KR20070054067A - Wireless access point apparatus and network traffic intrusion detection and prevention method using the same - Google Patents

Abstract

The present invention provides a wireless access point device that can improve the quality of security services in a wireless network by detecting and blocking intrusions to the wirelessly input traffic from the wireless access point device, and network traffic intrusion detection and blocking using the same. It's about how

The wireless access device according to the present invention includes a network interface card (101) in the wireless access point device (100) for wirelessly interworking with a user to transmit and receive wireless signals and to detect and block wireless network traffic signals from attackers. And a network module 110 including a network monitoring module 112 for receiving and detecting attack traffic of an attacker and a warning interface module 116 for transmitting an alert message to the attacker; The packet analysis module 122 for filtering attack traffic transmitted from the network monitoring module 112 and whether the filtered packet from the packet analysis module 122 is a network attack packet are interworked with the rule DB / signature module 126. And the analysis and security module 120 including the intrusion detection module 124 for transmitting the result to the packet analysis module 122 and the warning interface module 116 to determine the attack traffic. It detects and blocks wireless network traffic intrusions by filtering and detecting, first sending a warning message, and secondly sending a signal to disconnect the recipient.

Attacker, Security Module, Network Module, Intrusion Detection

Description

Wireless access point device and network traffic intrusion detection and blocking method using same {WIRELESS ACCESS POINT APPARATUS AND NETWORK TRAFFIC INTRUSION DETECTION AND PREVENTION METHOD USING THE SAME}

1 is a conceptual diagram illustrating an attack type in a general wireless LAN.

2 is a conceptual diagram illustrating a WLAN denial-of-service attack technique according to the prior art.

3 is a conceptual diagram schematically showing the structure of a wireless IPS (IPS) system.

4 is a schematic structural diagram of a wireless ID system according to the present invention.

FIG. 5 is a perspective view illustrating an AP shown in FIG. 4 and an internal printed circuit board on which components are mounted.

6 is a conceptual diagram schematically illustrating an internal system configuration of a link system firmware device used in the present invention.

7 is a schematic view showing a system board used in the present invention.

8 is a conceptual diagram illustrating a network interface of a wireless IP system according to the present invention.

9 is a schematic functional block diagram of a wireless access point device according to the present invention.

10 is a flowchart illustrating a wireless network intrusion detection and blocking process through a wireless access point device according to the present invention.

Explanation of symbols on the main parts of the drawings

100: wireless access device

110: network module

120: Analysis and Security Module

The present invention relates to a wireless access point device and a method for detecting and blocking network traffic intrusion using the same. More particularly, the present invention relates to a wireless network by allowing the wireless access point device to filter, detect, and block intrusions for traffic input wirelessly. The present invention relates to a wireless access point apparatus and network traffic intrusion detection and blocking method using the same.

In general, a device called an access point (AP) device is installed and used for wireless Internet communication. However, the access point devices developed to date provide only the transmission of the wireless traffic, the network support function, or include additional functions, and there are products that perform the filtering function on the packet.

Among the conventional access point devices developed so far, the 3Com Access Point specification,

* User Support: Up to 253 users can access simultaneously.

* Compliance Standards: Wi-Fi Certified, IEEE 802.11g, IEEE 802.11a (with Upgrade Kit),

Data rate: 54, 48, 36, 24, 18, 11, 9, 5.5, 2, 1 Mbps,

Frequency band: 2.4 GHz,

Wireless medium: OFDM and DSSS (including Barker coding and CCK for backward compatibility with 802.11b),

* Media Access Protocol: CSMA / CA, Operating Channels: 1-11 (US and Canada), 1-13 (Global; range of channels used is determined by local law),

