KR20150068232A - System and method for detecting and blocking illegal access point - Google Patents

Abstract

The present invention relates to a system and a method for detecting and preventing an illegal access point (AP), the invention including: an AP information acquisition device which is detachably coupled to a client terminal and which acquires adjacent AP information that is information of adjacent APs around the client terminal; and a server for receiving adjacent AP information and client terminal position information from the AP information acquisition device and for determining whether an adjacent AP is an illegal AP based on the received information.

Description

[0001] SYSTEM AND METHOD FOR DETECTING AND BLOCKING AN ILLEGAL ACCESS POINT [

The present invention relates to an illegal access point (AP) detection and blocking system, and more particularly, to an illegal access point (AP) detection and blocking system, The present invention relates to an illegal AP detection and blocking system and method that can easily and efficiently judge whether or not a user is aware of the presence or absence of an AP and can block access to a nearby AP.

Recently, wireless LAN is widely used in home or office due to the development of technology and convenience of use. Wireless LAN (WiFi) has increased convenience in use, but has various problems in terms of security. Since the wireless terminal uses a method in which a client terminal accesses an access point (AP) wirelessly and transmits / receives data, it is very important whether the AP is a legitimate AP or an unauthorized AP. For example, an illegal AP may be installed to intercept information of a client terminal connected thereto.

Conventional technologies for detecting illegal APs require expensive hardware equipment, cables for installing sensors in a physical space to be controlled, a network switch port, and the like. In order to construct and operate sensors, There is a problem that the environment must be changed or modified. In addition, when new emerging protocols (for example, 802.11ac, 802.11ad, etc.) are introduced in accordance with the development of the wireless LAN technology, there is a problem that the entire infrastructure must be replaced according to the protocol.

Korean Patent Laid-Open No. 10-2008-0050946 (published on Jun. 10, 2008) discloses a method of detecting an illegal access point, comprising: obtaining identification information of an access point to which a wireless terminal desires to access; Encrypting identification information about the access point to be accessed through a USIM card and transmitting the encrypted identification information to an authentication server; Receiving an encrypted verification result of the access point to access from the authentication server and decrypting the encrypted verification result through the USIM card; And blocking or permitting a connection to the access point based on the decrypted verification result. ≪ Desc / Clms Page number 2 >

However, this technology is premised on the mobile communication terminal and the USIM card, and it is impossible to determine the location of the access point, and whether the AP is a legitimate AP or an illegal AP is simply stored in advance in the authentication server with the identification information of the access point But it is still limited in that it only compares and verifies a list of illegal access points.

Korean Patent Publication No. 10-2008-0050946 (published on Jun. 10, 2008)

SUMMARY OF THE INVENTION It is an object of the present invention to provide a system and method for efficiently detecting an illegal AP and blocking access to an illegal AP at low cost.

It is another object of the present invention to provide a system and method for increasing the efficiency of wireless network management by determining the location of an illegal AP and determining whether the location is illegal AP based on the location of the illegal AP.

It is another object of the present invention to provide a system and method capable of coping with changes in environments such as a network environment and a protocol with flexibility and flexibility by using a USB type sensor and agent system.

According to an aspect of the present invention, there is provided an illegal access point (AP) detection and blocking system, which is detachably coupled to a client terminal and acquires neighboring AP information, An AP information acquiring device; And a server for receiving the neighbor AP information and the location information of the client terminal from the AP information acquisition apparatus and determining whether the neighbor AP is an illegal AP based on the information.

Here, the neighbor AP information acquired by the AP information acquiring device may include signal strength information and AP identification information of the wireless LAN signal received from the neighbor AP and received by the AP information acquiring device.

The location information of the client terminal may be an IP address.

The server may also determine the location of the neighboring AP based on the location information of the received client terminal and the signal strength information of the neighboring AP, and determine whether the neighboring AP is an illegal AP based on the determined location of the neighboring AP have.

