Communication system, communication path establishment method, and non-transitory computer-readable medium storing a path establishment program

Abstract

An AP (1-3), a STA (1-4) belonging to the AP (1-3), an authentication server (1-1) that performs authentication when the AP (1-3) receives an authentication request from the STA (1-4), and a database in which information related to legitimate APs (1-3) is registered are provided. The AP (1-3) transmits an authentication server certificate signed by a trusted certificate authority to the STA (1-4), transmits the contents of the authentication server certificate to the authentication server upon receiving the authentication request from the STA (1-4), performs encrypted communication using a random number included in the authentication response as a seed, and encrypts the contents of the authentication response and transmits it to the STA (1-4). The STA (1-4) generates a public key, checks the contents of the response, receives the authentication server certificate, verifies the presence of a signature from the trusted certificate authority, and encrypts information related to a connection destination and a random number and transmits them as an authentication request to the AP (1-3). STA (1‑4) decrypts the contents of the verification response and checks to see whether information indicating success or failure of verification and a random number are included, decrypts the contents of the verification server certificate, and determines success or failure based on whether the database has a record of the information included in the verification request.

Description

Technical Field

[0001] The present invention relates to a communication system, a communication path establishment method, and a path establishment program, which can prevent an attached device (hereinafter referred to as a "station" or "STA") from belonging to anything other than a legitimate access point designated by an administrator when an access point (AP) is manageable during use of a wireless local area network (LAN) device and peripheral devices. Background Art

[0002] Due to the widespread use of mobile communication terminals such as smartphones and changes in distributed content, data traffic in mobile communication networks has exploded. It is urgent to move (offload) data services of mobile communication terminals from mobile communication networks to public wireless LANs installed in various places.

[0003] As a result, the number of areas where public wireless LANs are available has increased; however, public wireless LANs present security issues due to their nature as being accessible to anyone. As a result, some users avoid using public wireless LANs, while others risk becoming victims of cyberattacks during their use.

[0004] Although new mobile communication technologies such as 5G are now available, it is expected that offloading of traffic to public wireless LANs will remain unchanged in the future. Therefore, there is a need to make public wireless LANs more widely popular.

[0005] Prior art literature

[0006] Patent Literature

[0007] Patent Document 1: Japanese Patent Application No. 2014-527762 Summary of the Invention

[0008] While public wireless LANs are convenient, they also present security issues. More specifically, for user convenience, it's desirable to make public wireless LANs available without requiring a password (i.e., open authentication). However, in the currently common wireless LAN encryption schemes, when open authentication is used, communications are not even encrypted. This presents a significant risk, as malicious users (hereinafter referred to as "attackers") can intercept others' communications simply by capturing wireless LAN packets.

[0009] To address this, opportunistic wireless encryption (OWE) in WPA3, the latest security standard, can be used because encrypted communication is possible during open authentication. As another example, even with WPA2, encrypted communication can be achieved by using an encryption mode with non-open authentication. In these situations, the risk of interception may be reduced because an attacker cannot obtain the content of the communication simply by capturing packets. However, the methods used by attackers to intercept communications are not limited to packet capture.

[0010] For example, examples of attack methods include a man-in-the-middle (hereinafter, "MitM") attack. This attack method is not limited to wireless LANs; however, in the case of implementing MitM in a wireless LAN, the following method can be used.

[0011] First, the attacker assigns their device to a legitimate AP (hereinafter referred to as a "Real AP") in the same manner as a typical user. Subsequently, while maintaining operation as a STA, the attacker establishes another AP (hereinafter referred to as a "Rogue AP") that mimics the legitimate AP. The attacker then deceives the legitimate user and tricks the STA of the target user into assigning it to the Rogue AP. As a result, while the deceived user perceives the STA as appearing to be assigned to the Real AP, the STA is actually assigned to the Rogue AP. Consequently, communications to the Real AP are routed through the Rogue AP. In this way, all of the user's communication data is vulnerable to interception and tampering on the attacker's device.

[0012] In a MitM attack, since the communication path of a STA in a wireless LAN terminates at a rogue AP, the encryption in the wireless LAN is already decrypted at the rogue AP. For this reason, encrypting wireless LAN communications as a preventative measure against interception or tampering is meaningless during a MitM attack. Furthermore, since a MitM attack requires the attacker's device to be associated with the real AP, preventing the attacker's device from being associated with the real AP, i.e., setting up authentication for the real AP, is a good approach to prevent MitM. However, with public wireless LANs, due to their inherent use of open authentication, or because passwords are easily accessible even when non-open authentication is used, preventing MitM is currently virtually impossible. In other words, current public wireless LANs lack MitM protection, leaving security issues unresolved.

[0013] In Patent Document 1, prevention against connecting to a suspicious AP is provided in the following manner. First, during the period that a (random) STA belongs to a (random) AP, the STA sends data indicating the reputation of the AP to an evaluation server every day. Reputation can be, for example, "failed verification of the SSL certificate using a trusted website." This example constitutes a bad reputation. In addition, the AP itself sends data indicating its reputation to the evaluation server. In this case, reputation is represented by, for example, the number of STAs belonging to the AP. The more STAs belonging to the AP, the higher the reputation. In addition, when the STA attempts to connect to the AP, an inquiry is made to the evaluation server about the reputation. The evaluation server responds to the STA with the evaluation value of the AP based on the accumulated evaluation data and according to the rules derived from machine learning. In addition, the STA determines whether to continue the connection to the AP based on the obtained evaluation value. In this way, prevention against connecting to an AP with a bad reputation is provided.

