WO2021206156A1

WO2021206156A1 - Wireless network security diagnosing system, security diagnosing server, and program

Info

Publication number: WO2021206156A1
Application number: PCT/JP2021/014962
Authority: WO
Inventors: 洋一雪野
Original assignee: 株式会社スプラインネットワーク
Priority date: 2020-04-10
Filing date: 2021-04-08
Publication date: 2021-10-14
Also published as: JPWO2021206156A1; KR102562758B1; KR20230010630A; JP7045124B2

Abstract

[Problem] To provide a system capable of easily performing a security diagnosis on a wireless network. [Solution] The present invention provides a wireless network security diagnosing system comprising: a wireless signal search sensor for searching for a wireless signal and collecting equipment information including information about a terminal that is the transmission source of the wireless signal and information about a sub-terminal connected to the terminal; a manager server for receiving the collected equipment information from one or more of the wireless signal search sensors; and a security diagnosing server which, on the basis of the equipment information collected by the wireless signal search sensors, diagnoses security of a wireless network in which the wireless signal search sensors exist, and generates a security report.

Description

Wireless network security diagnostic system, security diagnostic server, and program

The present invention relates to a wireless network security diagnostic system, a security diagnostic server, and a program for diagnosing vulnerabilities in wireless networks such as Wi-Fi networks and wireless LAN environments.

In recent years, wireless networks, especially Wi-Fi, have rapidly become widespread, and Wi-Fi environments that anyone can freely use even in public places have come to be provided.

However, the wireless network has a problem that it is not easy to know whether or not the wireless network has vulnerabilities, such as whether or not an unauthorized terminal is connected or whether or not a spoofed terminal is connected.

In addition, when a company or business office provides a wireless network, if an unauthorized terminal is connected to the wireless network, there is a risk of information leakage, but the devices that can connect to the wireless network are becoming smaller year by year. However, there is a problem that even if the presence or absence of an unauthorized terminal is visually checked, it cannot be easily found.

In Patent Document 1, in order to detect a vulnerability in a certain network system existing in an in-house or business office, a small network system connected to each other in the network system is further divided into zones, and each zone is divided into zones. Security that collects zone information such as equipment, network information, and importance that make up a zone, encodes it, and then acquires vulnerability information to analyze the risk of each zone. The system is disclosed.

JP-A-2019-159877

However, in the technology of Patent Document 1, since a certain in-house network system is targeted and the security system also exists in the same network system, it is necessary to encode the network system and divide the network system into zones. In addition, complicated pre-settings were required, such as the need to register individual devices. In addition, there is a problem that even if an access point is installed without permission in the workplace for the purpose of information leakage or the like, it cannot be detected.

Therefore, in the present invention, a wireless signal detection sensor capable of detecting a wireless signal is installed at a place where a security diagnosis is desired, device information of an authorized access point and terminal information such as a computer are registered, and the detection sensor collects the information. We provide a wireless network security diagnosis system that can easily perform security diagnosis by configuring the device information and terminal information to be transmitted to the manager server via a network dedicated to the wireless signal detection sensor.

In the present invention, one or more wireless signal detection sensors that detect a wireless signal and collect device information having terminal information of the source of the wireless signal and sub-terminal information connected to the terminal. Based on the manager server that receives the collected device information from the wireless signal detection sensor and the device information collected by the wireless signal detection sensor, the security in the wireless network where the wireless signal detection sensor exists is diagnosed and a security report is issued. A wireless network security diagnostic system having a security diagnostic server to be generated can be provided.

Further, in a wireless network security diagnostic system, the wireless signal detection sensor is a sensor unit that detects a wireless signal, and a device ID, signal strength, and detection time for uniquely identifying the terminal that is the source of the detected wireless signal. The manager server has a device information storage unit that stores the device information as device information in association with the sub-terminal information connected to the source terminal, and a communication unit that transmits the device information to the manager server. , The device information received from each wireless signal detection sensor is stored in association with the wireless signal detection sensor, and when a transmission request is received from the security diagnosis server, the device information of the wireless signal detection sensor within a predetermined period corresponding to the request is transmitted. However, the security diagnostic server includes a security analysis unit that performs security analysis of the wireless network based on device information within a predetermined period collected by the wireless signal detection sensor, and a report generation unit that generates a security report based on the security analysis. It is possible to provide a wireless network security diagnostic system having a report notification unit for notifying report generation.

Further, in the wireless network security diagnostic system according to the present invention, the wireless signal detection sensor is a licensed terminal information storage unit that stores the licensed terminal information of the licensed access point and the connected terminal, and a device detected by the sensor unit. If the information is not included in the authorized terminal information stored in the authorized terminal information storage unit, or if multiple identical authorized terminal information is included, there is a log generator that generates log information as the connection log of the unauthorized terminal. Then, the communication unit sends the log information generated by the log generation unit to the manager server, the manager server sends the log information when it receives a request from the security diagnosis server, and the security analysis department sends the log information. Analyze the security risk of the wireless network based on the received log information and device information.

Further, the wireless signal detection sensor may further have a communication blocking unit that blocks wireless communication when an unauthorized terminal is detected.

Furthermore, the security analysis unit of the security diagnostic server refers to the risk level corresponding to the received log information, and analyzes the security risk of the wireless network based on the risk level and the number of logs.

Further, the security diagnostic server requests the manager server for device information detected by a predetermined wireless signal detection sensor at regular intervals, and when the manager server receives the request from the security diagnostic server, the requested wireless signal detection sensor When the device information is requested to, and the predetermined wireless signal detection sensor transmits the device information, the security analysis unit of the security diagnostic server determines whether the terminal of the received device information is an authorized access point and is authorized. Based on the signal strength received by the wireless signal detection sensor and the duration of the detection time, it is diagnosed that there is an unauthorized access point for device information other than the access point, and the report generator determines that there is an unauthorized access point. Provides a wireless network security diagnostic system that produces reports notifying you.

Further, the security diagnostic server according to the present invention is a device that receives device information having terminal information of the source of the detected wireless signal collected by a predetermined wireless signal detection sensor and sub-terminal information connected to the terminal. An information receiving unit, a security analysis unit that performs security analysis of a wireless network based on device information within a predetermined period collected by a wireless signal detection sensor, a report generation unit that generates a security report based on the security analysis, and a report generation unit. A security diagnosis server having a report notification unit for notifying is provided.

Further, the device information receiving unit further receives log information which is a connection log of an unauthorized terminal, and the security analysis unit analyzes the security risk of the wireless network based on the received log information and the device information.

In addition, the security analysis department refers to the risk level corresponding to the received log information, and analyzes the security risk of the wireless network based on the risk level and the number of logs.

Further, the device information receiving unit receives the device information at regular intervals, and the security analysis unit determines whether the device of the received device information is an authorized access point, and the device information other than the authorized access point. Based on the signal strength received by the wireless signal detection sensor and the duration of the detection time, it is diagnosed that there is an unauthorized access point, and the report generator generates a report notifying that there is an unauthorized access point. May be good.

