JP7485451B2 - Unauthorized access point detection system, access point, method, and program - Google Patents

Description

The present invention relates to an unauthorized access point detection system, an access point, a method, and a program.

In recent years, access points (public wireless LAN (Local Area Network), free Wi-Fi (registered trademark), etc.) are provided in various places (for example, hotels, restaurants, convenience stores, airports, etc.). In such places, the SSID (Service Set Identifier, sometimes called ESSID (Extended Service Set Identifier)) and password for using the access point are made public to users. In such a situation, malicious service providers may install unauthorized access points with the same SSID and password as those of legitimate access points. By connecting a terminal to such an unauthorized access point, there is a risk that information on the terminal may be extracted and misused. Since access points are currently in an environment where they can be easily installed, the risk from unauthorized access points may continue to increase in the future. Therefore, methods for detecting unauthorized access points have been proposed (for example, see Patent Documents 1 to 3).

For example, Patent Document 1 discloses a method in which a management terminal that manages wireless LAN devices in a LAN is used to register authorized wireless LAN devices (BSSID (Basic Service Set Identifier), ESSID, flags) in a list, acquire beacons of the wireless LAN devices, and use the beacon information of the beacons (including BSSID and ESSID) and the list to identify unauthorized wireless LAN devices, and notify an administrator of the results of the identification.

Patent Document 2 also discloses a method in which, when a legitimate access point detects another access point that transmits the same identification information as the specific identification information transmitted by the legitimate access point from a received signal, wireless communication is performed between the detected other access point and the other access point using a second MAC address different from a first MAC address for wireless communication with a wireless communication terminal under the legitimate access point, and when it is detected that the other access point does not request a password or that the authentication method of the other access point is different from that of the legitimate access point, the other access point is detected as an unauthorized access point and information about the other access point is transmitted to a management device.

Furthermore, Patent Document 3 discloses a method in which a detector in a wireless local area network receives a beacon frame including a sequence number and a MAC address, and this beacon frame is transmitted onto the wireless local area network by one or more access points, and the detector analyzes the sequence number and MAC address of the received beacon frame (pre-registered sequence number and MAC address) to detect a counterfeit access point within the wireless local area network.

JP 2019-129434 A JP 2017-168909 A Special Publication No. 2005-522120

The following analysis is provided by the present inventors.

However, in the method of Patent Document 1, a management terminal is added in addition to the wireless LAN device, so many management terminals are required to monitor unauthorized access points over a wide area, which incurs high costs. In addition, in the method of Patent Document 2, in order to monitor unauthorized access points over a wide area, all legitimate access points within the area must have the function of detecting unauthorized access points, which incurs high costs. Furthermore, in the method of Patent Document 3, multiple detectors must be prepared to monitor unauthorized access points over a wide area, which incurs high costs.

The main objective of the present invention is to provide a rogue access point detection system, access point, method, and program that can contribute to monitoring rogue access points at low cost and over a wide area.

The unauthorized access point detection system according to the first aspect is an unauthorized access point detection system in which a plurality of authorized access points and a management terminal are connected to be able to communicate with each other via a network, and which is configured to transmit an email to the management terminal when an unauthorized access point is detected at any one of the plurality of authorized access points, notifying the management terminal of the presence of the unauthorized access point, and one or more first authorized access points among the plurality of authorized access points transmit a password related to the same identification information as that of the first authorized access point itself to another access point, attempting a wireless connection with the other access point, and when the wireless connection with the other access point is successful, acquiring identification information related to the other access point from the other access point, and a wireless connection unit configured to transmit the password related to the first authorized access point to the other access point when the wireless connection with the other access point is successful, A request sending unit configured to send request information including the identification information of the other access point to a second legitimate access point among the plurality of legitimate access points that is different from the first legitimate access point when the identification information of the other access point is acquired, the second legitimate access point having a management database in which data on whether the access point is an acceptable access point based on the identification information of the access point is registered, an analysis unit configured to analyze whether the other access point related to the identification information included in the request information is the unauthorized access point based on the management database, and an email sending unit configured to send an email to the management terminal notifying the existence of the unauthorized access point when the other access point is determined to be the unauthorized access point.

The access point according to the second aspect (corresponding to the first authorized access point) is one or more predetermined access points (corresponding to the first authorized access point) among the plurality of authorized access points in an unauthorized access point detection system in which a plurality of authorized access points and a management terminal are connected to be able to communicate with each other via a network, and an email informing the management terminal of the presence of an unauthorized access point is sent when an unauthorized access point is detected at any of the plurality of authorized access points. The access point includes a wireless connection unit configured to transmit a password related to the same identification information as that of the predetermined access point itself to the other access points to attempt a wireless connection with the other access point, and to obtain identification information related to the other access point from the other access point when the wireless connection with the other access point is successful, and a request transmission unit configured to transmit request information including the identification information related to the other access point to one other predetermined access point (corresponding to the second authorized access point) among the plurality of authorized access points that is different from the predetermined access point when the identification information related to the other access point is obtained by the wireless connection unit of the predetermined access point.

The access point according to the third aspect (corresponding to the second legitimate access point) is a specific access point (corresponding to the second legitimate access point) among a plurality of legitimate access points in an unauthorized access point detection system in which a plurality of legitimate access points and a management terminal are connected to be able to communicate with each other via a network, and an email notifying the management terminal of the existence of an unauthorized access point when an unauthorized access point is detected at any of the plurality of legitimate access points is sent. The specific access point includes a management database in which data on whether or not the access point is an acceptable access point for identification information related to the access point is registered, an analysis unit configured to analyze, based on the management database, whether or not another access point related to identification information included in request information from another specific access point (corresponding to the first legitimate access point) among the plurality of legitimate access points that is different from the specific access point is the unauthorized access point, and an email sending unit configured to send an email notifying the management terminal of the existence of the unauthorized access point when the other access point is determined to be the unauthorized access point.

