Method and device for countering target wireless access point and electronic equipment

Abstract

The invention provides a method and a device for countering a target wireless access point, and electronic equipment, which are used for improving the effectiveness of a countering method for an illegal AP in a WLAN network and avoiding the problems that countering cannot be carried out on an illegal AP with a PMF function opened when a deauth message is constructed, and countering cannot be carried out on an illegal AP connected with a terminal when a beacon message is constructed, and other countering methods are invalid. The method is applied to a controller, and comprises the following steps: determining a first target wireless access point AP, and generating a virtual wireless access point VAP corresponding to the first target AP; in response to the detected message sent to the first target AP, replying a confirmation response to a target terminal by using the VAP; wherein the target terminal is a terminal which sends the message to the first target AP.

Description

Technical Field

[0001] The present application relates to the field of wireless communication technology, and in particular to a method, device and electronic device for countering a target wireless access point. Background Art

[0002] An illegal wireless access point (Rogue AP) is an unauthorized or malicious wireless access point (AP) in the network that pretends to be a legitimate AP in the wireless network to communicate with the terminal and launch an attack; it is also called a rogue AP or illegal device. Figure 1 ,AP and wireless controller (Access Controller, referred to as: AC) cooperate to deploy the network and form a wireless LAN. AP can be deployed indoors or outdoors for terminal (client) access. RougeAP may be a neighbor AP, an AP that privately accesses the network, or an AP controlled by an attacker. Rouge may provide some fake services or attack AP through vulnerabilities, causing security threats after the terminal accesses. The threat includes but is not limited to session hijacking and denial of service attacks (DOS).

[0003] To this end, the Wireless Intrusion Detection System (WIDS) is a system that detects and defends against potential threats in the Wireless Local Network (WLAN). WIDS detects devices in the WLAN network, and after detecting illegal devices, it processes abnormal devices through countermeasures to disconnect the terminal from the abnormal device and ensure network security. However, the current countermeasure method based on WIDS mainly constructs a deauth message by monitoring the wireless access point (Monitor Acess Point, Monitor AP), or constructs a benacon message to send to the terminal associated with the Rouge AP to disconnect the terminal from the Rouge AP.

[0004] However, the problem with constructing the deauth message for countermeasure is that when only the management frame protection function is used between the terminal and the Rouge AP, the terminal will ignore the deauth message sent by the Monitor AP, resulting in the failure of the countermeasure. The problem with the beacon message is that since the terminal monitors the beacon message for capability adjustment in order to join the network, when the terminal has successfully associated with the RougeAP, it will no longer monitor the beacon message, which also results in the failure of the countermeasure. Therefore, the effectiveness of the current countermeasure against illegal APs in WLAN networks needs to be improved. Summary of the invention

[0005] The present application provides a method, device and electronic device for countering a target wireless access point, so as to improve the effectiveness of the countermeasure method for illegal APs in a WLAN network, avoid the problem that the countermeasure method fails, such as the inability to counter illegal APs with PMF function enabled when constructing a deauth message, and the inability to counter illegal APs that have established a connection with a terminal when constructing a beacon message.

[0006] In a first aspect, an embodiment of the present application provides a method for countering a target wireless access point, which is applied to a controller and includes:

[0007] Determine a first target wireless access point AP, and generate a virtual wireless access point VAP corresponding to the first target AP;

[0008] In response to detecting the message sent to the first target AP, using the VAP to reply a confirmation response to the target terminal; wherein the target terminal is the terminal that sends the message to the first target AP.

[0009] In a possible implementation manner, the ACK includes address information of the target terminal.

[0010] In a possible implementation manner, the determining a first target wireless access point AP and generating a virtual wireless access point VAP corresponding to the first target AP includes:

[0011] Acquire message information of the air interface, and read AP information from the message information of the air interface;

[0012] Based on the information of the APs, identifying the first target AP from the APs;

[0013] The VAP corresponding to the first target AP is generated.

[0014] In a possible implementation manner, the generating the VAP corresponding to the first target AP includes:

[0015] caching first information of the first target AP;

[0016] Extracting a basic service set identifier BSSID of the first target AP from the first information of the first target AP;

[0017] A VAP corresponding to the first target AP is generated based on the BSSID of the first target AP.

[0018] In a possible implementation manner, in response to detecting the message sent to the first target AP, replying a confirmation response to the target terminal using the VAP includes:

[0019] Receive target message;

[0020] In response to the target message containing the BSSID of the first target AP, determining that the sender of the target message is the target terminal;

[0021] Determining the address information of the target terminal based on the source address in the target message;

[0022] Based on the address information of the target terminal, a confirmation response is sent to the target terminal using the VAP.

[0023] In a possible implementation manner, the number of the first target APs is greater than 1; then the generating a virtual wireless access point VAP corresponding to the first target AP includes:

[0024] Determining the priority of the first target AP;

[0025] Based on the priority of the first target AP, add the first target AP to a priority queue, and cache the first information of the first target AP in the priority queue;

[0026] A VAP is generated for the first target AP in the priority queue.

