KR102220877B1 - Device for testing performance of wireless intrusion prevention system and recording medium storing program for performing the same - Google Patents

Abstract

Disclosed are an apparatus for testing performance of a wireless intrusion prevention system and a recording medium. The performance test apparatus of the wireless intrusion prevention system includes: a first communication module connected to a wireless network in which a wireless intrusion prevention system (WIPS) is built; A second communication module using a wireless LAN card separate from the first communication module and monitoring packets transmitted and received through the first communication module; A control module for controlling the first communication module to operate as a virtual access point and a plurality of virtual terminals; A packet generation module for generating a packet according to a preset item so that packet transmission and reception can be performed between the virtual access point and a plurality of virtual terminals; And a blocking packet analysis module for analyzing blocking packets transmitted from the WIPS sensor of the wireless intrusion prevention system to at least one of the virtual access point and a plurality of virtual terminals.

Description

Performance test device and recording medium of wireless intrusion prevention system {DEVICE FOR TESTING PERFORMANCE OF WIRELESS INTRUSION PREVENTION SYSTEM AND RECORDING MEDIUM STORING PROGRAM FOR PERFORMING THE SAME}

The present disclosure relates to a performance test apparatus and a recording medium of a wireless intrusion prevention system.

In general, wireless networks are more convenient to use than wired networks, but the user terminal accessing the wireless network is physically separated from the network equipment, and the data transmitted through the wireless network is exposed to the air. There was a disadvantage that the possibility of leakage of data was greater than that of wired networks.

Recently, as a technology to strengthen the security of a wireless network, a wireless intrusion prevention system (WIPS) has been developed and has been widely used. A typical wireless intrusion prevention system consists of a WIPS server and one or more WIPS sensors, and the WIPS sensor collects unique information (MAC address, serial number, hardware information, etc.) on a plurality of wireless devices connected to the wireless network. It monitors the occurrence of intrusion, attacks, and abnormal conditions on the wireless network where the wireless device is located, reports the details to the WIPS server, and receives a control signal for response from the WIPS server and is connected to the wireless network. By transmitting to the wireless device, unauthorized wireless device access is blocked.

However, conventionally, it was difficult to monitor and check whether such a wireless intrusion prevention system normally operates or how efficiently controls unauthorized wireless equipment, and some of the wireless intrusion prevention system products on the market are equipped with a monitoring function of the system itself. Since the monitoring function is applied only to the wireless intrusion prevention system products of a specific manufacturer, there were limitations in terms of compatibility and scalability, and because monitoring is performed through the console of the wireless intrusion prevention system, if the wireless intrusion prevention system is not installed Performance monitoring was impossible.

On the other hand, Korean Patent Publication No. 10-1591801 (hereinafter referred to as'conventional technology') proposes a technology for measuring the security performance of the wireless intrusion prevention system by measuring the point at which illegal access is blocked from the wireless intrusion prevention system. have. However, since the prior art is a technology in which one of the first communication module and the second communication module is operated as a management AP and the other is operated as a terminal that attempts illegal access, performance monitoring is limited to a single channel. The development of a new technology overcoming the aforementioned limitations is required in that it is possible to check only the normal operation.

The technical idea of the present disclosure is to solve the above-described problem, and is not limited to the types of wireless intrusion prevention systems for each manufacturer, and an object thereof is to provide a technology capable of examining the blocking operation of the wireless intrusion prevention system.

Another object of the present disclosure is to provide a technique capable of verifying a blocking operation of a wireless intrusion prevention system in a plurality of channels.

Another object of the present disclosure is to provide a technology capable of verifying not only the blocking operation of the wireless intrusion prevention system, but also the quality of the wireless network blocking operation performed in the wireless intrusion prevention system.

The problem to be solved by the present invention is not limited to the above-described problem, and other technical problems that are not mentioned will be clearly understood by those of ordinary skill in the technical field to which the present invention belongs from the following description.

