JP2007174287A - Radio packet communication system, radio packet base station, radio packet terminal and illegal communication canceling method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a system for improving security in the environment allowing co-existence of multiple WLANs. <P>SOLUTION: The regular AP11 to 13 or regular STA31, 32 of WLAN refer to a monitoring server 61 to check whether the transmitting source is regularly registered or not when these are monitoring a beacon of unknown transmitting source. If the beacon transmitting source is illegal AP21 to 23 not registered to the monitoring server 61, the regular AP11 to 13 or regular STA31, 32 cancel the communication between illegal AP and illegal STA by transmitting disguised packets (posed packet) such as dummy ACK packet or the like. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to a wireless packet communication system, a wireless packet base station, a wireless packet terminal, and an unauthorized communication elimination method, and in particular, eliminates unauthorized communication in a wireless section between an unregistered wireless packet base station and a wireless packet terminal under its control. Related to technology.

  Wireless network systems represented by wireless LAN (Local Area Network; hereinafter referred to as “WLAN”) have been developed to perform packet communication while sharing public radio frequency resources with other peripheral systems. -It has become easy to introduce due to price reduction and availability of equipment. Against this backdrop, in terms of security, there are many systems in the vicinity, and it is urgent to see how to build a defense function against unauthorized network intrusion and a defense function against leakage of personal information / secret information. It has become a challenge. Further, in standardization work, measures for strengthening security have been further required.

  In particular, in WLAN, there is a possibility of intrusion from the outside by a wireless LAN base station (access point; hereinafter referred to as “AP”) that is illegally installed. For example, Japanese Patent Laid-Open No. 2005-184719 discloses each AP. Includes a means for receiving status information of other APs and a transmission means for transmitting the status information to the monitoring device, and the monitoring device counts the information to allow the administrator to report the existence of an unauthorized AP to the wireless LAN. A system is disclosed.

  Japanese Patent Laid-Open No. 2003-198571 discloses a AP list in which a wireless LAN terminal (station; hereinafter referred to as “STA”) transmits an AP search result to a controller connected to the WLAN, and the controller is registered in advance. A network security system that detects unauthorized APs by collating with the above is disclosed.

  Also, in International Publication WO 2005/081460, an operation management device that detects an unauthorized AP based on a BSSID included in a radio frame and notifies the STA to be managed to prohibit the use of the unauthorized AP. A wireless communication system is disclosed.

JP 2005-184719 A JP 2003-198571 A International Publication WO2005 / 081460

  10 and 11 are diagrams showing a configuration example of a conventional WLAN system. In the example of FIG. 10, a registered AP (hereinafter referred to as “R-AP”) 20 that is authorized to connect normally is connected to the subnetwork 100 by the authentication server 51 or manually. Here, a case is considered in which unregistered APs (hereinafter referred to as “NR-AP”) 21 to 23 that are not authorized to be connected are wiredly connected. It is known that the NR-AP can be detected by adopting an authentication method in which communication on the network is permitted by completing the authentication to the authentication server 51, but the NR-AP and an unregistered STA connected to the NR-AP are known. There is a problem in that communication performed in the wireless section between (hereinafter referred to as “NR-STA”) cannot be excluded.

  Similarly, in the example of FIG. 11, the R-AP 20 is normally connected to a certain subnetwork 100 by the authentication server 51 or manually. NR-APs 21 to 23 are connected to another subnetwork 101 independent of the subnetwork 100. In this case, communication performed in the wireless section between NR-AP and NR-STA cannot be excluded, and it is necessary to have management authority for subnetwork 101 in order to detect NR-APs 21 to 23. There is a problem that there is.

  The present invention has been made in view of the above-described circumstances, and provides a wireless packet communication mechanism capable of improving the security by eliminating the wireless communication of other systems in an environment where a plurality of wireless communication networks coexist. There is to do.

  According to a first aspect of the present invention, there is provided a wireless packet communication system including a wireless packet base station (AP), a wireless packet terminal (STA), and a monitoring server (SV), wherein the monitoring server ( SV) includes means for registering and managing a properly authenticated radio packet base station (R-AP), and when the radio packet base station (R-AP) intercepts a beacon of an unknown source, Means for inquiring to the monitoring server (SV) whether or not the radio packet base station that is the source of the beacon is an unregistered radio packet base station (NR-AP); When it is determined that the packet is a radio packet base station (NR-AP), the mode shifts to an exclusion mode in which the unregistered radio packet base station (NR-AP) is excluded, and the unregistered radio packet base station (NR-AP) Connect By transmitting impersonation information deceiving a radio packet terminal (NR-STA), communication between the unregistered radio packet base station (NR-AP) and its connected radio packet terminal (NR-STA) is eliminated (disturbance) A wireless packet communication system, and an apparatus constituting the wireless packet communication system.