Further, the computer program that functions the computer as the security diagnostic server according to the present invention obtains the terminal information of the source of the detected wireless signal collected by the predetermined wireless signal detection sensor and the sub-terminal information connected to the terminal. A computer program that receives the device information it has, performs a security analysis of the wireless network based on the device information within a predetermined period collected by the wireless signal detection sensor, generates a security report based on the security analysis, and sends a report generation notification. I will provide a.

According to the present invention, the wireless signal detection sensor collects wireless signal information within a predetermined radius and transmits the collected device information and the generated log information without using the wireless network to be diagnosed. Security diagnosis can be easily performed by simply placing the wireless signal detection sensor in the desired location. In addition, the position of an unauthorized terminal can be estimated by installing a plurality of wireless signal detection sensors so that their reception ranges overlap each other.

Further, according to the present invention, since the unauthorized terminal is detected based on the signal strength and the duration of signal reception, the unauthorized terminal can be detected even when the authorized terminal is not registered in advance.

FIG. 1 is a diagram showing an example of a wireless network security diagnostic system according to the present invention. FIG. 2 is a diagram showing an example of a functional block diagram of the wireless signal detection sensor 10. FIG. 3 is a diagram showing an example of a functional block of the manager server 20. FIG. 4 is a diagram showing an example of a functional block diagram of the security diagnosis server 30. FIG. 5 is an example of a database stored in the device information storage unit 120 of the wireless signal detection sensor 10. FIG. 6 is an example of a database stored in the licensed terminal information storage unit 130 of the wireless signal detection sensor 10. FIG. 7 is a flowchart illustrating an example of log generation processing in the wireless signal detection sensor 10. FIG. 8 is an example of the log generation conditions stored in the log generation unit 140. FIG. 9 is an example of a flowchart when the security analysis unit 310 of the security diagnosis server 30 diagnoses the presence or absence of an unauthorized access point. FIG. 10 is a diagram for explaining a communication cutoff process when the wireless signal detection sensor 10 is connected to an unauthorized terminal. FIG. 11 is an example of a database stored in the data storage unit 350. FIG. 12 is an example of a flowchart when the security analysis unit 310 analyzes the security risk at the installation location of the wireless signal detection sensor 10. It is a figure which shows an example of the security report generated by the report generation part 320. It is a block diagram which shows an example of the hardware block diagram of the security diagnostic server 30 in this invention. This is an example of a functional block diagram of the manager server 20 according to the second embodiment of the present invention. This is an example of a database configuration stored in the device classification information storage unit 240 according to the second embodiment of the present invention.

Hereinafter, a mode for carrying out the present invention will be described with reference to the drawings. In the present specification and drawings, components having substantially the same function and configuration are designated by the same reference numerals, and duplicate description will be omitted.

FIG. 1 is a diagram showing an example of a wireless network security diagnostic system according to the present invention. The wireless network security diagnostic system shown in FIG. 1 includes one or a plurality of wireless signal detection sensors 10, a manager server 20, and a security diagnostic server 30.

The wireless signal detection sensor 10 is a sensor that detects a wireless signal and collects terminal information of the source of the wireless signal and terminal information connected to the device. When a wireless signal of a compliant standard is transmitted within a range that can be detected by the wireless signal detection sensor 10 (for example, a radius of 25 meters) that conforms to a predetermined wireless network standard such as Wi-Fi. It detects it and collects device information having the terminal information of the source terminal and the sub terminal information connected to the terminal. As the source terminal, for example, an access point for realizing wireless communication or a communication terminal that transmits a wireless signal to search for an access point destination and is not yet connected to any access point, for example. , Mobile terminals such as smartphones and computers. Also, if a communication terminal such as a smartphone has the tethering function turned on, it is included in the access point. Further, the information of the communication terminal connected to the access point is also collected as the sub terminal information in association with the terminal information of the access point.

Further, the wireless signal detection sensor 10 stores in advance terminal information that is permitted to transmit a wireless signal, such as a wireless access point that is permitted to be installed at that location, as authorized terminal information. The terminal information is, for example, information on an access point for realizing wireless communication and a communication terminal connected to the access point, for example, a mobile terminal such as a smartphone or a computer. When the source information of the radio signal collected by the wireless signal detection sensor 10 and the stored authorized terminal information are referred to, and the collected device information is not included in the stored authorized terminal device information, or When a plurality of the same authorized terminal information is included, log information may be generated as a connection log of an unauthorized terminal and transmitted to the manager server 20. Further, the wireless signal detection sensor 10 stores the log generation condition which is a condition for detecting the existence of an unauthorized terminal, and when the terminal information matching the log generation condition is detected, even if the log information is generated. good.

The wireless signal detection sensor 10 associates the device ID, signal strength, and detection time of the terminal as the detected terminal information with the device ID of the sub terminal connected to the source terminal as device information. Remember.

Further, the wireless signal detection sensor 10 stores an access point and a connected terminal that are authorized to transmit a wireless signal or wirelessly connect within the detected range as authorized terminal information, and is not included in the authorized terminal information. When the device information of is detected, the log information is generated as the connection log of the unauthorized terminal. The generated log information is transmitted to the manager server 20.

Further, when the wireless signal detection sensor 10 detects an unauthorized terminal, the wireless signal detection sensor 10 transmits a communication disconnection message for blocking the wireless communication to both the illegally connected terminal and the access point in order to block the wireless communication. Forcibly cut off communication. The wireless signal detection sensor 10 stores not only the authorized terminal but also the device information of the fraudulent terminal, and when it detects a terminal that matches the stored fraudulent terminal device information, it cuts off wireless communication as a fraudulent terminal. May be good.

The wireless signal detection sensor 10 connects to the manager server 20 by its own access point instead of the network of the wireless signal being detected, and transmits the device information and log information collected based on the request from the manager server 20. ..

A plurality of wireless signal detection sensors 10 may be installed in the same network system, or only one may be installed. The number of wireless signal detection sensors 10 to be installed can be appropriately determined by comparing the range that can be detected by the wireless signal detection sensor 10 with the range for which security diagnosis is desired in the network system.

The manager server 20 is a server that receives and stores device information and log information collected by the wireless signal detection sensors 10 from a plurality of wireless signal detection sensors 10. When the manager server 20 receives the transmission request of the information identifying the wireless signal detection sensor 10 and the device information and the log information from the security diagnosis server 30, the manager server 20 makes a transmission request of the device information to the specified wireless signal detection sensor 10 and wirelessly. The information received from the signal detection sensor 10 is stored, and the log information received each time is transmitted to the security diagnosis server 30.

The manager server 20 stores the device information received from the wireless signal detection sensor 10 in association with the identification information for uniquely identifying the wireless signal detection sensor 10. Further, the manager server 20 does not classify the device information of the authorized terminal or the unauthorized terminal, the authorized terminal, or the unauthorized terminal according to the wireless signal detection sensor 10 or the customer based on the device information received in the past. Device classification information such as unconfirmed terminals may be stored. Access the device classification information of the manager server 20, classify unconfirmed terminals as authorized terminals or unauthorized terminals, and register and update them. Further, when the stored device classification information is updated, the manager server appropriately transmits the stored device classification information to the corresponding wireless signal detection sensor 10, and updates the information of the authorized terminal or unauthorized terminal stored in the wireless signal detection sensor 10. You may.

