KR102119317B1 - Apparatus and method for identifying a user terminal and blocking access to a wireless access point - Google Patents

Abstract

In one embodiment, a wireless AP database storing a wireless AP management list; A vulnerability database that stores vulnerability information for a user terminal; A black list database for storing a list of abnormal user terminals; And a SIEM server that determines whether to allow the user terminal to access the wireless AP using the blacklist database and the vulnerability database in response to a user terminal confirmation request received from the wireless AP included in the wireless AP management list. do.

Description

Device and method for blocking access to a wireless AP by identifying a user terminal{APPARATUS AND METHOD FOR IDENTIFYING A USER TERMINAL AND BLOCKING ACCESS TO A WIRELESS ACCESS POINT}

Associated with an apparatus and method for performing access processing to an access point (AP) of a wireless local area network (WLAN), and more specifically, a router access processing device for evaluating and evading a malicious router in advance and How to do it.

With enterprise information security becoming increasingly important, attackers have been attacking to steal user information through various channels. Among them, security for a wired network can be solved through various software, but security for a wireless AP is very difficult to defend against various attacks from hackers, and the method is also very limited.

In particular, recently, attacks on wireless APs have been further intensified, for example, attacks on wireless APs and cases of stealing personal information stored in devices connected to wireless APs through DNS forgery and forgery and wireless APs. Through this, there are cases of hacking IPTV or CCTV.

There are several types of methods to defend against attacks on wireless APs, but at a glance, how to keep the firmware version provided by the wireless AP manufacturer always up to date and how to use the strongest security and encryption method provided by the wireless AP. There is this.

However, even in the case of defense through this method, the internal system may be exposed to various risks as soon as an attacker starts an activity through an attack and connection to a wireless AP.

According to an embodiment, a wireless AP database storing a wireless AP management list; A vulnerability database that stores vulnerability information for a user terminal; A black list database for storing a list of abnormal user terminals; And a SIEM (Security Information) for determining whether the user terminal is allowed to access the wireless AP using the blacklist database and the vulnerability database in response to a user terminal confirmation request received from the wireless AP included in the wireless AP management list. and Event Management) server.

According to another embodiment, the SIEM server discloses a wireless AP access blocking device that performs vulnerability checking of a user terminal attempting to access the wireless AP and stores the vulnerability in the vulnerability database.

According to another embodiment, the SIEM server is provided with a wireless AP access blocking device that notifies the user terminal of attempting to access the wireless AP with a vulnerability.

According to another embodiment, the SIEM server calculates a vulnerability score of the user terminal attempting to access the wireless AP and allows access to the wireless AP only when the vulnerability score is equal to or less than a predetermined value. Blocking devices are possible.

According to another embodiment, the SIEM server receives IP addresses and MAC addresses of the one or more wireless APs from one or more wireless APs, verifies the security of the one or more wireless APs, and transmits information related to the successful wireless APs. It may be a wireless AP access blocking device that is stored in the wireless AP management list.

According to another embodiment, the SIEM server collects the MAC address of the abnormal user terminal from a malware information provider or uses the malware search tool to collect the MAC address of the abnormal user terminal, and collects the abnormal user terminal's MAC address. A wireless AP access blocking device that stores a MAC address in the abnormal user terminal list is also possible.

According to one embodiment, the user terminal verification request includes the MAC address of the user terminal, and the SIEM server checks whether the MAC address of the user terminal is included in the abnormal user terminal list, blocking wireless AP access The device is presented.

According to another embodiment, when the MAC address of the user terminal is included in the abnormal user terminal list, the SIEM server transmits a connection blocking signal for the user terminal to the wireless AP, the wireless AP access blocking device Is presented.

According to one side, a wireless AP access blocking method for blocking access to a wireless AP using a SIEM server, the method comprising: storing a wireless AP management list in a wireless AP database; Storing the abnormal user terminal list in a blacklist database; Storing vulnerability information for the user terminal in a vulnerability database; And in response to a user terminal confirmation request received from the wireless AP included in the wireless AP management list, determining whether to allow the user terminal to access the wireless AP using the blacklist database and the vulnerability database. A wireless AP access blocking method is disclosed.

According to another side, the step of storing the vulnerability information in the vulnerability database discloses a method of blocking a wireless AP access by performing a vulnerability check of a user terminal attempting to access the wireless AP and storing the vulnerability in the vulnerability database.

According to another aspect, a method of blocking access to a wireless AP, which further comprises the step of reporting a vulnerability to the user terminal attempting to access the wireless AP, is also possible.

According to another side, calculating a vulnerability score of the user terminal attempting to access the wireless AP; And allowing a connection to the wireless AP only when the vulnerability score is equal to or less than a predetermined value.