The server may generate and store a sensor list correlated with the location information of the client terminal received from the AP information acquisition apparatus and the client terminal, generate and store an electronic map in which the location of the client terminal included in the sensor list is set, And a data manager for generating and storing an AP list including neighboring AP information of the neighbor AP received from the AP information acquiring apparatus.

The server displays the location of the client terminal that transmitted the neighboring AP information of the neighboring AP included in the AP list on the electronic map, and corresponds to the signal strength information of the neighboring AP around the location of the client terminal And an AP position determination unit for determining the overlapping area of the circles as the position of the surrounding AP.

Also, the AP position determination unit may change the size of the circle in accordance with the input signal of the user and display the changed size on the electronic map.

In addition, the AP position determination unit may determine an area where the circles overlap by changing the size of the circle to the position of the neighboring AP.

Also, the server compares the determined location information of the neighboring AP with the location information of the legitimate APs included in the whitelist storing the location information of the legitimate APs, and if the location information of the neighboring AP does not exist in the whitelist, And an illegal AP determination unit for determining the neighboring AP as an illegal AP.

The server further includes a blocking unit that transmits a blocking signal indicating blocking of a connection to a neighboring AP determined to be an illegal AP by the client terminal. The client terminal, receiving the blocking signal from the blocking unit, The connection may be blocked.

According to another aspect of the present invention, there is provided a method for acquiring AP information, comprising: a first step of coupling an AP information acquisition apparatus to a client terminal; A second step of the AP information acquisition apparatus acquiring neighboring AP information which is information on an AP around the client terminal; A third step of the AP information acquisition apparatus transmitting the neighbor AP information and the location information of the client terminal to the server; And a fourth step of the server determining whether the neighboring AP is an illegal AP based on the received neighboring AP information and the location information of the client terminal.

According to the present invention, it is possible to provide a system and method for efficiently detecting an illegal AP and blocking access to an illegal AP at low cost.

The present invention also provides a system and method for increasing the efficiency of wireless network management by determining the location of an illegal AP and determining whether the location of the illegal AP is determined based on the location of the illegal AP.

Further, the present invention can provide a system and a method that can cope with changes in environments such as a network environment and a protocol with flexibility and flexibility by using a USB type sensor and agent system.

FIG. 1 is a diagram illustrating an overall configuration of an illegal access point (AP) detection and blocking system 100 according to an embodiment of the present invention.
FIG. 2 is a diagram showing an internal configuration of the server 20 described with reference to FIG.
3 is a diagram showing an example of a sensor list generated by the data management unit 21. In FIG.
4 and 5 are diagrams illustrating a process of generating and storing an electronic map.
6 shows an actual example of a screen in which an AP list is displayed.
7, when the "location" button is clicked on in FIG. 6, the AP position determination unit 22 determines the position of the AP information acquisition apparatuses 10 that transmitted the AP information about the AP Is displayed on the screen.
8 is a diagram for explaining a method of determining the location of an AP by adjusting the size of a circle.
9 is a diagram showing a relationship of distances according to signal strength.
FIG. 10 is a flowchart illustrating the overall operation of the system 100 according to the present invention described with reference to FIGS. 1-9.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

FIG. 1 is a diagram illustrating an entire configuration of an illegal access point (AP) detection and blocking system 100 according to an embodiment of the present invention.

1, an illegal AP detection and blocking system 100 (hereinafter referred to as a "system 100") according to the present embodiment includes an AP information obtaining apparatus 10 and a server 20. [

The AP (Access Point) information acquisition apparatus 10 is detachably coupled to the client terminal 30 and acquires neighboring AP information about neighboring APs existing around the client terminal 10 do.

In addition, the server 20 receives the neighbor AP information and the location information of the client terminal 30 from the AP information obtaining apparatus 10, and performs a function of determining whether the neighbor AP is an illegal AP based on the received information .

The AP information acquisition apparatus 10 receives and detects a WiFi signal radiated from neighboring APs AP1 and AP2 existing around the client terminal 30 and outputs signal intensity information and AP identification information of the wireless LAN signal . Here, the AP identification information is preferably an SSID (Service Set Identifier) which is a unique identifier existing in a header of a packet transmitted through a wireless LAN, for example. In FIG. 1, only two APs (AP1 and AP2) are shown around the client terminal 30 for convenience of description. However, it is needless to say that more APs may exist in practice.