  Further, according to a second aspect of the present invention, there is provided a method for eliminating unauthorized communication between an unregistered radio packet base station (NR-AP) and its connected radio packet terminal (NR-STA) in a radio packet communication system. When the wireless packet base station (NR-AP) intercepts a beacon of an unknown transmission source, the monitoring server (SV) that registers and manages the correctly authenticated wireless packet base station (R-AP) Inquiring whether the beacon transmission source radio packet base station is an unregistered radio packet base station (NR-AP), and as a result of the inquiry, an unregistered radio packet base station (NR-AP) The wireless packet base station (R-AP) shifts to an exclusion mode in which the unregistered wireless packet base station (NR-AP) is excluded, and the unregistered wireless packet base station Include sending impersonation information deception wireless packet terminals (NR-STA) that connects to the NR-AP), a method for eliminating improper communication, wherein is provided.

  ADVANTAGE OF THE INVENTION According to this invention, it becomes possible to improve the security of the radio | wireless area of a radio | wireless packet communication system, and to construct | assemble the environment which is easy to catch an unauthorized access.

[First Embodiment]
Next, the best mode for carrying out the present invention will be described in detail with reference to the drawings. 1 and 2 are diagrams showing a configuration example of a WLAN system according to an embodiment of the present invention. Referring to FIG. 1, the R-AP 11 to 13 and the R-STAs 31 and 32 include monitoring control units 111, 121, 131, 311, and 321, respectively, with respect to the conventional WLAN system of FIG. The monitoring server 61 is connected to the network 100.

  Referring to FIG. 2, the R-APs 11 to 13 and the R-STAs 31 and 32 have monitoring control units 111, 121, 131, 311, and 321, respectively, with respect to the conventional WLAN system of FIG. 11. And, it is different in that a monitoring server 61 is connected to the network 100.

  According to the present invention, the configuration including the monitoring control unit and the monitoring server monitors peripheral wireless packets, and the device-specific MAC address (Media Access Control Address), BSSID (Basic Service Set IDentifier), etc. Whether or not it is R-AP or R-STA, and if unregistered, control for eliminating communication in the wireless section (between NR-AP 21 and NR-STA 41 in FIGS. 1 and 2) It is characterized by implementing.

  Next, a detailed configuration of each device for performing the above control will be described. FIG. 3 is a block diagram showing the detailed configuration of the R-STA, R-AP, and monitoring server according to an embodiment of the present invention. FIG. 4 is a block diagram showing detailed configurations of the NR-STA, NR-AP, and authentication server.

  First, referring to FIG. 4, the NR-AP 21 has the same configuration as a conventional radio base station apparatus, and includes a network interface (hereinafter referred to as “I / F”) unit 213, an AP control unit 214, a MAC A control unit 215, a PHY MODEM unit 216, and an RF transmission / reception unit 217 are configured and connected to the network 100.

  The network I / F unit 213 is a unit that manages I / F with the subnetwork 100, and the AP control unit 214 is a unit that controls the entire NR-AP. The MAC control unit 215 is a means for managing packet analysis / generation and their timing, and the PHY MODEM unit 216 provides a modulation / demodulation function. In addition, the RF transmission / reception unit 217 is a unit that manages a wireless interface with the STA.

  When AP authentication is performed on the authentication server 51 on the network, the NR-AP 21 makes an inquiry (AP registration request) to the AP / STA authentication control unit 512 of the authentication server 51, and authentication is permitted (AP registration). ) Can be exchanged on the network 100.

  The NR-STA 41 includes an application / driver 412, a CPU / CPU I / F 413, and a WLAN card or an internally mounted communication module (WLAN module). The WLAN module includes a module I / F 414, a MAC control unit 415, a PHY MODEM unit 416, and an RF transmission / reception unit 417, and transmits / receives data from the application driver 412 via the module I / F 414. It is possible.

  Referring to FIG. 3, the R-AP 11 has a configuration including a monitoring control unit 111 in addition to the configuration of the NR-AP 21 described above. The monitoring control unit 111 performs timing and wireless packet monitoring on the RF transmission / reception unit 117, the PHY MODEM unit 116, the MAC control unit 115, and the AP control unit 114.

