From Access to Data Storage: The Timing Sequence Between Cloud Portal and Cloud Audit for a Single Internet Session

Since the enforcement of Ministry of Public Security Order No.176, carrier turnkey projects have exposed a prominent issue. It is not a poor system integration, but rather that real-name authentication and log auditing were never included in the original delivery scope.

Carriers only deliver broadband access and networking services. ONTs are installed, circuits activated, and Wi-Fi made available. However, the ONT only handles WAN configuration, Wi-Fi parameters and firmware upgrades. It has no capability for user identity verification or internet activity logging. Real-name authentication and log retention have long been excluded from carrier networking delivery packages. After Order No.176 came into force, this gap evolved from a common industry practice into a serious compliance risk.

The gap is filled in two complementary layers. AINOPOL Cloud Portal delivers authentication via plug-in deployment, while Cloud Audit handles log correlation and retention on the cloud. These two modules are not standalone components. They operate sequentially on the same timeline: the front stage confirms who the user is, and the back stage records what the user did. The whole chain is linked together by a unique Session ID.

We break down the full timeline from T0 to T6, clarifying accountability boundaries and common failure points.

T0: Terminal Connection — No Authentication on the ONT

A guest connects to Wi-Fi. The carrier ONT only performs broadband forwarding. It lacks native real-name authentication and log generation functions.
The carrier’s TR069 management channel only covers WAN settings, Wi-Fi profiles and firmware updates, with no access to user identity or traffic logs. This is the baseline fact for all carrier networking deployments and the starting point for all compliance upgrades.

T1: Portal Redirection — Plug-in Takes Over

Cloud Portal connects to the carrier ONT as a lightweight plug-in, without altering the ONT’s original broadband forwarding capability. It only pushes the authentication webpage to unauthenticated terminals.
Acceptance checkpoint for integration: Unauthenticated clients are properly intercepted and redirected to the login page; authenticated users enjoy uninterrupted internet access.

T2: Multi-Channel Real-Name Verification

The guest selects a verification method on the Portal page. Cloud Portal supports SMS verification, document scanning (including passports and Mainland Travel Permits for HK/Mac/TW residents), and WeChat one-click login.
For international hotels, document verification must be fully functional. Foreign visitors being blocked at the login stage is a top cause of customer complaints. Channel exceptions and automatic fallback rules are centrally configured via the EaaS cloud management platform.

T3: Access Granted + 4-Tuple Written Simultaneously

Two actions must be triggered together upon successful verification:

1. The terminal is granted internet access;
2. The system writes the 4-tuple (user ID, terminal MAC, terminal IP, login timestamp) and generates a unique Session ID.

These two steps must be tightly coupled. If access is enabled before data persistence, guests can browse normally, yet no session records are saved. Such failures are nearly invisible to regular system monitoring.

T4: Behavior Log Collection & Cloud Upload

Access records and traffic data generated during the online session are collected and uploaded.
Mandatory collected fields: mobile number / ID number, MAC address, IP address, login time, full access URL, uplink & downlink traffic. Missing fields at this stage cannot be fixed afterward.

T5: Cloud Correlation — Matching Records by Session ID

All traffic logs are aggregated on the cloud. Cloud Audit aligns traffic logs with authentication records using the Session ID.
This is where authentication data and behavior logs form a complete traceability chain. No local log server is deployed on-site; all data correlation and storage take place on the cloud.

T6: Log Retention & Report Export

Correlated logs are stored with a rolling retention period of no less than 180 days, subject to local public security bureau requirements. Inspectors can export full browsing history filtered by mobile number or time window. This completes the whole lifecycle of one internet session.

Three Most Common Breakpoints in the Timing Chain

Field data shows three high-risk failure points, all of which do not affect user internet experience and can only be detected via data auditing:

1. T3: Access permission is granted before the 4-tuple is written to the database;
2. T4: Key log fields are missing during data collection;
3. T5: Session ID matching fails between authentication records and traffic logs.

Three acceptance tests must be added to the project checklist:

• Compare hourly counts of successful authentications against persisted session records;
• Monitor the null-value ratio of all mandatory log fields;
• Perform random traceback tests by mobile number to verify complete log linkage.

Order No.176 requires a complete, auditable and forensically sound evidence chain. The traceability chain is not built by separate modules, but by keeping every stage intact from T0 to T6.
Treat this full timeline as the core delivery standard, instead of accepting authentication and logging as two independent items. Only then can carriers fully deliver enforceable compliance capabilities for turnkey venue networking projects.

FAQ

Q1: Why can’t carrier ONTs run real-name authentication directly?
A1: ONTs are designed purely for broadband forwarding. The TR069 management interface only manages WAN connectivity, Wi-Fi settings and firmware upgrades. They have no built-in identity verification or log storage functions. Compliance must be supplemented with Cloud Portal and Cloud Audit plug-ins.

Q2: Will Cloud Portal modify the original functions of the ONT?
A2: No. It runs as a plug-in without changing the ONT’s forwarding logic. It only handles Portal page push, multi-channel real-name verification and 4-tuple data writing.

Q3: How are authentication records matched with internet behavior logs?
A3: Correlation is implemented on the cloud via Session ID, managed by Cloud Audit. No local log server needs to be deployed on the customer premises.