WO2014157745A1

WO2014157745A1 - Method for detecting illicit mobile device by means of both wired and wireless scanning

Info

Publication number: WO2014157745A1
Application number: PCT/KR2013/002517
Authority: WO
Inventors: 김태범; 김정식
Original assignee: (주)노르마
Priority date: 2013-03-27
Filing date: 2013-03-27
Publication date: 2014-10-02

Abstract

Disclosed is a method for detecting an illicit mobile device invading an intranet consisting of wired and wireless communications, which includes the steps of: scanning wirelessly a wired and wireless network sharing device and the devices connected thereto; scanning the devices connected to a wired network; and comparing the result of the wireless scanning with the result of the wired scanning so as to detect the illicit mobile device.

Description

Discrimination of illegal mobile devices using wired and wireless scanning

The present invention relates to a method for discriminating illegal mobile devices using wired scanning and wireless scanning.

It is necessary to detect when a wired / wireless router breaks in by impersonating a terminal in the company's internal network.

Conventionally, Korean Patent Publication KR2002-0041004A discloses an internal network security system, but it is difficult to apply when a wired / wireless router is invaded. This is because wired / wireless routers may leak the company's confidential data by directly connecting to an external network without going through an authentication system.

On the other hand, devices called WIPS perform the operation of detecting illegal or fake APs, but these devices are expensive and are not easy to introduce.

There may be provided a method for discriminating illegal mobile devices using wired and wireless scanning that can identify a mobile device illegally invading an internal network.

According to an embodiment of the present invention, there is provided a method for determining an illegal mobile device invading a wired and wireless internal network, comprising: a wireless scanning step of wirelessly scanning a wired / wireless router and devices connected to the wired / wireless router; A wired scanning step of scanning devices connected to a wired network; And comparing the result of the wireless scanning step with the wired scanning step, and determining illegal mobile device.

The wireless scanning step may be a step of collecting a wireless mac address and a wired mac address of devices connected to the device having the wireless mac address from at least one ARP frame received wirelessly.

The wired scanning may include collecting wired mac addresses of devices wired to the internal network.

The determining may include: excluding a wireless mac address that is not connected to at least one wired mac address scanned in the wired scanning step from a result scanned in the wireless scanning step; And determining a device having an illegally connected wireless MAC address by referring to a list of devices having a wireless MAC address that is legally registered in the result of the scanning in the wireless scanning step.

The collected wired MAC address may be directly connected to a device having the wireless MAC address.

According to one or more embodiments of the present invention, it is possible to determine a mobile device illegally invading an internal network.

1 is a view for explaining the discriminating device S of the illegal mobile device according to an embodiment of the present invention,

2 is a view for explaining the illegal mobile method according to an embodiment of the present invention,

3 is a view for explaining the embodiment of Figures 1 and 2,

4 is a view for explaining a functional block diagram of the discriminating device S of an illegal mobile device according to an embodiment of the present invention; and

5 is a diagram illustrating a computer system in which an illegal mobile device is implemented according to an embodiment of the present invention.

[Description of the code]

10: first wired / wireless router 20: second wired / wireless router

30: third wired / wireless router

11, 13, 15, 17, 19, 20, 21, 23, 25, 30, 31, 33, 35: terminal device

101: program logic 103: processor

105: storage unit 107: memory

102: wireless scanning unit 104: wired scanning unit

106: illegal device selection unit

Objects, other objects, features and advantages of the present invention will be readily understood through the following preferred embodiments associated with the accompanying drawings. However, the present invention is not limited to the embodiments described herein and may be embodied in other forms. Rather, the embodiments introduced herein are provided so that the disclosure may be made thorough and complete, and to fully convey the spirit of the present invention to those skilled in the art. In the present specification, when a component is mentioned to be on another component, it means that it may be formed directly on the other component or a third component may be interposed therebetween.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. In this specification, the singular also includes the plural unless specifically stated otherwise in the phrase. As used herein, the words 'comprises' and / or 'comprising' do not exclude the presence or addition of one or more other components.

Hereinafter, the present invention will be described in detail with reference to the accompanying drawings. In describing the specific embodiments below, various specific details are set forth in order to explain the invention more specifically and to help understand. However, those skilled in the art can understand that the present invention can be used without these various specific details. In some cases, it is mentioned in advance that parts of the invention which are commonly known in the description of the invention and which are not highly related to the invention are not described in order to prevent confusion in explaining the invention without cause.

