JP7079994B1 - Intrusion blocking method for unauthorized wireless terminals using WIPS sensor and WIPS sensor - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an intrusion blocking method for an unauthorized wireless terminal using a WIPS (Wireless Intrusion Prevention System) sensor and an intrusion blocking method for an unauthorized wireless terminal using a WIPS sensor and a WIPS sensor. SOLUTION: The intrusion blocking method of an unauthorized wireless terminal using a WIPS sensor includes a stage of collecting packets transmitted in real time from an AP (Access Point) and from at least one wireless terminal connected to the AP and wirelessly communicated. If it is determined that the wireless terminal that transmitted the packet is an unauthorized wireless terminal as a result of the stage of collecting the packets transmitted in real time and the analysis of the packets received from at least one wireless terminal, the channel of the unauthorized wireless terminal is changed. A step of generating a fake probe response message for inducing a fake probe response and a step of transferring the generated fake probe response message are included. [Selection diagram] FIG. 6

Description

The present invention relates to an intrusion blocking method for an unauthorized wireless terminal using a WIPS (Wireless Intrusion Prevention System) sensor and a WIPS sensor in communication to which a PMF (Protected Managed Frame) is applied.

In general, the Internet is an open network that is configured so that anyone can freely connect and use it by applying a common protocol called TCP / IP to the computer to which they want to connect, anywhere in the world. In addition to the transmission of textual information, it is used for the distribution of multimedia information with the development of compression technology, and various services such as e-mail, file transfer, and WWW (World Wide Web) can be used.

The use of such the Internet is increasing rapidly in Japan and around the world, and its importance is rapidly increasing as a strategic tool for improving efficiency and productivity throughout the conventional industry. In addition to the continuous creation of new business opportunities through the Internet, the area is also expanding, and the number of businesses using the Internet is increasing.

The dedicated network is preferably closed to the outside in order to block various intrusions from the outside (hereinafter referred to as "intrusion") such as hacking for information security. There is also a need to manage access to terminal information in a hierarchical manner even within a dedicated network. Therefore, various security technologies have been developed, complemented, and continue to develop.

In addition, with the development of wireless technology, a wireless LAN that can be wirelessly connected to a network has appeared. By wireless LAN, a wireless terminal is easily connected to a network via a wireless LAN access point (access point: AP, hereinafter referred to as "AP") even if the wireless terminal does not go through a complicated line connection process. This has made it possible for wireless terminal users to connect to the network very easily, but the security of the network has been significantly reduced. This means that a dedicated network operated in a closed manner may be exposed to various risks. Therefore, a system for blocking intrusion in a wireless environment (Wireless Intrusion Prevention System: WIPS, hereinafter referred to as "WIPS") has been developed.

The wireless LAN technology based on IEEE 802.11 is widely used in homes, businesses, and public lines because it can use the network inexpensively and quickly without connecting terminals by wire. In particular, laptops, smartphones, and tablets equipped with wireless LAN cards are widely used, and users can play games, web surfing, and news through the Internet at any place and time in their daily lives. ), Social services, etc. have become available. In addition, users can now take advantage of various forms of Internet-based application services, such as easily sending and receiving email over the Internet at any place and time in their daily lives. Furthermore, high-speed technologies such as 802.1n and 802.11ac and wireless LAN technologies with enhanced safety such as 802.1i and 802.11w will be introduced, and safer and more convenient wireless LAN technologies will be used. Can now be done.

However, even if the technology for enhancing safety is applied to a wireless LAN, vulnerabilities due to the characteristics of wireless still exist. Unlike wired technology, wireless technology allows anyone to access the network and it is difficult to find the actual physical location of the network connection point, so various forms of attack such as address spoofing, eavesdropping, and packet spoofing. Is exposed to as it is.

In this way, there is a possibility of various attacks and intrusions in wireless LANs provided by homes, companies, and public lines. For example, unauthorized APs, denial of service attacks, insider attacks, etc. can be said to be typical. ..

The WIPS plays a role of detecting a packet generated between an AP and a wireless terminal (Station), determining a connection fraud according to a security policy defined by a user, and blocking the connection.

However, in the WPA3 encryption environment in the Wi-Fi6 environment announced in recent years, the application of PMF (Protected Managed Frame) based on 802.11w is indispensable, so the deauthentication frame and connection of the conventional WIPS products are required. There is a limit to the connection control between the AP and the wireless terminal via the release frame (Dissociation frame).

Therefore, Patent Document 1 (name of the invention: WIPS sensor, hereinafter referred to as "conventional technique") has been proposed as a technique for overcoming the limitation of control by applying PMF. The prior art is a method of generating a fake beacon to cause a wireless terminal to recognize an AP channel change. However, the channel change signal using the fake beacon packet is a broadcast (Broadcasting) transmission method, is received by all peripheral wireless terminals, and is connected to an unauthorized wireless terminal that is connected to the AP and is a blocking target. There is a problem of blocking both the connection to the permitted terminal and the normally connected terminal. In addition, blocking and control occurs for all connections relative to APs that use such PMFs, requiring separate storage and management for PMF APs.