A fourth aspect of the unauthorized access point detection method is a method for detecting an unauthorized access point using an unauthorized access point detection system in which a plurality of authorized access points and a management terminal are connected to be able to communicate with each other via a network, and an email is sent to the management terminal when an unauthorized access point is detected at any one of the plurality of authorized access points, the method comprising the steps of: at one or more first authorized access points among the plurality of authorized access points, transmitting a password related to the same identification information as that of the first authorized access point itself to another access point, attempting to establish a wireless connection with the other access point, and, when the wireless connection with the other access point is successful, acquiring identification information related to the other access point from the other access point; and, The method includes a step of, in the legitimate access point, when the first legitimate access point acquires the identification information related to the other access point, transmitting request information including the identification information related to the other access point to a second legitimate access point among the plurality of legitimate access points that is different from the first legitimate access point; a step of, in the second legitimate access point, analyzing whether the other access point related to the identification information included in the request information is the unauthorized access point based on a management database in which data on whether the access point is an acceptable access point based on the identification information related to the access point is registered; and a step of, in the second legitimate access point, sending an email to the management terminal notifying the existence of the unauthorized access point when it is determined that the other access point is the unauthorized access point.

The program according to the fifth aspect (program for a first legitimate access point) is a program for causing one or more predetermined access points (corresponding to a first legitimate access point) among a plurality of legitimate access points in a rogue access point detection system configured to communicate with a plurality of legitimate access points and a management terminal via a network, and to transmit an email informing the management terminal of the presence of a rogue access point when any of the plurality of legitimate access points detects the rogue access point, and causes the predetermined access point (corresponding to a first legitimate access point) to perform the following processes: transmit a password related to the same identification information as that of the predetermined access point itself to the other access point, attempt a wireless connection with the other access point, and obtain identification information related to the other access point from the other access point when the wireless connection with the other access point is successful; and transmit request information including the identification information related to the other access point to one other predetermined access point (corresponding to a second legitimate access point) among the plurality of legitimate access points that is different from the predetermined access point when the wireless connection unit of the predetermined access point obtains the identification information related to the other access point.

The program according to the sixth aspect (program for a second legitimate access point) is a program for causing a predetermined access point (corresponding to a second legitimate access point) among a plurality of legitimate access points in an unauthorized access point detection system configured to communicate with a plurality of legitimate access points and a management terminal via a network, and to transmit an email notifying the management terminal of the presence of an unauthorized access point when an unauthorized access point is detected at any of the plurality of legitimate access points, to execute a process of detecting the unauthorized access point, and causes the predetermined access point (corresponding to a first legitimate access point) among the plurality of legitimate access points to execute a process of analyzing whether or not another access point related to identification information included in request information from another predetermined access point (corresponding to a first legitimate access point) different from the predetermined access point among the plurality of legitimate access points is the unauthorized access point, based on a management database in which data on whether or not the identification information related to the access point is an acceptable access point is registered, and a process of sending an email notifying the management terminal of the presence of the unauthorized access point when the other access point is determined to be the unauthorized access point.

The program can be recorded on a computer-readable storage medium. The storage medium can be a non-transient medium such as a semiconductor memory, a hard disk, a magnetic recording medium, or an optical recording medium. In addition, the present disclosure can be embodied as a computer program product. The program is input to the computer device from an input device or an external device via a communication interface, stored in a storage device, and drives the processor according to a predetermined step or process, and can display the processing results, including intermediate states as necessary, at each stage via a display device, or can communicate with the outside via the communication interface. As an example, a computer device for this purpose typically includes a processor, a storage device, an input device, a communication interface, and a display device as necessary, all of which can be connected to each other via a bus.

The first to sixth aspects can contribute to monitoring unauthorized access points at low cost and over a wide area.

1 is a block diagram showing a schematic configuration of an unauthorized access point detection system according to a first embodiment; 1 is a block diagram illustrating an example of a configuration when an unauthorized access point detection system according to a first embodiment is applied. 4 is a table showing a schematic configuration of a management database used in the unauthorized access point detection system according to the first embodiment. 4 is a table showing a schematic configuration of request information used in the unauthorized access point detection system according to the first embodiment. 10 is a flow chart diagram illustrating the operation of the unauthorized access point detection system according to the first embodiment when a first authorized access point is wirelessly connected to an unauthorized access point. FIG. 10 is a flow chart diagram illustrating the operation of the unauthorized access point detection system according to the first embodiment when a second authorized access point is wirelessly connected to the unauthorized access point. FIG. FIG. 11 is a block diagram illustrating a configuration of an unauthorized access point detection system according to a second embodiment. FIG. 2 is a block diagram illustrating a schematic configuration of hardware resources.

The following describes the embodiments with reference to the drawings. Note that when reference symbols are used in this application, they are intended to aid understanding and are not intended to limit the invention to the illustrated form. The following embodiments are merely illustrative and do not limit the invention. The connection lines between blocks in the drawings and the like referred to in the following description include both bidirectional and unidirectional lines. One-way arrows are used to diagrammatically indicate the flow of the main signal (data) and do not exclude bidirectionality. Furthermore, although not explicitly shown in the circuit diagrams, block diagrams, internal configuration diagrams, connection diagrams, and the like shown in this disclosure, input ports and output ports exist at the input and output ends of each connection line. The same is true for input/output interfaces. The program is executed via a computer device, which includes, for example, a processor, a storage device, an input device, a communication interface, and a display device as necessary, and the computer device is configured to be able to communicate with devices inside or outside the device (including a computer) via the communication interface, regardless of whether it is wired or wireless.

[Embodiment 1]
The unauthorized access point detection system according to the first embodiment will be described with reference to the drawings. FIG. 1 is a block diagram showing a schematic configuration of the unauthorized access point detection system according to the first embodiment. FIG. 2 is a block diagram showing a schematic example of a configuration when the unauthorized access point detection system according to the first embodiment is applied. FIG. 3 is a table showing a schematic configuration of a management database used in the unauthorized access point detection system according to the first embodiment. FIG. 4 is a table showing a schematic configuration of request information used in the unauthorized access point detection system according to the first embodiment.