[0027] In a possible implementation manner, after adding the first target AP to a priority queue based on the priority of the first target AP and caching the first information of the first target AP in the priority queue, the method further includes:

[0028] In response to the priority queue containing a second target AP having a BSSID equal to that of the first target AP, updating the information of the second target AP using the first information of the first target AP; and / or,

[0029] In response to the first target AP being aged, the first target AP is deleted from the priority queue, and the VAP corresponding to the first target AP is deleted.

[0030] In a second aspect, an embodiment of the present application provides a radio frequency card for countering a target wireless access point, including:

[0031] A message module, used to determine a first target wireless access point AP, and generate a virtual wireless access point VAP corresponding to the first target AP;

[0032] A response module: used for replying a confirmation response to a target terminal using the VAP in response to detecting a message sent to the first target AP; wherein the target terminal is a terminal that sends the message to the first target AP.

[0033] In a possible implementation manner, the radio frequency card is installed in the AP; the radio frequency card is independent of the radio frequency card in the AP that provides a terminal access function.

[0034] In a third aspect, an embodiment of the present application provides a device for countering a target wireless access point, including:

[0035] A virtual unit, configured to determine a first target wireless access point AP, and generate a virtual wireless access point VAP corresponding to the first target AP;

[0036] A responding unit is used to reply a confirmation response to a target terminal using the VAP in response to detecting the message sent to the first target AP; wherein the target terminal is the terminal that sends the message to the first target AP.

[0037] In a possible implementation manner, the virtual unit is specifically used to obtain message information of an air interface, and read AP information in the message information of the air interface; based on the AP information, identify the first target AP from the AP; and generate the VAP corresponding to the first target AP.

[0038] In a possible implementation manner, the virtual unit is specifically used to cache first information of the first target AP; extract a basic service set identifier BSSID of the first target AP from the first information of the first target AP; and generate a VAP corresponding to the first target AP based on the BSSID of the first target AP.

[0039] In a possible implementation manner, the response unit is specifically used to receive a target message; in response to the target message containing the BSSID of the first target AP, determine that the sender of the target message is the target terminal; based on the source address in the target message, determine the address information of the target terminal; based on the address information of the target terminal, use the VAP to reply a confirmation response to the target terminal.

[0040] In a possible implementation manner, the number of the first target APs is greater than 1; the virtual unit is also used to determine the priority of the first target AP; based on the priority of the first target AP, the first target AP is added to the priority queue, and the first information of the first target AP is cached in the priority queue; and a VAP is generated for the first target AP in the priority queue.

[0041] In one possible implementation, the device for countering the target wireless access point also includes an update unit, which is specifically used to update the information of the second target AP using the first information of the first target AP in response to the priority queue containing a second target AP whose BSSID is equal to that of the first target AP; and / or, in response to the aging of the first target AP, delete the first target AP from the priority queue and delete the VAP corresponding to the first target AP.

[0042] In a fourth aspect, an embodiment of the present application provides a readable storage medium, including:

[0043] Memory,

[0044] The memory is used to store a computer program. When the computer program is executed by the processor, the device including the readable storage medium performs the method as described in the first aspect and any possible implementation manner.

[0045] In a fifth aspect, an embodiment of the present application provides an electronic device, including:

[0046] Memory, used to store computer programs;

[0047] The processor is used to execute the computer program stored in the memory to implement the method described in the first aspect and any possible implementation manner.

[0048] One or more technical solutions provided in the embodiments of the present invention have at least the following technical effects:

[0049] In the embodiment of the present application, after the first target AP is determined, a corresponding VAP is generated for the first target AP to ensure that after detecting a message sent to the first target AP, a confirmation response can be immediately replied to the message sender (target terminal), so that the terminal receives both the confirmation response from the first target AP and the confirmation response sent by the aforementioned VAP simulating the first target AP, and therefore believes that the message is lost, and thus cannot be managed normally with the first target AP, thereby achieving the purpose of countering the first target AP.

[0050] When the first target AP is an illegal AP, since the WLAN network follows the ACK confirmation response mechanism, no matter it is an illegal AP that has established a connection with the terminal before the VAP is generated, or an illegal AP that the terminal attempts to associate with after the VAP is generated, in the method provided in the embodiment of the present application, countermeasures can be taken after the message sent to the illegal AP is detected. In this way, the effectiveness of countermeasures against illegal APs is significantly improved.

[0051] Other features and advantages of the present application will be described in the subsequent description, and partly become apparent from the description, or be understood by practicing the present application. The purposes and other advantages of the present application can be realized and obtained by the structures specifically pointed out in the written description, claims, and drawings. It should be understood that the above general description and the detailed description below are only exemplary and explanatory and cannot limit the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0053] Figure 1 A schematic diagram of the composition of a WLAN network provided in an embodiment of the present application;

[0054] Figure 2A A schematic diagram of a WLAN network that constructs a deauth message to counter illegal APs;

[0055] Figure 2B This is a diagram of the message interaction between the terminal that currently constructs the deauth message and successfully counters the illegal AP and each AP;

[0056] Figure 2C A schematic diagram of the message interaction between the terminal and each AP when the deauth message is currently constructed to counter illegal APs and countermeasures fail;

[0057] Figure 3A A schematic diagram of a WLAN network that constructs beacon messages to counter illegal APs.