The security diagnosis server 30 receives the device information and log information collected by each wireless signal detection sensor 10 from the manager server 20, diagnoses the security in the wireless network in the place where the wireless signal detection sensor 10 exists, and reports the security. To generate. It also notifies the generated security report. Security reports are generated, for example, daily or monthly.

The security diagnosis server 30 analyzes the security risk of the wireless network at that location based on the received log information and device information. Specifically, the risk level corresponding to the log information is referred to, and the security risk of the wireless network at that location is analyzed based on the risk level and the number of logs.

Further, the security diagnosis server 30 requests the device information of the predetermined wireless signal detection sensor 10 from the manager server 20 at regular intervals, and when the device information is received via the manager server 20, the device of the received device information is authorized. It is determined whether or not the access point is authorized, and if it is device information other than the authorized access point, the signal strength of the wireless signal emitted by the device received by the wireless signal detection sensor 10 and the signal are detected. It measures the duration of the operation, and if it continues for a predetermined time or longer, it diagnoses that there is an unauthorized access point and notifies the existence of the unauthorized access point.

Further, when the security diagnosis server 30 detects the same unauthorized terminal in the plurality of wireless signal detection sensors 10 when the plurality of wireless signal detection sensors 10 are installed close to each other, each wireless signal detection sensor 30 The location of the fraudulent terminal is estimated based on the signal strength of the radio signal received by 10.

FIG. 2 is a diagram showing an example of a functional block diagram of the wireless signal detection sensor 10. The wireless signal detection sensor 10 includes a sensor unit 110, a device information storage unit 120, an authorized terminal information storage unit 130, a log generation unit 140, a communication blocking unit 150, and a communication unit 160.

The sensor unit 110 constantly detects and receives a wireless signal conforming to a predetermined wireless communication standard, for example, a Wi-Fi signal with a predetermined radius. The sensor unit 110 receives the wireless signal and collects the terminal information of the source and the sub-terminal information connected to the terminal as device information. The terminal of the source of the wireless signal is, for example, a mobile terminal such as a smartphone that transmits a wireless signal in order to search for an access point or an access point of a wireless network, or a computer having a wireless communication function. Further, the sub-terminal information is information on a mobile terminal or a computer that is wirelessly connected using an access point. The sensor unit 110 collects, for example, a MAC address that can uniquely identify the terminal or the sub terminal as the terminal information and the sub terminal information, and stores the device information in the device information storage unit 120.

The device information storage unit 120 stores the device information collected by the sensor unit 110. The device information is the terminal information of the source of the wireless signal collected and received by the sensor unit and the sub-terminal information connected to the terminal. For example, MAC address, SSID, signal strength, etc. are collected as terminal information, and the MAC address of the sub terminal and the connection time to the terminal are stored in association with the MAC address of the connected terminal as sub terminal information. At this time, a display for distinguishing between a terminal or access point connected for a short time such as a connection time of less than 10 minutes and the other may be attached and stored.

The device information stored in the device information storage unit 120 is transmitted to the manager server 20 in response to a transmission request from the manager server 20. At this time, in order to secure the storage capacity, the device information transmitted to the manager server 20 may be configured to be deleted from the device information storage unit 120.

The authorized terminal information storage unit 130 stores the authorized terminal information of the authorized access point and the connected terminal. For example, the licensed terminal information storage unit 130 provides information on an access point that is permitted to transmit a wireless signal at a place where the wireless signal detection sensor 10 is installed, and a computer or communication terminal that is permitted to be installed. It is stored as the information of the authorized terminal. As the authorized terminal information, for example, the MAC address of the authorized terminal is stored. Further, the authorization terminal information storage unit 130 may store the information of the unauthorized terminal. It stores device information that is not permitted to transmit wireless signals from the SSID or MAC address at the location where the wireless signal detection sensor 10 is installed.

When the device information detected by the sensor unit 110 is not included in the authorized terminal information stored in the authorized terminal information storage unit 130, or when a plurality of the same authorized terminal information is included, the log generation unit 140 of the unauthorized terminal Generate log information as a connection log. The log information generated by the log generation unit 140 is transmitted from the communication unit 160 to the manager server. Matching log generation conditions may be sent as log information. At this time, the generated log information may be transmitted together with the risk level corresponding to the matching log generation conditions.

For example, the log generation unit 140 stores the log generation condition, compares the device information detected by the sensor unit 110 with the authorization terminal information stored in the authorization terminal information storage unit 130, and matches the log generation condition. In some cases, log information may be generated. As an example, as a log generation condition, for example, if the MAC address of the device information detected by the sensor unit 110 is different from any of the MAC addresses of the authorized terminal stored in the authorized terminal information storage unit 130, the unauthorized terminal The log generation condition that the log information is generated assuming that the log information exists is stored, and the log generation unit 140 may generate the log by referring to the log generation condition.

The log generation unit 140 may store, for example, a risk item and a risk degree together as a log generation condition. For example, the risk item of the existence of an unauthorized terminal has a risk level of "medium", and the risk item of an unidentified terminal connecting to an authorized access point has a risk level of "high". The log generation conditions are not limited to these, and various conditions such as when the authorized terminal stored in the authorized terminal information storage unit 130 is connected to an unauthorized access point not stored in the authorized terminal information storage unit 130 can be used. It may be set.

When the communication blocking unit 150 detects an unauthorized terminal, it blocks wireless communication between the unauthorized terminal and another terminal. For example, when an unauthorized terminal that is not stored in the authorized terminal information storage unit 130 is connected to an authorized access point whose MAC address is stored in the authorized terminal information storage unit 130, the communication blocking unit 150 uses the authorized access point. By sending a forced disconnection message to both the and unauthorized terminals, the security risk is reduced by blocking communication with each other.

When the log generation unit 140 generates a log as a connection log of an unauthorized terminal, the communication blocking unit 150 may be configured to block the communication that is the target of the log, and a predetermined time elapses after the log is generated. However, it may be configured to cut off the communication when the connection is continued. Further, the communication blocking process by the communication blocking unit 150 may be configured to perform the communication blocking process only when, for example, log information having a high risk level is generated, and when the log information is generated, all the communication blocking processing may be performed. It may be configured to perform communication blocking processing for an unauthorized connection.
Further, the communication blocking unit 150 is configured to block the communication when the authorized terminal information storage unit 130 stores the information of the unauthorized terminal and a terminal matching the information of the unauthorized terminal is detected. You may.

The communication unit 160 communicates with the manager server 20. When the manager server requests transmission of the device information generated by the sensor unit 110, the device information is transmitted to the manager server, and when the log generation unit 140 generates a log, the log information is appropriately managed. Send to the server. In addition, the communication blocking unit 150 transmits a blocking message when the communication between two terminals that are performing illegal communication is forcibly blocked.

FIG. 3 is a diagram showing an example of a functional block of the manager server 20. It has a wireless signal detection sensor information storage unit 210, a control unit 220, and a communication unit 230. The wireless signal detection sensor information storage unit 210 stores the device information received by the manager server 20 from the plurality of wireless signal detection sensors 10 in association with the information of the wireless signal detection sensor. When the log information is received from the wireless signal detection sensor 10, the log information is also stored in association with the information of the wireless signal detection sensor in the wireless signal detection sensor information storage unit 210.