Operating range: Up to 100 meters (328 feet), transmit and receive,

* Transmission power setting: 17 dBm (depending on the bit rate),

* Power consumption: 7.1W average, 8.4W maximum,

* Sensitivity: 1 Mbps: -96 dBm

* 2 Mbps: -94 dBm,

5.5 Mbps: -92 dBm

11 Mbps: -88 dBm

12 Mbps: -86 dBm,

24 Mbps: -85 dBm

36 Mbps: -80 dBm

54 Mbps: -73 dBm,

Security: 40 / 64-bit and 128 / 154-bit WEP encryption; WPA AES 256-bit encryption, Dynamic Security Link 128-bit encryption; 802.11x (RADIUS server authentication scheme); EAP-MD5, EAP-TLS, EAP-TTLS and PEAP authentication; ESSID broadcast control, local MAC authentication; Server access control lists, dynamic session key management and TKIP, dynamic VLAN assignment, client-to-client and uplink filtering,

* Performance: Clear Channel Select, Automatic Network Connection, Dynamic Rate Shifting,

Network Management: Site Discovery Tool, Wireless Infrastructure Device Manager, Wireless LAN Discovery Tool, 3NS, SNMP.

That is, the conventional access point device is equipped with only a security module as follows to ensure the stability for the packet.

Security: 40 / 64-bit and 128 / 154-bit WEP encryption; WPA AES 256-bit encryption, Dynamic Security Link 128-bit encryption; 802.11x (RADIUS server authentication scheme); EAP-MD5, EAP-TLS, EAP-TTLS and PEAP authentication; ESSID broadcast control, local MAC authentication; Server access control lists, dynamic session key management and TKIP, dynamic VLAN assignment, client-to-client and uplink filtering.

However, various attacks are possible on the conventional access point device, and the equipment including the corresponding function has not been developed.

Hereinafter, an attack method on an access pointer disclosed to date is described.

Network attack technology overview

* Wireless network attack

Cyber attack techniques are being diversified by malicious users, and the development of hacking techniques has led to the public and dissemination of automated and intelligent hacking tools. In particular, network vulnerabilities are continuously increasing, and denial-of-service (DDoS) attacks that can paralyze network services by fatal attacks such as worm viruses are rapidly increasing. Similarly, they can be classified as passive, active, and rogue AP attacks.

end. Passive Attack

The purpose of the passive attack is to obtain the access point device MAC, SSID, channel, manufacturer, WEP settings, and installation location information. There are three types of programs: a sniffer method for capturing packets, a stumbler method for querying information, and a passive monitor that collects all network packets because no packets are sent and does not belong to any network. have.

Typical sniffer programs include airopeek, ethereal, and tcpdump, stumbler programs are netstumbler, and passive monitor programs are kismet.

I. Rogue AP attack

Rogue AP refers to an unauthorized AP installed in a wired network or an AP deliberately installed by an attacker for the convenience of a user. This is a significant threat, and rogue APs must be removed because they can break into internal wired networks without going through the company's security policy. If ad-hoc network is formed by connecting AP without careless security, it may be more dangerous and cause network bandwidth wasted by unauthorized person.

All. Active attack

The purpose of active attacks is more aggressive, such as denial of service, than information gathering. Attack techniques include spoofing, DoS, and MITM. In each case, spoofing attacks are used to pass authentication by altering MAC / IP / Frame, and are also used for denial of service attacks. DoS attacks include deauth flooding, which repeatedly transmits forged fake disassociation / deauthentication frames, and jamming techniques that use noise from devices of similar frequency bands. The disassociation technique is also used as a technique for rogue AP isolation. Man-in-the-middle and session hijack attacks are a technique of intercepting sessions by releasing existing connections and inducing them to the attacker's AP or spoofing macs. In addition, as shown in FIG. 2, a denial of service (DDoS) attack is possible, and thus a corresponding technology should be provided.

Therefore, it is necessary to propose a countermeasure technology / response module for various attacks as described above.

Current research conducted to provide Wireless IDS / IPS functionality is based on AirMagnet (Borque, Lyne, "Wi-Fi Security Review: AirMagnet", http://www.enterpriseitplanet.com/security, 2004 ) And AirDefense (http://www.airdefense.com).

Airmagnet sensor performs WLAN management and monitoring function based on SQL DB. It provides Rogue AP detection and tracking function and aims to secure wireless network by responding to DoS attack.

