KR101564002B1 - Detection Apparatus for Infringement of Illegal Mobile device - Google Patents

Abstract

An illegal mobile device discriminating apparatus for detecting an illegal mobile device entering into an internal network formed of wired and / or wireless, comprising: a wire scanning unit scanning devices connected to a wired network; and a wireless scanning result wirelessly scanning the wire and wireless router and devices connected to the wired and / And a discriminating unit for comparing illegal mobile equipment by comparing the wire scanning results of the wire scanning unit.

Description

TECHNICAL FIELD [0001] The present invention relates to an illegal mobile device discrimination device,

The present invention relates to an identification device for an illegal mobile device.

It is necessary to detect when a router or a wireless router intrudes into the company's internal network.

Although an in-house network security system has been disclosed in Korean Patent Publication No. 2002-0041004A, it is difficult to apply the system when a router or a wireless router intrudes. This is because, in the case of a router, there is a possibility of leaking confidential data of the company by connecting directly with the external network without going through the authentication system.

On the other hand, devices called WIPS perform operations that detect illegal or fake APs, but these devices are expensive and difficult to introduce.

According to one or more embodiments of the present invention, an illegal mobile device discriminator capable of discriminating a mobile device that illegally entered an internal network is provided.

According to one or more embodiments of the present invention, there is provided an apparatus for identifying an illegal mobile device that has penetrated into an internal network formed of a wired and / or wireless network, the apparatus comprising: a wired scanning unit for scanning devices connected to a wired network; And a discriminator for discriminating an illegal mobile device by comparing wireless scanning results obtained by scanning the wireless router and devices connected to the wireless router with wire scanning results of the wire scanning unit, Device is provided.

An illegal mobile device discriminating apparatus according to an embodiment of the present invention includes a wireless scanning unit for wirelessly scanning a wireless router and devices connected to the wireless router; And the determination unit may compare the wireless scanning result of the wireless scanning unit with the wire scanning result to identify the illegal mobile equipment.

The wireless scanning unit may be to collect a wireless MAC address from at least one ARP frame received wirelessly and a wired MAC address of devices connected to the device having the wireless MAC address.

The wired scanning unit may collect wired MAC addresses of devices wired to the internal network.

Wherein the determination unit excludes, from the wireless scanning result, a wireless MAC address that is not associated with at least one wired MAC address scanned as a result of the wired scanning, and that, in the wireless scanning result, To identify a device having an illegally connected wireless MAC address.

The wired MAC address collected by the wireless scanning unit may be directly connected to the device having the wireless MAC address.

According to one or more embodiments of the present invention, it is possible to identify a mobile device that has entered an internal network illegally.

1 is a view for explaining an illegal mobile device discriminating apparatus S according to an embodiment of the present invention,
2 is a diagram for explaining an illegal mobile method according to an embodiment of the present invention,
FIG. 3 is a view for explaining the embodiment of FIGS. 1 and 2,
FIG. 4 is a functional block diagram of an illegal mobile device discriminating apparatus S according to an embodiment of the present invention, and FIG.
5 is a diagram for explaining a computer system in which an illegal mobile device according to an embodiment of the present invention is implemented.

BRIEF DESCRIPTION OF THE DRAWINGS The above and other objects, features, and advantages of the present invention will become more readily apparent from the following description of preferred embodiments with reference to the accompanying drawings. However, the present invention is not limited to the embodiments described herein but may be embodied in other forms. Rather, the embodiments disclosed herein are provided so that the disclosure can be thorough and complete, and will fully convey the scope of the invention to those skilled in the art. In this specification, when an element is referred to as being on another element, it may be directly formed on another element, or a third element may be interposed therebetween.

The terminology used herein is for the purpose of illustrating embodiments and is not intended to be limiting of the present invention. In the present specification, the singular form includes plural forms unless otherwise specified in the specification. The terms "comprises" and / or "comprising" used in the specification do not exclude the presence or addition of one or more other elements.

Hereinafter, the present invention will be described in detail with reference to the drawings. In describing the specific embodiments below, various specific details have been set forth in order to explain the invention in greater detail and to assist in understanding it. However, it will be appreciated by those skilled in the art that the present invention may be understood by those skilled in the art without departing from such specific details. In some instances, it should be noted that portions of the invention that are not commonly known in the description of the invention and are not significantly related to the invention do not describe confusing reasons for explaining the present invention.