Korean Registered Patent No. 10-102835 Gazette

An object of the present invention is to separately control the connection to an unauthorized wireless terminal connected to an AP based on the PMF and the connection to a normally connected authorized terminal, and eliminate a separate storage and management point for the PMF AP. Further, it is an object of the present invention to provide a WIPS sensor capable of improving the blocking performance of WIPS and a method for blocking intrusion of an unauthorized wireless terminal using the WIPS sensor.

Further, an object of the present invention is a WIPS sensor and the WIPS sensor capable of efficiently controlling an unauthorized wireless terminal by blocking the connection only to an unauthorized wireless terminal connected to the AP based on the PMF. The purpose is to provide a method for blocking intrusion of an unauthorized wireless terminal used.

The characteristic configuration of the present invention for achieving the above-mentioned object of the present invention and the effect peculiar to the present invention described later is as follows.

According to one embodiment of the present invention, the WIPS sensor receives a packet transmitted in real time from an AP (Access Point), is connected to the AP, and is transmitted in real time from at least one wireless terminal that wirelessly communicates with the AP. Communication unit that receives the packet; Memory that stores the packet received from the AP and the wireless terminal; Analyzes the packet received from the at least one wireless terminal and determines whether or not PMF (protruded managed frame) is applied. Information analysis unit; Fraudulent terminal determination unit that determines whether or not the wireless terminal to which the PMF is applied is an unauthorized wireless terminal based on the analysis result of the information analysis unit; If it is determined to be present, a message generation unit that generates a fake probe response message for inducing a channel change of the rogue wireless terminal; and the fake probe response message generated through the communication unit. The message generation unit generates a fake authentication cancellation message for deauthentication for the fraudulent wireless terminal, and the fraudulent terminal blocking processing unit generates the fraudulent terminal blocking processing unit; The fake authentication cancellation message is processed so as to be forwarded to the AP through the communication unit.

Preferably, the fraudulent terminal determination unit determines whether or not the fraudulent terminal is a fraudulent wireless terminal with respect to the at least one wireless terminal based on the fraudulent device information and the security policy information received from the WIPS server.

Preferably, the fake probe response message includes address information for the rogue radio terminal as destination information.

Preferably, the fake probe response message contains information instructing the rogue radio terminal to switch to a different channel than the one to which it is currently connected.

Preferably, the message generation unit generates a fake connection disconnection message for disconnecting to the unauthorized wireless terminal, and the unauthorized terminal blocking processing unit generates the fake connection disconnection message through the communication unit. Process so that it is transferred to an unauthorized wireless terminal.

According to another embodiment of the present invention, the intrusion blocking method of an unauthorized wireless terminal using a WIPS sensor includes a step of collecting packets transmitted in real time from an AP (access point) and a step of connecting to the AP. Whether or not PMF (protracted managed frame) is applied by analyzing the stage of collecting packets transmitted in real time from at least one wireless terminal for wireless communication and analyzing the packets received from the AP or at least one wireless terminal. A step of determining whether or not the wireless terminal to which the PMF is applied is a step of determining whether or not the wireless terminal to which the PMF is applied is an unauthorized wireless terminal, and as a result of the determination, the wireless terminal to which the PMF is applied is an unauthorized wireless terminal. If it is determined to be present, a step of generating a fake probe response message for inducing a channel change of the rogue wireless terminal, a step of transferring the generated fake probe response message, and the step of forwarding the rogue It includes a step of generating a fake deauthentication message for deauthentication for the wireless terminal and a step of transferring the generated fake deauthentication message to the AP .

Preferably, the method further includes a step of determining whether or not the wireless terminal is an unauthorized wireless terminal for the at least one wireless terminal based on the unauthorized device information and the security policy information received from the WIPS server.

Preferably, the fake probe response message includes address information for the rogue radio terminal as destination information.

Preferably, the fake probe response message contains information instructing the rogue radio terminal to switch to a channel other than the one currently connected.

Preferably, the method further includes a step of generating a fake disconnect message for disconnecting to the rogue wireless terminal and a step of transferring the generated fake disconnect message to the rogue wireless terminal. ..

Information for receiving the provision of an intrusion blocking method for an unauthorized wireless terminal using the WIPS sensor can be stored in a readable recording medium in the server computer. These recording media include all types of recording media in which programs and data are stored so that they can be read by computer systems. Examples include ROM (Read Only Memory), RAM (Random Access Memory), CD (Compact Disk), DVD (Digital Video Disk) -ROM, magnetic tape, floppy disk, optical data storage device, and the like. It also includes being embodied in the form of a carrier wave (eg, transmission over the Internet). In addition, these recording media are distributed to computer systems connected by a network, and a computer-readable code is stored and executed in a distributed manner.

