JP2020005080A - Wireless communication device, wireless communication method, wireless communication program, and wireless communication system - Google Patents

Abstract

To provide a wireless communication device, a wireless communication method, a wireless communication program, and a wireless communication system, capable of reducing a possibility of unauthorized access while suppressing an increase in processing load.SOLUTION: The wireless communication device 20 includes: a control unit 21 for operating an own device as a pseudo wireless slave when a communication terminal 30 is not connected to the own device; and a beacon processor 22 for receiving a beacon signal from the communication terminal 30 and determining whether the beacon signal is a desired beacon signal. When the beacon signal is the desired beacon signal, the control unit 21 operates the own device as an access point.SELECTED DRAWING: Figure 1

Description

  The present disclosure relates to a wireless communication device, a wireless communication method, a wireless communication program, and a wireless communication system.

  A network device that is permanently installed outdoors has a low maintainability because physical operation is difficult due to the installation location. For this reason, such a network device does not require any operation, so that a minimum communication cable is laid. On the other hand, when a problem occurs in the network device, it is necessary to promptly deal with the problem, and therefore, an emergency management line for operating the network device is provided. Here, the emergency management line for the network device generally requires a smaller band than the main signal, and is realized using a part of the band (Inband) of the main signal line. However, for example, when the main signal line is disconnected, the emergency management line is also disconnected, and the emergency management line cannot be used.

  Therefore, it has been considered that the network is realized by using a wireless LAN (Local Area Network) or Bluetooth (registered trademark) as an emergency management line for operating the network device. However, when a wireless LAN or Bluetooth is used as an emergency management line, a physical connection is not required, but there is a problem that a third party can easily try unauthorized access to the network device. Further, since the above network device is generally operated in a closed network (CN) which is isolated from the Internet or the like, a physical intrusion barrier into the inside of the network device is reduced. That is, even if account management, encryption, and security updating are sufficiently performed, the network device may be illegally accessed due to a potential vulnerability such as a zero-day attack. Therefore, it is required that the existence of the network device operating as an access point (AP: Wireless Access Point) be hidden as much as possible so as not to be detected by another wireless communication device, so that the network device is not recognized as an attack target.

In connection with the above, related technologies relating to a concealment method for preventing an access point device from being detected from another wireless communication device have been studied (for example, Patent Documents 1 and 2).
According to Patent Literature 1, when an AP has a stealth mode function and notifies an SSID (Service Set Identifier) to a specific wireless terminal device, the AP encrypts and transmits the SSID of the AP. The wireless terminal device transmits an AP search signal, determines whether the SSID is encrypted with respect to the response signal from the AP, and if the SSID is encrypted, decrypts the SSID using decryption means. It is disclosed to connect. As described above, Patent Document 1 discloses that an unauthorized access is prevented by encrypting an SSID and combining it with a response restriction to a Probe Request.

  In Patent Document 2, an AP generates hash information using a time stamp and an ESSID (Extended Service Set Identifier), and generates an SSID using the generated hash information. The client extracts the time stamp and the hash information from the SSID included in the beacon signal transmitted from the AP, and calculates the hash information from the extracted time stamp and the ESSID of the client. It is disclosed that when the hash information included in the SSID matches the calculated hash information, the client connects to the AP. As described above, Patent Literature 2 discloses that unauthorized access is prevented by hashing the SSID and combining the hash with the response to the Probe Request.

JP 2007-251500 A JP 2012-95191 A

  In the technologies disclosed in Patent Documents 1 and 2 described above, since the AP encrypts all wireless LAN frames including the SSID, or the AP calculates hash information for each frame, general communication is performed. The processing load becomes higher than that.

  Here, in the wireless LAN, it is assumed that the AP is hidden using the stealth AP function or the MAC address filter function. However, in the stealth AP function, since a beacon signal is transmitted from the AP, the existence of the AP can be grasped without actual communication. Further, even if the MAC address filter function is used, the MAC address of the AP can be easily intercepted from communication with the STA. Therefore, even if the above function is used, it cannot be said that the possibility of unauthorized access is reduced.

  An object of the present disclosure is to solve the above-described problem, and it is possible to reduce a possibility of unauthorized access while suppressing an increase in processing load, a wireless communication apparatus, a wireless communication method, and a wireless communication method. A communication program and a wireless communication system are provided.

A wireless communication device according to the present disclosure includes:
When the communication terminal is not connected to its own device, a control unit that operates its own device as a pseudo wireless slave,
A beacon processing unit that receives a beacon signal from the communication terminal and determines whether the beacon signal is a desired beacon signal,
When the beacon signal is a desired beacon signal, the control unit operates the own device as an access point.

The wireless communication method according to the present disclosure includes:
If the communication terminal is not connected to its own device, operate its own device as a pseudo wireless slave,
While receiving a beacon signal from the communication terminal, determine whether the beacon signal is a desired beacon signal,
When the beacon signal is a desired beacon signal, the wireless communication method operates the own device as an access point.

The wireless communication program according to the present disclosure includes:
If the communication terminal is not connected to its own device, to operate its own device as a pseudo wireless handset,
While receiving a beacon signal from the communication terminal, determining whether the beacon signal is a desired beacon signal,
If the beacon signal is a desired beacon signal, the wireless communication program causes a computer to execute the operation of the own device as an access point.

A wireless communication system according to the present disclosure includes:
Including a wireless communication device and a communication terminal,
The wireless communication device,
When the communication terminal is not connected to the own device, a first control unit that operates the own device as a pseudo wireless slave device;
A first beacon processing unit that receives a first beacon signal from the communication terminal, and determines whether the first beacon signal is a desired beacon signal,
The communication terminal,
A second controller configured to operate the own device as a pseudo access point when the own device is not connected to the wireless communication device;
A second beacon processing unit that transmits the first beacon signal to the wireless communication device,
The first control unit, when the first beacon signal is a desired beacon signal, operates its own device as an access point,
The second control unit is a wireless communication system that, when transmitting the first beacon signal or receiving a second beacon signal from the wireless communication device, causes the own device to operate as a wireless handset.

