JP2004128613A - Base station supervisory apparatus in radio network, base station supervising method, and program thereof - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To find base stations installed without intention of an organization, by supervising MAC addresses, etc. used for communications. <P>SOLUTION: The base station supervisory apparatus 20 in a radio network for supervising the existence of any expected base station connected to a wired network comprises a base station table 30 for previously storing identification information of intended base stations for executing the radio network, an antenna 21 and a radio wave receiver 22 for receiving radio waves used for the radio network in a specified area, a radio wave analyzer 23 and a base station identifier 24 for analyzing the received radio waves to acquire the identification information of the base stations, a questionable base station finder 26 for finding base stations disagreeing with the identification information of the intended base stations stored in the base station table 30, and a supervisory result output unit 27 for outputting the supervisory result. <P>COPYRIGHT: (C)2004,JPO

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to a base station monitoring device and the like in a wireless network, and more particularly to a device and the like for monitoring the presence of an access point connected to a network.
[0002]
[Prior art]
2. Description of the Related Art In recent years, a mode of constructing a LAN (Local Area Network) has been increasing not only in offices but also in homes. Among them, in order to avoid the troublesomeness of cable wiring and the like, and with the rapid development of mobile terminals such as notebook PCs, mobile phones and PDAs, the spread of wireless (Wireless) LANs is expected in the future. Have been.
[0003]
Here, for example, when constructing a LAN using wired Ethernet (registered trademark of US XEROX Corporation), a physical work such as connecting a cable to a hub or the like is required, so that the security level is generally high. . However, in the case of a wireless LAN system, for example, in an IEEE802.11b system, a mobile terminal can freely perform data communication by executing an association procedure for causing an access point to recognize its own existence. And the security level is very low. Therefore, as a conventional technique, for example, a mobile station in a wireless area executes an authentication procedure before starting an association procedure, and a network administrator who manages a LAN instructs final permission or denial of the authentication procedure. There is a technique for preventing theft (reading) of a malicious network from an intruder (for example, refer to Patent Document 1).
[0004]
[Patent Document 1]
JP 2001-345819 A (page 4-5, FIG. 1)
[0005]
[Problems to be solved by the invention]
On the other hand, in recent years, base stations (commonly known as access points) of wireless networks have been rapidly reduced in price, and are readily available to any number of people, such as being sold at general PC mass retailers. it can. It is very dangerous if such a base station is installed in a company or the like without permission.
[0006]
At the time of shipment from a factory, security measures are not taken when setting up the base station of such a wireless network in order to allow the user to easily experience the wireless network and to make it function sufficiently. For this reason, if a purchased wireless network base station is connected to the company's internal wired network, it can easily be found by a third party who intercepts radio waves outside, There is a high possibility that the intrusion by the user will be easily accepted. In addition, it is easy to be vulnerable to cyber terrorism that intentionally installs base stations in the internal network and induces intrusions from the outside.
[0007]
In addition, security technologies such as base station identification codes, encryption, and user authentication have been devised and implemented in wireless networks, but these are useful functions when installation is performed with due consideration for security. It is. In the prior art as disclosed in Patent Document 1, only security measures are taken for the wireless LAN itself, and no solution is presented for intrusion from outside using a wireless LAN to a wired network. That is, a solution to “prevent installation of base stations with insufficient security settings” has not been reached.
[0008]
SUMMARY OF THE INVENTION The present invention has been made to solve the above-described technical problems, and a purpose thereof is to install a base station with an insufficiently or unintentionally set security. To monitor and discover actions.
[0009]
[Means for Solving the Problems]
In order to achieve the above object, the present invention provides a method for scanning when a base station (access point) of a wireless network is connected to a wired network, which is an internal network, with or without intention of an organization. Thus, the identification information possessed by the base station is acquired, and the presence of the problematic base station is recognized by comparing it with the information stored in advance. That is, the present invention is a base station monitoring apparatus in a wireless network for monitoring the presence of an unexpected base station connected to a wired network, and stores identification information of a base station intended in advance to execute the wireless network. Receiving means for receiving radio waves used in a wireless network in a predetermined area; acquiring means for analyzing radio waves received by the receiving means to obtain identification information of a base station; Comparing means for comparing the identification information of the base station obtained by the means with the identification information of the intended base station stored in the storage means; and the identification information of the intended base station by the comparing means. And output means for outputting a monitoring result as an unintended base station when it is different from the base station.