The control unit 220 stores the device information or reads the stored information in the wireless signal detection sensor information storage unit 210, controls the data transmission / reception request, and controls the communication by the communication unit 230.

When the communication unit 230 receives the device information or the log information from the wireless signal detection sensor 10 and receives the data transmission request from the security diagnosis server 30, the communication unit 230 transmits the data. When the communication unit 230 receives log information from the wireless signal detection sensor 10 at any time and receives a data transmission request for designating a predetermined wireless signal detection sensor 10 from the security diagnosis server 30, the communication unit 230 receives the wireless signal detection sensor 10. When a device information transmission request is made to and the device information is received, the log information stored in the wireless signal detection sensor information storage unit 210 and the received device information may be transmitted to the security diagnosis server 30. good.

FIG. 4 is a diagram showing an example of a functional block diagram of the security diagnosis server 30. The security diagnosis server 30 includes a security analysis unit 310, a report generation unit 320, a report notification unit 330, and a device information receiving unit 340.

The security analysis unit 310 performs security analysis of the wireless network based on the device information within a predetermined period collected by the wireless signal detection sensor 10. Specifically, the security risk of the wireless network is analyzed based on the received log information and device information. The security analysis unit 310 refers to the risk level corresponding to the log information received from the radio signal detection sensor 10, and based on the risk level and the number of logs, the radio is based on the evaluation table stored in the data storage unit 350. The security risk of the wireless network at the place where the signal detection sensor 10 is placed is analyzed.

When three or more wireless signal detection sensors 10 are installed in close proximity to each other, the security analysis unit 310 may identify the location of an unauthorized terminal based on the device information collected by these wireless signal detection sensors 10. For example, when a plurality of wireless signal detection sensors 10 are installed in close proximity to each other, the plurality of wireless signal detection sensors 10 may collect device information of the same unauthorized terminal. In this case, the security analysis unit 310 estimates the location of the fraudulent terminal based on the signal strength of the fraudulent terminal received by each wireless signal detection sensor 10.

Further, the security analysis unit 310 requests device information from the manager server 20 to the predetermined radio signal detection sensor 10 at regular intervals, for example, every 5 minutes or 30 minutes, and the manager server 20 requests the device information from the manager server 20 to the predetermined radio signal detection sensor 10. When the device information collected by the server is received, it is determined whether the signal strength of the terminal of the received device information is equal to or higher than a predetermined value. When it is equal to or more than a predetermined value, for example, -70 dBm or more, it is determined that an unauthorized access point has been detected. Further, if the signal strength of the terminal of the received device information is equal to or higher than a predetermined value and the terminal is detected for the first time, it may be stored as an unconfirmed access point as an unauthorized access point, and may be stored for a predetermined time. As described above (for example, for 12 hours or more), when the same device information is continuously received, the information of the terminal is added to the always-installed list assuming that the access point is always installed. If the duration of signal reception is less than a predetermined time, the information of the terminal may be added to the temporary use list as an access point for temporary use. Here, device information for less than a predetermined time, for example, a detection duration of less than 10 minutes, is considered to be a passing access point such as Wi-Fi of a passing vehicle, and is deleted from the temporary use list or detected for a short time. May be displayed.

At this time, when the data storage unit 350 stores the authorized terminal information corresponding to the wireless signal detection sensor 10, the security analysis unit 310 determines whether or not a terminal having a signal strength of a predetermined value or more matches the authorized terminal information. It may be configured to do so. If the terminal is an authorized terminal, it is excluded from unconfirmed access points. The security analysis unit 310 determines whether or not the access point is authorized, and illegally uses device information other than the authorized access point based on the signal strength received by the wireless signal detection sensor 10 and the duration of the detection time. Diagnose that you have an access point. Further, when the data storage unit 350 stores the unauthorized terminal information as well as the authorized terminal information, the security analysis unit 310 may configure a terminal having device information that does not correspond to any of them as an unconfirmed access point. Further, the security analysis unit 310 requests device information at the timing of report generation, and whether the received device information is an authorized terminal stored in the authorized terminal information storage unit 130, an unauthorized terminal, or an unconfirmed terminal that is not stored. May be determined.

The report generation unit 320 generates a security report based on the security analysis of the security analysis unit 310. For example, the report generation unit 320 stores a predetermined report format, and inputs the security analysis, device information, and log information performed by the security analysis unit 310 into the predetermined report format by API (Application Programming Interface). Generate a security report with.

For example, the report generation unit 320 includes the security risk taken by the security analysis unit 310 in the report based on the device information and the log information collected by the radio signal detection sensor 10 corresponding to a certain customer within a predetermined period. At the same time as generating, the log information and the number of cases and the degree of risk are displayed, and a report is generated so that the device information corresponding to the log information is also displayed.

When the position estimation of the unauthorized terminal is performed, the report generation unit 320 includes the position estimation in the security report and generates it. In addition, when the security analysis unit 310 diagnoses an unauthorized access point based on the signal strength and the detection duration, when the unauthorized access point is detected for the first time, a report is generated on the existence of the unauthorized access point on a daily or monthly basis. conduct.

The report notification unit 330 notifies a predetermined terminal, e-mail address, etc. that the report has been generated. It should be noted that the notification that the report has been generated is not limited to this, and for example, a security report may be attached to an email to notify the notification.

The device information receiving unit 340 is targeted for creating a security report on the manager server 20 at a predetermined timing such as monthly, daily, etc., which is determined on the first day of each month. Requests transmission of device information of one or more wireless signal detection sensors 10 corresponding to the customer, and receives device information and log information from the manager server 20.

The data storage unit 350 stores customer data and evaluation tables. As customer data, for example, a customer ID and a contact email address, an ID of a wireless signal detection sensor 10 installed at the customer destination, information on an authorized access point, and the like are stored. It also stores an evaluation table for evaluating security risks. For example, when there is one log with a high risk level, a risk assessment table according to the security risk such as security risk "D" (extremely high) and the risk level associated with the log contents is stored. Further, regarding the unauthorized access points diagnosed by the security analysis unit 310 based on the signal strength and the duration, a list of unconfirmed access points, a list of access points recognized as temporary use, a list of access points installed at all times, and the like are stored.

FIG. 5 is an example of a database stored in the device information storage unit 120 of the wireless signal detection sensor 10. The device information storage unit 120 stores the device information collected by the sensor unit 110, and stores the device information of the terminal, that is, the device information of the access point, the tethering device, and the terminal transmitting the wireless signal. Corresponds to the terminal and stores the device information of the sub terminal that is connected to the terminal by communication.

In this example, the SSID, encryption method, authentication method, protocol, signal strength, etc. of the terminal are stored in association with the MAC address of the terminal. For example, the SSID, which is the identification name of the access point in the wireless LAN, is stored. Further, as the encryption method, the encryption method used by the terminal, such as AES or WEP, is stored. As the authentication, the authentication method used by the terminal, such as WPA2-PSK and WEP, is stored. As a protocol, the wireless LAN standard supported by the terminal is stored. For example, when it corresponds to the Wi-Fi communication standards IEEE802.11b, 802.11g, and 802.11n, it is stored as "b / g / n". In addition, the signal strength of the radio signal transmitted by the terminal received by the radio signal detection sensor 10 is stored. For example, -46 dBm. Further, the detection start time, the end time, and the detected time may be stored.

