KR101566765B1 - Wireless network device detecting system - Google Patents

Abstract

The present invention relates to a wireless device detection system, and more particularly, to a wireless device detection system including an inspection module for performing a test on a plurality of wireless devices (SSID: Service Set Identifier) A monitoring module for collecting status information of the wireless device through monitoring of a wireless signal communicated in the specific network area; And an information processing module for storing location information of a specific point and comparing the stored location information with the current location information to calculate location information of the wireless equipment. The scanner includes a plurality of wireless devices And is arranged to detect position information.
Accordingly, it is possible to detect the position of a wireless device existing on a specific wireless network without the construction of a wireless intrusion blocking system by collecting information from a portable scanner, and determine whether the detected wireless device is authorized based on the detected wireless device The security of the wireless network can be increased at a low cost.

Description

[0001] WIRELESS NETWORK DEVICE DETECTING SYSTEM [0002]

The present invention relates to a wireless device detection system.

The sensor in the wireless network security system collects unique information (MAC address, product name, manufacturer, serial number, hardware information, etc.) of a plurality of wireless devices constituting the wireless network and transmits the wireless intrusion prevention system (WIPS) ) Server, it also monitors the intrusion, attack, and abnormal state occurrence of the wireless network in which the wireless device is located, reports the details thereof to the WIPS server, receives a control signal for the response from the WIPS server, And in the prior art related thereto, Korean Patent Laid-Open Publication No. 10-2013-0019892 was given.

Meanwhile, the location of various wireless devices (AP, AC, wireless terminals, etc.) existing on a specific wireless network and the method of detecting unauthorized wireless devices have been implemented by analyzing the information collected by the above-mentioned sensors in the WIPS server, A method of analyzing all the information collected from a separate WIPS server is used to detect a wireless intrusion prevention system only when the wireless intrusion prevention system is installed in a specific wireless network.

SUMMARY OF THE INVENTION The present invention has been made in order to solve the above problem, and it is an object of the present invention to provide a wireless intrusion prevention system, which is capable of collecting information from a portable scanner, And a wireless device detection system capable of detecting whether or not the detected wireless device is authorized based on the detected wireless device.

According to the present invention, the above objects can be accomplished by providing an information processing apparatus comprising: an inspection module for performing a test on a plurality of wireless equipment (SSID: Service Set Identifier) A monitoring module for collecting status information of the wireless device through monitoring of a wireless signal communicated in the specific network area; And an information processing module for storing location information of a specific point and comparing the stored location information with the current location information to calculate location information of the wireless equipment. The scanner includes a plurality of wireless devices The status information of the wireless equipment collected through the monitoring module includes identification information of the wireless device, basic service set identifier (BSSID) information, received signal strength (RSSI) information, Wherein the monitoring module stores MAC information stored in the information processing module and location information of the wireless device collected by the monitoring module, wherein the location information is received from the wireless device at a corresponding point, State information of each wireless device is classified and stored according to the strength of a wireless signal, Wherein the module is configured to receive the signal strength information of the radio signal received from the radio equipments at the first point collected through the monitoring module, the received signal strength information of the radio signal received from the radio equipments at the second point, A second position, a third position, and a distance between the first point, the second point, and the third point, and direction information of the first point, the second point, and the third point, Based on the location information of the wireless devices installed on the specific network area.

Here, the scanner is connected to the wired network of the specific network through ARP (Address Resolution Protocol), and collects MAC information of all wireless devices applied in the specific network.

delete

The scanner may further include an unauthorized equipment detection module that determines whether the detected wireless device is authorized by comparing the collected status information of the wireless device and the MAC information of the wireless device applied in the specific network.

delete

According to the present invention, it is possible to detect the position of a wireless device existing on a specific wireless network without building a wireless intrusion blocking system by collecting information in a portable scanner, and determine whether the detected wireless device is authorized So that the security of the wireless network can be increased at a low cost.

In addition, location information and status information of wireless devices existing on a specific wireless network can be easily obtained through a single scanner.