  Similarly, as shown in FIG. 3, the R-STA 31 also includes a monitoring control unit 311 in addition to the configuration of the NR-STA 41 described above.

  The monitoring server 61 includes a peripheral AP management table 613 that stores and manages peripheral registered APs, and an AP management unit 612 that manages registered APs based on the peripheral AP management table 613.

  In the example of FIG. 3, the authentication server 51 and the management server 61 are separately provided. However, by adding the AP management unit 612 and the peripheral AP management table 613 to the authentication server 51, the monitoring server It is also possible to function as 61.

  Next, the operation of this embodiment will be described in detail with reference to the drawings. FIG. 5 is a diagram for explaining the operation of the first exemplary embodiment of the present invention in which communication via an unregistered AP is excluded using a pseudo ACK response packet that spoofs a transmission source. Referring to FIG. 5, when NR-AP 21 transmits a beacon to NR-STA 41, R-AP 11 and R-STA 31 arranged at a position where they can be intercepted intercepts this.

  For example, when the R-AP 11 intercepts a beacon (Yes in step S001), the R-AP 11 extracts the MAC address and BSSID information from the beacon, and the AP to which the NR-AP 21 has been registered with respect to the monitoring server 61. Is inquired (step S004).

  Further, for example, when the R-STA 31 intercepts a beacon (Yes in step S002), the R-STA 31 extracts the MAC address or BSSID information from the beacon, and the AP to which the NR-AP 21 is registered with respect to the R-AP 11 It is requested to confirm whether or not (step S003). Also in this case, the R-AP 11 transmits the MAC address or BSSID information received from the R-STA 31 to the monitoring server 61 and inquires whether the NR-AP 21 is a registered AP (step S004).

  Upon receiving the MAC address or BSSID information from the R-AP 11, the monitoring server 61 searches the peripheral AP management table 613 via the AP management unit 612, and searches the BSSID or MAC from the list of R-APs on the peripheral AP management table 613. It is determined whether or not there is an AP with a matching address, and the result is returned (step 005). For example, when the AP that has received the inquiry has been registered in the peripheral AP management table 613, an acknowledgment (registered AP) is transmitted, and the AP that has received the inquiry has not been registered in the peripheral AP management table 613. In this case, a negative response (unregistered AP) is transmitted.

  The R-AP 11 simultaneously notifies the inquiry result received from the monitoring server 61 to all the subordinate R-STAs (step S006). This simultaneous notification may be transmitted using multicast or may be transmitted individually using unicast.

  When the AP inquiry result is an affirmative response (registered AP), no interference is particularly performed (see the unregistered AP exclusion mode release state between steps S024 to S025 in FIG. 6), but the AP inquiry result is a negative response. In the case of (unregistered AP), R-AP11 and R-STA31 are the main entities, and an unregistered AP exclusion mode for performing a wireless access rejection operation related to NR-AP21 is started (step S007).

  When shifting to the unregistered AP exclusion mode, when the monitoring control units 111 and 311 of the R-AP 11 and the R-STA 31 receive the transmission packet of the NR-AP 21 on the radio (Yes in steps S008 and S009), the address of the reception packet When the analysis is performed and the BSSID to be excluded or the MAC address to be excluded matches, the MAC address of the communication partner is impersonated, and a pseudo ACK response (dummy ACK response) is transmitted (steps S010 and S011).

  At this time, the monitoring control units 111 and 311 may transmit the pseudo ACK packet as a normal packet without an FCS (Frame Check Sequence) error, or may return a pseudo ACK packet with an FCS error. Also, with regard to the transmission timing, it is possible to prevent an ACK response from a genuine communication partner by advancing a SIFS (Short Inter Frame Sequence) time by a fixed time such as 1 μs, for example, from the standard.

  Even if the beacon that is first intercepted is that of an unregistered AP, the unregistered AP exclusion mode can be canceled if the beacon is a legitimate AP that can be authenticated by the authentication server 51. Hereinafter, it will be described in detail with reference to FIG.

  The operation from step S001 to S010 in FIG. 6 is the same as in FIG. 5. When a beacon that is a regular AP (R-AP12) but is not registered is received, R-AP11 and R-STA31 Transition to unregistered AP exclusion mode.

  When the legitimate AP (R-AP12) transmits an AP registration request to the monitoring server 61 manually or via wired Ethernet (registered trademark) (step S020), the monitoring server 61 adds an R to the peripheral AP management table 613. -Register AP12 and respond to that effect (step S021).