As described above, according to the present invention, a fake probe response message that induces an individual channel change to an unauthorized wireless terminal, and a fake detect message that prevents reconnection after a channel change. By forwarding a fake deauthentication message that induces confirmation and disconnection of the AP, normal wireless terminals connected to APs that use PMF and unauthorized wireless terminals are distinguished and individually controlled. There are advantages that can be achieved.

Further, according to the present invention, a method that can be used for all connections regardless of whether or not PMF is used is provided, the burden due to whether or not PMF is used is eliminated, performance is improved, and individual security of a wireless network is achieved. It has the effect of improving sex.

It is a block diagram which shows the structure of the unauthorized wireless terminal cutoff system which concerns on embodiment of this invention. It is a block diagram which shows the detailed structure of the WIPS sensor which concerns on embodiment of this invention. It is a flowchart of a signal which shows the connection procedure between an AP and a wireless terminal which concerns on embodiment of this invention. It is a flowchart of a signal which shows the security connection confirmation procedure between an AP using PMF and a wireless terminal which concerns on embodiment of this invention. It is a figure which shows the example of the beacon frame transmitted from AP. It is a flowchart of the signal for blocking an unauthorized wireless terminal using the WIPS sensor which concerns on embodiment of this invention. It is a figure which shows an example of the beacon frame which concerns on embodiment of this invention. It is a figure which shows an example of the fake probe response frame which concerns on embodiment of this invention. It is a figure which shows the example of the fake authentication cancellation frame for SA query induction and reconnection prevention which concerns on embodiment of this invention. It is a figure which shows an example of the fake connection disconnection frame for preventing the reconnection according to the embodiment of this invention.

For a detailed description of the invention described below, reference will be made to the accompanying drawings illustrating specific embodiments in which the invention can be practiced. These embodiments will be described in detail to be sufficient for those skilled in the art to practice the invention. It should be understood that the various embodiments of the invention are different from each other but need not be mutually exclusive. For example, the particular shapes, structures and properties described herein can be implemented in other embodiments without departing from the object and scope of the invention with respect to one embodiment. Further, it should be understood that the location or placement of the individual components in each disclosed embodiment may be modified without departing from the object and scope of the invention. Therefore, the detailed description described below should not be taken in a limited sense, and the scope of the present invention is attached in addition to all the scope equivalent to what the claims claim, as long as it is properly described. Limited only by the claims of. Similar reference numerals in the figure refer to the same or similar functions in several embodiments.

The present invention separately controls the connection of an unauthorized wireless terminal connected to the AP based on the PMF and the connection of a normally connected authorized terminal, and eliminates a separate storage and management point for the PMF AP. Further, the present invention provides a WIPS sensor capable of improving the blocking performance of WIPS and a method for blocking intrusion of an unauthorized wireless terminal using the WIPS sensor.

Further, in the embodiment of the present invention, the unauthorized wireless terminal can be efficiently controlled by blocking the connection only to the unauthorized wireless terminal connected to the AP based on the PMF.

An embodiment of the present invention, which will be described later, separately controls the connection of an unauthorized wireless terminal connected to such a PMF AP and the connection of a normally connected authorized terminal, and connects based on the PMF. It is possible to improve the blocking performance of WIPS by removing the storage and management points separately for the AP. For the above object, an embodiment of the present invention is a fake probe response (Fake Probe Response) message that individually induces a channel change to a wireless terminal in a WIPS sensor, and a fake connection that prevents reconnection after a channel change. The Fake Dissuspend message, the fake authentication disconnection message that induces the confirmation and disconnection of the AP are forwarded, and the normal wireless terminal and the unauthorized wireless terminal connected to the AP using the PMF are distinguished. Can be controlled individually.

FIG. 1 is a block diagram showing a configuration of an unauthorized wireless terminal blocking system according to an embodiment of the present invention. Referring to FIG. 1, the system according to the embodiment of the present invention includes a WIPS sensor 100, a WIPS server 110, AP120, and a plurality of wireless terminals 130 (for example, first wireless terminal 130-1 and second wireless terminal 130-2). ..., The nth wireless terminal 130-n) can be included.

According to one embodiment, the WIPS sensor 100 monitors packets sent and received from the AP 120 and the wireless terminal 130, and is based on the information about the unauthorized wireless terminal or the information about the security policy provided by the WIPS server 110, the unauthorized wireless terminal. Can perform functions to block. The WIPS server 110 can provide the information about the unauthorized wireless terminal or the information to the WIPS sensor 100 every time the security policy is changed. The WIPS sensor 100 can block unauthorized wireless terminals based on the updated information received from the WIPS server 110.

