WO2014081205A1

WO2014081205A1 - Illegal ap detection system and detection method therefor

Info

Publication number: WO2014081205A1
Application number: PCT/KR2013/010597
Authority: WO
Inventors: 이상준; 함성윤
Original assignee: 유넷시스템주식회사
Priority date: 2012-11-23
Filing date: 2013-11-21
Publication date: 2014-05-30
Also published as: KR20140066312A; KR101429177B1

Abstract

The present invention provides the advantages of confirming and detecting whether an unauthorized illegal AP is connected to a user's communication network even in a wireless environment of a secure mode and a router mode. To this end, disclosed is an illegal AP detection system comprising: a sensor for detecting a data packet wirelessly transmitted to a user terminal through at least one AP; and a wireless intrusion prevention system (WIPS) server for determining whether the AP is an unauthorized illegal AP connected to an internal network by receiving the detected data packet from the sensor, wherein the WIPS server comprises: a packet generation unit which generates a data packet of specific length that is to be transmitted to the user terminal through the AP so as to transmit the data packet a specific number of times for a predetermined time; a packet analysis unit for determining whether the AP is an AP connected to the internal network by analyzing the number of times at which the data packet of the specific length has been detected by the sensor for a predetermined time; and a database unit for storing MAC address information of the AP.

Description

Illegal Ap Detection System and Its Detection Method

The present invention relates to an illegal AP detection system and a detection method thereof. More specifically, the present invention relates to an illegal AP detection system and a detection method thereof, which can detect whether an unauthorized illegal AP is connected to its own network even when the wireless environment is a security mode and a router mode.

Rapidly expanding wireless networks, particularly wireless LANs, support the exchange of data by wirelessly connecting user terminals to the network in accordance with the IEEE802.11 standard. Wireless network environment is convenient because it enables users to move easily and exchange data through network connection, while access user terminal is physically separated from the network equipment and transmission data is exposed in the air. / The possibility of leakage can be said to be greater compared to wired networks, especially wired LANs.

The most fundamental and fundamental vulnerabilities of the wireless environment are first, the unauthorized person or unauthorized terminal that makes FW, IDS, etc., which is a security device in the wired gateway section obsolete, by easily accessing the wireless AP inside the building from outside the building. It is possible to bypass the network. In addition, when accessing an external wireless LAN AP using a laptop equipped with a wireless LAN, etc., to which an employee is not authorized, such as a network connected to an internal wired network, an information leakage accident may occur through this.

Second, even without accessing the in-house wireless network by accessing the AP, the wireless section data can be easily eavesdropped through air sniffing, so that confidential and personal information of the company can be leaked. Currently, the largest area of security vulnerabilities, such as wireless APs or routers in Korea, is caused by wireless devices such as wireless LANs that have been left unauthenticated and password-free. As security measures, security infrastructures such as authentication and encryption are being applied.

On the other hand, the conventional techniques for detecting unauthorized AP has a problem that it is not possible to confirm whether the collected unauthorized AP is connected to the internal network by collecting only the information about the unauthorized AP without performing data traffic (data traffic) processing . That is, even if an unauthorized AP is detected, there is a problem that such unauthorized AP cannot check whether it is an AP connected to its network and cannot block it without permission.

In addition, the prior art was able to collect information about the AP in the open mode and bridge mode state, but there was a problem that can not collect information about the AP in the security mode and router mode state.

The present invention was created to solve the above problems, and an object of the present invention is to identify an unauthorized illegal AP connected to its own network regardless of whether the wireless environment is a bridge mode, a router mode, an open mode, and a secure mode. The present invention provides a detection system and a detection method capable of detecting the same.

An object of the present invention as described above is a sensor for detecting a data packet that is wirelessly transmitted to a user terminal through at least one AP; And a wireless intrusion prevention system (WIPS) server that receives the detected data packet from a sensor and determines whether the AP is an unauthorized and illegal AP connected to an internal network, wherein the WIPS server includes a specific length of a specific length to be transmitted to a user terminal through the AP. A packet generator for generating a data packet and transmitting the predetermined number of times for a predetermined time; A packet analyzer configured to analyze whether the data packet having a specific length is detected by the sensor for a predetermined time and determine whether the AP is an AP connected to the internal network; And a database unit storing MAC address information of the AP.