[0058] Figure 3B This is a diagram of the message interaction between the terminal that currently constructs the beacon message and successfully counters the illegal AP and each AP;

[0059] Figure 3C This is a diagram of the message interaction between the terminal and each AP when the beacon message is currently constructed to counter illegal APs and the countermeasure fails;

[0060] Figure 4 A flowchart of a method for countering a target wireless access point provided in an embodiment of the present application;

[0061] Figure 5 A schematic diagram of a method for generating a VAP for replying a confirmation response to a terminal provided in an embodiment of the present application;

[0062] Figure 6 A schematic diagram of the structure of a message module in a radio frequency card provided in an embodiment of the present application;

[0063] Figure 7 A schematic diagram of countering an illegal AP when a target terminal attempts to associate with an illegal AP provided in an embodiment of the present application;

[0064] Figure 8 A schematic diagram of countering an illegal AP when a target terminal has been associated with an illegal AP provided in an embodiment of the present application;

[0065] Fig. 9 A schematic diagram of the structure of a device for countering a target wireless access point provided in an embodiment of the present application;

[0066] Fig.10 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0067] In order to make the purpose, technical scheme and advantages of the present application clearer, the technical scheme in the embodiment of the present application will be clearly and completely described below in conjunction with the drawings in the embodiment of the present application. Obviously, the described embodiment is only a part of the embodiment of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application. In the absence of conflict, the embodiments in the present application and the features in the embodiments can be arbitrarily combined with each other. In addition, although the logical order is shown in the flow chart, in some cases, the steps shown or described can be performed in an order different from that here.

[0068] The terms "first" and "second" in the specification and claims of the present application and the above-mentioned drawings are used to distinguish different objects, rather than to describe a specific order. In addition, the term "comprising" and any of their variations are intended to cover non-exclusive protection. For example, a process, method, system, product or device comprising a series of steps or units is not limited to the listed steps or units, but optionally also includes steps or units that are not listed, or optionally also includes other steps or units inherent to these processes, methods, products or devices. "Multiple" in the present application can mean at least two, for example, two, three or more, and the embodiments of the present application are not limited.

[0069] To facilitate understanding of the technical solution provided by the embodiments of the present application, the following first introduces the design concept of the embodiments of the present application:

[0070] For the method of countering illegal wireless access points (hereinafter referred to as illegal APs) by constructing deauth messages based on WIDS, please refer to Figure 2A After the monitoring wireless access point (hereinafter referred to as monitoring AP) finds an illegal AP, since the deauth message is a management message that sends a disconnection request, the monitoring AP will simulate the illegal AP to send a deauth message to the terminal, and simulate the terminal to send a deauth message to the illegal AP. Figure 2B As shown, when the terminal receives the deauth message sent by the monitoring AP simulating the illegal AP, the terminal will go offline, so as to force the terminal to disconnect from the illegal AP. Alternatively, the illegal AP receives the deauth message sent by the monitoring AP simulating the terminal, which can also force the terminal to disconnect from the illegal AP.

[0071] However, when the Protected Management Frame (PMF) function is enabled between the terminal and the illegal AP, the monitoring AP cannot obtain / decrypt the key information between the terminal and the illegal AP. Therefore, when the monitoring AP simulates the illegal AP or the terminal sends the deauth message, it can only send unencrypted deauth messages. For illegal APs and terminals using the PMF function, the unencrypted deauth message will be ignored. Figure 2C , which makes the countermeasure ineffective.

[0072] The above-mentioned PMF is a solution released by the Wi-Fi Alliance, which aims to protect management frames and prevent forgery attacks. After PMF is turned on, the terminal will ignore the unencrypted management message and will not respond.

[0073] In addition, for methods of countering illegal APs by constructing beacon messages based on WIDS, please refer to Figure 3A When the monitoring AP finds an illegal AP, it will simulate the illegal AP to construct a beacon message and send it to the terminal. The function of the beacon message is to use the capability parameters of the AP so that the receiving terminal can adjust its own parameters to join the AP network. Therefore, the monitoring AP can simulate the illegal AP to send a beacon message, and set different information in the beacon message from the illegal AP, such as the encryption method. Please refer to Figure 3B , causing the terminal that receives the beacon message to mistakenly believe that the parameters of the illegal AP are constantly changing, so that the terminal cannot normally associate with the illegal AP, thus achieving a countermeasure effect.

[0074] However, when the terminal monitors beacon messages, it has not yet successfully associated with the illegal AP, that is, it is in the state of trying to associate with the illegal AP. When the terminal is associated with the illegal AP and the link communication is smooth, the terminal no longer monitors beacon messages. Please refer to Figure 3C , which results in the failure to counter illegal APs.

