WO2013089396A1

WO2013089396A1 - Method for preventing intrusion in real time in wired and wireless integration system

Info

Publication number: WO2013089396A1
Application number: PCT/KR2012/010685
Authority: WO
Inventors: 류동주
Original assignee: 주식회사 코닉글로리
Priority date: 2011-12-16
Filing date: 2012-12-10
Publication date: 2013-06-20
Also published as: KR101186876B1

Abstract

The present invention provides a method for preventing intrusion in real time in a wired and wireless integration system, which can protect against malicious packets accessing through a wired network or a wireless network. To this end, the present invention provides the method for preventing intrusion in real time in a wired and wireless integration system, comprising the steps of: allowing a control unit used to control a network to confirm and store IP and MAC information of a wired user permitted to access the network; allowing the control unit to store wireless MAC information with which access is permitted; allowing the control unit to store USIM information or PKI information of a terminal permitted to access the network; and allowing the control unit to determine whether the terminal which has requested access to the network is authenticated by confirming all of the MAC information of the wired user, the wireless MAC information, and the PKI or USIM information of the terminal.

Description

Real-time intrusion prevention method in wired / wireless integrated system

The present invention relates to a real-time intrusion blocking method in a wired / wireless integrated system, and more particularly, to a real-time intrusion blocking method in a wired / wireless integrated system using MAC information.

In general, all OS systems and related applications have security vulnerabilities due to the nature of the program development process. In addition, the Internet-based network has been widely spread, and the number of system breaches through the network is increasing. In addition, in recent years, the invasion through the wireless network has been frequent due to the development of the wireless Internet.

A wireless LAN system for wireless Internet communication includes a wireless LAN access point (AP) and a wireless LAN terminal. An access point (AP) installs and uses equipment called an access point apparatus. Currently, the access point device mainly used does not filter hacking information that is invaded wirelessly because it provides only a transmission and network support function for wireless traffic. The WLAN terminal functions to receive information provided from the AP and provide it to the next stage.

The WLAN system follows the WLAN security standard proposed by IEEE 802.11i, and performs authentication and encryption only for the AP and the WLAN terminal in the WLAN system. Accordingly, a user terminal denied access in a wireless network may be accessed in a wired LAN, or vice versa, a user terminal denied access in a wired network may be accessed in a wired network.

The present invention provides a real-time intrusion prevention method in a wired or wireless integrated system that can protect against malicious packets accessed through a wired or wireless network.

The present invention includes a step of registering and storing a wired IP address and a wired MAC address of a terminal by a controller for controlling a network; Checking and registering the wireless MAC address of the terminal by the controller; Registering and storing, by the controller, USIM information or PKI information of the terminal; And determining, by the controller, whether the terminal requesting access to the network is authenticated by determining all the wired MAC information, the wireless MAC information, and the USIM information or the PKI information to determine a network connection. It provides a real-time intrusion prevention method.

The control unit may include a wireless intrusion detection system or an intrusion detection system for detecting hacking information that an unregistered terminal invades a network wirelessly, and stores the wireless MAC information in the wireless intrusion detection system or an intrusion detection system. Characterized in that.

The controller may automatically detect whether the downloaded file is a malicious file when the terminal to which the access is allowed accesses the external web wirelessly and downloads the selected file.

The control unit may block access to the downloaded file without notifying the user of the terminal when the downloaded file is a malicious file when the terminal is allowed to access the external web wirelessly. do.

According to the present invention, since it is possible to protect against malicious packets that are accessed through a wired or wireless network, it is possible to expect an improved reliability related to security in a wired / wireless integrated networking system.

1 is a block diagram illustrating a WLAN intrusion prevention system for explaining the present invention.

2 is a block diagram for referring to a description related to MAC.

DETAILED DESCRIPTION Hereinafter, the most preferred embodiments of the present invention will be described with reference to the accompanying drawings so that those skilled in the art may easily implement the technical idea of the present invention. do.

1 is a view illustrating a real-time intrusion blocking method in the wired / wireless integrated system of the present invention, and is a configuration diagram of a system for preventing hacking signals from invading the wired / wireless networking system.

As illustrated in FIG. 1, a system for preventing a hacking signal from invading a wired / wireless networking system according to the present embodiment includes a WLAN device 110, an access point (AP) 111, a sensor 130, and a sensor management manager. 200.

The WLAN device 110 and the access point 111 are essential components for establishing a wireless network.

The WLAN device 110 configures a wireless network and exchanges data with another WLAN device 110 through a wireless network. The WLAN device 110 may encrypt and transmit data.

The wireless LAN device 110 includes a wired / wireless IP router, a wireless LAN card, a wireless printer, an antenna, a wireless network camera, and the like.

The access point 111 is disposed between the wireless LAN device 110 and a server (not shown) to transfer data provided from the wireless LAN device 110 to the server or wirelessly transmit a signal provided from the server to the wireless LAN device 110. To pass).