[0014] The method described in Patent Document 1 has the advantage of providing information on a large amount of unspecified APs, indicating whether each AP is generally considered good or bad, without requiring the administrator of the AP to be evaluated. However, there are a number of problems. The first problem is that it is impossible to make a reliable evaluation unless a certain amount of data has been accumulated as the reputation of the AP to be evaluated. For example, in the case of a newly opened store providing a public wireless LAN, or in the case of an existing public wireless LAN where the AP has been replaced due to aging, etc., there is almost no data indicating the reputation of the AP, making it impossible to make a reliable evaluation. The second problem is that since the AP is evaluated based on information from the end user, an attacker can create a false reputation by sending false reputation data to the evaluation server. As a result, for example, the reputation of a real AP may be made worse, or the reputation of a rogue AP may be made better. In other words, Patent Document 1 only discloses technology for "detecting suspicious APs" and does not actually disclose technology for preventing MitM attacks by accurately evaluating APs.

[0015] Furthermore, users of public wireless LANs can use the network without worrying about whether the AP they are connecting to is newly installed. Furthermore, users should only connect to APs that are definitely legitimate. Even if information indicating whether an AP is suspicious is provided, if the information itself is likely to contain false reputations, this method is meaningless in preventing MitM attacks. As explained herein, the technology disclosed in Patent Document 1 does not address the aforementioned issue of public wireless LANs lacking a means to prevent MitM attacks. Therefore, this problem remains.

[0016] The present invention aims to provide a communication system, comprising: an AP; a STA configured to belong to the AP; an authentication server configured to perform authentication when the AP has received an authentication request from the STA; and a database in which information related to the legitimate AP is registered, wherein before the STA belongs to the AP, when the STA notifies the AP that the AP is a compliant AP, the AP sends a authentication server certificate signed by a trusted certificate authority to the STA, and when receiving the authentication request from the STA, the AP sends the content of the authentication request to the authentication server and authenticates the STA by using a secure authentication server. The AP receives a verification response from the verification server, upon receiving the verification response, communicates with the STA by using an encryption communication scheme using a random number included in the verification response as a seed as a wireless LAN encryption scheme to be used between the AP and the STA, upon receiving the verification response, the AP generates a shared key using the random number included in the verification response as a seed, encrypts the contents of the verification response, and transmits the encrypted content to the STA, the STA notifying the AP that it is a compliant STA before belonging to the AP, receives the verification server certificate from the AP, and verifies whether the verification server certificate is signed by a trusted certificate authority. In the case where the authentication server certificate is authentic, the STA encrypts the information related to the connection destination and the random number and transmits the encrypted information to the AP as the authentication request, the encryption using the public key attached to the authentication server certificate. Upon receiving the authentication response from the AP, the STA generates a public key using the random number as a seed, further decrypts the contents of the authentication response, and checks to see whether the contents of the authentication response include information indicating success or failure of the authentication and the random number. In the case where the contents of the authentication are successful and the random number is also confirmed, the STA completes the authentication by using an encryption communication scheme using the random number as a seed. The wireless LAN encryption scheme to be used for communication with the AP is used. When receiving a verification request from the AP, the verification server decrypts the content of the verification request by using a private key paired with a public key attached to the verification server certificate signed by the trusted certificate authority, and judges success or failure based on whether a database that registers information related to legitimate APs has a record that matches the information included in the verification request. The verification server sends the judgment result of success or failure and the random number included in the verification request as the verification response to the AP that sent the verification request to the verification server by using the secure path.

[0017] Furthermore, another object of the present invention is to provide a communication path establishment method, wherein, before a STA is attributed to an AP, the STA notifies the AP that the AP is a compliant AP, the AP transmits an authentication server certificate signed by a trusted certificate authority to the STA, upon receiving an authentication request from the STA, the AP transmits the contents of the authentication request to an authentication server, and receives an authentication response from the authentication server using a secure path, upon receiving the authentication response, the AP communicates with the STA using an encryption communication scheme using a random number included in the authentication response as a seed as a wireless LAN decryption scheme to be used, upon receiving the authentication response, the AP generates a shared key using the random number included in the authentication response as a seed, encrypts the contents of the authentication response to the STA, and transmits the encrypted contents of the authentication response to the STA, wherein the STA notifies the AP that the STA is a compliant STA before being attributed to the AP, receives the authentication server certificate from the AP, and verifies whether the authentication server certificate is signed by a trusted certificate authority, and if the authentication server certificate is authentic, the STA encrypts information related to a connection destination and the random number as a shared key. The authentication request is sent to the AP, and the encryption uses a public key attached to the authentication server certificate. Upon receiving an authentication response from the AP, the STA generates a public key using the random number as a seed, further decrypts the contents of the authentication response, and checks to see whether the contents of the authentication response include information indicating success or failure of the authentication and the random number. If the contents of the authentication are successful and the random number is confirmed, the STA communicates with the AP using an encryption communication scheme using the random number as a seed as a wireless LAN encryption scheme to be used. Upon receiving the authentication request from the AP, the authentication server decrypts the contents of the authentication request using a private key paired with the public key attached to the authentication server certificate signed by the trusted certificate authority, and determines success or failure based on whether a database registering information about legitimate APs has a record matching the information included in the authentication request. The authentication server then transmits the success or failure determination result and the random number included in the authentication request as the authentication response to the AP that sent the authentication request to the authentication server using the secure path.

[0018] Furthermore, another object of the present invention is to provide a non-transitory computer-readable medium storing a communication path establishment program stored in an AP (access point), wherein, before causing an STA (attached device) to belong to the AP, when the STA notifies the AP that the AP is a compliant AP, the AP transmits an authentication server certificate signed by a trusted certificate authority to the STA, upon receiving an authentication request from the STA, the AP transmits the contents of the authentication request to an authentication server, and receives an authentication response from the authentication server using a secure path, upon receiving the authentication response, the AP communicates with the STA using an encryption communication scheme using a random number included in the authentication response as a seed as a wireless LAN encryption scheme to be used, and upon receiving the authentication response, the AP generates a shared key using the random number included in the authentication response as a seed, encrypts the contents of the authentication response, and transmits the encrypted key to the STA.