Definition of Terms

In this specification, the term 'wireless MAC address' refers to a MAC address of a device that transmits / receives data wirelessly, and 'wired MAC address' refers to a MAC address of a device that transmits / receives data by wire.

FIG. 1 is a view for explaining an illegal mobile device discriminating apparatus S according to an embodiment of the present invention, and FIG. 3 is a view for explaining the embodiments of FIG. 1 and FIG.

Hereinafter, an illegal mobile device discriminating apparatus S according to an embodiment of the present invention will be described with reference to FIGS. 1 and 3

For the purpose of the description of the present invention, in the embodiment of FIG. 1, the internal network N1 is composed of a wired and a wireless network, and an illegal mobile device , An illegal mobile device discriminating device S (hereinafter referred to as a discriminating device S) will be described.

The discriminating device S performs an operation of scanning by wireless and an operation of scanning by wire. The operation of scanning wirelessly may be performed first or the operation of scanning by wire may be performed first.

In FIG. 1, the discrimination device S is shown as being located at two points in a dotted line, and this discrimination device S can be physically implemented as one device or two devices physically. When the determination device S is physically implemented as a single device, the wireless scanning operation may be performed first, followed by the wired scanning operation, or the wireless scanning operation may be performed after the wired scanning operation.

In the case where the determination device S is physically implemented as two devices, the determination device S that performs the wireless scanning operation and the determination device S that performs the wire scanning operation are provided separately, It is possible to configure the discriminating device S to provide the result of the scanning by itself to the other discriminating device S or provide the result to the other discriminating device S.

In another case where the determination device S is physically implemented as two devices, the determination device S that performs the wireless scanning operation and the determination device S that performs the wire scanning operation are provided separately, The server S transmits its own scanning result to the server (not shown), and the server which receives the scanning result from both the discriminating device S discriminates which device is an illegal mobile device.

Wireless scanning operation

First, an operation in which the discriminating device S scans wirelessly will be described.

An operation of scanning wirelessly (hereinafter, referred to as a 'wireless scanning operation') is an operation of analyzing signals received wirelessly to identify devices connected to a wireless router and a wireless router. For example, the wireless scanning operation collects ARP requests and signals from beacons received around (these signals are signals originating from devices commonly called wireless access points (APs)) and sends them to wireless routers and wireless routers You can find connected devices.

Specifically, the determination device S can acquire the MAC address for surrounding wireless routers by collecting the beacons for reception in the vicinity. In addition, by collecting ARP requests, the MAC address of devices directly connected to the router can be found.

The result of wireless scanning by the discriminating device S in the environment shown in Fig. 1 is shown in Fig. Referring to FIG. 3, the distinguishing device S includes a first group (A ', A, F, G, and B), a second group (D', D, C, J, K) P ', P, Q, R, W).

G, B, H, I, and D are the wireless MAC addresses of the wireless routers A ', D', and P ' , J, K, C, P, Q, R, and W are connected to the devices 11, 13, 15, 17, 19, 20, 21, 23, 25, 30, 31, 33, Indicates the MAC address.

On the other hand, the discriminating device S distinguishes which wired devices are directly connected to the wireless router when wireless scanning is performed. 3, the first group includes a wireless MAC address A 'of the first wireless router 10, a wired MAC address A of the first router, And the wired MAC addresses (F, G, B) of the devices directly connected to the network.

In a similar manner, the second group includes a wireless MAC address D 'of the second router 22, a wired MAC address D of the second router 22, and a second router connected directly to the second router 22 The third group consists of the wireless MAC address P 'of the third router 30, the wired MAC address of the third router 30, P, and wired MAC addresses (Q, R, W) of devices directly connected to the third router (30).

The result of the wireless scanning performed by the discriminator S collects not only the internal network N1 but also the signals from the surrounding external network N2 as shown in FIG. .

The reason why the determination device S performs wireless scanning and groups and manages wireless MAC addresses is to refer to wired scanning results to be described later to identify illegal mobile devices.

 On the other hand, how the determining device S finds the wired MAC address of the devices directly connected to the router will be described as an example.

The discrimination device S collects signals called ARP frames, which are signals broadcast from wired or wireless devices constituting the internal network N1 and the external network N2. The discriminator S analyzes signals called ARP frames to know which wired device is directly connected to any wired / wireless router. That is, if the SSID included in the ARP frame is found, it is possible to know what type of wired / wireless router the wired / wireless router is.

Wired scanning operation

Now, the operation of the discriminating device S scanning by wire will be described.

