KR20140071801A - Appratus of mobile device classification for preventing wireless intrusion - Google Patents

Abstract

The present invention relates to a wireless device classifying apparatus for preventing wireless intrusion. The disclosed wireless device classifying apparatus includes an information collecting unit which collects information about a wireless device from an authentication server and a wireless terminal management server, an information storage unit which stores the collected information about the wireless device, and an information analyzing unit which analyzes the information about the wireless device based on a classification policy stored in a classification storage unit and classifies the wireless device according to an analysis result. Therefore, a wireless intrusion preventing service is efficiently performed by minutely classifying the wireless device.

Description

[0001] APPARATUS OF MOBILE DEVICE CLASSIFICATION FOR PREVENTING WIRELESS INTRUSION [0002]

BACKGROUND OF THE INVENTION 1. Field of the Invention [0001] The present invention relates to wireless infringement prevention, and more particularly, to a wireless device classification apparatus for preventing wireless infringement.

As will be known, a wireless intrusion prevention technology detects an unauthorized access point in a management domain in a wireless LAN environment and controls access to the access point, and a security threat in a wireless section such as a denial of service (DoS) As shown in FIG.

Such a wireless intrusion prevention technique has a structure in which an access policy is held and enforced according to the classification of an access point and a wireless device.

According to the related art, a wireless device is classified as authorized, unauthorized, and neighbor, and controls access to a wireless network through an access point according to the classification.

However, according to the related art, there is a problem in that the classification of the wireless device is not detailed and the access point connection control can not be performed effectively.

U.S. Published patent application 20070025313, published on February 01, 2007.

An embodiment of the present invention provides a wireless device classification apparatus for wireless infringement prevention that collects device-related information and classifies wireless devices in detail based on the information.

According to an aspect of the present invention, there is provided an apparatus for classifying a wireless device for prevention of wireless infringement, comprising: an information collecting unit for collecting information related to a wireless device from a wireless terminal management server and an authentication server; And an information analyzer for analyzing the information related to the wireless device based on the classification policy stored in the classification storage unit and classifying the wireless device according to the analysis result .

According to the embodiment of the present invention, more efficient wireless infringement prevention service is possible by classifying wireless devices. In particular, although the device information that can be classified by the wireless intrusion prevention system is limited, in the present invention, since the device information is received from the authentication server and the wireless terminal management server in real time and used for classification of devices, Can be classified. This enables more secure wireless network services because it controls access to the management domain wireless network of potentially dangerous terminals.

1 is a block diagram illustrating an example of a wireless network access system to which a wireless device classification apparatus according to an embodiment of the present invention can be applied.
2 is a block diagram of a wireless device classification apparatus according to an embodiment of the present invention.
3 is a flowchart illustrating a method of classifying wireless devices by a wireless device classifier according to an embodiment of the present invention.
4 is an exemplary diagram illustrating a risk classification process performed by a wireless device classification apparatus according to an embodiment of the present invention.
5 is an illustration of a graphical user interface for setting a risk level policy according to a classification of a wireless device in accordance with an embodiment of the present invention.
6 is a diagram illustrating an access point access control setting process according to a device risk level according to an embodiment of the present invention.

BRIEF DESCRIPTION OF THE DRAWINGS The advantages and features of the present invention and the manner of achieving them will become apparent with reference to the embodiments described in detail below with reference to the accompanying drawings. The present invention may, however, be embodied in many different forms and should not be construed as being limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the concept of the invention to those skilled in the art. Is provided to fully convey the scope of the invention to those skilled in the art, and the invention is only defined by the scope of the claims.

In the following description of the present invention, a detailed description of known functions and configurations incorporated herein will be omitted when it may make the subject matter of the present invention rather unclear. The following terms are defined in consideration of the functions in the embodiments of the present invention, which may vary depending on the intention of the user, the intention or the custom of the operator. Therefore, the definition should be based on the contents throughout this specification.

1 is a block diagram illustrating an example of a wireless network access system to which a wireless device classification apparatus according to an embodiment of the present invention can be applied.