Here, the client terminal 30 is preferably a computer such as a notebook computer or a desktop computer, and has a port, such as a USB port, a serial port, and a parallel port, to which the AP information obtaining apparatus 10 can be attached and detached.

The AP information acquisition device 10 is detachably coupled to the client terminal 30 and receives and detects a wireless LAN signal radiated from a neighboring AP and acquires signal intensity information and AP identification information of the wireless LAN signal For example, a configuration similar to that of a USB type wireless LAN card. As is well known, a USB type wireless LAN card that can be inserted into a USB port of a computer and can be easily separated from a computer after use is widely used. The USB type wireless LAN card performs a known function as a LAN card. This function is a function of receiving and detecting a wireless LAN signal (WiFi signal) emitted from a neighboring AP and acquiring signal intensity information of a wireless LAN signal to be sensed . And can also acquire AP identification information of the neighbor AP, for example, an SSID (Service Set Identifier).

According to a preferred embodiment of the present invention, the AP information obtaining apparatus 10 has a function that is performed by the wireless LAN card as is known in the art, and stores software that can perform functions for implementing the present invention It is desirable to include a storage device. That is, the AP information acquisition apparatus 10 according to the preferred embodiment of the present invention receives and detects the wireless LAN signal of the neighboring APs and acquires the signal strength information of the received wireless LAN signal and the identification information of the neighboring APs And a storage device in which software for carrying out the present invention is stored, and a configuration capable of being combined with a USB port of the client terminal 30. [ When the AP information acquiring device 10 is inserted into the USB port of the computer which is the client terminal 30, the software stored in the storage device is automatically installed or executed in the client terminal 30, The AP information acquisition apparatus 10, the client terminal 30, and the server 20 operate in cooperation with each other according to the present invention. Such software operates as a kind of agent.

The server 20 receives peripheral AP information about neighboring APs existing around the client terminal 30 from the AP information obtaining apparatus 10 coupled to the client terminal 30 as described above. As described above, the neighbor AP information includes signal intensity information and AP identification information of a wireless LAN signal received by the AP information acquiring apparatus 10 radiated from the neighboring APs AP1 and AP2. Also, the server 20 receives the location information of the client terminal 30 from the client terminal 30, which is preferably the IP address of the client terminal 30, for example.

Meanwhile, the neighboring AP information and the location information of the client terminal 30 may be configured to be transmitted from the AP information acquiring device 10 to the server 20 or transmitted to the server 20 through the client terminal 30 It is possible.

The server 20 performs a function of determining whether or not the neighbor APs AP1 and AP2 are illegal APs based on the neighbor AP information transmitted from the client terminal 30 and the location information of the client terminal 30 do.

A detailed process of determining whether the server 20 is an illegal AP is described with reference to FIG. 2 and subsequent figures.

FIG. 2 is a diagram showing an internal configuration of the server 20 described with reference to FIG.

As described above, the server 20 determines the location of the neighbor AP based on the location information of the client terminal 30 and the neighbor AP information transmitted from the client terminal 30 (or the AP information acquiring apparatus 10) The server 20 determines whether or not the neighboring AP is an illegal AP based on the determined and determined location of the neighboring AP. The server 20 includes a data management unit 21, an AP positioning unit 22, An AP determination unit 23, and a blocking unit 24. [

First, the data management unit 21 generates and stores a sensor list in which the client terminal 30 is associated with the location information of the client terminal 30 received from the AP information acquisition apparatus 10.

3 is a diagram showing an example of a sensor list generated by the data management unit 21. In FIG.

