JP2023000990A - Wips sensor and method for blocking intrusion of unauthorized wireless terminal using wips sensor - Google Patents

Abstract

To provide a WIPS (Wireless Intrusion Prevention System) sensor and a method for blocking intrusion of an unauthorized wireless terminal using the WIPS sensor.SOLUTION: A method for blocking intrusion of an unauthorized wireless terminal using a WIPS sensor includes: collecting packets transmitted in real time from an AP (access point); collecting packets transmitted in real time from at least one wireless terminal that is connected to the AP and performing wireless communication; if the wireless terminal that has transmitted the packets is determined to be an unauthorized wireless terminal as a result of analysis of the packets received from the at least one wireless terminal, generating a fake probe response message for inducing channel change of the unauthorized wireless terminal; and transferring the generated fake probe response message.SELECTED DRAWING: Figure 6

Description

The present invention relates to a WIPS (Wireless Intrusion Prevention System) sensor and an unauthorized wireless terminal intrusion blocking method using a WIPS (Wireless Intrusion Prevention System) sensor in communications to which a PMF (Protected Managed Frame) is applied.

In general, the Internet is an open network configured so that anyone can freely connect and use it by applying a common protocol called TCP/IP to a computer that they want to connect to anywhere in the world. Along with the development of compression technology, it is also used to distribute multimedia information, and various services such as e-mail, file transfer, and WWW (World Wide Web) can be used.

The use of the Internet is rapidly increasing not only in Japan but also worldwide, and its importance as a strategic tool for improving efficiency and productivity is rapidly increasing in conventional industries. As a result, not only are new business opportunities continuously created through the Internet, but the scope of these opportunities is also expanding, and the number of business operators using the Internet is increasing.

The dedicated network is preferably closed to the outside in order to block various external intrusions such as hacking (hereinafter referred to as "intrusion") for information security. There is also a need to hierarchize and manage access to terminal information even within a dedicated network. Therefore, various security technologies have been developed, supplemented, and continue to evolve.

In addition, with the development of wireless technology, a wireless LAN that allows wireless connection to a network has appeared. A wireless LAN allows a wireless terminal to be easily connected to a network via a wireless LAN access point (AP, hereinafter referred to as "AP") without a complicated line connection process. This has made it possible for wireless terminal users to connect to the network very easily, but the security of the network has been greatly reduced. This means that private networks operated in a closed fashion may be exposed to various risks. Therefore, a system for blocking intrusion in a wireless environment (Wireless Intrusion Prevention System: WIPS, hereinafter referred to as "WIPS") has been developed.

Wireless LAN technology based on IEEE 802.11 is widely used in homes, businesses, and public lines because it enables inexpensive and rapid use of networks without connecting terminals to wires. In particular, notebook computers, smart phones, and tablets equipped with wireless LAN cards are widely used, and users can enjoy games, web surfing, and news through the Internet at any place and time in their daily lives. ), social services, etc. became available. In addition, users are now able to utilize various forms of Internet-based application services, such as easily sending and receiving e-mails, through the Internet at any place and time in their daily lives. In addition, high-speed technologies such as 802.11n and 802.11ac and wireless LAN technologies with enhanced security such as 802.11i and 802.11w have appeared, making it possible to use safer and more convenient wireless LAN technologies. is now possible.

However, even with the application of security-enhancing techniques to wireless LANs, vulnerabilities still exist due to their wireless nature. Unlike wired technologies, wireless technologies allow everyone to access the network, and because it is difficult to locate the actual physical location of network attachment points, various forms of attacks such as address spoofing, eavesdropping, and packet spoofing are possible. exposed to the

In this way, wireless LANs provided by homes, companies, and public lines are subject to various attacks and intrusions, and representative examples include unauthorized APs, denial of service attacks, and insider attacks. .

The WIPS functions to detect packets generated between an AP and a wireless station (Station), determine whether the connection is illegal according to a security policy defined by the user, and block the connection.

However, in the recently announced WPA3 encrypted environment in the Wi-Fi6 environment, it is essential to apply PMF (Protected Managed Frame) based on 802.11w, so the deauthentication frame and connection of conventional WIPS products There is a limit to connection control between an AP and a wireless terminal via a disassociation frame.

Therefore, Patent Document 1 (title of the invention: WIPS sensor, hereinafter referred to as "prior art") has been proposed as a technique for overcoming the limitation of control by applying such PMF. The conventional technique is a method of generating a fake beacon to make the wireless terminal recognize the channel change of the AP. However, since the channel change signal using the fake beacon packet is a broadcasting transmission method, it is received by all the wireless terminals in the vicinity, and the connection to the unauthorized wireless terminal to be blocked connected to the AP is blocked. There is a problem that both the connection to the normally connected permitted terminal and the connection to the permitted terminal are blocked. In addition, separate storage and management for PMF APs is required since all connections are blocked and controlled based on the AP using such PMF.

Korean Patent No. 10-2102835

It is an object of the present invention to separately control connections to unauthorized wireless terminals connected to APs based on PMF and connections to authorized terminals that are normally connected, eliminating separate storage and management points for PMF APs. It is another object of the present invention to provide a WIPS sensor capable of improving the WIPS blocking performance and a method of blocking unauthorized wireless terminals using the WIPS sensor.