[0010]
Here, when the beacon signal is emitted, the acquisition means analyzes the data frame from the beacon signal (beacon frame) for the base station from which the beacon signal is not emitted, and acquires the identification information. It is preferable that the identification information is acquired by both of them, so that oversight of the base station can be minimized. In addition, the identification information of the intended base station stored in the storage unit and the identification information of the base station acquired by the acquisition unit are a MAC (Media Access Control) address and / or an SSID (Service Set Identification). Can be characterized. Further, the present invention can be characterized by further comprising base station registration means for registering the identification information of the base station acquired by the acquisition means in the storage means.
[0011]
On the other hand, a method for monitoring a base station in a wireless network to which the present invention is applied includes a step of receiving a radio wave used in the wireless network in a predetermined area, a step of analyzing the received radio wave, and a step of analyzing a base station based on the analyzed radio wave. Identifying a station, determining whether the identified base station is a pre-registered base station as a scheduled base station, and identifying the identified base station with a pre-registered base station. Outputting the monitoring result as a problematic base station if different.
[0012]
Here, the step of analyzing the radio wave may be characterized by analyzing a beacon signal from the received radio wave and / or analyzing a data frame of the received radio wave.
[0013]
Further, if a step of initializing a table in which the identification information of the base station is registered in advance and a step of registering the identified base station in the initialized table are further included, the base station can be added as needed. , Correction, deletion, etc. are possible.
[0014]
The present invention can be understood as a program configured such that a computer functioning as a base station monitoring device can realize each of these functions. When this program is provided to a computer, the program is provided in a state where the program is installed in a base station monitoring device such as a notebook PC. The form provided in is considered. The storage medium corresponds to, for example, a CD-ROM medium. A program is read by a CD-ROM reader or the like, and the program is stored and executed in a flash ROM or the like. These programs may be provided, for example, by a program transmission device via a network. This program transmission device is provided, for example, in a server on the host side, and includes a memory for storing the program, and a program transmission unit for providing the program via a network.
[0015]
The program includes a function of receiving a radio wave used in a wireless network in a predetermined area, a function of analyzing the received radio wave, and a function of identifying a base station from the analyzed radio wave. A function of determining whether a base station that has been registered is a base station registered in advance as a scheduled base station, and monitoring as a problem base station if the identified base station is different from the base station registered in advance. And a function of outputting a result.
[0016]
BEST MODE FOR CARRYING OUT THE INVENTION
Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.
FIG. 1 is a diagram for explaining the overall configuration of a base station monitoring system 1 to which the present embodiment is applied. Here, a network (internal network) 10 that is a wired LAN such as an Ethernet is provided with a hub 11 that is a concentrator that relays the wired network. The hub 11 has a PC (personal computer) that uses the network 10. Computer device) 12 is connected. Further, the example shown in FIG. 1 shows a state in which a base station (access point: AP) 13 of a wireless network is connected to the hub 11. This base station 13 is installed by being connected to the hub 11 intentionally or unintentionally by a user using the network 10, and here, it is assumed that the base station 13 is installed with insufficient security settings. Think. In addition, in the base station monitoring system 1 shown in FIG. 1, a base station monitoring device 20, which is a characteristic configuration in the present embodiment, is provided to detect a base station 13 with insufficient security settings and monitor the network 10. Running.
[0017]
FIG. 2 is a block diagram for explaining the configuration of the base station monitoring device 20. The base station monitoring apparatus 20 to which the present embodiment is applied is configured such that the antenna 21 is connected to a portable computer apparatus such as a notebook PC, and the computer apparatus is based on radio waves received by the antenna 21 in a predetermined area. Is configured to output a monitoring result. Each function shown in FIG. 2 is executed by the CPU of the computer device by various programs stored in the computer device.