In order to achieve this object, as an embodiment of the present invention, a performance test apparatus for a wireless intrusion prevention system includes: a first communication module connected to a wireless network in which a wireless intrusion prevention system (WIPS) is built; A second communication module using a wireless LAN card separate from the first communication module and monitoring packets transmitted and received through the first communication module; A control module for controlling the first communication module to operate as a virtual access point and a plurality of virtual terminals; A packet generation module for generating a packet according to a preset item so that packet transmission and reception can be performed between the virtual access point and a plurality of virtual terminals; And a blocking packet analysis module for analyzing blocking packets transmitted from the WIPS sensor of the wireless intrusion prevention system to at least one of the virtual access point and a plurality of virtual terminals; and wherein the control module includes the virtual access A point and a plurality of virtual terminals control packet transmission and reception using one channel, or control so that packet transmission and reception are performed using different channels for each virtual terminal, and the performance test apparatus of the wireless intrusion prevention system When a blocking packet is transmitted from the WIPS sensor to at least one of the virtual access point and a plurality of virtual terminals in a situation in which the access point of and a plurality of virtual terminals transmit and receive packets through different channels for each virtual terminal, each It further includes a multi-channel blocking function check unit for checking whether the wireless network access blocking of each channel is normally performed.

delete

In addition, the packet generation module may generate an attack packet according to at least one attack type to attack the wireless network.

In addition, when the WIPS sensor transmits a blocking packet for each attack type generated by the WIPS server of the wireless intrusion prevention system to at least one of the virtual access point and a plurality of virtual terminals, the transmitted blocking packet Blocked packet verification unit for each attack to check whether the attack type is normally generated; A blocking packet uniformity verification unit checking whether blocking packets transmitted from the WIPS sensor are uniformly transmitted by checking each unit time; When at least one of the virtual access point and the plurality of virtual terminals receives the blocking packet transmitted from the WIPS sensor, it checks whether the wireless network access of the received virtual device is blocked, and the responsiveness to the blocking packet is determined. Blocked packet response analysis unit to analyze; A blocking packet signal strength tester measuring the signal strength of the blocking packet transmitted from the WIPS sensor; And when access to at least one of the virtual access points and the plurality of virtual terminals is blocked, an external WIPS server by analyzing the blocking packet received by the blocked device to check the unique identification information of the WIPS server. It may include an external WIPS blocking verification unit to determine whether or not involved in blocking.

delete

In addition, the control module controls the virtual terminals of the plurality of virtual terminals to be connected to each other to operate in an ad-hoc mode, or the control module is a virtual master in which the first communication module is connected to the wireless network. Controls to operate as an access point, a virtual slave access point receiving a radio signal from the virtual master access point, and a plurality of virtual terminals wirelessly connected to the virtual slave access point, and the blocking packet analysis module is in an ad hoc mode It may further include an ad-hoc blocking analysis unit that checks whether the wireless network access of the virtual terminals connected by is blocked, and a WDS blocking analysis unit that checks whether the wireless network access of the virtual master access point and the slave access point is blocked.