  Further, the monitoring server 61 notifies the other AP including the R-AP 11 of the new AP registration result (step 022). The R-AP 11 simultaneously notifies the AP registration result received from the monitoring server 61 to all the R-STAs under its control (step S023).

  As described above, the unregistered AP exclusion mode is canceled, and the interference between the R-AP 11 and the R-STA 31 in the communication between the R-AP 12 and the R-STA 32 is interrupted.

  Conversely, when the R-AP 12 transmits an AP release request to the monitoring server 61 manually or via wired Ethernet (registered trademark) (step S025), the monitoring server 61 reads the R-AP from the peripheral AP management table 613. The AP 12 is deleted and a response to that effect is sent (step S026).

  Furthermore, the monitoring server 61 notifies the AP cancellation result of the R-AP 12 to other APs including the R-AP 11 (step 027). The R-AP 11 notifies the AP cancellation result received from the monitoring server 61 to all of the subordinate R-STAs simultaneously (step S028).

  As described above, the unregistered AP exclusion mode is resumed, and the interference between the R-AP 12 and the R-STA 32 by the R-AP 11 and the R-STA 31 is resumed.

  As is clear from the above description, if either R-AP or R-STA can receive a beacon and send a pseudo ACK packet, communication between unregistered AP-STAs can be eliminated, and the R-STA side However, from the viewpoint of improving the monitoring / exclusion performance, it is preferable to provide a monitoring control unit on the R-STA side as well. The reason will be described below.

  FIG. 7 is a diagram for explaining the monitoring performance of the WLAN system according to the present embodiment. As shown in FIG. 7, when R-AP11, NR-AP21, and NR-AP22 are arranged, the wireless communication possible ranges are ranges 91, 92, and 93, respectively. At this time, if each AP and STA have the same frequency, each AP and STA can transmit and receive packets in a time division manner, including STAs that can be received within the wireless communicable range.

  On the other hand, APs and STAs outside the wireless communicable range cannot transmit / receive packets. For example, the NR-AP 21 outside the range 91 cannot receive the communication of the R-AP 11, and therefore almost the same as the R-AP 11. If packet transmission is executed at the same time, a wireless collision occurs, and the R-STA 31 and the NR-STA 41 that can receive both wireless communications fall into a state in which both packets cannot be received. Similarly, in FIG. 7, the R-AP 11 can recognize that the NR-STA 44 is transmitting, but since the NR-STA 45 is not known, the R-AP 11 and the NR-STA 45 have almost the same time. If the packet transmission is executed, the NR-STA 44 may be in a state where it cannot be received due to a packet collision. These are generally called “hidden terminal” problems.

  In this embodiment, a monitoring control unit is also installed on each STA side so that peripheral wireless communication can be detected and blocked from all STAs in the WLAN system, so that the WLAN system as a whole covers a wider range. Is possible.

  Of course, depending on the required security strength and cost, the monitoring control on the STA side can be omitted and the monitoring can be performed only with the regular AP. In addition, by preparing drivers that operate wireless modules such as WLAN cards, monitoring control on the STA side described above can be introduced to enable monitoring of hidden terminals and communication control, thereby enhancing security afterwards. Is possible.

  As described above, by providing the unregistered AP exclusion mode that interferes with communication between unregistered APs and STAs in the wireless section, security improvement in the WLAN is achieved. Further, as is clear from the above-described embodiment, a mechanism for constantly monitoring unauthorized APs from outside or unauthorized STA intrusions via this and unauthorized communication states is constructed. Thus, an environment in which unauthorized access can be easily captured is realized. In addition, since the use of limited and unique radio frequency resources due to unauthorized communication can be suppressed to the minimum, the effect of ensuring as much as possible the communication band and communication throughput in regular communication is also exhibited.

[Second Embodiment]
Next, a second embodiment of the present invention that can be realized with the same configuration as the first embodiment will be described. FIG. 8 is a diagram for explaining the operation of the second exemplary embodiment of the present invention in which the R-AP and R-STA actively excludes communication in the unregistered AP exclusion mode.

  Referring to FIG. 8, when the NR-AP 21 transmits a beacon to the NR-STA 41, the R-AP 11 and the R-STA 31 arranged at a position where they can be intercepted can intercept it. Consider a case where the STA 41 performs an attribution procedure for the NR-AP 21.

  When the NR-STA 41 transmits a probe request (hereinafter referred to as “ProbeReq”) when searching for a neighboring BSSID or the like in an attempt to belong to the NR-AP 21, the R-AP 11 and the R-STA 31 intercept it.

