JP4697278B2 - Access point device detection method and control method, access point detection device, access point device, and wireless LAN system - Google Patents

Description

  The present invention relates to an access point device detection method and control method, an access point detection device, an access point device, and a wireless LAN system. For example, in a wireless LAN network, an unauthorized access point device connected outside the local network is detected. However, it is intended to prevent the terminal from connecting to the unauthorized access point device.

  For example, in a wireless LAN system in a company, wireless LAN terminals 1-1 to 1-N relay access point apparatuses 3-1 to 3-M connected to their own network 2 as shown in FIG. Network connection is performed (for example, refer to FIG. 3 of Patent Document 1).

  The wireless LAN terminal 1-n (n is 1 to N) and the access point device 3-m (m is 1 to M) can be connected without using a communication cable by using wireless, and the terminal can be moved freely. The degree becomes higher.

For this reason, wireless LAN systems are rapidly spreading as corporate network infrastructure.
JP 2000-31162 A International Publication No. 2005/057333

  However, wireless radio waves fly beyond the walls of the companies building wireless LANs, so a third party moves an unauthorized access point device outside the premises for the purpose of illegally acquiring data. When installed, it is difficult for a wireless LAN terminal to detect whether the access point device is illegal.

  In view of such points, the applicant of the present application has proposed a method in which a legitimate access point device detects that an unauthorized access point exists in the vicinity of itself (Japanese Patent Application No. 2006-060094 and the drawings). .

  However, in the wireless LAN system, since it is not a cable connection, it is difficult for the terminal itself to know which access point device the wireless LAN terminal 1-n is connected to. Further, as shown in FIG. Even if the device 3-m detects the presence of an unauthorized access point device 4 in the vicinity, there is no means for notifying the wireless LAN terminal 1-n of the fact, and the wireless LAN terminal 1-n is informed to the unauthorized access point device 4. It cannot be prevented from connecting.

  Patent Document 2 describes the concept of detecting an unauthorized access point device by a detection device, transmitting a beacon frame for confusion by the detection device, and destabilizing and desynchronizing the unauthorized access point device. However, no more specific detection method has been proposed.

  Therefore, an access point device detection method, control method, access point detection device, access point device, and wireless LAN system that can detect an unauthorized access point device and prevent a wireless LAN terminal from connecting to the unauthorized access point device. Is required.

  A first aspect of the present invention is a method for detecting an access point device in an access point detection device connected to a wired LAN, wherein (1) a wireless space around the access point detection device is monitored, and the first access point device An access point detection step of obtaining the identification information of the access point storage unit, and (2) a first access point device of the identification information stored in the wired LAN, the access point storage unit, and (2) access point search data; Are transmitted in this order or in reverse order so as to return to the access point detection apparatus, and the access point is searched for the first access point apparatus on the path where the access point search data has returned. A search data communication step of storing in the storage unit that the device is a regular device; ) While identifying information is stored in the access point storage unit, an access point device that is not stored as a legitimate device is recognized as an unauthorized access point device, and a beacon frame from the unauthorized access point device An access point specifying step for obtaining transmission cycle information is provided.

  A second aspect of the present invention is a method for controlling an access point apparatus in an access point apparatus that communicates with a wireless LAN terminal and is connected to a wired LAN, and (1) an access in the access point detection apparatus according to the first aspect of the present invention. A disturbing access point detection step to which the point device detection method is applied, and (2) a beacon frame is transmitted from the recognized unauthorized access point device according to the transmission period information of the beacon frame from the unauthorized access point device. A jamming timing timing step for timing timing, and (3) a data creation and transmission step for creating jamming data and transmitting it to a radio space at a timing when a beacon frame is transmitted from a recognized unauthorized access point device. It is characterized by.

