KR102536855B1 - Method for configuring wireless lan secure channel - Google Patents

Abstract

The present invention relates to a method for configuring a wireless LAN security channel. The disclosed method for constructing a wireless LAN security channel is a method for configuring a wireless LAN security channel that provides authentication reinforcement and security performance improvement in a work environment through a wireless terminal device approval process, and a wireless device registration procedure for a client is performed in a security server. Applying for authentication service use, generating a one-time OTA in the client and requesting authentication from the security server, verifying the one-time OTA received in the security server and then generating an authentication token, in the security server After verifying the one-time OTA, generating an authentication token and transmitting it to the client if the verification is successful, requesting a wireless channel including the authentication token granted by the client, the authentication token in the security server If it is verified by verifying, it provides a wireless LAN security channel configuration method comprising the step of allocating a wireless LAN security channel to the client.
According to the present invention, a wireless LAN security channel capable of strengthening authentication and improving security performance of a wireless work environment through the establishment of a wireless LAN security system and, on the other hand, blocking access to harmful sites to increase the efficiency of management functions and smart life. It has the advantage of being able to provide a configuration method.

Description

How to configure a wireless LAN security channel {METHOD FOR CONFIGURING WIRELESS LAN SECURE CHANNEL}

The present invention relates to a method for constructing a wireless LAN secure channel, and more particularly, to a method for constructing a secure wireless LAN security channel capable of strengthening security by constructing a secure channel through an access token issued through one-time verification.

The contents described in this part merely provide background information on the present embodiment and do not constitute prior art.

As BYOD (Bring Your Own Device) support spreads in the work environment along with the explosive growth of mobile devices, security vulnerabilities of wireless LAN (WLAN) in smart work environments are increasing.

As wireless infrastructure and applications increase, a smart work environment has arrived, and the global smartphone penetration rate has been growing by more than 30% annually since 2015. However, along with this, the risk of data leakage through illegal internal network access, attempts to hijack malicious code, camouflaged APs, and hotspots is also increasing.

Wireless LAN makes it possible to create a convenient IT environment due to various wireless devices, but there are physical, technical, and managerial security vulnerabilities. It can be stolen, damaged, or initialized due to physical exposure of the wireless AP, and there are vulnerabilities such as leakage of stored data when the wireless terminal is lost. Technically, unencrypted communication data can be eavesdropped/sniffed, and there are vulnerabilities in attacks such as DoS on wireless transmission equipment. In addition, there are many cases in which management cannot grasp even if damage or theft of wireless AP equipment occurs, and vulnerabilities such as lack of security awareness of users and lack of radio output management may exist.

Despite the emergence of various wireless LAN access authentication technologies and wireless transmission data encryption technologies to solve the above wireless LAN vulnerabilities, inconvenient IT work environments are still common because vulnerabilities in security technologies have been discovered.

Due to hacking threats through wireless vulnerabilities, the wireless LAN environment is not allowed in the internal private network, and the internal work convenience (mobility) is reduced by setting the wired LAN environment, and it is difficult to solve in case of a LAN cable error, and unnecessary switch hubs / routers / power cables There are downsides to using this.

In addition, wireless LAN access has indiscriminate site access problems, such as access to sites not related to work and access to personal wireless devices, and problems with access to gambling/pornographic sites due to military bases allowing soldiers to use phones.

Accordingly, the present invention proposes a method for constructing a wireless LAN security channel with improved authentication/security performance in a wireless work environment compared to the prior art.

Korean Registered Patent Publication No. 10-2145602, published on August 11, 2020 (Name: Wi-Fi sharing restriction system and method) Korean Registered Patent Publication No. 10-1658657, published on April 4, 2013 (Name: Terminal device and authentication support device for network access security enhancement system) Korean Registered Patent Publication No. 10-1552950, published on September 14, 2015 (Name: Direct Access Control System for Server and Network Equipment)

The present invention has been proposed to solve the above-mentioned problems of the prior art, and the main purpose of the present invention is to provide a method for configuring a wireless LAN security channel that can enhance authentication and security performance of a wireless work environment through the establishment of a wireless LAN security system. there is.

In addition, another object of the present invention is to provide a method for configuring a wireless LAN security channel capable of increasing management function and efficiency of smart life by blocking access to harmful sites through a wireless terminal device approval process function.

The problem to be solved by the present invention is not limited to those mentioned above, and another problem to be solved that is not mentioned will be clearly understood by those skilled in the art from the description below.