As the device information of the sub terminal connected to the terminal, the SSID of the connection destination terminal, the MAC address of the sub terminal, and the connection time are stored in association with the MAC address of the connection destination terminal. The connection time stores the time when the sub terminal starts connecting to the terminal and the end time. As the connection time, the connection start time and the connected period (for example, 10 hours and 4 minutes) may be stored.

FIG. 6 is an example of a database stored in the authorized terminal information storage unit 130 of the wireless signal detection sensor 10. The licensed terminal information storage unit 130 is a communication terminal such as an access point that is permitted to transmit a wireless signal or a computer that is permitted to wirelessly connect at a place where the wireless signal detection sensor 10 is installed. Is stored here in advance. Information for identifying the licensed terminal is stored in the licensed terminal information storage unit 130, and for example, the MAC address of the licensed terminal is stored. Not limited to this, any information that can uniquely identify the authorized terminal may be used, and information other than the MAC address, the name and SSID of the terminal, the manufacturer, and the like may also be stored. In addition, the unauthorized terminal information may be stored at the same time. In that case, the types of the unauthorized terminal and the authorized terminal may be stored together so that the unauthorized terminal and the authorized terminal can be distinguished from each other. By storing the unauthorized terminal, the communication can be cut off immediately.

FIG. 7 is a flowchart illustrating an example of log generation processing in the wireless signal detection sensor 10. First, the sensor unit 110 of the wireless signal detection sensor 10 detects the wireless signal (step S701).

Next, the sensor unit 110 stores the terminal information of the source of the wireless signal and the sub-terminal information connected to the terminal (step S702). The sensor unit 110 collects information included in the detected wireless signal, and stores the terminal information of the source of the wireless signal and the sub-terminal information connected to the terminal in the device information storage unit 120.

Then, the log generation unit 140 compares the authorized terminal information with the collected device information (step S703). Based on the stored log generation conditions and the comparison result, the log generation unit 140 determines whether or not the terminal that transmits the detected wireless signal is an unauthorized terminal (step S704). The log generation unit 140 is not authorized when, for example, the MAC address included in the terminal information of the terminal that is the source of the detected wireless signal does not match any of the MAC addresses stored in the authorized terminal information storage unit 130. It is determined that the access point exists, that is, the malicious terminal exists. When a plurality of radio signals are detected, two terminal information having the same MAC address exist in the two terminals, and the MAC address is stored in the authorized terminal information storage unit 130, one terminal is a spoofing terminal. If the log generation condition is memorized, it is determined that the terminal is an unauthorized terminal.

When the terminal is an unauthorized terminal (yes), the log generation unit 140 generates and stores the log information (step S705). At this time, the generated log information may be configured to be transmitted to the manager server 20 at a predetermined timing. The predetermined timing may be, for example, a log generation time, a fixed time every day, or the like. The log information includes log generation conditions and device information of a terminal determined to be an unauthorized terminal.

If it is not an unauthorized terminal (no), the log generation unit 140 does not generate log information and ends the process as it is.

FIG. 8 is an example of the log generation conditions stored in the log generation unit 140. The log generation unit 140 compares the stored log generation conditions, the device information included in the radio signal received by the sensor unit, and the authorization terminal information stored in the authorization terminal information storage unit 130 to generate log information. Decide whether or not to do. As the log generation condition, here, the item which is the log generation condition and the risk degree thereof are stored in association with each other.

For example, "authorized AP external terminal connection", that is, the case where the connection of an unauthorized terminal is detected by the authorized AP (access point) is set as a log generation condition, and the risk level is stored as "high". .. In addition, the risk level is "medium", with "external AP authorized terminal connection", that is, the case where an external access point or a terminal registered in an access point not registered as an authorized terminal is connected as a sub terminal as a log generation condition. Is remembered.

For example, "guest AP authorized terminal connection", that is, a terminal registered as an authorized terminal is connected as a sub terminal to an access point that is not stored as an authorized terminal and is detected for a short period of time such as within 12 hours. The risk level is stored as "low" with the case of detection as a log generation condition.

Also, for example, "spoofing AP detection", that is, the case where the access point is detected as spoofing is set as a log generation condition, and the risk level is stored as "medium". Whether or not there is a spoofed access point is a log generation condition in which a terminal having a MAC address that is not stored in the authorized terminal information storage unit 130 as an authorized terminal uses the same SSID as the SSID of the authorized terminal.

When receiving device information that matches the log generation conditions, the log generation unit 140 may send the matched log generation conditions and the risk level to the manager server 20 as log information.

FIG. 9 is an example of a flowchart when the security analysis unit 310 of the security diagnosis server 30 diagnoses the presence or absence of an unauthorized access point. Since the wireless signal detection sensor 10 has an authorized terminal information storage unit 130 and stores log generation conditions, it is possible to detect an unauthorized terminal, but a place where installation of a wireless LAN access point is not permitted. In the case of, since the authorized terminal does not exist, the unauthorized terminal cannot be detected by comparing with the authorized terminal. In such a case, the security analysis unit 310 is effective in detecting an unauthorized access point based on the signal strength and the duration of signal detection.

The security analysis unit 310 requests the manager server 20 to transmit device information at predetermined intervals (step S901). The predetermined interval is, for example, every 30 minutes or every hour. In the device information transmission request, the transmission request is made by designating the information for specifying the required wireless signal detection sensor 10 and the period (date and time when the device information is collected). Normally, the device information transmission request is made last time, and the subsequent device information transmission request is made. At the time of generating the report, the security analysis unit 310 may request the transmission of the device information stored at that time.

The security analysis unit 310 determines whether or not the device information of the desired wireless signal detection sensor 10 has been received (step S902). If it is not received (No), the reception determination is continuously performed, and if the device information is received (Yes), it is determined whether or not the received device information includes information having a signal strength equal to or higher than a predetermined value (step S903). ). For example, only terminals having a signal of −70 dBm or more are targeted, and information on other terminals is ignored. This is because there is a high possibility that a terminal having a signal strength lower than a predetermined value does not exist in the place targeted for security diagnosis. The signal strength threshold value may be appropriately changed depending on the location targeted for security diagnosis. If the signal strength included in the device information is less than a predetermined value (No), it is ignored and the process ends.

When the signal strength is equal to or higher than a predetermined value (Yes), the security analysis unit 310 determines whether or not the terminal is an authorized terminal (step S904). It is determined whether or not the terminal is an authorized terminal by comparing the MAC address of the authorized terminal stored in the data storage unit 350 with the received device information. As a result of the determination, if the received device information is an authorized terminal (Yes), the process ends. At this time, for example, a "white list" may be created assuming that the authorized terminal has been received and stored in the data storage unit 350.