The wireless terminal 130 can include various devices capable of exchanging data via the AP 120 such as a laptop computer equipped with a wireless LAN and a smartphone. The WIPS sensor 100 can detect a data packet wirelessly transmitted to the wireless terminal 130 via the AP 120. The WIPS sensor 100 and AP120 can be connected by wire. Here, the AP 120 may be composed of one or a plurality. A data packet can mean a unit of information transmitted as a block from one device to another through a communication line. Here, the data packet includes various element fields such as service set identifier (SSID), support speed, time stamp, display interval, capacity information, channel, and the like.

The data packet detected by the WIPS sensor 100 can be transmitted to the WIPS server 110. At this time, the WIPS sensor 100 can transmit the data packet detected through the communication unit to the WIPS server 110. The WIPS sensor 100 or the WIPS server 110 analyzes data packets transmitted / received from the AP 120 or data packets transmitted / received from the at least one wireless terminal 130, and whether or not the at least one wireless terminal 130 is an unauthorized wireless terminal. Can be determined. The detailed functions of the WIPS sensor 100 will be described later in the description of FIG.

FIG. 2 is a block diagram showing a detailed configuration of the WIPS sensor according to the embodiment of the present invention. Referring to FIG. 2, the WIPS sensor 100 includes a communication unit 210, a control unit 220, and a memory 230. The control unit 220 includes a packet monitoring unit 221, an information analysis unit 222, an unauthorized terminal determination unit 223, a message generation unit 224, and an unauthorized terminal blocking processing unit 225.

According to one embodiment, the packet monitoring unit 221 can collect packets in the wireless network in real time through the communication unit 210. For example, the packet monitoring unit 221 can collect packets transmitted from at least one wireless terminal 130 to AP 120, and can collect packets transmitted to at least one wireless terminal 130 via AP 120.

The information analysis unit 222 can analyze each data packet collected through the packet monitoring unit 221 by the analysis means. The information analysis unit 222 can analyze the packets of the wireless network and acquire the information of the AP 120 and the wireless terminal 130. For example, the information of the AP 120 acquired by the information analysis unit 222 includes the use of BSSID (Basic Service Set ID), SSID (Service Set ID), channel, and PMF of the AP via the beacon packet continuously emitted by the AP 120. , Encrypted information, MAC (Medium Access Control) address, etc. are included. Further, the information of the wireless terminal 130 acquired by the information analysis unit 222 includes the BSSID of the wireless terminal, the MAC (Medium Access Control) address, the SSID of the connected AP, the BSSID of the connected AP, and the like.

The information analysis unit 222 can store the analyzed information in the memory 230. Further, the WIPS sensor 100 can transmit the information analyzed via the information analysis unit 222 to the WIPS server 110.

The fraudulent terminal determination unit 223 calls and compares the detection information periodically stored in the memory 230, the fraudulent device information stored in advance, the permitted device information, and the security policy information, and makes a fraudulent radio for each wireless terminal. The presence or absence of a terminal can be determined. The unauthorized device information, the permitted device information, and the security policy information are distributed from the WIPS server 110 via the communication unit 210 in real time and can be stored in the memory 230.

As a result of the determination of the fraudulent terminal determination unit 223, if it is determined that at least one wireless terminal 130 is a fraudulent wireless terminal, an operation for blocking the fraudulent wireless terminal can be performed.

The message generation unit 224 can generate a message for blocking the unauthorized wireless terminal according to the embodiment of the present invention. For example, the message generation unit 224 can generate a fake probe response message for inducing a channel change of an unauthorized wireless terminal. Further, the message generation unit 224 can generate a fake dissociation message for preventing reconnection as being transmitted from the AP 120 by disguising the MAC. Further, the message generation unit 224 forges the MAC of the wireless terminal and cancels the fake authentication (for the purpose of preventing confirmation procedure guidance to AP120 (so-called SA (Security Association) Quality message transmission) and reconnection of the unauthorized wireless terminal (s). Fake Wireless) message can be generated.

The message generation unit 224 can specify the source address, reception address, or destination address of each generated message or packet as the rogue radio terminal 130 or AP120. By doing so, the message is transmitted only to the wireless terminal and the AP to be blocked, and the peripheral wireless connection device is not affected. Therefore, the WIPS sensor 100 can transmit a message without distinguishing between the case where each wireless terminal or AP120 uses PMF and the case where the general connection does not use PMF.

The unauthorized terminal blocking processing unit 225 can transmit the message generated by the message generation unit 224 to the unauthorized wireless terminal 130 or AP 120 through the communication unit 210 in real time or periodically, and can process the unauthorized terminal to be blocked. ..