As shown in Fig. 3, the sensor list may be composed of the fields of the sensor name, the IP, and the connection diagram. The sensor name means the identifier of the client terminal 30 to which the AP information acquisition apparatus 10 is connected and the IP means the IP address of the client terminal 30 to which the AP information acquisition apparatus 10 is connected. When the connection diagram of the corresponding sensor is selected by a device such as a mouse as a link of the AP information acquiring device 10 included in the generated sensor list, that is, An electronic map can be displayed on the display device of the server 20. [

As described above, when the AP information acquiring device 10 is inserted and coupled to the USB port of the client terminal 30, the software stored in the AP information acquiring device 10 is installed or executed in the client terminal 30, The AP information acquiring apparatus 10 transmits the neighbor AP information about the client terminal 30 and the location information of the client terminal 30 to the server 20. [ The data management unit 21 of the server 20 generates and stores the sensor list as shown in FIG. 3 based on the surrounding AP information and the location information of the client terminal 30. [

Also, the data management unit 21 generates and stores an electronic map in which the position of the client terminal 30 included in the sensor list is set.

4 and 5 are diagrams illustrating a process of generating and storing an electronic map.

4 is a screen for registering / uploading an electronic map, clicking a sensor connection setting button, and connecting an electronic map and a sensor.

5 shows an actual example of a screen for setting the position of the client terminal 30 on the electronic map. The position of the sensor included in the positionally assignable sensor list in the upper left corner of Fig. 5 is set on the electronic map, Clicking the Save Current Location button on the upper right will link the sensor and the electronic map. The sensors set in this way are included in the list of assigned sensors in the lower left corner.

In addition, the data management unit 21 generates and stores an AP list including the neighboring AP information of the neighboring AP received from the AP information obtaining apparatus 10. [

6 shows an actual example of a screen in which an AP list is displayed.

Referring to FIG. 6, it can be seen that an AP list including AP identification information such as SSID and other AP information included in the neighbor AP information received from the AP information acquisition apparatus 10 is generated. In this state, if the "location" button is clicked on the red box on the right side of Fig. 6, an electronic map displaying the position of the AP information acquiring device 10, i.e., the sensor, Reference).

On the other hand, the AP positioning unit 22 of the server 20 displays the position of the client terminal 30, i.e., the sensor, which has transmitted the neighbor AP information of the neighbor AP included in the AP list, on the electronic map, 30 on the electronic map, and determines the overlapping area of the circles as the position of the surrounding AP.

7, when the "location" button is clicked on in FIG. 6, the AP position determination unit 22 determines the position of the corresponding AP by using the AP information acquisition apparatus 10 Fig. 8 is a diagram showing a state in which an electronic map showing the positions of sensors is displayed on the screen. In FIG. 7, the actual AP is indicated by a red square in the center for convenience of explanation.

Referring to FIG. 7, it can be seen that the position of the AP information acquiring device 10, that is, the position of the sensor transmitting the AP information for the AP whose SSID is "External_AP", which is the AP identification information, is displayed at the center of each circle . In FIG. 7, four circles are shown, which indicates that four AP information acquisition apparatuses 10, that is, a sensor has transmitted AP information for the corresponding AP. The sizes of the circles correspond to the signal strength information of the wireless LAN signal received by each AP information acquiring device 10, and the larger the intensity of the signal is, the smaller the circle is, and the larger the intensity of the signal is, the larger the size of the circle. This means that as the intensity of the signal becomes stronger, the location of the AP acquiring device 10 and the corresponding AP are close to each other.

7, if there is an area where the circles overlap each other, the AP positioning unit 22 determines the location of the corresponding AP in the overlapping area. However, as shown in FIG. 7, when there is no area where the circles overlap each other, it is possible to roughly grasp the position of the AP from each sensor, but it is difficult to accurately grasp the actual position. In this case, the AP position determination unit 22 can grasp the position of the AP by adjusting the size of the circle in order to more accurately estimate the actual position of the neighboring AP.

8 is a diagram for explaining a method of determining the location of an AP by adjusting the size of a circle.

Referring to FIG. 8, when the user adjusts the signal intensity using the "signal intensity" control bar at the upper left corner, the AP position determination unit 22 changes and displays the size of the circle so as to increase or decrease accordingly. If there is no overlapping area, the user can increase the size of the circle by using the "Signal Strength" control bar so that overlapping areas are created. If the overlapping area is too large, .