Another object of the present invention is to provide a WIPS sensor capable of efficiently controlling unauthorized wireless terminals by blocking connection only to unauthorized wireless terminals connected to an AP based on PMF, and the WIPS sensor. The object is to provide a method for blocking an intrusion of an illegal wireless terminal used.

The characteristic configuration of the present invention for achieving the object of the present invention as described above and achieving the effects peculiar to the present invention, which will be described later, is as follows.

According to one embodiment of the present invention, a WIPS sensor receives packets transmitted in real time from an AP (Access Point), and transmitted in real time from at least one wireless terminal connected to the AP and communicating wirelessly. a communication unit that receives packets; a memory that stores packets received from the AP and wireless terminals; an information analysis unit that analyzes packets received from the at least one wireless terminal; an unauthorized terminal determination unit for determining whether or not the transmitted wireless terminal is an unauthorized wireless terminal; a fake terminal for inducing a channel change of the unauthorized wireless terminal when it is determined to be an unauthorized wireless terminal as a result of the determination; a message generating unit for generating a probe response message; and an unauthorized terminal blocking processing unit for processing to transfer the generated fake probe response message through the communication unit.

Preferably, the information analysis unit analyzes a packet received from the AP or at least one wireless terminal and determines whether or not a PMF (Protected Managed Frame) is applied, and the unauthorized terminal determination unit analyzes the PMF It is determined whether or not the wireless terminal to which is applied is an unauthorized wireless terminal.

Preferably, the unauthorized terminal determination unit determines whether or not the at least one wireless terminal is an unauthorized wireless terminal based on unauthorized device information and security policy information received from the WIPS server.

Preferably, the fake probe response message includes address information for the unauthorized wireless terminal as destination information.

Preferably, the fake probe response message includes information instructing the unauthorized wireless terminal to change to a channel other than the channel currently connected.

Preferably, the message generation unit generates a fake deauthentication message for deauthentication of the unauthorized wireless terminal, and the unauthorized terminal blocking processing unit sends the generated fake deauthentication message to the AP through the communication unit. processed to be forwarded to

Preferably, the message generation unit generates a fake connection cancellation message for disconnection to the unauthorized wireless terminal, and the unauthorized terminal blocking processing unit transmits the generated fake connection cancellation message to the communication unit. Process so that it is forwarded to unauthorized wireless terminals.

According to another embodiment of the present invention, a method for blocking an unauthorized wireless terminal intrusion using a WIPS sensor includes collecting packets transmitted in real time from an access point (AP); Collecting packets transmitted in real time from at least one wireless terminal that wirelessly communicates; and analyzing the packets received from the at least one wireless terminal to determine that the wireless terminal that transmitted the packet is an unauthorized wireless terminal. If so, generating a fake probe response message for inducing a channel change of the unauthorized wireless terminal; and transmitting the generated fake probe response message.

Preferably, the method further includes analyzing packets received from the AP or the at least one wireless terminal and determining whether protected managed frames (PMFs) are applied. It is determined whether or not the wireless terminal detected is an unauthorized wireless terminal.

Preferably, the method further comprises determining whether the at least one wireless terminal is a rogue wireless terminal based on rogue device information and security policy information received from a WIPS server.

Preferably, the fake probe response message includes address information for the unauthorized wireless terminal as destination information.

Preferably, the fake probe response message includes information instructing the unauthorized wireless terminal to change to a channel other than the channel currently connected.

Preferably, the method further includes generating a fake deauthentication message for deauthentication of the unauthorized wireless terminal, and forwarding the generated fake deauthentication message to the AP.

Preferably, the method further includes generating a fake disconnection message for disconnection to the unauthorized wireless terminal, and forwarding the generated fake disconnection message to the unauthorized wireless terminal. .

The information for receiving the provision of the method of blocking intrusion of unauthorized wireless terminals using the WIPS sensor can be stored in a readable recording medium in the server computer. These recording media include all types of recording media on which programs and data are stored in a manner readable by a computer system. Examples include ROM (Read Only Memory), RAM (Random Access Memory), CD (Compact Disk), DVD (Digital Video Disk)-ROM, magnetic tape, floppy disk, and optical data storage device. It also includes being embodied in the form of a carrier wave (eg transmission over the Internet). These recording media can also be distributed over network coupled computer systems so that the computer readable code is stored and executed in a distributed fashion.

As described above, according to the present invention, a fake probe response (Fake Probe Response) message that induces an unauthorized wireless terminal to individually change a channel, and a fake disconnect (Fake Disassociate) message that prevents reconnection after a channel change. , Distinguish and individually control normal wireless terminals and unauthorized wireless terminals connected to an AP using PMF by transferring a fake deauthentication message that induces confirmation and disconnection of the AP. There are advantages that can be

In addition, according to the present invention, a method is provided that can be used for all connections regardless of whether or not PMF is used. It has the effect of improving sexuality.