FIG. 3 is a flowchart of a signal showing a connection procedure between the AP and the wireless terminal according to the embodiment of the present invention. Referring to FIG. 3, the AP 120 can broadcast the beacon signal to the wireless terminal 130 (step 302). The beacon signal is a signal whose destination is not specified and is broadcast. For example, the frame of the beacon signal can be configured as shown in FIG.

FIG. 5 is a diagram showing an example of a beacon frame transmitted from the AP. Referring to FIG. 5, as shown in the figure, the receiver address (receiver address) or the destination address (destination address) is set to be broadcast and the address is not specified (for example, “ff: ff: ff: ff:”. ff: ff: ff "can be set). Thereby, the beacon frame can be received from all the wireless terminals in the area where the AP120 is located. Further, when the beacon frame is transmitted as a fake beacon frame in order to block the unauthorized wireless terminal by the conventional technique, the connection is blocked not only to the unauthorized wireless terminal but also to all normal wireless terminals receiving the beacon frame. can.

According to one embodiment, the wireless terminal 130 that has received the beacon signal can forward the probe request message to the AP 120 and retrieve the AP information (step 304). The AP 120 can receive a probe request message from the radio terminal 130 and transfer the probe response message to the radio terminal 130 (step 306).

According to one embodiment, the wireless terminal 130 that has successfully received the probe response message can send an authentication request message to the AP 120 (step 308). Upon receiving the authentication request message, the AP 120 can authenticate the wireless terminal 130. The certification may include a relatively low level of certification (eg, Open, WEP-based certification). If the authentication is successfully completed, the AP 120 can forward the authentication result message to the wireless terminal 130 (step 310).

According to one embodiment, the wireless terminal 130 that has successfully completed the authentication and received the authentication result message can transfer the association request message to the AP 120 (step 312). The AP 120 can receive the association request message from the wireless terminal 130 and transfer the association response message to the wireless terminal 130 (step 314).

Thus, when the connection between the wireless terminal 130 and the AP 120 is completed, the wireless terminal 130 and the AP 120 each exchange an encryption key to achieve a relatively high level of authentication (eg, WPA /. WPA2), WPA3, or 802.1X-based authentication) can be performed (step 316).

Once the high level of authentication is completed, the wireless terminal 130 and AP 120 can send and receive data to and from each other (step 318). For example, the wireless terminal 130 can transfer data to an external network via the AP 120 and can receive data transferred from the external network via the AP 120.

If WPA 3 encryption in a Wi-Fi 6 environment is supported at the high-level authentication stage, PMF (Protected Managed Frame) may be indispensably applied based on 802.11w.

FIG. 4 is a flowchart of a signal showing a security connection confirmation procedure between an AP using PMF and a wireless terminal according to an embodiment of the present invention. With reference to FIG. 4, as described in FIG. 3, a connection via the PMF can be set between the wireless terminal 130 and the AP 120 (step 402).

The WIPS sensor 100 can transfer a Deauthentication message to the AP 120 in order to block the unauthorized wireless terminal (step 404). The deauthentication message transferred to the AP 120 may be a deauthentication message for a wireless terminal not applied to the PMF. Further, the WIPS sensor 100 can transfer an authentication cancellation message to the wireless terminal 130 in order to block the unauthorized wireless terminal (step 406). The deauthentication message transferred to the wireless terminal 130 may be a deauthentication message for a wireless terminal not applied to the PMF.

Upon receiving the deauthentication message, the AP 120 can send an encrypted SA (Security Association) query (query) to the wireless terminal 130 in order to confirm whether or not to deauthenticate the wireless terminal 130 (step 408). ). The wireless terminal 130 that has received the encrypted SA query can transfer the SA query response message to the AP 120 (step 410). That is, the AP 120 and the wireless terminal 130 to which the PMF is applied can execute the confirmation procedure by a normal SA query by receiving the authentication cancellation message to which the PMF is not applied from the WIPS sensor 100. As a result, even if the authentication cancellation message is received from the WIPS sensor 100 between the wireless terminal 130 and the AP 120, normal data frames are transmitted and received via the PMF (step 412).

FIG. 6 is a flowchart of a signal for blocking an unauthorized wireless terminal using the WIPS sensor according to the embodiment of the present invention. The procedure of FIG. 6 described later can be executed via the WIPS sensors 100, AP120, and wireless terminal 130 of FIGS. 1 and 2 described above. Referring to FIG. 6, the AP 120 can broadcast the beacon signal to the wireless terminal 130. The beacon signal to be broadcast in the AP 120 can be configured in the form of FIG. 5 described above.