The unauthorized access point detection system 1 is a system that detects unauthorized access points 50 using first authorized access points 10A to 10N and second authorized access points 20 (see FIG. 1 and FIG. 2). In the unauthorized access point detection system 1, the first authorized access points 10A to 10N and second authorized access points 20 attempt to connect to unauthorized access points 50 with the same SSID and password as their own. In the unauthorized access point detection system 1, when the connection is successful, the unauthorized access point detection system 1 acquires identification information (e.g., BSSID including MAC address) related to the unauthorized access point 50, and searches for whether the acquired identification information (e.g., BSSID, MAC address) matches the identification information registered in the second authorized access point 20 (e.g., registered MAC address in FIG. 3). In the unauthorized access point detection system 1, if there is no matching identification information (e.g., MAC address), or if there is matching identification information (e.g., MAC address) but it is NG, the second authorized access point 20 sends an email to the management terminal 30 notifying that the unauthorized access point 50 has been detected. The unauthorized access point detection system 1 includes first authorized access points 10A to 10N, a second authorized access point 20, a management terminal 30, and a network 40.

The first legitimate access points 10A-10N are legitimate access points that have the function of acquiring identification information (e.g., MAC addresses) related to other access points (rogue access points 50, legitimate access points) (see Figures 1 and 2). The first legitimate access points 10A-10N do not have the function of analyzing identification information (e.g., MAC addresses) related to other access points. There are N first legitimate access points 10A-10N in Figures 1 and 2, but it is sufficient that there is at least one. The first legitimate access points 10A-10N are wired and communicatively connected to the network 40. The first legitimate access points 10A-10N wirelessly connect to the user terminal 60 that has sent the password related to their SSID, enabling communication between the user terminal 60 and the network 40. The first legitimate access points 10A-10N transmit the password related to their SSID to the other access points and attempt to wirelessly connect to the other access points. When the first legitimate access points 10A to 10N have successfully established a wireless connection with the other access point, they acquire identification information (e.g., a BSSID including a MAC address) related to the other access point from the other access point, and transmit request information including the acquired identification information (e.g., the BSSID and MAC address) to the second legitimate access point 20. The first legitimate access points 10A to 10N are equipped with a computer including a processor, memory, a network interface, and the like. The first legitimate access points 10A to 10N can be virtually configured to include a wireless providing unit 11, a wireless connection unit 12, and a request sending unit 13 by executing a program in the processor while using the memory.

The wireless providing unit 11 is a functional unit that provides wireless connection to a user terminal (60 in FIG. 2) that has sent a password related to the SSID of the first authorized access point 10A-10N itself (see FIG. 1). The SSID and password of the first authorized access point 10A-10N itself are registered in the wireless providing unit 11. The wireless providing unit 11 requests the password related to the SSID of the first authorized access point 10A-10N itself from the user terminal 60, compares the password related to the SSID sent from the user terminal 60 with the password related to the registered SSID, and enables communication between the user terminal 60 and the network 40 when they match.

The wireless connection unit 12 is a functional unit that periodically (e.g., at a pre-specified time) transmits a password related to the SSID of the first authorized access point 10A-10N to other access points (unauthorized access point (50 in FIG. 2), authorized access point) and attempts to establish a wireless connection with the other access points (see FIG. 1). When the wireless connection with the other access point is successful, the wireless connection unit 12 obtains identification information related to the other access point from the other access point (e.g., a BSSID including a MAC address).

The request sending unit 13 is a functional unit that, when the wireless connection unit 12 acquires identification information from another access point (e.g., a BSSID related to the other access point), sends request information (see FIG. 4) including the identification information (which may be a MAC address extracted from the BSSID) to the second legitimate access point 20 (see FIG. 1). The request information is information that requests the second legitimate access point 20 to analyze the identification information included in the request information. For example, HTTP (Hypertext Transfer Protocol) communication can be used to send the request information, and a communication method other than the communication method used by the wireless provision unit 11 may also be used.

The second legitimate access point 20 is a legitimate access point that has the function of acquiring and analyzing identification information (e.g., BSSID, MAC address) related to other access points (rogue access point 50, legitimate access point) (see Figures 1 and 2). There is one second legitimate access point 20 in Figures 1 and 2, but there may be two or more, and it is preferable that the number of second legitimate access points is less than the number of first legitimate access points 10A to 10N. The second legitimate access point 20 is wired and communicatively connected to the network 40. The second legitimate access point 20 wirelessly connects to the user terminal 60 that has sent the password related to its SSID, enabling communication between the user terminal 60 and the network 40. The second legitimate access point 20 transmits the password related to its SSID to the other access point and attempts to wirelessly connect to the other access point. When the second legitimate access point 20 has successfully established a wireless connection with the other access point, the second legitimate access point 20 acquires from the other access point identification information (e.g., BSSID including a MAC address) related to the other access point (the MAC address may be extracted from the BSSID). The second legitimate access point 20 extracts identification information (BSSID and MAC address related to the other access point) from the request information received from the first legitimate access points 10A to 10N. The second legitimate access point 20 searches for identification information (e.g., MAC address) that matches the acquired or extracted identification information (e.g., MAC address) registered in advance in the management database 25. When there is no matching identification information (e.g., MAC address) or when there is matching identification information (e.g., MAC address) but it is not acceptable, the second legitimate access point 20 transmits an email to the management terminal 30 notifying that an unauthorized access point 50 has been detected. If there is no matching identification information (e.g., MAC address), the second legitimate access point 20 registers the extracted identification information (e.g., MAC address) as NG in the management database 25. The second legitimate access point 20 includes a computer including a processor, memory, a network interface, and the like. By using the memory and executing a program in the processor, the second legitimate access point 20 can be configured to include a wireless providing unit 21, a wireless connection unit 22, a request receiving unit 23, an analyzing unit 24, a management database 25, and a mail sending unit 26.

