JP5546418B2 - Full stealth mode wireless LAN apparatus and connection method - Google Patents

Description

  The present invention relates to a wireless LAN (IEEE 802.11 series) device that realizes a complete stealth mode and a connection method. The wireless LAN is standardized as the IEEE 802.11 series. The series includes IEEE802.11a / b / g / n, etc., but these differences are differences in the frequency band and modulation method used, resulting in different transmission rates (Non-Patent Document 1).

  The wireless LAN has an identifier called ESSID. When a wireless LAN client connects to a wireless LAN access point, the identifier is used to connect to a desired network. The wireless LAN access point advertises the ESSID on a periodically broadcast signal called a beacon. By receiving this, the wireless LAN client can recognize the presence of the wireless LAN access point (and the network configured behind it).

  However, on the other hand, advertising the existence of the wireless LAN access point to an unspecified number increases the possibility of various malicious attacks. In order to prevent such a problem, a mechanism called a stealth mode is provided. This is a mechanism in which the ESSID is not placed on the beacon of the wireless LAN access point. Accordingly, since the wireless LAN client cannot recognize the presence of a desired wireless LAN access point (when using the stealth mode), the wireless LAN client tries to connect to all ESSIDs registered in the wireless LAN client.

IEEE 802.11 IEEE Computer Society

  However, in the above stealth mode, the wireless LAN client searches for a nearby wireless LAN access point having the ESSID by sending a desired ESSID in a Probe request message. If there is a wireless LAN access point having the ESSID described in the probe request, the wireless LAN access point responds with a probe request message and notifies the wireless LAN client of its existence (notifies other information necessary for connection). To do). Thereafter, the wireless LAN client enters a procedure for connecting to the wireless LAN access point.

  The problem here is that the wireless LAN client stores the ESSID in plaintext in the Probe request message. Therefore, if this probe request is transmitted while a third party is monitoring a radio frame, the presence of the ESSID is easily known to the third party. Furthermore, since the wireless LAN client sends out a probe request message for each of the ESSIDs registered in itself, it results in exposing more information than necessary to a third party.

  Therefore, an object of the present invention is to provide a wireless LAN device and a connection method having a mechanism (complete stealth mode) that almost completely prevents an ESSID from being known to a third party.

  To achieve the above object, the wireless LAN device according to the present invention receives a frame including hash information generated from the ESSID and time stamp of the partner wireless LAN device from the partner wireless LAN device, and receives the hash information and time stamp from the frame. By comparing the extracted hash information with the extracted time stamp / hash information extracting means, the hash information generating means for generating hash information from the extracted time stamp and the ESSID in the own wireless LAN device, Hash information comparing means for confirming the ESSID of the counterpart wireless LAN device.

  In order to achieve the above object, a wireless LAN device according to the present invention includes hash information creation means for creating hash information from an ESSID and a time stamp in an access point, creates an SSID from the hash information and the time stamp, and includes the SSID An access point comprising an SSID creation means for transmitting a frame, a time stamp / hash information extraction means for extracting hash information and a time stamp from the SSID of the received frame, and a hash from the extracted time stamp and the ESSID in the wireless LAN client A wireless LAN client comprising hash information creating means for creating information and hash information comparing means for confirming the ESSID of the access point by comparing the created hash information with the extracted hash information

  To achieve the above object, a wireless LAN device according to the present invention creates hash information creation means for creating hash information from an ESSID and a time stamp in a wireless LAN client, creates an SSID from the hash information and the time stamp, and stores the SSID. SSID creation means for transmitting the included frame, time stamp / hash information extraction means for extracting hash information and time stamp from the SSID of the received frame, and creation of hash information from the extracted time stamp and ESSID in the wireless LAN client A wireless LAN client comprising hash information creating means, hash information comparing means for confirming the ESSID of the access point by comparing the created hash information and the extracted hash information, and the SSID of the received frame Time stamp / hash information extracting means for extracting hash information and time stamp, hash information creating means for creating hash information from the extracted time stamp and ESSID in the access point, the created hash information, and the extracted hash information And an access point comprising hash information comparison means for confirming the ESSID of the wireless LAN client.

  The wireless LAN device preferably includes a common encryption key, and the hash information creation means creates hash information from the ESSID, the time stamp, and the encryption key.

  The hash information creating means creates hash information using a random number or a pseudo random number instead of the time stamp, and the time stamp / hash information extracting means extracts the hash information and the random number or pseudo random number. It is also preferable.

