WO2014114099A1

WO2014114099A1 - Method and system for preventing rogue access points in wireless local area network

Info

Publication number: WO2014114099A1
Application number: PCT/CN2013/083675
Authority: WO
Inventors: 彭永超; 熊杰; 唐建国
Original assignee: 中兴通讯股份有限公司
Priority date: 2013-01-24
Filing date: 2013-09-17
Publication date: 2014-07-31
Also published as: CN103067922A

Abstract

Disclosed in the present invention are a method and system for preventing rogue access points in a wireless local area network. The method comprises: an access point controller controlling one or a plurality of monitor terminals to send a detection message to all access points, and the access point controller giving an advance notice through a secure channel that legal access points do not respond after receiving the detection message; and the access point controller determining the rogue access points in all the access points through the responses received by the monitor terminals, and controlling the monitor terminals to send an attack message to the rogue access points. The method is simple and easy to implement, and effectively solves the problem that the MAC (Media Access Control) address of a rogue AP (Access Point) is modified as the MAC address of a legal AP for illegal access.

Description

The present invention relates to the field of communications technologies, and in particular, to a method and system for preventing a rogue access point in a wireless local area network. BACKGROUND Wireless Local Area Network (WLAN) technology is established based on the 802.11 standard established by the IEEE. In this standard, the wireless local area network is called Basic Service Set (BSS). The devices that make up the BSS are called stations (STA, Station), and define two networking modes: Infrastructure mode (Infrastructure BSS) BSS and independent mode (Independent) BSS. In Infrastructure BSS, there is a STA that has both an interface to a wireless LAN and an interface to a wired network. It is called an access point (AP), and other STAs must be connected to the AP, each STA and wired network. The communication between the STAs and the communication between the STAs must be relayed through the AP. IBSS is also known as ad hoc network. The status of each STA is equal. There is no AP, they are connected to each other and communicate directly. Most of the actual networking will adopt the infrastructure mode. Since the WLAN signal is transmitted over the air, it faces more security threats than wired LAN. One of the bigger threats is illegal APs. The criminals can set up an AP at a very low cost (just a wireless network card), put it in a hotspot, such as a coffee shop, and name it with a legal wireless network name or the same name, such as ChinaNet - At the beginning of CMCC-, the user is tempted to connect to it, and provides a fake login page to obtain the user's account number and password. In order to be more deceptive, criminals may adopt a man-in-the-middle attack method, installing two wireless network cards on his computer, one of which is configured in AP mode to provide false access services; the other is configured in STA mode, connected to legal On the AP; two network cards are bridged. In this way, after the STA is connected to the rogue AP, the STA can access the Internet normally. However, all the packets sent and received by the STA are intercepted, and the attacker can analyze many information of the user. To prevent illegal APs, you must first detect the existence of illegal APs. Currently, the detection method is generally based on the MAC address of the AP. The controller maintains a MAC address list of a legal AP through static configuration or dynamic learning, and specifies that several legal APs periodically perform scanning operations. The result of the scan, including the MAC address and channel number of each neighbor AP, is reported to the controller; the controller compares the scan result with the legal AP list. If the MAC address of the AP is not in the list, it is judged. It is an illegal AP. However, because the wireless network environment is open, the illegal AP can completely obtain the information such as the MAC address of a legitimate AP by listening to the beacon frame, and then modify its own MAC address and other parameters to be the same, so that the above detection The method is invalid. So we need to study new ways to deal with this situation. SUMMARY OF THE INVENTION In view of the above analysis, the present invention is directed to a method and a system for preventing a rogue access point in a wireless local area network, so as to at least solve the problem that the MAC address of an AP that cannot be prevented by an illegal AP from modifying its MAC address to be legal is illegal. Access problems. The purpose of the present invention is mainly achieved by the following technical solutions: A method for preventing a rogue access point in a wireless local area network, comprising: an AC controlling one or more monitoring terminals to send a detection packet to all APs, and the AC is pre-passed through security The channel is notified that the legal AP does not respond after receiving the detection packet; the AC determines the rogue AP in all the APs by using the response received by the monitoring terminal, and controls the monitoring terminal to send an attack packet to the rogue AP. . Preferably, the step of controlling the monitoring end to send an attack packet to the rogue AP after the AC determines the rogue AP includes: after the AC determines the rogue AP, randomly constructs multiple fake STA addresses, and the fake The STA address is transmitted to the monitoring terminal through the secure channel, and if the illegal AP is impersonating the STA address of the legal AP, the fake STA address is transmitted to the legal AP impersonating the illegal AP through the secure channel; The AC controls the monitoring terminal to use the fake STA address to falsely generate a plurality of fake STAs to send an attack packet to the rogue AP. After the legal AP that the rogue AP is pretending, the legal AP ignores the attack after receiving the attack packet. Message. Preferably, the monitoring end is a monitoring STA or a monitoring AP designated by the AC; when the monitoring end is a monitoring AP, the monitoring AP spoofs as a STA sends a detection packet to all APs, where the monitoring AP The MAC address masquerading as the STA is randomly configured by the AC; when the monitoring end is monitoring the STA, the MAC address of the monitoring STA is randomly configured by the AC. Preferably, the type of the detection message includes: a probe request and/or an association request. Preferably, the type of the attack message includes: an authentication request and/or an association request. The present invention also provides a system for preventing a rogue access point in a wireless local area network, including:

The AC is configured to control one or more monitoring terminals to send detection packets to all APs, and notify the legal APs through the secure channel to receive the detection packets without responding, and determine all the responses received by the monitoring terminal. A rogue AP in the AP, and the monitoring terminal sends an attack packet to the rogue AP. The monitoring end is configured to send a detection packet to all APs according to the indication of the AC, and the received packet is received. The response is sent to the AC, and the attack packet is sent to the rogue AP according to the indication of the AC. Preferably, the AC is configured to control one or more monitoring terminals to send detection packets to all APs, and notify all legal APs through the secure channel to receive no response after receiving the detection packet, according to the monitoring terminal. Determining the illegitimate APs in all the APs, and randomly constructing a plurality of fake STA addresses after determining the rogue APs, and transmitting the fake STA addresses to the monitoring terminal through the secure channel, if The illegal AP is pretending to be the STA address of the legal AP, and the fake STA address is transmitted to the legal AP that is impersonating the illegal AP through the secure channel, and the monitoring terminal uses the fake STA address to fake multiple fakes. The STA sends an attack packet to the rogue AP; the monitoring end is configured to send a detection packet to all APs according to the indication of the AC, and send the received response to the AC, according to the The indication of the AC uses the AC to randomly construct multiple fake STA addresses to send an attack message to the rogue AP. Preferably, the monitoring end is a monitoring STA or a monitoring AP designated by the AC; when the monitoring end is a monitoring AP, the monitoring AP spoofs as a STA sends a detection packet to all APs, where the monitoring AP The MAC address masquerading as the STA is randomly configured by the AC; when the monitoring end is monitoring the STA, the MAC address of the monitoring STA is randomly configured by the AC. Preferably, the type of the detection message includes: a probe request and/or an association request. Preferably, the type of the attack message includes: an authentication request and/or an association request. The present invention provides a method and a system for preventing a rogue access point in a wireless local area network. The access point controller controls the monitoring end to send a detection packet to all APs, and the legal AP receives the detection message. No response is received, and the illegal AP responds after receiving the detection packet, and the access point controller receives the illegal AP according to the monitoring terminal. And sending the response to the rogue AP, and controlling the monitoring end to send an attack packet to the rogue AP, so that the rogue AP cannot work normally. The method is simple and easy to implement. This method effectively solves the problem that an illegal AP modifies its MAC address to the MAC address of a legal AP for illegal access. Other features and advantages of the invention will be set forth in the description in the description which follows. The objectives and other advantages of the invention will be realized and attained by the <RTI 1 is a flowchart of a method for preventing a rogue AP from detecting a rogue AP according to Embodiment 1 of the present invention; FIG. 2 is a flowchart of a method for detecting and attacking a rogue AP by a legal AP according to Embodiment 1 of the present invention; A flowchart of a method for detecting and attacking an illegal AP by the STA in Embodiment 1 of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT OF THE INVENTION The preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings in which For the sake of clarity and simplicity, detailed descriptions of known functions and structures in the devices described herein will be omitted when they may obscure the subject matter of the present invention. The method and system for preventing a rogue access point in a wireless local area network include a station (STA, Station) access point (Access Point, referred to as AP) and an access point controller (Access Point Controller, abbreviated as AC). ). Embodiment 1 This embodiment of the present invention provides a method for preventing a rogue access point of a wireless local area network. Referring to FIG. 1, the method includes:

The S10K access point controller controls one or more monitoring terminals to send the detection packet to all the APs, and the AC does not need to respond after receiving the detection packet by using the secure channel. The secure channel is a secure channel established between the legal AP and the AC, and between the STA and the AC. The legal AP and the AC are usually connected through a wired network and interact using the CAPWAP protocol (see rfc5415). This protocol requires a pre-shared key or a certificate. Establish an encrypted communication channel between the AP and the AC. An illegal AP is not connected to the AC through a wired network. Even if it is connected, because there is no pre-shared key or certificate on the illegal AP, the encrypted communication channel cannot be established. Therefore, only the legitimate AP and the AC have a secure channel. . If the monitoring terminal is a STA, the packets transmitted between the STA and the legal AP through the wireless channel also need to be protected, so that the legal AP and the STA can establish a wireless security channel through WPA/WPA2 key negotiation. The monitoring terminal in the embodiment of the present invention is a monitoring STA or a monitoring AP designated by the AC. When the monitoring end is a monitoring AP, the monitoring AP spoofs that the STA sends a detection packet to all APs, where the monitoring AP masquerades as the MAC address of the STA is randomly configured by the AC; When monitoring the STA, the MAC address of the monitoring STA is randomly configured by the AC. The detection message in the embodiment of the present invention includes: a detection period, a probe request and/or an association request, and a channel that needs to be scanned.

S1 02: The illegal AP responds after receiving the detection packet; because the illegal AP does not know that this is a detection packet, it will respond to the detection packet.

S103: The AC determines, according to the response sent by the illegal AP, the AP is an illegal AP.

S104: After determining the rogue AP, the AC controls the monitoring end to send an attack packet to the rogue AP, so that the illegal AP cannot work normally. The attack packet includes: a MAC address of the illegal AP, a probe request and/or an association request, and a length of the attack time. The step may include: after the AC determines the rogue AP, randomly constructs a plurality of fake STA addresses, and transmits the fake STA address to the monitoring terminal through the secure channel, if the rogue access point is impersonated The STA address of the legal access point, and the fake STA address is transmitted to the legal access point impersonating the rogue access point through the secure channel; the AC controls the monitoring terminal to use the fake STA address pseudo Causing multiple fake STAs to the illegal

The AP sends an attack packet, so that the illegal AP cannot work normally. The legal AP that the spoofing AP is spoofed ignores the attack packet after receiving the attack packet, so it is not affected by the attack packet. As shown in FIG. 2, the embodiment of the present invention further provides a method for a legal AP to perform detection and attack on a rogue AP. The method may include: when the function of preventing an illegal AP is enabled, the AC first selects several legal APs for monitoring. AP, the coverage of these monitoring APs should add up to cover the entire wireless network. To simplify the description, the following example assumes that there are 3 legal APs, AP1-AP3, and AC selected APIs as monitoring APs. Assume that AP4 is a rogue AP and that it sets its own MAC address to be the same as AP2.

The S20K AC randomly constructs several fake STA addresses and transmits them to all legal APs through a secure channel. S202. The AC issues a command to start testing to the API, and requests it to start detecting the process of the illegal AP. The detection command includes: a detection period, a type of the detected message (a probe request and/or an association request, etc.), and a channel that needs to be scanned;

5203. The API periodically constructs a detection packet whose source address is a fake STA address, and sends the broadcast packet or unicast (if it is a probe request, it can use broadcast; if it is an association request, it can only use the single broadcast). AP2 and AP3 already know that this is a fake STA and will not respond. AP4 did not know, sent a response, and exposed himself.

5204. If the API receives the response, it is reported to the AC.

5205. In order to reduce misjudgment, AC can be further confirmed. For example, if the source address of the response packet is the address of a legal AP, the AC can pass the secure channel and ask the legal AP to confirm whether the response packet has been sent. In addition, certain rules can be configured on the AC to ignore certain responses. For example, if the name of the wireless network included in the response message is not the carrier's, it is ignored. After the AC confirms that an illegal AP is detected, you can perform the following steps to attack the illegal AP to prevent the STA from connecting to the illegal AP.

5206. The AC randomly constructs a plurality of fake STA addresses, and these addresses are transmitted to the monitoring AP through a secure channel, where is an API. If the rogue AP sets its own address to be the same as a legitimate AP, the AC also passes the fake STA address to the spoofed legal AP, here AP2. 5207. The AC sends an attack command to the API, and requests it to attack the illegal AP. The attack command includes parameters such as the MAC address of the rogue AP, the type of the attack packet (authentication request and/or association request, etc.), and the length of the attack.

5208. The API starts to send an attack to the illegal AP, that is, AP4, and generates a number of STAs to send attack packets to the illegal AP. Generally, the number of STAs allowed to connect on an AP is limited. When resources on AP4 are false.

When the STA is occupied, the normal STA cannot connect to it, which is exactly what we want.