[0019] Furthermore, another object of the present invention is to provide a non-transitory computer-readable medium storing a communication path establishment program stored in an STA (access point), wherein the STA notifies an AP (access point) that the STA is a compliant STA before belonging to the AP, receives an authentication server certificate from the AP, and verifies whether the authentication server certificate is signed by a trusted certificate authority. If the authentication server certificate is authentic, the STA encrypts information related to a connection destination and a random number and transmits the encrypted information to the AP as an authentication request, the encryption using a public key attached to the authentication server certificate. Upon receiving an authentication response from the AP, the STA generates a public key using the random number as a seed, further decrypts the contents of the authentication response, and checks to see whether the contents of the authentication response include information indicating success or failure of the authentication and the random number. If the contents of the authentication are successful and the random number is also confirmed, the STA communicates with the AP by using the encryption communication scheme using the random number as a seed as the wireless LAN encryption scheme to be used.

[0020] In addition, another object of the present invention is to provide a non-transitory computer-readable medium, which stores a communication path establishment program stored in a verification server, wherein, upon receiving a verification request from an AP (access point), the verification server decrypts the content of the verification request by using a private key paired with a public key attached to a verification server certificate signed by a trusted certificate authority, and judges success or failure based on whether a database that registers information related to legitimate APs has a record that matches the information included in the verification request, and the verification server sends the judgment result of success or failure and the random number included in the verification request as a verification response to the AP that sent the verification request to the verification server by using a secure path.

[0021] In the case where the administrator is able to manage legitimate APs, even if an attacker has established a fake AP, the STA can only belong to the legitimate AP. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 is a structural diagram of a wireless LAN environment according to the first exemplary embodiment.

[0023] Figure 2 is a diagram schematically illustrating transmission and reception of information according to the first exemplary embodiment.

[0024] Figure 3 is a diagram illustrating an example of the operation flow of the STA according to the first exemplary embodiment.

[0025] Figure 4 is a diagram showing an example of the operation flow of the Real AP according to the first exemplary embodiment.

[0026] Figure 5 is a diagram illustrating an example of an operation flow of the authentication server according to the first exemplary embodiment.

[0027] Figure 6 FIG. 4 is a structural diagram of establishing a Real AP and a Rogue AP according to the first exemplary embodiment.

[0028] Figure 7 is a diagram showing an example of a radio wave state according to the first exemplary embodiment.

[0029] Figure 8 FIG. 1 is a diagram showing a configuration in which an attacker prepares a fake authentication server in addition to a Rogue AP according to the first exemplary embodiment.

[0030] Figure 9 is a structural diagram showing an example of a specific wireless LAN environment according to the first exemplary embodiment.

[0031] Figure 10 is a table showing main setting items of the AP according to the first exemplary embodiment.

[0032] Figure 11 is a table showing an example of content recorded in the database of the authentication server according to the first exemplary embodiment.

[0033] Figure 12 is a table showing an example of content recorded in the database of the false verification server according to the first exemplary embodiment. DETAILED DESCRIPTION

[0034] First exemplary embodiment

[0035] Hereinafter, exemplary embodiments of the present invention will be described with reference to the accompanying drawings. Figure 1 The structure diagram of the present invention is presented. The authentication server 1-1 is managed by a business operator who installs an AP that provides a public wireless LAN and is a server that manages the Real AP 1-3. Figure 1 In the example, the authentication server 1-1 is connected to the Real AP 1-3 via the Internet 1-2; however, the connection does not necessarily have to be routed through the Internet. The Real AP 1-3 is also installed by the commercial operator in the same manner as the authentication server 1-1 and is a legitimate AP. Figure 1 This is a minimal structural diagram of the present invention, and therefore depicts only one Real AP. However, in practice, two or more Real APs are expected to exist. STA1-4 are attached terminals of users of a public wireless LAN.

[0036] Next, refer to Figure 2 The operation of the present invention is described. Figure 2 , paths shown with hatching each indicate that a secure path is established between devices provided at both ends of the path. First, before starting to provide a public wireless LAN service, a business operator who manages APs performs preparations as described below.

[0037] In the present invention, to communicate with STA 2-3 using a public key encryption scheme using digital certificates, authentication server 2-1 pre-acquires a certificate digitally signed by a trusted certificate authority. (Hereinafter, this certificate will be referred to as the "authentication server certificate.") The authentication server certificate includes a public key generated by authentication server 2-1. Its paired private key is installed in authentication server 2-1. Furthermore, the obtained authentication server certificate is stored in Real AP 2-2. Furthermore, a secure communication path is established between authentication server 2-1 and Real AP 2-2. As for the method used to establish this path, using a common method such as VPN or HTTPS is acceptable. Furthermore, as information related to legitimate APs, the database in authentication server 2-1 registers three pieces of information related to the Basic Service Set (BSS) provided by Real AP 2-2: the Extended Service Set Identifier (ESSID), the Basic Service Set Identifier (BSSID), and the channel number. The above process is performed as preparation before starting public wireless LAN service.

[0038] Next, refer to Figure 2 、 3 , 4 and 5 illustrate operations after the public wireless LAN service starts. Figure 3 、 4 5 are flowcharts related to the processing performed by STA 2-3, Real AP 2-2, and authentication server 2-1, respectively. In addition, since the basic operations of Real AP 2-2 and STA 2-3 correspond to the operations of general wireless LAN devices, only the parts related to the present invention will be described below.

[0039] First, before starting the wireless LAN connection process, STA 2-3 sends a presence notification request to check whether an AP exists, as a general STA operation. When sending the presence notification request, STA 2-3 sends data indicating the technology consistent with the present invention along with the presence notification request (2-4; 3-1), and waits for a presence notification response from the AP within a predetermined period of time (3-2).

[0040] Upon receiving the presence notification request (4-1), the Real AP 2-2 checks to see if the STA 2-3 complies with the technology of the present invention (4-2). A Real AP 2-2 that complies with the technology of the present invention does not allow any STA that does not comply with the technology of the present invention to belong to the Real AP 2-2. Therefore, if the STA 2-3 does not comply with the technology of the present invention, the subsequent processing (4-4) will not be performed.