According to another side, the step of storing the wireless AP management list in the wireless AP database may include receiving IP addresses and MAC addresses of the one or more wireless APs from one or more wireless APs; And verifying the security of the one or more wireless APs and storing information related to the wireless APs that are successfully verified in the wireless AP management list.

According to another aspect, the step of storing the abnormal user terminal list in the blacklist database includes: collecting the MAC address of the abnormal user terminal from a malware information provider; Collecting the MAC address of the abnormal user terminal using a malware search tool; And storing the collected MAC address of the abnormal user terminal in the abnormal user terminal list.

According to one side, the user terminal verification request includes the MAC address of the user terminal, and determining whether to allow the user terminal to access the wireless AP using the black list database includes: A wireless AP access blocking method is possible, including the step of checking whether it is included in the abnormal user terminal list.

According to another side, when the MAC address of the user terminal is included in the abnormal user terminal list, further comprising the step of transmitting a connection blocking signal for the user terminal to the wireless AP, a wireless AP access blocking method is also disclosed. .

According to one embodiment, a computer-readable recording medium including a program for performing the wireless AP access blocking method is also provided.

1 is a block diagram illustrating an exemplary wireless AP access blocking device according to an embodiment.
2 is a view for explaining the operation of the wireless AP access blocking device according to an embodiment.
3 is a flowchart illustrating a method of blocking wireless AP access according to an embodiment.
4 is a flowchart illustrating a method of blocking wireless AP access according to an embodiment.
5 is a flowchart for explaining a method of blocking wireless AP access according to an embodiment.
6 is a flowchart illustrating a method of blocking wireless AP access according to an embodiment.
7 is a block diagram illustrating an exemplary wireless AP access blocking device according to an embodiment.
8 is a diagram illustrating a specific configuration of a SIEM server among wireless AP access blocking devices according to an embodiment.
9 is a flowchart illustrating a method of blocking wireless AP access according to an embodiment.

Hereinafter, embodiments will be described in detail with reference to the accompanying drawings. However, the scope of rights is not limited or limited by these embodiments. The same reference numerals in each drawing denote the same members.

The terminology used in the description below has been selected to be general and universal in the related technical field, but may have other terms depending on technology development and/or changes, conventions, and technical preferences. Therefore, the terms used in the following description should not be understood as limiting the technical idea, but should be understood as exemplary terms for describing the embodiments.

Also, in certain cases, some terms are arbitrarily selected by the applicant, and in this case, the detailed meaning will be described in the corresponding description. Therefore, the terms used in the description below should be understood based on the meaning of the term and the entire contents of the specification, not just the name of the term.

1 is a block diagram illustrating an exemplary wireless AP access blocking device according to an embodiment. In one embodiment, the wireless AP access blocking device 100 uses a security information and event management (SIEM) server to connect to a wireless AP where a user's terminal or mobile device, etc., whose identity is unknown, is managed. It may be a device that processes a process that blocks access.

In one embodiment, the wireless AP access blocking device 100 may include a SIEM server 110, a wireless AP database 120 and a blacklist database 130. The wireless AP database 120 and the blacklist database 130 may be implemented through a server and/or recording medium configured separately from the SIEM server 110, but the SIEM server 110 and all or some of its components may be implemented. It can also be implemented in a shared form.

In one embodiment, the wireless AP database 120 may store a wireless AP management list in which information related to the managed wireless AP is stored so that the SIEM server 110 can identify the managed wireless AP. For example, the wireless AP management list may include information such as the IP address and MAC address of the wireless AP.

In one embodiment, the wireless AP management list may additionally include information regarding the security level of the wireless AP. In this case, when access to the wireless AP of the user terminal is allowed, information regarding the security level of the wireless AP may be transmitted to the user terminal.

At this time, the security level of the wireless AP may be determined by the SIEM server 110 in the process of establishing the wireless AP database 120, or an external device for granting the security level may be additionally used. The wireless AP database 120 is constructed or updated in more detail below.

In one embodiment, the blacklist database 130 includes an abnormal user terminal list in which information related to the abnormal user terminal is stored so that the SIEM server 110 can identify the abnormal user terminal for blocking access for wireless AP protection. Can be saved. The abnormal user terminal refers to a terminal having a high risk of attack, such as hacking, to the wireless AP. In one embodiment, the abnormal user terminal list may include information such as the IP address of the abnormal user terminal.

In one embodiment, the abnormal user terminal list may include information on a high-risk user terminal capable of hacking or paralyzing a wireless AP through malware or the like.

In one embodiment, the abnormal user terminal list may be constructed and updated by acquiring information about the abnormal user terminal from a malware information provider providing the latest information about the malicious code distributors, phishing sites, and other harmful sites. As a non-limiting example, a method of receiving an IP address of an abnormal user terminal from an information providing service such as Malwaredomainlist and HpHosts may be used.

In addition, the abnormal user terminal list may be constructed and updated by collecting information about the abnormal user terminal using a malware search tool in the SIEM server 110. As a non-limiting example, a method of collecting the IP address of the abnormal user terminal using a malware search tool such as the Yara tool may be used.

