KR20110020072A - Apparatus and method of wireless network security - Google Patents

Abstract

PURPOSE: A wireless network security apparatus and a method thereof are provided to embody an integrated monitoring and controlling about an unlicensed AP(Access Point). CONSTITUTION: An AP information extracting unit(212) is connected to a plurality of APs, and extracts information about the APs. An AP comparison unit(213) compares the extracted AP information with an approved AP information. The AP comparison unit extracts the unlicensed AP information. A transmission unit(215) transmits the approved AP information and unlicensed AP information to a user terminal connected to the wireless network.

Description

Apparatus and method of wireless network security

The present invention relates to a security device, and more particularly, to a wireless network security device and a method thereof.

Rapidly expanding wireless networks, in particular, wireless LANs, enable the user terminal to connect to the network wirelessly and exchange data according to the IEEE802.11 standard. Wireless network environment is convenient because it enables users to move easily and exchange data through network connection, while access user terminal is physically separated from the network equipment and transmission data is exposed to air, thereby preventing malicious access and data corruption. The possibility is large compared to wired networks, especially wired LANs.

1 is a block diagram of a wireless network system according to the prior art. Referring to FIG. 1, a wireless network 110, an AP 120, a user terminal 130, an unauthorized AP 140, and an illegal terminal 150 are illustrated.

The wireless LAN environment according to the prior art has a security vulnerability that can be exposed to various types of attacks, such as the following. The intruder moves to a vehicle equipped with a WLAN antenna and searches for a weak AP (War AP) 120, or walks and searches for a weak AP 120, thereby allowing malicious access. In addition, the intruder collects wireless data using the illegal terminal 150 or the like, cracks the WEP key, etc. and infiltrates the wireless network 110 (Sniffing & WEP crack). In addition, the intruder finds out the MAC of the normally authorized user terminal 130 and infiltrates the MAC of the illegal terminal 150 to penetrate the wireless network 110 (MAC spoofing). The intruder also connects to the wireless network 110 by disguised as a normal user terminal 130 using an intermediate session (Man in the middle & Session High-jacking). In addition, the intruder obtains the user's information from the user terminal 130 attempting to connect after installing the unauthorized AP 140. In addition, the intruder generates a modified frame into a damaged frame by using a weakness of the IV and the WEP key of the frame, and puts a load on the wireless network 110 (IV attack & Bit-Flipping & DoS). Therefore, when using the wireless network 110, a security management solution for the above-mentioned security vulnerability is necessary.

The background art described above is technical information possessed by the inventors for the derivation of the present invention or acquired during the derivation process of the present invention, and is not necessarily a publicly known technique disclosed to the general public before the application of the present invention.

An object of the present invention is to provide a wireless network security device and method for implementing integrated monitoring and control for an unauthorized AP.

Another object of the present invention is to provide a wireless network security device and method for detecting and blocking an unauthorized AP using an authorized user terminal in a wireless network environment without installing any separate monitoring equipment.

In addition, the present invention provides a monitoring and control system for the wireless network without installing a separate security equipment, so a security environment is established at a minimum cost, and is controlled using information of a user terminal that is a real person to be protected. To provide a wireless network security device and method that can minimize the exposure of the.

Technical problems other than the present invention will be easily understood through the following description.

According to an aspect of the present invention, a security apparatus for a wireless network connected to a plurality of APs, comprising: a storage unit for storing authorization AP information about an AP previously authorized, and a plurality of APs connected to the plurality of APs An AP information extractor for extracting information, an AP information comparator for extracting unauthorized AP information by comparing the extracted AP information with the authorized AP information, and a user terminal connected to the wireless network with the authorized AP information and the unauthorized AP information; Including a transmitter for transmitting to the wireless terminal, the user terminal is provided with a wireless network security device, characterized in that to access only the authorized AP using the received AP information and unauthorized AP information.

The authorized AP information and the unauthorized AP information may include an IP address and installation location information, and the AP information extracting unit may extract information about the plurality of APs using SMP or Telnet. Can be.

In addition, the present embodiment may further include an AP information receiver for receiving detection AP information connected to the user terminal from the user terminal.

Here, the AP information comparison unit may extract the unauthorized AP information by comparing the detected AP information with the authorized AP information, and the AP information comparison unit is included in the detection AP information and included in the extracted AP information. The non-AP information may be set as external AP information.