  According to a third aspect of the present invention, in the access point detection apparatus connected to the wired LAN, (1) the wireless space around the access point detection apparatus is monitored, and the identification information of the first access point apparatus is obtained to store the access point. The access point detection unit stored in the unit, and (2) the access point search data in the order of the wireless LAN and the first access point device of the identification information stored in the access point storage unit in this order, or In the reverse order, it is transmitted so as to return to the access point detection device, and the access point storage unit indicates that the first access point device on the route from which the access point search data has returned is a regular device. A search data communication unit to store, and (3) identification information is stored in the access point storage unit. Therefore, the access point identifying unit that recognizes an access point device that is not stored as a legitimate device as an unauthorized access point device and obtains transmission cycle information of a beacon frame from the unauthorized access point device; It is characterized by having.

  According to a fourth aspect of the present invention, in an access point device that communicates with a wireless LAN terminal and is connected to a wired LAN, (1) a disturbing access point detection unit to which the access point detection device according to the third aspect of the present invention is applied; 2) an interference timing timer that measures the timing at which a beacon frame is transmitted from a recognized unauthorized access point device in accordance with transmission period information of the beacon frame from the unauthorized access point device; and (3) recognized And a data creation / transmission unit that creates jamming data and transmits it to a wireless space at a timing when a beacon frame is transmitted from an unauthorized access point device.

  According to a fifth aspect of the present invention, there is provided a wireless LAN system in which a plurality of access point devices communicating with a wireless LAN terminal are connected by a wired LAN. A point device is applied.

  According to the present invention, it is possible to detect an unauthorized access point device and prevent a wireless LAN terminal from connecting to an unauthorized access point device.

(A) Embodiment Hereinafter, an embodiment of an access point device detection method and control method, an access point detection device, an access point device, and a wireless LAN system according to the present invention will be described in detail with reference to the drawings.

(A-1) Configuration of Embodiment In the wireless LAN system according to this embodiment, the arrangement of the components is the same as that shown in FIG.

  The access point device 3-m includes a wireless communication unit that performs communication with the wireless LAN terminal 1-n in its own area, a wired communication unit that performs communication with the company network (wired LAN portion) 2, and these wireless communication units. It has a signal processing unit that intervenes in signal transfer of the communication unit and the wired communication unit, and executes connection control when the signal is a control signal.

  Here, the signal processing unit mainly has a software processing configuration centering on a CPU and the like. In this embodiment, a part of the software configuration in the access point device 3-m (signal processing unit) is as follows. As shown in FIG. FIG. 1 shows a portion related to a function of detecting an unauthorized access point device and preventing connection between the unauthorized access point device and the wireless LAN terminal, and other functions such as a control signal processing function. The components related to are omitted.

  In FIG. 1, the access point device 3-m includes a wireless LAN driver 31, a wireless data communication processing unit 32, an unauthorized access point detection unit 33, a wired LAN driver 34, an adjacent access point table 35, an interference timer control unit 36, and interference data. A creation unit 37 and the like are included.

  The wireless LAN driver 31 controls the wireless LAN protocol and performs wireless data transmission / reception. The communication partner of the access point device 3-m is the wireless LAN terminal 1-n, but the transmission data of the adjacent access point device 3-j (j is 1 to M, except m) also reaches the wireless LAN terminal 1-n. The driver 31 may also receive transmission data of such an adjacent access point device 3-j.

  Further, the wireless LAN driver 31 drives search data (control signal including search data), which will be described later, and interference data (control signal including interference data), which will be described later, in the wireless space (jurisdiction area) by driving the wireless data communication processing unit 32. ). The access point device 3-m has a plurality of wireless channels so that a plurality of wireless LAN terminals can be accommodated, and transmits search data through an empty channel that is not used for communication with the wireless LAN terminals. .

  The wireless data communication processing unit 32 receives data received by the wireless LAN driver 31 and analyzes the contents thereof.

  When the wireless data communication processing unit 32 receives a beacon frame from the adjacent access point device 3-j, the wireless data communication processing unit 32 stores information on the adjacent access point device in the adjacent access point table 35. Here, the information of the adjacent access point device 3-j to be stored is identification information of the adjacent access point device (for example, BSSID (Basic Service Set Identifier)) or a beacon period (this is stored only for an unauthorized access point device). is there.