The wired scanning operation (hereinafter referred to as a 'wired scanning operation') is an operation of analyzing signals received through a wired line to find devices connected to each other in a wired manner in the internal network N1. For example, in the wired scanning operation, the determination device S directly connects to the internal network N1 to collect wired MAC addresses of wired devices as shown in FIG.

Referring again to FIG. 3, the portion labeled 'wired group' shows the wired MAC addresses collected by the determination device S by wire. As a result of wire scanning in the embodiment of FIG. 1, the wire group can be A, F, G, B, D, C, J, K, H,

Since the wired MAC addresses P, Q, R and W included in the external network N2 are not connected to the internal network N1 by wire, they are naturally included in the result of wire scanning by the discrimination device S It is not.

Illegal mobile device discrimination behavior

Referring to FIG. 3, an operation of the second wireless router (20), which is an illegal mobile device that the discrimination device (S) has penetrated into the internal network, will be described.

The discriminating device S can discriminate an illegal mobile device by referring to both the wireless scanning result and the wire scanning result. The act of discriminating an illegal mobile device includes: i) excluding a group to an external network and ii) selecting an illegal mobile device in comparison with a registered group list.

The operation of excluding a group to an external network will be described first.

For example, the discriminator S selects groups that do not have a wired MAC address belonging to the wired group in the wirelessly scanned groups. That is, the wired MAC addresses belonging to the wired group are A, F, G, B, D, C, J, K, H and I. The wireless scanning group which does not include any wired MAC address is the third group. The third group consists of P ', P, Q, R and W and does not have any of A, F, G, B, D, C, J, K, Therefore, the distinguishing device S judges that the third group is the external network, and excludes it from the judgment object.

 Now, an operation of selecting an illegal mobile device in comparison with the registered group list will be described. Here, the registered group list means a MAC address list for wireless devices that have been properly authorized to use. The registration group list may be stored in advance by the distinguishing device S performing 'an operation of selecting an illegal mobile device', or may be received from an external (server).

The discrimination device S can find out which device has an unregistered wireless MAC address by comparing the registered group list and the first group and the second group. In the case of the second wired / wireless router 20, it is not included in the registration group list since it is a device which is not properly authorized to use. Therefore, the discriminator S can know that the device having the wireless MAC address D 'in the second group is illegal.

By performing the above two operations, the distinguishing device S discriminates the illegal mobile device.

As another example, the determination apparatus S may be configured to perform the steps of i) excluding the group to the external network described above, and ii) selecting ii) an illegal mobile device in comparison with the registered group list, ii) ) Operation, it is possible to identify an illegal mobile device. This is because the registered group list of the internal network N1 does not include the wireless router 30 belonging to the external network and i) does not perform the operation and ii) performs the operation also discriminates the illegal mobile device .

FIG. 2 is a diagram for explaining a method for identifying an illegal mobile device according to an embodiment of the present invention.

Referring to FIG. 2, a method for discriminating an illegal mobile device according to an embodiment of the present invention includes a step S101 of performing wireless scanning by the discrimination device S, and a step S103 of performing wire scanning , And discriminating illegal mobile devices connected to the internal network (N1) by referring to the wireless scanning result and the wire scanning result (S105).

Here, the wireless scanning step (S101) and the wired scanning step (S103) may be performed simultaneously or either of them may be performed first.

 The apparatus performing the wireless scanning step S101 and the apparatus performing the wire scanning step S103 may be physically identical to each other or may be separate apparatuses. If the apparatus is a separate apparatus, the apparatus provides the result of scanning from one side to the other, and the apparatus provided with the result of the scanning performs step S105 of discriminating illegal mobile apparatuses connected to the internal network.

On the other hand, the apparatus for performing the step S105 of discriminating may be any one of the apparatus performing the wireless scanning step S101 and the apparatus performing the wire scanning step S103, Server). In the case of performing the step S105 in which the server discriminates, the apparatus performing the wireless scanning step S101 and the apparatus performing the wire scanning step S103 respectively transmit the result of the scanning to the server .

The step of performing wireless scanning (S101) comprises collecting a wireless MAC address from at least one ARP frame received wirelessly and a wired MAC address of devices connected to the device having this wireless MAC address.

The meaning of the wireless scanning and wired scanning in FIG. 2 has already been described with reference to FIG. 1, and thus will not be described here.

4 is a functional block diagram of an illegal mobile device discriminating apparatus S according to an embodiment of the present invention.