  A probe response (hereinafter referred to as “ProbeRsp”) from the NR-AP 21 to ProbeReq is also intercepted by the R-AP 11 and R-STA 31. After that, when the NR-AP 21 and the NR-STA 41 complete the belonging operation according to a normal belonging procedure such as an association request (hereinafter referred to as “AssocReq”), an association response (hereinafter referred to as “AssocRsp”), the NR-AP 21 and the NR-STA 41 -The STA 41 is ready for wireless communication.

  However, when the R-AP 11 or R-STA 31 detects a probe request / response (steps S101 and S102), it makes an inquiry to the monitoring server 61 (steps S103 and S104).

  As a result of the inquiry, if it is found that the probe request / response is for an unregistered AP (step S105), the R-AP 11 and R-STA 31 can cancel the unregistered AP in the same manner as in the first embodiment. (Steps S106 and S107).

  Then, during the unregistered AP exclusion mode, the R-AP 11 and R-STA 31 impersonate the NR-AP 21 and perform pseudo-disassociation with the NR-STA 41 periodically or at each completion of re-assignment or completion of assignment. A procedure (hereinafter referred to as “DisAssoc”) is executed (steps S108 and S109).

  As described above, the attribution of the NR-STA 41 to the NR-AP 21 is canceled at a predetermined timing, and unauthorized wireless communication is excluded as in the first embodiment. In this embodiment, since monitoring control takes time until the transition to the unregistered AP exclusion mode is completed and the transition to the unregistered AP exclusion mode is completed, a part of the wireless communication packet to be originally excluded May be used in combination with other exclusion methods.

[Third Embodiment]
Next, a third embodiment of the present invention that can be realized with the same configuration as that of the first embodiment will be described. FIG. 9 is a diagram for explaining the operation of the third exemplary embodiment of the present invention in which the R-AP and R-STA perform a packet collision in the unregistered AP exclusion mode to perform the exclusion.

  Referring to FIG. 9, the operations until the R-AP 11 and R-STA 31 shift to the unregistered AP exclusion mode based on the intercepted radio frame (steps S201 to S207 in FIG. 9) are described in the first embodiment. It is the same.

  When shifting to the unregistered AP exclusion mode (step S207), when the R-AP11 and R-STA31 intercept the packet (steps S208 and S209), the header information is analyzed and the packet from the exclusion target AP (NR-AP21) is received. A pseudo packet is transmitted according to the length (steps S210 and S211). As a result, when packet transmission from the exclusion target AP (NR-AP21) is still continued, it is possible to collide packets on the radio and eliminate unauthorized wireless communication.

  As a pseudo packet, a pseudo ACK packet may be transmitted as in the first embodiment, or a pseudo data packet may be transmitted. When the former pseudo ACK packet is used, a pseudo ACK packet without an FCS error and a pseudo ACK packet with an FCS error can be selected. Also, for the transmission timing, the SIFS time is set to a fixed time such as 1 μs, for example, compared to the standard. It is possible to set ahead of time.

  When the latter pseudo data packet is used, the collision range is selected by increasing or decreasing the packet length by a certain length for each modulation method with respect to the actual packet data length. Further, by combining these, collision including an ACK response period for unauthorized wireless communication is possible.

  The preferred embodiments of the present invention have been described above. However, the technical scope of the present invention is not limited to the above-described embodiments, and an unregistered radio packet base station (NR-AP) is detected. In this case, the present invention of transmitting impersonation information (spoofing information; spoofing information) to the radio packet base station (NR-AP) and radio packet terminals (NR-STA) under the radio packet base station (NR-AP) and eliminating radio communication. It goes without saying that various modifications and substitutions can be made without departing from the gist of the invention.

  For example, in the above description of the embodiment, an example in which the present invention is applied to a WLAN system has been described. However, as long as a base station and a monitoring server having the above-described characteristics can be installed, the present invention is also applied to other wireless packet communications. The invention can be applied.

  In addition, for example, in the description of the above-described embodiment for the understanding of the present invention, when there are a plurality of radio frequency channels used in the WLAN system, an R-AP or R-STA monitoring control unit is provided. Each radio frequency channel to be monitored may be handled and monitoring control may be performed, and the AP management unit 612 of the monitoring server 61 may be configured to centrally control a plurality of R-APs.

  In addition, in order to sufficiently monitor every corner of the local area WLAN, it should be considered that a place where a blind spot is partially formed on the layout of the AP is generated. Depending on the strength of security required, it is necessary to use a directional antenna or the like so as not to cause blind spots.

