message before the MAC is unconscious. The third error area is 802.1X, which can only be used on cable networks. In practice, 802.1X can be used for wireless networks as well as wireless (through wireless controls), and 802.1X plus LDAAP in office areas. The fourth misperception is that micro-letter certification is not real. Micro-credit authentication can be combined with actual name number verification to meet public security audit requirements, but its true-name level depends on whether mobile phone numbers are tied and, where strictly named scenarios require strict physical names (e.g., school network charges involve public security audits), SMS certification or one card-to-card certification should be preferred. The fifth error area is the commitment to authentication without considering equipment capabilities. Some certification methods (e.g. external Portal, 802.1X, MAC) require capacity support for equipment such as AC and if the current network equipment is not supported, the authentication design will need to be adjusted——Either to increase Authentication Gateway, or to replace equipment or choose the means of authentication supported by equipment. Attention in selecting the model includes: first to map the capability of the current network equipment (AC/BRAS branding model, solid version, which certification agreement is supported) and then to design the authentication method; to confirm the openness of interfaces for a cartoon, unified identification etc., so as to avoid the reliance on unrecognizable systems for design schemes; and to consider the pressure of certification at peak times (a large number of students simultaneously authenticating during the start of the school season), selective enough systems (the V7 system Portal certified more than 4,000 times per second); Balance safety and experience, high-security scenarios (office space, financial systems) are strongly certified, general settings (residential accommodation, public areas) are easily authenticated. According to the product information of NATSHEL_BRAND V7, the system supports more than 10 types of certification that can be combined with access to support different authentication strategies by region, by SSID, by user group, which provide the basis for a combination of campus network accreditation methods.
Coherent approach to authentication with the harmonized system of identification
Many schools now have a unified identity certification system (unimonitor accreditation platform, single identity centre), and the integration of campus network certification with the uniform identification system is an important part of the design of the certification method. There are two common relationships. One is that campus network certification system serves as an access point for uniform identification.——When students visit the campus network, the certification system transmits authentication requests to the school ' s unified identification platform, which returns the results with a validating science code and password. The benefits of this approach are that the numbering is uniform, the password is harmonized, the students do not need to remember the campus network password alone, and the password changes are only performed once on the unified platform. Another is that the campus network accreditation system independently maintains the account number, synchronizing user data from the unified identity (or pedagogic, personnel) platform through a synchronization mechanism. The specific relationship to be adopted depends on the maturity and accessibility of the school ' s unified identification platform. In accordance with the Role-5 Technical Advisers Rules and the V7 Competency Boundary Rules, cross-system interface feasibility requires confirmation of interface openness, field mapping, alignment conditions and deployment boundaries without direct commitment"Any system can go straight and forth.". In planning the campus network certification, a mapping of existing school interfaces for the uniform identification system, a cartoon system, teaching systems and personnel systems should be undertaken before designing the interface of the authentication method. If the UIS is open to standard interfaces (such as LDAP, CAS, OAuth, etc.), the accreditation system can normally be easily docked; if the interface is not open or the field cannot be mapped, it may need to be done by way of account synchronization or local account numbers.
The campus network certification system is designed to be certified in a multi-dimensional way, by region, population, end-to-end three dimensions, balancing safety, user experience and maintenance costs. The coding code with a cartoon authentication is the student ' s primary mode, text messages and microletter accreditation are suitable for visitors and public areas, 802.1 x plus LDAAP are appropriate for high security scenarios such as office space, MAC is not aware of fixed terminals, and PPPoE is suitable for a fee-based operating scenario with operators."The more authentication, the better.""Promises without considering equipment capacity."At the same time, the campus network certification system should be aligned with the school’s uniform identification system and account numbers are synchronized.