1 is a block diagram showing the configuration of an unauthorized wireless terminal blocking system according to an embodiment of the present invention; FIG. 1 is a block diagram showing the detailed configuration of a WIPS sensor according to an embodiment of the present invention; FIG. FIG. 4 is a signal flow chart illustrating a connection procedure between an AP and a wireless terminal according to an embodiment of the present invention; FIG. 4 is a signal flow chart illustrating a security connection verification procedure between an AP and a wireless terminal using PMF according to an embodiment of the present invention; FIG. 4 is a diagram showing an example of a beacon frame transmitted from an AP; 4 is a flow chart of signals for blocking unauthorized wireless terminals using a WIPS sensor according to an embodiment of the present invention; FIG. 4 is a diagram showing an example of a beacon frame according to an embodiment of the present invention; FIG. It is a figure which shows an example of the fake probe response frame concerning embodiment of this invention. FIG. 4 is a diagram showing an example of a fake deauthentication frame for SA query induction and reconnection prevention according to an embodiment of the present invention; FIG. 10 illustrates an example of a fake disconnection frame for preventing reconnection according to an embodiment of the present invention;

DETAILED DESCRIPTION OF THE INVENTION The following detailed description of the invention refers to the accompanying drawings, which show, by way of illustration, specific embodiments in which the invention may be practiced. These embodiments are described in sufficient detail to enable those skilled in the art to practice the invention. It should be understood that various embodiments of the invention are different from each other and need not be mutually exclusive. For example, specific shapes, structures and features described herein with respect to one embodiment may be implemented in other embodiments without departing from the spirit and scope of the invention. Additionally, it is to be understood that the location or arrangement of individual components in each disclosed embodiment may be changed without departing from the spirit and scope of the invention. Therefore, the detailed description set forth below is not to be taken in a limiting sense, and the scope of the invention, so far as properly described, is defined in addition to the full range of equivalents claimed by the claims. limited only by the claims of: Like reference numbers in the figures refer to the same or similar features throughout some aspects.

The present invention separately controls the connection of rogue wireless terminals connected to APs based on PMF and the connections of authorized terminals that are normally connected, eliminating separate storage and management points for PMF APs. A WIPS sensor capable of improving WIPS blocking performance and an unauthorized wireless terminal intrusion blocking method using the WIPS sensor are provided.

Furthermore, the embodiments of the present invention can efficiently control unauthorized wireless terminals by blocking connections only to unauthorized wireless terminals connected to the AP based on the PMF.

The embodiment of the present invention, which will be described later, separately controls the connection of an unauthorized wireless terminal connected to such a PMF AP and the connection of a normally connected authorized terminal, and connects based on the PMF. It eliminates a separate storage and management point for the AP and improves blocking performance of WIPS. For the above purposes, embodiments of the present invention provide a WIPS sensor that generates a Fake Probe Response message that individually induces a channel change for a wireless terminal, a Fake Connection that prevents reconnection after a channel change, Transfer a Fake Disassociate message, a fake deauthentication message that induces confirmation and disconnection of the AP, distinguishes between normal wireless terminals and unauthorized wireless terminals connected to the AP using PMF, Can be controlled individually.

FIG. 1 is a block diagram showing the configuration of an unauthorized wireless terminal blocking system according to an embodiment of the present invention. Referring to FIG. 1, a system according to an embodiment of the present invention includes a WIPS sensor 100, a WIPS server 110, an AP 120, a plurality of wireless terminals 130 (eg, first wireless terminal 130-1, second wireless terminal 130-2). , n-th wireless terminals 130-n).

According to one embodiment, the WIPS sensor 100 monitors packets transmitted and received from the AP 120 and the wireless terminal 130, and based on the information about the unauthorized wireless terminal or the information about the security policy provided by the WIPS server 110, detects the unauthorized wireless terminal. can perform functions to block WIPS server 110 can provide WIPS sensor 100 with information about rogue wireless terminals or whenever security policies change. The WIPS sensor 100 can block unauthorized wireless terminals based on updated information received from the WIPS server 110 .

The wireless terminal 130 can include various devices capable of exchanging data via the AP 120, such as a notebook computer equipped with a wireless LAN and a smart phone. WIPS sensor 100 can detect data packets wirelessly transmitted to wireless terminal 130 via AP 120 . The WIPS sensor 100 and AP 120 can be connected by wire. Here, the AP 120 may consist of one or more. A data packet may refer to a unit of information sent as a block from one device to another over a communication line. Here, the data packet contains various element fields such as Service Set Identifier (SSID), supported speed, timestamp, display interval, capacity information, channel, and so on.

Data packets detected by the WIPS sensor 100 can be transmitted to a WIPS server 110 . At this time, the WIPS sensor 100 can transmit the data packet detected through the communication unit to the WIPS server 110 . The WIPS sensor 100 or WIPS server 110 analyzes data packets transmitted and received from the AP 120 or data packets transmitted and received from the at least one wireless terminal 130 to determine whether the at least one wireless terminal 130 is an unauthorized wireless terminal. can determine whether Detailed functions of the WIPS sensor 100 will be described later with reference to FIG.

