JP4779711B2 - Unauthorized access point detection method, access point device, and wireless LAN system - Google Patents

Description

  The present invention relates to an unauthorized access point detection method, an access point apparatus, and a wireless LAN system. For example, an attempt is made to detect an unauthorized access point apparatus connected outside the own network in a wireless LAN network.

  For example, in a wireless LAN system in a company, wireless LAN terminals 1-1 to 1-N relay access point apparatuses 3-1 to 3-M connected to their own network 2 as shown in FIG. Network connection is performed (for example, refer to FIG. 3 of Patent Document 1). The wireless LAN terminal 1-n (n is 1 to N) and the access point device 3-m (m is 1 to M) can be connected without using a communication cable by using wireless, and the terminal can be moved freely. The degree becomes higher.

For this reason, wireless LAN systems are rapidly spreading as corporate network infrastructure.
JP 2000-31162 A

  However, in the wireless LAN system, since it is not a cable connection, it is difficult for the terminal itself to know which access point device 3-m the wireless LAN terminal 1-n is connected to. In addition, since wireless radio waves fly beyond the walls of corporate buildings, even if a third party installs the unauthorized access point device 4 outside the premises for the purpose of unauthorized data acquisition, difficult.

  Therefore, there is a need for an unauthorized access point detection method, an access point apparatus, and a wireless LAN system that can detect the presence of an unauthorized access point device.

  The first aspect of the present invention relates to a wireless LAN system in which a plurality of access point devices accommodating wireless LAN terminals are connected by a wired LAN, and unauthorized access point detection for detecting unauthorized access point devices not connected to the wired LAN. (0) At least some of the access point devices include an adjacent access point detection unit, an adjacent access point storage unit, a search data transmission unit, and an unauthorized access point specifying unit. The adjacent access point detection means monitors the wireless space around the access point apparatus, obtains identification information of the adjacent access point apparatus, stores it in the adjacent access point storage means, and (2) transmits the search data. The means includes the unauthorized access point search data, the wired LAN, the adjacent A wireless link with the adjacent access point device stored in the access point storage means is transmitted so as to return to the access point device via this order or in reverse order, and an unauthorized access point search is performed. The neighboring access point storage means stores information indicating that it is a legitimate device for the access point apparatus adjacent to the route where the data has returned, and (3) the unauthorized access point specifying means identifies the neighboring access point storage means. While the information is stored, an access point device that is not stored as a legitimate device is recognized as an unauthorized access point device.

  According to a second aspect of the present invention, in an access point device that accommodates a wireless LAN terminal and is connected to another access point device via a wired LAN, (1) identification of an access point device adjacent to the access point device Neighboring access point storage means capable of storing information and the fact that it is a legitimate device, and (2) monitoring the wireless space around the access point device and obtaining identification information of the neighboring access point device to store the neighboring access point A wireless link between the adjacent access point detection means stored in the means and (3) the unauthorized access point search data for the wired LAN and the adjacent access point device stored in the adjacent access point storage means in this order. Or return to the access point device via reverse order Search data transmitting means for storing the fact that the access point device adjacent to the path on which the rogue access point search data has returned is stored in the adjacent access point storage means, and (4) the adjacent access. The point storage means includes unauthorized access point specifying means for recognizing as an unauthorized access point apparatus an access point apparatus that stores identification information but is not stored as a legitimate apparatus.

  According to a third aspect of the present invention, in a wireless LAN system in which a plurality of access point devices accommodating wireless LAN terminals are connected by a wired LAN, the access point device according to the second aspect of the present invention is used as at least a part of the access point devices. It is characterized by having applied.

  According to the present invention, it is possible to detect the presence of an unauthorized access point device that is not connected to a wired LAN.

(A) Embodiment Hereinafter, an embodiment of an unauthorized access point detection method and an access point apparatus according to the present invention will be described with reference to the drawings.

(A-1) Configuration of Embodiment In the wireless LAN system according to this embodiment, the arrangement of the components is the same as that shown in FIG.

  The access point device 3-m includes a wireless communication unit that performs communication with the wireless LAN terminal 1-n in its own area, a wired communication unit that performs communication with the company network (wired LAN portion) 2, and these wireless communication units. A signal processing unit that intervenes in signal transfer between the communication unit and the wired communication unit, or that executes connection control when the signal is a signaling signal.