[0041] If STA 2-3 conforms to the technology of the present invention (4-3), a presence notification response is sent to STA 2-3, along with data indicating conformance to the technology of the present invention and a verification server certificate (2-5, 4-5). Conversely, if no presence notification response is received within a predetermined time period, STA 2-3 does not perform subsequent processing (3-4). Upon receiving the presence notification response (3-3), it verifies whether Real AP 2-2 conforms to the technology of the present invention (3-5). If Real AP 2-2 does not conform to the technology of the present invention, it does not perform subsequent processing (3-7).

[0042] If Real AP 2-2 conforms to the present invention (3-6), it obtains the verification server certificate from the received presence notification response to verify the presence of a signature from a trusted certificate authority (3-8). If the verification result is negative (i.e., untrustworthy), the subsequent processing (3-10) is discontinued.

[0043] After verifying that a signature from a trusted certificate authority exists (3-9), STA 2-3 generates a random value rnd (3-11). STA 2-3 also encrypts four pieces of information related to the BSS to which it is connected, such as the ESSID, BSSID, channel number, and rnd (this encryption uses the public key attached to the authentication server certificate) and sends them to Real AP 2-2 (2-6, 3-12).

[0044] The three pieces of information other than rnd are readily available by observing beacons issued by the Real AP 2-2, and are the type of information always obtained during normal operation when a STA is affiliated with an AP. After transmitting the presence notification response described above, the Real AP 2-2 waits until data is received from the STA 2-3 within a predetermined period of time (4-6). Upon receiving the data (4-7), its contents are transmitted to the authentication server 2-1 as an authentication request (2-7, 4-9). In this case, if no data is received within the predetermined period of time, the subsequent processing (4-8) is not performed.

[0045] Upon receiving the authentication request (5-1), the authentication server 2-1 first decrypts the contents of the data by using its own private key. Subsequently, the authentication server 2-1 compares the obtained information related to the ESSID, BSSID, and channel number with the database managed by it, and checks to see if there is data that matches all three pieces of information (5-2).

[0046] If data matching all three pieces of information exists (5-3), information indicating success and rnd are sent as a verification response to the Real AP 2-2 via a pre-prepared secure path (2-8, 5-5). Conversely, if data matching all three pieces of information does not exist (5-4), information indicating failure and rnd are sent to the Real AP 2-2 via a secure path.

[0047] Upon receiving the authentication response (4-10), Real AP 2-2 obtains rnd from the authentication response (4-11). It then checks to see if the authentication response indicates success or failure (4-12). If it indicates success (4-13), it sets an encryption scheme to perform encrypted communication using rnd as a seed for wireless LAN communication with STA 2-3 (4-15). Conversely, if it indicates failure (4-14), it does not set an encryption scheme. It then encrypts the contents of the authentication response using rnd as a public key and sends it to STA 2-3 (2-9, 4-16).

[0048] After sending the authentication request to the Real AP 2-2 in process 3-12, the STA 2-3 waits for data to be received from the Real AP 2-2 within a predetermined period of time (3-13). Upon receiving the data (3-14), the data is decrypted using rnd as the public key (3-16). Conversely, if no data is received within the predetermined period of time, the subsequent process is not performed (3-15).

[0049] Subsequently, it is verified whether the decrypted content indicates success and whether the value of rnd (obtained from the decryption) matches the value generated by itself (3-17). If this condition is not met (for example, the decryption itself failed, the content indicates failure, or the value of rnd does not match the value generated by itself), the subsequent processing will not be performed (3-19).

[0050] On the other hand, if the above conditions are met (3-18), an encryption scheme is set to perform encrypted communication using rnd as a key as wireless LAN communication with the Real AP 2-2 (3-20). STA 2-3 then performs normal affiliation processing (transmission of an authentication frame and subsequent processing) as an STA (3-21), while the Real AP 2-2 also performs normal corresponding affiliation processing as an AP (4-17). As a result, STA 2-3 completes the affiliation processing of the Real AP 2-2.

[0051] Through the above operations, the STA has been assigned to a legitimate AP.

[0052] Next, to help understand the beneficial effects of the present invention, the following will describe how to provide protection against MitM in the presence of a false AP (=Rogue AP).

[0053] For a rogue AP, all parameters, including the MAC address, are essentially the same as those of a legitimate AP. However, when establishing an AP with identical parameters, communication between the legitimate and rogue APs becomes confused (because wireless LAN packets are radio waves, the radio waves physically reach both the legitimate and rogue APs, and if the BSSID (MAC address) is the same, both APs receive the radio waves), preventing proper communication. For this reason, rogue APs disguise themselves as legitimate APs by making one or more parameters different or taking specific measures to prevent physical confusion of radio waves.

[0054] As Case 1, we will discuss an example of establishing a Rogue AP in a different channel from the Real AP. Figure 6 Shown in.

[0055] In case 1, the BSSIDs of the real AP 6-3 and the rogue AP 6-4 are the same; however, since the channels are different, the communication contents of the real AP 6-3 and the rogue AP 6-4 are not confused. The communication path is as follows: STA 6-5 – rogue AP 6-4 – real AP 6-3 – authentication server 6-1.

[0056] Without the technology of the present invention, STA 6-5 would inadvertently be attributed to rogue AP 6-4 because no process is performed to verify the channel number used by rogue AP 6-4. In contrast, with the technology of the present invention, STA 6-5 sends an authentication request including the channel number of rogue AP 6-4 to authentication server 6-1 (via rogue AP 6-4 and real AP 6-3) in process 3-12, causing authentication server 6-1 to perform authentication including the channel number (5-2). Therefore, rogue AP 6-4, which uses a different channel from real AP 6-3, is determined to have failed in process 5-2.