FIG. 2 is a block diagram showing the detailed configuration of the WIPS sensor according to the embodiment of the invention. Referring to FIG. 2, the WIPS sensor 100 includes a communication unit 210, a control unit 220, and a memory 230. FIG. The control unit 220 includes a packet monitoring unit 221 , an information analysis unit 222 , an unauthorized terminal determination unit 223 , a message generation unit 224 and an unauthorized terminal blocking processing unit 225 .

According to one embodiment, the packet monitor 221 can collect packets in the wireless network in real time through the communication unit 210 . For example, the packet monitoring unit 221 can collect packets transmitted from at least one wireless terminal 130 to the AP 120 and can collect packets transmitted to at least one wireless terminal 130 via the AP 120 .

The information analysis unit 222 can analyze each data packet collected through the packet monitoring unit 221 by an analysis means. The information analyzer 222 can analyze wireless network packets and obtain information about the AP 120 and the wireless terminal 130 . For example, the information of the AP 120 acquired by the information analysis unit 222 includes the AP's BSSID (Basic Service Set ID), SSID (Service Set ID), channel, and whether or not PMF is used through beacon packets continuously emitted by the AP 120. , encryption information, MAC (Medium Access Control) address, etc. The information of the wireless terminal 130 acquired by the information analysis unit 222 includes the BSSID of the wireless terminal, the MAC (Medium Access Control) address, the SSID of the connected AP, the BSSID of the connected AP, and the like.

The information analysis unit 222 may store the analyzed information in the memory 230 . Also, the WIPS sensor 100 may transmit information analyzed by the information analysis unit 222 to the WIPS server 110 .

The unauthorized terminal judging unit 223 retrieves detection information periodically stored in the memory 230, pre-stored unauthorized device information, authorized device information, and security policy information, and compares them to determine unauthorized wireless communication for each wireless terminal. The presence or absence of a terminal can be determined. The unauthorized device information, authorized device information, and security policy information can be delivered in real time from the WIPS server 110 via the communication unit 210 and stored in the memory 230 .

If at least one wireless terminal 130 is determined to be an unauthorized wireless terminal as a result of the determination by the unauthorized terminal determining unit 223, an operation for blocking the unauthorized wireless terminal can be performed.

The message generator 224 can generate a message for blocking the unauthorized wireless terminal according to the embodiment of the present invention. For example, the message generator 224 can generate a Fake Probe Response message to guide an unauthorized wireless terminal to change channels. In addition, the message generation unit 224 can generate a fake disassociation message for preventing reconnection from the AP 120 by camouflaging the MAC. In addition, the message generation unit 224 forges the MAC of the wireless terminal and deauthenticates the fake authentication ( (Fake Deauthentication) messages can be generated.

The message generator 224 can designate the source address, receiving address or destination address of each generated message or packet as the relevant unauthorized wireless terminal 130 or AP 120 . By doing so, the message is transmitted only to the wireless terminals and APs to be blocked, and peripheral wireless connection devices are not affected. Therefore, the WIPS sensor 100 can transmit messages regardless of whether each wireless terminal or AP 120 uses PMF or a general connection that does not use PMF.

The unauthorized terminal blocking processing unit 225 transmits the message generated by the message generating unit 224 to the unauthorized wireless terminal 130 or AP 120 through the communication unit 210 in real time or periodically, thereby blocking the unauthorized terminal. .

FIG. 3 is a signal flow chart illustrating a connection procedure between an AP and a wireless terminal according to an embodiment of the present invention. Referring to FIG. 3, AP 120 may broadcast a beacon signal to wireless terminals 130 (step 302). The beacon signal is a broadcast signal whose destination is not specified. For example, the frame of the beacon signal can be configured as shown in FIG.

FIG. 5 is a diagram showing an example of a beacon frame transmitted from an AP. Referring to FIG. 5, as shown in the figure, the receiver address or destination address is set to be broadcast and set so that the address is not specified (for example, "ff:ff:ff:ff: ff:ff:ff"). This allows beacon frames to be received from all wireless terminals within the area where AP 120 is located. In addition, when a beacon frame is transmitted as a fake beacon frame in order to block an unauthorized wireless terminal according to the conventional technology, connection is blocked not only to the unauthorized wireless terminal but also to all normal wireless terminals that receive the beacon frame. can.

According to one embodiment, the wireless terminal 130 receiving the beacon signal may forward a probe request message to the AP 120 to retrieve AP information (step 304). The AP 120 may receive a probe request message from the wireless terminal 130 and forward a probe response message to the wireless terminal 130 (step 306).

According to one embodiment, a wireless terminal 130 that successfully receives the probe response message can send an authentication request message to the AP 120 (step 308). The AP 120 that has received the authentication request message can authenticate the wireless terminal 130 . The authentication may include relatively low-level authentication (eg, Open, WEP-based authentication). Upon successful completion of authentication, AP 120 may forward an authentication result message to wireless terminal 130 (step 310).

According to one embodiment, the wireless terminal 130, having successfully completed the authentication and having received the authentication result message, may forward an association request message to the AP 120 (step 312). The AP 120 may receive an association request message from the wireless terminal 130 and forward an association response message to the wireless terminal 130 (step 314).