Definition of Terms

In the present specification, the term "wireless mac address" refers to a mac address of a device that transmits and receives data wirelessly, and the term "wired mac address" refers to a mac address of a device that transmits and receives data by wire.

1 is a view for explaining the discriminating device (S) of the illegal mobile device according to an embodiment of the present invention, Figure 3 is a view for explaining the embodiment of Figs.

Hereinafter, referring to FIGS. 1 and 3, an apparatus for determining an illegal mobile device according to an embodiment of the present invention will be described.

For the purpose of explanation of the present invention, in the embodiment of Fig. 1, the internal network N1 is composed of a wired and wireless network, and the illegal mobile device in which the second wired / wireless router 20 invades the internal network N1. After that, the discriminating device S (hereinafter, referred to as 'identifying device S') of the illegal mobile device will be described.

The determination device S performs an operation of scanning wirelessly and an operation of scanning by wire. Scanning by wireless may be performed first, or scanning by wire may be performed first.

In FIG. 1, the determination device S is illustrated as being positioned at two places by dotted lines, and the determination device S may be implemented as one device or two devices. When the determination device S is physically implemented as one device, the wireless scanning operation may be performed first and then the wired scanning operation may be performed, or the wired scanning operation may be performed and then the wireless scanning operation may be performed.

When the discriminating device S is physically implemented as two devices, a discriminating device S for performing a wireless scanning operation and a discriminating device S for performing a wired scanning operation are separately provided, and any one of them is provided. The determination device S may be configured to provide the results of the scanning to the other determination device S or to provide each other.

In another case where the discriminating device S is physically implemented as two devices, a discriminating device S for wireless scanning operation and a discriminating device S for wired scanning operation are separately provided, and these discriminating devices are provided. Each S transmits its scanning result to a server (not shown), and the server receiving the scanning result from both determination devices S determines which device is an illegal mobile device.

무선 스캐닝 동작Wireless scanning operation

First, an operation of scanning by the determination apparatus S wirelessly will be described.

Scanning wirelessly (hereinafter, referred to as a 'wireless scanning operation') is an operation of analyzing signals received wirelessly and finding a wired / wireless router and devices connected to the wired / wireless router. For example, a wireless scanning operation may collect beacons (such as signals originating from devices called wireless access point (AP)) and ARP requests that are received from the surroundings and collect the information on the router and the router. Find out which devices are connected.

Specifically, the determination device S can find out the MAC addresses for the wired / wireless routers in the surroundings by collecting beacons for reception in the surroundings. In addition, by collecting ARP requests, it is possible to determine the MAC address of devices directly connected to the router.

In the environment as shown in FIG. 1, a result of wireless scanning performed by the determination device S is illustrated in FIG. 3. Referring to FIG. 3, the determination device S includes a first group A ', A, F, G, B, a second group D', D, C, J, K, and a third group ( Wireless scanning results such as P ', P, Q, R, W) can be collected.

Here, A ', D', and P 'are MAC ADDRESS of the wired / wireless routers, A, D, and P are wired MAC addresses of the wired / wireless router, and the remaining F, G, B, H, I, D , J, K, C, P, Q, R, W are the devices (11, 13, 15, 17, 19, 20, 21, 23, 25, 30, 31, 33, 35) directly connected to the router. Indicates a Mac address.

On the other hand, when the wireless scanning device, the determination device (S) is to distinguish and collect which wired devices are directly connected to the wireless sharing router. That is, as shown in FIG. 3, the first group includes a wireless mac address A ′ of the first wired / wireless router 10, a wired mac address A of the first wired / wireless router 10, and a first wired / wireless router. It consists of wired Mac addresses F, G, B of devices directly connected to it.

In a similar manner, the second group is directly connected to the wireless mac address D 'of the second wired / wireless router 20, the wired mac address D of the second wired / wireless router 20, and the second wired / wireless router 20. The device consists of wired mac addresses C, J, and K, and the third group is a wireless mac address P 'of the third router 30, a wired mac address of the third router 30. P), the wired MAC addresses (Q, R, W) of the devices directly connected to the third wired / wireless router 30.

On the other hand, the result of the wireless scanning performed by the determination device (S), because not only the internal network (N1) but also collects the signals from the surrounding external network (N2) together, as shown in Figure 3 also the same information as the third group It will be included.

The reason why the discriminating device S performs wireless scanning to group and manage each wireless MAC address is to discriminate illegal mobile devices with reference to the wired scanning result to be described later.