[0075] Based on the above analysis, it can be seen that the effectiveness of the current method of countering illegal wireless APs needs to be improved urgently to avoid the problem that when constructing beacon messages or deauth messages for countermeasures, the countermeasure effect cannot be guaranteed when PMF is turned on, and the information security of terminal users is threatened.

[0076] To this end, the embodiment of the present application provides a method for countering a target wireless access point: after determining the target AP, a virtual wireless access point (Virtual Access Point, VAP for short) is generated for the target AP, so that after detecting the target terminal that sends a message to the target AP with the intention of communicating with the target AP, the aforementioned generated VAP is used to simulate the target AP and send a confirmation response to the target terminal, so that the terminal receives not only the confirmation response sent by the target AP, but also the confirmation response based on the simulation sent by the VAP. This causes a conflict between the two confirmation responses on the terminal side, causing the terminal to disconnect from the target AP, thereby achieving the purpose of protecting the target terminal and avoiding the security threat caused to the target terminal when the target AP is an illegal AP.

[0077] It should be noted that the application scenario of the method for countering the target AP provided in the embodiment of the present application can be any scenario where the connection between a target AP and a terminal needs to be disconnected. The application scenarios include but are not limited to scenarios for countering illegal wireless access points. For example, it can also be applied when the signal of the AP associated with the terminal is poor. In order to improve the user experience, based on the method provided in the embodiment of the present application, the AP with poor signal can be used as the target AP to make the terminal associated with it go offline, thereby prompting the terminal to connect to an AP with better signal.

[0078] It should also be noted that the method for countering a target wireless access point provided in the embodiment of the present application is applied to a controller. The controller may be an AP that supports monitoring function in a WLAN, such as a Monitor AP; the controller may also be other control modules.

[0079] Preferably, the controller is an AP supporting a monitoring function.

[0080] When the method for countering the target wireless access point provided in the embodiment of the present application is applied to the AP, the method can be specifically applied to the radio frequency card that provides user access in the AP, and can also be applied to an independent radio frequency card in the AP. The independent radio frequency card is only used to implement the method for countering illegal APs provided in the embodiment of the present application, and does not provide the function of user access. Preferably, the method provided in the embodiment of the present application is applied to an independent radio frequency card in the AP. In this way, the conflict between countering illegal APs and providing access functions for users (i.e., terminals) can be avoided to fully guarantee the effectiveness and timeliness of the countermeasures. That is, the conflict between the time spent on scanning to collect air interface message information and then determining illegal APs and the time required for access terminals is avoided. If the time for scanning illegal APs is long, it is easy to cause packet loss or offline of access terminals. If the time for scanning illegal APs is short, it is easy to cause the illegal APs to fail to be determined in time, which leads to untimely countermeasures.

[0081] The following describes a method for countering illegal wireless access points provided by an embodiment of the present application in conjunction with the accompanying drawings.

[0082] like Figure 4 As shown, a method for countering illegal wireless access points AP provided by an embodiment of the present application is applied to a controller to improve the effectiveness of countermeasures and avoid the problem that the currently constructed deauth messages or beacon messages are easily invalid. The method includes the following implementation steps:

[0083] Step 401: Determine a first target wireless access point AP, and generate a VAP corresponding to the first target AP.

[0084] The VAP is generated based on a Basic Service Set Identifier (BSSID) of the first target AP.

[0085] The following is a detailed description of the determination of the first target AP and the generation of the VAP. Figure 5 :

[0086] Step 501: Acquire air interface message information, and read AP information from the air interface message information.

[0087] The message information of the air interface may include messages sent by one or more APs, each of which includes information of a corresponding AP.

[0088] In some embodiments, the message information of the air interface may include beacon messages sent by one or more APs, indicating that they are in a working state.

[0089] Specifically, the message information of the air interface around the AP may be collected first to obtain the message information of the air interface, and then the information of the AP may be read from the message information of the air interface.

[0090] The information of the AP corresponds to the AP one by one and is also message information. The first information may include the BSSID and service set identifier (Service Set Identifier, SSID for short) of the AP.

[0091] Step 502: Based on the AP information, identify a first target AP from the APs in the aforementioned air interface message information.

[0092] The information of the first target AP may be marked as the first information.

[0093] Specifically, for APs that are normally deployed in the existing network, the messages they send all contain a pre-negotiation flag bit, which indicates that the sending AP is a legal AP that is normally deployed. Therefore, when the pre-negotiation flag bit is read in the AP information, it can be determined that the sending AP of the AP information is a non-target AP. When the AP information does not contain the pre-negotiation flag bit, it can be determined that the AP that sends the AP information is a non-friendly AP.

[0094] In some embodiments, the non-friendly APs mentioned above may also be determined as the first target APs.

[0095] In some embodiments, the first target AP may be identified from the aforementioned non-friendly APs according to a preset rule corresponding to a specific countermeasure mode in an upper layer application.