In addition, when there are a plurality of APs, the packet generation unit may generate data packets having different lengths corresponding to the number of APs and transmit the same to the user terminal through each AP.

The packet analyzer may determine that the AP is an AP connected to an internal network when the AP determines that the data packet having a specific length is transmitted to the user terminal more than a predetermined number of times for a predetermined time. .

The WIPS server may determine that the AP is an unauthorized illegal AP when the packet analyzer determines that the MAC address of the AP determined to be connected to the internal network is not included in the MAC address information of the authorized AP. You can do

The sensor may further include a communication unit for transmitting the detected data packet to the WIPS server.

On the other hand, an object of the present invention is another category, the sensor step A for detecting a data packet that is wirelessly transmitted to the user terminal through at least one AP; Transmitting, by the sensor, the detected data packet to a wireless intrusion prevention system (WIPS) server; A step C of generating a data packet having a specific length by the packet generation unit provided in the WIPS server and transmitting the data packet to the user terminal through the AP a specific number of times for a predetermined time; A step D for checking whether a packet analyzer provided in the WIPS server has a data packet having a specific length among the data packets transmitted from the sensor; An E step of checking, by the packet analyzer, the number of times a data packet having a specific length among the data packets transmitted from the sensor is detected for a predetermined time; A step F of determining, by the packet analyzer, whether the AP is an AP connected to the internal network based on the presence and the number of detections of the data packet having a specific length; And a G step of determining whether the AP is an unauthorized illegal AP by searching a database unit in which the WIPS server stores MAC address information of the authorized AP.

In addition, in step C, when there are a plurality of APs, the packet generation unit may generate data packets having different lengths corresponding to the number of APs and transmit the number of data packets to the user terminal through each AP.

Also, in step F, the packet analyzer may determine that the AP is an AP connected to the internal network when a data packet having a specific length is detected more than a predetermined number of times for a predetermined time.

In step G, the packet analyzer determines that the MAC address of the AP determined to be connected to the internal network is not included in the MAC address information of the authorized AP stored in the database unit provided in the WIPS server. For example, the AP may be determined to be an unauthorized and illegal AP.

According to one embodiment of the present invention, the present invention has the effect of identifying and detecting whether an unauthorized illegal AP is connected to its network.

In addition, even in a secure mode in which data packets transmitted and received between an unauthorized illegal AP and a user terminal are encrypted, there is an effect of confirming whether the unauthorized AP is connected to its own network communication network.

In addition, there is an effect that can detect an unauthorized illegal AP connected to its network communication network in both the bridge mode and router mode wireless environment.

1 is a block diagram showing the configuration of an unauthorized illegal AP detection system according to an embodiment of the present invention;

2 is a block diagram showing the configuration of a WIPS server according to an embodiment of the present invention;

3 is a flowchart sequentially illustrating a method for detecting an unauthorized illegal AP according to an embodiment of the present invention.

100: WIPS server

110: packet generation unit

120: packet analysis unit

130: packet storage unit

200: sensor

300: communication unit

400: AP

500: user terminal

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. It should be noted that the same elements among the drawings are denoted by the same reference numerals and symbols as much as possible even though they are shown in different drawings. In addition, in the following description of the present invention, if it is determined that a detailed description of a related known function or configuration may unnecessarily obscure the subject matter of the present invention, the detailed description thereof will be omitted.

<비인가 불법 AP 검출 시스템의 구성><Configuration of unauthorized illegal AP detection system>

1 is a block diagram of a system for detecting an illegal AP of a network communication network according to an embodiment of the present invention, and FIG. 2 is a block diagram showing a configuration of a WIPS server according to an embodiment of the present invention. As shown in FIG. 1, the present inventors have an illegal AP detection system (hereinafter, referred to as a 'detection system') of a wireless intrusion prevention system (WIPS) server 100, a sensor 200, a communication unit 300, and an AP 400. ) And a user terminal 500. In addition, as shown in FIG. 2, the WIPS server 100 includes a packet generation unit 110, a packet analysis unit 120, and a packet storage unit 130 therein. Meanwhile, the unauthorized illegal AP in the present invention refers to an AP (Acess Point) that is unauthorized by an administrator, and the authorized AP refers to an AP authorized by the administrator. In addition, the user terminal 500 refers to various devices capable of transmitting and receiving data through the AP 400 connected to the WIPS server 100 such as a laptop or a smartphone equipped with a wireless LAN.