3 is a structural diagram of a wireless IP system (see AirDefense).

Referring to FIG. 3, the AirDefense system consists of a Red Hat Linux server consisting of a wireless AP sensor and a Java-based web console system. The AirDefense web console and AP sensor manage and block traffic through secure wireless communication with the server.

Wireless IPS, presented by AirDefense, is a policy-based IDS / IPS system that establishes management, performance, and security for the network and provides security for WLAN sessions. In addition, it is generally developed in the form of open software based on Linux operating system, and is being actively researched, and codes such as Snort-Wireless and WIDZ are currently presented.

 However, according to the above structure, since the air defense system provides only a detection function for an attack and provides only a passive response to an external attack, a technology that actively detects and blocks an attack intrusion is urgently required. It is true.

An object of the present invention is to solve the problems in the prior art as described above, and to provide a wireless access point device that can detect and block an attack from the outside.

It is still another object of the present invention to provide a wireless access point device capable of improving the quality of security services in a wireless network by adding a module that provides a discrimination function for abnormal traffic of the access point device.

Still another object of the present invention is to provide a method of detecting abnormal traffic using a wireless access point device and detecting a network attack such as a denial of service attack in the access point device.

It is still another object of the present invention to provide a method for blocking an attack of abnormal traffic detected by using a wireless access point device.

It is still another object of the present invention to provide a method for disconnecting a corresponding traffic to a network where an intrusion is detected using a wireless access point device.

It is still another object of the present invention to provide a method for using a wireless access point device to send a De-Auth flooding packet to a corresponding host, thereby disconnecting the attacker system.

According to a preferred embodiment of the present invention for achieving the above object, in a wireless access point device for wirelessly interworking with a user to transmit and receive wireless signals and detect and block wireless network traffic signals from attackers, the network A network module including an interface card and a network monitoring module for receiving and detecting attack traffic of an attacker and a warning interface module for controlling sending an alert message to the attacker; The packet analysis module for filtering attack traffic transmitted from the network monitoring module and whether the filtered packet from the packet analysis module is a network attack packet are determined in conjunction with a rule DB / signature module and the result is determined by the packet analysis module and the module. Provided is a wireless access point device comprising an analysis and security module comprising an intrusion detection module for transmitting to the alert interface module.

Advantageously, said network module channel hopping 802.11 b / g packets, synchronizing other configuration information, monitoring level 2 wireless traffic, and transmitting probe request, probe response, and beacon frames. It further comprises a channel hopping module.

Also preferably, the network monitoring module is a monitoring mode for performing passive sniffing and detecting all network packets, collecting 802.11 b / g packets collected through the channel hopping module, and not transmitting an SSID beacon frame. The hidden AP network is characterized by monitoring and detecting the SSID when the client accesses the AP.

Also preferably, the alert interface module may transmit a deauth signal for disconnecting a network attack packet sender.

Also preferably, the intrusion detection module is a rogue AP detection module that compares the AP information transmitted from the network monitoring module with an authorized AP list input by an administrator in advance, and tracks a sequence number to detect a MAC spoofing attack. DoS deauth flooding attack detects and detects broadcast disassociate / deauthenticate frame, detects stumbler fingerprints by comparing them with packets, and detects man-in-the-middle attacks. The Spoof / DoS / Stumbler / MITM detection module for detecting and detecting the change of the channel of the AP is characterized in that made.

According to another aspect of the present invention, in the wireless network intrusion detection and blocking method using a wireless access point device for detecting and blocking wireless network attack traffic through the wireless access point device, analyzing and transmitting the received wireless traffic Wow; Filtering the transmitted wireless traffic; Determining whether the filtered packet is a network attack packet in association with a rule DB / signature module; As a result of the determination, when the filtered packet is a network attack packet, a wireless network intrusion detection and blocking method using a wireless access point device is provided.

Preferably, the step of determining whether the recipient confirmed after the warning message delivery step; If the receiver confirms, the method further includes discarding the corresponding data.

Also preferably, if the filtered packet is a network attack packet, it is characterized in that to transmit the deauth data that disconnects the receiver when sending the warning message.