As described above, the size of the circle corresponds to the intensity of the signal, and in the state as shown in FIG. 7, the circle is displayed such that the intensity of the signal is smaller and the intensity of the signal is smaller. If there is no overlapping area between the circles in this state, if the user adjusts the signal strength adjustment bar greatly (meaning that the size of the circle is increased corresponding to the intensity of the signal rather than increasing the actual signal strength) The size of the circle correspondingly increases. It is preferable that the proportion of each circle increases in advance by previously measuring the proportional relationship between the signal intensity and the distance and setting it in advance.

9 is a diagram showing a relationship of distances according to signal strength.

Referring to FIG. 9, it can be seen that the relationship of the signal intensity according to the distance between the sensor and the AP is displayed. The closer the distance is, the greater the intensity of the signal. When the measured value is obtained by using a test sensor in advance and the signal intensity adjusting bar is enlarged according to the change of the signal intensity adjusting bar in FIG. 8, the relationship of the distance (increasing distance) So that the radius of the circle corresponding to the distance can be increased.

Since the size of the circle is changed by adjusting the signal intensity using the signal intensity control bar, the user can appropriately operate the signal intensity control bar to obtain a screen in which the circles overlap each other as shown in FIG. 8, The overlapping area of the circles can be determined as the position of the corresponding AP as shown in FIG.

The illegal AP determination unit 23 will be described with reference to FIG.

The illegal AP determining unit 23 finally performs a function of determining whether the corresponding AP is an illegal AP based on the location information of the neighboring AP determined by the AP position determining unit 22, Lt; / RTI > That is, the illegal AP determination unit 23 compares the location information of the AP determined by the AP position determination unit 22 with the location information of the legitimate APs included in the whitelist storing the location information of the legitimate APs, If the location information of the AP determined by the determination unit 22 does not exist, the neighboring AP is determined to be an illegal AP. This can be determined automatically by calculating the difference between the distances between the position information and calculating a distance equal to or smaller than a predetermined threshold value. Alternatively, the location of the party APs included in the whitelist may be displayed on the electronic map as shown in FIGS. 7 and 8 to be provided to the user (administrator) so that the user can confirm the location of the AP. The AP may be classified as an illegal AP. The AP determined as an illegal AP in the illegal AP determination unit 23 can record data indicating that it is an illegal AP in the AP list (see FIG. 6).

Referring again to FIG. 2, the blocking portion 24 will be described.

The blocking unit 24 performs a function of transmitting a blocking signal to the client terminal 30, which indicates that the connection to the neighboring AP determined as an illegal AP is to be blocked. The client terminal 30 receiving the blocking signal from the blocking unit 24 is disconnected from the corresponding peripheral AP, which can be accomplished by the operation of the software executed by the AP information obtaining apparatus 10 as described above .

FIG. 10 is a flowchart illustrating the overall operation of the system 100 according to the present invention described with reference to FIGS. 1-9.

Referring to FIG. 10, the AP information obtaining apparatus 10 first associates with the client terminal 30 (S100). As described above, according to the preferred embodiment of the present invention, the AP information acquisition apparatus 10 is coupled to the USB port of the client terminal 30. [

When the AP information acquisition apparatus 10 is coupled to the client terminal 30, the software (program) stored in the AP information acquisition apparatus 10 is executed as described above (S110).

By executing the software, the AP information acquisition apparatus 10 acquires the neighbor AP information, which is the information of APs existing around the client terminal 30 (S120).

Upon acquiring the neighboring AP information, the AP information obtaining apparatus 10 transmits the acquired neighbor AP information and the location information of the client terminal 30 to the server 20 (S130).

The server 20 receives the surrounding AP information and the location information of the client terminal 30, and based on these, the data management unit 21 of the server 20 generates the sensor list, the electronic map, and the AP list as described above (S140, S150, S160).