On the other hand, by the IP spoofing of an unknown attacker, the possibility that a case where a verified wireless AP that should be used for work is registered in the abnormal user terminal list cannot be excluded. In order to respond to this type of attack, a specific IP or a specific IP band may be set not to be registered in the abnormal user terminal list. For example, an exception may be set so that the IP band of the AP or terminal used in the network is not registered in the abnormal user terminal list.

When the wireless AP database 120 and the blacklist database 130 are constructed in the manner described above, the SIEM server 110 receives a user terminal confirmation request from the wireless AP receiving the user terminal access request, and confirms the user terminal In response to the request, it is possible to determine whether to allow the user terminal to access the wireless AP using the blacklist database 130.

For example, the SIEM server 110 receives the IP address of the user terminal requesting access from the wireless AP, and whether the IP address of the user terminal is included in the list of abnormal user terminals stored in the blacklist database 130. Can be confirmed.

When the IP address of the user terminal is included in the list of abnormal user terminals, the SIEM server 110 transmits a connection blocking signal for the user terminal to the wireless AP, so that the wireless AP deletes the user terminal's access information from the memory. It is possible to block access to the user terminal.

If the IP address of the user terminal is not included in the list of abnormal user terminals, the SIEM server 110 may transmit a connection permission signal for the user terminal to the wireless AP to allow the wireless AP to access the user terminal. .

In this way, the SIEM server 110 identifies the wireless AP to be managed using the wireless AP database 120 in addition to the functions of the conventional SIEM server related to the network system, and the blacklist database 130. By using it, a function of blocking an abnormal user terminal from accessing a wireless AP to be managed may be performed.

2 is a view for explaining the operation of the wireless AP access blocking device according to an embodiment. Hereinafter, a process for blocking wireless AP access will be described with reference to FIG. 2.

In one embodiment, the SIEM server 220 may perform a process of interworking with the wireless AP 210 in advance to protect the wireless AP 210 by designating it as a management target. For example, the SIEM server 220 primarily checks whether normal communication with the wireless AP 210 is possible, and then receives the IP address and MAC address of the wireless AP 210 from the wireless AP 210, and the wireless AP 210 If the verification is successful by verifying the security of, the information related to the wireless AP 210 may be stored in the wireless AP management list of the wireless AP database 230.

In order to verify the security of the wireless AP 210, the SIEM server 220 checks whether the firmware version of the wireless AP 210 is maintained to the latest version, and the DNS settings of the wireless AP 210 are external attacks, etc. It can be checked whether it has been falsified or falsified.

In one embodiment, the SIEM server 220 may assign a security level to the wireless AP 210 that has verified security. The security level may be simply granted or disapproved, but preferably, it may be evaluated as three or more levels according to the security level.

Here, it has been described that the security verification and security rating of the wireless AP 210 are performed by the SIEM server 220, but an external device is used for security verification and/or security rating of the wireless AP 210. It may additionally or alternatively be used.

In one embodiment, the SIEM server 220 may build and update the blacklist database 250 to identify abnormal user terminals with high risk among unidentified user terminals.

For the construction of the blacklist database 250, the SIEM server 220 may receive information on the abnormal user terminal from the malware information provider 240 or collect information on the abnormal user terminal using a malware search tool. . The information for identification of the abnormal user terminal may include the IP address of the abnormal user terminal.

In a preferred embodiment, the SIEM server 220 may periodically update the blacklist database 250 so that the latest information is maintained in the abnormal user terminal list.

In one embodiment, the SIEM server 220 is the same period as the update period of the malware information provider 240 or a period shorter than the update period of the malware information provider 240, information about the abnormal user terminal from the malware information provider 240 By receiving it, it can be reflected in the list of abnormal user terminals in the blacklist database 250.

In addition, when a list of abnormal user terminals is constructed and updated using both the malware information provider 240 and the malware search tool, the cycle of collecting information about the abnormal user terminal using the malware search tool is the malware information provider 240 It may be set to be shorter than the period for receiving information on the abnormal user terminal from.

In one embodiment, when there is a request to access any user terminal 260 or 270 to the wireless AP 210 included in the wireless AP management list, the wireless AP 210 requests the SIEM server 220 to confirm the user terminal To send. For example, when requesting user terminal confirmation, the wireless AP 210 may transmit the IP address of the user terminal to the SIEM server 220.

When the user terminal verification request is received from the wireless AP 210, the SIEM server 220 checks whether the wireless AP 210 is an AP included in the management target by referring to the wireless AP management list of the wireless AP database 230. Can be. When the wireless AP 210 is the management target of the SIEM server 220, it can be checked whether the IP address of the user terminal received from the wireless AP 210 is included in the list of abnormal user terminals in the blacklist database 250. .