[0096] For example, the preset rule is that according to the blacklist confirmation of BSSID and SSID in the upper layer application, when the BSSID or SSID in the AP information belongs to the blacklist, the AP corresponding to the AP information (i.e. the aforementioned non-friendly AP) can be determined as the first target AP.

[0097] For another example, the preset rule is to determine the SSID similarity between the SSID in the AP information and the SSID of the legal AP deployed in the existing network, and compare the relative size relationship between the similarity and the similarity threshold. Then, when the similarity between the SSID in the information of a certain AP and the SSID of the aforementioned legal AP is greater than the similarity threshold, the AP corresponding to the information of the AP (i.e., the aforementioned non-friendly AP) can be determined as the first target AP.

[0098] Step 503: Generate a VAP corresponding to the first target AP.

[0099] The VAP has a one-to-one correspondence with the first target AP.

[0100] Specifically, in order to facilitate management and to know the situation of illegal APs in the WLAN network, the first information of the first target AP may be cached.

[0101] At the same time, the BSSID of the first target AP can be extracted from the first information of the first target AP, so as to generate a VAP corresponding to the first target AP based on the BSSID of the first target, and the VAP is used to simulate the first target AP to reply a confirmation response to the target terminal.

[0102] Step 402: In response to detecting the message sent to the first target AP, using the VAP to reply a confirmation response to the target terminal, so as to achieve the purpose of simulating the first target AP replying a confirmation response to the target terminal.

[0103] The target terminal indicates a terminal that sends a message to the first target AP. The confirmation response may be an ACK confirmation under the 802.11 standard.

[0104] Specifically, a target message is received. The target message may be an association message sent by the terminal to an AP in the WLAN to initiate a request to establish a connection to the AP. The target message may also be a data message initiated by the terminal to an AP in the WLAN after the terminal has established a connection with the AP.

[0105] The target message contains the source address (i.e. the address information of the sender) and the destination address (i.e. the address information of the target end).

[0106] The destination address at least includes the BSSID of the target AP, so as to accurately identify whether the receiving end of the target message is the first target AP.

[0107] In addition, the destination address may also include a destination media access control address (Media Access Control Address, abbreviated as: MAC), and the destination MAC may be a MAC address of a switch in the WLAN network or a MAC address of a target AP.

[0108] The source address is, for example, a source MAC.

[0109] Then, the target message is read to detect the destination address in the target message. In response to the BSSID in the destination address in the target message corresponding to the first target AP, that is, in response to the BSSID of the first target AP contained in the target message, it can be determined that the sender of the target message is the target terminal. Therefore, the source address in the target message is the address information of the target terminal. Therefore, based on the address information of the target terminal, a confirmation response can be sent to the target terminal using the VAP.

[0110] Otherwise, in response to the BSSID in the destination address in the target message not corresponding to the first target AP, that is, in response to the target message not containing the BSSID of the first target AP, it can be determined that the terminal sending the target message is not the target terminal.

[0111] Furthermore, when the number of first target APs is greater than 1, when caching the first information of the first target AP in the aforementioned step 401, the priority of the first target AP can be determined first, and the information can be arranged in priority order as a priority queue for caching, so that when multiple target terminals initiate associations to multiple first target APs, the time for replying a confirmation response to the target terminal can be determined based on the priority queue, thereby avoiding the problem of lack of support caused by the number of illegal AP signals to be countered exceeding the number limit when executing step 402.

[0112] Specifically, the priority of the first target AP may be determined first. The priority may be determined based on the security threat level of the first target AP to the terminal. For example, the higher the SSID similarity between the first target AP and other legitimate APs in the WLAN, the more likely it is that the first target AP intends to defraud. Therefore, the priority may be determined based on the similarity.

[0113] Then, based on the priority of the first target AP, the priority position of the first target AP in the priority queue is determined, so that the first target AP is added to the priority queue to cache the first information of the first target AP in the priority queue. Finally, a VAP can be generated for all target APs including the first target AP in the priority queue, so that when multiple target terminals initiate associations with multiple first target APs, the VAP can reply a confirmation response to the target terminal according to the priority order of the target APs.

[0114] Furthermore, in the process of implementing steps 401-402, when a new first target AP is determined to be obtained, the new first target AP still needs to be added to the aforementioned priority queue to update the priority queue. And / or,

[0115] When the first target AP is determined to be added to the priority queue, it is found that the first target AP overlaps with the second target AP listed in the priority queue, that is, the BSSIDs of the two are the same, which means that the two are the same AP. At this time, only the first information of the first target AP needs to be used to update the information of the second target AP. The updated information here includes SSID and can also include channel information.

[0116] and / or,

[0117] When the target AP is not scanned again within a preset time after the target AP is determined, it is determined that the target AP is aged, and the priority queue is updated accordingly. That is, after the first target AP is determined in step 401, the working status of the first target AP can also be monitored: scanning the beacon message of the first target AP indicates that the first target AP is in a working state, and when the beacon message of the first target AP is not scanned again within a preset time period, it means that the first target AP is offline and stops working. It can be determined that the first target AP is aged, and the first target AP is deleted from the priority queue to update the priority queue; and the VAP of the first target AP is deleted.