Next, the AP positioning unit 22 of the server 20 displays circles on the electronic map according to the method described with reference to FIGS. 7 to 9 and adjusts the size of the circles to determine the position of the neighboring AP (S170).

When the location of the neighboring AP is determined, the illegal AP determining unit 23 of the server 20 determines whether or not the legitimate APs included in the whitelist storing the location information of the determined neighboring APs and the location information of the legitimate APs If the location information of the surrounding AP does not exist in the whitelist by comparing the location information, it is determined that the neighboring AP whose location is determined is an illegal AP (S180).

If it is determined that the neighboring AP is an illegal AP, the blocking unit 24 of the server 20 transmits a blocking signal instructing the client terminal 30 to block access to the neighboring AP determined as an illegal AP (S190) The client terminal 30 is disconnected from the corresponding peripheral AP (S200).

Although the present invention has been described with reference to the preferred embodiments thereof, it is to be understood that the scope of the present invention is not limited to the above-described embodiments but various changes and modifications may be made without departing from the scope of the present invention. Of course.

10 ... AP information acquisition device
20 ... server
30 ... client terminal

Claims (11)

In an illegal access point (AP) detection and blocking system,
An AP information acquiring device detachably coupled to the client terminal and acquiring neighboring AP information that is information on the AP around the client terminal; And
A server for receiving the neighbor AP information and the location information of the client terminal from the AP information acquiring device and determining whether the neighboring AP is an illegal AP
And an AP detection and blocking system.
The method according to claim 1,
Wherein the peripheral AP information acquired by the AP information acquisition apparatus includes signal strength information and AP identification information of the wireless LAN signal received by the AP information acquisition apparatus radiated from the neighboring AP.
The method according to claim 1,
Wherein the location information of the client terminal is an IP address.
3. The method of claim 2,
The server comprises:
Determines the location of the neighboring AP based on the received location information of the client terminal and the signal strength information of the neighboring AP, and determines whether the neighboring AP is an illegal AP based on the determined location of the neighboring AP. Detection and blocking system.
5. The method of claim 4,
The server comprises:
Generates and stores a sensor list corresponding to the location information of the client terminal received from the AP information acquisition apparatus and the client terminal, generates and stores an electronic map in which the location of the client terminal included in the sensor list is set, And a data management unit for generating and storing an AP list including peripheral AP information of a peripheral AP received from the acquisition apparatus.
6. The method of claim 5,
The server comprises:
The location of the client terminal that has transmitted the neighbor AP information of the neighbor AP included in the AP list is displayed on the electronic map and the circle corresponding to the signal strength information of the neighbor AP is centered on the position of the client terminal, And an AP position determination unit for determining an overlapping area of the circles as a position of the neighboring AP.
The method according to claim 6,
Wherein the AP position determination unit changes the size of the circle in accordance with the input signal of the user and displays the changed size on the electronic map.
8. The method of claim 7,
Wherein the AP position determination unit determines an area where the circles overlap by changing the size of the circle to a position of the neighboring AP.
9. The method of claim 8,
The server comprises:
If the location information of the neighboring APs is not present in the whitelist by comparing the location information of the determined nearby APs with the location information of the legitimate APs included in the whitelist storing the location information of the legitimate APs, And an unauthorized AP judging unit for judging whether or not an illegal AP has been detected.
The method according to claim 1,
The server comprises:
Further comprising a blocking unit for transmitting a blocking signal for instructing the client terminal to block access to the neighboring AP determined as an illegal AP,
And the client terminal receiving the blocking signal from the blocking unit is disconnected from the corresponding AP.
11. A method for detecting and blocking an illegal AP in an illegal AP detection and blocking system according to any one of claims 1 to 10,
A first step of coupling an AP information acquisition device to a client terminal;
A second step of the AP information acquisition apparatus acquiring neighboring AP information which is information on an AP around the client terminal;
A third step of the AP information acquisition apparatus transmitting the neighbor AP information and the location information of the client terminal to the server; And
The server determines whether the neighbor AP is an illegal AP based on the received neighbor AP information and the location information of the client terminal
The method comprising the steps of:

Images