The wireless providing unit 21 is a functional unit that provides wireless connection to a user terminal (60 in FIG. 2) that has sent a password related to the SSID of the second authorized access point 20 itself (see FIG. 1). The SSID and password of the second authorized access point 20 itself are registered in the wireless providing unit 21. The wireless providing unit 21 requests the password related to the SSID of the second authorized access point 20 itself from the user terminal 60, compares the password related to the SSID sent from the user terminal 60 with the password related to the registered SSID, and enables communication between the user terminal 60 and the network 40 when they match.

The wireless connection unit 22 is a functional unit that periodically (e.g., at a pre-specified time) transmits a password related to the SSID of the second legitimate access point 20 to other access points (unauthorized access point (50 in FIG. 2), legitimate access point) and attempts to establish a wireless connection with the other access points (see FIG. 1). When the wireless connection with the other access point is successful, the wireless connection unit 22 obtains identification information related to the other access point (e.g., a BSSID including a MAC address) from the other access point.

The request receiving unit 23 is a functional unit that receives request information (see Figure 4) from the first authorized access points 10A to 10N (see Figure 1).

The analysis unit 24 is a functional unit that analyzes whether or not the access point related to the acquired identification information (e.g., the MAC address included in the BSSID) or the identification information (e.g., the MAC address) included in the received request information (see FIG. 4) is an unauthorized access point (50 in FIG. 2) based on the management database 25 (see FIG. 1). The analysis unit 24 searches for the identification information (e.g., the MAC address included in the BSSID) or the identification information (e.g., the MAC address) included in the received request information registered in the management database 25, and if there is a match and the permission of the identification information (e.g., the registered MAC address in FIG. 3) is NG, it determines that an unauthorized access point 50 exists. The analysis unit 24 searches for identification information (e.g., the registered MAC address in FIG. 3) registered in the management database 25 for the acquired identification information (e.g., the MAC address included in the BSSID) or the identification information (e.g., the MAC address) included in the received request information, and if there is no match, it determines that an unauthorized access point 50 exists and registers the identification information (e.g., the MAC address) and its permission status as NG in the management database 25. The analysis unit 24 searches for identification information (e.g., the registered MAC address in FIG. 3) registered in the management database 25 for the acquired identification information (e.g., the MAC address included in the BSSID) or the identification information (e.g., the MAC address) included in the received request information, and if there is a match and the permission status of the identification information (e.g., the registered MAC address in FIG. 3) is OK, it determines that an unauthorized access point does not exist.

The management database 25 is a management database that registers data on whether an access point (legitimate access point) is permissible for the identification information (registered MAC address in FIG. 3). In the management database 25, the identification information (registered MAC address in FIG. 3) is associated with permission (OK/NG). The management database 25 is registered (or updated) in advance (or when the number of legitimate access points is changed) by operation from the management terminal 30. In addition, when the identification information (e.g., MAC address included in the BSSID) acquired by the analysis unit 24 or the identification information (e.g., MAC address) included in the received request information does not match the identification information registered in the management database 25 (e.g., registered MAC address in FIG. 3), the identification information (e.g., MAC address) and its permission status of NG are automatically registered in the management database 25.

The email sending unit 26 is a functional unit that, when the analysis unit 24 determines that the identification information (e.g., MAC address) is related to an unauthorized access point (50 in FIG. 2), sends an email to the management terminal 30 associated with a pre-registered email address to notify the existence of an unauthorized access point 50 associated with the identification information (e.g., MAC address) (see FIG. 1). The email address is registered in the email sending unit 26 by an operation from the management terminal 30. In addition to the identification information (e.g., MAC address) related to the unauthorized access point 50, the email may include information such as whether the identification information (e.g., MAC address) is a new registration or an existing registration, identification information related to the second legitimate access point 20 from which the identification information (e.g., MAC address) was obtained, and email sender information (e.g., identification information related to the second legitimate access point 20).

The management terminal 30 is a terminal used by the administrator of the unauthorized access point detection system 1 (see FIG. 1). The management terminal 30 is communicatively connected (wired or wireless) to the network 40. The management terminal 30 may be equipped with a computer including a processor, memory, network interface, etc., and may be, for example, a personal computer, a tablet terminal, or a smartphone. The management terminal 30 has the function of inputting and outputting (including displaying) information. The management terminal 30 can input and send the management database 25 and email address registered in the second legitimate access point 20 by operation of the administrator. The management terminal 30 can receive and display emails from the second legitimate access point 20.

The network 40 is a wired or wireless communication network that connects the first authorized access points 10A-10N, the second authorized access point 20, and the management terminal 30 so that they can communicate with each other (see FIG. 1). The network 40 may be, for example, a personal area network (PAN), a local area network (LAN), a metropolitan area network (MAN), a wide area network (WAN), or a global area network (GAN).

The unauthorized access point 50 is not a component of the unauthorized access point detection system (1 in FIG. 1), but is an unauthorized access point that is maliciously installed in the network 40 of the unauthorized access point detection system 1 (see FIG. 2). The unauthorized access point 50 is set with a password for the SSID that is the same as the password for the SSID of any of the legitimate access points 10A to 10N, 20. The unauthorized access point 50 is connected to the network 40 by wire so as to be able to communicate with the network. The unauthorized access point 50 has a function of providing a wireless connection to a user terminal (60 in FIG. 2) or the legitimate access points 10A to 10N, 20 that has sent a password for the SSID of any of the legitimate access points 10A to 10N, 20. The unauthorized access point 50 requests a password for the SSID of any of the legitimate access points 10A to 10N, 20 from the user terminal 60 or the legitimate access points 10A to 10N, 20 that has accessed the unauthorized access point 50. The unauthorized access point 50 checks the password for the SSID sent from the user terminal 60 or the authorized access points 10A-10N, 20 against the password for the SSID set in the unauthorized access point 50 itself, and if they match, it transmits identification information (e.g., BSSID, MAC address) related to the unauthorized access point 50 itself to the user terminal 60 or the authorized access points 10A-10N, 20, enabling communication between the user terminal 60 or the authorized access points 10A-10N, 20 and the network 40.

