KR101553827B1 - System for detecting and blocking illegal access point - Google Patents

Abstract

The present invention relates to an illegal access point (AP) detection and blocking system, which is an illegal access point (AP) detection and blocking system, which is included in a wireless communication device, An AP access management apparatus that acquires neighbor AP information and manages connection to a neighboring AP; And a server for storing and managing a normal AP list and an illegal AP list, wherein the server transmits the normal AP list to the AP connection management apparatus via the wireless communication device, and the AP connection management apparatus generates, based on the normal AP list And determines whether the neighboring AP is an illegal AP.

Description

SYSTEM FOR DETECTING AND BLOCKING ILLEGAL ACCESS POINT [

The present invention relates to an illegal access point (AP) detection and blocking system, and more particularly, to an illegal access point (AP) detection and blocking system that collects information of nearby APs, easily and efficiently judges whether or not an adjacent AP is an unauthorized AP, And more particularly, to a system and method for detecting and blocking illegal APs that can block access to neighboring APs.

Recently, wireless LAN is widely used in home or office due to the development of technology and convenience of use. Wireless LAN (WiFi) has increased convenience in use, but has various problems in terms of security. Since the wireless terminal uses a method in which a client terminal accesses an access point (AP) wirelessly and transmits / receives data, it is very important whether the AP is a legitimate AP or an unauthorized AP. For example, an illegal AP may be installed to intercept information of a client terminal connected thereto.

Conventional technologies for detecting illegal APs require expensive hardware equipment, cables for installing sensors in a physical space to be controlled, a network switch port, and the like. In order to construct and operate sensors, There is a problem that the environment must be changed or modified. In addition, when new emerging protocols (for example, 802.11ac, 802.11ad, etc.) are introduced in accordance with the development of the wireless LAN technology, there is a problem that the entire infrastructure must be replaced according to the protocol.

Korean Patent Laid-Open No. 10-2008-0050946 (published on Jun. 10, 2008) discloses a method of detecting an illegal access point, comprising: obtaining identification information of an access point to which a wireless terminal desires to access; Encrypting identification information about the access point to be accessed through a USIM card and transmitting the encrypted identification information to an authentication server; Receiving an encrypted verification result of the access point to access from the authentication server and decrypting the encrypted verification result through the USIM card; And blocking or permitting a connection to the access point based on the decrypted verification result. ≪ Desc / Clms Page number 2 >

However, this technology is premised on the mobile communication terminal and the USIM card, and still has a limitation in that the authentication server verifies whether the AP is a legitimate AP or an illegal AP.

Korean Patent Publication No. 10-2008-0050946 (published on Jun. 10, 2008)

SUMMARY OF THE INVENTION It is an object of the present invention to provide a system capable of efficiently detecting an illegal AP and blocking access to an illegal AP at low cost.

Further, the present invention can increase the efficiency of wireless network management by transmitting a list of normal APs from a server to a wireless communication device and allowing the AP connection management device included in the wireless communication device to determine whether the AP is illegal AP by referring to the normal AP list The present invention also provides a system.

Another object of the present invention is to provide a system capable of coping with changes in environments such as a network environment and protocols by using agents in a robust and flexible manner.

According to an aspect of the present invention, there is provided an illegal access point (AP) detection and blocking system, which includes a wireless communication device and includes a wireless communication device, An AP connection management device that acquires AP information and manages connection to a peripheral AP; And a server for storing and managing a normal AP list and an illegal AP list, wherein the server transmits the normal AP list to the AP connection management apparatus via the wireless communication device, and the AP connection management apparatus generates, based on the normal AP list And determines whether the neighboring AP is an illegal AP.

Here, it is preferable that the AP information acquired by the AP connection management apparatus includes AP identification information of the neighbor AP.

The normal AP list includes AP identification information of a normal AP. The AP connection management apparatus compares AP identification information included in the normal AP list with AP identification information of neighboring APs acquired from the wireless communication device, It may be determined whether or not the AP is an illegal AP.

The AP information further includes a WLAN protocol, an authentication encryption scheme, and signal strength information. The normal AP list further includes a WLAN protocol, an authentication encryption scheme, and signal strength information of a normal AP. The access management apparatus may compare the AP identification information, the WLAN protocol, the authentication encryption scheme, and the signal strength information to determine whether the neighboring AP is an illegal AP.

In addition, the AP connection management apparatus may be configured to block connection with a neighboring AP determined to be an illegal AP.