  The beacon frame includes “BSSID”, “beacon cycle”, and “various information (security information, communication speed, etc.) for connecting to the access point device”. The beacon frame is for instructing the wireless LAN terminal that an access point device exists in the vicinity thereof, and the wireless LAN terminal receives its own accommodation destination (connection destination) by receiving the beacon frame. The information of the access point device is obtained.

  When the wireless data communication processing unit 32 receives the search data from the adjacent access point device 3-j, the wireless data communication processing unit 32 sets the status of the information of the adjacent access point device 3-j in the adjacent access point table 35 to “regular”. Is.

  The wireless data communication processing unit 32 causes the wireless LAN driver 31 to transmit the search data given from the company network (wired LAN portion) 2 side to the wireless space.

  Further, the wireless data communication processing unit 32 causes the wireless LAN driver 31 to transmit the interference data created by the interference data creation unit 37 to the wireless space.

  The unauthorized access point detection unit 33 periodically transmits search data to the wired LAN portion (in-house network) 2 in order to search for the unauthorized access point device 4. The unauthorized access point detection unit 33 checks the status of the adjacent access point table 35 when a predetermined time has elapsed after transmitting search data, and determines whether there is an unauthorized access point device 4 or not. Is.

  When the unauthorized access point detection unit 33 detects the presence of the unauthorized access point device 4, the unauthorized access point detection unit 33 sends detection data (for example, specifying data such as BSSID) to the wired LAN portion (in-house network) 2. The data is transmitted to a connected higher-level device (not shown), and handed over to the interference timer control unit 36 to the identification information and beacon period (including information on the previous beacon transmission timing) of the unauthorized access point device 4.

  In addition, the unauthorized access point detection unit 33 delivers search data to the wireless data communication processing unit 32 when the search data is given from the wired LAN part (own company network) 2 side, and causes the wireless LAN driver 31 to transmit it to the wireless space. It is.

  The wired LAN driver 34 controls the protocol of the wired LAN part (in-house network) 2 and performs data transmission / reception with the wired LAN part 2.

  The adjacent access point table 35 is a data file for storing information of the adjacent access point device 3-j (device identification information, regular device flag, beacon period). Writing to the adjacent access point table 35 is performed by the wireless data communication processing unit 32 as described above. The status in the adjacent access point table 35 is referred to by the unauthorized access point detection unit 33.

  The jamming timer control unit 36 instructs the jamming data creation unit 37 to create jamming data for each beacon period of the unauthorized access point device 4 read from the adjacent access point table 35.

  The jamming data creation unit 37 creates jamming data according to an instruction from the jamming timer control unit 36, gives the jamming data to the radio data communication processing unit 32, and transmits the radio data to the radio space.

(A-2) Operation of Embodiment Next, the operation of the wireless LAN system of the embodiment is detected by an unauthorized access point device detection operation (A-3), and an unauthorized access point device is connected to a wireless LAN terminal. It demonstrates in order of (A-4).

(A-3-1) Recognition of adjacent access point device Each access point device 3-m monitors the radio waves of the surrounding wireless LAN and must be transmitted by the access point device as shown in FIG. A control frame of a wireless LAN called “beacon” is monitored. The beacon frames of the access point devices 3-j and 4 adjacent to the access point device 3-m generally reach the access point device 3-m.

  Since the BSSID of the transmission source is inserted in the beacon frame, the wireless data communication processing unit 32 of the access point device 3-m stores the BSSID in the received beacon frame in the adjacent access point table 35. Stored as identification information of the adjacent access point devices 3-j and 4. In the example of FIG. 4, the adjacent access point table 35 of the access point device 3-m includes the identification information of the legitimate adjacent access point device 3-j and the identification information of the illegal adjacent access point device 4. Stored.