According to one embodiment, the beacon signal is broadcast to all radio terminals in the region without targeting a particular radio terminal. Therefore, the beacon signal broadcast from the AP 120 is received not only by the permitted wireless terminal but also by the unauthorized wireless terminal 130b. In the description described later, the permitted wireless terminal is referred to as a permitted wireless terminal 130a. As described in FIG. 3, the authorized wireless terminal 130a transmits / receives data to / from the AP 120 by normally performing procedures such as probe request, probe response, authentication, association request, association response, and encryption key exchange with the AP 120. Yes (step 604, step 606, step 608). Similarly, as described in FIG. 3, the unauthorized wireless terminal 130b also normally performs procedures such as probe request, probe response, authentication, association request, association response, and encryption key exchange with AP120, thereby performing data with AP120. Can be sent and received (step 610). For convenience of explanation, it is assumed that the permitted radio terminal 130a and the unauthorized radio terminal 130b are connected to the AP 120 and the channel 116.

According to one embodiment, the WIPS sensor 100 can collect and store data packets transmitted and received from the AP 120, the authorized wireless terminal 130a, and the unauthorized wireless terminal 130b.

According to one embodiment, the packet monitoring unit 221 can collect packets in the wireless network in real time via the communication unit 210. For example, the packet monitoring unit 221 can collect packets transmitted from at least one wireless terminal 130 to the AP 120, and can collect packets transmitted to at least one wireless terminal 130 via the AP 120. According to one embodiment, the WIPS sensor 100 receives a beacon packet continuously emitted by the AP, and the BSSID (Basic Service Set ID), SSID (Service Set ID), channel, and PMF of the AP are used. You can check the encrypted information, MAC (Medium Access Control) address, and so on. Further, the WIPS sensor 100 receives data packets transmitted / received from the wireless terminals 130a and 130b, and receives the BSSID of the wireless terminal, the MAC (Media Access Control) address, the SSID of the connected AP, and the BSSID of the connected AP. You can check such things.

According to one embodiment, the WIPS sensor 100 can confirm whether or not PMF is used via the beacon frame transmitted from the AP 120.

FIG. 7 is a diagram showing an example of a beacon frame according to an embodiment of the present invention. For example, referring to FIG. 7, the setting information (for example, “True”) of the PMF-related information (for example, “Management Frame Protection Liquid” or “Management Frame Protection Cable”) included in the beacon frame is confirmed, and the above-mentioned It is possible to confirm whether or not the PMF of the beacon frame transmitted from the AP120 is used.

According to one embodiment, the WIPS sensor 100 can collect and analyze packets generated on the channel 116 and determine whether or not each of the wireless terminals 130a and 130b is fraudulent or permitted. That is, the WIPS sensor 100 can analyze data packets transmitted / received from the AP 120, the permitted wireless terminal 130a, and the unauthorized wireless terminal 130b, and detect that the unauthorized wireless terminal 130b is an illegally connected wireless terminal.

When the WIPS sensor 100 detects that the unauthorized wireless terminal 130b is an illegally connected wireless terminal, the embodiment of the present invention can execute various procedures for blocking the connection of the unauthorized wireless terminal 130b. ..

For example, the WIPS sensor 100 generates a fake probe response message and generates a fake regardless of whether or not the AP120 and PMF are used when the unauthorized wireless terminal 130b is an illegally connected wireless terminal. The probe response message can be forwarded to the rogue radio terminal 130b (step 612). The fake probe response message may be a message instructing the unauthorized radio terminal 130b to change the channel.

The WIPS sensor 100 sets the source address (source address) of the fake probe response message as AP120, and sets the destination address (destination address) as the unauthorized wireless terminal 130b, whereby the fake probe response message is set as the unauthorized wireless terminal 130b. Can only be transferred to. For example, the WIPS sensor 100 can disguise itself as the MAC address of the AP 120, generate a probe response message, and then continuously transfer the generated fake probe response message to the rogue wireless terminal 130b.

FIG. 8 is a diagram showing an example of a fake probe response frame according to an embodiment of the present invention. Referring to FIG. 8, the fake probe response message can be transmitted by setting a receiver address (receiver address), a destination address (destination address), a transmitter address (transmitter address), and a source address (source address). In addition, the fake probe response message may further contain information instructing the channel to change. For example, by setting the information about "Channel Switch Announcation Mode" to "144", it is possible to instruct to change the channel of the rogue radio terminal 130b connected to the current channel 116 to channel 144.

The fraudulent wireless terminal 130b can receive the fake probe response message transferred from the WIPS sensor 100 and can recognize the probe response message normally transferred from the AP 120. The rogue radio terminal 130b confirms the channel change related information included in the fake probe response message, changes its own channel from channel 116 to channel 144, and then waits for a certain period of time for the channel of AP120 to be changed. Yes (step 614). The channel of the rogue radio terminal 130b was changed to channel 144 by the fake probe response message, but since the channel of the AP 120 has not been changed, normal data communication is performed between the AP 120 and the rogue radio terminal 130b. Sometimes not.