  According to the present disclosure, it is possible to reduce the possibility of unauthorized access while suppressing an increase in processing load.

1 is a diagram illustrating a configuration example of a wireless communication system according to an outline of an embodiment. FIG. 1 is a diagram illustrating a configuration example of a wireless communication system according to an embodiment; FIG. 9 is a diagram illustrating a determination process performed by a beacon processing unit. FIG. 5 is a diagram illustrating an operation example of the AP according to the embodiment; FIG. 9 is a diagram illustrating an operation example of the STA according to the embodiment. 1 is a block diagram illustrating a hardware configuration of a computer (information processing device) capable of realizing a wireless communication device and the like according to each embodiment of the present disclosure.

  Hereinafter, embodiments of the present disclosure will be described with reference to the drawings. The following description and drawings are omitted and simplified as appropriate for clarity of explanation. In the following drawings, the same elements are denoted by the same reference numerals, and a repeated description is omitted as necessary.

(Outline of Embodiment)
Prior to description of an embodiment of the present disclosure, an outline of the embodiment will be described. FIG. 1 is a diagram illustrating a configuration example of a wireless communication system according to an outline of an embodiment. The wireless communication system 10 includes a wireless communication device 20 and a communication terminal 30.

  The wireless communication device 20 may be a network device (communication device) that is permanently installed at a high place outdoors. The wireless communication device 20 is a communication device that supports wireless LAN communication, and is, for example, an access point device. The wireless communication device 20 is a communication device configured to be connectable and communicable with the communication terminal 30 via a wireless line.

  The communication terminal 30 is a communication device that supports wireless LAN communication, and may be, for example, a communication device such as a wireless LAN slave unit, a mobile phone terminal, a smartphone terminal, a tablet terminal, a personal computer device, or a mobile router. . The communication terminal 30 is a communication device configured to be connectable and communicable with the wireless communication device 20 via a wireless line.

  Next, a configuration example of the wireless communication device 20 will be described. The wireless communication device 20 includes a control unit 21 and a beacon processing unit 22.

  When the communication terminal 30 is not connected to the own device, the control unit 21 operates the own device as a pseudo wireless slave. In addition, when the beacon signal received from the communication terminal 30 by the beacon processing unit 22 described later is a desired beacon signal, the control unit 21 operates the own device as an access point.

  The beacon processing unit 22 receives a beacon signal from the communication terminal 30 and determines whether the received beacon signal is a desired beacon signal.

  Next, a configuration example of the communication terminal 30 will be described. The communication terminal 30 includes a control unit 31 and a beacon processing unit 32.

When the own device is not connected to the wireless communication device 20, the control unit 31 operates the own device as a pseudo access point. In addition, when the beacon processing unit 32 described later transmits the beacon signal to the wireless communication device 20 or receives another beacon signal different from the beacon signal from the wireless communication device 20, the control unit 31 wirelessly transmits its own device. Operate as a slave unit.
The beacon processing unit 32 transmits a beacon signal to the wireless communication device 20.

  As described above, when the communication terminal 30 is not connected, the wireless communication device 20 operates itself as a pseudo wireless slave. In this case, since the wireless communication device 20 operates as a wireless slave, it does not respond to an AP search from an attacker who attempts unauthorized access. Therefore, the use of the wireless communication device 20 makes it difficult for an attacker who attempts unauthorized access to recognize the existence of the wireless communication device 20. Further, the wireless communication device 20 and the communication terminal 30 according to the embodiment of the present disclosure perform encryption processing and calculation of hash information for each frame, as in the techniques disclosed in Patent Documents 1 and 2 described above. Since the processing is not performed, the processing for increasing the processing load is not performed. Therefore, according to the embodiment of the present disclosure, it is possible to reduce the possibility of unauthorized access while suppressing an increase in processing load.

(Embodiment)
Hereinafter, the embodiments of the present disclosure will be described in detail with reference to the drawings.
<Configuration example of wireless communication system>
First, a configuration example of the wireless communication system 100 according to the embodiment will be described with reference to FIG. FIG. 2 is a diagram illustrating a configuration example of a wireless communication system according to the embodiment. The wireless communication system 100 is a wireless LAN system. The wireless communication system 100 includes an AP 40 and a STA (Wireless Station) 50.

  The AP 40 corresponds to the wireless communication device 20 according to the embodiment. The AP 40 may be a communication device that is permanently installed outdoors. The AP 40 is a communication device that enables connection and communication with the STA 50 by using the STA 50 as a wireless slave (wireless LAN slave). The AP 40 operates in two operation modes. Specifically, the first operation mode is a Fake STA operation mode that operates as a STA that is a pseudo wireless slave device. The second operation mode is a True AP operation mode that operates as an AP that is an original wireless master device.

  The Fake STA operation mode is a mode in which the AP 40 operates as a STA in a pseudo manner, and is an operation mode in which a part of the operation performed by the STA is performed. Specifically, when the AP 40 is in the Fake STA operation mode, the AP 40 does not transmit a beacon signal to the STA 50, and receives a pseudo beacon signal transmitted from the STA 50. The pseudo beacon signal transmitted from the STA 50 is a beacon signal including information equivalent to the beacon signal transmitted by the original AP. In the following description, the beacon signal transmitted from the STA 50 may be described as a Fake Beacon signal or a Fake beacon signal.

  Note that when the AP 40 operates in the Fake STA operation mode, the AP 40 does not execute the connection process including the STA 50 and the authentication process. When the AP 40 operates in the Fake STA operation mode, if connection processing is performed, an attacker who attempts unauthorized access must start automatic connection processing to a fake AP prepared by the attacker. This is because the attack opportunity increases.

