KR101186874B1 - Method for operating intrusion protecting system for network system connected to wire and wireless integrated environment - Google Patents

Abstract

The present invention provides a method of operating a wireless intrusion detection system that can collect information in multiple layers in order to collect and control information in the wireless intrusion detection system of the wired and wireless integrated system. The present invention implements a wireless intrusion detection system of a wired / wireless integrated system, which corresponds to a plurality of first APs, and senses data transmitted between a wireless terminal connected to the plurality of first APs wirelessly and the first AP. A plurality of first sensors for; A first manager for checking whether the data packet provided by the first sensor is malicious or controlling the first sensor; A plurality of second sensors corresponding to a plurality of second APs, for sensing data transferred between a wireless terminal wirelessly connected to the plurality of second APs and the second AP; A second manager for checking whether or not the data packet provided by the second sensor is malicious and controlling the second sensor; And an integrated manager for controlling the first and second managers, the first sensor and the second sensor to perform sensor control, manager control, terminal blocking information, log storage, and integrated control. Provide a wireless intrusion detection system.

Description

METHOOD FOR OPERATING INTRUSION PROTECTING SYSTEM FOR NETWORK SYSTEM CONNECTED TO WIRE AND WIRELESS INTEGRATED ENVIRONMENT}

The present invention relates to a method of operating a wireless intrusion detection system of a wired / wireless integrated system, and more particularly, to a method of operating a wireless intrusion detection system of a wired / wireless integrated system by collecting information in multiple layers.

Since it is impossible to access the wired Internet from an outdoor or mobile terminal, there is a growing interest in wireless Internet, which can use the Internet even outdoors or on the move. The wireless Internet is largely classified into a fixed type and a mobile type. The fixed wireless Internet is developed based on a wireless LAN, and can be used at stationary terminals within a radius of about 100 meters around an access point (AP) and cannot be used while moving. It is mainly used in large offices.

In addition, the mobile wireless Internet includes a WAP (or ME) method and a portable Internet method recently commercialized. Since WAP is based on a mobile communication network, there is an advantage that it can be used even during high-speed movement, but there is a disadvantage that it is not suitable for transmitting and receiving large data due to low transmission speed. On the other hand, the portable Internet has been developed with a focus on high-speed data transmission, and supports a transmission speed of 1Mbps or more on the go, and thus has the advantage that a user can use the Internet at a level similar to the wired Internet. In order to use the portable Internet in a portable terminal such as a laptop or a PDA, a wireless modem for wireless communication with a base station or an access point (AP) of a wireless network should be installed in a USB port.

Recently, a wired / wireless integrated networking system in which wireless and wires are integrated has been developed. However, when wireless and wired are combined, detecting and filtering hacking signals is becoming more difficult than ever. Even if the access is blocked by determining that the hacking is an IP address in the wired network, when accessing again by wireless, it is difficult to detect an intrusion of the hacking signal, thereby allowing access.

The present invention provides a method of operating a wireless intrusion detection system that can collect information in multiple layers in order to collect and control information in the wireless intrusion detection system of the wired and wireless integrated system.

The present invention implements a wireless intrusion detection system of a wired / wireless integrated system, and corresponds to a plurality of first APs, and includes a plurality of sensors for sensing data transmitted between a wireless terminal connected to the plurality of first APs wirelessly and the first AP. A first sensor; A first manager for inspecting whether or not the data packet provided by the first sensor is malicious and controlling the first sensor; A plurality of second sensors corresponding to a plurality of second APs, and configured to sense data transferred between a wireless terminal wirelessly connected to the plurality of second APs and the second AP; A second manager for checking whether or not the data packet provided by the second sensor is malicious and controlling the second sensor; And an integrated manager for controlling the first and second managers and the first and second sensors to perform sensor control, manager control, terminal blocking information, log storage, and integrated control. Provides wireless intrusion detection system of wired and wireless integrated system.

The first manager and the second manager may transmit information to the integrated manager when a predetermined event occurs during the control operation of the sensor.

In addition, the first sensor is characterized in that less than or equal to the number of the first AP.

The integrated manager may control the plurality of first and second sensors, respectively, through the first and second managers.

The integrated manager may communicate with the first and second managers by wire or wirelessly, and integrate and manage information transmitted by wire or wirelessly.

The first and second managers store sensor control, terminal blocking information and logs, and store user authentication processing and user related information of the wireless terminal.