[0057] Furthermore, the authentication request (3-12) sent by STA 6-5 is configured to include a random number rnd generated by the STA itself before being encrypted with the public key associated with the authentication server certificate. Therefore, Rogue AP 6-4 cannot tamper with the data. (Learning rnd requires a decryption step, which is impossible because Rogue AP 6-3 does not have the private key.) Even if Rogue AP 6-4 sends a false authentication request instead of the correct one, the defense in process 3-17 is effective because rnd is inaccurate. As described herein, MitM will not work in case 1.

[0058] As Case 2, we'll discuss an example of using the same channel as the real AP but a different BSSID. Because the BSSID is different, communications remain unobstructed even when using the same channel as the real AP. In Case 2, the present invention's techniques verify the BSSID along with the channel number, so MitM will not work for the same reason as Case 1.

[0059] As Case 3, we will discuss an example of establishing a Rogue AP during which all parameters including the channel and BSSID are identical to those of the Real AP. Figure 6 Shown in.

[0060] As mentioned above, when all parameters are the same as those of the Real AP, the communication is obfuscated; however, when the arrangement is as Figure 7 More specifically, in this arrangement, radio waves 7-4 from Real AP 7-1 reach Rogue AP 7-2 but not STA 7-3, while radio waves 7-5 from STA 7-3 reach Rogue AP 7-2 but not Real AP 7-1.

[0061] In this scenario, although authentication server 6-1's authentication fails to detect the masquerade, the authentication response from authentication server 6-1 is delivered to Real AP 6-3 via a secure path (2-7, 5-5). However, Rogue AP 6-4 does not receive the content or cannot decrypt it. Therefore, Rogue AP 6-4 is also unable to learn rnd and, in process 3-17, provides protection. Therefore, MitM will not work in case 3.

[0062] As Case 4, we will discuss an example where the attacker prepares a fake authentication server in addition to the Rogue AP. The structure in this example is Figure 8 Shown in.

[0063] In this example, the communication path is as follows: STA 8-6 – Rogue AP 8-5 – Fake Authentication Server 8-4. In Case 4, protection is provided by verifying the authentication server's certificate in process 3-8. This is because obtaining a digital certificate signed by a trusted certificate authority requires incurring costs and undergoing a rigorous screening process. In other words, since a digital certificate signed by a trusted certificate authority is unavailable, the attacker has no choice but to use an unsigned certificate or a self-signed certificate. Therefore, protection is provided in process 3-8. As a result, MitM will not work in Case 4.

[0064] As described above, the technology of the present invention is extremely robust to MitM.

[0065] Next, a more specific embodiment example will be described. Figure 9 Shown in.

[0066] Authentication server 9-2, Real AP (A) 9-3, and Real AP (B) 9-4 are prepared and installed by a business operator that provides public wireless LAN services. STA 9-5 is a wireless terminal (a smartphone in this example) of a user using the public wireless LAN. The purpose of the present invention is to allow STA 9-5 to belong to Real AP (A) 9-3 or Real AP (B) 9-4, which are legitimate APs prepared by the business operator, and to prevent STA 9-5 from belonging to Rogue AP (A) 9-6, Rogue AP (B) 9-7, and Rogue AP (C) 9-8. An attacker prepares a fake authentication server 9-9 and Rogue AP (A) 9-6, Rogue AP (B) 9-7, and Rogue AP (C) 9-8. The attacker attempts to make STA 9-5 belong to one of the rogue APs.

[0067] In this case, Rogue AP (A) 9-6 is the Rogue AP in the above case 1. Rogue AP (B) 9-7 is the Rogue AP in the above case 3. Rogue AP (C) 9-8 is the Rogue AP in the above case 4. Rogue AP (A) 9-6 and Rogue AP (B) 9-7 have been assigned to Real AP (B) 9-4 as attached devices.

[0068] The main settings of AP are Figure 10 In this example, public wireless LAN services are provided under the ESSID "freewlan". All Real APs and Rogue APs use "freewlan" as the ESSID.

[0069] As for the BSSID, Rogue AP (A) 9-6 and Rogue AP (B) 9-7 use the same BSSID as Real AP (B) 9-4 to disguise themselves as Real AP (B) 9-4. Since Rogue AP (C) 9-8 does not disguise itself as any specific Real AP, it can use a different BSSID. Since Real AP (A) 9-3 and Real AP (B) 9-4 do not need to have the same channel number, they use different channel numbers. To avoid confusion in communications with Real AP (B) 9-4, Rogue AP (A) 9-6 uses a different channel number from Real AP (B) 9-4. In contrast, as described above, Rogue AP (B) 9-7 uses the same channel number as Real AP (B) 9-4 because there is no radio wave interference. Rogue AP (C) 9-8 uses a different channel because its BSSID is the same and does not need to match the channel of the Real AP.

[0070] There are two types of verification server certificates, which for ease of explanation will be referred to as "A" and "B." Certificate A comes from verification server 9-2 and is signed by a trusted certificate authority. In contrast, Certificate B comes from a fake verification server 9-9 and is not signed by a trusted certificate authority.

[0071] Next, the operation will be explained.

[0072] A commercial operator providing a public wireless LAN service performs the following processing in advance. First, as an authentication server certificate, a digital certificate signed as defined in ITU-T X.509 is obtained by requesting a trusted certificate authority together with the corresponding private key. The obtained authentication server certificate is stored in Real AP (A) 9-3 and Real AP (B) 9-4, while the private key is stored in the authentication server 9-2. Furthermore, separately from this, a connection using IPsec is established between the authentication server 9-2 and each of Real AP (A) 9-6 and Real AP (B) 9-7. In addition, by using a firewall or the like, the authentication server 9-2 blocks any communication other than communication using the connection established using IPsec. Furthermore, in the database in the authentication server 9-2, the ESSID, BSSID, and channel number of Real AP (A) 9-3 and Real AP (B) 9-4 are registered as information related to legitimate APs, such as Figure 11 shown.

[0073] Next, an explanation will be given of operations performed in the case where the STA 9-5 is to belong.