That is, the SIEM server 220 may determine whether to allow the user terminals 260 and 270 to access the wireless AP 210 with reference to the blacklist database 250. When the IP address of the user terminal is included in the abnormal user terminal list, the SIEM server 220 transmits a connection blocking signal to the wireless AP 210, and the IP address of the user terminal is not included in the abnormal user terminal list. If not, the SIEM server 220 may transmit a connection permission signal to the wireless AP 210.

The wireless AP 210 may block or allow access to the user terminals 260 and 270 according to the access blocking signal or the access permission signal received from the SIEM server 220. For example, for the user terminal 260 that is not included in the abnormal user terminal list of the black list database 250, access to the wireless AP 210 is allowed and included in the abnormal user terminal list of the black list database 250 The connected user terminal 270 may be blocked from accessing the wireless AP 210.

3 is a flowchart illustrating a method of blocking wireless AP access according to an embodiment. Specifically, FIG. 3 schematically shows a process of determining whether to allow wireless AP access in the SIEM server.

In step 310, the wireless AP management list may be stored in the wireless AP database. As described above, the wireless AP management list is a list reflecting a pre-interlocking process with a wireless AP for designating and protecting as a management target in the SIEM server, and may include information on one or more wireless APs whose security verification has been completed.

In step 320, the abnormal user terminal list may be stored in the black list database. As described above, the abnormal user terminal list may include information on terminals that are at high risk of attack, such as hacking on the wireless AP, and may be built and updated through a malware information provider and/or malware discovery tool. have.

In step 330, it may be determined whether to allow the user terminal to access the wireless AP using the blacklist database. To this end, for example, the SIEM server can check whether the IP address of the user terminal is included in the list of abnormal user terminals in the black list database. According to the confirmation result, the SIEM server may transmit an access permission signal or an access blocking signal to the wireless AP.

4 is a flowchart illustrating a method of blocking wireless AP access according to an embodiment. Specifically, FIG. 4 schematically shows a process of interworking the wireless AP management list and the wireless AP in the SIEM server.

In step 410, the SIEM server may receive the IP address and MAC address of the wireless AP from the wireless AP. In one embodiment, in addition to the IP address and the MAC address, when the security verification for the wireless AP is previously performed by an external device, for example, the security level may be received together in this step.

In step 420, the SIEM server may check whether communication with the wireless AP is possible through the IP address of the wireless AP. For example, the SIEM server may check whether normal communication with the corresponding AP is possible through wired and/or wireless communication using the public IP address of the wireless AP.

In step 430, the SIEM server may verify the security of the wireless AP. For example, the SIEM server can verify whether the wireless AP has a history affected by an external attack, such as checking the firmware version of the wireless AP and DNS settings of the wireless AP.

In step 440, the SIEM server may store information related to the wireless AP that has successfully verified security in the wireless AP database. For example, the SIEM server stores the verified wireless AP in the wireless AP management list of the wireless AP database, and then, if there is a request to access the corresponding wireless AP of any user terminal, the SIEM server determines whether to allow the access. The wireless AP can be protected.

5 and 6 are flowcharts for explaining a method of blocking wireless AP access according to an embodiment. Specifically, FIGS. 5 and 6 schematically illustrate a process in which an abnormal user terminal list of a blacklist database is built or updated.

5, an embodiment in which an abnormal user terminal list in a blacklist database is built or updated through a malware information provider will be described.

In step 510, the SIEM server may receive the IP address of the abnormal user terminal from the malware information provider. In one embodiment, the malware information provider may be an organization or a company that periodically updates and provides the latest information about the spreaders of malicious codes, phishing sites, and other harmful sites.

In step 520, the SIEM server may store the received IP address of the abnormal user terminal in the abnormal user terminal list. In a preferred embodiment, the receiving and storing of the IP address of the abnormal user terminal is periodically repeated so that the latest information is reflected in the abnormal user terminal list.

Referring to FIG. 6, an embodiment of constructing or updating an abnormal user terminal list of a blacklist database through a malware search tool will be described.

In step 610, the SIEM server may collect the IP address of the abnormal user terminal using a malware search tool. In one embodiment, the malware search tool may be implemented to detect malicious code or the like based on a string or a binary pattern using a Yara tool or the like.

In step 620, the SIEM server may store the collected IP address of the abnormal user terminal in the abnormal user terminal list. In a preferred embodiment, the collection and storage of the IP address of the abnormal user terminal is periodically repeated so that the latest information is reflected in the abnormal user terminal list.

5 and 6 are not mutually exclusive, and the two methods may be used in parallel or may be configured to be selectively used. Particularly, when two methods are used in parallel, the update period according to each method may be set differently from each other.

7 is a block diagram illustrating an exemplary wireless AP access blocking device according to an embodiment. The wireless AP access blocking device 700 according to an embodiment may include a SIEM server 710, a wireless AP database 720, a blacklist database 730, and a vulnerability database 740.