BRIEF DESCRIPTION OF THE DRAWINGS The accompanying drawings, which are included to provide a further understanding of the invention and are incorporated in and constitute a part of this specification, illustrate embodiments of the invention and, together with the description, serve to explain the principles of the invention.
1 is a schematic diagram illustrating the detection of wireless devices in a wireless device detection system in accordance with the present invention,
2 is a block diagram illustrating a scanner configuration of a wireless device detection system according to the present invention.

Hereinafter, the configuration of the present invention will be described in detail with reference to the accompanying drawings.

Prior to this, the terms used in the specification and claims should not be construed in a dictionary sense, and the inventor may, on the principle that the concept of a term can be properly defined in order to explain its invention in the best way And should be construed in light of the meanings and concepts consistent with the technical idea of the present invention.

Therefore, the embodiments shown in the present specification and the drawings are only exemplary embodiments of the present invention, and not all of the technical ideas of the present invention are presented. Therefore, various equivalents It should be understood that water and variations may exist.

FIG. 1 is a schematic diagram showing the detection of a wireless device in a wireless device detection system according to the present invention, and FIG. 2 is a block diagram showing a configuration of a scanner in a wireless device detection system according to the present invention.

Referring to FIGS. 1 and 2, a wireless device detection system according to the present invention includes a test for performing a test on a plurality of wireless devices (SSID: Service Set Identifier) Module 10; A monitoring module (20) for collecting status information of a wireless device (AP) through monitoring for a wireless signal communicated in a specific network area; And an information processing module (30) for storing location information of a specific point and comparing the stored location information with the current location information to calculate location information of the wireless equipment (AP). The scanner (100) (AP) through the acquisition of the location information of the plurality of radio equipment (AP).

The scanner 100 may be provided as a portable terminal such as a notebook computer including an inspection module 10, a monitoring module 20, an information processing module 30, and an unauthorized device detection module 40.

Also, the checking module 10 and the monitoring module 20 are installed as two independent communication means (for example, a wireless LAN card).

Here, the checking module 10 performs testing (e.g., virtual attack) on various wireless devices (APs) or networks to check for vulnerabilities on the wireless devices (AP) or the wireless network .

In addition, the monitoring module 20 monitors and collects radio signals generated in real time between wireless devices, access terminals, and servers on a specific network area.

The information processing module 30 is configured to compute location information of a wireless device (AP) by comparing location information stored in a specific location with stored location information with current location information, and the scanner 100 The position information of the plurality of wireless devices AP is detected through the position movement and the information collection twice.

That is, the information processing module 30 receives the information communicated by the wireless devices (APs) at the first point collected through the monitoring module 20, the information communicated by the wireless devices (APs) at the second point, (APs) installed on a specific network area based on the information communicated by the wireless devices (APs) at the point and the distance and direction information between the first point, the second point and the third point .

Hereinafter, the location information calculation process of the radio equipment (AP) will be described in detail with reference to FIG.

First, the scanner 100 collects wireless packets at the first point.

Here, the information processing module 30 stores location information of the first point and wireless packets collected through the monitoring module 20. The wireless packet information to be collected includes identification information of the wireless device (AP), BSSID information, Received signal strength information, and MAC information.

Next, the scanner 100 moves to the second point and collects wireless packets.

Here, the information processing module 30 stores the position information of the second point, compares the position information of the first point with the position information of the stored first point, stores the distance information between the first point and the second point, Lt; RTI ID = 0.0 > 2 < / RTI >

Next, the scanner 100 moves to the third point and collects wireless packets.

Here, the information processing module 30 stores the wireless packet at the third point collected through the monitoring module 20 at the third point, and calculates the distance and direction between the wireless packet at each previously stored point and each point And calculates position information of the detected wireless devices (APs).