In addition, the AP access management apparatus transmits AP information of a neighboring AP determined to be an illegal AP to a server, and the server can store the neighboring AP included in the illegal AP list based on the received AP information.

According to another aspect of the present invention, there is provided an illegal access point (AP) detection and blocking system, which includes peripheral AP information, which is included in a wireless communication device and is information of neighboring APs existing around the wireless communication device from the wireless communication device An AP access management apparatus for managing access to a neighboring AP, wherein the neighboring AP information includes signal strength information of a neighboring AP; And a server for storing and managing a normal AP list and an illegal AP list, wherein the AP connection management apparatus transmits the obtained peripheral AP information to a server, and the server further comprises: a predetermined number or more of AP connection management apparatuses When the AP transmits signal strength information exceeding a predetermined value to the neighboring AP, the specific neighboring AP is determined to be an illegal AP.

According to the present invention, it is possible to provide a system that can efficiently detect an illegal AP and block access to an illegal AP at low cost.

Further, the present invention can increase the efficiency of the wireless network management by transmitting a list of normal APs from the server to the wireless communication device and allowing the AP connection management device included in the wireless communication device to determine whether the AP is illegal AP by referring to the normal AP list System can be provided.

Further, the present invention can provide a system that can cope with changes in environment such as network environment, protocol, and the like in a robust and flexible manner by using agent system.

FIG. 1 is a diagram showing the configuration of an illegal AP detection and blocking system 100 according to a first embodiment of the present invention.
FIG. 2 is a diagram showing an internal configuration of the server 20 described with reference to FIG.
FIG. 3 is a flowchart illustrating the overall operation of the system 100 according to the present invention described with reference to FIGS.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings.

FIG. 1 is a diagram showing the configuration of an illegal AP detection and blocking system 100 according to a first embodiment of the present invention.

1, an illegal AP detection and blocking system 100 (hereinafter referred to as "system 100") according to the first embodiment of the present invention includes an AP access management apparatus 10 and a server 20 .

The access point (AP) access management apparatus 10 is included in the wireless communication device 30 and includes peripheral AP information that is information on neighboring APs existing around the wireless communication device 30 from the wireless communication device 30 And manages the connection of the wireless communication device 30 to the neighboring APs.

Here, the AP information acquired by the AP connection management apparatus 10 includes the AP identification information of the neighboring AP. It may also include signal strength information of the neighboring APs. Also, it may include a wireless LAN protocol (e.g., 802.11a / b / g / n) and authentication encryption scheme information (e.g., Open, WEP, PSK, etc.) provided by the AP if necessary. This AP information is obtained from the wireless communication device 30 and transmitted to the AP connection management device 10. [

The server 20 stores and manages the normal AP list and the illegal AP list and the server 20 transmits the normal AP list to the AP connection management apparatus 10 via the wireless communication device 30 , And the AP connection management device 10 determines whether the neighbor AP is an illegal AP based on the normal AP list. Here, the normal AP list means a list of authorized APs, and the illegal AP list means a list of unauthorized APs.

The wireless communication device 30 receives and detects a WiFi signal emitted from peripheral APs AP1 and AP2 existing in the vicinity of the wireless communication device 30 and outputs signal strength information and AP identification information of the wireless LAN signal And transmits it to the AP connection management apparatus 10. Here, the AP identification information is preferably a combination of an SSID (Service Set Identifier) which is a unique identifier existing in a header of a packet transmitted through a wireless LAN and a BSSID (Basic Service Set Identifier) which is a MAC address of the AP, for example. But is not limited to, either one of them may be used, or other possible identification information may be used.

The AP connection management device 10 is provided in the form of hardware or software in such a wireless communication device 30. [ According to a preferred embodiment of the present invention, the AP access management apparatus 10 is installed in the wireless communication device 30 in the form of software and is driven and executed in the form of an agent in the wireless communication device 30 desirable.

In FIG. 1, only two APs (AP1 and AP2) are shown around the wireless communication device 30 for convenience of explanation. However, it is needless to say that there may be more APs than the APs.

Here, the wireless communication device 30 is, for example, a computer such as a notebook computer or a desktop computer, and is a device having wireless communication, in particular, a wireless LAN (WiFi) connection means. Since the wireless communication device 30 has a wireless LAN connection means such as a wireless LAN card, it receives and detects a wireless LAN signal (WiFi signal) emitted from a neighboring AP through the wireless LAN connection means, The signal strength information can be obtained. In addition, AP identification information of the neighboring APs, such as SSID (Service Set Identifier) and BSSID (Basic Service Set Identifier), can be obtained.