[0074] First, the operations attributed to Real AP (A) 9-3 will be described. When the user taps "freewlan" in the ESSID list displayed on the screen of STA 9-5, STA 9-5 first broadcasts a ProbeRequest specifying "freewlan" as the ESSID. In this case, since the ProbeRequest frame has a field called VendorSpecific where the vendor can freely insert data, the string "READY" is inserted into this field before transmission to indicate compliance with the present invention (3-1).

[0075] Real AP (A) 9-3 receives the ProbeRequest (4-1) and checks to see if the character string "READY" is present in the Vendor Specific section (4-2). Since the character string "READY" is present (4-3), a ProbeResponse is sent (4-5). In this case, since ProbeResponse also has a Vendor Specific area, the character string "READY" indicating compliance with the present invention and the authentication server certificate stored in Real AP (A) 9-3 are inserted into the area before being sent.

[0076] Upon receiving the ProbeResponse, STA 9-5 first checks to see if the string "READY" exists in the Vendor Specific (3-5). Since its existence is confirmed (3-6), the attached certificate is verified to be trustworthy (3-8). In this example, the verification server certificate is signed by a trusted certificate authority, which is pre-configured in STA 9-5 (typically at the factory) as a trusted root certificate authority. Therefore, the verification server certificate is determined to be trustworthy (3-9).

[0077] STA 9-5 then generates a random value rnd (3-11). In this case, let's assume that rnd is 12345678. STA 9-5 then obtains the ESSID, BSSID, and channel number associated with Real AP (A) 9-3 and encrypts the information ["freewlan", AA:AA:AA:AA:AA:AA:AA, 1, 12345678] using the public key included in the authentication server certificate. This information is then stored back in the Vendor Specific field of the ProbeRequest and sent to Real AP (A) 9-3 (3-12).

[0078] Upon receiving the ProbeRequest from the STA 9-5 for the second time, the Real AP (A) 9-4 transmits the encrypted data sent from the STA 9-5 to the Real AP (A) 9-4 to the authentication server without any modification (4-9). The authentication server 9-2 receives the data, decrypts the data by using the private key stored therein, and checks to see if the database has a record that matches the ESSID, BSSID, and channel number that have been sent to the authentication server 9-2 (5-2). In this case, if Figure 11 As shown, it is known from the database that the record numbered 1 has matching data. Therefore, the authentication server 9-2 sends ["OK", 12345678] as an authentication response to the Real AP (A) 9-3 (5-5).

[0079] Until the verification response is received, the Real AP (A) 9-3 learns that rnd is 12345678 (4-11). In addition, the Real AP (A) 9-3 establishes settings so that the wireless LAN encryption scheme used for communication with the STA 9-5 will be the WPA2 (AES) scheme and so that rnd, which is 12345678, will be used as a pre-shared key (PSK) (4-15). In addition, the Real AP (A) 9-3 encrypts the content of the verification response using the public key generated by using rnd (i.e., 12345678) as a seed, and stores the encrypted result in the Vendor Specific of the ProbeResponse and transmits it to the STA 9-5 (4-16).

[0080] Upon receiving the ProbeResponse for the second time, STA 9-5 obtains its contents by decrypting it using the public key generated using 12345678 as a seed, in the same manner as Real AP (A) 9-3 (3-16). The contents are ["OK", 12345678]. Since the contents are "OK" and the same value as the rnd generated by itself is written, it can be recognized that the series of inquiries was carried out correctly. Therefore, the configuration is established so that the encryption scheme will be the WPA2 (AES) scheme and 12345678 will be used as the PSK (3-20).

[0081] In this way, STA 9-5 and Real AP (A) 9-3 are ready to connect to each other. The subsequent processing is the same as that in the general wireless LAN connection processing. Authentication is sent from STA 9-5 to Real AP (A) 9-3, thus completing the home processing.

[0082] Next, as for the process of belonging to the Real AP (B) 9 - 4 , since the belonging process is the same as that in the example for the Real AP (A) 9 - 3 , the description thereof will be omitted.

[0083] Next, the processing attributed to Rogue AP (A) 9-6 will be described. Since the Rogue AP performs the same operations as the Real AP, the operations are the same as those in the example for Real AP (B) 9-4 until the authentication server 9-2 receives and decrypts the authentication request from Rogue AP (A) 9-6 and performs the judgment process (5-2). Therefore, the description thereof will be omitted.

[0084] In this example, in the process attributed to the Rogue AP (A) 9-6, the content of the data sent as the authentication request is ["freewlan", BB:BB:BB:BB:BB:BB:BB, 11, 12345678]. For this reason, the database ( Figure 11 ) does not have a matching record. Therefore, as a verification response, the verification server 9-2 sends ["NG", 12345678] to the Rogue AP (A) 9-6 (5-6). Subsequent processing is performed in the same manner as in the example of attribution to the Real AP (B) 9-4; however, since the result in process 3-17 is not "OK", the processing of the attached device ends without proceeding to process 3-20. As a result, the STA 9-5 cannot be attributed to the Rogue AP (A) 9-6.

[0085] Next, the processing attributed to Rogue AP (B) 9-7 will be described. In this case, the content of the data sent as the authentication request is ["freewlan", BB:BB:BB:BB:BB:BB:BB, 7, 12345678], and since the data exists in the database ( Figure 11 ), so the process is performed in the same manner as in the example of attribution to Real AP (B) 9-4. However, since IPsec is not established between Rogue AP (B) 9-7 and authentication server 9-2, the authentication response to Rogue AP (B) 9-7 is blocked and does not reach Rogue AP (B) 9-7. As a result, since Rogue AP (B) 9-7 cannot continue with processes 4-10 and thereafter, STA 9-5 is no longer attributed to Rogue AP (B) 9-7.