  Here, the signal processing unit mainly has a software processing configuration centering on a CPU and the like. In this embodiment, a part of the software configuration in the access point device 3-m (signal processing unit) is as follows. As shown in FIG. FIG. 1 shows a portion related to a function of detecting an unauthorized access point device, and omits components related to other functions such as a signaling signal processing function.

  In FIG. 1, the access point device 3-m includes a wireless LAN driver 31, a wireless data communication processing unit 32, an unauthorized access point searching unit 33, a wired LAN driver 34, an adjacent access point table 35, and the like.

  The wireless LAN driver 31 controls the wireless LAN protocol and performs wireless data transmission / reception. The communication partner of the access point device 3-m is the wireless LAN terminal 1-n, but the transmission data of the adjacent access point device 3-j (j is 1 to M, except m) also reaches the wireless LAN terminal 1-n. The driver 31 may also receive transmission data of such an adjacent access point device 3-j (j is 1 to M, except m).

  The wireless LAN driver 31 drives the wireless data communication processing unit 32 to transmit search data (signaling signal including search data) to the wireless space (jurisdiction area). The access point device 3-m has a plurality of wireless channels so that a plurality of wireless LAN terminals can be accommodated, and transmits search data through an empty channel that is not used for communication with the wireless LAN terminals. .

  The wireless data communication processing unit 32 receives data received by the wireless LAN driver 31 and analyzes the contents thereof.

  When the wireless data communication processing unit 32 receives a beacon frame from the adjacent access point device 3-j, the wireless data communication processing unit 32 stores information on the adjacent access point device in the adjacent access point table 35. Here, the information of the adjacent access point device 3-j to be stored is identification information (for example, BSSID (Basic Service Set Identifier)) of the adjacent access point device.

  When the wireless data communication processing unit 32 receives the search data from the adjacent access point device 3-j, the wireless data communication processing unit 32 sets the status of the information of the adjacent access point device 3-j in the adjacent access point table 35 to “regular”. Is.

  The wireless data communication processing unit 32 causes the wireless LAN driver 31 to transmit the search data given from the company network (wired LAN portion) 2 side to the wireless space.

  The unauthorized access point search unit 33 periodically transmits search data to the wired LAN portion (in-house network) 2 in order to search for the unauthorized access point device 4. The unauthorized access point search unit 33 confirms the status of the adjacent access point table 35 when a predetermined time has elapsed after transmitting the search data, and determines whether or not the unauthorized access point device 4 exists. When the presence of an unauthorized access point device 4 is detected, detection data (for example, including data to be specified such as BSSID) indicating that is connected to the wired LAN portion (in-house network) 2 The data is transmitted to a host device (not shown).

  In addition, the unauthorized access point search unit 33 is handed over to the wireless data communication processing unit 32 and transmitted to the wireless space by the wireless LAN driver 31 when the search data is given from the wired LAN part (own network) 2 side. It is.

  The wired LAN driver 34 controls the protocol of the wired LAN part (in-house network) 2 and performs data transmission / reception with the wired LAN part 2.

  The adjacent access point table 35 is a data file for storing information (device identification information and regular device flag) of the adjacent access point device 3-j. Writing to the adjacent access point table 35 is performed by the wireless data communication processing unit 32 as described above. The status in the adjacent access point table 35 is referred to by the unauthorized access point search unit 33.

(A-2) Operation of Embodiment Next, an operation of the wireless LAN system of the embodiment, particularly an operation for detecting an unauthorized access point device will be described.

(A-2-1) Recognition of adjacent access point apparatus Each access point apparatus 3-m monitors the radio waves of the surrounding wireless LAN, and the access point apparatus must always transmit, as shown in FIG. A control frame of a wireless LAN called “beacon” is monitored. The beacon frames of the access point devices 3-j and 4 adjacent to the access point device 3-m generally reach the access point device 3-m.

  Since the BSSID of the transmission source is inserted in the beacon frame, the wireless data communication processing unit 32 of the access point device 3-m stores the BSSID in the received beacon frame in the adjacent access point table 35. Stored as identification information of the adjacent access point devices 3-j and 4. In the example of FIG. 3, the adjacent access point table 35 of the access point apparatus 3-m includes identification information of the legitimate adjacent access point apparatus 3-j and identification information of the illegal adjacent access point apparatus 4. Stored.