The SIEM server 710 may determine whether to allow the user terminal to access the wireless AP using a blacklist database and a vulnerability database in response to a user terminal confirmation request received from the wireless AP included in the wireless AP management list. have.

In other words, by searching the blacklist database 730 and the vulnerability database 740 for the user terminal to be connected to the wireless AP, reviewing whether it corresponds to the blacklist and to what extent it is vulnerable to the wireless AP. You can allow or block access.

The wireless AP database 720 may store a wireless AP management list. The SIEM server 710 may manage a plurality of wireless APs, and may store a plurality of wireless AP management lists corresponding thereto.

Specifically, the wireless AP database 720 may store an IP address and a MAC address of a managed wireless AP. The SIEM server 710 may manage a wireless AP registered in the wireless AP database 720, and may perform blacklist determination and vulnerability determination for a user terminal attempting to access the wireless AP.

The blacklist database 730 may store a list of abnormal user terminals. The abnormal user terminal refers to a terminal having a high risk of attacking a wireless AP such as a DDoS attack or a hack. For example, a user terminal that has attempted to hack a wireless AP or a terminal that has generated excessive traffic when the terminal accesses the wireless AP may be classified as an abnormal user terminal.

The IP address or MAC address of the terminal classified as the abnormal terminal may be stored in the blacklist database 730. Information on the abnormal terminal may be received and stored from an external server, and the SIEM server may directly determine the abnormal terminal and store related information of the corresponding terminal.

The vulnerability database 740 may store vulnerability information for a user terminal. Specifically, information related to a vulnerability received from an external server may be stored. In addition, the SIEM server 710 may perform vulnerability analysis on the user terminal accessing the wireless AP and store discovered vulnerability information.

In addition, the vulnerability database 740 may store the determined vulnerability score or grade in addition to the detailed vulnerability. The detection results of vulnerabilities of wireless APs and terminals are stored and processed in log form.

As a result, the SIEM server 710 can manage wireless APs stored in the wireless AP database 720, and blacklist database 730 and vulnerability database 740 for user terminals performing access to the wireless AP. ) May be performed to determine whether to allow access to the wireless AP. The configuration and the specific verification process of the SIEM server will be described in detail in FIGS. 8 and 9.

8 is a diagram illustrating a specific configuration of a SIEM server among wireless AP access blocking devices according to an embodiment. The SIEM server 810 according to an embodiment may include a wireless AP management unit 811, a vulnerability detection unit 813, and a vulnerability processing unit 815.

The SIEM server 810 may manage the wireless AP 850. Although only one wireless AP 850 is exemplarily illustrated in FIG. 8, the present invention is not limited thereto, and may be connected to a plurality of wireless APs to manage a plurality of wireless APs.

A first user terminal 860 and a second user terminal 870 may attempt to access the wireless AP 850. As in the case of the wireless AP 850, a plurality of terminals can perform the connection, but only two terminals are exemplarily illustrated, but the present invention is not limited thereto. That is, it is possible that multiple terminals try to access.

Hereinafter, each configuration will be described in detail. The wireless AP management unit 811 may notify each terminal of the vulnerability, and determine whether to allow access to the user terminal according to the measured vulnerability score.

The vulnerability detection unit 813 may perform vulnerability detection for each user terminal 860 and 870 attempting to connect to the managed wireless AP. Information used for vulnerability detection can be periodically retrieved from the vulnerability database, or separate vulnerability data from external servers can be imported.

The vulnerability results detected for the user terminals 860 and 870 may be stored in the terminal vulnerability database. In addition, the result of the vulnerability detection may be transmitted to each user terminal 860 and 870 through the wireless AP management unit 811.

The results of the vulnerability information of the first user terminal 860 and the second user terminal 870 attempting to connect to the wireless AP 850 are stored in the vulnerability database of the AP access blocking device, and the SIEM server 810 wirelessly The AP management unit 811 determines whether to block/allow. The determined result is notified to the wireless AP through the wireless AP management unit 811, and the first and second user terminals 860 and 870 are managed.

The wireless AP manager 811 is interworked with the wireless AP 850 to manage, and performs control of the wireless AP 850. The first user terminal 860 and the second user terminal 870 using the wireless AP 850 may be managed by the wireless AP management unit 811 through the wireless AP.

By way of example, but not limitation, the first user terminal 860 may be allowed access to the wireless AP 850, and the second user terminal 870 may be blocked from accessing the wireless AP 850. Can be.

Whether to allow access to the wireless AP 850 may be determined by the wireless AP management unit 811 according to the final score of vulnerability and the high risk number to be described below.

When the first and second user terminals 860 and 870 attempt to access the wireless AP 850, the vulnerability detection unit 813 performs vulnerability detection for each user terminal. Specifically, the vulnerability detection unit 813 checks whether there are items matching known vulnerabilities with respect to operating systems of open ports, installed software, and software status using each port in the user terminal attempting to access.