If it is not an authorized terminal (No), then the security analysis unit 310 determines whether it is the first detected terminal (step S905). Specifically, the determination is made based on whether or not the terminal is in the unconfirmed AP list, the temporary use list, or the constantly installed list stored in the data storage unit 350. When it is the device information of the terminal received for the first time (Yes), it is determined as an unconfirmed AP among the unauthorized access points (step S908). The unconfirmed AP list is a list that stores the device information of the terminal detected for the first time.

If it is not the first detection (No), that is, if the terminal information is in the unconfirmed AP list, the temporary use list, or the always-installed list, the security analysis unit 310 next determines whether or not the terminal has been detected for a predetermined time or longer. (Step S906). The predetermined time is, for example, 12 hours or more, but is not limited to this. When the device information of the same terminal is received for a predetermined time or more (Yes), the security analysis unit 310 stores the device information of the terminal in the data storage unit 350 as a constant installation list (step S907). Here, when the temporary use list or the unconfirmed AP list is newly changed to the always-installed list and stored, the report notification unit 330 may be configured to notify the user.

If the detection is less than a predetermined time and the device information of the terminal that is continuously detected (No), the security analysis unit 310 stores the device information of the terminal in the temporary use list. If it is stored in the unconfirmed AP list, it is changed and stored in the temporary use list.

FIG. 10 is a diagram for explaining a communication cutoff process when the wireless signal detection sensor 10 is connected to an unauthorized terminal. When the log generation unit 140 of the wireless signal detection sensor 10 generates log information as the connection log of the unauthorized terminal, the communication blocking unit 150 blocks the unauthorized connection that is the target of the connection log. Further, when the authorized terminal information storage b130 of the wireless signal detection sensor 10 stores the information of the unauthorized terminal, the communication blocking unit 150 interrupts the communication when a terminal matching the information of the unauthorized terminal is detected. ..

Here, for example, a case where an authorized terminal is connected as a sub terminal to an illegally installed access point will be described. The communication blocking unit 150 of the wireless signal detection sensor 10 transmits a disconnection message to both the unauthorized access point and the authorized terminal connected to the unauthorized access point. Specifically, the MAC address of the authorized terminal is used as the source for the unauthorized access point, a forced disconnection message is sent to the unauthorized access point, and the MAC address of the unauthorized access point is used as the source for the authorized terminal. It is used to block communication by sending a forced disconnection message to the authorized terminal. The communication blocking unit 150 obtains the MAC address of each terminal from the device information collected by the sensor unit 110 of the wireless signal detection sensor 10, and forcibly sends a disconnection message to both parties in the form of disguising the MAC address. Disconnect the communication. When multiple authorized terminals are connected to the unauthorized access point, a forced disconnection message is sent to the plurality of authorized terminals using the MAC address of the unauthorized access point as the source.

FIG. 11 is an example of a database stored in the data storage unit 350. The data storage unit 350 stores customer data and an evaluation table. As customer data, for example, an ID that can uniquely identify the wireless signal detection sensor installed in the customer, an email address that sends a security report, log information generated by the wireless signal detection sensor, and an authorized terminal in association with the customer ID. Information, report frequency, presence / absence of position estimation, necessity of unconfirmed AP detection, etc. are stored.

The e-mail address is referred to when the report notification unit 330 notifies the report creation or sends the report. Further, the log information received from the manager server 20 may be configured to be stored in association with the wireless signal detection sensor 10. The authorized terminal information stores the MAC address of the terminal authorized to transmit a wireless signal or wirelessly connect at the customer's installation location. The report frequency stores the timing of generating a report, such as daily, the end of the month, and the time of log generation. The position estimation stores the necessity of estimating the position information of the unauthorized terminal based on the device information received by the plurality of wireless signal detection sensors 10 in the security analysis unit 310. In addition, the security analysis unit 310 stores the necessity of detecting an unconfirmed access point based on the signal strength and the connection duration.

The evaluation table is a table for determining the comprehensive evaluation of the wireless network at the place where the wireless signal detection sensor 10 is installed. The comprehensive evaluation is divided into A to D, where A is the safest and most normal state, D is the most dangerous state, and is in a state of being damaged in some way. Here, if even one log information with a high risk level is detected, it is stored as evaluation "D", and if no log information is received, it is stored as evaluation "A" as no detection. The security analysis unit 310 determines the comprehensive evaluation with reference to the evaluation table stored in the data storage unit 350.

FIG. 12 is a flowchart of a flow chart in which when the security analysis unit 310 creates a security report, the security risk at the installation location of the radio signal detection sensor 10 is analyzed with reference to the evaluation table stored in the data storage unit 350. This is an example.

The security analysis unit 310 refers to the log information received from the wireless signal detection sensor 10 for which the security report is created (step S1201). The security analysis unit 310 requests and receives the device information and log information for a predetermined period for which the report of the radio signal detection sensor 10 corresponding to the customer ID stored in the data storage unit 350 is to be created from the manager server 20. Refer to the log information. The log information is stored in the data storage unit 350.

The security analysis unit 310 determines whether or not the received log information includes log information with a high risk level (step S1202). When there is log information with a high risk level (Yes), the overall evaluation is set to “evaluation D” by referring to the evaluation table stored in the data storage unit 350 (step S1204). If there is no log information with a high risk level (No), then it is determined whether or not there is log information with a medium risk level (step S1203). If there is log information with a risk level of "medium" (Yes), the evaluation table is referred to and the overall evaluation is set to "evaluation C" (step S1205). If there is no log information with a risk level of "medium" (No), then it is determined whether or not there is log information with a risk level of "low" (step S1206). If there is log information with a low risk level (Yes), the evaluation table is referred to and the overall evaluation is set to “Evaluation B” (step S1207). If there is no log information with a risk level of "low" (No), it means that there is no log information, and the security analysis unit 310 sets the overall evaluation to "evaluation A" (step S1208) and ends the process. .. Here, if there is even one log with a high risk level, the evaluation is lowered, but it is not limited to this, and the score system is based on each risk level and the number of cases, and the risk level is calculated by the total of the points. You may decide.

FIG. 13 is a diagram showing an example of a security report generated by the report generation unit 320. This example is a security report generated by the report generation unit 320, which is the result of analysis by the security analysis unit 310 based on the device information and log information collected by the wireless signal detection sensor 10 for one month for the wireless network at a certain location. be.

In this security report, the comprehensive evaluation determined by the security analysis unit 310 based on the risk level of the log information is described as the evaluation result, and the log information generated during that period is described together with the number of cases by log type, and detailed information is provided. Describe the device information corresponding to the log information as. When the security analysis unit 310 detects an unconfirmed access point based on the signal strength and detection duration, the MAC address, signal strength, and detection period of the detected unconfirmed access point list, temporary use list, and always-installed list are displayed. It may be described. Further, when the position of the unauthorized terminal is estimated, the result of the position estimation may be described.

FIG. 14 is a block diagram showing an example of a hardware configuration diagram of the security diagnostic server 30 in the present invention. The hardware configuration of the security diagnostic server 30, which is a computer device shown in FIG. 14, can be realized mainly by a computer device. The security diagnosis server 30 performs a security diagnosis by executing a security diagnosis program.

