WO2016159396A1

WO2016159396A1 - Wips sensor and method for blocking terminal using same

Info

Publication number: WO2016159396A1
Application number: PCT/KR2015/003068
Authority: WO
Inventors: 이상준; 함성윤; 손민기
Original assignee: 주식회사 유넷시스템
Priority date: 2015-03-27
Filing date: 2015-03-27
Publication date: 2016-10-06
Also published as: CN107431971A; JP2018511282A

Abstract

The present invention relates to a WIPS (wireless intrusion prevention system) sensor for monitoring the traffic of a wireless communication terminal connected to an AP (access point), the WIPS sensor being characterized in that, upon receiving an access blocking control signal related to a specific wireless communication terminal connected to the AP from a WIPS server, the WIPS sensor changes the MAC address of the specific wireless communication terminal to its MAC address and requests the AP to make a new connection. In addition, the present invention relates to a method for blocking a terminal using a WIPS sensor, the method being characterized by comprising: a first step for the WIPS sensor monitoring the traffic of a wireless communication terminal connected to an AP (access point) and collecting information regarding the BSSID (basic service set identifier) and MAC address of the AP and the wireless communication terminal; a second step for the WIPS sensor receiving a control signal for blocking access of a specific wireless communication terminal, which has been transmitted from a WIPS server; a third step for the WIPS sensor extracting the MAC address of the specific wireless communication terminal from the information collected in the first step and assigning same as MAC address of self; and a fourth step for the WIPS sensor requesting a new connection from the AP, which is connected to the specific wireless communication terminal. Accordingly, information collection by a portable scanner makes it possible to detect the position of wireless equipment, which exists on a specific wireless network, without constructing a wireless intrusion prevention system, and to determine whether or not to approve the detected wireless equipment on the basis thereof, thereby improving the security of the wireless network at a low cost.

Description

WIPS sensor and terminal blocking method using the same

The present invention relates to a WIPS sensor and a terminal blocking method using the same, and more particularly, to a WIPS sensor and a terminal blocking method using the same, which can block a security policy violation access terminal in wireless communication in an 802.11w environment.

The WIPS sensor in the wireless network security system collects unique information (MAC address, product name, manufacturer, serial number, hardware information, etc.) of the plurality of wireless devices constituting the wireless network, and uses WIPS (Wireless Intrusion Prevention System). In addition to transmitting to the server, it monitors the intrusion, attack and abnormality of the wireless network where the wireless equipment is located, reports the details to the WIPS server, and receives the control signal for response from the WIPS server to receive the wireless network. It serves to propagate to, and the related art related to this, Republic of Korea Patent Publication No. 10-2013-0019892 (published on Feb. 27, 2013), Republic of Korea Patent Publication No. 10-1186876 (2012.10. 02. announcement).

On the other hand, the blocking of the security policy violation terminal of the conventional WIPS sensor, as shown in Figure 1, according to the control signal of the WPIS server deauthentication (deauthentication) to the AP connected to the blocking target terminal T in the WIPS sensor (S) or The AP blocks the access to the corresponding UE by transmitting a deassociation packet.

However, in 802.11w, a new standard of the wireless network environment, a technology for protecting communication packets through specific key sharing is added in an interworking process between an AP and a terminal for improving security of a management frame.

That is, the existing WIPS sensor did not know the shared key of the AP and the terminal to which 802.11w was applied, and thus it was impossible to block the terminal (T) through the authentication release or the transmission of the de-linked packet. Necessity is emerging.

The present invention was made to solve the above problems, and an object of the present invention is to provide a technology capable of implementing network access blocking for a terminal in violation of a security policy even in an 802.11w environment.

The above object is, according to the present invention, a wireless intrusion prevention system (WIPS) sensor for monitoring the traffic of a wireless communication terminal connected to an access point (AP), the connection is blocked from a WIPS server to a specific wireless communication terminal connected to the AP When receiving the control signal, the WIPS sensor may be achieved by the WIPS sensor to request a new connection to the AP by changing the MAC address of the specific wireless communication terminal to its own MAC address.