5209. Because AP4 sets its own address to be the same as that of AP2, AP2 also receives attack packets. Since the AC has already notified the address of the fake STA to the AP2, the wireless driver on the AP2 can directly discard these messages, and it is less affected. As shown in FIG. 3, an embodiment of the present invention further provides a method for an STA to perform detection and attack on an illegal AP, and the method may include: the present invention deploys a plurality of monitoring STAs within a coverage of a wireless local area network, and performs detection and detection by the same. Block the work of illegal APs. By using the monitoring STA, the impact on the normal operation of the legal AP can be reduced.

The S30K monitors the STA to establish a secure channel with the legal AP through the WPA/WPA2 key negotiation.

5302, the AC determines that the uplink is a monitoring STA, and sends a command to the monitoring STA, which includes a fake STA address, and the AC sends the forged STA address to each legal AP through the secure channel;

5303. The AC sends a command for detecting the packet to the monitoring STA, and requests it to start the detecting process, where the detecting command includes: a detection period, a type of the detected packet (a probe request and/or an association request, etc.), and a channel to be scanned. ;

5304. The monitoring STA changes its own address to a forged address and sends a detection packet according to the requirements. Since the legitimate AP already knows that this is a fake address, it will not respond; and if the illegal AP does not know, it will respond and will expose itself;

After the detection process is completed, the monitoring STA changes its own address back to the real address, re-associates the corresponding AP, and reports the detection result to the AC.

S306. In order to reduce the misjudgment, the AC may send a message to the legal AP that the fake AP spoofs for further confirmation; 5307. After confirming the rogue AP, the AC randomly constructs a plurality of fake STA addresses, and transmits the addresses to the monitoring STA and the counterfeit legal AP through the secure channel, where is AP2;

5308. The AC sends an attack command to the monitoring STA, and requests it to attack the illegal AP. The attack command includes: the MAC address of the illegal AP, the type of the attack packet (authentication request and/or association request, etc.), and the length of the attack time;

5309. The monitoring STA starts to attack the illegal AP, that is, AP4. It uses a fake address to send an attack packet to AP4. The number of STAs allowed to connect to the AP is limited. When the resources on AP4 are occupied by fake STAs, other normal STAs cannot connect to it. A rogue AP is not working properly.

5310. Because AP4 sets its own address to be the same as that of AP2, AP2 also receives attack packets. Since the AC has already notified the address of the fake STA to the AP2, the wireless driver on the AP2 can directly discard these messages, and it is less affected.

Embodiment 2 The embodiment of the present invention provides a system for preventing a rogue access point in a wireless local area network, where the system includes: an access point controller, configured to control one or more monitoring terminals to send detection packets to all access points, And in advance, the security channel is notified that all legal access points do not respond after receiving the detection message, and the illegal access point in all the access points is determined according to the response received by the monitoring terminal, and the illegal access point is determined. After the access point, a plurality of fake STA addresses are randomly configured, and the fake STA address is transmitted to the monitoring terminal through the secure channel. If the illegal access point is pretending to be the address of the legal access point, The fake STA address is transmitted to the legal access point impersonating the rogue access point through the secure channel, and the monitoring terminal uses the above-mentioned fake STA address to falsely cause multiple fake STAs to the illegal access. The point sends an attack message; the monitoring end is configured to send a detection message to all access points according to the indication of the access point controller, and send the received response to the access point. System, further use of the random access point controller configured according to a plurality of address STA false indicates that the access point controller transmits the illegal attack packets to the access point. The monitoring terminal in the embodiment of the present invention is a monitoring STA or a monitoring AP designated by the AC. When the monitoring end is a monitoring AP, the monitoring AP spoofs the STA to send a detection packet to all the APs, where the monitoring AP masquerades as the MAC address of the STA is randomly configured by the AC; When the monitoring end is a monitoring STA, the MAC address of the monitoring STA is randomly configured by the AC. The detection message in the embodiment of the present invention includes: a detection period, a probe request, and/or an association request, and a channel that needs to be scanned. The attack packet in the embodiment of the present invention includes: a MAC address, an authentication request, and/or an association request of the illegal AP, and a length of the attack time. In summary, the embodiment of the present invention provides a method and system for preventing a rogue access point in a wireless local area network. The access point controller controls the monitoring end to send a detection packet to all APs, and the legal AP receives the detection packet. After the acknowledgment is received, the illegitimate AP responds with the detection packet, and the access point controller determines, according to the response sent by the illegitimate AP received by the monitoring terminal, which AP is a rogue AP. And after determining the rogue AP, the monitoring terminal sends an attack packet to the rogue AP, so that the rogue AP cannot work normally. The method is simple and easy to implement. This method effectively solves the problem that an illegal AP modifies its MAC address to the MAC address of a legal AP for illegal access. Industrial Applicability As described above, the embodiment of the present invention provides a method and system for preventing a rogue access point in a wireless local area network, which has the following beneficial effects: The access point controller controls the monitoring end to send detection packets to all APs, and the legal AP After receiving the detection packet, the acknowledgment is not performed, and the illegitimate AP responds after receiving the detection packet, and the access point controller determines, according to the response sent by the illegal AP received by the monitoring terminal. A rogue AP sends an attack packet to the rogue AP, so that the rogue AP cannot work normally. This method is simple and easy to implement. The above is only a preferred embodiment of the present invention, but the scope of the present invention is not limited thereto, and any person skilled in the art can easily think of changes or within the technical scope disclosed by the present invention. Alternatives are intended to be covered by the scope of the present invention. Therefore, the scope of the invention should be determined by the scope of the claims.