  FIG. 6 is a flowchart showing the reception process of the wireless data communication processing unit 32. The wireless data communication processing unit 32 stores the BSSID in the adjacent access point table 35 when it is determined as a beacon in the step of determining whether or not it is a “beacon” (steps 100 and 101).

(A-3-2) Broadcast search data Each access point device 3-m starts the process shown in FIG. 5 by interruption every predetermined period (for example, 30 minutes), and each access point device 3-m is illegal. The access point detection unit 33 transmits “illegal access point search data” as broadcast data to the company network (wired LAN portion) 2 (step 150). Here, the unauthorized access point search data may be broadcast data, and the format thereof is not limited.

  Since the unauthorized access point search data is transmitted to the company network (wired LAN portion) 2, it reaches the regular access point device 3-j but does not reach the unauthorized access point device 4. Since the unauthorized access point search data is broadcast data, the legitimate access point apparatus 3-j determines that it is necessary to relay to the wireless LAN side, and transmits the unauthorized access point search data to the wireless LAN side.

  As a result, as shown in FIG. 7, the legitimate access point device 3-j wirelessly transmits the unauthorized access point search data to its own jurisdiction area. Search data is not sent.

  As described above, the wireless data communication processing unit 32 performs the reception processing shown in FIG. The wireless data communication processing unit 32 of the access point device 3-m that has instructed to broadcast the unauthorized access point search data receives the unauthorized access point search data of the transmission source from the wireless LAN side from the adjacent access point device 3-j. When this occurs, the status of “regular” is stored in association with the BSSID (identification information of the adjacent access point device 3-j) related to the reception of the current search data in the adjacent access point table 35 (steps 102 and 103).

  The wireless data communication processing unit 32 of the access point device 3-m receives the unauthorized access point search data of the transmission source from the wireless LAN side within a predetermined time (for example, 3 minutes) from the time when the broadcast is instructed. It is also possible to store the status of “regular” only when it is possible, and even if the unauthorized access point search data is received over a predetermined time, the reception is regarded as “not received”. For example, even if the unauthorized access point device 4 receives the search data wirelessly transmitted by the adjacent access point device 3-j, and transmits the search data in a hurry, the reception may be regarded as “not received”. What is necessary is just to select predetermined time so that it can do.

  On the other hand, since the unauthorized access point device 4 does not transmit the unauthorized access point search data to the wireless LAN side, the adjacent access point table 35 in the access point device 3-m that is the transmission source of the unauthorized access point search data is A “normal” status is not stored in association with the BSSID (identification information) of the unauthorized access point device 4.

(A-3-3) Recognition of Unauthorized Access Point Device The unauthorized access point detection unit 33 of the access point device 3-m that is the transmission source of the unauthorized access point search data is a predetermined time (for example, 5 minutes) from the time of transmission. When the time has elapsed, the process shown in FIG. 8 is started by interruption, and the BSSID (identification information) to which the “normal” status is not given is acquired from the adjacent access point table 35 (step 200). The BSSID (identification information) to which the status of “regular” is not given is the BSSID (identification information) of the unauthorized access point device 4, thereby detecting (recognizing) the presence of the unauthorized access point device 4. Can do.

  Although omitted in FIG. 8, when the unauthorized access point detection unit 33 detects the presence of the unauthorized access point device 4, it notifies the host device, and the host device performs a predetermined protection operation, an abnormality notification operation, and the like. For example, the presence of an unauthorized access point device 4 is notified to a monitor by the sound of a buzzer, or the presence of an unauthorized access point device 4 is notified by automatic in-house broadcasting. At that time, the location information of the access point device 3-m that has detected the presence of the unauthorized access point device 4 may be broadcasted to teach the attention location.

(A-4) Prevention of connection with unauthorized access point device When the unauthorized access point detection unit 33 of the access point device 3-m detects the presence of the unauthorized access point device 4, as shown in FIG. After obtaining the beacon period (including the next transmission timing) from the beacon from the access point device 4 and registering it in the adjacent access point table 35 (steps 300 and 301), the disturbance timer control unit 36 is activated (step 302). ).

