Visitor Network Control for Incubators & Maker Spaces: All-Optical Self-Service Authentication Isolates Visitors from Internal Networks

Incubators, maker spaces and shared office campuses differ from ordinary corporate office buildings. They host numerous tenant enterprises with high personnel turnover. Besides regular staff, the network is constantly accessed by clients, investors, partners and temporary visitors. For operators, providing Wi-Fi is only a basic service. The real challenge lies in answering three key questions: who is accessing the network, what resources can they reach, and whether access permissions are revoked promptly after visitors leave.

If a universal Wi-Fi password is still used to manage visitors, employees, tenants and outsiders will share the same network. Once a visitor’s terminal carries security vulnerabilities, it may become an entry point into the enterprise intranet. Therefore, network construction for incubators and maker spaces needs to evolve from simple internet connectivity to identifiable, isolated and controllable network access.

I. Why Incubator Visitor Networks Cannot Rely on a Single Wi-Fi Password

Easy access, but hard identity mapping

Dozens of different people come and go in maker spaces every day. If all visitors use one shared Wi-Fi password, operators cannot identify individual users. Once the password is forwarded, the guest network intended for visiting clients may be abused by unauthorized people for a long time.

For campuses subject to cybersecurity governance, visitor access should have a clear identity verification entry, rather than merely granting access to anyone who knows the password.

Visitors can access the internet, but must not reach tenant internal networks

A defining feature of incubators is that multiple enterprises share the same infrastructure. Although tenants share the campus network, their office PCs, servers, printers and business systems are independent network assets.

Without effective isolation between visitor networks and office networks, visitor terminals may discover internal devices after connecting. Especially when visitors’ phones or laptops contain unpatched vulnerabilities, the open network creates extra risks for tenant intranets.

The core goal of visitor networking is not simply bandwidth throttling, but defining access boundaries at the network layer, so visitors can only access authorized internet resources.

Frequent personnel turnover makes manual permission management cumbersome

If IT staff must manually create accounts and configure network access for every visitor, the administrative workload piles up over time. Worse still, temporary accounts that are not cancelled in time retain active access rights.

Incubators and co-working spaces are better suited to self-service authentication with automatic expiry. Visitors complete network access by themselves, and the system manages permissions according to predefined validity periods.

II. AINOPOL All-Optical Network: Self-Service Authentication and Independent Internet Access for Visitors

For high-turnover scenarios such as incubators and maker spaces, AINOPOL builds a visitor self-service authentication system on top of the all-optical network, integrating authentication, isolation and network management.

Portal self-service authentication for visitor network access

After connecting to campus Wi-Fi, visitors go through authentication via a Portal page. Supported methods include WeChat QR code verification and SMS verification codes, configurable according to management requirements. Operators no longer need to distribute a universal password. Visitors gain corresponding network access rights after authentication.

Temporary visitor accounts can be assigned lifespans and expire automatically, eliminating manual account revocation work. AINOPOL’s visitor Portal self-service authentication solution isolates guest networks from internal LANs and automatically deletes accounts upon expiry.

Independent visitor network partitioning to protect office resources

Authentication is only the first line of defence. True security boundaries rely on network isolation.

AINOPOL all-optical networks use VLAN, ACL and other technologies to separate visitor Wi-Fi from tenant office networks into distinct logical networks. Visitors only receive internet access, not access to internal corporate LANs.

Even after connecting to campus Wi-Fi, visitors cannot freely access other tenants’ PCs, file servers, printers or internal assets. Office, guest and security services can be managed independently on demand.

Combine authentication with logging to record all network activities

Campus operators need traceability for visitor network activities. Associating authentication data with network logs enables investigation of abnormal behaviour using timestamps, account information and terminal identifiers, instead of facing anonymous traffic on a shared Wi-Fi.

AINOPOL integrates Portal authentication, network isolation and log management, transforming guest Wi-Fi from a simple free internet service into an identity-based, permission-controlled and fully auditable network service.

III. All-Optical + Security Integration to Build an Integrated Communication & Encryption Network for Incubators

For incubators and maker spaces, the network serves not only visitor internet access, but also tenant office work, wireless access, access control, cameras and multiple other services. Deploying a separate network for every new service increases hardware and O&M complexity.

Built on the all-optical foundation, AINOPOL combines communication and security capabilities. Multiple services can be accessed and isolated on one unified network base. Office networks support tenant daily operations, visitor networks provide controlled internet access, and security devices are assigned independent network zones to prevent cross-service interference.

This demonstrates the value of integrated communication & encryption in campus scenarios: the network is not only for data transmission, but also handles identity authentication, access control, network segmentation and threat defence. The communication infrastructure evolves from basic connectivity into a core component of campus security management.

Via the EAAS cloud platform, operators can centrally manage optical gateways, APs, ONUs and other devices. When new tenants move in or visitor network policies require adjustment, configurations can be modified remotely, reducing repeated on-site troubleshooting.

Network requirements for incubators and maker spaces keep changing along with tenant numbers, office areas and business types. Simply adding APs or updating Wi-Fi passwords cannot resolve access boundary issues in multi-tenant environments.

Built on an all-optical foundation, the solution clarifies visitor identity via Portal self-service authentication, draws logical boundaries between visitors, tenants and security networks, and combines log auditing with cloud O&M. This makes the visitor network convenient to use while preventing privilege escalation.

For incubators continuously attracting new enterprises and teams, this all-optical-based architecture with converged communication and security reserves room for future expansion and service upgrades. It improves visitor experience while establishing a clear network governance system for campus operators.

FAQ

Q: What requirements does Decree No.176 impose on incubator visitor networks?
A: Article 7 of Decree No.176 lists public internet service providers as targets for supervision and inspection. Inspectors focus on whether operators legally record and retain user registration information and internet access logs. As venues offering Wi-Fi to visitors, incubators must implement real-name authentication and log retention.

Q: Is the QR-code password distribution method compliant?
A: It is non-compliant. If users only receive a universal password after scanning a QR code with no real-name verification, the requirement to record and preserve user registration information cannot be met. The system must implement one account per person with real-name traceability.

Q: Do visitor accounts remain active after visitors leave?
A: No. Administrators can customise account validity periods. Once the preset time expires, the system automatically revokes network permissions and fully deletes accounts without manual IT intervention.