One aspect of the present invention for achieving the above object is a wireless LAN security channel configuration method that provides authentication reinforcement and security performance improvement in a work environment through a wireless terminal device approval process, in a security server for a client wireless Performing a device registration procedure and applying for authentication service use; generating a one-time OTA in the client and requesting authentication from the security server; generating an authentication token after verifying the received one-time OTA in the security server; After verifying the one-time OTA in the security server, generating an authentication token and delivering it to the client if the verification is successful; requesting a radio channel including the authentication token granted by the client; The security server verifies the authentication token and, if verified, allocating a wireless LAN security channel to the client.

Another aspect of the present invention is a method for constructing a wireless LAN security channel for blocking access to unnecessary sites through a wireless LAN, comprising: distributing harmful site information to an access point by a security server; If a client requests access to a wireless LAN through the access point, filtering whether or not the access point is an attempt to access the distributed harmful site; If the site to which the client tries to access is one of the distributed harmful sites, a method for constructing a wireless LAN security channel comprising the step of blocking the client from accessing the corresponding harmful site.

Another aspect of the present invention is a method for configuring a wireless LAN security channel for a wireless remote meter reading system, comprising: accessing an access point through a client that is a smart meter for wireless remote meter reading; registering, by the client, with the access point; registering the device to the central management server by the access point; transmitting, by the central management server, the access point list registered and approved in the wireless remote meter reading system to a security server; the access point searching for a surrounding security server for wireless remote meter reading service; If the surrounding security server is discovered, generating an OTA in the client and transmitting the OTA to the security server through the access point, and in the security server, OTA authentication and configuring a wireless LAN security channel for the authenticated client; Through the configured wireless LAN security channel, the meter reading information read by the client is transmitted to the security server and collected back to the central management server.

According to the wireless LAN security channel configuration method of the present invention, there is an effect that it is possible to provide a wireless LAN security channel configuration method capable of enhancing authentication and security performance of a wireless work environment through the establishment of a wireless LAN security system.

In addition, there is an effect that it is possible to provide a wireless LAN security channel configuration system and room capable of increasing the efficiency of management function and smart life by blocking access to harmful sites through a terminal device approval process function.

The effects obtainable in the present invention are not limited to the effects mentioned above, and other effects not mentioned will be clearly understood by those skilled in the art from the description below. .

BRIEF DESCRIPTION OF THE DRAWINGS The accompanying drawings, which are included as part of the detailed description to aid understanding of the present invention, provide examples of the present invention and, together with the detailed description, describe the technical features of the present invention.
1 is a diagram illustrating a system for configuring a wireless LAN security channel according to an embodiment of the present invention.
2 is a diagram illustrating a method for configuring a wireless LAN security channel according to an embodiment of the present invention.
3 is a diagram illustrating a one-time authentication procedure in more detail according to an embodiment of the present invention.
4 is a one-time authentication request according to an embodiment of the present invention And it is a drawing illustrating approval.
5 is a diagram illustrating a method for filtering harmful sites according to an embodiment of the present invention.
6 is a diagram illustrating a method of configuring a wireless LAN security channel in an office according to an embodiment of the present invention.
7 is a diagram illustrating a method of configuring a wireless LAN security channel of a wireless remote meter reading system according to an embodiment of the present invention.

Hereinafter, preferred embodiments according to the present invention will be described in detail with reference to the accompanying drawings. The detailed description set forth below in conjunction with the accompanying drawings is intended to describe exemplary embodiments of the present invention and is not intended to represent the only embodiments in which the present invention may be practiced. The following detailed description includes specific details for the purpose of providing a thorough understanding of the present invention. However, those skilled in the art to which the present invention pertains understand that the present invention may be practiced without these specific details.

In some cases, in order to avoid obscuring the concept of the present invention, well-known structures and devices may be omitted or may be shown in block diagram form centering on core functions of each structure and device.

Throughout the specification, when a part is said to "comprising" or "including" a certain element, it means that it may further include other elements, not excluding other elements, unless otherwise stated. do. In addition, terms such as “… unit”, “… unit”, and “module” described in the specification mean a unit that processes at least one function or operation, which may be implemented as hardware or software or a combination of hardware and software. there is. Also, "a or an", "one", "the" and similar related words in the context of describing the invention (particularly in the context of the claims below) Unless indicated or otherwise clearly contradicted by context, both the singular and the plural can be used.

In describing the embodiments of the present invention, if it is determined that a detailed description of a known function or configuration may unnecessarily obscure the subject matter of the present invention, the detailed description will be omitted. In addition, terms to be described later are terms defined in consideration of functions in the embodiment of the present invention, which may vary according to the intention or custom of a user or operator. Therefore, the definition should be made based on the contents throughout this specification.