Claims

Claims, a method for preventing unauthorized access points in a wireless LAN, including:

The access point controller controls one or more monitoring terminals to send a detection packet to all the access points, and the access point controller notifies the legal access point to receive the detection packet and does not respond in advance through the secure channel;

The access point controller determines an illegal access point in all the access points by using the response received by the monitoring terminal, and controls the monitoring end to send an attack packet to the rogue access point. The method according to claim 1, wherein the step of controlling the access point controller to control the monitoring end to send an attack message to the rogue access point after the access point controller comprises:

After the access point controller determines the rogue access point, randomly constructs a plurality of fake STA addresses, and transmits the fake STA address to the monitoring terminal through the secure channel, if the rogue access point is impersonating The STA address of the legal access point is transmitted to the legal access point impersonated by the rogue access point through the secure channel;

The access point controller controls the monitoring terminal to use the fake STA address to falsely generate multiple fake STAs to send an attack message to the rogue access point;

After receiving the attack packet, the legal access point impersonating the rogue access point ignores the attack packet. The method according to claim 1 or 2, wherein the monitoring end is a monitoring STA or a monitoring access point specified by the access point controller;

When the monitoring end is the monitoring access point, the monitoring access point is spoofed as the STA sends a detection packet to all the access points, where the monitoring access point is masqueraded as the MAC address of the STA as the access. The point controller is randomly constructed;

When the monitoring end is a monitoring STA, the MAC address of the monitoring STA is randomly configured by the access point controller. The method according to claim 1 or 2, wherein the detecting the type of the message comprises: a probe request and/or an association request. The method according to claim 1 or 2, wherein the type of the attack message comprises: an authentication request and/or an association request. A system for preventing a rogue access point in a wireless local area network, comprising:

The access point controller is configured to control one or more monitoring terminals to send detection packets to all access points, and notify the legal access point through the secure channel to receive the detection message without responding, and The response received by the monitoring end determines an illegal access point in all the access points, and controls the monitoring end to send an attack message to the illegal access point;

The monitoring end is configured to send a detection packet to all access points according to the indication of the access point controller, and send the received response to the access point controller, and according to the connection The indication of the ingress controller sends an attack message to the rogue access point. The system according to claim 6, wherein

The access point controller is configured to: control one or more monitoring terminals to send detection packets to all access points, and notify all legal access points through the secure channel to receive the detection message without answering, according to The response received by the monitoring end determines an illegal access point in all access points, and randomly constructs multiple fake STA addresses after determining the illegal access point, and passes the fake STA address through the security. Passing the channel to the monitoring terminal, if the rogue access point is pretending to be the address of the legal access point, and transmitting the fake STA address to the rogue access point through the secure channel And controlling, by the monitoring terminal, the fake STA address to generate a plurality of fake STAs to send an attack message to the rogue access point;

The monitoring end is configured to send a detection packet to all access points according to the indication of the access point controller, and send the received response to the access point controller, according to the connection The indication of the ingress controller uses the access point controller to randomly construct a plurality of fake STA addresses to send an attack message to the rogue access point. The system according to claim 6 or 7, wherein the monitoring terminal is a monitoring STA or a monitoring access point specified by the access point controller;

When the monitoring end is a monitoring STA, the MAC address of the monitoring STA is randomly configured by the access point controller. The system according to claim 6 or claim 1, wherein the type of the detection message comprises a probe request and/or an association request. The system according to claim 6 or 7, wherein the type of the attack message comprises: an authentication request and/or an association request.