As a result of detection, information on whether it matches or does not match known vulnerabilities is stored in the vulnerability database.

Table 1 below shows an example of the items stored in the vulnerability database.

User terminal Vulnerability contents score Final score measure Cell phone001 Detailed Vulnerability 1 9.5 27.5 Block/Notify Detailed Vulnerability 2 5.0 Detailed Vulnerability 3 4.0 Detailed Vulnerability 4 9.0 Notebook001 Detailed Vulnerability 1 6.5 19.5 Allow/Notify Detailed Vulnerability 2 5.0 Detailed Vulnerability 3 4.0 Detailed Vulnerability 4 4.0 Notebook002 none 0 0 permit

The user terminal is an identifier for each user terminal connected to the wireless AP. A different name may be assigned to each user terminal. Vulnerability content means details of the detected vulnerability. The vulnerability detection unit 813 may evaluate the risk of each detail by scoring each vulnerability.

The final score is the combined score of each detailed vulnerability. If the vulnerability score is higher than the reference, the wireless AP management unit 811 blocks access to the wireless AP of the corresponding terminal. Alternatively, access to the wireless AP is blocked even if the item with a high score is higher than the reference number.

The action indicates the action performed by the wireless AP management unit 811 based on the final score associated with the vulnerability. If it is judged to be dangerous according to the result of the vulnerability determination, blocking and notification of the vulnerability are carried out. As a result of vulnerability determination, access to the wireless AP is allowed in the normal case, but notification of the determined vulnerability is performed. Lastly, if it is secure, it allows access to the wireless AP without any notice.

The vulnerability detection unit 813 may be linked to the vulnerability processing unit 815. The vulnerability processing unit 815 may collect the latest vulnerability information in connection with a database of an externally-authorized vulnerability providing institution, and provide the collected information to the vulnerability detection unit 813.

Exemplarily, but not limited to, vulnerability information may use Common Vulnerabilities and Exposures (CVE). The vulnerability processing unit 815 periodically imports and applies CVE, and works with the vulnerability detection unit 813 to perform vulnerability detection for the user terminal.

The score for the vulnerability can use the Common Vulnerability Scoring System (CVSS). CVSS is a system for scoring vulnerabilities for each CVE, and can score points from 0 to 10 for each risk. Each item in the CVE has a predefined CVSS score.

The vulnerability processing unit 815 checks and sums each individual vulnerability score, and grasps the number of items having a high risk of 8 or higher. The result of the summation score and the number of high-risk items is recorded in the vulnerability database. Based on this, the wireless AP management unit 811 blocks access when the sum of scores is greater than a certain score and the number of high-risk items is greater than a certain number.

Table 2 below shows the details of the wireless AP access permission criteria of the user terminal by way of example. This is only an example, and is not limited thereto, and the scores for blocking and allowing can be changed by a person skilled in the art.

Final score Rating High risk count 20 points or more danger 2 or more 10 points or more and less than 20 points usually One Less than 10 safety 0

For example, if the final score is 20 or more, it can be judged as a risk level, if it is 10 or more and less than 20, it can be judged as normal, and if it is less than 10, it can be judged as a safety level. If the number of vulnerabilities is two or more, it can be judged as a risk level, if one is normal, and if it is not, it can be judged as a safety level.

Vulnerability ratings can be determined by using the final score criteria and high-risk number criteria in combination, and it is possible to determine whether to allow access to the wireless AP or notify the vulnerability according to the determined rating.

9 is a flowchart illustrating a method of blocking wireless AP access according to an embodiment. The wireless AP access blocking method according to an embodiment includes a vulnerability information collection step 910, a vulnerability detection step 920 of the user terminal, a vulnerability score calculation step 930, a step 940 determining whether the score is below a reference score, a reference score It may be configured as a step 960 to determine whether the abnormality.

The vulnerability information collection step 910 is a step of collecting vulnerability information by the vulnerability processing unit. For example, information about vulnerabilities can be collected from external servers such as CVE. Alternatively, vulnerability information may be collected through vulnerability detection of a user terminal.

The vulnerability detection step 920 of the user terminal is a step of detecting the vulnerability of the user terminal with respect to the user terminal attempting to access the wireless AP managed by the SIEM server. Specifically, it is a step of grasping detailed vulnerabilities with respect to the operating system of ports opened to the user terminal, installed software, and software status using each port.

The vulnerability score calculation step 930 is a step of calculating the scores of the vulnerabilities detected in the vulnerability detection step 920 of the user terminal. Exemplarily, but not limited to, the vulnerability score can be calculated by adding up the CVSS score for the vulnerability of the CVE.