[0118] That is, in response to the priority queue containing a second target AP having a BSSID equal to that of the first target AP, the first information of the first target AP is used to update the information of the first target AP. And / or,

[0119] In response to the aging of the first target AP, the first target AP is correspondingly deleted from the priority queue, and the VAP corresponding to the first target AP is deleted. Similarly, in response to the aging of the second target AP, the second target AP is correspondingly deleted from the priority queue, and the VAP corresponding to the second target AP is deleted.

[0120] Based on the same inventive concept, the embodiment of the present application also provides a radio frequency card for countering a target AP, which is used to counter illegal APs, avoiding the problem that the current construction of deauth messages or beacon messages to counter illegal APs is prone to failure. The radio frequency card corresponds to the aforementioned method for countering a target AP. The specific implementation of the radio frequency card can be found in the description of the aforementioned method embodiment, and the repeated parts will not be repeated. The radio frequency card includes:

[0121] The message module is used to determine a first target wireless access point AP and generate a virtual wireless access point VAP corresponding to the first target AP.

[0122] Furthermore, the message module can be divided into a detection submodule for determining the first target AP and a countermeasure submodule for generating a VAP. Figure 6 .

[0123] The detection submodule transmits the collected raw air interface data (i.e., air interface message information) to the air interface detection submodule in the detection submodule, so that the air interface detection submodule filters and obtains the AP information contained in the air interface data. Then, the air interface detection submodule can transmit the AP information to the target AP judgment submodule, so that the target AP judgment module identifies and determines the first target AP. And transmit the data of the first target AP, i.e., the first information of the first target AP, to the data processing submodule in the countermeasure submodule.

[0124] In the data processing submodule in the countermeasure submodule, priorities are determined for the multiple first target APs to establish and cache priority queues, or to add them to the established priority queues for caching. Then, VAPs are generated for the target APs in the priority queues.

[0125] The generated VAP is managed by the VAP management submodule in the countermeasure submodule. The VAP management submodule can execute the update of the priority queue and the corresponding VAP queue. For example, when the data processing submodule in the countermeasure submodule fails to determine the first information of the first target AP determined previously from the target AP data determined by the target AP judgment module within the preset time range, it can be determined that the first target AP is offline, and it is determined that there is no need to counter the first target AP, then the data processing submodule can directly notify the VAP management submodule, and after receiving the notification, the VAP management submodule deletes the aforementioned first target AP that no longer needs to be countered, and the corresponding VAP. The update is thus completed.

[0126] The response module is used to respond to the message sent to the first target AP by using the VAP to reply a confirmation response to the target terminal, so as to simulate the first target AP replying a confirmation response to the target terminal.

[0127] The target terminal indicates a terminal that sends a message to the first target AP.

[0128] The radio frequency card can be installed in a controller. The controller can be any AP in a WLAN network or other controller modules.

[0129] When the radio frequency card is installed in an AP in a WLAN network, the AP also becomes a monitoring AP in the WLAN network. At this time, the radio frequency card is installed in the monitoring AP.

[0130] When the controller is an AP, in some embodiments, the radio frequency card can be a radio frequency card that provides terminal access functions in the AP. However, this easily leads to the problem that the function of countering illegal APs conflicts with the function of terminal access: the problem of access terminal packet loss or offline due to the long scanning time of illegal APs and the untimely access of terminals; or the problem of untimely countermeasures due to the insufficient scanning time of illegal APs and the failure to identify illegal APs in time.

[0131] Therefore, in order to avoid the conflict between countering illegal APs and providing access functions to users (i.e., terminals) and to improve the effectiveness of countering illegal APs, when the controller is an AP, the embodiment of the present application preferably makes the radio frequency card independent of the radio frequency card that provides terminal access functions in the AP.

[0132] Based on the above method and radio frequency card, the effectiveness of countering illegal AP can be effectively guaranteed. The following assumes that the radio frequency card is installed in the AP, and the AP is regarded as the monitoring AP in the WLAN network. And, the confirmation response under the 802.11 standard is ACK confirmation, and examples are given for the two situations of the terminal trying to associate with the illegal AP and the terminal establishing a connection with the illegal AP and communicating.

[0133] Figure 7 A schematic diagram of countering an illegal AP when a target terminal attempts to associate with an illegal AP provided by an embodiment of the present application. Figure 7 As shown, when the terminal sends an association message to an illegal AP to request to establish a connection, the monitoring AP detects the association message based on the collected message information of the air interface. As a result, the VAP corresponding to the illegal AP replies ACK to the target terminal, and the ACK is the ACK sent by the VAP simulating the illegal AP based on the BSSID of the illegal AP. In this way, the terminal receives not only the ACK replied by the illegal AP, but also the confirmation response sent by the aforementioned VAP simulating the illegal AP.