The sensor 200 detects a data packet wirelessly transmitted to the user terminal 500 through the AP 400. The sensor 200 and the AP 400 are connected to the WIPS server 100 by wire. Here, the AP 400 may be configured as one or a plurality. A data packet refers to a unit of information transmitted from one device to another device through a communication network in a block. Here, the data packet may include various element fields such as a service set identification address (SSID), a support rate, a timestamp, an indication interval, capacity information, channels, and the like. The data packet detected by the sensor 200 is transmitted to the WIPS server 100. In this case, the sensor 200 may be provided with a communication unit 300, and the data packet detected through the communication unit 300 may be transmitted to the WIPS server 100.

The WIPS server 100 determines whether the AP 400 is an unauthorized illegal AP connected to the internal network based on the data packet transmitted from the sensor 200. Specifically, it is determined whether the AP 400 is an AP connected to the internal network through the packet generator 110 and the packet analyzer 120 provided in the WIPS server 100, and then the WIPS server 100 It is determined whether the AP 400 connected to the internal network is an authorized AP 400a or 400c or an unauthorized

illegal AP

400b or 400d. The packet generator 110 and the packet analyzer 120 provided in the WIPS server 100 will be described in detail below. Meanwhile, the data packet transmitted from the sensor 200 may be stored in the packet storage unit 130 provided in the WIPS server 100.

The packet generator 110 generates a data packet of a specific length to be transmitted to the user terminal 500 through the AP 400 and transmits the data packet a specific number of times for a predetermined time. In this case, the packet generator 110 may periodically generate a data packet having a specific length and transmit the data packet to the user terminal 500. Meanwhile, as the packet generator 100, a probe capable of searching for and verifying a computer and a running service on a network in a security field may be used. Here, the data packet of a specific length generated by the packet generator 110 may be generated by various known packet conversion methods. In addition, a predetermined time may be set by an administrator, and preferably set in seconds. In addition, the number of times of transmitting the data packet can also be adjusted by the administrator. For example, an administrator may set whether to transmit a data packet of a specific length 10 times in 1 second or 100 times in 1 second.

On the other hand, when there are a plurality of APs 400, the packet generator 110 generates data packets having different lengths corresponding to the number of APs 400 so as to generate a user terminal 500 through each AP 400. Can be sent to. That is, when several APs 400 are connected to the internal network, the APs 400 may simultaneously detect multiple APs 400 connected to the internal network by transmitting data packets having different lengths. . For example, if there are four APs 400, four types of data packets having different lengths may be generated and transmitted separately for each AP.

The packet analyzer 120 determines whether the AP 400 is connected to the internal network by analyzing the number of times a data packet having a specific length is detected by the sensor 200. That is, when the packet analyzer 120 determines that the AP 400 transmits a data packet having a specific length to the user terminal 500 more than a preset number of times, the AP 400 transmits the AP 400 to the internal network. It is determined by the AP 400 connected. In this case, the preset number of times may be set in consideration of the number of times the packet generator 110 generates and transmits a data packet having a specific length.

If the WIPS server 100 determines that the MAC address of the AP 400 determined to be connected to the internal network by the packet analyzer 120 is not included in the MAC address information of the authorized AP, the

AP

400b, 400d) is determined to be an unauthorized illegal AP. That is, the WIPS server 100 is provided therein, and searches for a database unit (not shown) that stores MAC address information of the authorized

APs

400a and 400b and determines that the AP 400 determined to be connected to the internal network is unauthorized. It is determined whether or not the illegal AP (400b, 400d) or the authorized AP (400a, 400c).

<비인가 불법 AP 검출 방법><Unauthorized illegal AP detection method>

3 is a flowchart sequentially illustrating a method for detecting an unauthorized illegal AP according to an embodiment of the present invention. Hereinafter, a method of detecting an unauthorized AP (hereinafter, referred to as a 'detection method') will be described in detail, but the content overlapping with the description of the detection system will be considered.