The sensor 130 monitors and controls the WLAN device 110. The sensor 130 detects a packet transmitted by the WLAN device 110 or the access point 111, and controls the WLAN device 110 or the access point 111 under the control of the sensor manager 200.

The sensor management manager 200 monitors and controls the wireless LAN device 110 or the access point 111 through the sensor 130. In this case, the sensor management manager 200 may be connected through a communication network and may be controlled by a user.

Various techniques for attacking wireless networks have been found. Cyber attack techniques are being diversified by malicious users, and the development of hacking techniques has led to the public and dissemination of automated and intelligent hacking tools. In particular, network vulnerabilities are continuously increasing, and denial-of-service attacks (DDoS) that can paralyze network services by fatal attacks such as worm viruses are increasing. Similarly, they can be classified as passive, active, and rogue AP attacks.

end. Passive Attack

The purpose of the passive attack is to obtain the access point device MAC, SSID, channel, manufacturer, WEP settings, and installation location information. There are three types of programs: a sniffer method for capturing packets, a stumbler method for querying information, and a passive monitor that collects all network packets because no packets are sent and does not belong to any network. have. Typical sniffer programs include airopeek, ethereal, and tcpdump, stumbler programs are netstumbler, and passive monitor programs are kismet.

I. Rogue AP attack

Rogue AP refers to an unauthorized AP installed in a wired network or an AP deliberately installed by an attacker for the convenience of a user. This is a significant threat, and rogue APs must be removed because they can break into internal wired networks without going through the company's security policy. If ad-hoc network is formed by connecting AP without careless security, it may be more dangerous and cause network bandwidth wasted by unauthorized person.

All. Active attack

The purpose of active attacks is more aggressive, such as denial of service, than information gathering. Attack techniques include spoofing, DoS, and MITM. In each case, spoofing attacks are used to pass authentication by tampering with MAC / IP / Frame.

It is also used for denial attacks. DoS attacks include deauth flooding, which repeatedly transmits forged disassociation / deauthentication frames, and jamming techniques that use noise from devices of similar frequency bands. The disassociation technique is also used as a technique for rogue AP isolation. Man-in-the-middle and session hijack attacks are a technique of intercepting sessions by releasing existing connections and inducing them to the attacker's AP or spoofing macs.

As described above, in order to protect attacks of wireless devices on various wireless networks, the establishment of a system for preventing hacking signals from invading wired / wireless networking systems becomes increasingly important.

2 is a block diagram for explaining the MAC.

2 shows a protocol layer model defined in a wireless mobile communication system based on the IEEE 802.16 system.

Referring to FIG. 2, a medium access control (MAC) information layer belonging to a link layer may be composed of three sublayers. First, the Service-Specific Convergence Sublayer (Service-Specific CS) uses MAC SDU (CPS: Common Part Sublayer) of data from an external network received through a CS SAP (Service Access Point). Can be transformed or mapped into Service Data Units. This layer may include a function of classifying SDUs of an external network and then associating a corresponding MAC Service Flow IDentifier (SFID) with a Connection IDentifier (CID).

Next, MAC CPS is a layer that provides the core functions of MAC such as system access, bandwidth allocation, connection establishment and management, and receives data classified by specific MAC connection from various CSs through MAC SAP. . In this case, quality of service (QoS) may be applied to data transmission and scheduling through the physical layer. In addition, the security sublayer may provide authentication, security key exchange, and encryption functions. The MAC layer is a connection-oriented service and is implemented in the concept of transport connection. When a terminal is registered in the system, a service flow may be defined by negotiation between the terminal and the system. If the service request changes, a new connection can be established. Here, the transport connection defines the mapping between peer convergence processes using the MAC and service flow, and the service flow defines the QoS parameters of the MAC PDUs exchanged in that connection. Service flow on the transport connection plays a key role in the operation of the MAC protocol, and provides a mechanism for QoS management of uplink and downlink. In particular, service flows may be combined with a bandwidth allocation process. In a typical IEEE 802.16 system, a terminal may have a universal MAC address of 48 bits in length per air interface. This address uniquely defines the air interface of the terminal and may be used to establish the connection of the terminal during the initial ranging process. Since the base station verifies the terminals with different identifiers (IDs) of the terminals, the universal MAC address may also be used as part of the authentication process. Each connection may be identified by a connection identifier (CID) of 16 bits in length. During the initialization of the terminal, two pairs of management connections (uplink and downlink) are established between the terminal and the base station, and three pairs may be selectively used including the management connection. Under the above-described hierarchical structure, the transmitting end and the receiving end may exchange data or control messages through a medium access control packet data unit (MAC PDU). In order to generate such a MAC PDU, the base station or the terminal may include a MAC header in the MAC PDU. The UE may request uplink bandwidth by transmitting bandwidth request information in the form of a MAC signaling header or a MAC subheader.

3 is a signal flow diagram illustrating a real-time intrusion prevention method in a wired / wireless integrated system using MAC information of the present invention.