Further, according to the embodiment of the present invention, the WIPS sensor 100 can generate a forged authentication cancellation message in the MAC address of the unauthorized wireless terminal 130b as a fake authentication cancellation message and transmit it to the AP 120 (step 616). The fake authentication deauthentication message generated by the WIPS sensor 100 can be continuously transmitted to the AP 120.

FIG. 9 is a diagram showing an example of a fake authentication cancellation frame for SA query guidance and reconnection prevention according to the embodiment of the present invention. In FIG. 9, in the fake authentication cancellation message, the receiver address can be set as the address of the AP120 (for example, the MAC address of the AP120), and the sender address can be set as the address of the unauthorized wireless terminal 130b.

When the AP 120 that has received the fake authentication cancellation message is an AP that uses PMF, the AP 120 that has received the fake authentication cancellation message is whether or not the fake authentication cancellation message is a message delivered from the unauthorized wireless terminal 130b. An SA query can be sent to the fraudulent wireless terminal 130b to confirm that (step 618).

Since the channel of the unauthorized wireless terminal 130b is changed from channel 116 to channel 144 by the fake probe response message transferred from the WIPS sensor 1000, the SA query transmitted from the AP 120 is normally performed. Unable to respond (step 620).

Since the AP 120 cannot normally receive the response from the transmission of the SA query, the connection with the unauthorized wireless terminal 130b can be terminated (step 622). That is, since the AP 120 does not receive a response from the unauthorized wireless terminal 130b, the unauthorized wireless terminal 130b reconnects (power on / off) the fake authentication release message transferred from the WIPS sensor 100 to normally release the authentication. It can be recognized as a message for, and the connection with the unauthorized wireless terminal 130b can be terminated (step 622).

If the AP 120 is an AP that does not use PMF, the fake authentication cancellation message transferred from the WIPS sensor 100 is sent to the unauthorized wireless terminal 130b without a separate confirmation procedure (for example, the confirmation procedure by sending the SA query). It can be recognized as a normal deauthentication message transferred from and disconnected.

The unauthorized wireless terminal 130b is not connected to the AP 120 even after waiting for a certain period of time on the changed channel 144, performs a wireless channel scan operation for reconnection, and performs the wireless channel scan operation for reconnection, and the AP 120 is performed via the previously connected channel 116. And an attempt to reconnect can be made (step 624).

According to one embodiment, the WIPS sensor 100 can generate a fake diagnostic message to prevent the rogue radio terminal 130b from attempting to reconnect to the AP 120 and transfer it to the rogue radio terminal 130b. For example, the source address of the disconnection message can be forged to the address of AP120 (for example, the MAC address of AP120), the receiver address can be forged to the unauthorized wireless terminal 130b, and the fake disconnection message can be generated. The WIPS sensor 100 can continuously transfer the generated fake disconnection message to the unauthorized wireless terminal 130b via the channel 116.

FIG. 10 is a diagram showing an example of a fake disconnection frame for preventing reconnection according to the embodiment of the present invention. Referring to FIG. 10, the WIPS sensor 100 can set the sender address as the address of the AP 120 and the receiver address as the address of the rogue wireless terminal 130b to generate a fake connection disconnect message.

The fraudulent wireless terminal 130b can recognize the fake disconnection message transferred from the WIPS sensor 100 as a normal disconnection message transferred from the AP 120, and can continuously disconnect from the channel 116.

That is, as shown in FIG. 6, the WIPS sensor 100 can cut off the connection by changing the channel to the unauthorized wireless terminal 130b via the fake probe response message. After that, the WIPS sensor 100 terminates the connection between the AP 120 and the unauthorized wireless terminal 130b by transferring the fake authentication cancellation message to the AP 120, even when the PMF is used. Further, in order to block the unauthorized wireless terminal 130b from trying to connect again, the connection of the unauthorized wireless terminal 130b is continuously blocked by transferring a fake authentication cancellation message to the unauthorized wireless terminal 130b for the channel. be able to.

By the above procedure, the connection of the permitted wireless terminal 130a is not affected at all, and the connection to the unauthorized wireless terminal 130b can be completely cut off individually.

On the other hand, the embodiment according to the present invention is embodied in a program instruction form that can be executed via various computer means, and can be recorded on a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, etc. alone or in combination thereof. The program instructions recorded on the medium may be those specially designed and configured for the present invention, or may be those known and usable by those skilled in the art of computer software. Examples of computer-readable recording media include hard disks, floppy disks, magnetic media such as magnetic tapes, optical recording media such as CD-ROMs and DVDs, optical disks, and floptic discs. Includes a specific optical media, and a hardware device specifically configured to store and execute program instructions such as ROM, RAM, and flash memory. Examples of program instructions include not only machine language code as created by a compiler, but also high-level language code that can be executed by a computer using an interpreter or the like. The hardware device may be configured to operate as one or more software modules to perform the operation of the present invention, as well as its role.

