The users of WiFi on campus are divided into three categories: students, teachers, visitors. The certification needs of the three categories are very different. Students can complain if they are convenient, when they drop their lines, and when they lose their passwords; teachers have to have a stable identity sign, preferably with the school account system; visitors are temporary, fast, retroactive, time-bound. A set of certification methods does not work in the campus landscape.
NatShell V7 Authentication & Billing supports more than 10 authentication methods, covering account codes, one key login, text messages, micro-mails, APP (business micro-letters, nails, flyers and custom-defined APPs), ID card brushing, unconsciousness, LDAP, 802.1X, PEAP, EAP-SIM and third party data source certification (a cartoon, OA, any third-party database). In the WiFi landscape, the recommended combination of the mode of authentication is: micro-letter authentication, SMS authentication, APP authentication as a master, account number password and no awareness as an alternative.
Students group: priority experience, combination of use
Students are the main users of WiFi on campus, and most sensitive to certification experiences. Micro-letter authentication codes, which connects APP certification with school App, are a good choice; SMS certification meets real name requirements at the same time and is appropriate for opening the account; daily repeater settings, in conjunction with Mac Seamless Authentication, require that students re-involve after first accreditation without repeating input. It should be recalled that NATSHELL_SEAMLES_AUTH based on its MAC address and validity period, has too long validity periods with security risks, short experience differences, and requires operators to balance safety and experience.
If the campus is operated on a fee-based basis, student certification usually binds to an account number: in the school self-built mode, the school number is the online account and a cartoon system; in the operator ' s dialling mode, the mobile phone number is the online account number, which is tied to the operator ' s set of meals. How does the account number have a direct impact on subsequent opening accounts, paying fees, auditing the entire chain?
Teachers ' group: unified identity, stable and reliable
The accounts of teachers and staff are stable and manageable. V7 supports the LDAP certification, combined with Windows domain certification, to achieve a uniform identity authentication and distribution of privileges; supports third-party data source certification, which connects existing school teacher management systems, and the teacher's account numbers to the school personnel account number system without additional registration.
Teachers can also divide their user groups by department and faculty. V7 supports multi-level user groups, which can be associated with different package strategies, defined in the words IP, ACIP, ACNAME. Teachers from different regions of the teaching service, library, administrative building may have different access rights and bandwidth strategies. For example, a scientific laboratory area requires high bandwidth, regular bandwidth for ordinary office areas, which can be distinguished through a user group strategy.
Visitors ' groups: temporary, rapid and retroactive
Visitors are the most demanding group in WiFi. Academic meetings, open-door admission days, parents visit, and there is a small number of visitors but clear certification needs: fast (not to teach a student half a day), time limits (not to use until the end of the meeting), retroactive (who can be found if problems arise). SMS authentication is the usual way for visitors to view, with mobile phone numbers running as soon as they are available; it may also be authorized by administrators to generate temporary account numbers or visitor passwords, setting valid durations and expiry periods automatically.
Visitors can also be customized to match the authentication page. V7 supports matching of different certification pages with IP, SSID, gateway names, ACIP, mobile terminals and PC templates, which are configured separately, and a customised pre-auction advertising page, post-certification jump page.
Combining and landing of authentication methods
The more you choose, the more complex and user-disturbed systems, the more you can be. The key is to combine them according to the user group, security level and operational objectives: students with micro-mail/APP plus insensitiveness, teachers with a unified identity, visitors with text messages plus temporary authorization. V7 supports mixed access through multiple authentication methods, with different groups of users in the same system, which is the most practical capability for campus settings.
The security phase and the experience trade-off also need to be designed in such a way as to: the highest level of safety (e.g. double factor certification, 802.1X) is appropriate for high-sensitized areas such as finance, machine rooms; the high level of security (text message certification, LDAP) is suitable for general office; the medium level of security (micromail, APP, SMS combination) is appropriate for student accommodation and public areas.
Several prerequisites are also identified when they land: micro-credit requires public and commercial configuration, text message authentication requires SMS access, APP certification needs school App collaboration, LDAP and third-party data source validation require each other’s system interface open. The authentication method is enabled depending on whether these external conditions are in place, the selection of the type is confirmed item by item, and it is more economical to go back online than to do.
The selection could be compared with a set of diagnostic questions: whether the project scenario is campus or other industry, and whether it determines the direction to be recommended for certification; whether security phase requirements are low, medium, high or highest, and whether double factors such as 802.1X are required for verification; whether micro-letters are widely used by user groups to determine their priority status; whether there is an AD domain or unified identification system in schools that decides on the necessity of LDAP and third-party data source authentication; whether projects require real name authentication and traceability and SMS certification cannot be overridden; and whether they interface with operator AAAA, which evaluates PPPoE, proxy, AAA. Once again, the portfolio of accreditation modalities has largely emerged.
The authentication method is designed to be a sort of combing of the campus ' s user structure. Three groups of people, their needs, corresponding authentication methods, matching account numbers, and these are clear, and Authentication & Billing is the foundation of the system.