The present invention shows a weakness that the conventional 802.1x-based WLAN is easily attackable, detects sniffing, tampering, and tampering with a wireless packet, and detects / blocks an AP in advance for a DDoS attack such as AirJack. It is done.

That is, although wireless is introduced in most conventional network environments, the AP does not detect hacking attacks, whereas in the present invention, packet filtering is applied to the wireless AP function at a time when attacks related to WLAN are gradually increasing. The company has developed an embedded Linux-based wireless AP with embedded network intrusion detection.

Hereinafter, a method for detecting and blocking an attack intrusion of a wireless access point device and a wireless network system using the same according to the present invention will be described in detail with reference to the accompanying drawings.

4 is a schematic configuration diagram of a wired / wireless integrated security system using a wireless access point device according to the present invention.

In the wire / wireless integrated security system 1000 according to the present invention, the wireless IDS device 100 (a wireless access point device, hereinafter referred to as an 'AP' device) performs a monitoring function for traffic transmitted on a wireless network. In particular, a packet filtering and blocking function is provided through a monitoring function for traffic transmitted through the Wi-Fi device 113 (see FIG. 8).

Referring to FIG. 4, the wireless AP device 100 serving as an IPS sensor is constructed between wired and wireless networks to perform a monitoring function for wireless traffic.

That is, the embedded AP integrated high-performance IPS system that provides packet sniffing and rule-based intrusion detection / blocking function according to the present invention is a wireless IDS device (W-IDS) and a wired / wireless integrated security device 200 as described later. (Server).

Wireless IDS (W-IDS) equipment for detection is directly or indirectly connected to wired / wireless integrated security equipment, and analyzes traffic on the wireless network and transmits traffic information and alert information to the wired / wireless integrated security equipment.

The wireless AP device 100 transmits and receives a wireless signal from a user computer and detects and blocks a wireless network attack packet from an attacker.

Through the system, attack packets can be detected and blocked regardless of whether they are wired or wireless.

According to the present invention, since the WLAN attack frame can be detected only in the wireless AP, a method of adding a function by selecting a device of a company whose firmware is disclosed is used. If a product is required for mass production, a suitable embedded board for AP development should be selected.

FIG. 5 is a perspective view illustrating the wireless access point (AP) device 100 of FIG. 4 and an internal printed circuit board on which components are mounted. 6 is a conceptual diagram schematically illustrating an internal system configuration of a link system firmware device used in the present invention.

Practically, the present invention portes OpenWRT including only the minimum function among various firmwares and adds an intrusion detection function. If it is not a wireless-related attack, even if connected to the wireless AP, the wired and wireless integrated device 200 detects and blocks.

According to the present invention, the 802.11 b / g level 2 frame log generated by the wireless AP device 100 is transmitted to the wired / wireless integrated security device 200 so that the wired / wireless integrated device can monitor all wireless network traffic.

7 is a schematic view showing a system board used in the present invention.

Referring to FIG. 7, the wireless AP-based W-IDS structure, that is, the wireless AP device 100 is actually embedded with related software in a wireless AP device having the following specification.

      The hardware specification of the device 100 uses Linksys WRT54GS as hardware. The device 100 is composed of a MIPS CPU 200MHz, flash 8MB, RAM 32MB, LAN 4Port, WAN 1Port, and Wifi. MIPS supports both little-endian and big-endian, while OpenWRT firmware uses little-endian MIPSEL.

Since the device 100 supports four LAN ports, one WAN port, and an antenna, the device 100 can be connected to the outside and has RAM and Flash memory to support embedded programming. In the present invention, the filtering module is compiled in the form of firmware and embedded in the AP system.

8 is a conceptual diagram illustrating a wireless AP device network interface according to the present invention.

That is, the connection of the control unit 140, the WiFi antenna 130, and the switch 150 in the wireless AP device 100 is illustrated. By applying snort packet filtering and sniffing module to this system, we can provide the control function for wireless traffic.