Each component in the drawings of the present invention is shown independently to represent different characteristic functions in the WLAN security channel configuration method, and does not mean that each component is made of a separate hardware or software component unit. . That is, each component is listed and included as each component for convenience of explanation, and at least two components of each component can be combined to form one component, or one component can be divided into a plurality of components to perform a function, and each of these components can be divided into a plurality of components. Integrated embodiments and separated embodiments of components are also included in the scope of the present invention as long as they do not depart from the essence of the present invention.

In addition, some of the components may be optional components for improving performance rather than essential components that perform essential functions in the present invention. The present invention can be implemented by including only components essential to implement the essence of the present invention, excluding components used for performance improvement, and a structure including only essential components excluding optional components used for performance improvement. Also included in the scope of the present invention.

Hereinafter, embodiments of the present invention will be described with reference to the accompanying drawings.

1 is a diagram illustrating a system for configuring a wireless LAN security channel according to an embodiment of the present invention.

A wireless LAN secure channel configuration system according to an embodiment of the present invention is composed of a client 100, an access point 200, and a security server 300, and establishes a VPN secure channel through a device authentication request of the client 100. configure and provide services.

The client 100 is an information communication device that wants to access the server 300 through a wireless LAN protocol, and is a smartphone, desktop, tablet PC, notebook, net book, multimedia It may be an information communication device such as a terminal, a wired terminal, a fixed terminal, an Internet Protocol (IP) terminal, a mobile phone, a Portable Multimedia Player (PMP), a Mobile Internet Device (MID), and a wireless printer.

The access point 200 refers to a low power wireless device serving as a base station in a wireless LAN, commonly referred to as an access point (AP). The access point 200 serves as a bridge connecting wired and wireless, and from the point of view of a wired network, the access point 200 is attached to a router or switch, and the router or switch is unaware of the wireless station, which is entirely dependent on the access point 200. become dependent Accordingly, the access point 200 serves to extend the wired network to the wireless network.

The security server 300 refers to a host computer that provides authentication and approval processing for access through a wireless LAN to clients.

Security server 300 may be in the form of a server farm as well as a single server. A server farm is a group of servers accommodated and operated as a group, also called a server cluster, and managed separately from the client network. Each server is useful for stabilizing the server because even if a server is down, another server can be immediately replaced to prevent service interruption.

The security server 300 is connected to the access point 200 and manages the access point 200 together with authentication of the client 100 .

A communication network connecting the security server 300 and the access point 200 is a wired communication network such as Ethernet.

2 is a diagram illustrating a method for configuring a wireless LAN security channel according to an embodiment of the present invention.

First, in order to configure a secure channel according to an embodiment of the present invention, a wireless device registration procedure for the client 100 is performed in the security server 300.

The second step is the client credentials step. After the wireless device registration procedure for the client 100, if the client 100 generates a one-time OTA and requests authentication from the security server 300, the security server 300 verifies the one-time OTA and then generates an authentication token.

The third is a step of configuring a secure radio channel. After verifying the one-time OTA in the security server 300, when an authentication token is generated and transmitted to the client 100, a wireless channel is requested including the authentication token granted by the client 100, and the security server 300 performs authentication. If the token is verified and verified, a wireless security channel is allocated to the client 100 to enable wireless communication.

3 is a diagram illustrating a one-time authentication procedure in more detail according to an embodiment of the present invention.

The procedure of FIG. 2 will be described in more detail through FIG. 3 .

If the client 100 wants to use the wireless LAN security channel according to an embodiment of the present invention, it must first apply for an authentication service to the security server 300 (S301) and be registered in the security server 300.

The security server 300 receiving the application for use of the authentication service generates and stores information about the client 100 (S303). This is the client ID and authentication key (client key). The generated client ID and authentication key are delivered to the client 100 (S305) and stored.

If necessary, the issued authentication key can be renewed/reissued/discarded (S307).

When the registered client 100 wants to use the wireless LAN security channel, it needs to generate a one-time OTA (One Time Authentication) and undergo verification.

This may use the TLS/SSL authentication method. The TLS/SSL authentication method is a technology that uses the random number as a master key to securely communicate with each other since the client generates a random number and encrypts it with a public key before sending it to the server.

SSL (Secure Sockets Layer, SSL) is a technology that secures an Internet connection by encrypting data transmitted between a website and a browser (or two servers). This prevents hackers from viewing or stealing any information transmitted, including personal and financial information.

TLS (Transport Layer Security, TLS) is a newer technology than SSL and refers to a stronger version of SSL.