Thus, once a connection is established between the wireless terminal 130 and the AP 120, the wireless terminal 130 and the AP 120 each exchange encryption keys to provide a relatively high level of authentication (e.g., WPA/ WPA2), WPA3, or authentication based on 802.1X) can be performed (step 316).

Once the high-level authentication is completed, the wireless terminal 130 and AP 120 can transmit data to and receive data from each other (step 318). For example, wireless terminal 130 can transfer data to an external network via AP 120 and receive data transferred from the external network via AP 120 .

In addition, in the high-level authentication stage, if WPA 3 encryption in Wi-Fi 6 environment is supported, Protected Managed Frame (PMF) based on 802.11w may be mandatory.

FIG. 4 is a signal flow diagram illustrating a security connection verification procedure between an AP and a wireless terminal using PMF according to an embodiment of the present invention. Referring to FIG. 4, a connection can be set up between wireless terminal 130 and AP 120 via PMF (step 402), as described in FIG. 3 above.

Also, the WIPS sensor 100 may transfer a deauthentication message to the AP 120 to block unauthorized wireless terminals (step 404). The deauthentication message forwarded to the AP 120 may be a deauthentication message for wireless terminals that do not apply to PMF. Also, the WIPS sensor 100 may forward a deauthentication message to the wireless terminal 130 to block unauthorized wireless terminals (step 406). The deauthentication message forwarded to the wireless terminal 130 may be a deauthentication message for wireless terminals that do not apply to PMF.

Upon receiving the deauthentication message, the AP 120 may send an encrypted Security Association (SA) query to the wireless terminal 130 to confirm whether to deauthenticate the wireless terminal 130 (step 408). ). Upon receiving the encrypted SA query, the wireless terminal 130 may forward an SA Query Response message to the AP 120 (step 410). That is, the AP 120 and the wireless terminal 130 to which the PMF is applied can perform an authentication procedure by a normal SA query by receiving the deauthentication message to which the PMF is not applied from the WIPS sensor 100 . Accordingly, even if a deauthentication message is received from the WIPS sensor 100 between the wireless terminal 130 and the AP 120, a normal data frame is transmitted/received through the PMF (step 412).

FIG. 6 is a flow chart of signals for blocking unauthorized wireless terminals using a WIPS sensor according to an embodiment of the present invention. The procedure of FIG. 6, described below, can be performed via WIPS sensor 100, AP 120, and wireless terminal 130 of FIGS. 1 and 2 described above. Referring to FIG. 6, AP 120 can broadcast beacon signals to wireless terminals 130 . A beacon signal broadcast in the AP 120 can be configured in the form of FIG. 5 described above.

According to one embodiment, the beacon signal is broadcast to all wireless terminals in the area without targeting a specific wireless terminal. Therefore, the beacon signal broadcast from AP 120 is received not only by authorized wireless terminals but also by unauthorized wireless terminals 130b. In the description that will be given later, the wireless terminal that has been authorized will be referred to as an authorized wireless terminal 130a. As described in FIG. 3, the authorized wireless terminal 130a normally performs procedures such as probe request, probe response, authentication, association request, association response, and encryption key exchange with the AP 120 to transmit and receive data with the AP 120. Yes (steps 604, 606, 608). Similarly, the unauthorized wireless terminal 130b normally performs procedures such as probe request, probe response, authentication, association request, association response, and encryption key exchange with AP 120 as described in FIG. can be sent and received (step 610). For convenience of explanation, it is assumed that the authorized wireless terminal 130a and unauthorized wireless terminal 130b are connected to AP 120 and channel .

According to one embodiment, WIPS sensor 100 can collect and store data packets sent and received from AP 120, authorized wireless terminals 130a, and unauthorized wireless terminals 130b.

According to one embodiment, the packet monitor 221 can collect packets in the wireless network in real time through the communication unit 210 . For example, the packet monitoring unit 221 can collect packets transmitted from at least one wireless terminal 130 to the AP 120 and can collect packets transmitted to the at least one wireless terminal 130 via the AP 120 . According to one embodiment, the WIPS sensor 100 receives a beacon packet continuously emitted by the AP, and detects the AP's BSSID (Basic Service Set ID), SSID (Service Set ID), channel, whether PMF is used, You can check encryption information, MAC (Medium Access Control) address, etc. Also, the WIPS sensor 100 receives data packets transmitted and received from each of the wireless terminals 130a and 130b, and detects the BSSID of the wireless terminal, the MAC (Medium Access Control) address, the SSID of the connected AP, the BSSID of the connected AP, and the BSSID of the connected AP. etc. can be checked.

According to one embodiment, the WIPS sensor 100 can check whether PMF is used through a beacon frame transmitted from the AP 120 .

FIG. 7 is a diagram showing an example of a beacon frame according to an embodiment of the invention. For example, referring to FIG. 7, setting information (eg, 'True') of PMF-related information (eg, 'Management Frame Protection Required' or 'Management Frame Protection Capable') included in the beacon frame is checked, and the Whether or not the beacon frame transmitted from the AP 120 uses PMF can be confirmed.