  Thus, the jamming timer control unit 36 causes the jamming data creation unit 37 to create jamming data (dummy data for jamming) in accordance with the beacon period of the unauthorized access point device 4, and the jamming data is transferred to the wireless space. Transmit (step 350).

  As shown in FIG. 10, even if the wireless LAN terminal 1-n exists in a range where the beacon of the unauthorized access point device 4 reaches, the wireless LAN terminal 1-n includes the unauthorized access point device 4. The beacon and the disturbance data transmitted from the access point device 3-m arrive at the same time, and the wireless LAN terminal 1-n cannot correctly receive the beacon of the unauthorized access point device 4. As a result, the wireless LAN terminal 1-n is not connected (accommodated) to the unauthorized access point device 4.

  The jamming data (dummy data for jamming) is not particularly limited as long as it can make the demodulation of the beacon of the unauthorized access point device received by the wireless LAN terminal an error.

(A-5) Effect of Embodiment As described above, according to the above-described embodiment, it is possible to recognize the presence of an unauthorized access point device and to prevent the unauthorized access point device from being connected to a wireless LAN terminal. Can do. That is, when an unauthorized access point device is detected, the wireless LAN terminal is immediately prevented from being connected, and data leakage can be prevented.

(B) Other Embodiments In the above-described embodiment, the access point device 3-m performing the detection operation broadcasts the unauthorized access point search data. However, the identification information is included in the adjacent access point table 35. The access point device may be multicast from the stored adjacent access point device (in this case, it may be routed through the host device), and the adjacent access point device whose identification information is stored in the adjacent access point table 35 Alternatively, the search data may be transmitted individually from each one (in this case, the search data may be routed through a host device). In the latter case, the adjacent access point apparatus 3-j may be caused to execute a wireless transmission operation similar to that of a wireless LAN terminal that accommodates the adjacent access point apparatus 3-m.

  In the above embodiment, the access point device 3-m performing the detection operation transmits the unauthorized access point search data to the company network (wired LAN portion) 2 and monitors the wireless search data of the adjacent access point device. By doing so, the device that recognizes the normal adjacent access point device 3-j has been shown. However, the search data may be circulated through the reverse loop path to recognize the normal adjacent access point device 3-j. For example, the access point device 3-m performing the detection operation wirelessly transmits the unauthorized access point search data addressed to itself and receives the unauthorized access point search data transmitted wirelessly. By allowing j to feed back the unauthorized access point search data to the access point device 3-m via the company's network (wired LAN portion) 2 (in this case, it may be routed through the host device), the legitimate adjacent access point The device may be recognized.

  Further, in the above embodiment, all the access point devices have been shown to have an unauthorized access point device detection function, but some access point devices have an unauthorized access point device detection function. It may be. For example, an access point device installed at a position close to the outer wall of a building may have a detection function of an unauthorized access point device.

  Furthermore, in the above embodiment, the beacon period of the unauthorized access point device is shown after being recognized as unauthorized, but it is registered in the table during the search operation and used immediately when it is recognized as unauthorized. You may make it do.

  Although not described in the above embodiment, it is monitored whether the unauthorized access point device continues to transmit beacons, and when the unauthorized access point device stops transmitting beacons, the transmission of jamming data is terminated. Anyway.

  In the above-described embodiment, the transmission data is transmitted at the same transmission power as that at the time of transmission of other data, but the transmission power may be increased as compared with the transmission of other data. . Further, in consideration of a timer timing error, the disturbance data may be transmitted for a period longer than the period in which the unauthorized access point device determines to transmit a beacon.