If the plan view of the area where the specific network is constructed is stored in the scanner 100 in this process, the position information of each point and the monitored information at each point are calculated to display the positions of the wireless devices (APs) on the floor plan And the relative position values of the wireless devices (APs) can be grasped by computing distance and direction information between each point even if there is no plan view.

Also, as shown in FIG. 1, the scanner 100 may be arranged to divide and store measurement ranges (represented by dotted lines) at respective points according to the signal strength of the wireless equipment. When the measurement ranges at the respective points are crossed (AP-1, AP-2) located at the intersection can calculate the position information of the corresponding wireless device very precisely. By analyzing the status information of other wireless devices that are not located at the intersection based on the location information, the location information of other wireless devices can be detected relatively easily.

Meanwhile, the location information of the wireless devices (APs) calculated by the scanner 100 and the status information of the collected wireless devices (AP identification value, BSSID, RSSI, MAC information, etc.) .

That is, when the position of the wireless devices AP is detected, the scanner 100 is configured to detect whether or not the wireless devices (APs) detected through the unauthorized device detection module 50 are applied, The scanner 100 connected to the wired network of the network through ARP (Address Resolution Protocol), receives the MAC information of all wireless devices (APs) applied in the network, It is implemented by comparing MAC information of wireless devices and MAC information of each wireless device collected.

In summary, the scanner 100 stores status information (AP identification information, BSSID, RSSI, and MAC information) of wireless devices (APs) collected through the monitoring module 20 and transmits to the two or more scanners 100) position information of the wireless device (100) and substitutes the position information of the scanner (100) or the plane information of the specific network to detect the position of the wireless device (AP) It is possible to confirm whether or not the corresponding wireless device is authorized by comparing the MAC information and the MAC information of all the authorized wireless devices collected through the ARP (matching of MAC information: authorization, matching of MAC information: non-matching).

As described above, it is possible to detect the position of a wireless device existing on a specific wireless network without building a wireless intrusion blocking system by collecting information in a portable scanner, and determine whether or not the detected wireless device is authorized So that the security of the wireless network can be increased at a low cost.

While the present invention has been described with reference to the exemplary embodiments and the drawings, it is to be understood that the technical scope of the present invention is not limited to these embodiments and various changes and modifications may be made without departing from the spirit and scope of the present invention by those skilled in the art. Various modifications and variations may be made without departing from the scope of the appended claims.

Description of the Related Art [0002]
100: Scanner
10: Check module
20: Monitoring module
30: Information processing module
40: Unauthorized equipment detection module

Claims (5)

An inspection module for performing a test on a plurality of wireless equipment (SSID: Service Set Identifier) installed on a specific network area;
A monitoring module for collecting status information of the wireless device through monitoring of a wireless signal communicated in the specific network area; And
And an information processing module for storing position information of a specific point and comparing the stored position information with current position information to calculate position information of the wireless device, Is arranged to detect information,
The status information of the wireless devices collected through the monitoring module includes identification information of the wireless device, Basic Service Set Identifier (BSSID) information, received signal strength indication (RSSI) information, and MAC (Media Access Control) ,
Wherein the monitoring module stores location information stored at each point in the information processing module and state information of the wireless device collected by the monitoring module, The state information of the equipment is divided and stored,
The information processing module is configured to receive the signal strength information of the radio signal received from the radio equipment at the first point collected through the monitoring module and the received signal strength information of the radio signal received from the radio equipment at the second point And the distance between the first point, the second point, and the third point, and the received signal strength information of the radio signal received from the radio apparatuses at the third point and the position information of the first point, And position information of wireless devices installed on a specific network area based on the direction information.
Wireless device detection system delete The method according to claim 1,
The scanner is connected to the wired network of the specific network through an ARP (Address Resolution Protocol), and collects MAC information of all wireless devices applied in the specific network
Wireless device detection system. The method of claim 3,
The scanner may further include an unauthorized equipment detection module for comparing the collected status information of the wireless device and the MAC information of the wireless device applied in the specific network to determine whether the detected wireless device is authorized
Wireless device detection system. delete

Images