[0018]
The base station monitoring device 20 shown in FIG. 2 includes, for example, a diversity antenna or the like, and receives an antenna 21 for receiving a radio wave from the base station 13 in which a wireless network is executed in a predetermined area, and transmits an antenna 21 for transmitting a radio wave used in the wireless network. , A radio wave analyzing unit 23 for analyzing radio waves of a wireless network, and identification information such as a MAC (Media Access Control) address of the base station 13 or an SSID (Service Set). A base station identification unit 24 for identifying the base station 13 based on the identification, a base station table 30 for storing the problem-free base station 13 in, for example, a table format stored in a storage device such as an HDD in the computer device, a base station identification unit. Example identified by 24 For example, the base station table 30 is automatically or manually stored in the base station table 30 from among the base station registration unit 25 and the base station 13 identified by the base station identification unit 24 based on the user's instruction. , A problematic base station finding unit 26 for finding a problematic base station, and a monitoring result output for outputting a warning or the like when the problematic base station finding unit 26 finds a radio wave of the base station 13 considered to be a problematic base station. A portion 27 is provided.
[0019]
Next, the frame format of the beacon signal will be described.
FIGS. 3A to 3C are diagrams for explaining a frame configuration transmitted and received in a wireless network. FIG. 3A shows a basic configuration of the wireless communication, FIG. 3B shows a MAC (MAC) data field included in the basic configuration, and FIG. 3C shows a frame control (Frame Control) in the MAC data field. ) Field. Communication transmitted and received in a wireless network is composed of individual frames, and its basic configuration is standardized by IEEE 802.11 as shown in FIG.
[0020]
IEEE 802.11 is a wireless LAN standard using a maximum transfer rate of 2 Mbps and a 2.4 GHz band, and is a predecessor standard of IEEE 802.11b (DS-SS (Direct Spread Spectrum Spread Spectrum)) which is a high-speed wireless LAN standard. In IEEE802.11b, as shown in FIG. 3A, a Physical Layer Convergence Protocol (PLCP) preamble, a PLCP header, and a MAC data (MAC Data) frame are provided as physical layer headers. (Cyclic Redundancy Check: cyclic redundancy check) for detecting a bit error. Here, PLCP is a protocol for exchanging information of a physical layer such as a transmission speed and a frame length in IEEE 802.11.
[0021]
As shown in FIG. 3B, the MAC data field included in the basic configuration includes a frame control (16 bits) as a MAC header and a time (standby time) until the terminal can transmit data. Duration: ID (16 bits), address 1 (48 bits) as a destination address in the wireless LAN, address 2 (48 bits) as a source address, address 3 (48 bits) as an auxiliary address, sequence control (16 bits), an address 4 (48 bits) which is an address stored when using a WDS (Wireless Distribution System), a frame body (0-2312 * 8 bits) which is a data part, and a CRC (32 bits). .
[0022]
Further, the frame control field includes a protocol version (2 bits), which is version information of the protocol, for example, a type (2 bits) indicating a frame type of management (00), control (01), and data frame (11). 2, a sub-type (4 bits) indicating the type of the frame, a ToDS (1 bit) indicating the type of the destination, a FromDS (1 bit) indicating the type of the source, transfer information (4 bits) which is information such as retransmission and division, and encryption of a wireless packet. It is composed of WEP (1 bit) indicating whether or not WEP (Wired Equivalent Privacy) processing is performed.
[0023]
In the type (Type) and subtype (Subtype) fields, when the bits of type B3 and B2 are “00” and the bits of subtypes B7, B6, B5 and B4 are each 1000, the corresponding frame Is called a "Beacon frame". Various formats of frames are used for the wireless network, and the beacon frame is used by the base station 13 to notify the nearby users of its own existence.
[0024]
FIG. 4 is a diagram illustrating an example of the beacon frame. (A) shows a code string, and (b) shows an information portion that can be confirmed on the display of the base station monitoring device 20. “0x8000” indicated by reference numeral 41 in the figure is a frame control field, which is interpreted inside the communication program as a subtype indicating a beacon. In addition, the address 2 included in the MAC data field in the beacon frame includes the MAC address “00 02 2d 1b 61 41” of the base station 13 that is the transmission source of the frame, as indicated by reference numeral 42 in FIG. I have. Further, in the case of a beacon frame, as indicated by reference numeral 43 in FIG. 4, an SSID indicating the name of the base station 13 is included as identification information.