  The True AP operation mode is an operation mode in which the AP 40 operates as an original AP. The AP 40 operating in the True AP operation mode performs, for example, a process of transmitting a beacon signal to the STA 50, a process of receiving an Authentication Request transmitted from the STA 50, and a process of authenticating with the STA 50. In the following description, a beacon signal transmitted by the AP 40 operating in the True AP operation mode may be described as a True Beacon signal or a True beacon signal.

  The STA 50 corresponds to the communication terminal 30 according to the outline of the embodiment. The STA 50 is a communication device that enables connection and communication with the AP 40 using the AP 40 as a master unit. The STA 50 operates in two operation modes similarly to the AP 40. Specifically, the first operation mode is a Fake AP operation mode in which the STA 50 operates as an AP that is a pseudo wireless master device. The second operation mode is a True STA operation mode in which the STA 50 operates as an STA that is an original wireless slave.

  The Fake AP operation mode is a mode in which the STA 50 operates pseudo as an AP, and is an operation mode in which a part of the operation performed by the AP is performed. Specifically, when the STA 50 is in the Fake AP operation mode, the STA 50 transmits a Fake Beacon signal, which is a pseudo beacon signal, to the AP 40. The Fake Beacon signal is a beacon signal including a SA (Source MAC (Media Access Control) Address) similarly to the beacon signal transmitted by the AP 40. When the STA 50 is in the Fake AP operation mode, the STA 50 may perform an operation of determining whether or not the information included in the True Beacon signal transmitted from the AP 40 is desired information.

  The True STA operation mode is an operation mode in which the STA 50 operates as an original STA. The STA 50 operating in the True STA operation mode performs, for example, an authentication process with the AP 40.

  Here, when the STA 50 operates in the True STA operation mode and the AP 40 operates in the True AP operation mode, the AP 40 and the STA 50 perform authentication processing, and perform connection and communication when the authentication processing is completed. In other words, when the AP 40 operates in the Fake STA operation mode or when the STA 50 operates in the Fake AP operation mode, the AP 40 and the STA 50 do not perform authentication processing and do not perform connection and communication.

<Example of AP configuration>
Next, a configuration example of the AP 40 will be described. 2, the AP 40 includes a storage unit 41, a wireless LAN IF (Interface) unit 42, a beacon processing unit 43, a control unit 44, and an authentication processing unit 45. The storage unit 41, the wireless LAN IF unit 42, the beacon processing unit 43, the control unit 44, and the authentication processing unit 45 are connected by a communication bus for exchanging information for cooperation between the functional units.

  The storage unit 41 is a setting information storage area for storing setting information. The storage unit 41 provides information to be stored to each functional unit. The information stored in the storage unit 41 may be information that can be arbitrarily set by an administrator and an operator of the wireless communication system 100.

  The storage unit 41 stores information used when connecting to the STA 50 when the AP 40 operates in the Fake STA operation mode. More specifically, the storage unit 41 stores information on the validity / invalidity of the Fake STA operation mode, the Fake Beacon signal, and the information included in the Probe Response. The information included in the Fake Beacon signal and the Probe Response is, for example, a MAC address, a Supported Rate, a Channel, an ESSID, an SSID, and the like. The information included in the Fake Beacon signal and the Probe Response is the same information as the information included in the Fake Beacon signal and the Probe Response. The information included in the Fake Beacon signal and the Probe Response is grasped and determined in advance by an administrator or an operator of the wireless communication system 100. Since the Fake Beacon signal includes the same information as the beacon signal transmitted by the original AP, it can be said that the storage unit 41 stores information equivalent to the True Beacon signal.

  The storage unit 41 stores information used when the beacon processing unit 43 determines whether the Fake Beacon signal is a desired beacon signal. The information is stored in Sequence No. This information is included in the Fake Beacon signal and the Probe Response except for variable information such as The storage unit 41 may store all information included in the Fake Beacon signal and the Probe Response, or may store some information.

  Further, the storage unit 41 stores authentication information used when the authentication processing unit 45 performs authentication processing with the STA 50.

  The wireless LAN IF unit 42 is a communication port (communication interface) for performing wireless LAN communication. The wireless LAN IF unit 42 transmits the transmission frame output from the other function unit to the STA 50, and outputs the frame received from the STA 50 to the other function unit. The wireless LAN IF unit 42 is connected to the STA 50 by any of disconnection of the STA 50, authentication failure, timeout, error, and communication completion. The control unit 44 is notified that the authentication processing or communication with the STA 50 has been completed.

  The beacon processing unit 43 corresponds to the beacon processing unit 22 according to the outline of the embodiment. The wireless LAN IF unit 42 and the beacon processing unit 43 are functional units that communicate with the STA 50. Therefore, the wireless LAN IF unit 42 and the beacon processing unit 43 can be said to be a communication unit. The beacon processing unit 43 determines whether or not the Fake Beacon signal received from the STA 50 when operating in the Fake STA operation mode is a desired beacon signal. The beacon processing unit 43 compares the information included in the Fake Beacon signal with the setting information stored in the storage unit 41, and determines whether the Fake Beacon signal is a desired beacon signal. If the Fake Beacon signal is the desired beacon signal, the beacon processing unit 43 outputs to the control unit 44 that the Fake Beacon signal is the desired beacon signal.

  Further, when the AP 40 operates in the True AP operation mode, the beacon processing unit 43 creates a frame of a True Beacon signal. The beacon processing unit 43 creates a True Beacon signal frame based on the setting information stored in the storage unit 41, and transmits the frame to the STA 50 via the wireless LAN IF unit 42.

  Here, the process of determining the Fake Beacon signal performed by the beacon processing unit 43 will be described with reference to FIG. FIG. 3 is a diagram illustrating a determination process performed by the beacon processing unit. FIG. 3 shows a frame configuration of the Fake Beacon signal. As described above, the Fake Beacon signal has the same frame configuration as the True Beacon signal. That is, the Fake Beacon signal has the same frame configuration as a general beacon signal. Therefore, description of each information included in the frame configuration is omitted. DA represents a Destination MAC Address, and SA represents a Source MAC Address. The information and the order of the information described in FIG. 3 are an example, and the information and the order of the information included in the frame conform to the wireless LAN system applied to the AP 40 and the STA 50.