On the other hand, how to determine the wired MAC address of the devices directly connected to the wired / wireless router, the determination device (S) will be described by way of example.

The discriminating device S collects signals called ARP frames, which are signals broadcast from wired or wireless devices constituting the inner network N1 and the outer network N2. The discriminating device S analyzes signals called ARP frames, and it is possible to know which device is directly connected to which wired / wireless router. In other words, the SSID included in the ARP frame indicates which wired / wireless router and which MAC address is included therein to determine which wired device is connected.

유선 스캐닝 동작Wired Scanning Action

Now, the operation of scanning by the determination device S by wire will be described.

The wired scanning operation (hereinafter, referred to as a “wired scanning operation”) is an operation of analyzing signals received by the wire and finding devices connected to each other by wire in the internal network N1. For example, in the wired scanning operation, as shown in FIG. 1, the determination device S directly connects to the internal network N1 to collect wired mac addresses of devices connected by wire.

Referring to FIG. 3 again, the portion labeled 'wired group' shows the wired mac addresses collected by the determination device S by wire. As a result of the wired scanning in the embodiment of FIG. 1, the wired group may be A, F, G, B, D, C, J, K, H, or I.

Since the wired mac addresses P, Q, R, and W included in the external network N2 are not connected to the internal network N1 by wire, the determination device S is naturally included in the wired scanning result. Not.

불법 모바일 장치 판별 동작Illegal Mobile Device Discrimination Behavior

Referring to FIG. 3, an operation of determining the second wired / wireless router 20 which is an illegal mobile device invading the internal network will be described.

The determination device S may determine the illegal mobile device by referring to both the wireless scanning result and the wired scanning result. Determining the illegal mobile device includes i) excluding the group for the external network and ii) selecting the illegal mobile device in comparison with the registered group list.

The operation of excluding groups for external networks will be described first.

For example, the discrimination apparatus S selects groups which do not have a wired mac address belonging to a wired group from the groups wirelessly scanned. That is, the wired mac address belonging to the wired group is A, F, G, B, D, C, J, K, H, I, and the wireless scanning group that does not contain any of these wired mac addresses is the third group. The third group consists of P ', P, Q, R, and W, and does not have any of A, F, G, B, D, C, J, K, H, I. Therefore, the determination device S determines that the third group is the external network and excludes it from the determination object.

Now, an operation of selecting an illegal mobile device in comparison with the registered group list will be described. Here, the registration group list means a MAC address list for wireless devices that are duly authorized to use. The registered group list may be previously stored by the determination device S that performs the operation of selecting an illegal mobile device or may be transmitted from an external (server).

The discriminating device S can find out which device has an unregistered wireless MAC address by comparing the registered group list with the first group and the second group. In the case of the second wired / wireless router 20, since the device is not properly licensed, the second wired / wireless router 20 is not included in the registered group list. Accordingly, the discriminating device S can know that the device having the wireless MAC address D 'in the second group is illegal.

By performing the above two operations, the determination device S determines the illegal mobile device.

As another example, the determination device S does not need to perform i) an operation of excluding a group for the external network described above and ii) selecting an illegal mobile device in comparison with a registered group list, ii). The illegal mobile device can also be determined by performing the operation. This is because the registered group list of the internal network N1 does not include the wired / wireless router 30 belonging to the external network, i) without performing an operation, and ii) determining an illegal mobile device by performing the operation. Can be.

2 is a view for explaining a method for determining an illegal mobile device according to an embodiment of the present invention.

Referring to FIG. 2, the method for determining an illegal mobile device according to an embodiment of the present invention includes the steps of performing the wireless scanning (S101) and performing the wired scanning (S103) by the determination device S. And determining illegal mobile devices connected to the internal network N1 with reference to the wireless scanning result and the wired scanning result (S105).

Here, the wireless scanning step S101 and the wired scanning step S103 may be performed simultaneously with each other or with each other.

The device performing the wireless scanning (S101) and the device performing the wired scanning (S103) may be physically the same as or different from each other. In the case of separate devices, the device provides the result of scanning from one side to the other, and the device provided with the scanning result performs the step of determining illegal mobile devices connected to the internal network (S105).

On the other hand, the device performing the step of determining (S105) is any one of the device performing the step of performing a wireless scanning (S101) and the device performing a step of performing a wired scanning (S103), or another device (for example Server). When the server performs the step of determining (S105), the device performing the wireless scanning step (S101) and the device performing the wire scanning step (S103), respectively, to the server the results of their scanning to the server. Will be provided.

