For Telecom Account Managers: Log Fields Required Under MPS Order No.176 — Common Pitfalls in Projects

Since the implementation of MPS Order No.176, network compliance is no longer limited to enabling real-name authentication and keeping simple internet access records. For telecom account managers serving enterprise and park clients, besides broadband and networking services, you must verify whether the existing network supports identity verification, internet behavior logging and subsequent traceability.

Many projects fail not because logs are completely missing, but because records are incomplete, and data from different systems cannot be correlated. When an inspection takes place, it becomes impossible to reconstruct a user’s online activity at a specific time. Reliable log retention has become a must-have value-added service for telecom carriers expanding government and enterprise business.

I. Key Log Fields Required Under MPS Order No.176

First clarification: Order No.176 mandates retention of user registration data and internet logs, yet it does not specify a universal field list applicable to all network scenarios. Field requirements shall be defined project-by-project based on applicable laws, business types and network architecture. Telecom account managers should focus on verifying three categories of data in the pre-sales phase.

1. User Identity Data: Can records be mapped to real individuals?

For Portal-based real-name authentication, verify user registration details, authentication account, authentication method, authentication result and timestamp. Record items vary across different authentication modes.

Managers should confirm whether the authentication system can generate clear user profiles, rather than merely checking if a login webpage exists.

2. Internet Session Data: Can a full network session be reconstructed?

Logs must record not only authenticated users but also complete connection metadata. Key inspection items include:

• Access time, session start and end timestamps
• User account or unique authentication ID
• Assigned private IP and access device information
• Public egress IP, source port and other NAT traceability data
• Access records and events captured by business systems

These are core audit items, even though Order No.176 does not enumerate every single field. Especially for shared public egress and NAT networking: if only one public IP is recorded without port mapping and timestamps, investigators cannot link traffic to individual sessions.

3. Log Management Capabilities: Support for search, export and long-term storage

Writing logs into a database is not enough. Verify:

• Multi-condition search by time, account and IP address
• Batch export and correlation analysis
• Anti-tampering protection to prevent arbitrary deletion or overwriting of logs

Article 21 of the Cybersecurity Law stipulates that network operators must deploy technical measures to monitor network operations and security incidents, and retain network logs for no less than six months. Compliance cannot be confirmed only by the existence of backend logs; retention scope, duration and access control must also meet regulatory requirements.

II. How Telecom Carriers Fill Log Compliance Gaps

1. Audit the existing network first, then add missing functions

Carriers do not need to rebuild the entire network from scratch. First assess the capability boundary of existing optical modems, gateways, authentication platforms and log systems. Identify gaps in identity authentication and log collection, then fix them via device upgrades, platform interconnection or supplementary management modules.

For broadband networks lacking unified authentication and auditing, AINOPOL Cloud Portal and Cloud Audit solutions are highly recommended. The suite supports user authentication, internet log management and record query. Interconnection plans are tailored to on-site device models, interface specifications and deployment conditions.

2. Establish correlation between authentication, IP address and timestamp

During deployment, ensure one-to-one mapping between authenticated accounts and live network sessions, so timestamps, IP addresses and NAT port mappings can be cross-verified. The log platform must support conditional search, batch export, access permission control and a minimum 6-month retention cycle.

Note that the 6-month log retention rule is only one compliance item. Real-name authentication, log integrity and network attack protection must all pass inspection.

III. Two Cooperation Models Between AINOPOL and Telecom Carriers

Many legacy carrier networks still lack full real-name authentication and log retention capabilities. Carriers hold broadband resources, government & enterprise customer channels and local service teams, while AINOPOL provides mature products and technical support. Two cooperation paths are available based on business scale.

1. Single-project cooperation: Start with individual client demands

When account managers identify compliance rectification needs from enterprises, business parks and other clients:

• The carrier delivers client communication, on-site network survey and project coordination;
• AINOPOL provides product solutions, technical docking and implementation support.

Both parties sort out requirements, adapt devices, deploy systems and verify functionality, turning compliance demands into deliverable projects. This model starts with small-scale pilot deployments to validate compatibility before replicating to similar clients.

2. Municipal & provincial-level cooperation: Build large-scale service capacity

If a region has massive government & enterprise clients requiring network compliance upgrades, carriers can establish formal partnerships with AINOPOL at municipal or provincial branch level.
AINOPOL provides standardized solutions, product capabilities and technical training. Carriers leverage their customer network and local branches to roll out projects consistently. Unified technical specifications and implementation workflows eliminate repeated trial-and-error across projects and accelerate solution coverage.

For telecom carriers, this cooperation not only upgrades existing network capabilities but also creates new revenue streams on top of basic broadband services.

Compliance under Order No.176 goes far beyond launching authentication pages and storing logs. The core inspection criteria are:

1. Can user identity, online time, IP address and access records be fully correlated?
2. Can credible records be retrieved quickly during on-site audits?

AINOPOL collaborates with carriers on both single-project deliveries and large-scale provincial standardization. By auditing legacy networks first, supplementing missing capabilities and building replicable implementation plans, carriers can better meet client compliance requirements and expand government & enterprise network service business.

FAQ

Q: Both authentication logs and internet logs are complete and stored separately; why is this still deemed non-compliant?
A: Inspectors under Order No.176 do not check two separate datasets individually. The core requirement is: input a mobile phone number and pull out the full list of online behavior directly. Without session-level association between the two systems, investigators have to manually match timestamps across platforms, resulting in broken evidence chains. In regulatory practice, "authenticated records without session correlation" is treated the same as "no authentication".

Q: How to prove field integrity to clients in pre-sales without verbal commitments?
A: Conduct on-site acceptance testing:

• Search by mobile number to retrieve full records including NAT port range, MAC address, online/offline time and access URL;
• Batch export all records within a selected time period.

Include the full field list and search functions in the delivery checklist to form verifiable acceptance criteria.