The user terminal 60 is a terminal used by a user who uses the access point (see FIG. 2). The user terminal 60 is configured to be capable of wireless connection to the access point. The user terminal 60 may be, for example, a smartphone, a tablet terminal, or a notebook personal computer.

Each access point (10A to 10N, 20, 50) is assigned unique communication identification information (e.g., BSSID, MAC address) that is different from the communication identification information of other access points. The identification information is transmitted from the access point to the user terminal 60 when a wireless connection between the access point and the user terminal 60 is successful.

The operation of the unauthorized access point detection system according to the first embodiment will be described.

First, the operation of the unauthorized access point detection system 1 when any of the first authorized access points 10A to 10N is wirelessly connected to the unauthorized access point 50 will be described with reference to the drawings. FIG. 5 is a flow chart diagram that shows a schematic operation when the first authorized access point of the unauthorized access point detection system according to the first embodiment is wirelessly connected to the unauthorized access point.

First, the second authorized access point 20 registers (or updates) the management database 25 and email address (the email address associated with the management terminal 30) in advance (or when the number of authorized access points is changed) through operations from the management terminal 30 (step A1).

Next, the first legitimate access point (here, the first legitimate access point 10A) periodically (for example, at a pre-specified time) transmits a password related to the SSID of the first legitimate access point 10A itself and attempts to establish a wireless connection with another access point (step A2). If the wireless connection with another access point is not successful, it is determined that no unauthorized access point exists and the process ends.

If a wireless connection with another access point (here, the unauthorized access point 50) is successful, the unauthorized access point 50 transmits identification information relating to itself (here, the BSSID including the MAC address) to the first legitimate access point 10A (step A3).

Next, the first legitimate access point 10A receives the BSSID from the unauthorized access point 50 and obtains the MAC address from the received BSSID (step A4).

Next, the first legitimate access point 10A generates request information including the acquired MAC address (step A5).

Next, the first legitimate access point 10A transmits the generated request information to the second legitimate access point 20 (step A6). Here, the request information can be transmitted using a communication method (e.g., HTTP communication) different from the communication method between the first legitimate access point 10A and the unauthorized access point 50.

Next, the second legitimate access point 20 receives the request information from the first legitimate access point 10A and obtains the MAC address from the received request information (step A7).

Next, the second legitimate access point 20 searches for the acquired MAC address to see if it matches any identification information (here, a registered MAC address) previously registered in the management database 25 (step A8). If a matching registered MAC address is found and permission is OK, it is determined that no unauthorized access point exists and the process ends.

If there is no matching registered MAC address, the second legitimate access point 20 determines that an unauthorized access point 50 exists, and registers the acquired MAC address and its permission status as NG in the management database 25 (updates the management database 25) (step A9). If there is a matching registered MAC address and its permission status is NG, it determines that an unauthorized access point 50 exists, skips step A9, and proceeds to step A10.

After step A8, the second legitimate access point 20 sends an email to the management terminal 30 associated with the preregistered email address informing it of the presence of an unauthorized access point 50 (step A10), and then terminates.

Next, the operation of the unauthorized access point detection system 1 when the second authorized access point 20 is wirelessly connected to the unauthorized access point 50 will be described with reference to the drawings. FIG. 6 is a flow chart diagram that shows a schematic operation of the unauthorized access point detection system according to the first embodiment when the second authorized access point is wirelessly connected to the unauthorized access point.

First, the second authorized access point 20 registers (or updates) the management database 25 and email address (the email address associated with the management terminal 30) in advance (or when the number of authorized access points is changed) through operations from the management terminal 30 (step B1).

Next, the second authorized access point 20 periodically (for example, at a pre-specified time) transmits a password related to its own SSID and attempts to establish a wireless connection with another access point (step B2). If the wireless connection with another access point is not successful, it is determined that no unauthorized access point exists and the process ends.

If a wireless connection with another access point (here, the unauthorized access point 50) is successful, the unauthorized access point 50 transmits identification information relating to itself (here, the BSSID including the MAC address) to the second legitimate access point 20 (step B3).

Next, the second legitimate access point 20 receives the BSSID from the unauthorized access point 50 and obtains the MAC address from the received BSSID (step B4).

Next, the second legitimate access point 20 searches for the acquired MAC address to see if it matches any identification information (here, a registered MAC address) previously registered in the management database 25 (step B5). If a matching registered MAC address is found and permission is OK, it is determined that no unauthorized access point exists and the process ends.

If there is no matching registered MAC address, the second legitimate access point 20 determines that an unauthorized access point 50 exists, and registers the acquired MAC address and its permission status as NG in the management database 25 (updates the management database 25) (step B6). If there is a matching registered MAC address and its permission status is NG, it determines that an unauthorized access point 50 exists, skips step B6, and proceeds to step B7.

After step B6, the second legitimate access point 20 sends an email to the management terminal 30 associated with the preregistered email address informing it of the presence of an unauthorized access point 50 (step B7), and then terminates.

According to the first embodiment, when any of the legitimate access points 10A-10N, 20 succeeds in wirelessly connecting to another access point, the identification information related to the other access point acquired from the other access point is collected in the second legitimate access point 20 to detect the unauthorized access point 50. This simplifies the configuration of the first legitimate access points 10A-10N, and allows unauthorized access points 50 to be monitored over a wide area by the multiple legitimate access points 10A-10N, 20, which contributes to monitoring unauthorized access points over a wide area at low cost.

[Embodiment 2]
The unauthorized access point detection system according to the second embodiment will be described with reference to the drawings. Fig. 7 is a block diagram showing a schematic configuration of the unauthorized access point detection system according to the second embodiment.

The unauthorized access point detection system 1 is a system that detects unauthorized access points. The unauthorized access point detection system 1 is configured such that authorized access points 10A-10N, 20 and a management terminal 30 are communicably connected via a network 40. The unauthorized access point detection system 1 is configured such that when an unauthorized access point is detected by any of the authorized access points 10A-10N, 20 (e.g., authorized access point 10A), it sends an email to the management terminal 30 notifying the presence of the unauthorized access point. The authorized access points 10A-10N, 20 include a first authorized access point 10A-10N and a second authorized access point 20.