In the use of the wireless AP device 100, the description of the software for reference, the openWRT porting and toolchain configuration is as follows. If the default linksys firmware is installed, go to the web management screen and install OpenWRT firmware (linux 2.4.30). Alternatively, firmware can be installed by tftp after initializing the NVRAM values. After installation, you can connect to 192.168.1.1 using telnet. If you want to use ssh, give root a password. Build a development platform by configuring the MIPSEL toolchain on a PC with Linux.

9 is a schematic functional block diagram of a wireless access point device according to the present invention.

Referring to FIG. 9, the wireless access point apparatus 100 includes a network module 110, an analysis and security module 120, and a network interface card 101.

The network module 110 consists of a channel hopping module 112, a network monitoring module 114, and an alert interface module 116.

The channel hopping module 112 channel hops 802.11 b / g packets. Synchronize other configuration information. It also monitors level 2 radio traffic and specifically sends probe request, probe response and beacon frame.

The network monitoring module 114 collects 802.11 b / g packets collected through the channel hopping module 112 as a monitoring mode for performing passive sniffing and detecting all network packets. In addition, the hidden AP network that does not transmit the SSID beacon frame monitors and detects the SSID when the client accesses the AP. In addition, the collected packets are then forwarded to the security module 120. In addition, it periodically checks and synchronizes the wireless-related configuration changes of wired and wireless integrated equipment.

The network monitoring module 114 collects all network packets at the AP device.

The alert interface module 116 serves to transmit to the wired / wireless integrated device 200, logs a wireless network monitoring, and is a kind of action module that logs an alert. It can also generate attack alerts that attack wireless networks.

The analysis and security module 120 is composed of a packet analysis module 122, intrusion detection module 124 and rule DB / signature module 126.

The packet analysis module 122 is a kind of a wireless traffic filtering module that captures network packets transmitted from the network monitoring module 114 and detects attack traffic.

The intrusion detection module 124 is composed of a rogue AP detection module 124-1 and a spoof / DoS / Stumbler / MITM detection module 124-2, which is a kind of determination module.

The rogue AP detection module 124-1 compares the AP information transmitted from the network monitoring module 114 with an authorized AP list input by an administrator in advance. In this case, the comparison information compares MAC / SSID / Vendor / Media type (802.11 b / a / g) / Channel. When detected as an unauthorized AP, the alert log is transmitted to the wired / wireless integrated device 200.

The Spoof / DoS / Stumbler / MITM detection module 124-2 detects a MAC spoofing attack by tracking a sequence number and detects whether a deauth flooding attack of DoS confirms whether a broadcast disassociate / deauthenticate frame has occurred. To detect stumbler attacks, the fingerprints of each stumbler are detected against the packets. In the case of representative netstumbler 3.2.3, the query includes the string “All your 802.11b are belong to us.” Man-in-the-middle attack detection checks whether the AP has changed the channel. Logs are sent to wired and wireless integrated equipment.

The rule database / signature module 126 operates in conjunction with the intrusion detection module 124 to search for signatures and rules.

Reference numeral 101 denotes a network interface card and serves as a transmission / reception path for various wireless packets.

10 is a flowchart illustrating a wireless network intrusion detection and blocking process through a wireless access point device according to the present invention.

Referring to FIG. 10, first, wireless traffic is received through the channel hopping module 112 and the network monitoring module 114 of the network module 110 of the wireless access point device 100 (ST-2).

The received wireless traffic is then analyzed by the network monitoring module 114 and transmitted to the packet analysis module 122 (ST-4).

The transmitted wireless traffic is then filtered by the packet analysis module 122 and then transmitted to the intrusion detection module 124 (ST-6).

The intrusion detection module 124 determines whether the filtered packet is a network attack packet in association with the rule DB / signature module 126 (ST-8). As a result of the determination of step ST-8, if it is not a network attack packet, the result is notified to the packet analysis module 122 and the alert interface module 116. As a result, the data is bypassed.