[0025]
The base station 13 that outputs the beacon signal transmits the beacon signal without specifying the destination. The transmitted beacon signal can be received within a radius of about 100 m. Communication can take place in the same way as a wired network. When performing communication, a MAC address is required, and communication with a specific device is made possible by recognizing both MAC addresses for transmission and reception. When communicating with an unspecified majority, a broadcast address of “ff: ff: ff: ff: ff: ff: ff” is used as a destination MAC address, and an individual MAC address is used in communication with a specific partner. Can be The MAC address is a unique number individually assigned to the communication device, and it is determined that no device with the same number exists.
[0026]
On the other hand, in the data communication, in the type (Type) and subtype (Subtype) fields shown in FIG. 3C, the bits of the type B3 and B2 are respectively “10”, and the subtypes B7, B6, B5 and When each of the bits of B4 is 0000, the corresponding frame is called a “data (Data) frame”.
[0027]
FIG. 5 is a diagram illustrating an example of a data frame. “0x0842” indicated by reference numeral 51 in FIG. 5 is a frame control (Frame Control) field, and is interpreted inside the communication program as a subtype indicating data. In addition, the MAC address “00 02 2d 1b 61 41” of the base station 13 is stored in the address 2 included in the MAC data field in the data frame, as indicated by reference numeral 52 in FIG. Therefore, the MAC address of the base station 13 can be known by referring to the field indicated by reference numeral 51.
[0028]
FIGS. 6A and 6B are diagrams showing examples of tables stored in the base station table 30. FIG. The MAC address and the SSID are recorded in the base station table 30 as a database. When the SSID is recorded by the beacon frame as shown in FIG. 4, as shown in FIG. 6A, the SSID “LACWave” and the MAC address “00 02 2d 1b 61 41” are stored. . For the base station 13 from which the beacon signal is not transmitted, as shown in FIG. 6B, the MAC address “00 02 2d 1b 61 41” is stored. The base station table 30 is initialized, for example, at the time of activation, and thereafter registration of identification information is performed.
[0029]
Next, a base station monitoring process performed by the base station monitoring device 20 will be described. FIG. 7 is a flowchart illustrating a flow of the base station monitoring process according to the present embodiment. First, in a predetermined area such as a building such as a predetermined building or a predetermined area, the radio wave receiving unit 22 of the base station monitoring device 20 acquires a radio wave used in the wireless network via the antenna 21 (step S1). 101). That is, radio waves are intercepted by scanning. The radio wave analyzer 23 analyzes the radio wave acquired by the radio wave receiver 22 (Step 102). Here, it is determined whether or not a beacon signal is detected (step 103). If a beacon signal is detected, for example, a beacon frame is analyzed as shown in FIG. Then, the MAC address and the SSID are confirmed from the beacon frame (step 104). On the other hand, if no beacon signal is detected, the MAC address is obtained from the data frame included in the packet as shown in FIG. 5 (step 105). As described above, even when the base station 13 does not disperse beacons, the base station ID, which is an unencrypted portion included in the packet, can be always recognized by starting communication. By recognizing the base station ID, it is possible to recognize the base station 13 even when the beacon signal is not scattered.
[0030]
Thereafter, the problematic base station finding unit 26 compares the detected MAC address or SSID with the detected MAC address or SSID stored in the base station table 30 based on the recognized MAC address or SSID (step 106), and registers. It is determined whether a MAC address or SSID that has not been detected is detected (step 107). As a result, if a MAC address or SSID that is not registered in the base station table 30 is detected, it is managed via a monitoring result output unit 27 by a method such as a wired network, a wireless network, a telephone or a mobile phone. Is notified to the person, the person in charge, and a management system (not shown) (step 108). If an unregistered MAC address or SSID is not detected, a message indicating that no abnormality is found is displayed on a display or the like (step 109).
[0031]
Here, it is determined whether or not the mode is the registration mode for the base station table 30 (step 110). If no registration is made, the process is terminated as it is, and if registration is performed, the MAC address, The SSID is registered in the base station table 30 (step 111), and the process ends. As described above, the registration in the base station table 30 is initialized when, for example, the base station monitoring device 20 is started, and may be configured to perform addition, correction, and deletion as needed. In order to quickly find a new base station 13, it is preferable to operate the base station monitoring device 20 at all times to collect information on the base station 13.