The first legitimate access points 10A to 10N each include a wireless connection unit 12 and a request transmission unit 13. The wireless connection unit 12 is configured to transmit a password related to the same identification information as that of the first legitimate access points 10A to 10N themselves to the other access points to attempt a wireless connection with the other access points, and to obtain identification information related to the other access points from the other access points when the wireless connection with the other access points is successful. The request transmission unit 13 is configured to transmit request information including the identification information related to the other access points to the second legitimate access point 20 when the wireless connection unit 12 obtains the identification information related to the other access points.

The second legitimate access point 20 includes a management database 25, an analysis unit 24, and an email sending unit 26. The management database 25 stores data on whether or not an access point is an acceptable access point based on the identification information associated with the access point. The analysis unit 24 is configured to analyze, based on the management database 25, whether or not another access point associated with the identification information included in the request information is an unauthorized access point. The email sending unit 26 is configured to send an email to the management terminal 30 notifying the existence of the unauthorized access point when it is determined that the other access point is an unauthorized access point.

According to the second embodiment, when any of the first legitimate access points 10A to 10N succeeds in wirelessly connecting to another access point, the identification information related to the other access point obtained from the other access point is collected in the second legitimate access point 20 to detect an unauthorized access point. This simplifies the configuration of the first legitimate access points 10A to 10N, and allows the first legitimate access points 10A to 10N to monitor unauthorized access points 50 over a wide area, thereby contributing to monitoring unauthorized access points over a wide area at low cost.

The access point in the unauthorized access point detection system according to the first and second embodiments can be configured to include so-called hardware resources (information processing device, computer), and the hardware resource can include the configuration shown in FIG. 8. For example, the hardware resource 100 includes a processor 101, a memory 102, a network interface 103, and the like, which are interconnected by an internal bus 104.

Note that the configuration shown in FIG. 8 is not intended to limit the hardware configuration of the hardware resource 100. The hardware resource 100 may include hardware (e.g., an input/output interface) that is not shown. Furthermore, the number of units such as the processor 101 included in the device is not intended to be limited to the example shown in FIG. 8, and for example, multiple processors 101 may be included in the hardware resource 100. The processor 101 may be, for example, a CPU (Central Processing Unit), an MPU (Micro Processor Unit), a GPU (Graphics Processing Unit), etc.

Memory 102 may be, for example, a RAM (Random Access Memory), a ROM (Read Only Memory), a HDD (Hard Disk Drive), or a SSD (Solid State Drive).

The network interface 103 may be, for example, a LAN (Local Area Network) card, a network adapter, a network interface card, etc.

The functions of the hardware resource 100 are realized by the above-mentioned processing module. The processing module is realized, for example, by the processor 101 executing a program stored in the memory 102. The program can be downloaded via a network or updated using a storage medium on which the program is stored. Furthermore, the processing module may be realized by a semiconductor chip. In other words, it is sufficient that the functions performed by the processing module are realized by the execution of software in some kind of hardware.

A part or all of the above embodiments may be described as follows, but is not limited to the following:

[Appendix 1]
1. An unauthorized access point detection system, comprising: a plurality of authorized access points and a management terminal connected to each other via a network so as to be capable of communicating with each other; and configured to transmit an email to the management terminal when an unauthorized access point is detected by any one of the plurality of authorized access points, the email notifying the management terminal of the presence of the unauthorized access point,
One or more first authorized access points among the plurality of authorized access points are
a wireless connection unit configured to transmit a password related to the same identification information as that of the first authorized access point to another access point, to attempt a wireless connection with the other access point, and to obtain, from the other access point, the identification information related to the other access point when the wireless connection with the other access point is successful;
a request sending unit configured, when the wireless connection unit of the first authorized access point acquires the identification information related to the other access point, to send request information including the identification information related to the other access point to a second authorized access point other than the first authorized access point among the plurality of authorized access points;
Equipped with
The second authorized access point is
a management database in which data is registered as to whether or not an access point is an acceptable access point with respect to identification information relating to the access point;
an analysis unit configured to analyze, based on the management database, whether the other access point associated with the identification information included in the request information is the unauthorized access point;
an email sending unit configured to send an email notifying the management terminal of the existence of the unauthorized access point when the other access point is determined to be the unauthorized access point;
Equipped with
Rogue access point detection system.
[Appendix 2]
the second authorized access point further includes a wireless connection unit configured to transmit a password related to the same identification information as that of the second authorized access point itself to another access point to attempt a wireless connection with the other access point, and to obtain, from the other access point, the identification information related to the other access point when the wireless connection with the other access point is successful;
the analysis unit is configured to analyze, based on the management database, whether or not the other access point related to the identification information acquired by the wireless connection unit of the second legitimate access point is the unauthorized access point.
2. The unauthorized access point detection system of claim 1.
[Appendix 3]
the analysis unit determines that the unauthorized access point is present when the identification information related to the other access point does not match the identification information registered in the management database.
3. The unauthorized access point detection system according to claim 1 or 2.
[Appendix 4]
the analysis unit is configured to register the other access point in the management database as an unacceptable access point when the identification information related to the other access point does not match the identification information registered in the management database.
4. The unauthorized access point detection system according to claim 1,
[Appendix 5]
the analysis unit is configured to determine that the unauthorized access point exists when the identification information related to the other access point matches the identification information registered in the management database and is registered in the management database as an unacceptable access point.
5. The unauthorized access point detection system according to claim 1 ,
[Appendix 6]
the request transmission unit is configured to transmit the request information to the second authorized access point through HTTP communication.
6. The unauthorized access point detection system according to claim 1,
[Appendix 7]
The identification information of the other access point is a MAC address or a BSSID.
7. The unauthorized access point detection system according to claim 1 ,
[Appendix 8]
the request transmission unit is configured to transmit the request information to the second authorized access point by a communication method different from a communication method between the first authorized access point and the other access point;
8. The unauthorized access point detection system according to claim 1 ,
[Appendix 9]
the analysis unit is configured to determine that the unauthorized access point does not exist when the identification information related to the other access point matches the identification information registered in the management database and is registered in the management database as an allowable access point.
9. An unauthorized access point detection system according to any one of claims 1 to 8.
[Appendix 10]
A unauthorized access point detection system in which a plurality of authorized access points and a management terminal are communicably connected via a network, and which is configured to transmit an email notifying the management terminal of the presence of an unauthorized access point when any of the authorized access points detects an unauthorized access point, said unauthorized access point being one or more predetermined access points (corresponding to a first authorized access point) among the plurality of authorized access points;
a wireless connection unit configured to transmit a password related to the same identification information as that of the predetermined access point itself to another access point, to attempt a wireless connection with the other access point, and to obtain, from the other access point, the identification information related to the other access point when the wireless connection with the other access point is successful;
a request transmission unit configured to transmit, when the wireless connection unit of the predetermined access point acquires the identification information related to the other access point, request information including the identification information related to the other access point to one other predetermined access point (corresponding to a second legitimate access point) different from the predetermined access point among the plurality of legitimate access points;
Equipped with
Access point (corresponding to the first authorized access point).
[Appendix 11]
A unauthorized access point detection system in which a plurality of authorized access points and a management terminal are communicably connected via a network, and which is configured to transmit an email notifying the management terminal of the presence of an unauthorized access point when any of the authorized access points detects an unauthorized access point, said predetermined access point (corresponding to a second authorized access point) among the plurality of authorized access points,
The predetermined access point is
a management database in which data is registered as to whether or not an access point is an acceptable access point with respect to identification information relating to the access point;
an analysis unit configured to analyze, based on the management database, whether or not a second access point associated with identification information included in request information from another predetermined access point (corresponding to a first legitimate access point) different from the first predetermined access point among the plurality of legitimate access points is the unauthorized access point;
an email sending unit configured to send an email notifying the management terminal of the existence of the unauthorized access point when the other access point is determined to be the unauthorized access point;
Equipped with
Access point (corresponding to the second regular access point).
[Appendix 12]
A method for detecting a rogue access point using a rogue access point detection system, the system being configured such that a plurality of authorized access points and a management terminal are communicably connected via a network, and that when a rogue access point is detected by any of the plurality of authorized access points, the system transmits an email notifying the management terminal of the presence of the rogue access point, the method comprising:
a step of transmitting, in one or more first authorized access points among the plurality of authorized access points, a password related to the same identification information as that of the first authorized access point itself to another access point to attempt a wireless connection with the other access point, and acquiring, when the wireless connection with the other access point is successful, the identification information related to the other access point from the other access point;
a step of transmitting, in the first legitimate access point, when the first legitimate access point acquires the identification information related to the other access point, request information including the identification information related to the other access point to a second legitimate access point among the plurality of legitimate access points that is different from the first legitimate access point;
a step of analyzing, in the second legitimate access point, whether or not the other access point associated with the identification information included in the request information is the unauthorized access point based on a management database in which data on whether or not the access point is an allowable access point according to identification information associated with the access point is registered;
a step of, when the second authorized access point determines that the other access point is the unauthorized access point, sending an email to the management terminal to notify the existence of the unauthorized access point;
including,
A method for detecting unauthorized access points.
[Appendix 13]
A unauthorized access point detection system is configured such that a plurality of authorized access points and a management terminal are communicably connected via a network, and when an unauthorized access point is detected at any one of the plurality of authorized access points, the unauthorized access point detection system transmits an email notifying the management terminal of the presence of the unauthorized access point, the program causing one or more predetermined access points (corresponding to a first authorized access point) among the plurality of authorized access points to execute a process of detecting the unauthorized access point,
a process of transmitting a password related to the same identification information as that of the predetermined access point itself to another access point to attempt a wireless connection with the other access point, and acquiring identification information related to the other access point from the other access point when the wireless connection with the other access point is successful;
a process of transmitting, when the wireless connection unit of the predetermined access point acquires the identification information related to the other access point, request information including the identification information related to the other access point to one other predetermined access point (corresponding to a second legitimate access point) different from the predetermined access point among the plurality of legitimate access points;
The program causes the predetermined access point (corresponding to the first authorized access point) to execute the above.
[Appendix 14]
A program for causing a predetermined access point (corresponding to a second authorized access point) among a plurality of authorized access points in a unauthorized access point detection system, the unauthorized access point detection system being configured such that a plurality of authorized access points and a management terminal are communicably connected via a network, and an email notifying the management terminal of the presence of an unauthorized access point when an unauthorized access point is detected by any of the plurality of authorized access points, the program causing the predetermined access point (corresponding to a second authorized access point) among the plurality of authorized access points to execute a process for detecting the unauthorized access point,
a process of analyzing whether an access point associated with identification information included in request information from another predetermined access point (corresponding to a first legitimate access point) different from the predetermined access point among the plurality of legitimate access points is the unauthorized access point based on a management database in which data on whether the access point is an allowable access point according to identification information associated with the access point is registered;
a process of sending an email to the management terminal when the other access point is determined to be the unauthorized access point, notifying the management terminal of the existence of the unauthorized access point;
The program causes the predetermined access point (corresponding to the second authorized access point) to execute the above.

The disclosures of the above patent documents are incorporated herein by reference and may be used as the basis or part of the present invention as necessary. Within the framework of the entire disclosure of the present invention (including the claims and drawings), and further based on the basic technical ideas, modifications and adjustments of the embodiments and examples are possible. Furthermore, within the framework of the entire disclosure of the present invention, various combinations or selections (or non-selection as necessary) of various disclosed elements (including each element of each claim, each element of each embodiment or example, each element of each drawing, etc.) are possible. In other words, the present invention naturally includes various modifications and corrections that a person skilled in the art would be able to make in accordance with the entire disclosure, including the claims and drawings, and the technical ideas. Furthermore, with regard to the numerical values and numerical ranges described in this application, any intermediate value, lower numerical value, and small range are considered to be described even if not specified. Furthermore, the disclosures of the above cited documents may be used in part or in whole in combination with the descriptions in this document as part of the disclosure of the present invention in accordance with the spirit of the present invention as necessary, and are considered to be included (belong) to the disclosures of this application.