As shown, the wireless network access system includes a wireless terminal management server 110, an authentication server 120, and a wireless intrusion prevention system 130. The wireless intrusion prevention system 130 includes a wireless intrusion prevention sensor 131, , And a wireless intrusion prevention server (132).

The wireless terminal management server 110 remotely manages a wireless terminal that is in a power-on state at anytime and anywhere using a mobile terminal wireless transmission technology, for example, OTA (Over The Air). The wireless terminal management server 110 includes device management, use registration and tracking management including automatic update of wireless terminal firmware, registration / authorization / recovery function for wireless terminals, lock / data of terminals in lost / A function of suspending the service through deletion of the software, distribution of software through the wireless terminal management server 110, remote diagnosis of the terminal, and after service (AS). An MDM agent is mounted on a terminal managed by the wireless terminal management server 110, and the wireless terminal is managed while the MDM agent and the wireless terminal management server 110 communicate with each other.

The authentication server 120 performs user and device authentication. ID, password-based authentication, authentication using a device certificate, authentication using biometric information, and the like.

The wireless intrusion prevention system 130 detects an unauthorized access point 11 in a management domain in a wireless LAN environment and controls access to the access point 11, and performs security in a wireless section such as a DoS (Denial of Service) Detect and block threats. The wireless intrusion prevention sensor 131 constituting the wireless intrusion prevention system 130 collects RF signals for the wireless LAN management area 10 and transmits the collected RF signals to the wireless intrusion prevention server 132, And performs a reverse attack against the wireless device 12 to block the intrusion according to the instruction of the wireless device 132. The wireless intrusion prevention server 132 comprehensively manages the security of the WLAN infrastructure.

2 is a block diagram of a wireless device classification apparatus according to an embodiment of the present invention.

The wireless device classifying apparatus 200 includes an information collecting unit 210, an information storing unit 220, a classification storing unit 230, and an information analyzing unit 240.

The wireless device classifying apparatus 200 may be mounted on a wireless intrusion prevention server (132 in FIG. 1) or separately installed outside the wireless device classifying apparatus 200.

The information collecting unit 210 has an interface between the wireless terminal management server 110 and the authentication server 120 and collects detailed information related to the wireless device 12 through the interface.

The wireless device related information provided from the wireless terminal management server 110 and collected by the information collection unit 210 includes information of an MDM server management terminal (terminal equipped with an MDM agent and loaded with an MDM agent), hacked or routed terminal information , Lost terminal information, terminal information in which the MDM agent is forcibly deleted, and terminal (tethering, wi-fi hotspot, etc.) that also acts as an AP while receiving the wireless LAN service.

The wireless device related information collected from the information collection unit 210 by the authentication server 120 includes authentication information including an authentication success or failure event.

The information storage unit 220 stores wireless device related information collected by the information collection unit 210 from the wireless terminal management server 110 and the authentication server 120.

The classification storage unit 230 stores classification information for wireless devices, classification information for access points, classification policies, and connection policies according to classification.

The information analyzing unit 240 analyzes the wireless device related information stored in the information storage unit 220 based on the classification policy stored in the classification storage unit 230 and classifies the wireless devices according to the analysis result to classify and store the classification information (230). For example, classification information for each wireless device may be added or updated in the device classification table of the classification storage unit 230. [

According to an embodiment of the present invention, the information analysis unit 240 may classify the wireless devices into nine types. The types and classification criteria are as follows.

Type 1: Type 1 authentication device

An authorized device authenticated through the authentication server 120;

Type 2: Type 2 authentication device

- an authorized device that is set manually by the system itself

Class 3: Type 3 authentication device

- a device that is authenticated by the wireless terminal management server (110) and which is equipped with an MDM agent

Class 4: Guest device

- Set by the system itself

Class 5: Risky Devices

A device or a lost device that hacked or routed or forcibly deleted the MDM agent, and this information is provided by the wireless terminal management server 110

Class 6: tethering devices

- Devices that are also serving as access points (devices providing services such as tethering, wifi hotspot, etc.)

Class 7: External devices

- Devices that exist outside the management domain

Category 8: black-list devices

- Blacklisted devices (in the system's own blacklist)

Class 9: Uncategorized devices

Since the information analysis unit 240 performs the classification according to the classification policy pre-stored in the classification storage unit 230, if the classification policy stored in the classification storage unit 230 is changed, the information analysis unit 240) is also changed.