In order to achieve this object, as another embodiment of the present invention, a computer-readable recording medium includes a first function that is connected to a wireless network in which a wireless intrusion prevention system is built through a first wireless LAN card; A second function that is connected to the wireless network through a second wireless LAN card and monitors packets transmitted and received to and from the first wireless LAN card; A third function of operating the first wireless LAN card as a virtual access point and a plurality of virtual terminals; A fourth function of generating a packet according to a preset item so that packet transmission/reception can be performed between the virtual access point and a plurality of virtual terminals; A fifth function of analyzing a blocking packet transmitted from a WIPS sensor of the wireless intrusion prevention system to at least one of the virtual access point and a plurality of virtual terminals; A sixth function of controlling packet transmission/reception between the virtual access point and a plurality of virtual terminals using one channel; A seventh function of controlling packet transmission and reception between the virtual access point and a plurality of virtual terminals by using different channels for each virtual terminal; When a blocking packet is transmitted from the WIPS sensor to at least one of the virtual access point and a plurality of virtual terminals in a situation where the virtual access point and the plurality of virtual terminals transmit and receive packets through different channels for each virtual terminal , An eighth function of checking whether the wireless network access blocking of the virtual terminal for each channel is normally performed; A ninth function of generating an attack packet according to at least one attack type to attack the wireless network; When the WIPS sensor transmits a blocking packet for each attack type generated by the WIPS server of the wireless intrusion prevention system to at least one of the virtual access point and a plurality of virtual terminals, whether the transmitted blocking packet is normally generated for each attack type A tenth function of checking; An eleventh function of checking whether a blocking packet transmitted from the WIPS sensor is uniformly transmitted by checking for each unit time; When at least one of the virtual access point and the plurality of virtual terminals receives the blocking packet transmitted from the WIPS sensor, it checks whether the wireless network access of the received virtual device is blocked, and the responsiveness to the blocking packet is determined. A twelfth function of analyzing; A thirteenth function of measuring the signal strength of the blocking packet transmitted from the WIPS sensor; When access to at least one of the virtual access point and the plurality of virtual terminals is blocked, an external WIPS server by analyzing the blocking packet received by the blocked virtual device to check the unique identification information of the WIPS server A 14th function of determining whether or not is involved in blocking; A fifteenth function of controlling an arbitrary virtual terminal among the plurality of virtual terminals to operate while being connected to each other in an ad-hoc mode; A virtual master access point to which the first wireless LAN card is connected to the wireless network, a virtual slave access point receiving a radio signal from the virtual master access point, a plurality of virtual terminals wirelessly connected to the virtual slave access point A sixteenth function of controlling to operate as a function; A 17th function of checking whether a wireless network connection of virtual terminals connected in an ad hoc mode is blocked; And an eighteenth function of checking whether access to a wireless network between the virtual master access point and the slave access point is blocked; a program capable of executing on a computer may be recorded.

The means for solving the above-described problems are merely exemplary and should not be construed as limiting the present invention. In addition to the above-described exemplary embodiments, there may be additional embodiments described in the drawings and detailed description of the invention.

As described above, according to various embodiments of the present invention, the blocking operation of the wireless intrusion prevention system can be verified without being limited to the type of each manufacturer of the wireless intrusion prevention system.

In addition, according to various embodiments of the present invention, since the verification is not performed by being built into the wireless intrusion prevention system, it is configured independently of the wireless intrusion prevention system to verify the performance of the wireless intrusion prevention system. Without installation, the wireless network blocking operation and blocking quality of the wireless intrusion prevention system can be verified.

In addition, in various embodiments of the present invention, the first communication module operates as a virtual access point and a plurality of virtual terminals, and packet transmission and reception is performed between the virtual access point and a plurality of virtual terminals. It is performed using a channel, and the second communication module monitors packets transmitted/received through the first communication module, so that when verifying the blocking operation of the wireless intrusion prevention system, it is possible to monitor not only a single channel but also multiple channels.

In addition, according to various embodiments of the present invention, further verifying the blocking operation of the wireless intrusion prevention system, the quality of the wireless network blocking operation performed in the wireless intrusion prevention system can be specifically verified.

Effects according to various embodiments of the present invention are not limited to the above-mentioned effects, and other effects that are not mentioned will be clearly understood by those skilled in the art from the description of the claims.

1 is a block diagram schematically showing configurations of an apparatus for testing performance of a wireless intrusion prevention system according to an embodiment of the present invention.
2 is a block diagram schematically showing each configuration of a blocked packet analysis module according to an embodiment of the present invention.

Preferred embodiments of the present invention will be described in more detail with reference to the accompanying drawings, but technical parts that are already well-known will be omitted or compressed for conciseness of description.