In order to achieve the above object, a wireless LAN connection method according to the present invention receives a frame including hash information generated from an ESSID of a counterpart wireless LAN device and a time stamp from the counterpart wireless LAN device, and uses the hash information and time stamp from the frame. Extracting the
Creating hash information from the extracted time stamp and the ESSID in the own wireless LAN device;
Checking the ESSID of the partner wireless LAN device by comparing the created hash information with the extracted hash information;
including.

  By using the wireless LAN apparatus and method of the present invention, a client who does not know the specific character string of the ESSID is not aware of any information exchanged by the wireless LAN.

1 shows an overview of a wireless LAN according to the present invention. 1 is a block diagram of an AP and a client according to a first embodiment of this invention. The sequence of the 1st Embodiment of this invention is shown. The block diagram of AP and the client of the 2nd Embodiment of this invention is shown. The sequence of the 2nd Embodiment of this invention is shown. The field format in IEEE802.11 is shown. An Element ID table is shown. The field format of SSID of this invention is shown.

  The best mode for carrying out the present invention will be described in detail below with reference to the drawings. FIG. 1 shows an outline of a wireless LAN according to the present invention. Like a normal wireless LAN mechanism, the wireless LAN access point 1 (hereinafter referred to as AP) and a wireless LAN client 2 (hereinafter referred to as client) are included. AP1 has a network behind it.

  AP1 can select the full stealth mode of the present invention, the stealth mode of the conventional method, and no stealth of the conventional method. Only the case of using the complete stealth mode according to the present invention will be described below.

  FIG. 2 is a block diagram of the AP and the client according to the first embodiment of this invention. FIG. 2 a shows a block diagram of AP 1, and FIG. 2 b shows a block diagram of client 2. The complete stealth mode of this embodiment operates in a passive scan mode. The passive scan method is a method for recognizing a connection destination AP by receiving a beacon advertised from an AP and starting a connection procedure.

  The AP 1 includes an ESSID list 11, a time stamp creation unit 12, a hash information creation unit 13, and an SSID creation unit 14. The client 2 includes an ESSID list 21, a hash information creation unit 22, a hash information comparison unit 23, and a time stamp / hash information extraction unit 24.

  The ESSID list 11 is an ESSID list that the AP 1 has, and the time stamp creation unit 12 generates a time stamp from the current time. The hash information creation unit 13 creates hash information from the ESSID and the time stamp, and the SSID creation unit 14 creates an SSID from the hash information.

  The ESSID list 21 is an ESSID list that the client 2 has. The time stamp / hash information extraction unit 24 extracts a time stamp and hash information from the received beacon frame. The hash information creation unit 22 creates hash information from the ESSID and the extracted time stamp. The hash information comparison unit 23 compares the extracted hash information with the created hash information.

FIG. 3 shows a sequence of the first embodiment of the present invention.
(1) The AP transmits a beacon frame. Unlike the conventional stealth mode, this beacon frame stores the following information in the SSID field in the beacon frame in the full stealth mode (the SSID is practically the same as the ESSID, but in IEEE 802.11, the SSID field) Defined as :).
-Time stamp (assuming the bit length is predetermined)
・ Hash information

Here, the time stamp is the current time indicated by the clock of the AP. The hash information is a bit string calculated as follows using a hash function such as MD5 or SHA-1 (this function is called h).
Hash information = h (ESSID + time stamp)

Note that the “+” symbol in the function h indicates that bit strings are combined. That is, a hash value for a value obtained by combining a bit string of ESSID (normal character string) and a bit string representing the current time is advertised as an SSID. Note that the hash value obtained by the function h (for example, 160 bits in the case of SHA-1) may be cut out to an appropriate length (eg, n bits from the head) and used as hash information.
(2) The client receives a beacon frame.
When the client receives the beacon, it extracts the time stamp and hash information from the SSID field.
(3) The client detects the ESSID.
Take out the ESSID character string one by one from the ESSID list held by the client, and x = h (ESSID + time stamp) from the received time stamp and the ESSID
To calculate the bit string x. If x has the same value as the hash information in the SSID field of the beacon, the beacon is known to have been sent from the AP of that ESSID.
(4) The client starts a connection procedure with the AP.
Using the matched ESSID, the client initiates the connection procedure. The connection procedure is the same as the conventional method, and is performed by exchanging Authentication requests, exchanging Association Requests / Responses, etc.