  The beacon processing unit 43 determines whether or not the Fake Beacon signal is a desired beacon signal based on whether or not the same information as the information set in the True Beacon signal is set. Specifically, the beacon processing unit 43 determines whether or not the Fake Beacon signal is a desired beacon signal based on whether each information included in the Fake Beacon signal matches a desired value. The information determined by the beacon processing unit 43 is determined according to operability and importance. When there is a lot of information on the determination target (check target), it is difficult to distinguish the AP from the determination process performed in the normal connection process, and thus it is difficult to recognize the AP. In other words, in this case, the attacker who performs the unauthorized access becomes difficult to recognize that the AP 40 is the AP, so that it is possible to enhance the suppression of the unauthorized access. On the other hand, for example, when the information to be determined is small, such as when the information is only partial information such as an SSID or the like, the range of devices to be used as STAs can be widened, so that the ease of connection can be improved. Therefore, the check target items performed by the beacon processing unit 43 may be appropriately set by the operator and the administrator of the wireless communication system 100 according to the operability and importance.

  The beacon processing unit 43 includes, for example, Sequence No. among information after the physical header (PHY Header). , Or static information other than variable information such as Timestamp may match a desired value. The beacon processing unit 43 includes Frame Control, DA, SA, basic service set identifier (BSSID), SSID included in Frame Body, Supported Rate, Extended Supported Rate, DSSS Parameter Set, CF Parameter Set, IBS Set, PBS Set, PBS Set, and PBS. It may be determined whether all or a part of Information, HT Control, and Vendor Specific matches a desired value. Alternatively, the beacon processing unit 43 may determine whether the SSID matches the SSID of the STA 50.

  Returning to FIG. 2, the description will be continued. The control unit 44 corresponds to the control unit 21 according to the outline of the embodiment. The control unit 44 manages and controls the operation mode of the own device. When the STA 50 is not connected to its own device, the control unit 44 operates in the Fake STA operation mode. That is, when the STA 50 is not connected to the own device, the control unit 44 operates the own device as a pseudo STA. When the beacon processing unit 43 determines that the Fake Beacon signal is a desired beacon signal, the control unit 44 operates by changing its own operation mode to the True AP operation mode. That is, when the Fake Beacon signal is a desired beacon signal, the control unit 44 operates the own device as an AP.

  The control unit 44 changes the operation mode of its own device to the Fake STA operation when the authentication process with the STA 50 fails or when the communication with the STA 50 including the disconnection and the communication end is completed. Change to mode and operate.

  When the AP 40 operates in the True AP operation mode, the authentication processing unit 45 performs authentication processing with the STA 50 in cooperation with the other function units. Specifically, the authentication processing unit 45 transmits and receives an Association Request / Response and transmits and receives an Authentication Request / Response. Further, the authentication processing unit 45 manages authentication processing (WPA2: Wi-Fi Protected Access II) including Handshake as the wireless LAN standard IEEE802.11 and connection status.

<Example of STA configuration>
Next, a configuration example of the STA 50 will be described. As illustrated in FIG. 2, the STA 50 includes a storage unit 51, a wireless LAN IF unit 52, a beacon processing unit 53, a control unit 54, and an authentication processing unit 55. The storage unit 51, the wireless LAN IF unit 52, the beacon processing unit 53, the control unit 54, and the authentication processing unit 55 are connected by a communication bus for exchanging information for cooperation between the functional units.

  The storage unit 51 is a setting information storage area for storing setting information. The storage unit 51 provides information to be stored to each functional unit. Note that the information stored in the storage unit 51 may be information that can be arbitrarily set by an administrator and an operator of the wireless communication system 100.

  The storage unit 51 stores information used when connecting to the AP 40 when the STA 50 operates in the Fake AP operation mode. More specifically, the storage unit 51 stores information on the validity / invalidity of the Fake AP operation mode, information included in the Fake Beacon signal, and information included in the Probe Response. The information included in the Fake Beacon signal and the Probe Response is, for example, the same information as the Beacon signal originally transmitted from the AP and the information included in the Probe Response, such as a MAC address, Supported Rate, Channel, and SSID. The information included in the Fake Beacon signal and the Probe Response is grasped and determined in advance by an administrator or an operator of the wireless communication system 100.

  Further, the storage unit 51 stores information used when the beacon processing unit 53 determines whether or not the True Beacon signal is a desired beacon signal. The information is stored in Sequence No. This is information included in the True Beacon signal and the Probe Response except for variable information such as The storage unit 51 may store all information included in the True Beacon signal and the Probe Response, or may store some information.

  Further, the storage unit 51 stores authentication information used when the authentication processing unit 55 performs authentication processing with the AP 40.

  The wireless LAN IF unit 52 is a communication port (communication interface) for performing wireless LAN communication. The wireless LAN IF unit 52 transmits the transmission frame output from the other function unit to the AP 40, and outputs the frame received from the AP 40 to the other function unit. The wireless LAN IF unit 52 controls when the authentication process with the AP 40 has failed or the communication has been terminated due to any of disconnection with the AP 40, authentication failure, Timeout, error, and communication completion. The unit 54 is notified that the authentication process or communication with the AP 40 has been completed.

  The beacon processing unit 53 corresponds to the beacon processing unit 32 according to the outline of the embodiment. The wireless LAN IF unit 52 and the beacon processing unit 53 are functional units that communicate with the AP 40. Therefore, the functional unit including the wireless LAN IF unit 52 and the beacon processing unit 53 can be said to be a communication unit. The beacon processing unit 53 creates a frame of a Fake Beacon signal to be transmitted when the STA 50 operates in the Fake AP operation mode. The beacon processing unit 53 uses the Sequence No. based on the setting information stored in the storage unit 51. For example, a frame of a Fake Beacon signal is created by complementing variable information for each frame, and transmitted to the AP 40 via the wireless LAN IF unit 52.