1. Data packet detection step (S610)

The sensor 200 refers to a step of detecting a data packet wirelessly transmitted to the user terminal 500 through the at least one AP 400 (S610).

2 . Data packet transmission step (S620)

In operation S620, the sensor 200 transmits the detected data packet to the WIPS server 100. Here, the data packet detected by the sensor 200 may be transmitted to the WIPS server 100 through the communication unit 300. On the other hand, the data packet transmitted to the WIPS server 100 may be stored in the packet storage unit 300 provided in the WIPS server 100 (S625).

3 . Data packet transmission step of a specific length (S630)

The packet generation unit 110 included in the WIPS server 100 generates a data packet having a specific length and transmits the data packet to the user terminal 500 through the AP 400 a predetermined number of times for a predetermined time (S630). . In this case, when there are a plurality of APs 400, the packet generation unit 110 generates data packets having different lengths corresponding to the number of APs 400 and through each

AP

400a, 400b, 400c, 400d. Each

user terminal

500a, 500b, 500c, or 500d). For example, a data packet having a length of 64 bits (Bit) is generated for the first unlicensed AP 400b among the AP 400 and transmitted 10 times for 1 second, and 640 for the second unlicensed AP 400d. When a data packet having a bit length is generated and transmitted ten times in one second, a predetermined number of times of a 64-bit long data packet and a number of 640-bit long data packets detected by the sensor for one second are set in advance. If it is confirmed that the number of times or more, it can be determined simultaneously that the first unlicensed AP (400b) and the second unlicensed AP (400d) is connected to the internal network.

4 . Step of checking the existence of the data packet of a specific length (S640)

The packet analyzer 120 of the WIPS server 100 refers to a step of checking whether a data packet having a specific length is present among the data packets transmitted from the sensor 200 (S640).

5 . Checking the existence of the data packet of a specific length (S650)

The packet analyzer 120 of the WIPS server 100 refers to a step of checking the number of times a data packet having a specific length among the data packets transmitted from the sensor 200 is detected for a predetermined time (S650). Here, the predetermined time may be set differently from the predetermined time set in the data packet transmission step (S630) of the specific length, but is preferably set to the same time.

6 . Checking whether the AP is connected to the internal network (S660)

The packet analysis unit 120 included in the WIPS server 100 refers to a step of determining whether the AP 400 is connected to the internal network based on the presence and detection frequency of a data packet having a specific length (S660). ). Here, the packet analyzer 120 determines that the AP 400 is an AP connected to the internal network when a data packet having a specific length is detected more than a preset number of times for a predetermined time. In this case, the set number of times refers to the number of times preset by the administrator in consideration of the number of times that the packet generation unit 110 generates and transmits a data packet having a specific length. For example, when the packet generator 110 transmits ten data packets of a specific length for one second, eight data packets of a specific length transmitted to the user terminal 500 through the AP 500 are detected. The AP 500 may be configured to determine that the AP 500 is connected to the internal network.

7 . Determination step of unauthorized illegal AP (S670)

The WIPS server 100 refers to a step of determining whether the AP 400 is an unauthorized illegal AP by searching a database unit that stores MAC address information of the authorized AP (S670). Here, the packet analysis unit 120 is MAC address information of the authorized AP is stored in the database unit (not shown) provided in the WIPS server 100 MAC address of the AP 400 is determined to be connected to the internal network If not determined to be included in, the AP (400b, 400d) is determined to be an unauthorized illegal AP.

On the other hand, while the prior art can detect the unauthorized AP (400b, 400d), it is not confirmed whether the detected unauthorized AP (400b, 400d) is an AP connected to its network communication network, AP (400) In the case where the data packet transmitted and received between the terminal 500 and the terminal 500 is encrypted, there is a limitation that it is impossible to determine whether the AP 500 is connected to the internal network through the data packet information. On the other hand, in the present invention, even if a data packet transmitted and received between the AP 400 and the user terminal 500 is encrypted, the data packet generated by the packet generator 110 and transmitted is detected through the number of times that the data packet of a specific length is detected. Since the AP 400 can determine whether the AP 400 is connected, there is an advantage of detecting an unauthorized illegal AP in all wireless environments in both open and secure modes.