It should be noted that references to "one" or "one" embodiment of the present invention in this specification are not necessarily to the same embodiment, and they mean at least one.

In the following embodiments, terms such as first and second are not used in a limiting meaning, but for the purpose of distinguishing one component from another component.

In the following examples, expressions in the singular include plural expressions unless the context clearly indicates otherwise.

In the following embodiments, terms such as include or have means that the features or elements described in the specification are present, and do not preclude the possibility of adding one or more other features or elements.

Since each configuration shown in the drawings is arbitrarily shown for convenience of description, the present invention is not necessarily limited to what is shown.

1 is a block diagram schematically showing each configuration of a performance testing apparatus of a wireless intrusion prevention system according to an embodiment of the present invention, and FIG. 2 is a block diagram showing each configuration of a blocked packet analysis module according to an embodiment of the present invention. It is a schematic block diagram. In the present specification, the wireless intrusion prevention system 20 is a system that blocks intrusion and attacks of unauthorized equipment on the wireless network 30, and the WIPS server 21 generates and manages blocking packets, and the WIPS server 21 It may include a WIPS sensor 22 that transmits the generated blocking packet to an access point or terminal connected to the wireless network 30.

1 and 2, the performance test apparatus 10 of the wireless intrusion prevention system according to an embodiment includes a first communication module 100, a second communication module 200, a control module 300, and packet generation. A module 400, a blocked packet analysis module 500, a multi-channel blocking function inspection unit 600, a WIPS shadow area analysis unit 700, and a report generation unit 800 may be included.

The first communication module 100 may be connected to a wireless network 30 in which a wireless intrusion prevention system (WIPS) 20 is built. In an embodiment, the first communication module 100 may perform wireless communication using a first wireless LAN card.

The second communication module 200 uses a wireless LAN card (ie, a second wireless LAN card) separate from the first communication module 100 and may monitor packets transmitted and received through the first communication module 100. For example, the second communication module 200 may receive all types of data packets transmitted/received by the first communication module 100 and check for each wireless channel. In one embodiment, the second communication module 200 is a wireless intrusion prevention system so that a wireless LAN analysis module (not shown) can analyze a Basic Service Set IDentifier (BSSID), a channel, a signal strength, a transmission method, a modulation method, etc. It is possible to collect packets that pass through the wireless network 30 to which the performance test apparatus 10 is connected. The wireless LAN analysis module may analyze a wireless LAN usage status for each channel and a device status using the wireless LAN based on the packets collected by the second communication module 200.

The control module 300 may generally control each component of the performance test apparatus 10 of the wireless intrusion prevention system. In an embodiment, the control module 300 sets the first communication module 100 to operate as a virtual access point and a plurality of virtual terminals, and controls to exchange packets created by the packet generation module 400 to be described later with each other. I can. At this time, the control module 300 may control a virtual access point and a plurality of virtual terminals to transmit and receive packets using a single channel, and according to implementation, the virtual access point and a plurality of virtual terminals may use a different channel for each virtual terminal. It is also possible to control so that packet transmission and reception are performed with the access point of.

When the first communication module 100 is set to operate as a virtual access point and a plurality of virtual terminals, the packet generation module 400 is preset so that packets can be transmitted and received between the virtual access point and a plurality of virtual terminals. You can create a packet according to. That is, the packet generation module 400 may generate packets used for general data communication between the access point and the terminal, and in addition, may generate packets for each type of network attack.

The source code capable of generating various types of packets may be pre-stored in the packet generation module 400. In addition, the packet generation module 400 may generate an attack packet according to at least one attack type to attack the wireless network 30. For example, the packet generation module 400 may generate attack packets for each attack type, such as denial of service attack, MAC spoofing, and malformed packet. In one embodiment, packets can be transmitted/received with a virtual access point using different channels for each virtual terminal, and the control module 300 can control each terminal to transmit an attack packet to the virtual access point. Network attacks can be implemented.