In addition, the embodiment may further include an authentication server for authenticating the AP connection of the user terminal for transmitting the detection AP information, and may further include an administrator server for receiving the unauthorized AP information from the transmitter.

According to another aspect of the present invention, in the security method of a wireless network connected to a plurality of APs, storing authorization AP information about a pre-authorized AP, information about the plurality of APs by accessing the plurality of APs Extracting the unauthorized AP information by comparing the extracted AP information with the authorized AP information, and transmitting the authorized AP information and the unauthorized AP information to a user terminal connected to the wireless network, The user terminal is provided with a wireless network security method characterized in that the access to only the authorized AP using the received AP information and unauthorized AP information.

Here, the authorized AP information and the unauthorized AP information may include an IP address and installation location information, and the information extraction step for the plurality of APs may include the plurality of APs using SNMP or Telnet. Information about the AP may be extracted.

The present invention may further include receiving detection AP information connected to the user terminal from the user terminal, wherein extracting the unauthorized AP information comprises: receiving the detection AP information and the authorized AP. The unauthorized AP information may be extracted in comparison with the information.

In the extracting of the unauthorized AP information, the AP information included in the detection AP information and not included in the extracted AP information may be set as external AP information.

The present invention may further include authenticating an AP connection of the user terminal transmitting the detection AP information, and may further include transmitting the unauthorized AP information to an administrator server that receives the unauthorized AP information.

Other aspects, features, and advantages other than those described above will become apparent from the following drawings, claims, and detailed description of the invention.

The wireless network security device and method thereof according to the present invention can implement integrated monitoring and control for unauthorized APs, and detect unauthorized APs using authorized user terminals in a wireless network environment without installing separate monitoring equipment. It has the effect of blocking.

In addition, the wireless network security device and method according to the present invention provides a monitoring and control system for the wireless network without the installation of additional security equipment, so that a secure environment is established at a minimum cost and is a real user terminal to be protected. Since the information is controlled using the information of, it is effective to minimize the exposure of wireless network vulnerability.

As the invention allows for various changes and numerous embodiments, particular embodiments will be illustrated in the drawings and described in detail in the written description. However, this is not intended to limit the present invention to specific embodiments, it should be understood to include all changes, equivalents, and substitutes included in the spirit and scope of the present invention.

Terms including ordinal numbers such as first and second may be used to describe various components, but the components are not limited by the terms. The terms are used only for the purpose of distinguishing one component from another. For example, without departing from the scope of the present invention, the first component may be referred to as the second component, and similarly, the second component may also be referred to as the first component. And / or < / RTI > includes any combination of a plurality of related listed items or any of a plurality of related listed items.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. Singular expressions include plural expressions unless the context clearly indicates otherwise. As used herein, the terms "comprise" or "have" are intended to indicate that there is a feature, number, step, action, component, part, or combination thereof described on the specification, and one or more other features. It is to be understood that the present invention does not exclude the possibility of the presence or the addition of numbers, steps, operations, components, components, or a combination thereof.

In the following description of the present invention with reference to the accompanying drawings, the same components are denoted by the same reference numerals regardless of the reference numerals, and redundant explanations thereof will be omitted. In the following description of the present invention, if it is determined that the detailed description of the related known technology may unnecessarily obscure the subject matter of the present invention, the detailed description thereof will be omitted.

2 is a block diagram of a wireless network system according to an embodiment of the present invention. 2, the wireless network security device 210, the authentication server 220, the wireless network 230, an authorized AP 241, an unauthorized AP 242, an external AP 243, and a first user terminal device ( 251, a second user terminal 252 is shown.

In this embodiment, the wireless network security device 210 coupled to the wireless network 230 recognizes the unauthorized AP 242 and the external AP 243 without using a separate device coupled to the access point (AP). By transmitting the corresponding information to the user terminal, a security environment for allowing the first user terminal 251 and the second user terminal 252 to access only the authorized AP 241 is proposed.

Here, the first user terminal 251 and the second user terminal 252 is a terminal of a user who wants to connect to the wireless network 230 and perform data exchange therethrough. The general form is a PC. The first user terminal 251 and the second user terminal 252 may be equipped with a device that can access the wireless network 230, for example, a wireless LAN network card.