The step 940 of determining whether the score is below the reference score (X point) is a step of determining whether the calculated vulnerability score is below the first reference score X score. X may be set to 10 as an example, which is exemplary and can be set to a range easily changeable by a person skilled in the art. That is, it is also possible to set the reference score differently from the above embodiment by adjusting according to the vulnerability score band.

The step 960 of determining whether the score is greater than or equal to the reference score (Y point) is similar to the step 940 of determining whether the score is less than or equal to the reference score (X point). It is a judgment step. Y may be set to 20 as an example, and specific values may be set differently.

It is determined that the vulnerability score is 10 points or less, and if it is 10 points or less, it is determined to be safe, and according to step 950, access to the wireless AP is allowed and a separate notification may not be performed.

On the other hand, if it is not 10 points or less, that is, if it exceeds 10 points, it is determined according to whether it is 20 points or more. If the score is 20 points or more, it is determined as a risk level and the access to the wireless AP is blocked according to step 970, and the content of the vulnerability can be notified to the user terminal attempting the access.

Finally, if it is not more than 10 points, but not more than 20 points, it is judged as a normal level, and access is allowed according to step 980, but notification can be made about the vulnerability.

According to an apparatus and method for blocking access to a wireless AP according to an embodiment, a user terminal that is blocked from accessing and notified of vulnerability information may attempt to reconnect after correcting the above-noted vulnerability. That is, if a reconnection is attempted after the vulnerability is corrected, the vulnerability detection process is performed again, and if the vulnerability is passed, normal access may be allowed.

According to another embodiment, in addition to detailed vulnerability information, the vulnerability database may store detailed description data of the vulnerability correction method. Among the stored vulnerability correction method data, a method of notifying the correction method data corresponding to a case in which the user terminal transmits vulnerability information is also possible. As a result, the user of the user terminal can check the problem of the terminal and then take action to facilitate the connection.

The device described above may be implemented with hardware components, software components, and/or combinations of hardware components and software components. For example, the devices and components described in the embodiments include, for example, processors, controllers, arithmetic logic units (ALUs), digital signal processors (micro signal processors), microcomputers, field programmable arrays (FPAs), It may be implemented using one or more general purpose computers or special purpose computers, such as a programmable logic unit (PLU), microprocessor, or any other device capable of executing and responding to instructions. The processing device may run an operating system (OS) and one or more software applications running on the operating system. In addition, the processing device may access, store, manipulate, process, and generate data in response to the execution of the software. For convenience of understanding, a processing device may be described as one being used, but a person having ordinary skill in the art, the processing device may include a plurality of processing elements and/or a plurality of types of processing elements. It can be seen that may include. For example, the processing device may include a plurality of processors or a processor and a controller. In addition, other processing configurations, such as parallel processors, are possible.

The software may include a computer program, code, instruction, or a combination of one or more of these, and configure the processing device to operate as desired, or process independently or collectively You can command the device. Software and/or data may be interpreted by a processing device, or to provide instructions or data to a processing device, of any type of machine, component, physical device, virtual equipment, computer storage medium or device. , Or may be permanently or temporarily embodied in the transmitted signal wave. The software may be distributed over networked computer systems and stored or executed in a distributed manner. Software and data may be stored in one or more computer-readable recording media.

The method according to the embodiment may be implemented in the form of program instructions that can be executed through various computer means and recorded on a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, or the like alone or in combination. The program instructions recorded in the medium may be specially designed and configured for the embodiments or may be known and usable by those skilled in computer software. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tapes, optical media such as CD-ROMs, DVDs, and magnetic media such as floptical disks. -Hardware devices specifically configured to store and execute program instructions such as magneto-optical media, and ROM, RAM, flash memory, and the like. Examples of program instructions include high-level language code that can be executed by a computer using an interpreter, etc., as well as machine language codes produced by a compiler. The hardware device described above may be configured to operate as one or more software modules to perform the operations of the embodiments, and vice versa.

Although the embodiments have been described by the limited drawings, those skilled in the art can make various modifications and variations from the above description. For example, the described techniques are performed in a different order than the described method, and/or the components of the described system, structure, device, circuit, etc. are combined or combined in a different form from the described method, or other components Alternatively, even if replaced or substituted by equivalents, appropriate results can be achieved.

Therefore, other implementations, other embodiments, and equivalents to the claims are also within the scope of the following claims.