Of course, depending on the implementation, the control module 300 increases the number of virtual terminals using the same channel and transmits an attack packet, thereby measuring how many terminals the WIPS server 21 can defend on the same channel. , The control module 300 allocates different channels for each virtual terminal, but transmits an attack packet while increasing the number of channels to measure how many channels the WIPS server 21 can defend.

The blocked packet analysis module 500 may analyze a blocked packet transmitted from the WIPS sensor 22 of the wireless intrusion prevention system 20 to at least one of a virtual access point and a plurality of virtual terminals. In one embodiment, the blocked packet analysis module 500 includes a block packet verification unit 510 for each attack, a block packet uniformity verification unit 520, a block packet response level analysis unit 530, a block packet signal strength check unit 540, An external WIPS blocking verification unit 550, an ad hoc blocking analysis unit 560, and a WDS blocking analysis unit 570 may be included.

The attack-specific blocking packet verification unit 510 uses the WIPS sensor 22 to detect at least one of the virtual access point and a plurality of virtual terminals for blocking packets for each attack type generated by the WIPS server 21 of the wireless intrusion prevention system 20. In the case of transmission to any one, it may be checked whether a blocking packet transmitted from the WIPS sensor 22 to a virtual device (ie, a virtual access point or terminal) is normally generated for each attack type. The blocked packet verification unit 510 for each attack may pre-store information on the blocked packet for each attack type, and may determine whether or not the blocked packet received by the virtual device is normal based on the previously stored information.

For example, in the first communication module 100, the first access point, which is a virtual access point, is registered on the WIPS server 21 as a management AP, and the virtual first terminal is set as an unauthorized terminal. When the terminal performs a MAC spoofing attack to the first access point, the WIPS sensor 22 provided in the wireless intrusion prevention system 20 detects this and transmits a first blocking packet capable of blocking the MAC spoofing attack to the first terminal. Then, the attack-specific blocking packet verification unit 510 may determine whether the first blocking packet has been normally generated using the previously stored information.

The blocking packet uniformity verification unit 520 may check whether the blocking packet transmitted from the WIPS sensor 22 is uniformly transmitted by checking for each unit time. For example, the blocking packet uniformity verification unit 520 may numerically calculate the uniformity by checking the size of the blocking packet per unit time received by the virtual access point or the virtual terminal, and checking whether the packet size is uniform. .

When at least one of a virtual access point and a plurality of virtual terminals receives a blocking packet transmitted from the WIPS sensor 22, the blocking packet response degree analysis unit 530 is a received virtual device (access point or terminal). By checking whether the connection between the and the wireless network 30 is successfully blocked, a response degree to the blocked packet may be analyzed.

The blocking packet signal strength inspection unit 540 measures the signal strength of the blocking packet transmitted from the WIPS sensor 22, thereby checking whether the signal strength sufficient to be easily transmitted from the WIPS sensor 22 to the access point or terminal is maintained. can do.

The external WIPS blocking verification unit 550 analyzes the blocking packet received by the blocked device when access to at least one of the virtual access points and a plurality of virtual terminals is blocked to uniquely identify the WIPS server 21 By checking the information, it can be determined whether an external WIPS server is involved in blocking. In the external WIPS blocking verification unit 550, the unique identification information of the WIPS server 21 is previously stored, and when a unique identification number that is not previously stored is identified when analyzing the blocking packet, the wireless network ( It can be determined that the connection of 30) has been blocked.

In one embodiment, the control module 300 connects random virtual terminals (for example, a second terminal and a third terminal) among a plurality of virtual terminals in an ad-hoc mode like a connection between actual terminals. Can be controlled to operate. If the wireless intrusion prevention system 20 is capable of detecting and blocking the ad-hoc mode between terminals, the WIPS sensor 22 can transmit blocking packets to the second terminal and the third terminal connected in the ad-hoc mode. 560 may check whether the wireless network access of the virtual terminals connected in the ad hoc mode is blocked.