If it is determined in step ST-8 that the filtered packet is a network attack packet, the result is notified to the packet analysis module 122 and the alert interface module 116. The alert interface module 116 transmits an alert message to the network monitoring module 114 so that the alert message is delivered to the receiver (ST-10). Meanwhile, in step ST-10, the received data together with the warning message may be transmitted.

Thereafter, the network monitoring module 114 determines whether the recipient who has received the warning message (or warning message + data) has confirmed the confirmation (ST-12). If the receiver checks the result of the determination of step ST-12, the corresponding data is discarded (ST-14).

On the other hand, although not shown, if the packet filtered in step ST-8 is a network attack packet, in step ST-10, deauth data for disconnecting the receiver may be transmitted without sending a warning message.

As described above, according to the wireless access point apparatus and the wireless network traffic intrusion detection and blocking method using the same according to the present invention, it has been developed in the state of simply checking the basic matters of the attack traffic. By detecting and first sending an alert message and secondly by sending a signal to disconnect the recipient, it is possible to reliably detect and block wireless network traffic intrusion.

The present invention has been described with reference to the above embodiments, but the scope of the present invention is not limited thereto, and those skilled in the art will be described later based on the contents described in the above embodiments. Various modifications can be made within the invention.

Claims (8)

In the wireless access point apparatus 100 for interworking with a user wirelessly to transmit and receive a wireless signal and detect and block a wireless network traffic signal from an attacker, A network module 110 including a network interface card 101 and a network monitoring module 114 for receiving and detecting attack traffic of an attacker and a warning interface module 116 for controlling sending an alert message to an attacker; The packet analysis module 122 filtering the attack traffic transmitted from the network monitoring module 114 and whether the filtered packet from the packet analysis module 122 is a network attack packet are interworked with the rule DB / signature module 126. And an analysis and security module (120) comprising an intrusion detection module (124) for determining and determining and transmitting the result to the packet analysis module (122) and the warning interface module (116). Device 100. The method of claim 1, wherein the network module 110 channel hopping 802.11 b / g packets, synchronize configuration information, monitor level 2 wireless traffic, probe request, probe response, beacon frame And a channel hopping module (112) for transmitting the wireless access point device (100). The method of claim 1, wherein the network monitoring module 114 is a monitoring mode for performing passive type sniffing and detecting all network packets, and 802.11 b / g packets collected through the channel hopping module 112. The hidden AP network, which collects and does not transmit the SSID beacon frame, monitors and detects the SSID when the client accesses the AP. 2. The wireless access point device (100) of claim 1, wherein said alert interface module (116) transmits a deauth signal that disconnects a network attack packet sender. The rogue AP detection of claim 1, wherein the intrusion detection module 124 compares the AP information transmitted from the network monitoring module 114 with an authorized AP list input by an administrator in advance. Detect MAC spoofing attack by tracking module 124-1 and sequence number. Deauth flooding attack of DoS checks whether broadcast disassociate / deauthenticate frame has occurred and detects fingerprint that exists by stumbler for stumbler attack detection. Compared to the packet detection, and Man-in-the-middle attack detection is a wireless characterized in that it comprises a Spoof / DoS / Stumbler / MITM detection module (124-2) for detecting and detecting whether the AP channel changes Access point device 100. In the wireless network intrusion detection and blocking method using the wireless access point device 100 for detecting and blocking wireless network attack traffic through the wireless access point device 100, Analyzing and transmitting the received wireless traffic; Filtering the transmitted wireless traffic; Determining whether the filtered packet is a network attack packet in conjunction with the rule DB / signing module 126; And, if the filtered packet is a network attack packet, transmitting the result to the attacker as a warning message. The wireless network intrusion detection and blocking method using the wireless access point device 100 according to the determination result. The method of claim 6, Determining whether the recipient has confirmed after the warning message delivery step; If the receiver confirms, discarding the corresponding data; wireless network intrusion detection and blocking method using a wireless access point device 100, characterized in that further comprises. 7. The wireless network intrusion detection using the wireless access point device 100 according to claim 6, wherein if the filtered packet is a network attack packet, the deauthentication data for disconnecting the receiver is transmitted when the warning message is transmitted. And blocking method.

Images