[0134] This causes two ACKs to conflict on the terminal side, resulting in a demodulation failure on the terminal side, or receiving two duplicate ACKs. The terminal will mistakenly believe that the probe / auth / assoc and other associated messages with the illegal AP are lost, and will retransmit the associated messages. This loops through the aforementioned steps, preventing the terminal from establishing a normal connection with the illegal AP.

[0135] Further, Figure 8 A schematic diagram of countering an illegal AP when a target terminal has been associated with an illegal AP is provided in an embodiment of the present application.

[0136] like Figure 8 As shown, the only difference from the aforementioned attempt is that the target terminal sends a data message. The monitoring AP can also detect the data message sent to the illegal AP based on the collected air interface message information. Then, based on the VAP corresponding to the illegal AP, an ACK is replied to the terminal, so that the confirmation response replied by the aforementioned simulated illegal AP and the confirmation response replied by the illegal AP affect each other and conflict during air interface transmission, and the terminal fails to demodulate. Alternatively, the terminal receives two repeated ACKs successively / simultaneously (i.e., the confirmation response replied by the aforementioned simulated illegal AP and the confirmation response replied by the illegal AP). This causes the terminal to repeat the step of retransmitting the data message until the terminal goes offline. Thereby, the purpose of countering illegal AP is achieved.

[0137] Based on the same inventive concept, an embodiment of the present application provides a device for countering a target wireless access point, the device can be used in a controller, and the device is similar to the aforementioned Figure 4The method for countering the target wireless access point shown in the figure corresponds to the method for countering the target wireless access point. The specific implementation of the device can refer to the description of the aforementioned method embodiment part, and the repeated parts will not be repeated. Fig. 9 , the device comprises:

[0138] The virtual unit 901 is configured to determine a first target wireless access point AP, and generate a virtual wireless access point VAP corresponding to the first target AP.

[0139] The virtual unit 901 is specifically used to obtain the message information of the air interface, and read the first information of the AP in the message information of the air interface; based on the first information, identify the first target AP from the AP; and generate the VAP corresponding to the first wireless access point.

[0140] The virtual unit 901 is specifically used to cache the first information of the first target AP; extract the basic service set identifier BSSID of the first target AP from the first information of the first wireless access point; and generate a VAP corresponding to the first target AP based on the BSSID of the first target AP.

[0141] The number of the first target APs is greater than 1; the virtual unit is also used to determine the priority of the first target AP; based on the priority of the first target AP, the first target AP is added to the priority queue, and the first information of the first target AP is cached in the priority queue; and a VAP is generated for the first target AP in the priority queue.

[0142] The device for countering the target wireless access point also includes an updating unit, which is specifically used to update the information of the second target AP using the first information of the first target AP in response to the priority queue containing a second target AP whose BSSID is equal to that of the first target AP; and / or, in response to the aging of the first target AP, delete the first target AP from the priority queue and delete the VAP corresponding to the first target AP.

[0143] The responding unit 902 is configured to reply a confirmation response to the target terminal by using the VAP in response to detecting the message sent to the first target AP.

[0144] The target terminal is a terminal that sends the message to the first target AP.

[0145] The response unit 902 is specifically used to receive a target message; in response to the BSSID of the first target AP contained in the target message, determine that the sender of the target message is the target terminal; based on the source address in the target message, determine the address information of the target terminal; based on the address information of the target terminal, use the VAP to reply a confirmation response to the target terminal.

[0146] Based on the same inventive concept, the embodiment of the present application further provides a readable storage medium, including:

[0147] Memory,

[0148] The memory is used to store a computer program. When the computer program is executed by the processor, the device including the readable storage medium performs the method of countering a target wireless access point as described above.

[0149] Based on the same inventive concept as the above-mentioned method for countering a target wireless access point, an electronic device is also provided in an embodiment of the present application, and the electronic device can implement the function of the above-mentioned method for countering a target wireless access point, please refer to Fig.10 , the electronic device comprises:

[0150] At least one processor 1001, and a memory 1002 connected to the at least one processor 1001. The specific connection medium between the processor 1001 and the memory 1002 is not limited in the embodiment of the present application. Fig.10 In the example, the processor 1001 and the memory 1002 are connected via the bus 1000. Fig.10 The connections between other components are shown in bold lines, and are not intended to be limiting. The bus 1000 can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Fig.10 Only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus. Alternatively, the processor 1001 can also be called a controller, and there is no limitation on the name.

[0151] In the embodiment of the present application, the memory 1002 stores instructions that can be executed by at least one processor 1001. The at least one processor 1001 can execute the method of countering the target wireless access point discussed above by executing the instructions stored in the memory 1002. The processor 1001 can implement Fig. 9 The functions of each module in the device shown.

[0152] Among them, processor 1001 is the control center of the device, and can use various interfaces and lines to connect various parts of the entire control device. By running or executing instructions stored in memory 1002 and calling data stored in memory 1002, various functions of the device and processing data, the device can be monitored as a whole.

[0153] In one possible design, the processor 1001 may include one or more processing units, and the processor 1001 may integrate an application processor and a modem processor, wherein the application processor mainly processes an operating system, a user interface, and application programs, and the modem processor mainly processes wireless communications. It is understandable that the modem processor may not be integrated into the processor 1001. In some embodiments, the processor 1001 and the memory 1002 may be implemented on the same chip, and in some embodiments, they may also be implemented separately on separate chips.