In another embodiment, the control module 300 transmits a wireless signal from a virtual master access point (eg, a second access point) connected to the wireless network 30 by the first communication module 100 or a virtual master access point. By controlling to operate as a receiving virtual slave access point (eg, a third access point) and a plurality of virtual terminals (eg, a fourth terminal, a fifth terminal) wirelessly connected to the virtual slave access point, A wireless distribution system (WDS) that expands the access range can be implemented virtually. When unauthorized devices arbitrarily attempt to build a wireless distribution system, the WIPS sensor 22 of the wireless intrusion prevention system 20 can transmit a blocking packet to the second access point or the third access point. 570 may check whether access to the wireless network between the virtual master access point and the slave access point is blocked.

On the other hand, the multi-channel blocking function test unit 600 is a virtual access point and a plurality of virtual terminals from the WIPS sensor 22 in a situation in which a virtual access point and a plurality of virtual terminals transmit and receive packets through different channels for each virtual terminal. When a blocking packet is transmitted to at least one of the channels, it may be checked whether the virtual terminal for each channel is normally blocked from accessing the wireless network.

For example, the first access point, which is a virtual access point implemented in the first communication module 100, is registered in the WIPS server 21 as an authenticated management AP, and the virtual terminal 6, 7, and Terminal 8 and Terminal 9 are set as unauthorized terminals that are not registered in the WIPS server 21, and in a situation in which packets are transmitted/received through different channels for each terminal, the WIPS sensor 22 is provided to terminals 6 to 9 A second blocking packet (for example, a Deauthentication packet) for releasing wireless access may be transmitted. In this case, the multi-channel blocking function tester 600 may check whether the access blocking of the virtual terminal for each channel is normally performed.

The WIPS shaded area analysis unit 700 may analyze a shaded area to which the signal of the blocked packet transmitted from the WIPS sensor 22 does not reach, based on the measurement result of the blocking packet signal strength inspection unit 540. For example, the WIPS shadow area analysis unit 700 pre-stores a digital map for a specific area, displays the location of each WIPS sensor on the digital map, and displays the coverage of each WIPS sensor signal in color to display a separate display. It can be output to the device in the form of a heat map. In addition, a region outside the coverage of the sensor may be displayed and output in a color different from the color representing the coverage.

The report generator 800 may generate a test result for each function of the wireless intrusion prevention system 20 as a report. The report generator 800 may output the synthesized test result to a separate display device so that the user can check it at a glance.

The performance test apparatus 10 of a wireless intrusion prevention system according to various embodiments of the present invention may be implemented through various means. For example, various embodiments of the present invention may be implemented by hardware, firmware, software, or a combination thereof. In the case of implementation by hardware, the test apparatus according to various embodiments of the present invention includes one or more application specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs). devices), field programmable gate arrays (FPGAs), processors, controllers, microcontrollers, microprocessors, and the like.

In the case of implementation by firmware or software, the test apparatus according to various embodiments of the present invention may be implemented in the form of a module, means, procedure, or function that performs the functions or operations described above. The software code may be stored in a memory unit and driven by a processor. Such a memory unit may be located inside or outside the processor, and may exchange data with the processor through various known means.

As described above, the performance test apparatus 10 of the wireless intrusion prevention system according to various embodiments of the present invention is not limited to the type of each manufacturer of the wireless intrusion prevention system 20, and blocks the wireless intrusion prevention system 20 You can verify the operation.

In addition, according to various embodiments of the present invention, performance verification is not performed in a form built into the wireless intrusion prevention system 20, but is configured in a form independent from the wireless intrusion prevention system 20, 20), so regardless of whether or not the wireless intrusion prevention system 20 is installed, the wireless network blocking operation and blocking quality of the wireless intrusion prevention system 20 can be verified, and are not limited to products of a specific manufacturer. It has the advantage of being able to check performance.