On the other hand, the server 20 stores and manages the normal AP list and the illegal AP list as described above. For example, the server 20 transmits the normal AP list to the AP connection management device 10 via the wireless communication device 30 at regular intervals or at predetermined time intervals do. Of course, when there is a request from the wireless communication device 30 or the AP connection management device 10 by the input signal of the manager of the server 20, the AP connection management device 10 ). ≪ / RTI >

The wireless communication device 30 receives the normal AP list transmitted from the server 20 and transmits it to the AP connection management device 10 and the AP connection management device 10 transmits the acquired normal AP list to the wireless communication device 30, The AP identification information included in the neighbor AP information and the AP identification information included in the normal AP list are compared with each other, and the AP identification information included in the neighbor AP information acquired by the AP access management apparatus 10 is compared with the AP It is determined whether or not it exists in the identification information.

If the AP identification information included in the neighbor AP information exists in the AP identification information included in the normal AP list, the neighbor AP is classified as a normal AP, and the AP identification information included in the neighbor AP information is classified into the AP If it does not exist in the identification information, it is determined that the corresponding peripheral AP is an illegal AP.

Meanwhile, as described above, the AP information may further include a WLAN protocol, an authentication encryption scheme, and signal strength information. The AP information may be compared with the AP identification information included in the normal AP list using the AP information, A method of comparing the wireless LAN protocol, the authentication encryption method, and the signal strength information may be additionally used. For this, the normal AP list is configured to further include the wireless LAN protocol, the authentication encryption method, and the signal strength information of the normal AP, and the server 20 transmits a normal AP list including this information to the AP access management apparatus 10 , And the AP access management apparatus 10 may compare the AP identification information, the WLAN protocol, the authentication encryption method, and the signal strength information to determine whether the neighboring AP is an illegal AP.

Here, the wireless LAN protocol or the authentication encryption method may be used to compare whether the server 20 uses a method other than the preset method, and a method of comparing threshold values such as whether the signal intensity information is a signal of a certain size or more .

If it is determined that the neighboring AP is an illegal AP through this process, the AP connection management apparatus 10 may block the connection between the wireless communication device 30 and the neighboring AP.

Also, the AP access management apparatus 10 transmits the AP information of the neighboring AP determined as the illegal AP to the server 20, and the server 20 sets the corresponding neighboring AP to the illegal AP list based on the received AP information To be included.

On the other hand, the AP connection management apparatus 10 can block the connection with the neighboring APs, for example, in the following manner.

That is, the AP access management apparatus 10 receives the illegal AP list from the server 20, stores the illegal AP list, checks the SSID and the BSSID of the AP used by the wireless communication device 30, ) With the list of illegal APs received. As a result of the comparison, if the AP included in the illegal AP list is used, the state of the wireless communication device 30 is changed to the disabled state or the non-connected state by using the API provided in the operating system, for example, window.

FIG. 2 is a diagram showing an internal configuration of the server 20 described with reference to FIG.

Referring to FIG. 2, the server 20 includes a normal AP list 21 and an illegal AP list 22, and stores and manages them.

The normal AP list 21 is a list of permitted APs allowed to access, and stores AP information of normal APs. The AP information to be stored may include, for example, AP identification information such as SSID / BSSID, AP signal strength information, IP address, wireless LAN protocol, and location information.

The illegal AP list 22 means a list of unauthorized APs that are not allowed to access, and stores AP information of APs judged to be illegal APs. The stored AP information can be configured similarly to the AP information of the normal AP list.

The server 20 stores and manages the normal AP list 21 and the illegal AP list 22 and transmits the normal AP list 21 to the AP connection management device 20 via the wireless communication device 30 (10). Of course, the normal AP list can be transmitted to the AP connection management apparatus 10 (10) via the wireless communication device 30 by the request of the wireless communication device 30 or the AP connection management apparatus 10 or by the input signal of the manager of the server 20 As shown in FIG. The wireless communication device 30 receives the normal AP list from the server 20 and delivers it to the AP connection management apparatus 10 and the AP connection management apparatus 10 transmits the AP identification information included in the received normal AP list The AP access management apparatus 10 compares the acquired AP identification information of the neighboring APs to determine whether the neighboring AP is an illegal AP.

In addition, the server 20 receives the AP information about the AP determined as the illegal AP transmitted from the AP access management apparatus 10 through the wireless communication device 30, and stores it in the illegal AP list.