[0086] Next, an example belonging to Rogue AP (C) 9-8 will be described. Rogue AP (C) 9-8 is configured to send an authentication request to a false authentication server 9-9 instead of the authentication server 9-2. In this case, the digital certificate sent by Rogue AP (C) 9-8 in process 4-5 is a certificate from the false authentication server 9-9. Figure 12 As shown, the attacker registers information related to Rogue AP (C) 9-8 in the database of the fake authentication server 9-9, mimicking the mechanism of this technology. However, because the fake authentication server certificate was not originally signed by a trusted certificate authority, STA 9-5 cannot verify the signature of the trusted certificate authority in process 3-8, and the attribution process ends. As a result, STA 9-5 will not be attributed to Rogue AP (C) 9-8.

[0087] As described above, in the case where the administrator can manage legitimate APs, even if an attacker has established a fake AP, the STA can belong only to the legitimate AP.

[0088] Furthermore, by using digital certificates with digital signatures, it is possible to make it extremely difficult for an attacker to imitate the mechanism of the present invention.

[0089] Second exemplary embodiment

[0090] In the first embodiment, ProbeRequest and ProbeResponse are used as authentication requests and responses between the STA and the AP; however, these are not necessarily required. It is sufficient to make the authentication request and corresponding response before the home process is completed. Therefore, it is also acceptable to use authentication packets and association packets. It is also acceptable to generate completely original packets.

[0091] Furthermore, although IPsec is used as a secure path between the authentication server and the Real AP, it is not always necessary to use IPsec. For example, it is acceptable to resolve this situation by establishing a TLS session. It is also acceptable to establish a connection using the original line.

[0092] Furthermore, while processes 4-15 and 3-20 illustrate an example where the wireless LAN encryption scheme is WPA2 (AES) and rnd is used as the PSK, it is important to use rnd as the seed for encrypted communication. Therefore, WPA2 (AES) is not necessarily required. (For example, WPA3-SAE can be used.) Even when using WPA2 (AES), for example, a hash value of rnd can be used as the PSK instead of directly using the value of rnd.

[0093] In addition, although the explanation is based on the assumption that the database is set in the authentication server, it is also acceptable to set up a database server separately from the authentication server. However, in this case, it should be noted that a secure path needs to be established in advance between the authentication server and the database server.

[0094] Furthermore, the above-described embodiment illustrates the use of a well-known certificate authority as a trusted certificate authority. However, it is also acceptable to have the business operator itself serve as the certificate authority for signing the verification server certificate. In this case, the cost of requesting a certificate from a well-known, trusted certificate authority can be reduced; however, it goes without saying that unless appropriate arrangements are made, STAs will not recognize the business operator as a trusted certificate authority and will not be able to connect to a legitimate AP. Therefore, in this case, it is necessary to pre-store the root certificate generated by the business operator itself in the STA's main body using some absolutely secure means (e.g., through a member-only application).

[0095] As described above, even if an attacker has established a fake AP using one operation or two or more operations selected from the following operations, the STA can be attributed only to the legitimate AP: changing the method of authentication request or authentication response; changing the type of security path; changing the encryption scheme; changing the location of the database; and changing the certificate authority.

[0096] The present invention is not limited to the above-described exemplary embodiments, and modifications can be appropriately applied without departing from the gist thereof.

[0097] In the above-mentioned exemplary embodiment, the present invention is described as a hardware structure; however, the present invention is not limited to this example. In the present invention, any processing can be achieved by causing a central processing unit (CPU) to execute a computer program. In addition, the above-mentioned program can be supplied to a computer, such as by storing it using any of various types of non-transitory computer-readable media. Non-transitory computer-readable media can be any of various types of tangible storage media. Examples of non-transitory computer-readable media include magnetic recording media (e.g., floppy disks, magnetic tapes, or hard disk drives), magneto-optical recording media (e.g., magneto-optical disks), CD read-only memories (ROMs), CD-Rs, CD-R / Ws, semiconductor memories (e.g., mask ROMs, programmable ROMs (PROMs), erasable PROMs (EPROMs), flash ROMs, or random access memories (RAMs)). In addition, the program can be supplied to a computer via any of various types of temporary computer-readable media. Examples of temporary computer-readable media include electrical signals, optical signals, and electromagnetic waves. Temporary computer-readable media can supply the program to a computer via a wired communication path such as an electric wire or optical fiber, or via a wireless communication path.

[0098] This application is based upon and claims the benefit of priority from Japanese patent application No. 2019-183433, filed on October 4, 2019, the disclosure of which is incorporated herein in its entirety by reference.

[0099] Reference Signs List

[0100] 1-1 Authentication Server, 1-2 Internet, 1-3 Real AP, 1-4 STA, 2-1 Authentication Server, 2-2 Real AP, 2-3 STA, 6-1 Authentication Server, 6-2 Internet, 6-3 Real AP, 6-4 Rogue AP, 6-5 SPA, 7-1 Real AP, 7-2 Rogue AP, 7-3 STA, 8-1 Authentication Server, 8-2 Internet, 8-3 Real AP, 8-4 Fake Authentication Server, 8-5 Rogue AP, 8-6 STA, 9-1 Internet, 9-2 Authentication Server, 9-3 Real AP (A), 9-4 Real AP (B), 9-5 STA, 9-6 Rogue AP (A), 9-7 Rogue AP (B), 9-8 Rogue AP (C), 9-9 Fake Authentication Server