  When the STA 50 operates in the True STA operation mode, the beacon processing unit 53 determines whether the True Beacon signal transmitted from the AP 40 is a desired beacon signal. The beacon processing unit 53 performs a process similar to the determination process performed between the normal AP and the STA, and determines whether the True Beacon signal transmitted from the AP 40 is a desired beacon signal. The beacon processing unit 53 compares the information included in the received True Beacon signal with the setting information stored in the storage unit 51, and determines whether the True Beacon signal transmitted from the AP 40 is a desired beacon signal. judge. If the True Beacon signal is the desired beacon signal, the beacon processing unit 53 outputs to the control unit 54 that the True Beacon signal is the desired beacon signal.

  The control unit 54 corresponds to the control unit 31 according to the outline of the embodiment. The control unit 54 manages and controls the operation mode of the own device. The control unit 54 operates in the Fake AP operation mode when the own device is not connected to the AP 40. That is, when the own device is not connected to the AP 40, the control unit 54 operates the own device as a pseudo AP. When the beacon processing unit 53 determines that the True Beacon signal is a desired beacon signal, the control unit 54 operates by changing the operation mode of the own device to the True STA operation mode. That is, when the True Beacon signal is a desired beacon signal, the control unit 54 operates the own device as an STA.

  The control unit 54 sets the operation mode of its own device to the Fake AP operation mode when the authentication process with the AP 40 fails or when the communication with the AP 40 including the disconnection and the communication end is completed. Change to work.

  When the own device operates in the True STA operation mode, the authentication processing unit 55 performs authentication processing with the AP 40 in cooperation with other function units. Specifically, the authentication processing unit 55 performs transmission and reception of Association Request / Response and transmission and reception of Authentication Request / Response. The authentication processing unit 55 manages an authentication process (WPA2) including Handshake as the wireless LAN standard IEEE 802.11 and a connection status.

<Operation example of AP>
Subsequently, an operation example of the AP 40 according to the embodiment will be described with reference to FIG. FIG. 4 is a diagram illustrating an operation example of the AP according to the embodiment. The operation example illustrated in FIG. 4 is an operation example that is started after the AP 40 is activated and after the AP 40 completes connection and communication with the STA 50.

  First, the AP 40 operates in the Fake STA operation mode, and waits for reception of a Fake Beacon signal transmitted from the STA 50 (step S1). Specifically, the control unit 44 operates in the Fake STA operation mode because the STA 50 is not connected to the own device. Further, the beacon processing unit 43 enters a state of waiting for reception of a Fake Beacon signal transmitted from the STA 50.

  Next, the AP 40 receives the Fake Beacon signal (Step S2), and determines whether or not the Fake Beacon signal is a desired (expected) beacon signal (Step S3).

  Specifically, the beacon processing unit 43 includes, for example, Sequence No. among information after the physical header (PHY Header). , Or static information other than variable information such as Timestamp may match a desired value. The beacon processing unit 43 includes Frame Control, DA, SA, basic service set identifier (BSSID), SSID included in Frame Body, Supported Rate, Extended Supported Rate, DSSS Parameter Set, CF Parameter Set, IBS Set, PBS Set, PBS Set, and PBS. It may be determined whether all or a part of Information, HT Control, and Vendor Specific matches a desired value. Alternatively, the beacon processing unit 43 may determine whether the SSID matches the SSID of the STA 50.

  In step S3, if the Fake Beacon signal is a desired beacon signal (YES in step S3), the processing in step S4 is executed. On the other hand, in Step S3, when the Fake Beacon signal is not the desired beacon signal (NO in Step S3), the process returns to Step S1.

  In step S3, the beacon processing unit 43 may determine once whether the Fake Beacon signal is a desired beacon signal. Alternatively, the beacon processing unit 43 determines whether or not the Fake Beacon signal is the desired beacon signal for a predetermined number of times. If the Fake Beacon signal is the desired beacon signal for the predetermined number of times, the beacon processing unit 43 performs the process of step S4. May be performed. It is assumed that an attacker who attempts unauthorized access performs unauthorized access to the AP 40, and even if the access fails, attempts an unauthorized access by brute force using another method. Therefore, if the beacon processing unit 43 executes the process of step S4 when the Fake Beacon signal is a desired beacon signal for a predetermined number of times, the attacker discovers the AP 40. Make it difficult. Therefore, it is possible to further suppress unauthorized access from the attacker.

  In step S4, the AP 40 changes to the True AP operation mode (step S4). Specifically, when the beacon processing unit 43 determines that the Fake Beacon signal is a desired beacon signal, the control unit 44 changes the operation mode of the own device from the Fake STA operation mode to the True AP operation mode.

  Next, the AP 40 transmits a True Beacon signal to the STA 50 (Step S5). Specifically, when the control unit 44 changes the operation mode of the own device to the True AP operation mode, the beacon processing unit 43 creates a True Beacon signal based on the setting information stored in the storage unit 41, and generates a wireless LAN signal. The data is transmitted to the STA 50 via the IF unit 42.

  Next, the AP 40 is in a state of waiting for an Authentication Request transmitted from the STA 50 (step S6). Specifically, when the beacon processing unit 43 transmits a True Beacon signal, the authentication processing unit 45 issues an Authentication Request waiting timer. Then, the authentication processing unit 45 enters a state of waiting for the Authentication Request transmitted from the STA 50, and the authentication processing with the STA 50 is started.

  In step S7, the AP 40 does not receive the Authentication Request in the timer, and when the timer times out (YES in step S7), changes the operation mode to the Fake STA operation mode (step S8). Then, the process returns to step S1. Specifically, when the timer expires without receiving an Authentication Request from the STA 50 in the timer, the authentication processing unit 45 notifies the control unit 44 that the timer has expired. If the control unit 44 does not receive the Authentication Request from the STA 50 in the timer, the control unit 44 determines that the authentication process has failed, and changes the operation mode of the own device to the Fake STA operation mode.