[0032]
As described above in detail, according to the present embodiment, when the base station 13 having the MAC address registered in the base station table 30 and a MAC address different from the SSID and the SSID is extracted, It becomes possible to identify as a base station 13 not intended as an organization. At this time, in the present embodiment, since the MAC address and SSID of the base station 13 are collected from both the beacon frame and the data frame, oversight of the base station 13 can be minimized.
[0033]
In the present embodiment, the information is collected from the beacon frame and the data frame. However, the base station is used by using the Probe Request frame output when one frequency is selected from the slave station as the user. It is also possible to find a user connecting to the station 13. Thus, other information collection functions can be implemented as extended functions.
[0034]
【The invention's effect】
As described above, according to the present invention, when an unintended base station is installed as an organization, it becomes possible to discover these by monitoring the MAC address and the like used for communication.
[Brief description of the drawings]
FIG. 1 is a diagram illustrating an overall configuration of a base station monitoring system to which the present embodiment is applied.
FIG. 2 is a block diagram illustrating a configuration of a base station monitoring device.
FIGS. 3A to 3C are diagrams for explaining a frame configuration transmitted and received in a wireless network.
FIG. 4 is a diagram showing an example of a beacon frame.
FIG. 5 is a diagram showing an example of a data frame.
FIGS. 6A and 6B are diagrams illustrating examples of tables stored in a base station table.
FIG. 7 is a flowchart illustrating a flow of a base station monitoring process according to the present embodiment.
[Explanation of symbols]
DESCRIPTION OF SYMBOLS 1 ... Base station monitoring system, 10 ... Network (internal network), 11 ... Hub, 12 ... PC (personal computer device), 13 ... Base station (access point), 20 ... Base station monitoring device, 21 ... Antenna, 22 ... Radio wave receiving unit 23 Radio wave analyzing unit 24 Base station identifying unit 25 Base station registering unit 26 Problem base station finding unit 27 Monitoring result output unit 30 Base station table

Claims (8)

A base station monitoring device in a wireless network that monitors the presence of a base station,
Storage means for storing identification information of a base station intended in advance as executing a wireless network;
Receiving means for receiving a radio wave used in a wireless network in a predetermined area, and acquiring means for analyzing the radio wave received by the receiving means and acquiring identification information of a base station,
Comparison means for comparing the identification information of the base station obtained by the obtaining means with the identification information of the intended base station stored in the storage means;
An output unit that outputs a monitoring result as an unintended base station when the identification information of the base station is different from the identification information of the intended base station by the comparing unit. When the beacon signal is emitted, the acquisition unit analyzes the data frame from the beacon signal to the base station from which the beacon signal is not emitted, and acquires the identification information. The base station monitoring device in the wireless network according to claim 1. The identification information of the intended base station stored in the storage unit and the identification information of the base station acquired by the acquisition unit are a MAC (Media Access Control) address and / or an SSID (Service Set Identification). The base station monitoring device in a wireless network according to claim 1, wherein: 2. The base station monitoring apparatus in a wireless network according to claim 1, further comprising a base station registration unit that registers the identification information of the base station acquired by the acquisition unit in the storage unit. Receiving radio waves used in a wireless network in a predetermined area;
Analyzing the received radio wave;
Identifying a base station from the analyzed radio waves;
Judging whether or not the identified base station is a base station registered in advance as a scheduled base station;
Outputting a monitoring result as a problematic base station when the identified base station is different from a pre-registered base station. The base station monitoring in a wireless network according to claim 5, wherein the step of analyzing the radio wave analyzes a beacon signal from the received radio wave and / or analyzes a data frame of the received radio wave. Method. Initializing a table in which the identification information of the base station is registered in advance at the time of startup,
6. The method of monitoring a base station in a wireless network according to claim 5, further comprising: registering the identified base station in the initialized table. On the computer,
A function of receiving radio waves used in a wireless network in a predetermined area,
A function of analyzing the received radio wave,
A function of identifying a base station from the analyzed radio waves,
A function of determining whether or not the identified base station is a base station registered in advance as a scheduled base station;
A function of outputting a monitoring result as a problem base station when the identified base station is different from a pre-registered base station.

Images