4, an illegal mobile device discriminating apparatus 100 according to an embodiment of the present invention may include a radio scanning unit 102, a wire scanning unit 104, and an illegal device selecting unit 106 have. Here, the wireless scanning unit 102, the wire scanning unit 104, and the illegal device selection unit 106 may be implemented by hardware and / or software.

The illegal mobile device discriminating apparatus 100 may correspond to the discriminating apparatus S in FIG. 1 and may be implemented in the form of devices such as a notebook, a smart phone, a PDA, a tablet PC, and the like.

The wireless scanning unit 102 performs the wireless scanning operation described with reference to FIGS. 1 and 3, and the wire scanning unit 104 performs the wire scanning operation described with reference to FIGS. 1 and 3. FIG.

The illegal device selection unit 106 performs the illegal mobile device discrimination operation described with reference to Figs.

Referring to FIGS. 1 and 3, an illegal mobile device discriminating apparatus 100 will be described. In the illegal mobile apparatus discriminating apparatus 100, at a position capable of receiving all the radio signals propagated in the internal network N1 And performs a wireless scanning operation. Then, the illegal mobile device discriminating apparatus 100 connects to the internal network N1 by wire to collect wired MAC addresses of devices connected to the internal network N1 by wire.

5 is a diagram for explaining a computer system in which an illegal mobile device according to an embodiment of the present invention is implemented.

5, a computer system embodying an illegal mobile device according to an embodiment of the present invention may include program logic 101, a computer processor 103, a storage unit 105, and a memory 107 have.

The program logic 101 may be implemented in the form of a code executable by a computer and may be stored in the storage unit 105 and loaded into the memory 107 under the control of the computer processor 103 .

For example, the program logic 101 includes a code for performing operations of the radio scan unit 102, the wire scan unit 104, and the illegal device selection unit 106 described with reference to FIG. 4 can do. Here, the code for performing the operation of the wireless scanning unit 102, the code for performing the operation of the wire scanning unit 104, and the code for performing the operation of the illegal device selection unit 106 are shown in FIGS. 1 and 3 A wire scanning operation, and an illegal device sorting operation described with reference to FIG.

Alternatively, at least one of the wireless scanning unit 102, the wire scanning unit 104, and the illegal device selection unit 106 may be implemented as hardware.

In the embodiments described above, the components implemented with the code of the program executable by the computer may be implemented as hardware logic. In the case of hardware logic, it may be embedded in the computer processor 103 or may be implemented in hardware separate from the computer processor 103.

While the present invention has been described with reference to the particular embodiments and drawings, it is to be understood that the invention is not limited to the disclosed embodiments, but, on the contrary, is intended to cover various modifications and equivalent arrangements included within the spirit and scope of the appended claims. This is possible. Therefore, the scope of the present invention should not be limited to the described embodiments, but should be determined by the equivalents of the claims, as well as the claims.

10: first wireless router 20: second wireless router
30: Third wireless router
11, 13, 15, 17, 19, 20, 21, 23, 25, 30, 31, 33, 35:
101: program logic 103: processor
105: storage unit 107: memory
102: wireless scanning unit 104: wire scanning unit
106: illegal device selection unit

Claims (6)

An illegal mobile device discrimination apparatus which has entered an internal network made up of wired and wireless,
A wired scanning unit for scanning devices connected to a wired network;
A wireless scanning unit for wirelessly scanning the wireless router and the devices connected to the router; And
A discriminator for comparing the result of the wireless scanning by the wireless scanning unit and the result of the wire scanning of the wire scanning unit to discriminate the illegal mobile equipment; And it includes a
The wireless scanning unit includes:
Collecting a wireless MAC address and at least one wired MAC address of devices connected to the device having the wireless MAC address from at least one ARP frame received wirelessly,
The collected wired MAC address is directly connected to the device having the wireless MAC address,
Wherein the determination unit compares the wireless scanning result of the wireless scanning unit with the wire scanning result of the wire scanning unit to identify the illegal mobile equipment, and in the wireless scanning result, the determination unit is connected to at least one wired MAC address scanned as a result of the wire scanning And a device having an illegally connected wireless MAC address is discriminated by referring to a list of devices having a wireless MAC address properly registered in advance in the wireless scanning result, A mobile device discrimination device. delete delete The method according to claim 1,
The wired-
And collects wired MAC addresses of devices connected to the internal network by wire. delete delete

Images