The WIPS sensor may include: a monitoring unit configured to collect traffic between a wireless communication terminal connected to the AP and BSSID (Basic Service Set Identifierd) and MAC address information of the AP and the wireless communication terminal; An information storage unit for storing BSSID and MAC address information of the AP and the wireless communication terminal collected by the monitoring unit; A communication unit which communicates with a WIPS server and receives an access blocking control signal for a specific wireless communication terminal from the WIPS server; A MAC address conversion unit for allocating the access blocking control signal to its own MAC address by referring to the MAC address of a specific wireless communication terminal stored in the information storage unit; And an AP access unit requesting a new connection to a corresponding AP accessing a specific wireless communication terminal using the MAC address converted by the MAC address conversion unit. It includes.

On the other hand, according to the present invention, the WIPS sensor monitors the traffic of the wireless communication terminal connected to the AP (Access Point), and the BSSID (Basic Service Set Identifierd) and MAC address information of the AP and the wireless communication terminal A first step of collecting; A second step of receiving, by the WIPS sensor, an access blocking control signal of a specific wireless communication terminal transmitted from a WIPS server; A third step of the WIPS sensor extracting the MAC address of the specific wireless communication terminal from the information collected in the first step and assigning the MAC address to its own MAC address; And a fourth step of requesting a new connection from the WIPS sensor to the AP connected to the specific wireless communication terminal. It may also be achieved by a terminal blocking method using a WIPS sensor comprising a.

Herein, after the fourth step, a fifth step of deeming that the AP requesting a new connection requests the new connection from the specific wireless communication terminal; And a sixth step in which the AP is interconnected by allocating a new key to the WIPS sensor. It may further include.

According to the present invention, the reliability of security is increased by implementing network access blocking for a terminal that violates a security policy even in an 802.11w environment.

In addition, the WIPS sensor can be recycled by implementing terminal blocking in an 802.11w environment through software update or firmware update without structural change of the WIPS sensor.

Since the accompanying drawings are for understanding the technical spirit of the present invention together with the detailed description of the above-described invention, the present invention should not be construed as limited to the matters shown in the following drawings.

1 is a schematic diagram showing that the WIPS sensor according to the prior art block the terminal on the network,

2 is a block diagram illustrating a configuration of a WIPS sensor according to the present invention and a schematic diagram showing that the WIPS sensor blocks a terminal on a network.

3 is a flowchart illustrating a flow of a terminal blocking method using a WIPS sensor according to the present invention.

Hereinafter, with reference to the accompanying drawings will be described in detail the configuration of the present invention.

Prior to this, the terms used in this specification and claims should not be construed in a dictionary sense, and the inventors may properly define the concept of terms in order to explain their invention in the best way. It should be construed as meaning and concept consistent with the technical spirit of the present invention.

Therefore, the configurations shown in the embodiments and drawings described herein are only preferred embodiments of the present invention, and do not represent all of the technical idea of the present invention, and various equivalents may be substituted for them at the time of the present application. It is to be understood that water and variations may exist.

1. WIPS 센서에 대한 설명1. Description of WIPS Sensor

2, the WIPS sensor 100 according to the present invention includes a monitoring unit 10, an information storage unit 20, a communication unit 30, a MAC address conversion unit 40, and an AP connection unit 50. do.

Hereinafter, a detailed configuration of the WIPS sensor 100 according to the present invention will be described. However, the configuration described below is not the overall configuration constituting the WIPS sensor, the configuration that implements the function and operation of the conventional WIPS sensor is assumed to be adopted, and features and technical features of the present invention for clarity of the invention. It will be clear that only the configurations shown are combined and explained.

The monitoring unit 10 monitors the communication traffic of the wireless communication terminal T connected to the AP, and at the same time, the BSSID (Basic Service Set Identifier) and the MAC address of the AP and the wireless communication terminal (T) through traffic monitoring. Collect information.