  FIG. 4 shows a block diagram of an AP and a client according to the second embodiment of this invention. FIG. 4 a shows a block diagram of AP 1, and FIG. 4 b shows a block diagram of client 2. The complete stealth mode of this embodiment operates in an active scan mode. The active scan method is a method of actively searching (scanning) an AP from a client, notifying the AP of its presence, and starting a connection procedure therefrom.

  The AP 1 includes an ESSID list 11, a hash information creation unit 13, a time stamp / hash information extraction unit 15, and a hash information comparison unit 16. The client 2 includes an ESSID list 21, a hash information creation unit 22, a hash information comparison unit 23, a time stamp / hash information extraction unit 24, a time stamp creation unit 25, a hash information creation unit 26, and an SSID creation unit 27. When AP1 calculates hash information, it can further include a time stamp creation unit 12 and an SSID creation unit 14 (not shown here) as in the first embodiment.

  The ESSID list 11 is an ESSID list that the AP 1 has. The time stamp / hash information extraction unit 15 extracts a time stamp and hash information from the received probe request. The hash information creation unit 13 creates hash information from the ESSID and the extracted time stamp. The hash information comparison unit 16 compares the extracted hash information with the created hash information.

  The ESSID list 21 is an ESSID list that the client 2 has. The time stamp / hash information extraction unit 24 extracts a time stamp and hash information from the received probe response. The hash information creation unit 22 creates hash information from the ESSID and the extracted time stamp. The hash information comparison unit 23 compares the extracted hash information with the created hash information. The time stamp creation unit 25 generates a time stamp from the current time. The hash information creation unit 26 creates hash information from the ESSID and the time stamp, and the SSID creation unit 27 creates an SSID from the hash information.

FIG. 5 shows a sequence of the second embodiment of the present invention.
(1) The client broadcasts a Probe request message.
A time stamp and hash information are stored in the SSID field of this Probe request message, as in the above-described beacon frame. The method of calculating the hash information is the same as in the case of the beacon frame. In this case, the time stamp is a time obtained from a clock held by the client itself. Since the client has a list of ESSIDs, a probe request is sent to each ESSID in the list (same as the conventional method).
(2) The AP receives a probe request.
The AP that has received the probe request extracts the time stamp and hash information from the SSID field therein.
(3) The AP detects the ESSID. The AP uses the received time stamp and the ESSID set in the AP itself.
x = h (ESSID + time stamp)
To calculate the bit string x and check whether it is the same as the hash information contained in the probe request. If they are not identical, the message is discarded.
(4) The AP returns a probe response to the transmission source client.
When the hash information is the same, the AP returns a Probe response to the transmission source client. In the SSID field of Probe response, the same content as that at the time of request may be stored, or hash information may be newly recalculated using the current time of the AP itself. In that case, the time stamp is also rewritten to the current time.
(5) The client receives a probe response.
The client that has received the probe response extracts the time stamp and hash information from the SSID field.
(6) The client detects the ESSID.
Similar to the passive scan method, the SSID field is checked (identity confirmation of the same hash value as described above), and the ESSID registered in the client list is detected.
(7) The client starts a connection procedure with the AP.
Similar to the passive scan method, the connection procedure is started.

  Next, details of the frame format are shown. In IEEE 802.11, each field storing various information necessary for using the wireless LAN including the SSID field is defined as shown in FIG. Element ID is 1-byte information indicating which information is stored in the field, and its type is as shown in FIG. Length represents the actual length of information (in bytes).

  In the present invention, a reservation number after 51 is used for the Element ID to indicate the complete stealth mode. Here, it is assumed that 100 is used. The field format of the SSID when using the full stealth mode is as shown in FIG. Length represents the byte length combining the time stamp and hash information. As mentioned above, the length of the time stamp (usually 8 bytes are often used) and the length of the hash information (the first n bits of the bit string obtained from the hash function) It is assumed that it is decided as common knowledge of AP and client.