When the client 100 requests authentication (client credentials) from the security server 300 (S309), the security server 300 generates a randomly generated token (or random number, nonce) and transmits it to the client 100 ( S311)

The client 100 generates an OTA using the randomly generated token received (S313), and more specifically, generates an OTA using an authentication code and a time-based one-time password (TOTP). TOTP refers to a two factor OTP generated using current time information as a source.

When the OTA generated by the client 100 is transmitted to the security server 300 (S315), the security server 300 verifies the OTA received (S317), and if it passes the verification, an authentication token, that is, the corresponding client 100 ) to generate an access token (S319).

The authentication token generated by the security server 300 is delivered to the client 100 (S321), and then, when the client 100 wants to request a wireless channel, an authentication API is called and the authentication token is delivered to the security server 300. It does (S323).

The security server 300 verifies the received authentication token (S325), and if the verification passes, transmits (approves) the result (S327) so that a wireless LAN security channel can be created.

4 is a one-time authentication request according to an embodiment of the present invention And it is a drawing illustrating approval.

When the client 100 requests wireless access to the access point 200, the access point 200 verifies the one-time OTA and authentication token transmitted from the client 100, and the access point 200 provides security Redirection to the server 300 is performed.

The security server 300 verifies the one-time OTA and authentication token requested from the access point 200, processes the approval, stores the approval history of the client 100, and transfers the approval result to the access point 200. send to

The access point 200 receives the approval result of the client 100 and configures a VPN tunnel (security channel) to provide a wireless network.

5 is a diagram illustrating a method for filtering harmful sites according to an embodiment of the present invention.

An embodiment of the present invention is a method for fundamentally blocking access to gambling/pornography sites due to the need to block access to sites irrelevant to business through a work wireless LAN in the workplace or the recent military base allowing phones. .

In the security server 300, harmful site information to be blocked from access is stored in advance through the management module (S501).

The security server 300 publishes (distributes) the stored harmful site information to the access point 200 (S503).

When the client 100 requests access to a distributed harmful site (S505), the access point 200 filters whether or not an attempt is made to access the harmful site (S507), and blocks the client 100 from accessing the corresponding harmful site (S507). S509).

The security server 300 collects and stores connection attempt history of the client 100 blocked by the access point 200 (S511).

6 is a diagram illustrating a method of configuring a wireless LAN security channel in an office according to an embodiment of the present invention.

A security server 300 is located centrally in the office's internal network, an access point 200 is established at each appropriate location to establish a security channel, and a work environment that enables blocking of harmful sites when necessary is established.

7 is a diagram illustrating a method of configuring a wireless LAN security channel of a wireless remote meter reading system according to an embodiment of the present invention.

The wireless LAN security channel configuration technology of the present invention can also be applied to a wireless remote meter reading system, and this is embodied through FIG. 7 .

The client 100 in the wireless remote meter reading system is a smart meter that accesses the access point 200 through a wireless LAN in a home network, such as a gas/power meter.

To build a wireless remote meter reading system, the client 100 registers the client 100 with the access point 200 (S701), and the access point 200 registers with the central management server 400 (S703).

The central management server 400 transmits the list of approved access points 200 registered in the wireless remote meter reading system to the security server 300 (S705).

In an embodiment of the present invention, the security server 300 is mounted on a wireless meter reading vehicle and exchanges information with the access point 200 and the central management server 400.

The access point 200 searches (scans) the security server 300 in the surrounding wireless LAN controller in the embodiment of the present invention for the wireless remote meter reading service (S707).

When the surrounding security server 300 is searched, OTA authentication and a wireless LAN security channel are configured for the authenticated client 100 in the manner described through FIG. 3 and the description thereof (S709).

Through the wireless LAN security channel created through this, the meter reading information read by the client 100 is transmitted to the security server 300, which is collected in the central management server 400 (S711).

In the drawings, although it is described that each step is sequentially executed, this is merely an example of the technical idea of the present embodiment, and those skilled in the art to which the present embodiment belongs are the essential characteristics of the present embodiment. Since it will be possible to change and execute the order described in the drawings without departing from, or to perform various modifications and variations by executing any one or more steps in parallel, the steps in the drawings are not limited to a chronological order. . For example, the client registration (S701) and access point registration (S703) steps of FIG. 7 may be performed in parallel rather than sequentially.