In addition, in various embodiments of the present invention, the first communication module 100 operates as a virtual access point and a plurality of virtual terminals, and packet transmission and reception are performed between the virtual access point and a plurality of virtual terminals, It is performed using a channel and a multi-channel, and the second communication module 200 monitors packets transmitted and received through the first communication module 100, so that when verifying the blocking operation of the wireless intrusion prevention system 20, a single channel In addition, it has the advantage of being able to monitor in multiple channels.

In addition, according to various embodiments of the present invention, in addition to verifying the blocking operation of the wireless intrusion prevention system 20, the quality of the wireless network blocking operation performed by the wireless intrusion prevention system 20 may be specifically verified.

As described above, a detailed description of the present invention has been made by an embodiment with reference to the accompanying drawings, but since the above-described embodiment has been described with reference to a preferred example of the present invention, the present invention is limited to the above embodiment. It should not be understood as being, and the scope of the present invention should be understood as the following claims and the concept of equality.

10: wireless intrusion prevention system performance test device
100: first communication module
200: second communication module
300: control module
400: packet generation module
500: blocking packet analysis module
510: Blocked packet verification unit for each attack
520: Blocked packet uniformity verification unit
530: Blocked packet response analysis unit
540: blocking packet signal strength inspection unit
550: External WIPS blocking verification unit
560: Ad hoc blocking analysis unit
570: WDS blocking analysis unit
600: multi-channel blocking function inspection unit
700: WIPS shadow area analysis unit
800: report generation unit
20: wireless intrusion prevention system
21: WIPS server
22: WIPS sensor
30: wireless network

Claims (8)