1 Unauthorized access point detection system 10A to 10N First authorized access point 11 Wireless providing unit 12 Wireless connection unit 13 Request sending unit 20 Second authorized access point 21 Wireless providing unit 22 Wireless connection unit 23 Request receiving unit 24 Analysis unit 25 Management database 26 Mail sending unit 30 Management terminal 40 Network 50 Unauthorized access point 60 User terminal 100 Hardware resources 101 Processor 102 Memory 103 Network interface 104 Internal bus

Claims (10)

1. An unauthorized access point detection system, comprising: a plurality of authorized access points and a management terminal connected to each other via a network so as to be capable of communicating with each other; and configured to transmit an email to the management terminal when an unauthorized access point is detected by any one of the plurality of authorized access points, the email notifying the management terminal of the presence of the unauthorized access point,
One or more first authorized access points among the plurality of authorized access points are
a wireless connection unit configured to transmit a password related to the same identification information as that of the first authorized access point to another access point, to attempt a wireless connection with the other access point, and to obtain, from the other access point, the identification information related to the other access point when the wireless connection with the other access point is successful;
a request sending unit configured, when the wireless connection unit of the first authorized access point acquires the identification information related to the other access point, to send request information including the identification information related to the other access point to a second authorized access point other than the first authorized access point among the plurality of authorized access points;
Equipped with
The second authorized access point is
a management database in which data on whether an access point is an acceptable access point is registered based on identification information relating to the access point;
an analysis unit configured to analyze, based on the management database, whether the other access point associated with the identification information included in the request information is the unauthorized access point;
an email sending unit configured to send an email notifying the management terminal of the existence of the unauthorized access point when the other access point is determined to be the unauthorized access point;
Equipped with
Rogue access point detection system. the second authorized access point further includes a wireless connection unit configured to transmit a password related to the same identification information as that of the second authorized access point itself to another access point to attempt a wireless connection with the other access point, and to obtain, from the other access point, the identification information related to the other access point when the wireless connection with the other access point is successful;
the analysis unit is configured to analyze, based on the management database, whether or not the other access point related to the identification information acquired by the wireless connection unit of the second legitimate access point is the unauthorized access point.
2. The unauthorized access point detection system according to claim 1. the analysis unit determines that the unauthorized access point is present when the identification information related to the other access point does not match the identification information registered in the management database.
3. The unauthorized access point detection system according to claim 1 or 2. the analysis unit is configured to register the other access point in the management database as an unacceptable access point when the identification information related to the other access point does not match the identification information registered in the management database.
4. The unauthorized access point detection system according to claim 1. the analysis unit is configured to determine that the unauthorized access point exists when the identification information related to the other access point matches the identification information registered in the management database and the unauthorized access point is registered in the management database as an unacceptable access point.
5. The unauthorized access point detection system according to claim 1. the request transmission unit is configured to transmit the request information to the second authorized access point by HTTP communication.
6. The unauthorized access point detection system according to claim 1. The identification information of the other access point is a MAC address or a BSSID.
7. The unauthorized access point detection system according to claim 1. A unauthorized access point detection system is configured such that a plurality of authorized access points and a management terminal are communicably connected via a network, and when an unauthorized access point is detected at any one of the authorized access points, the unauthorized access point detects the presence of the unauthorized access point by transmitting an email to the management terminal, the email including one or more predetermined access points among the authorized access points,
a wireless connection unit configured to transmit a password related to the same identification information as that of the predetermined access point itself to another access point, to attempt a wireless connection with the other access point, and to obtain, from the other access point, the identification information related to the other access point when the wireless connection with the other access point is successful;
a request transmission unit configured to transmit, when the wireless connection unit of the predetermined access point acquires the identification information related to the other access point, request information including the identification information related to the other access point to one other predetermined access point different from the predetermined access point among the plurality of authorized access points;
Equipped with
access point. A predetermined access point among a plurality of authorized access points in an unauthorized access point detection system, the predetermined access point being configured to transmit an email to the management terminal when a unauthorized access point is detected by any one of the authorized access points, the email notifying the management terminal of the presence of the unauthorized access point,
The predetermined access point is
a management database in which data is registered as to whether or not an access point is an acceptable access point with respect to identification information relating to the access point;
an analysis unit configured to analyze, based on the management database, whether or not another access point related to identification information included in request information from another predetermined access point different from the predetermined access point among the plurality of authorized access points is the unauthorized access point;
an email sending unit configured to send an email notifying the management terminal of the existence of the unauthorized access point when the other access point is determined to be the unauthorized access point;
Equipped with
access point. A method for detecting a rogue access point using a rogue access point detection system, the system being configured such that a plurality of authorized access points and a management terminal are communicably connected via a network, and that when a rogue access point is detected by any of the plurality of authorized access points, the system transmits an email to the management terminal notifying the presence of the rogue access point, the method comprising:
a step of transmitting, in one or more first authorized access points among the plurality of authorized access points, a password related to the same identification information as that of the first authorized access point itself to another access point to attempt a wireless connection with the other access point, and acquiring, when the wireless connection with the other access point is successful, the identification information related to the other access point from the other access point;
a step of transmitting, in the first legitimate access point, when the first legitimate access point acquires the identification information related to the other access point, request information including the identification information related to the other access point to a second legitimate access point among the plurality of legitimate access points that is different from the first legitimate access point;
a step of analyzing, in the second legitimate access point, whether or not the other access point associated with the identification information included in the request information is the unauthorized access point based on a management database in which data on whether or not the access point is an allowable access point according to identification information associated with the access point is registered;
a step of, when the second authorized access point determines that the other access point is the unauthorized access point, sending an email to the management terminal to notify the existence of the unauthorized access point;
including,
A method for detecting unauthorized access points.

Images