According to one embodiment, the WIPS sensor 100 can collect and analyze packets originating on the channel 116 to determine whether each wireless terminal 130a, 130b is fraudulent or authorized. That is, the WIPS sensor 100 can analyze data packets transmitted and received from the AP 120, the authorized wireless terminal 130a, and the unauthorized wireless terminal 130b, and detect that the unauthorized wireless terminal 130b is an unauthorized wireless terminal.

When the WIPS sensor 100 detects that the unauthorized wireless terminal 130b is an unauthorized wireless terminal, the WIPS sensor 100 can perform various procedures to disconnect the unauthorized wireless terminal 130b according to the embodiment of the present invention. .

For example, if the unauthorized wireless terminal 130b is an unauthorized wireless terminal, the WIPS sensor 100 generates a fake probe response message regardless of whether PMF is used with the AP 120, and generates a fake probe response message. A probe response message may be forwarded to the rogue wireless terminal 130b (step 612). The fake probe response message may be a message instructing unauthorized wireless terminal 130b to change channels.

The WIPS sensor 100 sets the source address of the fake probe response message as the AP 120 and sets the destination address as the unauthorized wireless terminal 130b, so that the fake probe response message is sent to the unauthorized wireless terminal 130b. can only be forwarded to For example, the WIPS sensor 100 can impersonate the MAC address of the AP 120, generate a probe response message, and then persistently transfer the generated fake probe response message to the unauthorized wireless terminal 130b.

FIG. 8 is a diagram showing an example of a fake probe response frame according to the embodiment of the invention. Referring to FIG. 8, the fake probe response message can be sent by setting a receiver address, a destination address, a transmitter address, and a source address. Additionally, the fake probe response message may further include information instructing to change channels. For example, by setting the information on "Channel Switch Announcement Mode" to "144", it is possible to instruct the unauthorized wireless terminal 130b connected to the current channel 116 to change to channel 144.

The unauthorized wireless terminal 130b can receive the fake probe response message forwarded from the WIPS sensor 100 and recognize the probe response message forwarded from the AP 120 normally. The unauthorized wireless terminal 130b confirms the channel change-related information included in the fake probe response message, changes its own channel from channel 116 to channel 144, and then waits for the channel change of AP 120 for a certain period of time. Yes (step 614). Although the channel of the unauthorized wireless terminal 130b was changed to the channel 144 by the fake probe response message, the channel of the AP 120 was not changed, so normal data communication was performed between the AP 120 and the unauthorized wireless terminal 130b. sometimes not.

Also, according to an embodiment of the present invention, the WIPS sensor 100 can generate a fake deauthentication message with the MAC address of the unauthorized wireless terminal 130b as a fake deauthentication message and send it to the AP 120 (step 616). A fake deauthentication message generated by the WIPS sensor 100 can be persistently sent to the AP 120 .

FIG. 9 is a diagram showing an example of a fake deauthentication frame for SA query induction and reconnection prevention according to an embodiment of the present invention. In FIG. 9, the fake deauthentication message can set the recipient address as the address of AP 120 (eg, the MAC address of AP 120) and the sender address as the address of unauthorized wireless terminal 130b.

When the AP 120 that receives the fake deauthentication message is an AP that uses PMF, the AP 120 that receives the fake deauthentication message determines whether the fake deauthentication message is a message delivered from the unauthorized wireless terminal 130b. An SA query can be sent to the rogue wireless terminal 130b to see if it is (step 618).

Note that the unauthorized wireless terminal 130b is in a state where the channel has been changed from the channel 116 to the channel 144 by the fake probe response message transferred from the WIPS sensor 1000. Unable to respond (step 620).

Since the AP 120 cannot normally receive a response to the transmission of the SA query, it can terminate the connection with the unauthorized wireless terminal 130b (step 622). That is, since there is no response from the unauthorized wireless terminal 130b, the AP 120 receives the fake deauthentication message transferred from the WIPS sensor 100 so that the unauthorized wireless terminal 130b receives the normal deauthentication by reconnection (power on/off). and terminate the connection with the unauthorized wireless terminal 130b (step 622).

If the AP 120 is an AP that does not use PMF, the unauthorized wireless terminal 130b receives the fake deauthentication message transferred from the WIPS sensor 100 without a separate confirmation procedure (for example, a confirmation procedure based on the SA query transmission). be recognized as a normal deauthentication message forwarded from

In addition, the unauthorized wireless terminal 130b is not connected to the AP 120 even after waiting for a certain period of time on the changed channel 144, performs a wireless channel scanning operation for reconnection, and then accesses the AP 120 via the previously connected channel 116. and a reconnection attempt can be made (step 624).

According to one embodiment, the WIPS sensor 100 can generate and forward a fake dissociate message to the rogue wireless terminal 130b to prevent the rogue wireless terminal 130b from attempting to reconnect to the AP 120. FIG. For example, the source address of the disconnect message can be forged to be the address of AP 120 (eg, the MAC address of AP 120) and the recipient address can be forged to be the rogue wireless terminal 130b to generate a fake disconnect message. The WIPS sensor 100 can persistently forward the generated fake disconnect message to the rogue wireless terminal 130b via channel 116. FIG.