In addition, the AP described in this embodiment is a wireless network 230 equipment for connecting the first user terminal 251 and the second user terminal 252 to the wireless network 230. In general, an AP has two network interfaces (Wireless, Wired). The wireless interface communicates with the first user terminal 251 and the second user terminal 252, and the wired interface wires the data of the first user terminal 251 and the second user terminal 252. It is used for transmission to network equipment and other terminal in network.

The wireless network security device 210 couples to the wireless network 230. The wireless network 230 according to the present embodiment refers to a network in which the first user terminal 251 and the second user terminal 252 are wirelessly accessible, for example, a LAN, a MAN, a WAN, and a WLAN. It may include various networks such as WPAN, mobile communication network, and the like.

The wireless network security device 210 stores authorized AP information about the AP 241 that is previously authorized. AP information according to the present embodiment includes IP address and installation location information. The installation location information may be information about which port of a network device (for example, a router, a switch, a hub, etc.) is connected.

Authorization AP 241 may be specified in advance by the administrator, or by being monitored and controlled by the administrator in real time. In addition, the authorized AP 241 may be specified only by the AP installed when the wireless network 230 is established. To this end, the wireless network security device 210 may access the AP connected to the wireless network 230 and extract information about the accessed AP. The wireless network security device 210 may store the extracted AP information or transmit the extracted AP information to a separate manager server, and the administrator may determine whether to be authorized by referring to the extracted AP information. AP information recognized as an AP authorized by an administrator may be separately stored together with the above-described authorized AP information.

The wireless network security device 210 also compares the extracted AP information with pre-stored authorized AP information and extracts unauthorized AP information not included in the authorized AP information from the extracted AP information. The extracted unauthorized AP information is transmitted to the first user terminal 251 and the second user terminal 252, and the first user terminal 251 and the second user terminal 252 are referred to the received unauthorized AP information. Only authorized APs are detected.

The unauthorized AP 242 is an AP installed without being authorized by an administrator, and may be distinguished by an IP address and installation location information of the corresponding AP. The external AP 243 is an AP detected to be accessible from the first user terminal 251 and the second user terminal 252, but is not connected to the internal network, and thus an AP that cannot confirm the IP and installation location information of the corresponding AP is connected. Can be.

To this end, the first user terminal 251 and the second user terminal 252 may be installed a program for accessing the wireless network 230 only through the authorized AP. That is, in order to access the wireless network 230, a program for connecting the first user terminal 251 and the second user terminal 252 is installed. The program connects to the APs with the SSID set by the user from the list of APs searched in the vicinity. When performing the association process, the first user terminal 251 and the second user terminal 252 receive the BSSID of the AP. The BSSID is information including the MAC address of the AP. That is, the wireless network security device 210 collects information of an AP from network devices and stores location information and MAC address (BSSID) information of the corresponding AP. Thereafter, the wireless network security device 210 transmits AP information, which may be divided into authorized AP information and unauthorized / external AP information, to the first user terminal 251 and the second user terminal 252. The first user terminal 251 and the second user terminal 252 do not perform an association process with reference to the received AP information when the detection AP information is not the BSSID of the authorized AP.

In addition, the wireless network security device 210 may receive information about an AP detected at the terminal from the first user terminal 251 and the second user terminal 252. The detection AP information of the user terminal is the AP information actually detected at the terminal. The wireless network security device 210 may extract the unauthorized AP information and the external AP information by comparing the detection AP information with the aforementioned authorized AP information. Here, the external AP information of the external AP 243 may be AP information included in the detection AP information and not included in the extracted AP information. That is, the wireless network security device 210 may extract AP information for each specific router, switch, and hub and set authorized AP information. In this case, the first user terminal 251 and the second user terminal ( Authorized AP information and external AP information may be set differently with respect to 252). Therefore, the internal networks for the first user terminal 251 and the second user terminal 252 may be set for each router, switch, and hub.

The authentication server 220 performs a function of determining whether the first user terminal 251 and the second user terminal 252 connected to the wireless network 230 are connected. When the first user terminal 251 and the second user terminal 252 attempt to connect through a wireless interface, the authentication server 220 authenticates whether the user is an authorized user. Since the wireless network security device 210 according to the present embodiment receives the above-described detection AP information from the authenticated first user terminal 251 and the second user terminal 252, the authorized AP information may be more reliably determined. There is an advantage. Referring to FIG. 1, the authentication server 220 is illustrated as being implemented with a device that is physically different from the wireless network security device 210. However, the present embodiment is not limited thereto and may be implemented with the same device. It may include cases implemented in other ways in software.