  FIG. 4 is a flowchart showing the reception process of the wireless data communication processing unit 32. The wireless data communication processing unit 32 stores the BSSID in the adjacent access point table 35 when it is determined as a beacon in the step of determining whether or not it is a “beacon” (steps 100 and 101).

(A-2-2) Broadcast search data Each access point device 3-m starts the process shown in FIG. 5 by interruption every predetermined period (for example, 30 minutes), and each access point device 3-m is illegal. The access point search unit 33 transmits “illegal access point search data” as broadcast data to the company network (wired LAN portion) 2 (step 150). Here, the unauthorized access point search data may be broadcast data, and the format thereof is not limited.

  Since the unauthorized access point search data is transmitted to the company network (wired LAN portion) 2, it reaches the regular access point device 3-j but does not reach the unauthorized access point device 4. Since the unauthorized access point search data is broadcast data, the legitimate access point apparatus 3-j determines that it is necessary to relay to the wireless LAN side, and transmits the unauthorized access point search data to the wireless LAN side.

  As a result, as shown in FIG. 6, the legitimate access point device 3-j wirelessly transmits the unauthorized access point search data to its own jurisdiction area. Search data is not sent.

  As described above, the wireless data communication processing unit 32 performs the reception processing shown in FIG. The wireless data communication processing unit 32 of the access point device 3-m that has instructed to broadcast the unauthorized access point search data receives the unauthorized access point search data of the transmission source from the wireless LAN side from the adjacent access point device 3-j. When this occurs, the status of “regular” is stored in association with the BSSID (identification information of the adjacent access point device 3-j) related to the reception of the current search data in the adjacent access point table 35 (steps 102 and 103).

  The wireless data communication processing unit 32 of the access point device 3-m receives the unauthorized access point search data of the transmission source from the wireless LAN side within a predetermined time (for example, 3 minutes) from the time when the broadcast is instructed. It is also possible to store the status of “regular” only when it is possible, and even if the unauthorized access point search data is received over a predetermined time, the reception is regarded as “not received”. For example, even if the unauthorized access point device 4 receives the search data wirelessly transmitted by the adjacent access point device 3-j, and transmits the search data in a hurry, the reception may be regarded as “not received”. What is necessary is just to select predetermined time so that it can do.

  On the other hand, since the unauthorized access point device 4 does not transmit the unauthorized access point search data to the wireless LAN side, the adjacent access point table 35 in the access point device 3-m that is the transmission source of the unauthorized access point search data is A “normal” status is not stored in association with the BSSID (identification information) of the unauthorized access point device 4.

(A-2-3) Recognition of Unauthorized Access Point Device The unauthorized access point search unit 33 of the access point device 3-m that is the transmission source of the unauthorized access point search data is a predetermined time (for example, 5 minutes) from the transmission time point. When the time has elapsed, the process shown in FIG. 7 is started by interruption, and the BSSID (identification information) to which the “regular” status is not given is acquired from the adjacent access point table 35 (step 200). The BSSID (identification information) to which the status of “regular” is not given is the BSSID (identification information) of the unauthorized access point device 4, thereby detecting (recognizing) the presence of the unauthorized access point device 4. Can do.

  Although omitted in FIG. 7, when the unauthorized access point search unit 33 detects the presence of the unauthorized access point device 4, it notifies the host device, and the host device performs a predetermined protection operation, an abnormality notification operation, and the like. For example, the presence of an unauthorized access point device 4 is notified to a monitor by the sound of a buzzer, or the presence of an unauthorized access point device 4 is notified by automatic in-house broadcasting. At that time, the location information of the access point device 3-m that has detected the presence of the unauthorized access point device 4 may be broadcasted to teach the attention location.

(A-3) Effect of Embodiment According to the above-described embodiment, it is possible to detect an unauthorized access point device installed by a third party in the peripheral area of the company network 2. As a result, the administrator can take appropriate measures before data eavesdropping occurs.

(B) Other Embodiments In the above-described embodiment, the access point device 3-m performing the detection operation broadcasts the unauthorized access point search data. However, the identification information is included in the adjacent access point table 35. The access point device may be multicast from the stored adjacent access point device (in this case, it may be routed through the host device), and the adjacent access point device whose identification information is stored in the adjacent access point table 35 Alternatively, the search data may be transmitted individually from each one (in this case, the search data may be routed through a host device). In the latter case, the adjacent access point apparatus 3-j may be caused to execute a wireless transmission operation similar to that of a wireless LAN terminal that accommodates the adjacent access point apparatus 3-m.