FIG. 10 is a diagram illustrating an example of a fake disconnection frame for preventing reconnection according to an embodiment of the present invention. Referring to FIG. 10, the WIPS sensor 100 can set the sender address as the address of the AP 120 and set the recipient address as the address of the unauthorized wireless terminal 130b to generate a fake disconnection message.

The unauthorized wireless terminal 130b can recognize the fake disconnection message forwarded from the WIPS sensor 100 as a normal disconnection message forwarded from the AP 120 and permanently disconnect from the channel 116. FIG.

That is, as shown in FIG. 6, the WIPS sensor 100 can block the connection by causing the unauthorized wireless terminal 130b to change channels via the fake probe response message. The WIPS sensor 100 then forwards a fake de-authentication message to the AP 120 to terminate the connection between the AP 120 and the rogue wireless terminal 130b even when using PMF. In addition, in order to block the unauthorized wireless terminal 130b from attempting to connect again, the connection of the unauthorized wireless terminal 130b is continuously blocked by transferring a fake deauthentication message to the unauthorized wireless terminal 130b over the channel. be able to.

By the above procedure, the connection of the authorized wireless terminal 130a is not affected at all, and the connection to the illegal wireless terminal 130b can be cut off individually and completely.

Meanwhile, embodiments according to the present invention can be embodied in the form of program instructions that can be executed through various computer means and recorded on computer-readable media. The computer-readable media may include program instructions, data files, data structures, etc. singly or in combination. The program instructions recorded on the medium may be those specially designed and constructed for the purposes of the present invention, or they may be of the kind known and available to those having skill in the computer software arts. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tapes, optical recording media such as CD-ROMs and DVDs, optical disks, and floptical disks. and magneto-optical media, and hardware devices specially configured to store and execute program instructions, such as ROM (ROM), RAM (RAM), and flash memory. Examples of program instructions include not only machine language code, such as produced by a compiler, but also high-level language code, such as that which can be executed by a computer using an interpreter. The hardware devices described above may be configured to act as one or more software modules, as well as their roles, to carry out the operations of the present invention.

While the present invention has been described in terms of specifics, such as specific components, etc., and limited embodiments and drawings, this is provided to aid in a more general understanding of the invention. Rather, the invention is not limited to the embodiments described above. Various modifications and variations can be made from these descriptions by those who have general knowledge in the field to which the present invention belongs.

Therefore, the spirit of the present invention is not limited to the described embodiments, and the scope of the spirit of the present invention covers not only the following claims, but also all modifications equivalent or equivalent to the scope of these claims. It can be said that it belongs to

100: WIPS sensor 110: WIPS server
120: AP
130: wireless terminal
130a: Authorized wireless terminal 130b: Unauthorized wireless terminal
210: Communication unit 220: Control unit
221: Packet monitoring unit 222: Information analysis unit
223: Unauthorized terminal determination unit 224: Message generation unit
225: Unauthorized terminal blocking processing unit 230: Memory

According to one embodiment of the present invention, a WIPS sensor receives packets transmitted in real time from an AP (Access Point), and transmitted in real time from at least one wireless terminal connected to the AP and communicating wirelessly. a communication unit for receiving packets; a memory for storing packets received from the AP and wireless terminals; analyzing packets received from the at least one wireless terminal and determining whether a protected managed frame (PMF) is applied; an unauthorized terminal determination unit that determines whether or not the wireless terminal to which the PMF is applied is an unauthorized wireless terminal based on the analysis result of the information analysis unit; an unauthorized wireless terminal as a result of the determination; a message generation unit for generating a fake probe response message for inducing channel change of the unauthorized wireless terminal when it is determined that the fake probe response is generated through the communication unit; an unauthorized terminal interception processing unit for processing to forward the message;

According to another embodiment of the present invention, a method for blocking unauthorized wireless terminal intrusion using a WIPS sensor includes collecting packets transmitted in real time from an access point (AP); Collecting packets transmitted in real time from at least one wireless terminal that wirelessly communicates ; analyzing packets received from the AP or the at least one wireless terminal to determine whether a protected managed frame (PMF) is applied; determining whether the wireless terminal to which the PMF is applied is an unauthorized wireless terminal; and as a result of the determination, the wireless terminal to which the PMF is applied is an unauthorized wireless terminal. generating a fake probe response message for inducing a channel change of the unauthorized wireless terminal if determined to be present; and transmitting the generated fake probe response message. .

According to one embodiment of the present invention, a WIPS sensor receives packets transmitted in real time from an AP (Access Point), and transmitted in real time from at least one wireless terminal connected to the AP and communicating wirelessly. a communication unit for receiving packets; a memory for storing packets received from the AP and wireless terminals; analyzing packets received from the at least one wireless terminal and determining whether or not a protected managed frame (PMF) is applied an information analysis unit; an unauthorized terminal determination unit that determines whether or not the wireless terminal to which the PMF is applied is an unauthorized wireless terminal based on the analysis result of the information analysis unit; a message generator for generating a fake probe response message for inducing a channel change of the unauthorized wireless terminal if it is determined to be present; and the fake probe response message generated through the communication unit wherein the message generating unit generates a fake deauthentication message for deauthentication of the unauthorized wireless terminal, and the unauthorized terminal blocking processing unit generates and transferring the fake deauthentication message to the AP through the communication unit.