Here, the collected BSSID and MAC address, which are unique information of the AP and the wireless communication terminal T, are used to block a specific wireless communication terminal to be described later.

The information storage unit 20 stores BSSID and MAC address information of the AP and the wireless communication terminal T collected by the monitoring unit 10, and the information stored in the information storage unit 20 controls access blocking. When a signal is received, it is referred to and used by the MAC address conversion unit 40 to be described later.

The communication unit 30 implements mutual communication between the WIPS sensor 100 and the WIPS server 200, and various report signals of the WIPS sensor 100 are transmitted to the WIPS server 200 by the communication unit 30. Various control signals of the WIPS server 200 are received by the WIPS sensor 100. Hereinafter, the case where the WIPS sensor 100 receives the access blocking control signal for blocking the security policy violation terminal analyzed by the WIPS server 200 will be described.

The MAC address conversion unit 40 is configured to change the MAC address of the WIPS sensor 100 in a specific situation. Specifically, the communication unit 30 is blocked from accessing a specific wireless communication terminal T. It is activated when a control signal is received.

Here, when the MAC address conversion unit 40 receives an access blocking control signal for a specific wireless communication terminal T through the communication unit 30, the MAC address conversion unit 40 refers to the BSSID and the MAC address list stored in the information storage unit 20. The BSSID and the MAC address of the specific wireless communication terminal T are extracted, and the MAC address of the extracted specific wireless communication terminal T is changed to the MAC address of the WIPS sensor 100.

By the operation of the MAC address conversion unit 40, the MAC address of the WIPS sensor 100 is set to be the same as the MAC address of the specific wireless communication terminal T to be blocked.

The AP access unit 50 serves to request a new connection to the AP that is accessing the specific wireless communication terminal T through the MAC address of the WIPS sensor 100 converted by the MAC address conversion unit 40.

In addition, when a new connection is requested to the corresponding AP by the AP access unit 50, the AP regards the specific wireless communication terminal T that is being connected to request a new connection and sends a new shared key to the WIPS sensor 100. Assigns and forms a security association (SA) between the AP and the WIPS sensor 100, and in this process, the connection between the AP and the AP that is being connected is blocked (the SA of the specific wireless communication terminal and the AP is disconnected). )

That is, when the WIPS sensor 100 according to the present invention receives the access blocking control signal for the specific wireless communication terminal T connected to the AP from the WIPS server 200, the MAC address of the specific wireless communication terminal T is received. Is a new connection request to the AP by changing its MAC address, and the AP processes a new connection request (In AP, a specific wireless communication terminal is regarded as requesting a new connection, but the new connection request is actually an AP and a WIPS sensor. By blocking the connection with a specific wireless communication terminal (T) in a natural manner can be implemented to block the specific wireless communication terminal (T) in violation of the security policy.

2. WIPS 센서를 이용한 단말 차단 방법에 대한 설명2. Description of terminal blocking method using WIPS sensor

Referring to Figure 3, the terminal blocking method using the WIPS sensor according to the present invention, information collection step (first step, S10), access block control signal receiving step (second step, S20), MAC address assignment step (the first Step 3, S30), the new connection request step (fourth step, S40), the new connection request receiving step (fifth step, S50) and the new connection and the terminal blocking step (five steps, S50).

제1단계:정보수집단계(S10)First step: information collection step (S10)

The WIPS sensor monitors traffic of a wireless communication terminal connected to an access point (AP), and collects BSSID (Basic Service Set Identifierd) and MAC address information of the AP and the wireless communication terminal. This step monitors the WIPS sensor. The collected BSSID and MAC address information is stored in the information storage unit of the WIPS sensor.

제2단계:접속 차단 제어신호 수신단계(S20)Step 2: Receiving connection blocking control signal (S20)

The WIPS sensor receives the access blocking control signal of a specific wireless communication terminal (security policy violation terminal selected by the analysis of the WiPS server) transmitted from the WIPS server, and the access blocking control signal is transmitted from the WIPS server. It is received through the communication unit.