As a performance test device of a wireless intrusion prevention system,
A first communication module connected to a wireless network in which a wireless intrusion prevention system (WIPS) is built;
A second communication module using a wireless LAN card separate from the first communication module and monitoring packets transmitted and received through the first communication module;
A control module for controlling the first communication module to operate as a virtual access point and a plurality of virtual terminals;
A packet generation module for generating a packet according to a preset item so that packet transmission and reception can be performed between the virtual access point and a plurality of virtual terminals; And
Including; a blocking packet analysis module for analyzing the blocking packet transmitted from the WIPS sensor of the wireless intrusion prevention system to at least one of the virtual access point and a plurality of virtual terminals;
The control module controls the virtual access point and the plurality of virtual terminals to transmit/receive packets using one channel or to transmit/receive packets using different channels for each virtual terminal,
The performance test apparatus of the wireless intrusion prevention system
When a blocking packet is transmitted from the WIPS sensor to at least one of the virtual access point and a plurality of virtual terminals in a situation where the virtual access point and the plurality of virtual terminals transmit and receive packets through different channels for each virtual terminal , A multi-channel blocking function tester that checks whether the wireless network access blocking of the virtual terminal for each channel is normally performed; characterized in that it further comprises
Wireless intrusion prevention system performance test device. delete The method of claim 1,
The packet generation module generates an attack packet according to at least one attack type to attack the wireless network.
Wireless intrusion prevention system performance test device. The method of claim 3,
The blocking packet analysis module
When the WIPS sensor transmits a blocking packet for each attack type generated by the WIPS server of the wireless intrusion prevention system to at least one of the virtual access point and a plurality of virtual terminals, whether the transmitted blocking packet is normally generated for each attack type Blocked packet verification unit for each attack to check the;
A blocking packet uniformity verification unit checking whether blocking packets transmitted from the WIPS sensor are uniformly transmitted by checking each unit time;
When at least one of the virtual access point and the plurality of virtual terminals receives the blocking packet transmitted from the WIPS sensor, it checks whether the wireless network access of the received virtual device is blocked, and the responsiveness to the blocking packet is determined. Blocked packet response analysis unit to analyze;
A blocking packet signal strength tester measuring the signal strength of the blocking packet transmitted from the WIPS sensor; And
When access to at least one of the virtual access points and the plurality of virtual terminals is blocked, the external WIPS server analyzes the blocking packet received by the blocked device and checks the unique identification information of the WIPS server. Characterized in that it comprises a; external WIPS blocking verification unit to determine whether or not involved in blocking;
Wireless intrusion prevention system performance test device. delete The method of claim 1,
The control module controls any virtual terminals among the plurality of virtual terminals to be connected to each other in an ad-hoc mode to operate, or the control module provides a virtual master access to which the first communication module is connected to the wireless network. A point, a virtual slave access point receiving a radio signal from the virtual master access point, and a plurality of virtual terminals wirelessly connected to the virtual slave access point are controlled to operate, and the blocking packet analysis module is in an ad hoc mode. An ad hoc blocking analysis unit that checks whether access to the wireless network of the connected virtual terminals is blocked, and a WDS blocking analysis unit that checks whether access to the wireless network between the virtual master access point and the slave access point is blocked.
Wireless intrusion prevention system performance test device. A first function of connecting to a wireless network in which a wireless intrusion prevention system is built through a first wireless LAN card;
A second function connected to the wireless network through a second wireless LAN card, and monitoring packets transmitted and received to the first wireless LAN card;
A third function of operating the first wireless LAN card as a virtual access point and a plurality of virtual terminals;
A fourth function of generating a packet according to a preset item so that packet transmission and reception can be performed between the virtual access point and a plurality of virtual terminals;
A fifth function of analyzing a blocking packet transmitted from a WIPS sensor of the wireless intrusion prevention system to at least one of the virtual access point and a plurality of virtual terminals;
A sixth function of controlling packet transmission/reception between the virtual access point and a plurality of virtual terminals using one channel;
A seventh function of controlling packet transmission/reception using different channels for each virtual terminal when packet transmission/reception between the virtual access point and a plurality of virtual terminals; And
When a blocking packet is transmitted from the WIPS sensor to at least one of the virtual access point and a plurality of virtual terminals in a situation where the virtual access point and the plurality of virtual terminals transmit and receive packets through different channels for each virtual terminal , The eighth function to check whether the wireless network access blocking of each channel is normally performed; a computer-readable recording medium in which a program that can be executed on a computer is recorded. The method of claim 7,
The recording medium,
A ninth function of generating an attack packet according to at least one attack type to attack the wireless network;
When the WIPS sensor transmits a blocking packet for each attack type generated by the WIPS server of the wireless intrusion prevention system to at least one of the virtual access point and a plurality of virtual terminals, whether the transmitted blocking packet is normally generated for each attack type A tenth function of checking;
An eleventh function of checking whether a blocking packet transmitted from the WIPS sensor is uniformly transmitted by checking for each unit time;
When at least one of the virtual access point and the plurality of virtual terminals receives the blocking packet transmitted from the WIPS sensor, it checks whether the wireless network access of the received virtual device is blocked, and the responsiveness to the blocking packet is determined. A twelfth function of analyzing;
A thirteenth function of measuring the signal strength of the blocking packet transmitted from the WIPS sensor;
When access to at least one of the virtual access point and the plurality of virtual terminals is blocked, an external WIPS server by analyzing the blocking packet received by the blocked virtual device to check the unique identification information of the WIPS server A 14th function of determining whether or not is involved in blocking;
A fifteenth function of controlling an arbitrary virtual terminal among the plurality of virtual terminals to operate while being connected to each other in an ad-hoc mode;
A virtual master access point to which the first wireless LAN card is connected to the wireless network, a virtual slave access point receiving a radio signal from the virtual master access point, a plurality of virtual terminals wirelessly connected to the virtual slave access point A sixteenth function of controlling to operate as a function;
A 17th function of checking whether a wireless network connection of virtual terminals connected in an ad hoc mode is blocked; And
A recording medium readable by a computer in which a program capable of executing on a computer is recorded, which checks whether the virtual master access point and the slave access point are blocked from accessing the wireless network.

Images