3 is a block diagram of a wireless network security device according to an embodiment of the present invention. Referring to FIG. 3, the wireless network security device 210 may include a storage 211, an AP information extractor 212, an AP information comparator 213, an AP information receiver 214, and a transmitter 215. Can be.

The storage unit 211 stores authorized AP information about an AP previously authorized. In addition, the storage unit 211 may further store the unauthorized AP information and the external AP information as described above.

The AP information extracting unit 212 extracts information about a plurality of APs connected to the plurality of APs. The AP information extracting unit 212 may access a plurality of APs connected to the wireless network 230 by using SMP or Telnet and extract AP information from the plurality of connected APs.

SNP is a protocol used for network management. SNP is not limited to TCP / IP networks but can be used for various networks as indicated in the IETF's RFC. Telnet also provides remote access to the host computer, consisting of user commands and TCP / IP-based protocols for accessing the remote computer. The present embodiment may extract AP information using such a protocol.

The AP information comparing unit 213 extracts unauthorized AP information by comparing the extracted AP information with the authorized AP information stored in the storage unit 211. The transmitter 215 transmits the authorized AP information and the unauthorized AP information to the first user terminal 251 and the second user terminal 252 connected to the wireless network 230. Thereafter, the first user terminal 251 and the second user terminal 252 access only the authorized AP using the received AP information and the unauthorized AP information.

The AP information receiving unit 214 may detect detection AP information regarding an AP detected by being connected to the first user terminal 251 and the second user terminal 252 from the first user terminal 251 and the second user terminal 252. Receive. According to the present embodiment, the wireless network security device 210 includes a BSSID (including a MAC address of a wireless interface) and a signal strength (RSSI) value of an AP collected from the first user terminal 251 and the second user terminal 252. Through the correlation analysis and AP information extracted from the internal network to determine the location of the AP is connected to the internal network, the AP that is not confirmed at this time is set to the external AP.

For example, the information collected by the wireless network security device 210 in the internal network may determine whether the APs detected by the first user terminal 251 and the second user terminal 252 are APs that are physically connected to the internal network. It is used to judge. Since all APs detected by the first user terminal 251 and the second user terminal 252 of the internal network can be accessed by all user terminals accessible to the internal network, the corresponding user terminal and the user according to the wireless network 230 connection. 'S personal information may be exposed on the network. Internal users may intentionally leak company internal information to the corresponding external APs. The external AP is an AP not detected through the internal network among the APs detected by the first user terminal 251 and the second user terminal 252. The detection by the first user terminal 251 and the second user terminal 252 is information collected by detecting a radio signal, and the confirmation by the wireless network security device 210 through the internal network is as described above. It may be information of a corresponding AP found in an internal network device through SNP or Telnet. The APs found in both directions by mapping the collected information in these two directions are authorized APs or unauthorized APs, and the APs included only in the detection AP information are external APs. In addition, an AP collected only in the wireless network security device 210 and not detected by the first user terminal 251 and the second user terminal 252 may be installed in a shadowed area and may be an AP having no terminal nearby. .

4 is a flowchart of a wireless network security method according to an embodiment of the present invention.

In operation S410, the wireless network security device 210 stores the authorized AP information about the previously authorized AP.

In operation S420, the wireless network security device 210 accesses a plurality of APs connected to the wireless network 230 and extracts information about the plurality of connected APs.

In operation S430, the wireless network security apparatus 210 is connected to the first user terminal 251 and the second user terminal 252 from the first user terminal 251 and the second user terminal 252 to the AP detected. Receive detected AP information. In this case, the first user terminal 251 and the second user terminal 252 are terminals previously authenticated by the authentication server 220 as described above.

In operation S440, the wireless network security apparatus 210 extracts unauthorized AP information by comparing the extracted AP information or the received detection AP information with stored authorized AP information.

In operation S450, the wireless network security apparatus 210 transmits the authorized AP information and the unauthorized AP information to the first user terminal 251 and the second user terminal 252 connected to the wireless network 230, and then, in step S460. The first user terminal 251 and the second user terminal 252 access only the authorized AP using the received AP information and the unauthorized AP information.