Claims (17)

A wireless AP database storing a wireless AP management list;
A vulnerability database that stores vulnerability information for a user terminal;
A blacklist database storing a list of abnormal user terminals including terminals that have generated abnormal traffic by accessing the wireless AP; And
In response to the user terminal confirmation request received from the wireless AP included in the wireless AP management list, SIEM (Security Information and Security) determines whether the user terminal is allowed to access the wireless AP using the blacklist database and the vulnerability database. Event Management) server
Including,
The SIEM server
Using the vulnerability information of the user terminal determined by checking whether there is a vulnerability to the operating system of the ports opened to the user terminal attempting to access, installed software, and the software state using each port, the user terminal of the user terminal A wireless AP access blocking device for determining whether to allow access to the wireless AP. According to claim 1,
The SIEM server performs vulnerability check of the user terminal attempting to access the wireless AP and stores it in the vulnerability database,
Wireless AP access blocking device. According to claim 2,
The SIEM server notifies the vulnerability of the user terminal attempting to access the wireless AP,
Wireless AP access blocking device. According to claim 3,
The SIEM server calculates a vulnerability score of the user terminal attempting to access the wireless AP, and allows the access to the wireless AP when the vulnerability score is equal to or less than a predetermined first value, and the vulnerability score is the first If the value exceeds the predetermined second value, the vulnerability is notified to the user terminal while allowing access to the wireless AP. If the vulnerability score is greater than or equal to the second value, access to the wireless AP is blocked and the user terminal is accessed. To report vulnerabilities,
Wireless AP access blocking device. According to claim 1,
The SIEM server receives IP addresses and MAC addresses of the one or more wireless APs from one or more wireless APs, verifies the security of the one or more wireless APs, and transmits information related to the verified wireless APs to the wireless AP management list. Stored,
Wireless AP access blocking device. According to claim 1,
The SIEM server collects the MAC address of the abnormal user terminal from a malware information provider or uses the malware search tool to collect the MAC address of the abnormal user terminal, and collects the MAC address of the abnormal user terminal from the abnormal user terminal Stored in a list,
Wireless AP access blocking device. According to claim 1,
The user terminal confirmation request includes the MAC address of the user terminal,
The SIEM server checks whether the MAC address of the user terminal is included in the abnormal user terminal list,
Wireless AP access blocking device. The method of claim 7,
When the MAC address of the user terminal is included in the abnormal user terminal list, the SIEM server transmits a connection blocking signal for the user terminal to the wireless AP,
Wireless AP access blocking device. In the wireless AP access blocking method for blocking access to a wireless AP using a SIEM server,
Storing a wireless AP management list in a wireless AP database;
Storing a list of abnormal user terminals including terminals that generated abnormal traffic by accessing the wireless AP in a blacklist database;
Storing vulnerability information for the user terminal in a vulnerability database; And
In response to a user terminal confirmation request received from the wireless AP included in the wireless AP management list, determining whether to allow the user terminal to access the wireless AP using the blacklist database and the vulnerability database.
Including,
The step of determining whether the user terminal is allowed to access the wireless AP is
Using the vulnerability information of the user terminal determined by checking whether there is a vulnerability to the operating system of the ports opened to the user terminal attempting to access, installed software, and the software state using each port, the user terminal of the user terminal A wireless AP access blocking method for determining whether to allow access to the wireless AP. The method of claim 9,
The step of storing the vulnerability information in the vulnerability database is to perform a vulnerability check of a user terminal attempting to access the wireless AP and store the vulnerability information in the vulnerability database. The method of claim 10,
Step of notifying the user terminal attempting to access the wireless AP vulnerability information
Wireless AP access blocking method further comprising a. The method of claim 10,
Calculating a vulnerability score of the user terminal attempting to access the wireless AP; And
When the vulnerability score is less than or equal to a first predetermined value, access to the wireless AP is allowed, and when the vulnerability score is greater than the first value and less than a predetermined second value, access to the wireless AP is allowed, and to the user terminal. Notifying the vulnerability, and if the vulnerability score is greater than or equal to the second value, blocking access to the wireless AP and notifying the user terminal of the vulnerability
Wireless AP access blocking method further comprising a. The method of claim 9,
The step of storing the wireless AP management list in the wireless AP database,
Receiving an IP address and a MAC address of the one or more wireless APs from one or more wireless APs; And
Verifying the security of the one or more wireless APs and storing information associated with the wireless APs that are successfully verified in the wireless AP management list
Including, wireless AP access blocking method. The method of claim 9,
The step of storing the abnormal user terminal list in the black list database,
Collecting the MAC address of the abnormal user terminal from a malware information provider;
Collecting the MAC address of the abnormal user terminal using a malware search tool; And
Storing the collected MAC address of the abnormal user terminal in the abnormal user terminal list
Including, wireless AP access blocking method. The method of claim 9,
The user terminal confirmation request includes the MAC address of the user terminal,
Determining whether to allow the user terminal to access the wireless AP using the black list database includes checking whether the MAC address of the user terminal is included in the abnormal user terminal list,
How to block wireless AP access. The method of claim 15,
When the MAC address of the user terminal is included in the list of abnormal user terminals, transmitting a connection blocking signal to the user terminal to the wireless AP.
Further comprising, a wireless AP access blocking method. A computer-readable recording medium containing a program for performing a method for blocking wireless AP access according to any one of claims 9 to 16.

Images