According to another embodiment of the present invention, a method for blocking unauthorized wireless terminal intrusion using a WIPS sensor includes collecting packets transmitted in real time from an access point (AP); Collecting packets transmitted in real time from at least one wireless terminal that wirelessly communicates; analyzing packets received from the AP or the at least one wireless terminal to determine whether a protected managed frame (PMF) is applied; determining whether the wireless terminal to which the PMF is applied is an unauthorized wireless terminal; and as a result of the determination, the wireless terminal to which the PMF is applied is an unauthorized wireless terminal. If it is determined that there is, generating a fake probe response message for inducing a channel change of the unauthorized wireless terminal; transferring the generated fake probe response message; generating a fake deauthentication message for deauthentication of a wireless terminal; and forwarding the generated fake deauthentication message to the AP .

Claims (15)

In a method for blocking unauthorized wireless terminals from intruding using a WIPS (Wireless Intrusion Prevention System) sensor,
Collecting packets transmitted in real time from an AP (Access Point);
collecting packets transmitted in real time from at least one wireless terminal connected to the AP and communicating wirelessly;
As a result of analyzing the packet received from the at least one wireless terminal, if it is determined that the wireless terminal that transmitted the packet is an unauthorized wireless terminal, a fake probe response ( A method of blocking an intrusion of an unauthorized wireless terminal using a WIPS sensor, comprising: generating a fake probe response message; and transmitting the generated fake probe response message. said method comprising:
analyzing packets received from the AP or the at least one wireless terminal;
Determining whether a Protected Managed Frame (PMF) has been applied;
2. The method of blocking an unauthorized wireless terminal intrusion using a WIPS sensor according to claim 1, wherein the wireless terminal to which the PMF is applied determines whether or not the wireless terminal is an unauthorized wireless terminal. said method comprising:
2. The WIPS of claim 1, further comprising determining whether the at least one wireless terminal is an unauthorized wireless terminal based on unauthorized device information and security policy information received from a WIPS server. An intrusion blocking method for an unauthorized wireless terminal using a sensor. The fake probe response message is
2. The method of blocking an unauthorized wireless terminal intrusion using a WIPS sensor according to claim 1, wherein address information for said unauthorized wireless terminal is included as destination information. The fake probe response message is
2. The method of claim 1, further comprising: information instructing to change to a channel different from the channel to which the unauthorized wireless terminal is currently connected, using a WIPS sensor. said method comprising:
The WIPS sensor of claim 1, further comprising: generating a fake deauthentication message for deauthentication of the rogue wireless terminal; and forwarding the generated fake deauthentication message to the AP. An intrusion blocking method for unauthorized wireless terminals. said method comprising:
The WIPS of claim 1, further comprising: generating a fake disconnect message for disconnecting to the unauthorized wireless terminal; and forwarding the generated fake disconnect message to the unauthorized wireless terminal. An intrusion blocking method for an unauthorized wireless terminal using a sensor. A computer-readable recording medium on which a program for executing the method according to any one of claims 1 to 7 is recorded. In the WIPS sensor,
A communication unit that receives packets transmitted in real time from an AP (Access Point) and receives packets transmitted in real time from at least one wireless terminal that is connected to the AP and communicates wirelessly;
a memory for storing packets received from the AP and wireless terminals;
an information analyzer that analyzes packets received from the at least one wireless terminal;
an unauthorized terminal determination unit that determines whether or not the wireless terminal that transmitted the packet is an unauthorized wireless terminal based on the analysis result of the information analysis unit;
a message generator for generating a fake probe response message for inducing a channel change of the unauthorized wireless terminal if the wireless terminal is determined to be an unauthorized wireless terminal as a result of the determination; and through the communication unit, A WIPS sensor, comprising: an unauthorized terminal blocking processor for processing the generated fake probe response message to be forwarded. The information analysis unit
analyzing packets received from the AP or the at least one wireless terminal;
Determining whether PMF (Protected Managed Frame) has been applied,
10. The WIPS sensor according to claim 9, wherein said unauthorized terminal determination unit determines whether or not a wireless terminal to which said PMF is applied is an unauthorized wireless terminal. The unauthorized terminal determination unit,
10. The WIPS sensor of claim 9, determining whether the at least one wireless terminal is a rogue wireless terminal based on rogue device information and security policy information received from a WIPS server. The fake probe response message is
10. The WIPS sensor according to claim 9, wherein address information for said unauthorized wireless terminal is included as destination information. The fake probe response message is
10. The WIPS sensor of claim 9, comprising information instructing the rogue wireless terminal to change to a different channel than the channel currently connected to. The message generator,
generating a fake deauthentication message for deauthentication of the unauthorized wireless terminal;
The unauthorized terminal blocking processing unit
10. The WIPS sensor of claim 9, configured to forward the generated fake de-authentication message to the AP through the communication unit. The message generator,
generating a fake disconnect message for disconnecting the unauthorized wireless terminal;
The unauthorized terminal blocking processing unit
10. The WIPS sensor according to claim 9, wherein the communication unit transfers the generated fake disconnection message to the unauthorized wireless terminal.

Images