Also, it can be classified as multiple species instead of only one species. For example, it can be classified as a type 1 authentication device and a rescue device, or can be classified into a type 2 authentication device, a type 3 authentication device, and a tethering device.

In addition, the information analysis unit 240 can classify the access points into five types. The types and classification criteria are as follows.

Class 1: Authorized Access Point

- authorized access point

Class 2: rogue access point

- Unauthorized access points (access points connected to the wired network)

Class 3: tethering / soft access point

- Tethering access points and soft access points

Class 4: External access point

- Access points installed outside the admin domain and space

Class 5: Unclassified Access Point

3 is a flowchart illustrating a method of classifying wireless devices by a wireless device classifier according to an embodiment of the present invention.

In FIG. 3, '+ =' means to add a state, and '- =' means to delete the state. It is also possible to use '=' (state change) instead of '+ =' (add state), or '==' (return to previous state) instead of '- =' . The setting change can be made through the classification policy setting of the classification storage unit 230. [

The device classifying process by the wireless device classifying apparatus 200 according to the embodiment of the present invention can be performed by domain or physical location range. For example, access point and device classification policies may be different for each building or floor of the same building.

When the wireless intrusion prevention sensor 131 detects a new device A (S301), it notifies the wireless intrusion prevention server 132 thereof. For example, when a new access point is found, information such as MAC (Media Access Control) address and SSID (Subsystem IDentification) of the found access point is reported to the wireless intrusion prevention server 132.

Then, the wireless infringement prevention server 132 first sets the state of the device A as a non-classification item (S302), and then searches the classification storage unit 230 for classification information about the device A (S303).

If the classification information stored in the classification storage unit 230 is already stored, the state of the device A is corrected by the classification. If there is no classification information previously stored in the classification storage unit 230, skip is performed (S304, S305).

Thereafter, it waits until an external event for the terminal status occurs (S306), and updates the classification information according to the type of the external event generated when the external event occurs (S307).

If a device authentication success event (from authentication server) has occurred, the first type authentication state is added to the state of the device A (S308).

If an MDM authentication success event (from MDM server) has occurred, a type 3 authentication state is added to the state of the device A (S309).

The hacking or routing terminal (from the MDM server) adds the resuscitation state to the state of the device A (S310).

The MDM agent forcible deletion or lost terminal (from MDM server) adds the state of device A to the state of device A (S311).

The access point performing terminal (from the MDM server) adds the tethering state to the state of the device A (S312).

The manual authentication terminal registration (from the local system (wireless intrusion prevention server)) adds the type 2 authentication state to the state of the device A (S313).

The black list addition terminal (from the local system (wireless intrusion prevention server)) adds the black list to the state of the device A (S314).

The device authentication failure (from authentication server) deletes the type 1 authentication state from the state of device A. If there is no type 1 authentication state, the process is ignored (S315).

The MDM authentication failure (from the MDM server) deletes the Type 3 authentication state from the state of device A. If there is no type-3 authentication status, it is ignored (S316).

A normal recovery from hacking or routing (from the MDM server) removes the resuscitation state from the state of device A. If there is no Risky condition, the process is ignored (S317).

Upon completion of the MDM agent reinstallation or return from the lost terminal (from the MDM server), it removes the resuscitation state from the state of device A. If there is no Risky condition, the process is ignored (S318).

The access point function off (from the MDM server) deletes the tethering state from the state of device A. If there is no tethering state, it is ignored (S319).

The manual authentication terminal list deletion (from the local system) deletes the type-2 authentication state from the state of the device A. If there is no type 2 authentication state, it is ignored (S320).

The deletion from the blacklist (from the local system) deletes the blacklist state from the state of device A. If there is no black list state, the process is ignored (S321).

After completing the processing of the external event through steps S308 to S321, the process proceeds to step S306 and waits until another external event occurs.

FIG. 4 is an exemplary diagram illustrating a process of classifying a security level by a wireless device classification apparatus according to an embodiment of the present invention. Referring to FIG.