FIG. 3 is a flowchart illustrating the overall operation of the system 100 according to the present invention described with reference to FIGS.

Referring to FIG. 3, first, the AP connection management apparatus 10 is driven in the wireless communication device 30 (S100). The AP connection management device 10 is preferably executed and operated in the form of an agent in the wireless communication device 30 in the form of software as described above.

When the AP access management apparatus 10 is driven, the AP access management apparatus 10 acquires the neighbor AP information, which is the information of APs existing in the vicinity and collected by the wireless communication device 30 from the wireless communication device 30 (S110).

The server 20 stores the normal AP list 21 and the illegal AP list 22 and transmits them to the AP connection management apparatus 10 through the wireless communication device 30 at steps S120 and S130. The wireless communication device 30 or the AP connection management device 10 transmits a request to the wireless communication device 30 or the AP connection management device 10 at predetermined intervals every predetermined period of time as described above Or may be transmitted according to an input signal of the manager of the server 20. [

The AP connection management apparatus 10 transmits the AP identification information included in the received normal AP list 21 and the AP identification information included in the peripheral AP information acquired by the AP connection management apparatus 10 in step S110 It is determined whether the neighboring AP is an illegal AP (S140).

If it is determined that the neighboring AP is an illegal AP, the AP connection management apparatus 10 disconnects the neighboring AP determined as an illegal AP (S150).

Also, the AP access management apparatus 10 transmits the AP information of the neighbor AP determined as the illegal AP to the server 20, and the server 20 stores the received AP information in the illegal AP list (S160, S170 ).

Next, a second embodiment of the present invention will be described.

The AP access management apparatus 10 transmits the neighbor AP information including the signal strength information to the server 20 and the server 20 transmits the neighbor AP information including the signal strength information to the AP access management apparatus 10 ) Transmits signal strength information exceeding a preset value for a specific peripheral AP, it is determined that the specific peripheral AP is an illegal AP.

For example, when three or more AP access management apparatuses 10 transmit AP information about neighboring APs whose signal strength information has a value exceeding a predetermined value, the AP may automatically determine the AP as an illegal AP . In this case, the server 20 may display on the display means that the AP information has been received, and the server 20 administrator may confirm the fact and set the AP as an illegal AP.

The second embodiment may be performed separately from the method described in the first embodiment, or may be performed in parallel with the method described in the first embodiment.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is clearly understood that the same is by way of illustration and example only and is not to be construed as limited to the embodiments set forth herein. It goes without saying that the present invention can be practiced.

10 ... AP connection management device
20 ... server
30 ... wireless communication device

Claims (7)

In an illegal access point (AP) detection and blocking system,
An AP access management device included in the wireless communication device, for acquiring AP information that is information of neighboring APs existing around the wireless communication device from the wireless communication device and managing access to the neighboring APs; And
Server that stores and manages normal AP list and illegal AP list
Lt; / RTI >
Wherein the AP information acquired by the AP access management apparatus includes AP identification information of a neighbor AP, a WLAN protocol, an authentication encryption scheme, and signal strength information,
The normal AP list includes AP identification information of a normal AP, a wireless LAN protocol of a normal AP, an authentication encryption scheme, and signal strength information,
The server sends a list of normal APs to the AP connection management apparatus via a wireless communication device, and the AP connection management apparatus transmits the AP identification information, the WLAN protocol, the authentication encryption method, and the signal strength information included in the normal AP list, Wherein the control unit compares the AP identification information of the neighbor AP obtained from the communication device, the WLAN protocol, the authentication encryption method, and the signal strength information to determine whether the neighboring AP is an illegal AP.
delete delete delete The method according to claim 1,
And the AP connection management apparatus disconnects the connection with the neighboring AP determined as an illegal AP.
The method according to claim 1,
Wherein the AP connection management device transmits AP information of a neighboring AP determined as an illegal AP to a server and the server stores the neighboring AP to be included in the illegal AP list based on the received AP information, AP detection and blocking system.
In an illegal access point (AP) detection and blocking system,
An AP access management device included in a wireless communication device for acquiring peripheral AP information that is information of neighboring APs existing around the wireless communication device from a wireless communication device and managing access to the neighboring APs, Signal strength information; And
Server that stores and manages normal AP list and illegal AP list
Lt; / RTI >
The AP connection management apparatus transmits the acquired peripheral AP information to the server,
Wherein the server determines that the specific peripheral AP is an illegal AP when a predetermined number of AP access management apparatuses transmit signal intensity information exceeding a preset value for a specific peripheral AP. system.

Images