Next, an extension of the first embodiment and the second embodiment of the present invention will be described. In the description so far, the hash function is calculated using the ESSID and the time stamp, and the hash information is configured. As a method for further improving the security, there is a method of calculating a hash function as follows. In this case, the AP and the client have a common encryption key.
Hash information = h (ESSID + h (encryption key + time stamp) + time stamp)

  This means that when calculating a hash, it is calculated by adding another information, and the added information is a hash value for a combination of an encryption key (such as a WEP key or an AES key) and a time stamp. is there. By doing so, even if the ESSID is accidentally distributed to a third party, the existence of the AP can be hidden unless the encryption key is further known. The two time stamps in the above formula are both the same time stamp bit string stored in the SSID field. Further, the hash value calculated by h (encryption key + time stamp) does not have to be cut into n bytes like the hash information placed in the SSID field. In addition, in this case, everyone must perform the same processing.

  The SSID field check performed by the AP and the client is performed using an encryption key corresponding to the ESSID in addition to the ESSID.

In the above embodiment, the time stamp is used to calculate the hash information, but the hash information is expressed as hash information = h (ESSID + (pseudo) random number) using a random number or a pseudo-random number.
Hash information = h (ESSID + h (encryption key + (pseudo) random number) + (pseudo) random number)
It can also be calculated with In this case, the AP or client includes a random number generator or a pseudo-random number generator instead of the time stamp generating unit. In the case of this form, the time stamp / hash information extraction unit extracts hash information and a random number or a pseudo-random number.

  Moreover, all the embodiments described above are illustrative of the present invention and are not intended to limit the present invention, and the present invention can be implemented in other various modifications and changes. Therefore, the scope of the present invention is defined only by the claims and their equivalents.

1 Wireless LAN access point (AP)
11 ESSID list 12 Timestamp creation unit 13 Hash information creation unit 14 SSID creation unit 15 Timestamp / hash information extraction unit 16 Hash information comparison unit 2 Wireless LAN client (client)
21 ESSID list 22 Hash information creation unit 23 Hash information comparison unit 24 Time stamp / hash information extraction unit 25 Time stamp creation unit 26 Hash information creation unit 27 SSID creation unit

Claims (6)

Time stamp / hash information extraction means for receiving a frame including hash information generated from the ESSID and time stamp of the partner wireless LAN device from the partner wireless LAN device, and extracting the hash information and time stamp from the frame;
Hash information creating means for creating hash information from the extracted time stamp and the ESSID in the own wireless LAN device;
Hash information comparison means for confirming the ESSID of the counterpart wireless LAN device by comparing the created hash information and the extracted hash information;
A wireless LAN device comprising: Hash information creating means for creating hash information from the ESSID and time stamp in the access point;
SSID creation means for creating an SSID from the hash information and a time stamp and transmitting a frame including the SSID;
An access point comprising:
Time stamp / hash information extracting means for extracting hash information and time stamp from the SSID of the received frame;
Hash information creating means for creating hash information from the extracted time stamp and the ESSID in the wireless LAN client;
Hash information comparison means for confirming the ESSID of the access point by comparing the created hash information and the extracted hash information;
A wireless LAN client comprising:
A wireless LAN device comprising: Hash information creating means for creating hash information from the ESSID and time stamp in the wireless LAN client;
SSID creation means for creating an SSID from the hash information and a time stamp and transmitting a frame including the SSID;
Time stamp / hash information extracting means for extracting hash information and time stamp from the SSID of the received frame;
Hash information creating means for creating hash information from the extracted time stamp and the ESSID in the wireless LAN client;
Hash information comparison means for confirming the ESSID of the access point by comparing the created hash information and the extracted hash information;
A wireless LAN client comprising:
Time stamp / hash information extracting means for extracting hash information and time stamp from the SSID of the received frame;
Hash information creating means for creating hash information from the extracted time stamp and the ESSID in the access point;
Hash information comparison means for confirming the ESSID of the wireless LAN client by comparing the created hash information and the extracted hash information;
An access point comprising:
A wireless LAN device comprising:   The wireless LAN device includes a common encryption key, and the hash information creation unit creates hash information from the ESSID, the time stamp, and the encryption key. The wireless LAN device according to the item. The hash information creating means creates hash information using a random number or a pseudo-random number instead of the time stamp,
5. The wireless LAN device according to claim 1, wherein the time stamp / hash information extraction unit extracts hash information and a random number or a pseudo-random number. 6. Receiving a frame including hash information generated from the ESSID of the partner wireless LAN device and the time stamp from the partner wireless LAN device, and extracting the hash information and the time stamp from the frame;
Creating hash information from the extracted time stamp and the ESSID in the own wireless LAN device;
Checking the ESSID of the partner wireless LAN device by comparing the created hash information with the extracted hash information;
A wireless LAN connection method comprising:

Images