As shown in Fig. 3, the core function of the present invention detects additional authentication information (PKI (Personal Key Infrastructure) or USIM information) in addition to MAC information in the wireless networking system, so that the information is not intended for networking. In this case, use a method of blocking access. That is, in operating the real-time intrusion blocking method in the wired / wireless integrated system, in determining whether the terminal should be connected stably or the terminal to be blocked, the presence or absence of the blocking is determined by using authentication information such as PKI or USIM of the mobile terminal in addition to the MAC information. It is characteristic.

USIM (Universal Subscriber Identity Module) chip combines subscriber identity module (SIM) card with subscriber information and universal IC card (UICC) to implement various functions such as user authentication, global roaming, and e-commerce on one chip. One universal user identification module.

Real-time intrusion prevention method in the wired / wireless integrated system of the present invention is not only MAC information. Recognition information provided by the USIM (or PKI) will also be used.

In detail, first, check the IP and MAC information of the wired user operating in the NMS. Network management system (NMS) refers to software used by system administrators to control a network. An NMS can consist of a program or a series of programs, also referred to as a network layer or protocol that provides access to the necessary settings.

Subsequently, wireless MAC information operating in a wireless intrusion prevention system (WIDS) or an intrusion detection system (IDS) is checked. Wireless Intrusion Detection System (WIDS) or Intrusion Detection System (IDS) is a system that detects hacking information invading wirelessly. It is a system that investigates and monitors suspicious points of network or system and takes necessary measures. If a firewall is a locked door, an intrusion detection system is a sensing device installed in the room that detects movement. The methods applied to IDS can range from identifying specific types of attacks to detecting unusual traffic.

Subsequently, the authentication server or the wireless intrusion detection system (WIDS) (or intrusion detection system (IDS)) determines whether the terminal requesting access is authenticated and registered user MAC (Media Access Control) and authentication information (PKI or USIM information). Check it. The terminal here comprises a smartphone.

User terminals other than the registered terminals are blocked from accessing the network, authorized user terminals are securely connected to the network, and receive real-time protection against malicious packets of wired and wireless in real time.

When the authorized user terminal accesses the external web through the wireless section and downloads the selected file, the downloaded file is automatically detected as a malicious file by the wireless intrusion detection system (WIDS) (or intrusion detection system (IDS)). If detected, malicious files are blocked from access. At this time, blocking can be immediately blocked without notifying the terminal user.

This function is unacceptable in the wireless WIPS. The data transmitted in the wireless section is encrypted because the entire data packet is encrypted. In the wireless section, it is impossible to check whether the packet is a malicious file. .

In the wired / wireless integrated system according to the present embodiment, the real-time intrusion blocking method uses a method of obtaining information from the AP, and inserts such a blocking function and a module when the AP is manufactured and designed.

In the wired network, since there is no analysis function for the data packet input through the wireless network, it is impossible to determine whether the currently transmitted data packet is malicious. In this case, therefore, a dedicated pattern analyzer must be manufactured.

In the wired / wireless integrated system according to the present embodiment, the function proposed in the real-time intrusion prevention method is a secure terminal through a device that performs MAC or authentication information (PKI or USIM) of a registered user's terminal through an NMS or a similar function. It is to ensure the connection, and to block access to the wired and wireless network of unauthorized terminals.

When access is controlled by using both MAC information and authentication information (PKI or USIM), it has the effect of controlling the information in real time by grasping the connection location, connection type, connection environment, and contents of the terminal used by the user. In practical application, it shows the performance of blocking packets within 0.1 second in the wireless section.

Although the present invention has been described in detail with reference to exemplary embodiments above, those skilled in the art to which the present invention pertains can make various modifications to the above-described embodiments without departing from the scope of the present invention. Will understand. Therefore, the scope of the present invention should not be limited to the described embodiments, but should be defined by the claims below and equivalents thereof.

Claims

Confirming and registering and storing a wired IP address and a wired MAC address of the terminal by a controller for controlling a network;

Checking and registering the wireless MAC address of the terminal by the controller;

Registering and storing, by the controller, USIM information or PKI information of the terminal; And

And determining, by the controller, whether the terminal requesting access to the network is authenticated by determining all the wired MAC information, the wireless MAC information, the USIM information, or the PKI information to determine a network connection. Intrusion Prevention Method.
The method of claim 1,

The control unit includes a wireless intrusion detection system or intrusion detection system for detecting hacking information that the unregistered terminal wirelessly invades the network,

And storing the wireless MAC information in the wireless intrusion detection system or the intrusion detection system.
The method of claim 1,

The control unit is a real-time intrusion prevention method in the wired / wireless integrated system, characterized in that when the terminal is permitted to access the external web wirelessly download the selected file, the downloaded file is a malicious file automatically.
The method of claim 3, wherein

The control unit may block access to the downloaded file without notifying the user of the terminal when the downloaded file is a malicious file when the terminal to which the access is allowed is wirelessly connected to the external web and downloads the selected file. Real-time intrusion prevention method in integrated system.