In operating the wireless intrusion detection system of the wired / wireless integrated system according to the present invention, since information is collected and controlled in multiple layers, the efficiency of collecting and controlling information in the wired / wireless integrated system can be improved.

1 is a block diagram of a wireless intrusion detection system of a wired / wireless integrated system with a view presented to explain the present invention.
Figure 2 is a block diagram of a wireless intrusion detection system of the wired and wireless integrated system according to an embodiment of the present invention.

DETAILED DESCRIPTION Hereinafter, exemplary embodiments of the present invention will be described with reference to the accompanying drawings so that those skilled in the art may easily implement the technical idea of the present invention. do.

With the recent development of integrated networking that combines wired and wireless networks, illegal intrusions can be made easier than ever, even if a system for protecting various information is installed. In such a case, the system controlling the network may pass by not knowing the fact of illegal invasion unless a system abnormality that can be judged from the user's point of view may occur, and thus, damage may occur.

As a countermeasure against illegal intrusion into the wired / wireless network using malicious packets, an expensive intrusion prevention system (Firewall) was introduced to the institutional system to allow only users access to the institutional network and prevent access from the outside.

However, the efficiency of work may be deteriorated due to insufficient consideration of the case where a business manager wants to access the company's work system from the outside. Also, even if a thorough firewall is used in the conventional network, the intrusion of hackers cannot be blocked at the source, so the solution after illegal intrusion is weak.

The present invention relates to a security system for network protection, and more particularly, to a wireless intrusion prevention system (WIDS) and an intrusion detection system (IDS). Intrusion prevention systems and intrusion detection systems are a preventive approach among network security technologies that monitor network traffic, recognize potential threats, and respond immediately. Normally, once an attacker has gained internal privileges, the malicious use of the system can proceed very quickly. The security system examines a packet and if it is determined that it is an invalid packet, blocks all incoming traffic from the IP address or port, and forwards the legitimate traffic to the receiver without any interruption or service delay.

Wireless intrusion detection system or intrusion detection system is installed in the system that controls the network. The wireless intrusion detection system or intrusion detection system includes a sensor and a management block. The sensor senses data transmitted through the AP wirelessly and delivers it to the managing block. The management block analyzes the data packets provided by the sensor to analyze for potential threats. If the analysis determines that there is a potential threat, it blocks all incoming traffic from that IP address or port.

1 is a block diagram illustrating a wireless intrusion detection system of a wired / wireless integrated system.

Referring to FIG. 1, the wireless intrusion detection system of the wired / wireless integrated system includes a plurality of sensors 12 and a manager 13. A plurality of sensors 12 may be provided, and the number of the sensors 12 may be determined according to regional characteristics in which wired and wireless networks are arranged. In addition, the region where the sensor 12 is disposed may also vary according to the regional characteristics of the wired / wireless network.

The sensor 12 senses a data packet transmitted from the wireless terminal 10 to the AP 11. The manager 13 checks whether the data packet provided through the sensor 12 is malicious or not, and controls whether or not to allow the wireless terminal 10 to continue to be connected to the wired or wireless network according to the result.

As shown in FIG. 1, each grouping sensor is controlled by each manager according to a zone in which a network is installed.

Therefore, if the wireless intrusion detection system is installed in three zones, as in the case of Figure 1, three managers are arranged, three users 14 to manage it, or must control each manager.

2 is a block diagram illustrating a wireless intrusion detection system of a wired / wireless integrated system according to an embodiment of the present invention. In particular, the wireless intrusion detection system of the wired / wireless integrated system according to the present embodiment shown in FIG. 2 distinguishes the integrated manager and the manager.

Referring to FIG. 2, the wireless intrusion detection system of the wired / wireless integrated system according to the present embodiment includes a sensor 300, a manager 400, and an integrated manager 500.

The sensor 300 senses a data packet transmitted from the wireless terminal 100 to the AP 200. The manager 400 checks whether the data packet provided through the sensor 300 is malicious or not, and controls whether the wireless terminal 100 is continuously connected to the wired or wireless network according to the result.

In the wireless intrusion detection system of the wired / wireless integrated system described in FIG. 1, an administrator has to have a manager, that is, a processing unit, and perform confirmation on each installed zone and site. To control each manager, all manager related programs must be activated and controlled.