  In the above embodiment, the access point device 3-m performing the detection operation transmits the unauthorized access point search data to the company network (wired LAN portion) 2 and monitors the wireless search data of the adjacent access point device. By doing so, the device that recognizes the normal adjacent access point device 3-j has been shown. However, the search data may be circulated through the reverse loop path to recognize the normal adjacent access point device 3-j. For example, the access point device 3-m performing the detection operation wirelessly transmits the unauthorized access point search data addressed to itself and receives the unauthorized access point search data transmitted wirelessly. By allowing j to feed back the unauthorized access point search data to the access point device 3-m via the company's network (wired LAN portion) 2 (in this case, it may be routed through the host device), the legitimate adjacent access point The device may be recognized.

  Further, in the above embodiment, all the access point devices have been shown to have an unauthorized access point device detection function, but some access point devices have an unauthorized access point device detection function. It may be. For example, an access point device installed at a position close to the outer wall of a building may have a detection function of an unauthorized access point device.

It is a functional block diagram which shows the software structure of the access point apparatus of embodiment. 1 is a block diagram showing a basic configuration of a corporate wireless LAN system. FIG. It is explanatory drawing of the beacon frame utilized in embodiment. It is a flowchart which shows the process at the time of reception of the wireless data communication process part of embodiment. It is a flowchart which shows the transmission operation | movement of the unauthorized access point search data by the unauthorized access point search part of embodiment. It is explanatory drawing which shows a mode that only the regular adjacent access point apparatus of embodiment transmits radio | wireless unauthorized access point search data. It is a flowchart which shows the recognition operation | movement of the regular adjacent access point apparatus of the unauthorized access point search part of embodiment.

Explanation of symbols

1-1 to 1-N: wireless LAN terminal, 2 ... own network (wired LAN), 3-1 to 3-M ... access point device, 31 ... wireless LAN driver, 32 ... wireless data communication processing unit, 33 ... illegal Access point search unit 34... Wired LAN driver 35... Adjacent access point table.

Claims (3)

In connection with a wireless LAN system in which a plurality of access point devices accommodating wireless LAN terminals are connected by a wired LAN, an unauthorized access point detection method for detecting an unauthorized access point device not connected to the wired LAN,
At least some of the access point devices include adjacent access point detection means, adjacent access point storage means, search data transmission means, and unauthorized access point identification means,
The adjacent access point detection means monitors the wireless space around the access point apparatus, obtains identification information of the adjacent access point apparatus and stores it in the adjacent access point storage means,
The search data transmission means passes the unauthorized access point search data through the wired LAN and the wireless line with the adjacent access point device stored in the adjacent access point storage means in this order or in reverse order. And sending back to the access point device, and storing the fact that the unauthorized access point search data is a legitimate device in the adjacent access point storage means for the access point device adjacent to the route returned,
The unauthorized access point specifying means recognizes, as an unauthorized access point apparatus, an access point apparatus in which identification information is stored in the adjacent access point storage means but is not stored as a legitimate apparatus. To detect unauthorized access points. In an access point device that accommodates a wireless LAN terminal and is connected to another access point device via a wired LAN,
Neighboring access point storage means capable of storing the identification information of the access point device adjacent to the access point device and the fact that it is a regular device;
An adjacent access point detection unit that monitors a wireless space around the access point device, obtains identification information of the adjacent access point device, and stores the identification information in the adjacent access point storage unit;
The unauthorized access point search data is transmitted to the access point device via the wired LAN and the wireless line with the adjacent access point device stored in the adjacent access point storage means in this order or in reverse order. Search data transmission means for transmitting information so as to return, and storing the fact that the adjacent access point storage means is a legitimate apparatus for the access point apparatus adjacent to the path on which the rogue access point search data has returned,
The adjacent access point storage means includes unauthorized access point specifying means for recognizing as an unauthorized access point apparatus an access point apparatus that stores identification information but is not stored as a legitimate apparatus. Access point device. In a wireless LAN system in which a plurality of access point devices accommodating wireless LAN terminals are connected by a wired LAN,
A wireless LAN system, wherein the access point device according to claim 2 is applied as at least some of the access point devices.

Images