제3단계:MAC 주소 할당단계(S30)Step 3: assigning the MAC address (S30)

The WIPS sensor extracts the MAC address of the specific wireless communication terminal from the information collected in the first step (extracted from the information storage unit of the WIPS sensor) and assigns it to its MAC address. It is done in the converter. That is, the MAC address of the WIPS sensor is set to be the same as the MAC address of the specific wireless communication terminal through this step.

제4단계:신규 연결 요청단계(S40)Step 4: New connection request step (S40)

The WIPS sensor requests a new connection to the AP connected to the specific wireless communication terminal. This step is performed at the AP connection part of the WIPS sensor.

제5단계:신규 연결 요청 수신단계(S50)Step 5: receiving a new connection request step (S50)

In this step, the AP requesting a new connection is regarded as requesting a new connection from the specific wireless communication terminal. In this step, the AP determines that a new connection is requested from the specific wireless communication terminal. It is not a specific wireless communication terminal, but a WIPS sensor).

제6단계:신규 연결 및 단말 차단단계(S60)Step 6: New connection and terminal blocking step (S60)

Upon request for a new connection, the AP establishes a connection with the WIPS sensor. At this stage, the AP generates and shares a new key with the newly connected WIPS sensor according to the 802.11w environment, and the SA (Security Association) between the WIPS sensor and the AP is formed and connected, and at the same time, with the specific wireless communication terminal that is already connected. The SA is disconnected, thereby disconnecting the network of a specific wireless communication terminal.

As described above, the WIPS sensor and the terminal blocking method using the same according to the present invention, the reliability of the security is increased by implementing the network access blocking for the terminal in violation of the security policy even in 802.11w environment.

As mentioned above, although the present invention has been described by way of limited embodiments and drawings, the technical idea of the present invention is not limited thereto, and a person having ordinary skill in the art to which the present invention pertains, Various modifications and variations may be made without departing from the scope of the appended claims.

Claims

WIPS (Wireless Intrusion Prevention System) sensor that monitors the traffic of wireless communication terminals connected to APs.

When receiving an access blocking control signal for a specific wireless communication terminal connected to an AP from a WIPS server, the WIPS sensor changes the MAC address of the specific wireless communication terminal to its own MAC address and requests a new connection to the AP. Characterized by

WIPS sensor.
The method of claim 1,

The WIPS sensor,

A monitoring unit collecting traffic between a wireless communication terminal connected to the AP and BSSID (Basic Service Set Identifier) and MAC address information of the AP and the wireless communication terminal;

An information storage unit for storing BSSID and MAC address information of the AP and the wireless communication terminal collected by the monitoring unit;

A communication unit which communicates with a WIPS server and receives an access blocking control signal for a specific wireless communication terminal from the WIPS server;

A MAC address conversion unit for allocating the access blocking control signal to its own MAC address by referring to the MAC address of a specific wireless communication terminal stored in the information storage unit; And

An AP access unit requesting a new connection to a corresponding AP accessing a specific wireless communication terminal using the MAC address converted by the MAC address conversion unit; Characterized in that it comprises

WIPS sensor.
A first step in which a WIPS sensor monitors traffic of a wireless communication terminal connected to an access point (AP) and collects basic service set identifier (BSSID) and MAC address information of the AP and the wireless communication terminal;

A second step of receiving, by the WIPS sensor, an access blocking control signal of a specific wireless communication terminal transmitted from a WIPS server;

A third step of the WIPS sensor extracting the MAC address of the specific wireless communication terminal from the information collected in the first step and assigning the MAC address to its own MAC address; And

A fourth step of requesting, by a WIPS sensor, a new connection to an AP connected to the specific wireless communication terminal; Characterized in that it comprises

Terminal blocking method using WIPS sensor.
The method of claim 3,

After the fourth step,

A fifth step of the AP requesting a new connection to be regarded as requesting a new connection from the specific wireless communication terminal; And

A sixth step in which the AP is interconnected by assigning a new key to the WIPS sensor; Characterized in that it further comprises

Terminal blocking method using WIPS sensor.