  On the other hand, in step S7, upon receiving the Authentication Request in the timer (NO in step S7), the AP 40 continues the authentication sequence (step S9). Specifically, upon receiving the Authentication Request in the timer, the authentication processing unit 45 continues the authentication sequence for performing the authentication process.

  In step S10, when the authentication sequence with the STA 50 is successful (YES in step S10), the AP 40 performs data communication because the connection with the STA 50 is completed (step S11).

  On the other hand, if the authentication sequence with the STA 50 fails in step S10 (NO in step S10), the AP 40 changes the operation mode to the Fake STA operation mode (step S8). Then, the process returns to step S1. Specifically, when the authentication sequence with the STA 50 fails, the authentication processing unit 45 notifies the control unit 44 that the authentication sequence has failed. The control unit 44 determines that the authentication processing has failed, and changes the operation mode of the own device to the Fake STA operation mode.

  In step S10, the AP 40 may change the operation mode to the Fake STA operation mode when the authentication sequence has failed even once, and may return to step S1 to perform the processing. By doing so, the AP 40 can reduce the number of unit times of attack attempts from the attacker in the authentication sequence. Alternatively, even when the authentication sequence fails once, the AP 40 may retry the authentication sequence up to a predetermined number of times. By doing so, it becomes possible for the AP 40 to secure easy connection with the STA 50.

  When the communication between the AP 40 and the STA 50 is completed, the AP 40 completes the communication with the STA 50 and disconnects the communication with the STA 50 (Step S12). Then, the AP 40 changes the operation mode of the own device to the Fake STA operation mode (step S13), and ends the processing. Specifically, when the communication ends, the control unit 44 changes the operation mode of the own device to the Fake STA operation mode, and ends the processing.

<Operation example of STA>
Subsequently, an operation example of the STA 50 according to the embodiment will be described with reference to FIG. FIG. 5 is a diagram illustrating an operation example of the STA according to the embodiment. The operation example illustrated in FIG. 5 is an operation example that is started after the STA 50 is started and after the STA 50 completes connection and communication with the AP 40.

  First, since the STA 50 is not connected to the AP 40, the STA 50 operates in the Fake AP operation mode, and transmits a Fake Beacon signal to the AP 40 (Step S21). Specifically, the control unit 54 operates in the Fake AP operation mode because the own device is not connected to the AP 40. Further, the beacon processing unit 53 converts the Fake Beacon signal based on the setting information stored in the storage unit 51 using information included in the beacon signal originally transmitted by the AP, such as a source address, SupportedRate, Channel, and ESSID. create. The beacon processing unit 53 transmits the created Fake Beacon signal to the AP 40 via the wireless LAN IF unit 52.

  Next, the STA 50 is in a state of waiting for receiving a True Beacon signal transmitted from the AP 40 (step S22). Specifically, when transmitting the Fake Beacon signal to the AP 40, the beacon processing unit 53 issues a True Beacon signal reception waiting timer and enters a state of waiting for a True Beacon signal transmitted from the AP 40.

  In step S23, when the STA 50 does not receive a True Beacon signal in the timer and the timer expires (YES in step S23), the STA 50 returns to step S21. Specifically, when the beacon processing unit 53 does not receive the True Beacon signal from the AP 40 in the issued timer and the timer expires, the process returns to step S21, where the Fake Beacon signal is created again and the wireless LAN IF The data is transmitted to the AP 40 via the unit 52.

  On the other hand, in step S23, upon receiving the True Beacon signal in the timer (NO in step S23), the STA 50 determines whether the True Beacon signal is a desired beacon signal (step S24). Specifically, upon receiving the True Beacon signal in the timer, the beacon processing unit 53 determines whether the received True Beacon signal is a desired beacon signal. The beacon signal received by the beacon processing unit 53 is a True Beacon signal, which is a beacon signal transmitted by a normal AP. The beacon processing unit 53 determines whether or not the True Beacon signal is a desired beacon signal based on a determination performed by a normal STA.

  In step S24, when the received True Beacon signal is a desired beacon signal (YES in step S24), the STA 50 changes its own operation mode to the True STA operation mode (step S25). Specifically, when the beacon processing unit 53 determines that the received Beacon signal is a desired beacon signal, the beacon processing unit 53 notifies the control unit 54 that the True Beacon signal is the desired beacon signal. Then, the control unit 54 can determine that the AP 40 is the communication target AP and that the AP 40 is operating in the True AP operation mode, and thus changes the operation mode of its own device to the True STA operation mode.

  On the other hand, in step S24, if the received True Beacon signal is not the desired beacon signal (NO in step S24), the STA 50 returns to step S21.

  When the STA 50 changes the operation mode to the True STA operation mode, the STA 50 transmits an Authentication Request to the AP 40 (Step S26), and continues the authentication sequence with the AP 40 (Step S27). Specifically, the authentication processing unit 55 transmits an Authentication Request to the AP 40, starts the authentication processing, and thereafter continues the authentication sequence for performing the authentication processing.

  When the authentication sequence with the AP 40 is successful in step S28 (YES in step S28), the STA 50 performs data communication because the connection with the AP 40 is completed (step S30).

  On the other hand, if the authentication sequence with the AP 40 fails in step S28 (NO in step S28), the STA 50 changes the operation mode to the Fake AP operation mode (step S29). Then, the process returns to step S21. Specifically, when the authentication sequence with the AP 40 fails, the authentication processing unit 55 notifies the control unit 54 that the authentication sequence has failed. The control unit 54 determines that the authentication processing has failed, and changes the operation mode of the own device to the Fake AP operation mode.