  In addition, from the viewpoint of legal compliance and the public nature of frequency resources, the present invention adds unique control to the above-mentioned WLAN standard, so that the external general WLAN system and other frequencies in the same frequency band can be used. Care should be taken to avoid interference with the radio system. More specifically, WLAN electromagnetic waves are blocked inside and outside the building, inside and outside the floor, and indoors / outdoors by walls and ceilings that are shielded as premises WLAN, and externally in a state that does not interfere with other wireless systems. In an environment that does not affect the general WLAN or wireless system, or in an environment that does not affect the general WLAN or wireless system because it is a large space and electromagnetic waves cannot reach the adjacent land, underground facilities, or another wireless line above The realization of is considered desirable.

It is a figure showing the example of a structure of the WLAN system which concerns on the 1st Embodiment of this invention. It is a figure showing the example of a structure of the WLAN system which concerns on the 1st Embodiment of this invention. It is a block diagram showing the detailed structure of R-STA which concerns on the 1st Embodiment of this invention, R-AP, and a monitoring server. It is a block diagram showing the detailed structure of NR-STA which concerns on the 1st Embodiment of this invention, NR-AP, and an authentication server. It is a figure for demonstrating operation | movement of the WLAN system which concerns on the 1st Embodiment of this invention. It is a figure for demonstrating operation | movement of the WLAN system which concerns on the 1st Embodiment of this invention. It is a figure for demonstrating operation | movement of the WLAN system which concerns on the 1st Embodiment of this invention. It is a figure for demonstrating operation | movement of the WLAN system which concerns on the 2nd Embodiment of this invention. It is a figure for demonstrating operation | movement of the WLAN system which concerns on the 3rd Embodiment of this invention. It is a figure showing the example of a structure of the conventional WLAN system. It is a figure showing the example of a structure of the conventional WLAN system.

Explanation of symbols

11-13, 20 Wireless LAN base station (R-AP)
21-23 Unregistered wireless LAN base station (NR-AP)
31-35 Registered wireless LAN terminal (R-STA)
41 to 45 Unregistered wireless LAN terminal (NR-STA)
51 Authentication server 61 Monitoring server 91-93 AP wireless communication possible range 100, 101 (Sub) network 111, 121, 131, 311, 321 Monitoring control unit 113, 213, 511, 611 Network I / F (interface) unit 114, 214 AP control unit 115, 215 MAC control unit 116, 216 PHY MODEM unit 117, 217 RF transmission / reception unit 312, 412 Application / driver 313, 413 CPU / CPU I / F (interface)
314, 414 Module I / F (interface)
315, 415 MAC control unit 316, 416 PHY MODEM unit 317, 417 RF transmission / reception unit 512 AP / STA authentication control unit 612 AP management unit 613 Peripheral AP management table

Claims (23)