Claims

1. A communication system comprising: AP stands for access point; STA is an attached device, which is configured to belong to the AP; an authentication server configured to perform authentication if the AP has received an authentication request from the STA; as well as A database, wherein information related to the legitimate AP is registered in the database, wherein: Before the STA is affiliated with the AP, the STA notifies the AP that the AP is a compliant AP, the AP sends the authentication server certificate signed by a trusted certificate authority to the STA, Upon receiving the authentication request from the STA, the AP sends the content of the authentication request to the authentication server, and receives an authentication response from the authentication server by using a secure path. Upon receiving the authentication response, the AP communicates with the STA by using an encryption communication scheme using a random number included in the authentication response as a seed as a wireless LAN encryption scheme to be used, Upon receiving the authentication response, the AP generates a shared key using a random number included in the authentication response as a seed, encrypts the content of the authentication response, and sends the encrypted content to the STA. The STA notifies the AP that the STA is a compliant STA before belonging to the AP, receives the verification server certificate from the AP, and verifies whether the verification server certificate is signed by a trusted certificate authority, If the authentication server certificate is authentic, the STA encrypts the information on the connection destination and the random number using the public key attached to the authentication server certificate and transmits the encrypted information and the encrypted information to the AP as the authentication request. Upon receiving the authentication response from the AP, the STA generates a public key using the random number as a seed, further decrypts the content of the authentication response, and checks to see whether the content of the authentication response includes information indicating success or failure of the authentication and the random number, If the verification is successful and the random number is confirmed, the STA communicates with the AP by using an encryption communication scheme using the random number as a seed as a wireless LAN encryption scheme to be used. Upon receiving the authentication request from the AP, the authentication server decrypts the contents of the authentication request by using a private key paired with a public key attached to the authentication server certificate signed by the trusted certificate authority, and determines success or failure based on whether a database that registers information related to legitimate APs has a record that matches the information included in the authentication request; and The authentication server transmits a judgment result of success or failure and the random number included in the authentication request as the authentication response to the AP that has transmitted the authentication request to the authentication server by using the secure path.

2. The communication system according to claim 1, wherein The database is stored in the authentication server.

3. The communication system according to claim 1 or 2, wherein: The information about the connection destination, which is sent by the STA to the AP as the authentication request after being encrypted by using the public key attached to the authentication server certificate, includes the ESSID, BSSID, and channel number of the connection destination, and When determining success or failure, the authentication server determines success or failure based on whether the database registering information related to the legitimate AP has records that match all of the ESSID, BSSID, and channel number included in the authentication request.

4. The communication system according to claim 1 or 2, wherein: Instead of the signature of the trusted certificate authority, the provider of the AP provides a signature and also pre-stores the root certificate in the STA, and The STA receives the authentication server certificate from the AP, and further verifies whether the authentication server certificate is signed.

5. A method for establishing a communication path, wherein: Before a STA (attached device) is made to belong to an AP (access point), the STA notifies the AP that the AP is a compliant AP, and the AP sends the STA an authentication server certificate signed by a trusted certificate authority. Upon receiving the authentication request from the STA, the AP sends the content of the authentication request to the authentication server, and receives an authentication response from the authentication server by using a secure path. Upon receiving the authentication response, the AP communicates with the STA by using an encryption communication scheme using a random number included in the authentication response as a seed as a wireless LAN decryption scheme to be used, Upon receiving the authentication response, the AP generates a shared key using a random number included in the authentication response as a seed, encrypts the content of the authentication response, and sends the encrypted content to the STA. The STA notifies the AP that the STA is a compliant STA before belonging to the AP, receives the verification server certificate from the AP, and verifies whether the verification server certificate is signed by a trusted certificate authority, If the authentication server certificate is authentic, the STA encrypts the information on the connection destination and the random number using the public key attached to the authentication server certificate and transmits the encrypted information and the encrypted information to the AP as the authentication request. Upon receiving the authentication response from the AP, the STA generates a public key using the random number as a seed, further decrypts the content of the authentication response, and checks to see whether the content of the authentication response includes information indicating success or failure of the authentication and the random number, If the verification is successful and the random number is confirmed, the STA communicates with the AP by using an encryption communication scheme using the random number as a seed as a wireless LAN encryption scheme to be used. Upon receiving the authentication request from the AP, the authentication server decrypts the contents of the authentication request by using a private key paired with a public key attached to the authentication server certificate signed by the trusted certificate authority, and determines success or failure based on whether a database that registers information related to legitimate APs has a record that matches the information included in the authentication request; and The authentication server transmits a judgment result of success or failure and the random number included in the authentication request as the authentication response to the AP that has transmitted the authentication request to the authentication server by using the secure path. The communication path establishment method according to claim 5 , wherein: The database is stored in the authentication server, and Upon receiving the authentication request from the AP, the authentication server judges success or failure by using records stored in the database stored in the authentication server.

7. The communication path establishment method according to claim 5 or 6, wherein: The information about the connection destination, which is sent by the STA to the AP as the authentication request after being encrypted by using the public key attached to the authentication server certificate, includes the ESSID, BSSID, and channel number of the connection destination, and When determining success or failure, the authentication server determines success or failure based on whether the database registering information related to the legitimate AP has records that match all of the ESSID, BSSID, and channel number included in the authentication request.

8. A non-transitory computer-readable medium storing a communication path establishment program stored in an AP (access point), wherein: Before the STA, i.e., the attached device, belongs to the AP, the STA notifies the AP that the AP is a compliant AP, the AP sends the authentication server certificate signed by a trusted certificate authority to the STA. Upon receiving the authentication request from the STA, the AP sends the content of the authentication request to the authentication server, and receives an authentication response from the authentication server by using a secure path. Upon receiving the authentication response, the AP communicates by using an encryption communication scheme using a random number included in the authentication response as a seed as a wireless LAN encryption scheme to be used between the AP and the STA, and Upon receiving the authentication response, the AP generates a shared key using the random number included in the authentication response as a seed, encrypts the content of the authentication response, and transmits the encrypted content to the STA.

9. A non-transitory computer-readable medium storing a communication path establishment program stored in an STA (attached device), wherein: The STA notifies the AP that it is a compliant STA before belonging to the AP, receives the verification server certificate from the AP, and verifies whether the verification server certificate is signed by a trusted certificate authority. If the authentication server certificate is authentic, the STA encrypts information about the connection destination and a random number using a public key attached to the authentication server certificate and sends the encrypted information and a random number to the AP as an authentication request. Upon receiving the authentication response from the AP, the STA generates a public key using the random number as a seed, further decrypts the content of the authentication response, and checks to see whether the content of the authentication response includes information indicating success or failure of the authentication and the random number, and If the verification is successful and the random number is confirmed, the STA communicates with the AP by using an encryption communication scheme using the random number as a seed as a wireless LAN encryption scheme to be used.

Images