  When the communication between the AP 40 and the STA 50 is completed, the STA 50 completes the communication with the AP 40 and disconnects the communication with the AP 40 (Step S31). Then, the STA 50 changes the operation mode of the STA 50 to the Fake AP operation mode (step S32), and ends the processing. Specifically, when the communication ends, the control unit 54 changes the operation mode of the own device to the Fake AP operation mode and ends the processing.

  As described above, when the STA 50 is not connected, the AP 40 operates as a pseudo wireless slave. In this case, since the AP 40 operates as a wireless slave, it does not respond to an AP search from an attacker attempting unauthorized access. Therefore, by using the AP 40, it is possible to make it difficult for an attacker who attempts unauthorized access to recognize the existence of the AP 40. Further, the AP 40 and the STA 50 according to the present embodiment do not perform an encryption process, a calculation of hash information, or the like for each frame, and thus do not perform a process for increasing a processing load. Therefore, according to the present embodiment, it is possible to suppress unauthorized access while suppressing an increase in processing load.

  The AP 40 and the STA 50 use the normal STA-AP communication procedure even when operating in the Fake STA operation mode and the Fake AP operation mode, respectively. Further, as described above, when the AP 40 is operating in the Fake STA operation mode, since it does not respond to the connection request to the AP, it is possible to avoid an AP search from an attacker attempting unauthorized access, and recognize the existence of the AP. It can be difficult. Therefore, according to the present embodiment, it is possible to improve the confidentiality of the AP.

(Other embodiments)
<1> In the above-described embodiment, the description has been given by transmitting the True Beacon signal to the STA 50 when the AP 40 operates in the True AP operation mode. However, the present invention is not limited to this, and the AP 40 may be configured not to transmit the True Beacon signal to the STA 50 when operating in the True AP operation mode. In this case, the beacon processing unit 53 of the STA 50 transmits a Fake Beacon signal to the AP 40 a plurality of times. The control unit 54 of the STA 50 receives the Fake Beacon signal from the beacon processing unit 43 of the AP 40, determines whether or not the beacon signal is the desired beacon signal, and predicts whether the control unit 44 will change to the True AP operation mode. No processing is performed until the time has elapsed. Then, after a lapse of time that the control unit 44 is predicted to change to the True AP operation mode, the control unit 54 of the STA 50 changes the mode to the True STA operation mode so that the authentication processing unit 55 starts the authentication process with the AP 40. You may. Even in this case, the same effect as in the above-described embodiment can be obtained. Note that, in this case, the STA 50 does not wait for the reception of the True Beacon signal, and does not determine whether the True Beacon signal is a desired beacon signal.

  <2> FIG. 6 shows that the wireless communication device 20, the communication terminal 30, the AP 40, and the STA 50 (hereinafter, referred to as the wireless communication device 20 and the like) described in the above embodiment have the following hardware configuration. May be. FIG. 6 is a block diagram illustrating a hardware configuration of a computer (information processing device) capable of realizing the wireless communication device and the like according to each embodiment of the present disclosure.

  Referring to FIG. 6, the wireless communication device 20 and the like include a network interface 1201, a processor 1202, and a memory 1203. Network interface 1201 is used to communicate with another wireless communication device. The network interface 1201 may include, for example, a network interface card (NIC) compliant with the IEEE 802.11 series.

  The processor 1202 reads the software (computer program) from the memory 1203 and executes the software to perform the processing of the wireless communication device 20 and the like described using the flowchart in the above embodiment. The processor 1202 may be, for example, a microprocessor, an MPU (Micro Processing Unit), or a CPU (Central Processing Unit). Processor 1202 may include multiple processors.

  The memory 1203 is configured by a combination of a volatile memory and a nonvolatile memory. The memory 1203 may include storage located away from the processor 1202. In this case, the processor 1202 may access the memory 1203 via an I / O interface (not shown).

  In the example of FIG. 6, the memory 1203 is used to store a software module group. The processor 1202 can perform the processing of the wireless communication device 20 and the like described in the above-described embodiment by reading and executing these software modules from the memory 1203.

  As described with reference to FIG. 6, each of the processors included in the wireless communication device 20 or the like executes one or a plurality of programs including a group of instructions for causing a computer to execute the algorithm described with reference to the drawings.

  In the above example, the program can be stored and supplied to a computer using various types of non-transitory computer readable media. Non-transitory computer readable media include various types of tangible storage media. Examples of non-transitory computer readable media include magnetic recording media (eg, flexible disks, magnetic tapes, hard disk drives), and magneto-optical recording media (eg, magneto-optical disks). Further, examples of the non-transitory computer-readable medium include a CD-ROM (Read Only Memory), a CD-R, and a CD-R / W. Further, examples of the non-transitory computer-readable medium include a semiconductor memory. The semiconductor memory includes, for example, a mask ROM, a PROM (Programmable ROM), an EPROM (Erasable PROM), a flash ROM, and a RAM (Random Access Memory). Also, the program may be supplied to the computer by various types of transitory computer readable media. Examples of transitory computer readable media include electrical signals, optical signals, and electromagnetic waves. The transitory computer-readable medium can supply the program to the computer via a wired communication path such as an electric wire and an optical fiber, or a wireless communication path.

  The present disclosure is not limited to the above embodiment, and can be appropriately modified without departing from the gist. In addition, the present disclosure may be implemented by appropriately combining the embodiments.