As shown in FIG. 14, the computer forming the security diagnosis server 30 includes a CPU 1, a communication interface 2, a ROM 3, a RAM 4, a hard disk drive 5, an input / output interface 6, a display unit 7 connected to the input / output interface 6, and a pointing device. 8 and a keyboard 9 are connected to a bus.

When a series of processes are executed by a program, for example, the security analysis unit 310, the report generation unit 320, the report notification unit 330, and the device information reception unit 340 are stored in the ROM 3 or the hard disk drive 5 as a security diagnosis program, and the CPU 1 By executing with, various functions are executed. It should be noted that the installation by connecting an external storage device such as a USB memory in which the security diagnosis program is stored to the input / output interface 6, the security diagnosis program installed from the network to the computer, and the state of being pre-installed in the device body. For example, it may be configured by a ROM 13 or the like in which a security diagnosis program is recorded. Further, by executing the security diagnosis program, a part of the area of the hard disk drive 5 functions as the data storage unit 350.

In addition, although the example of configuring with one computer has been described here, the present invention is not limited to this, and may be configured with a plurality of computers, and of course, it may be configured by distributed computing, cloud computing, or the like. Is.

Further, in this specification, the manager server 20 and the security diagnosis server 30 are described as separate server devices, but the manager server and the security diagnosis server may be configured as one server. Further, in this embodiment, the security diagnosis server 30 deletes the device information only for short-time detection from the device information detected by each wireless signal detection sensor 10 and displays that the time is short. The signal detection sensor 10 may perform this.

Next, the second embodiment of the present invention will be described. The description of the same contents as that of the first embodiment will be omitted. The manager server 20 of the wireless network security diagnostic system according to the second embodiment has a device classification information storage unit 240 that classifies and stores device information for each wireless signal detection sensor 10 or for each customer. One or more wireless signal detection sensors 10 are installed at a place where security diagnosis is desired, and the detected device information and log information matching the log generation conditions stored in advance are transmitted to the manager server 20 in a timely manner. The manager server 20 classifies the received device information into an authorized terminal, an unconfirmed terminal, and an unauthorized terminal whose communication should be blocked, and stores the received device information in the device classification information storage unit 240. Further, when the security diagnosis server 30 determines that the unconfirmed terminal is temporarily used or constantly installed, the security diagnosis server 320 transmits the determination result to the manager server, and the manager server 20 determines from the classification of the unconfirmed terminal. Change the classification to temporary use or permanent installation, and memorize it. Further, among the updated device classification information, the information of the licensed terminal and the unauthorized terminal is transmitted to the radio signal detection sensor 10 and updated and stored in the licensed terminal information storage unit 130.

The configuration of the wireless signal detection sensor 10 is the same as that of the first embodiment. However, in the present embodiment, the authorized terminal information storage unit 130 updates the information in the storage unit 130 by storing the information of the authorized terminal and the unauthorized terminal received from the manager server 20. Further, when the updated authorized terminal information storage unit 130 is referred to and the radio of the terminal matching the unauthorized terminal information is detected, the communication blocking unit 150 cuts off the communication.

The configuration of the security diagnosis server 30 is the same as that of the first embodiment. However, in the present embodiment, as a result of the analysis by the security analysis unit 310, the result of the unconfirmed terminal determined to be always installed or temporarily used is transmitted to the manager server 20, thereby transmitting the device classification information storage unit. The 240 updates and stores the stored unconfirmed terminal information for constant installation or temporary use.

FIG. 15 is an example of a functional block diagram of the manager server 20 according to the second embodiment of the present invention. The manager server 20 receives device information or log information from each wireless signal detection sensor 10 by the communication unit 230. The reception timing is, for example, when the device information is a data transmission request from the security diagnosis server 30, and the log information is when the wireless signal detection sensor 10 generates a log. Not limited to this, the device information is received at regular intervals (for example, every 5 minutes, every 30 minutes), and the device information detected during that period is received, and the status of the wireless signal is continuously monitored. It may be configured so that it can be done.

The wireless signal detection sensor information storage unit 210 stores device information and log information received from the wireless signal detection sensor 10 for each wireless signal detection sensor 10 or for each customer.

The control unit 220 stores device information in the wireless signal detection sensor information storage unit 210 or reads out the stored information, controls a data transmission / reception request to the wireless signal detection sensor 10 or the security diagnosis server 30, and controls communication by the communication unit 230. Controls the storage of device information and classification information in the device classification information storage unit 240 or the reading of the stored information.

The communication unit 230 receives the determination result of the unconfirmed terminal from the security diagnosis server 30. The determination result is stored in the device classification information storage unit 240 by updating the classification of the corresponding device information. Further, the communication unit 230 receives a connection request from the user to the device classification information storage unit 240, and transmits / receives data accompanying the update of the device classification information.

The device classification information storage unit 240 assigns device classification to access point or sub-terminal information for each customer or for each wireless signal detection sensor 10 and stores the information. When storing for each customer, the device information detected in the past by one or more wireless signal detection sensors 10 installed by the customer is stored. The device classification given in association with the device information is, for example, an authorized terminal, an unauthorized terminal, an authorized terminal or an unidentified terminal that is not classified as an authorized terminal or an unauthorized terminal that transmits wirelessly at that location and is permitted to connect. The device classification information storage unit 240 stores the information of the authorized terminal or the unauthorized terminal in the customer or the wireless signal detection sensor 10, receives the information from the wireless signal detection sensor 10, and stores the information in the wireless signal detection sensor information storage unit 210. Of the device information, device information other than authorized terminals and unauthorized terminals is stored as unconfirmed terminals.

The device classification information storage unit 240 also receives from the security diagnosis server 30 for temporary use or constant installation classified by the security diagnosis server 30, and stores it in association with the device information. At this time, the device classification information storage unit 240 updates and stores the classification of the device information received from the wireless signal detection sensor 10 and stored in advance from unconfirmed to temporary use or constant use.

Further, when the wireless signal detection sensor 10 transmits the device information for only a short time such as less than 10 minutes with a classification indicating that the device information is for a short time, the device classification information storage unit 240 uses the device information. Memorize the classification in association with.

The device classification stored in the device classification information storage unit 240 is read by the control unit 220 at the request of the user, and the device classification is updated. For example, if the device information classified as an unconfirmed terminal is determined to be an authorized terminal based on its SSID, MAC address, connection time, signal strength, etc., the classification information is updated and stored in the authorized terminal. You may. Further, when it is determined that the terminal is an unauthorized terminal, the classification information may be updated and stored from the unconfirmed terminal to the unauthorized terminal. By referring to the device information of the unconfirmed terminal and classifying it as an authorized terminal or an unauthorized terminal as appropriate, it is possible to improve the security of the wireless network at that location. In addition, even unconfirmed terminals can be classified from the devices that are always installed, which are considered to have a higher risk, by being given classifications such as constant installation, temporary use, and connection only for a short time. In addition, the security diagnosis server 30 may perform authorization or diagnosis of an unauthorized terminal, and send the classification information to the manager server 20 to update it.