Performing wireless scanning (S101) includes collecting a wireless mac address and a wired mac address of devices connected to the device having the wireless mac address from at least one ARP frame received wirelessly.

The meanings of wireless scanning and wired scanning in FIG. 2 have already been described with reference to FIG. 1 and will be omitted herein.

4 is a view for explaining a functional block diagram of the discriminating device S of the illegal mobile device according to an embodiment of the present invention.

Referring to FIG. 4, an apparatus 100 for determining an illegal mobile device according to an embodiment of the present invention may include a wireless scan unit 102, a wired scan unit 104, and an illegal device selection unit 106. have. Here, the wireless scan unit 102, the wired scan unit 104, and the illegal device selection unit 106 may be implemented in hardware and / or software.

The discriminating device 100 of the illegal mobile device may correspond to the discriminating device S of FIG. 1, and may be implemented in the form of devices such as a notebook computer, a smartphone, a PDA, a tablet PC, and the like.

The wireless scan unit 102 performs the wireless scanning operation described with reference to FIGS. 1 and 3, and the wired scan unit 104 performs the wired scanning operation described with reference to FIGS. 1 and 3.

The illegal device selection unit 106 performs the illegal mobile device determination operation described with reference to FIGS. 1 and 3.

Referring to FIGS. 1 and 3, the apparatus 100 for determining an illegal mobile device is described. The apparatus 100 for determining an illegal mobile device may be located at a position capable of receiving all radio signals propagated in the internal network N1. Perform a wireless scanning operation. In addition, the apparatus 100 for determining an illegal mobile device collects wired mac addresses of devices connected to the internal network N1 by wire by connecting to the internal network N1 by wire.

Referring to FIG. 5, a computer system in which an illegal mobile device is implemented according to an embodiment of the present invention may include a program logic 101, a computer processor 103, a storage unit 105, and a memory 107. have.

The program logic 101 may be implemented in the form of code executable in a computer, stored in the storage unit 105, and loaded and operated in the memory 107 under the control of the computer processor 103. Can be.

For example, the program logic 101 may include code for performing operations of the wireless scan unit 102, the wired scan unit 104, and the illegal device selection unit 106 described with reference to FIG. 4. can do. Here, the code for performing the operation of the wireless scanning unit 102, the code for performing the operation of the wired scanning unit 104, and the code for performing the operation of the illegal device selection unit 106, Figures 1 and 3 The wireless scanning operation, the wired scanning operation, and the illegal device selection operation described with reference to the present invention may be performed.

Alternatively, at least one of the wireless scan unit 102, the wired scan unit 104, and the illegal device selection unit 106 may be implemented in hardware.

In the above-described embodiments, components that are implemented in code of a program executable in a computer may be implemented in hardware logic. When implemented in hardware logic, it may be implemented in a form embedded in the computer processor 103, or may be implemented in a separate hardware from the computer processor 103.

As described above, the present invention has been described by way of limited embodiments and drawings, but the present invention is not limited to the above embodiments, and those skilled in the art to which the present invention pertains various modifications and variations from such descriptions. This is possible. Therefore, the scope of the present invention should not be limited to the described embodiments, but should be determined not only by the claims below but also by the equivalents of the claims.

Claims

In the method of discriminating illegal mobile devices invading the internal network of wired and wireless,

A wireless scanning step of wirelessly scanning the router and the devices connected to the router;

A wired scanning step of scanning devices connected to a wired network; And

And comparing the result of the wireless scanning step and the wired scanning step to determine an illegal mobile device.
The method of claim 1,

The wireless scanning step,

And collecting the wired MAC address of the wireless MAC address and the devices connected to the device having the wireless MAC address from at least one ARP frame received wirelessly.
The method of claim 2,

The wired scanning step,

And collecting wired mac addresses of devices wired to the internal network.
The method of claim 3,

The determining step,

Excluding a wireless mac address that is not connected to at least one wired mac address scanned in the wired scanning step from the result scanned in the wireless scanning step; And

And determining, from the results scanned in the wireless scanning step, a device having an illegally connected wireless mac address, by referring to a list of devices having a wireless MAC address legally registered in advance. How to determine the device.
The method of claim 2,

The collected wired mac address is directly connected to the device having the wireless mac address.