Further, some or all of the above-described embodiments can be described as in the following supplementary notes, but are not limited to the following.
(Appendix 1)
When the communication terminal is not connected to its own device, a control unit that operates its own device as a pseudo wireless slave,
A beacon processing unit that receives a beacon signal from the communication terminal and determines whether the beacon signal is a desired beacon signal,
The wireless communication device, wherein the control unit causes the own device to operate as an access point when the beacon signal is a desired beacon signal.
(Appendix 2)
The wireless communication device according to claim 1, wherein the beacon signal is a pseudo beacon signal transmitted from the communication terminal when the communication terminal operates as a pseudo access point.
(Appendix 3)
The wireless communication device according to claim 2, wherein the beacon processing unit transmits another beacon signal for operating the communication terminal as a wireless slave device when the own device is operating as an access point.
(Appendix 4)
When the apparatus itself operates as an access point, the apparatus further includes an authentication processing unit that performs authentication processing with the communication terminal,
The control unit, when any of the case where the authentication process has failed and the case where the communication with the communication terminal has been completed is satisfied, operates the own device as a pseudo wireless slave device, 2. The wireless communication device according to claim 1.
(Appendix 5)
The wireless communication device according to claim 4, wherein the authentication processing unit does not perform an authentication process with the communication terminal when the own device operates as a pseudo wireless slave.
(Appendix 6)
The beacon processing unit receives a plurality of the beacon signals, for each of the plurality of beacon signals, determines whether the beacon signal is a desired beacon signal,
The wireless communication device according to any one of supplementary notes 1 to 5, wherein the control unit, when the predetermined number of the beacon signals is a desired beacon signal, causes the device to operate as an access point.
(Appendix 7)
The beacon processing unit determines that the beacon signal is a desired beacon signal when at least an SSID (Service Set IDentifier) of information included in the beacon signal matches a desired value. 7. The wireless communication device according to any one of 6.
(Appendix 8)
If the communication terminal is not connected to its own device, operate its own device as a pseudo wireless slave,
While receiving a beacon signal from the communication terminal, determine whether the beacon signal is a desired beacon signal,
When the beacon signal is a desired beacon signal, the wireless communication method operates the own device as an access point.
(Appendix 9)
If the communication terminal is not connected to its own device, to operate its own device as a pseudo wireless handset,
While receiving a beacon signal from the communication terminal, determining whether the beacon signal is a desired beacon signal,
If the beacon signal is a desired beacon signal, a wireless communication program for causing a computer to operate the own device as an access point.
(Appendix 10)
Including a wireless communication device and a communication terminal,
The wireless communication device,
When the communication terminal is not connected to the own device, a first control unit that operates the own device as a pseudo wireless slave device;
A first beacon processing unit that receives a first beacon signal from the communication terminal, and determines whether the first beacon signal is a desired beacon signal,
The communication terminal,
A second controller configured to operate the own device as a pseudo access point when the own device is not connected to the wireless communication device;
A second beacon processing unit that transmits the first beacon signal to the wireless communication device,
The first control unit, when the first beacon signal is a desired beacon signal, operates its own device as an access point,
A wireless communication system, wherein the second control unit causes its own device to operate as a wireless handset when transmitting the first beacon signal or receiving a second beacon signal from the wireless communication device.
(Appendix 11)
The wireless communication system according to claim 10, wherein the beacon signal is a pseudo beacon signal transmitted from the communication terminal when the communication terminal operates as a pseudo access point.

10, 100 wireless communication system 20 wireless communication device 21, 31, 44, 54 control unit 22, 32, 43, 53 beacon processing unit 30 communication terminal 40 AP
41, 51 storage unit 42, 52 wireless LAN IF unit 45, 55 authentication processing unit 50 STA

Claims (10)

When the communication terminal is not connected to its own device, a control unit that operates its own device as a pseudo wireless slave,
A beacon processing unit that receives a beacon signal from the communication terminal and determines whether the beacon signal is a desired beacon signal,
The wireless communication device, wherein the control unit causes the own device to operate as an access point when the beacon signal is a desired beacon signal.   The wireless communication device according to claim 1, wherein the beacon signal is a pseudo beacon signal transmitted from the communication terminal when the communication terminal operates as a pseudo access point.   The wireless communication device according to claim 2, wherein the beacon processing unit transmits another beacon signal for operating the communication terminal as a wireless handset when the own device operates as an access point. When the apparatus itself operates as an access point, the apparatus further includes an authentication processing unit that performs authentication processing with the communication terminal,
4. The control unit according to claim 1, wherein when the authentication process fails or when communication with the communication terminal is completed, the control unit operates the own device as a pseudo wireless slave. 5. The wireless communication device according to claim 1.   The wireless communication device according to claim 4, wherein the authentication processing unit does not perform an authentication process with the communication terminal when the own device operates as a pseudo wireless slave. The beacon processing unit receives a plurality of the beacon signals, for each of the plurality of beacon signals, determines whether the beacon signal is a desired beacon signal,
The wireless communication device according to any one of claims 1 to 5, wherein the control unit causes the device to operate as an access point when the predetermined number of the beacon signals is a desired beacon signal.   The beacon processing unit determines that the beacon signal is a desired beacon signal when at least an SSID (Service Set IDentifier) of information included in the beacon signal matches a desired value. The wireless communication device according to any one of claims 1 to 6. If the communication terminal is not connected to its own device, operate its own device as a pseudo wireless slave,
While receiving a beacon signal from the communication terminal, determine whether the beacon signal is a desired beacon signal,
When the beacon signal is a desired beacon signal, the wireless communication method operates the own device as an access point. If the communication terminal is not connected to its own device, to operate its own device as a pseudo wireless handset,
While receiving a beacon signal from the communication terminal, determining whether the beacon signal is a desired beacon signal,
When the beacon signal is a desired beacon signal, a wireless communication program for causing a computer to operate the own device as an access point. Including a wireless communication device and a communication terminal,
The wireless communication device,
When the communication terminal is not connected to the own device, a first control unit that operates the own device as a pseudo wireless slave device;
A first beacon processing unit that receives a first beacon signal from the communication terminal, and determines whether the first beacon signal is a desired beacon signal,
The communication terminal,
A second controller configured to operate the own device as a pseudo access point when the own device is not connected to the wireless communication device;
A second beacon processing unit that transmits the first beacon signal to the wireless communication device,
The first control unit, when the first beacon signal is a desired beacon signal, operates its own device as an access point,
A wireless communication system, wherein the second control unit causes its own device to operate as a wireless handset when transmitting the first beacon signal or receiving a second beacon signal from the wireless communication device.

Images