In addition, the present invention has the advantage that can be used in both the wireless mode of the bridge mode, router mode, unlike the prior art. Bridge mode refers to a method in which two medium access control (MAC) devices having the same logical connection control protocol (LLC protocol) but having the same or different interconnection information networks (LANs) can exchange data. The bridge includes a local bridge (LB) that connects LANs in the same premises or local area, and a remote bridge that connects LANs in remote areas. Data is exchanged by sending frames by MAC addresses (MACA) between bridges. On the other hand, a router is a device that extracts the location of a packet and specifies the best path for that location, and redirects the data packet to the next device along the path. Routers connect two or more logical subnets, which do not match the physical interface of the router. In other words, the MAC address is changed in the router mode. That is, the conventional technology has a limitation in detecting

unauthorized APs

400b and 400d in the case of the router mode in which the MAC address is continuously changed. However, in the present invention, even when the MAC address is changed, the AP 400 connected to the WIPS server 100 is changed. Through detecting the unauthorized AP by using the number of times the data packet of a specific length transmitted to the user terminals 500 through the advantage that can be used in router mode.

Although the technical spirit of the present invention has been described above with reference to the accompanying drawings, it is intended to exemplarily describe the best embodiment of the present invention, but not to limit the present invention. In addition, it is obvious that any person skilled in the art may make various modifications and imitations without departing from the scope of the technical idea of the present invention.

Claims

A sensor for detecting a data packet wirelessly transmitted to a user terminal through at least one AP; And

A wireless intrusion prevention system (WIPS) server that receives the detected data packet from the sensor and determines whether the AP is an unauthorized illegal AP connected to an internal network;

The WIPS server,

A packet generation unit generating a data packet of a specific length to be transmitted to the user terminal through the AP and transmitting the specific number of times for a predetermined time;

A packet analyzer configured to analyze the number of times a data packet having a specific length is detected by the sensor for a predetermined time and determine whether the AP is an AP connected to an internal network; And

And a database unit for storing MAC address information of an authorized AP.
The method of claim 1,

The packet generation unit,

When there are a plurality of APs, illegal AP detection system, characterized in that for generating the number of data packets of different lengths corresponding to the number of APs and transmit them to the user terminal through each AP.
The method of claim 1,

The packet analyzer,

When the AP determines that the data packet having a specific length has been transmitted to the user terminal more than a preset number of times for a predetermined time, the AP is determined to be an AP connected to an internal network. .
The method of claim 1,

The WIPS server,

When the packet analyzer determines that the MAC address of the AP determined to be connected to the internal network is not included in the MAC address information of the authorized AP, the AP is determined to be an unauthorized illegal AP. Illegal AP Detection System.
The method of claim 1,

The sensor,

And a communication unit for transmitting the detected data packet to the WIPS server.
Detecting, by the sensor, a data packet wirelessly transmitted to the user terminal through the at least one AP;

Transmitting, by the sensor, the detected data packet to a wireless intrusion prevention system (WIPS) server;

A step C of generating a data packet having a specific length by the packet generator provided in the WIPS server and transmitting the data packet to the user terminal through the AP a specific number of times for a predetermined time;

A step D for checking whether a packet analyzer provided in the WIPS server has a data packet having a specific length among the data packets transmitted from the sensor;

An E step of checking, by the packet analyzer, the number of times a data packet having a specific length among the data packets transmitted from the sensor is detected for a predetermined time;

A step F of determining, by the packet analyzer, whether the AP is an AP connected to an internal network based on the presence and the number of detections of the data packet having the specific length; And

And determining, by the WIPS server, a database unit storing MAC address information of an authorized AP to determine whether the AP is an unauthorized illegal AP.
The method of claim 6,

In step C,

The packet generation unit, when there are a plurality of APs, illegal AP detection method characterized in that for generating the number of data packets of different lengths corresponding to the number of the AP and transmits to the user terminal through each AP.
The method of claim 6,

In step F,

The packet analyzer may determine that the AP is an AP connected to an internal network when the data packet having the specific length is detected more than a preset number of times for a predetermined time.
The method of claim 6,

In step G,

If the packet analyzer determines that the MAC address of the AP determined to be connected to the internal network is not included in the MAC address information of the authorized AP stored in the database unit provided in the WIPS server, the AP Illegal AP detection method characterized in that it is determined to be an unauthorized illegal AP.