As described above, the present invention has been described with reference to specific matters such as specific components and limited embodiments and drawings, which are provided to aid a more general understanding of the present invention. However, the present invention is not limited to the above-described embodiment. Any person with general knowledge in the field to which the present invention belongs can make various modifications and modifications from these descriptions.

Therefore, the idea of the present invention is not limited to the described embodiments, and not only the scope of the claims described later but also all the variations equal to or equivalent to the scope of the claims are within the scope of the ideas of the present invention. It can be said that it belongs.

100: WIPS sensor 110: WIPS server
120: AP
130: Wireless terminal
130a: Allowed wireless terminal 130b: Unauthorized wireless terminal
210: Communication unit 220: Control unit
2221: Packet monitoring unit 222: Information analysis unit
223: Illegal terminal determination unit 224: Message generation unit
225: Unauthorized terminal blocking processing unit 230: Memory

Claims (11)

In a method for blocking intrusion of an unauthorized wireless terminal using a WIPS (wireless intrusion prevention system) sensor.
The stage of collecting packets transmitted in real time from an AP (access point);
A step of collecting packets transmitted in real time from at least one wireless terminal connected to the AP and wirelessly communicating;
A step of analyzing a packet received from the AP or the at least one wireless terminal to determine whether or not a PMF (protruded managed frame) has been applied;
The stage of determining whether or not the wireless terminal to which the PMF is applied is an unauthorized wireless terminal;
As a result of the determination, if it is determined that the wireless terminal to which the PMF is applied is an unauthorized wireless terminal, a step of generating a fake probe response message for inducing a channel change of the unauthorized wireless terminal. ;
The step of transferring the generated fake probe response message to the rogue radio terminal;
The stage of generating a fake deauthentication message for deauthentication for the unauthorized wireless terminal; and
The step of forwarding the generated fake authentication cancellation message to the AP ;.
A method for blocking intrusion of an unauthorized wireless terminal using a WIPS sensor. The above method
The WIPS according to claim 1, further comprising a step of determining whether or not the at least one wireless terminal is an unauthorized wireless terminal based on the unauthorized device information and the security policy information received from the WIPS server. A method of blocking intrusion of unauthorized wireless terminals using sensors. The fake probe response message is
The method for blocking intrusion of an unauthorized wireless terminal using the WIPS sensor according to claim 1, which includes address information for the unauthorized wireless terminal as destination information. The fake probe response message is
The method for blocking intrusion of an unauthorized wireless terminal using the WIPS sensor according to claim 1, which includes information instructing the unauthorized wireless terminal to change to a channel different from the channel to which the unauthorized wireless terminal is currently connected. The above method
The WIPS according to claim 1, further comprising a step of generating a fake disconnection message for disconnection to the unauthorized wireless terminal; and a step of transferring the generated fake disconnection message to the unauthorized wireless terminal. A method of blocking intrusion of unauthorized wireless terminals using sensors. A computer-readable recording medium, wherein a program for executing the method according to any one of claims 1 to 5 is recorded. In the WIPS sensor
A communication unit that receives a packet transmitted in real time from an AP (access point), and receives a packet transmitted in real time from at least one wireless terminal that is connected to the AP and wirelessly communicates with the AP;
Memory for storing packets received from the AP and wireless terminal;
Packets received from at least one wireless terminal are analyzed and
Information analysis unit that determines whether or not PMF (producted managed frame) has been applied;
Based on the analysis result of the information analysis unit, the fraudulent terminal determination unit that determines whether or not the wireless terminal to which the PMF is applied is a fraudulent wireless terminal;
As a result of the determination, if it is determined to be a rogue radio terminal, a message generation unit that generates a fake probe response message for inducing a channel change of the rogue radio terminal; and through the communication unit. A rogue terminal blocking processor that processes the generated fake probe response message to be forwarded;
The message generation unit
Generate a fake deauthentication message for deauthentication for the unauthorized wireless terminal,
The unauthorized terminal blocking processing unit
A WIPS sensor that processes the generated fake authentication cancellation message to the AP through the communication unit . The fraudulent terminal determination unit
The WIPS sensor according to claim 7 , wherein it is determined whether or not the at least one wireless terminal is an unauthorized wireless terminal based on the unauthorized device information and the security policy information received from the WIPS server. The fake probe response message is
The WIPS sensor according to claim 7 , which includes address information for the unauthorized wireless terminal as destination information. The fake probe response message is
The WIPS sensor according to claim 7 , which includes information instructing the channel to be changed to a channel different from the channel currently connected to the rogue wireless terminal. The message generation unit
Generate a fake disconnection message for disconnection to the unauthorized wireless terminal,
The unauthorized terminal blocking processing unit
The WIPS sensor according to claim 7 , wherein the fake connection disconnection message generated is processed to be transferred to the unauthorized wireless terminal through the communication unit.

Images