It is a functional block diagram which shows the software structure of the access point apparatus of embodiment. 1 is a block diagram showing a basic configuration of a corporate wireless LAN system. FIG. It is explanatory drawing of the conventional subject. It is explanatory drawing of the beacon frame utilized in embodiment. It is a flowchart which shows the process at the time of reception of the wireless data communication process part of embodiment. It is a flowchart which shows the transmission operation | movement of the unauthorized access point search data by the unauthorized access point detection part of embodiment. It is explanatory drawing which shows a mode that only the regular adjacent access point apparatus of embodiment transmits radio | wireless unauthorized access point search data. It is a flowchart which shows the recognition operation | movement of the regular adjacent access point apparatus of the unauthorized access point detection part of embodiment. It is a flowchart which shows a series of operation | movement for transmitting the interference data in embodiment. It is explanatory drawing which shows the mode of the collision with the interference data of embodiment, and the beacon from an unauthorized access point apparatus.

Explanation of symbols

  1-1 to 1-N: wireless LAN terminal, 2 ... own network (wired LAN), 3-1 to 3-M ... access point device, 31 ... wireless LAN driver, 32 ... wireless data communication processing unit, 33 ... illegal Access point detection unit 34... Wired LAN driver 35. Adjacent access point table 36. Interference timer control unit 37 37 Interference data creation unit

Claims (5)

An access point device detection method in an access point detection device connected to a wired LAN,
An access point detection step of monitoring the wireless space around the access point detection device, obtaining identification information of the first access point device and storing it in the access point storage unit;
The access point search data is transmitted to the access point detection device via the wired LAN and the wireless line with the first access point device of the identification information stored in the access point storage unit in this order or in reverse order. A search data communication step for storing the fact that the access point search data is a legitimate device in the access point storage unit for the first access point device on the route where the access point search data has returned;
While identifying information is stored in the access point storage unit, an access point device that is not stored as a legitimate device is recognized as an unauthorized access point device, and a beacon frame is transmitted from the unauthorized access point device. An access point identifying step for obtaining period information. A method for detecting an access point device. A method for controlling an access point device in an access point device that communicates with a wireless LAN terminal and is connected to a wired LAN,
A disturbing access point detection step of applying the access point device detection method in the access point detection device according to claim 1;
A disturbance timing timing step for timing the timing at which a beacon frame is transmitted from a recognized unauthorized access point device according to the transmission cycle information of the beacon frame from an unauthorized access point device,
A control method for an access point device, comprising: a data creation and transmission step of creating jamming data and transmitting it to a radio space at a timing when a beacon frame is transmitted from a recognized unauthorized access point device. In an access point detection device connected to a wired LAN,
An access point detection unit that monitors the wireless space around the access point detection device, obtains identification information of the first access point device, and stores the identification information in the access point storage unit;
The access point search data is transmitted to the access point detection device via the wired LAN and a wireless line with the first access point device of the identification information stored in the access point storage unit in this order or in reverse order. A search data communication unit that transmits information so as to return, and stores the fact that the access point storage data is a legitimate device in the access point storage unit for the first access point device on the route where the access point search data has returned;
While identifying information is stored in the access point storage unit, an access point device that is not stored as a legitimate device is recognized as an unauthorized access point device, and a beacon frame is transmitted from the unauthorized access point device. An access point detection apparatus comprising: the access point specifying unit for obtaining period information. In an access point device that communicates with a wireless LAN terminal and is connected to a wired LAN,
A disturbing access point detection unit to which the access point detection device according to claim 3 is applied;
In accordance with the transmission cycle information of the beacon frame from the unauthorized access point device, an interference timing timing unit that measures the timing at which the recognized beacon frame is transmitted from the unauthorized access point device,
An access point device comprising: a data creation and transmission unit that creates jamming data and transmits it to a wireless space at a timing when a beacon frame is transmitted from a recognized unauthorized access point device. In a wireless LAN system in which a plurality of access point devices communicating with a wireless LAN terminal are connected by a wired LAN,
A wireless LAN system, wherein the access point device according to claim 4 is applied as at least a part of the plurality of access point devices.

Images