According to the embodiment of the present invention, the risk level can be classified into a total of five levels, and the number of the risk levels can be set in a security policy stored in the classification storage unit 230. The level is safe to be low, and the higher the number, the more dangerous it is. For example, level 1 is very safe and level 5 is very risky.

FIG. 5 shows a graphical user interface for setting a risk level policy according to a classification of a wireless device according to an embodiment of the present invention.

The example shown in Fig. 5 is a screen for defining a terminal having three kinds of state information up to the first type authentication state, the rescheduling state, and the tethering state as the risk level 2. This information is stored in the classification storage unit 230 when the user sets it using this interface. This embodiment for risk level mapping can be used in various applications. For example, in the case of the Type 1 authentication status, the risk level is set to level 1 irrespective of other status information, and in the case of the resis device, the risk level is set to level 5 irrespective of other classification The user interface can be configured.

6 is a diagram illustrating an access point access control setting process according to a device risk level according to an embodiment of the present invention.

The types of control for connection are as follows.

Permit: allow access

Prohibit: deny connection, attempt to connect, block access

Notification of administrator (inform): Notify administrator of connection information

Ignore: Ignore

In the embodiment shown in FIG. 6, the policy is set to allow in the case of an authenticated access point (authorized AP) connection to the terminal included in the risk level 1.

The rogue AP connection of the terminal included in the risk level 2 is set to block.

In the case of an access point connection authenticated to a terminal included in the risk level 4, it is set to block.

The terminal's external AP connection at the risk level 5 is set to administrator notification.

These settings are set by the administrator and policy settings can be made using the actual status information instead of the risk level.

For example, a connection to an authenticated access point for a wireless device in a Type 2 authentication state and a tethering state may be established by an administrator notification.

Also, it is possible to set a connection policy between the classification combination and the access point instead of the level of this method.

Combinations of each step of the flowchart and each block of the block diagrams appended to the present invention may be performed by computer program instructions. These computer program instructions may be loaded into a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus so that the instructions, which may be executed by a processor of a computer or other programmable data processing apparatus, And means for performing the functions described in each step are created. These computer program instructions may also be stored in a computer usable or computer readable memory capable of directing a computer or other programmable data processing apparatus to implement the functionality in a particular manner so that the computer usable or computer readable memory It is also possible for the instructions stored in the block diagram to produce a manufacturing item containing instruction means for performing the functions described in each block or flowchart of the block diagram. Computer program instructions may also be stored on a computer or other programmable data processing equipment so that a series of operating steps may be performed on a computer or other programmable data processing equipment to create a computer- It is also possible that the instructions that perform the processing equipment provide the steps for executing the functions described in each block of the block diagram and at each step of the flowchart.

Also, each block or each step may represent a module, segment, or portion of code that includes one or more executable instructions for executing the specified logical function (s). It should also be noted that in some alternative embodiments, the functions mentioned in the blocks or steps may occur out of order. For example, two blocks or steps shown in succession may in fact be performed substantially concurrently, or the blocks or steps may sometimes be performed in reverse order according to the corresponding function.

The foregoing description is merely illustrative of the technical idea of the present invention and various changes and modifications may be made by those skilled in the art without departing from the essential characteristics of the present invention. Therefore, the embodiments disclosed in the present invention are intended to illustrate rather than limit the scope of the present invention, and the scope of the technical idea of the present invention is not limited by these embodiments. The scope of protection of the present invention should be construed according to the following claims, and all technical ideas within the scope of equivalents should be construed as falling within the scope of the present invention.

110: wireless terminal management server 120: authentication server
130: Wireless Infringement Prevention System 131: Wireless Infringement Prevention Sensor
132: Wireless Intrusion Prevention Server
200: Wireless device classifying apparatus 210: Information collecting unit
220: information storage unit 230: classification storage unit
240: Information Analysis Department

Claims (1)

An information collecting unit for collecting relevant information about the wireless device from the wireless terminal management server and the authentication server;
An information storage unit for storing related information about the wireless device collected by the information collecting unit;
And an information analyzer for analyzing information related to the wireless device based on a classification policy stored in the classification storage unit and classifying the wireless device according to an analysis result.

Images