Further, the device classification information storage unit 240 may be stored in association with the wireless signal detection sensor information storage unit 210. For example, regarding the detection date and time, the detection time, and the like of the device information stored in the device classification information storage unit 240, the corresponding device information may be read from the wireless signal detection sensor information storage unit 210. When the user changes the classification of a certain terminal, the classification can be easily determined by reading and referring to the detection date and time and the time as appropriate.

When the device classification stored in the device classification information storage unit 240 is updated to "authorized" or "illegal", the authorized terminal or the authorized terminal updated to the radio signal detection sensor 10 corresponding to the updated device information. Information on the unauthorized terminal is transmitted by the communication unit 230 and stored in the authorized terminal information storage unit 130 of the wireless signal detection sensor 10.

FIG. 16 is an example of a database configuration stored in the device classification information storage unit 240 according to the second embodiment of the present invention. The device classification information storage unit 240 stores the device information of the authorized terminal and the unauthorized terminal at the place where the customer or the wireless signal detection sensor exists, as well as the device information detected at that place.

The device classification information storage unit 240 stores the device classification and customer ID in association with information that can uniquely identify the terminal, for example, the MAC address, SSID, and terminal name. Here, an example of storing the device classification in association with the customer is shown, but instead of the customer ID, the device classification may be stored in association with the wireless signal detection sensor. The equipment is classified as "authorized", which is permitted to transmit wireless signals at that location, "illegal", which is not permitted to transmit wireless signals at that location, and both authorized and illegal. It is roughly divided into three types, "unconfirmed". Among the "unconfirmed" terminals, when the wireless signal detection sensor 10 receives information indicating that the detection was performed for less than a predetermined time, for example, less than 10 minutes, a "short" indicating that the detection is performed for a short time is added. I remember it.

Further, among the unclassified terminals, the device classification information storage unit 240 receives a determination result such as temporary use or constant installation from the security diagnosis server 30, from "unclassified" to "temporary use" or "always". Change the classification to "Installation" and memorize it. Further, the device classification information of the device classification information storage unit 240 is accessed from an external user terminal or from the input unit of the manager server 20, and "authorization" is applied to the "temporary use", "always installed", and "unclassified" terminals. Or, if it is updated to "illegal", the information is updated and stored. Not limited to this, the classification update to "authorization" or "illegal" may be updated by receiving information from the security diagnosis server 30.

10 Wireless signal detection sensor 20 Manager server 30 Security diagnostic server

Claims

A wireless signal detection sensor that detects a wireless signal and collects device information having terminal information of the source of the wireless signal and sub-terminal information connected to the terminal.
A manager server that receives collected device information from one or more of the wireless signal detection sensors, and
A wireless network security diagnostic system including a security diagnostic server that diagnoses security in a wireless network in which the wireless signal detection sensor exists based on device information collected by the wireless signal detection sensor and generates a security report.
The wireless network security diagnostic system according to claim 1.
The wireless signal detection sensor is
A sensor unit that detects wireless signals and
A device that stores as device information by associating the device ID, signal strength, and detection time for uniquely identifying the source terminal of the detected wireless signal with the sub-terminal information connected to the source terminal. Information storage unit and
It has a communication unit that transmits the device information to the manager server, and has.
The manager server
The device information received from each wireless signal detection sensor is stored in association with the wireless signal detection sensor.
When a transmission request is received from the security diagnosis server, the device information of the wireless signal detection sensor within a predetermined period corresponding to the request is transmitted.
The security diagnostic server is
A security analysis unit that performs security analysis of wireless networks based on device information within a specified period collected by wireless signal detection sensors, and
A report generator that generates security reports based on security analysis,
A wireless network security diagnostic system that has a report notification unit that notifies report generation.
The wireless network security diagnostic system according to claim 2.
The wireless signal detection sensor further includes an authorized terminal information storage unit that stores authorized terminal information of an authorized access point and a connected terminal.
It has a log generation condition that stores log information to generate log information as a connection log of an unauthorized terminal, and if the log generation condition is met, it has a log generation unit that generates log information.
The communication unit transmits the log information generated by the log generation unit to the manager server.
Upon receiving the request from the security diagnostic server, the manager server transmits the log information.
The security diagnostic server is
A wireless network security diagnostic system in which the security analysis unit analyzes security risks of a wireless network based on received log information and device information.
The wireless network security diagnostic system according to claim 3.
The wireless signal detection sensor is a wireless network security diagnostic system that further includes a communication blocking unit that blocks wireless communication when an unauthorized terminal is detected.
The wireless network security diagnostic system according to claim 4.
The authorized terminal information storage unit further stores unauthorized terminal information, and further stores the unauthorized terminal information.
The communication blocking unit is a wireless network security diagnostic system that detects a fraudulent terminal based on fraudulent terminal information stored in the licensed terminal information storage unit and blocks wireless communication.
The wireless network security diagnostic system according to claims 3 to 5.
The security analysis unit of the security diagnosis server is a wireless network security diagnosis system that refers to the risk level corresponding to the received log information and analyzes the security risk of the wireless network based on the risk level and the number of logs.
The wireless network security diagnostic system according to claims 3 to 6.
The security diagnosis server requests the manager server for device information detected by a predetermined wireless signal detection sensor at regular intervals.
When the manager server receives the request from the security diagnosis server, the manager server requests the device information from the requested wireless signal detection sensor.
When the device information from the predetermined wireless signal detection sensor is transmitted via the manager server, the security analysis unit of the security diagnostic server determines whether the terminal of the received device information is an authorized access point and authorizes it. With respect to device information other than the access point, it is diagnosed that there is an unauthorized access point based on the signal strength received by the wireless signal detection sensor and the duration of the detection time, and the report generator determines the unauthorized access point. A wireless network security diagnostic system that produces reports notifying you that there is.
A device information receiving unit that receives device information having terminal information of the source of the detected wireless signal collected by a predetermined wireless signal detection sensor and sub-terminal information connected to the terminal, and
A security analysis unit that performs security analysis of wireless networks based on device information within a specified period collected by wireless signal detection sensors, and
A report generator that generates security reports based on security analysis,
A security diagnostic server that has a report notification unit that notifies report generation.
The security diagnostic server according to claim 8.
The device information receiving unit further receives log information which is a connection log of an unauthorized terminal, and the security analysis unit analyzes a security risk of a wireless network based on the received log information and device information. ..
The security diagnostic server according to claim 9, wherein the security analysis unit refers to the risk level corresponding to the received log information and analyzes the security risk of the wireless network based on the risk level and the number of logs. Diagnostic server.
The security diagnostic server according to claims 8 to 10.
The device information receiving unit receives device information at regular intervals and receives device information.
The security analysis unit determines whether or not the device of the received device information is an authorized access point, and for device information other than the authorized access point, the signal strength and detection time received by the wireless signal detection sensor. Diagnose that there is a rogue access point based on the duration and
The report generation unit is a security diagnostic server that generates a report notifying that there is an unauthorized access point.
A computer program that functions a computer as a security diagnostic server, and provides device information that includes terminal information of the source of the detected wireless signal collected by a predetermined wireless signal detection sensor and sub-terminal information connected to the terminal. Receive and
A security analysis of the wireless network is performed based on the device information within the specified period collected by the wireless signal detection sensor.
Generate security reports based on security analysis
A computer program that provides report generation notifications.