A wireless packet communication system including a wireless packet base station, a wireless packet terminal, and a monitoring server,
The monitoring server comprises means for registering and managing a wireless packet base station that has been properly authenticated,
The radio packet base station
Means for inquiring whether or not the radio packet base station of the beacon transmission source is an unregistered radio packet base station when the beacon of an unknown transmission source is intercepted;
If it is determined as an unregistered radio packet base station as a result of the inquiry, the mode shifts to an exclusion mode in which the unregistered radio packet base station is excluded, and the radio packet terminal connected to the unregistered radio packet base station is deceived. Means for eliminating communication between the unregistered radio packet base station and a radio packet terminal connected to the unregistered radio packet base station by transmitting impersonation information;
A wireless packet communication system. The radio packet base station further includes:
When it is determined as an unregistered radio packet base station as a result of the inquiry to the monitoring server, the radio packet terminal connected to the own station is provided with means for reporting the presence of the unregistered radio packet base station,
The wireless packet terminal is
Based on the notification, the mode shifts to an exclusion mode that excludes the unregistered radio packet base station, and transmits the impersonation information that deceives the radio packet terminal connected to the unregistered radio packet base station, thereby Means for eliminating communication between a packet base station and a wireless packet terminal connected to the unregistered wireless packet base station;
The wireless packet communication system according to claim 1. When the wireless packet terminal intercepts a beacon of an unknown transmission source, the wireless packet base station determines whether or not the wireless packet base station of the transmission source of the beacon is an unregistered wireless packet base station. With a means to request confirmation,
Even when the wireless packet base station receives the request, the wireless packet base station that is the transmission source of the beacon notified from the wireless packet terminal to the monitoring server is an unregistered wireless packet base station. Query whether or not
The wireless packet communication system according to claim 1 or 2. In the exclusion mode, by responding to the packet from the unregistered radio packet base station with a pseudo ACK response packet in the name of the destination of the packet, the unregistered radio packet base station and the unregistered radio packet base station Eliminating communication between wireless packet terminals connected to
The wireless packet communication system according to any one of claims 1 to 3. Based on the probe request or probe response intercepted in advance, detect a wireless packet terminal connected to an unregistered wireless packet base station,
In the exclusion mode, the wireless packet terminal connected to the unregistered wireless packet base station performs a dissociation process in the name of the unregistered wireless packet base station, whereby the unregistered wireless packet base station and Eliminating communication between radio packet terminals connected to the unregistered radio packet base station;
The wireless packet communication system according to any one of claims 1 to 3. In the exclusion mode, a pseudo packet is transmitted with respect to a packet from the unregistered radio packet base station, and a packet collision occurs to connect the unregistered radio packet base station and the unregistered radio packet base station. Eliminating communication between wireless packet terminals,
The wireless packet communication system according to any one of claims 1 to 3. A wireless packet base station that is connected to a wireless packet communication system to which a monitoring server having a means for registering and managing a wireless packet base station that is normally authenticated is connected, and constitutes an access point,
Means for inquiring whether or not the radio packet base station of the beacon transmission source is an unregistered radio packet base station when the beacon of an unknown transmission source is intercepted;
If it is determined as an unregistered radio packet base station as a result of the inquiry, the mode shifts to an exclusion mode in which the unregistered radio packet base station is excluded, and the radio packet terminal connected to the unregistered radio packet base station is deceived. Means for eliminating communication between the unregistered radio packet base station and a radio packet terminal connected to the unregistered radio packet base station by transmitting impersonation information;
A wireless packet base station. Furthermore,
As a result of the inquiry to the monitoring server, when it is determined as an unregistered radio packet base station, the radio packet terminal connected to the own station is provided with means for reporting the presence of an unregistered radio packet base station,
Based on the notification, the wireless packet terminal is shifted to an exclusion mode in which the unregistered wireless packet base station is excluded, and impersonation information for deceiving the wireless packet terminal connected to the unregistered wireless packet base station is transmitted. By eliminating communication between the unregistered radio packet base station and the radio packet terminal connected to the unregistered radio packet base station,
The radio packet base station according to claim 7. The wireless packet base station has received a request from a wireless packet terminal that has intercepted a beacon of an unknown transmission source to confirm whether the wireless packet base station of the transmission source of the beacon is an unregistered wireless packet base station Even in this case, inquiring to the monitoring server whether or not the wireless packet base station of the beacon notified from the wireless packet terminal is an unregistered wireless packet base station,
The radio packet base station according to claim 7 or 8, wherein In the exclusion mode, by responding to the packet from the unregistered radio packet base station with a pseudo ACK response packet in the name of the destination of the packet, the unregistered radio packet base station and the unregistered radio packet base station Eliminating communication between wireless packet terminals connected to
The radio packet base station according to any one of claims 7 to 9. Based on the probe request or probe response intercepted in advance, detect a wireless packet terminal connected to an unregistered wireless packet base station,
In the exclusion mode, the wireless packet terminal connected to the unregistered wireless packet base station performs a dissociation process in the name of the unregistered wireless packet base station, whereby the unregistered wireless packet base station and Eliminating communication between radio packet terminals connected to the unregistered radio packet base station;