However, the wireless intrusion detection system of the wired / wireless integrated system according to the present embodiment is designed to control each of the managers collectively in the integrated manager.

The integrated manager 500 controls the sensor, the manager, and stores the terminal blocking information and the log. This is the function to integrate and control the whole system. Therefore, the integrated manager 500 may control the manager 400 and all the sensors underneath with one program. In addition, communication sections between managers use encrypted communication.

The manager 400 may perform tasks such as sensor control, terminal blocking information, and log storage. The manager 400 controls general situations that occur when each terminal is connected. For example, the user's authentication information processing, information related to the user, and the like are performed.

In addition, when a significant event occurs in the process of controlling the sensors controlled by the manager 400, the manager 400 summarizes the event and transmits it to the integrated manager 500. For example, when a situation in which a malicious packet is invaded occurs, it is summarized and transmitted to the integration manager 500.

The integrated manager 500 receives the summary information provided from each manager 400 to control the entire manager and the sensor. In addition, each manager 400 does not transmit to the integrated manager 500, each time the integration manager 500 is required can be provided by requesting the necessary information from each manager 400.

Although FIG. 2 illustrates the implementation of the wireless intrusion detection system of the wired / wireless integrated system in two stages, the system may be implemented in more stages as needed.

The integrated manager 500 stores information received from the plurality of managers 400 and logs according to system operation. Therefore, the work manager 600 accesses the integrated manager 500 and checks the information stored in the integrated manager 500 so that all the information about the manager 400 and the sensor 300 managed by the integrated manager 500 can be changed. You can check it at once.

That is, the work manager 600 may access only the integrated manager 500 to check important information about the manager 400 and the sensor 300, and may control each manager 400 and each sensor 300 in detail. can do.

In this case, the control of each sensor 300 in the integrated manager 500 is controlled through the manager 400 managing the sensor 300. That is, the work manager 600 performs the work in the integrated manager 500, but does not directly control the sensor 300, but the sensor 300 control command to the manager 400 that manages the sensor 300. When sent, the manager 400 controls the sensor 300.

The sensor 300 may transmit information to the manager 400 by wire or wirelessly, and may also transmit information between the manager 400 and the integrated manager 500 by wire or wirelessly. That is, even when a plurality of managers 400 transmit information by wire or wirelessly, the integrated manager 500 does not divide and manage the information received through the wire and the information received through the wire, but integrates and manages the information. . Therefore, the task manager 600 can check and manage the information transmitted by wired or wireless through the integrated manager 500 at a time.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is clearly understood that the same is by way of illustration and example only and is not to be taken by way of limitation, I will understand. Therefore, the scope of the present invention should not be limited to the described embodiments, but should be determined by the scope of the appended claims, as well as the appended claims.

100: wireless terminal 200: AP
300: sensor 400: manager
500: Integrated Manager 600: Task Manager

Claims (6)

In implementing the wireless intrusion detection system of the wired and wireless integrated system,
A plurality of first sensors corresponding to a plurality of first APs, and configured to sense data transferred between a wireless terminal wirelessly connected to the plurality of first APs and the first AP;
A first manager for inspecting whether or not the data packet provided by the first sensor is malicious and controlling the first sensor;
A plurality of second sensors corresponding to a plurality of second APs, and configured to sense data transferred between a wireless terminal wirelessly connected to the plurality of second APs and the second AP;
A second manager for checking whether or not the data packet provided by the second sensor is malicious and controlling the second sensor; And
An integrated manager for storing the terminal blocking information and logs transmitted from the first and second managers, and controlling the first and second managers, the first sensor, and the second sensor to perform integrated control; ,
And the first manager and the second manager transmit the information to the integrated manager when a predetermined event occurs during the control operation of the sensor. delete The method according to claim 1,
The first sensor is a wireless intrusion detection system of the wired / wireless integrated system, characterized in that less than or equal to the number of the first AP. The method according to claim 1,
The integrated manager is a wireless intrusion detection system of the wired / wireless integrated system, characterized in that for controlling the plurality of first and second sensors through the first and second managers, respectively. The method according to claim 1,
The integrated manager communicates with the first and second managers in a wired or wireless manner, and integrates and manages information transmitted in a wired or wireless manner. The method according to claim 1,
The first and second managers store sensor control, terminal blocking information and logs, and store user authentication processing and user related information of the wireless terminal.

Images