In operation S470, the wireless network security apparatus 210 may transmit the authorized AP information and the unauthorized AP information to a separate manager server, and the manager server stores and outputs the AP information so that the administrator can control it. For example, the administrator may extract the location and IP address where the unauthorized AP is installed, and track it by referring to the unauthorized AP information.

The manager server may be coupled to a location that can communicate with the wireless network security device 210, and when the new AP is notified, the manager checks the information of the AP to determine whether to permit it. If the informed AP is determined to be an authorized AP, the registered AP may be registered as an authorized AP so that the first user terminal 251 and the second user terminal 252 may access the wireless network 230 through the corresponding AP.

As described above, unlike the conventional user terminal for accessing the wireless network 230, only the user's account information is transmitted to the authentication server 220 to perform only the access procedure of the corresponding wireless network 230. By accessing only to the list of authorized APs provided by the wireless network security device 210, there is an advantage in that it can cope with a security threat that may occur by accessing an unauthorized / illegal AP.

In addition, the wireless network security device according to an embodiment of the present invention and a specific connection method for the connection method, embedded system, common platform technology such as O / S, and the specific description of the interface standardization technology such as communication protocol, I / O interface, etc. Since it is obvious to those skilled in the art, the present invention will be omitted.

Those skilled in the art will appreciate that various modifications and changes can be made in the present invention without departing from the spirit and scope of the invention as set forth in the claims below.

1 is a block diagram of a wireless network system according to the prior art.

2 is a block diagram of a wireless network system according to an embodiment of the present invention.

3 is a block diagram of a wireless network security device according to an embodiment of the present invention.

4 is a flow chart of a wireless network security method in accordance with an embodiment of the present invention.

<Description of the symbols for the main parts of the drawings>

210: wireless network security device 220: authentication server

230: wireless network 241: authorized AP

242: unauthorized AP 243: external AP

251: first user terminal 252: second user terminal

Claims (16)

In the security device of a wireless network connected to a plurality of APs, A storage unit which stores authorization AP information regarding an AP previously authorized; An AP information extracting unit extracting information about the plurality of APs by accessing the plurality of APs; An AP information comparison unit for extracting unauthorized AP information by comparing the extracted AP information with the authorized AP information; And A transmitter for transmitting the authorized AP information and unauthorized AP information to a user terminal connected to the wireless network, The user terminal accesses only the authorized AP using the received AP information and unauthorized AP information, characterized in that the wireless network security device. The method of claim 1, The authorized AP information and the unauthorized AP information includes an IP address and installation location information. The method of claim 1, The AP information extracting unit extracts information about the plurality of APs by using SMP or Telnet. The method of claim 1, And an AP information receiver configured to receive detection AP information connected to the user terminal from the user terminal. The method of claim 4, wherein And the AP information comparing unit extracts the unauthorized AP information by comparing the detected AP information with the authorized AP information. The method of claim 5, The AP information comparison unit, The AP information included in the detection AP information and not included in the extracted AP information is set as external AP information. The method of claim 4, wherein The wireless network security device further comprises an authentication server for authenticating the AP connection of the user terminal for transmitting the detection AP information. The method of claim 1, And a manager server for receiving the unauthorized AP information from the transmitter. In the security method of a wireless network connected to a plurality of AP, Storing authorized AP information about a pre-authorized AP; Accessing the plurality of APs and extracting information about the plurality of APs; Extracting unauthorized AP information by comparing the extracted AP information with the authorized AP information; And And transmitting the authorized AP information and the unauthorized AP information to a user terminal connected to the wireless network. The user terminal accesses only to the authorized AP using the received AP information and unauthorized AP information. 10. The method of claim 9, The authorized AP information and the unauthorized AP information includes an IP address and installation location information. 10. The method of claim 9, Extracting information about the plurality of APs, And extracting information on the plurality of APs by using SMP or Telnet. 10. The method of claim 9, Receiving detection AP information connected to the user terminal from the user terminal. The method of claim 12, The unauthorized AP information extraction step, And extracting the unauthorized AP information by comparing the detected AP information with the authorized AP information. The method of claim 13, The unauthorized AP information extraction step, The AP information included in the detection AP information and not included in the extracted AP information is set as external AP information. The method of claim 12, And authenticating an AP connection of the user terminal that transmits the detection AP information. 10. The method of claim 9, And transmitting the unauthorized AP information to a manager server for receiving the unauthorized AP information.

Images