The radio packet base station according to any one of claims 7 to 9. In the exclusion mode, a pseudo packet is transmitted with respect to a packet from the unregistered radio packet base station, and a packet collision occurs to connect the unregistered radio packet base station and the unregistered radio packet base station. Eliminating communication between wireless packet terminals,
The radio packet base station according to any one of claims 7 to 9. A wireless packet terminal connectable to a wireless packet base station constituting an access point of a wireless packet system to which a monitoring server having a means for registering and managing a wireless packet base station that has been authenticated is connected,
Based on the notification from the radio packet base station that the unregistered radio packet base station has been detected, the radio packet base station shifts to an exclusion mode in which the unregistered radio packet base station is excluded, and is connected to the unregistered radio packet base station. Comprising means for eliminating communication between the unregistered radio packet base station and the radio packet terminal connected to the unregistered radio packet base station by transmitting impersonation information deceiving the packet terminal;
A wireless packet terminal characterized by the above. Further, when a beacon of an unknown transmission source is intercepted, the wireless packet base station is requested to inquire whether the wireless packet base station from which the beacon is transmitted is an unregistered wireless packet base station. Means to
Transition to the exclusion mode based on a response from the radio packet base station to the request;
The wireless packet terminal according to claim 13. In the exclusion mode, by responding to the packet from the unregistered radio packet base station with a pseudo ACK response packet in the name of the destination of the packet, the unregistered radio packet base station and the unregistered radio packet base station Eliminating communication between wireless packet terminals connected to
The wireless packet terminal according to claim 13 or 14, characterized in that: Based on the probe request or probe response intercepted in advance, detect a wireless packet terminal connected to an unregistered wireless packet base station,
In the exclusion mode, the wireless packet terminal connected to the unregistered wireless packet base station performs a dissociation process in the name of the unregistered wireless packet base station, whereby the unregistered wireless packet base station and Eliminating communication between radio packet terminals connected to the unregistered radio packet base station;
The wireless packet terminal according to claim 13 or 14, characterized in that: In the exclusion mode, a pseudo packet is transmitted with respect to a packet from the unregistered radio packet base station, and a packet collision occurs to connect the unregistered radio packet base station and the unregistered radio packet base station. Eliminating communication between wireless packet terminals,
The wireless packet terminal according to claim 13 or 14, characterized in that: A method for eliminating unauthorized communication between an unregistered radio packet base station and a radio packet terminal connected to the unregistered radio packet base station in a radio packet communication system,
When a wireless packet base station intercepts a beacon of an unknown transmission source, the wireless packet base station that is the transmission source of the beacon is unregistered with the monitoring server that registers and manages the wireless packet base station that has been correctly authenticated. Querying whether it is a packet base station;
As a result of the inquiry, when the wireless packet base station is determined to be an unregistered wireless packet base station, the wireless packet base station shifts to an exclusion mode in which the unregistered wireless packet base station is excluded and connected to the unregistered wireless packet base station. Transmitting impersonation information deceiving a wireless packet terminal to perform,
A method of eliminating unauthorized communication characterized by the above. A method for eliminating unauthorized communication between an unregistered radio packet base station and a radio packet terminal connected to the unregistered radio packet base station in a radio packet communication system,
When a wireless packet base station intercepts a beacon of an unknown transmission source, the wireless packet base station that is the transmission source of the beacon is unregistered with the monitoring server that registers and manages the wireless packet base station that has been correctly authenticated. Querying whether it is a packet base station;
As a result of the inquiry, when it is determined that the wireless packet base station is an unregistered wireless packet base station, the wireless packet base station determines the presence of the unregistered wireless packet base station to a wireless packet terminal connected to the wireless packet base station. Reporting step,
The wireless packet base station or the wireless packet terminal that has received the notification shifts to an exclusion mode in which the unregistered wireless packet base station is excluded, and impersonation information for deceiving the wireless packet terminal connected to the unregistered wireless packet base station Sending
A method of eliminating unauthorized communication characterized by the above. When the wireless packet terminal intercepts an unknown source beacon, the wireless packet base station determines whether the beacon source wireless packet base station is an unregistered wireless packet base station. Including a step requesting confirmation,
The wireless packet base station starts the inquiry operation to the monitoring server based on the request;
20. The method for eliminating unauthorized communication according to claim 18 or 19, wherein: In the exclusion mode, by responding to the packet from the unregistered radio packet base station with a pseudo ACK response packet in the name of the destination of the packet, the unregistered radio packet base station and the unregistered radio packet base station Eliminating communication between wireless packet terminals connected to
The method for eliminating unauthorized communication according to any one of claims 18 to 20. The wireless packet base station and the wireless packet terminal receiving the notification are:
Based on the probe request or probe response intercepted in advance, detect the wireless packet terminal connected to the unregistered wireless packet base station,
In the exclusion mode, by performing disassociation processing in the name of the unregistered radio packet base station for the radio packet terminal connected to the unregistered radio packet base station, the unregistered radio packet base station and Eliminating communication between radio packet terminals connected to the unregistered radio packet base station;
The method for eliminating unauthorized communication according to any one of claims 18 to 20. In the exclusion mode, a pseudo packet is transmitted with respect to a packet from the unregistered radio packet base station, and a packet collision occurs to connect the unregistered radio packet base station and the unregistered radio packet base station. Eliminating communication between wireless packet terminals,
The method for eliminating unauthorized communication according to any one of claims 18 to 20.

Images