[0154] The processor 1001 may be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component, and may implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the method for countering a target wireless access point disclosed in the embodiments of the present application may be directly embodied as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.

[0155] The memory 1002 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs and modules. The memory 1002 may include at least one type of storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory, a random access memory (Random Access Memory, RAM), a static random access memory (Static Random Access Memory, SRAM), a programmable read-only memory (Programmable Read Only Memory, PROM), a read-only memory (Read Only Memory, ROM), an electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, EEPROM), a magnetic memory, a disk, an optical disk, etc. The memory 1002 is any other medium that can be used to carry or store a desired program code in the form of an instruction or data structure and can be accessed by a computer, but is not limited thereto. The memory 1002 in the embodiment of the present application can also be a circuit or any other device that can realize a storage function, for storing program instructions and / or data.

[0156] By programming the processor 1001, the code corresponding to the method for countering the target wireless access point described in the above embodiment can be fixed into the chip, so that the chip can execute the code when running. Figure 4 The steps of the method for countering a target wireless access point are shown. How to design and program the processor 1001 is a technique known to those skilled in the art and will not be described in detail here.

[0157] Those skilled in the art can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. The specific working process of the system, device and unit described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0158] In the several embodiments provided by the present invention, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the modules or units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0159] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0160] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0161] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor (processor) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: a universal serial bus flash disk (Universal Serial Bus flash disk), a mobile hard disk, a read-only memory (Read-Only Memory, ROM), a random access memory (Random Access Memory, RAM), a disk or an optical disk, and other media that can store program codes.

[0162] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A method for countering a target wireless access point, applied to a controller, characterized in that: include: Determine a first target wireless access point AP, and generate a virtual wireless access point VAP corresponding to the first target AP; In response to detecting the message sent to the first target AP, using the VAP to reply a confirmation response to the target terminal; wherein the target terminal is the terminal that sends the message to the first target AP.

2. The method according to claim 1, characterized in that The determining of the first target wireless access point AP and generating a virtual wireless access point VAP corresponding to the first target AP includes: Acquire message information of the air interface, and read AP information from the message information of the air interface; Based on the information of the APs, identifying the first target AP from the APs; The VAP corresponding to the first target AP is generated.

3. The method according to claim 2, characterized in that The generating the VAP corresponding to the first target AP includes: caching first information of the first target AP; Extracting a basic service set identifier BSSID of the first target AP from the first information of the first target AP; A VAP corresponding to the first target AP is generated based on the BSSID of the first target AP.

4. The method according to any one of claims 1 to 3, characterized in that: The step of replying a confirmation response to the target terminal by using the VAP in response to detecting the message sent to the first target AP includes: Receive target message; In response to the target message containing the BSSID of the first target AP, determining that the sender of the target message is the target terminal; Determining the address information of the target terminal based on the source address in the target message; Based on the address information of the target terminal, a confirmation response is sent to the target terminal using the VAP.

5. The method according to any one of claims 1 to 3, characterized in that: The number of the first target APs is greater than 1; then generating a virtual wireless access point VAP corresponding to the first target AP includes: Determining the priority of the first target AP; Based on the priority of the first target AP, add the first target AP to a priority queue, and cache the first information of the first target AP in the priority queue; A VAP is generated for the first target AP in the priority queue.

6. The method according to claim 5, characterized in that After adding the first target AP to a priority queue based on the priority of the first target AP and caching the first information of the first target AP in the priority queue, the method further includes: In response to the priority queue containing a second target AP having a BSSID equal to that of the first target AP, updating the information of the second target AP using the first information of the first target AP; and / or, In response to the first target AP being aged, the first target AP is deleted from the priority queue, and the VAP corresponding to the first target AP is deleted.

7. A radio frequency card for countering a target wireless access point, characterized in that: include: A message module, used to determine a first target wireless access point AP, and generate a virtual wireless access point VAP corresponding to the first target AP; A response module: used for replying a confirmation response to a target terminal using the VAP in response to detecting a message sent to the first target AP; wherein the target terminal is a terminal that sends the message to the first target AP.

8. The radio frequency card as claimed in claim 7, characterized in that: The radio frequency card is installed in the AP; the radio frequency card is independent of the radio frequency card in the AP that provides the terminal access function.

9. A device for countering a target wireless access point, characterized in that: include: A virtual unit, configured to determine a first target wireless access point AP, and generate a virtual wireless access point VAP corresponding to the first target AP; A responding unit is used to reply a confirmation response to a target terminal using the VAP in response to detecting the message sent to the first target AP; wherein the target terminal is the terminal that sends the message to the first target AP.

10. A readable storage medium, characterized in that: include, Memory, The memory is used to store a computer program. When the computer program is executed by the processor, the device including the readable storage medium performs the method according to any one of claims 1 to 6.

Images