Combinations of each block of the block diagrams and each step of the flowcharts attached hereto may be performed by computer program instructions. Since these computer program instructions may be loaded into a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing equipment, the instructions executed by the processor of the computer or other programmable data processing equipment are each block of the block diagram or flowchart. In each step, means to perform the functions described are created. These computer program instructions may also be stored in a computer usable or computer readable memory that can be directed to a computer or other programmable data processing equipment to implement functionality in a particular way, such that the computer usable or computer readable memory It is also possible for the instructions stored in to produce an article of manufacture containing instruction means for performing the function described in each block of the block diagram or each step of the flow chart. The computer program instructions can also be loaded on a computer or other programmable data processing equipment, so that a series of operational steps are performed on the computer or other programmable data processing equipment to create a computer-executed process to generate computer or other programmable data processing equipment. It is also possible that the instructions performing the processing equipment provide steps for executing the functions described in each block of the block diagram and each step of the flowchart.

Additionally, each block or each step may represent a module, segment or portion of code that includes one or more executable instructions for executing specified logical function(s). It should also be noted that in some alternative embodiments it is possible for the functions recited in blocks or steps to occur out of order. For example, two blocks or steps shown in succession may in fact be performed substantially concurrently, or the blocks or steps may sometimes be performed in reverse order depending on their function.

The above description is merely an example of the technical idea of the present invention, and various modifications and variations can be made to those skilled in the art without departing from the essential characteristics of the present invention. Therefore, the embodiments disclosed in the present invention are not intended to limit the technical idea of the present invention, but to explain, and the scope of the technical idea of the present invention is not limited by these embodiments. The protection scope of the present invention should be construed according to the claims below, and all technical ideas within the scope equivalent thereto should be construed as being included in the scope of the present invention.

According to the wireless LAN security channel configuration method of the present invention, through the establishment of a wireless LAN security system, authentication and security performance of the wireless work environment are strengthened, and on the other hand, access to harmful sites is blocked to increase the efficiency of management functions and smart life. In that it can be used as a solution that can provide a method of configuring a wireless LAN security channel that can be used as a solution, there is sufficient possibility of marketing or sales of applicable devices, not just the use of related technologies, as it goes beyond the limits of existing technologies. In addition, it is an invention with industrial applicability because it can be clearly implemented in reality.

100: client 200: access point 300: security server
400: central management server

Claims (10)

A method for constructing a wireless LAN security channel that provides authentication reinforcement and security performance improvement in a work environment through a wireless terminal device approval process,
Performing a wireless device registration procedure for a client in a security server and requesting use of an authentication service;
generating a one-time OTA in the client and requesting authentication from the security server;
generating an authentication token after verifying the one-time OTA received from the security server;
After verifying the one-time OTA in the security server, generating an authentication token and delivering it to the client if the verification is successful;
requesting a radio channel including the authentication token granted by the client;
When the authentication token is verified by the security server and verified, allocating a wireless LAN security channel to the client,
The step of generating a one-time OTA in the client and requesting authentication from the security server,
When the client makes an authentication request to the security server, the security server generates a randomly generated token and delivers it to the client;
The method of configuring a wireless LAN security channel, characterized in that the client generates an OTA using the randomly generated token. According to claim 1,
When the security server receives an application for using the authentication service from the client, the security server generates and stores a client ID and authentication key,
The wireless LAN security channel configuration method further comprising the step of transmitting and storing the generated client ID and authentication key from the security server to the client. delete According to claim 1,
Wherein the client generates an OTA using an authentication code and a time-based one-time password (TOTP). According to claim 1,
After the authentication token generated by the security server is transmitted to the client, when the client wants to request a wireless LAN security channel, an authentication API is called and the authentication token is transmitted to the security server. Channel configuration method. According to claim 1,
and an access point for redirecting the one-time OTA and the authentication token transmitted from the client when the client requests wireless access between the client and the security server. delete delete A method for configuring a wireless LAN security channel for a wireless remote meter reading system,
Accessing an access point through a client that is a smart meter for wireless remote meter reading;
registering, by the client, with the access point;
registering the device to the central management server by the access point;
transmitting, by the central management server, a list of approved access points registered in the wireless remote meter reading system to the security server;
the access point searching for a surrounding security server for wireless remote meter reading service;
If the surrounding security server is discovered, generating an OTA in the client and transmitting the OTA to the security server through the access point, and in the security server, OTA authentication and configuring a wireless LAN security channel for the authenticated client;
and transmitting the meter reading information read by the client to the security server through the configured wireless LAN security channel, and collecting the meter reading information back to the central management server. According to claim 9,
The security server,
A method for constructing a wireless LAN security channel, characterized in that it is mounted on a wireless meter reading vehicle and exchanges information with the access point and the central management server.

Images