Monitoring device, monitoring method, and monitoring program

Abstract

A monitoring device (100) comprises a communication connection unit (124). When an unauthorized AP is present in a periphery, in order to fill a free connection of simultaneous connections to the unauthorized AP, the communication connection unit (124) uses each piece of device identification information of one or more pieces of device identification information generated so as not to overlap each other, to repeatedly connect to the unauthorized AP. Upon failure of the connection to the unauthorized AP, the communication connection unit (124) connects to the unauthorized AP using device identification information relating to a damaged CL connecting to the unauthorized AP, to thereby disconnect the communication connection between the unauthorized AP and the damaged CL. In order to fill a free connection which is of the simultaneous connections to the unauthorized AP and has become available as a result of disconnection of the communication connection, the communication connection unit (124) uses other device identification information to connect to the unauthorized AP.

Description

[Technical field]

[0001] The present disclosure relates to a monitoring device, a monitoring method, and a monitoring program. [Background technology]

[0002] The Wi-Fi® security standards up to WPA2 (Wi-Fi® Protected Access 2) had a vulnerability called DoS (Denial of Service) that allowed a third party to forcibly disconnect established communications using deauthentication frames. To counter this vulnerability, the WPA3 security standard requires a mechanism called PMF (Protected Management Frames). Meanwhile, in WIPS (Wireless Intrusion Prevention System), the vulnerability of forced disconnection of communication by deauthentication frames has been used to cut off communication of unauthorized devices (including both access points and clients). Fundamental measures against unauthorized devices include physically removing the unauthorized devices or cutting off their power. However, these fundamental measures cannot be implemented immediately after unauthorized communication is detected. Therefore, forced disconnection of communication by deauthentication frames has been used to limit damage that occurs between the detection of unauthorized communication and the implementation of fundamental measures. However, as WPA3 becomes more widespread, the deauthentication frame will no longer be effective in forcibly disconnecting communications. Therefore, a method that does not rely on deauthentication frames to block communications from unauthorized devices is required. Patent Document 1 discloses a technique in which, when an unauthorized client is detected in a PMF environment, a WIPS monitoring device spoofs the MAC (Medium Access Control) address of the unauthorized client to connect to a legitimate access point, thereby updating an encryption key for encrypting communication frames related to the MAC address. As a result of updating the encryption key, the unauthorized client cannot communicate with the legitimate access point because it does not know the new encryption key. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Special Publication No. 2018-511282 Summary of the Invention [Problem to be solved by the invention]

[0004] Patent Document 1 has the problem that it does not disclose measures to be taken when an unauthorized access point is installed, and the problem that it does not disclose measures to prevent a communication connection from being easily reconnected after it has been cut off. The present disclosure aims to provide a countermeasure for the case where an unauthorized access point is installed in a Wi-Fi (registered trademark) network in which PMF is enabled, which makes it difficult to easily reconnect after a communication connection is cut off. [Means for solving the problem]

[0005] The monitoring device according to the present disclosure comprises: an unauthorized device determination unit that determines whether or not an unauthorized access point that is not a properly installed access point is present in a group of surrounding devices based on communication between the group of surrounding devices and each of the surrounding devices in the wireless communication network; The above Among the surrounding equipment The abovewhen an unauthorized access point is present, repeatedly connecting to the unauthorized access point using each piece of device identification information of a device identification information group consisting of one or more pieces of device identification information generated so as not to overlap with each other, in order to fill the limit of the number of simultaneous connections to the unauthorized access point; when the connection to the unauthorized access point fails, disconnecting the communication connection between the unauthorized access point and the victim client by connecting to the unauthorized access point using device identification information of the victim client which is a communication device connected to the unauthorized access point; a communication connection unit that connects to the unauthorized access point using device identification information different from any of the device identification information groups in order to fill the slot for the number of simultaneous connections to the unauthorized access point that is vacant due to the disconnection of the communication connection; and A monitoring device comprising: the group of surrounding devices is composed of one or more devices that are present around the monitoring device and perform wireless communication; Each piece of device identification information in the device identification information group is different from the device identification information of the victim client. Effect of the Invention

[0006] According to the present disclosure, the limit of the number of simultaneous connections of the unauthorized access point is filled after the communication connection between the unauthorized access point and the victim client is cut off, so that the victim client cannot easily reconnect to the unauthorized access point after the communication connection is cut off. The present disclosure also works in a Wi-Fi (registered trademark) network where PMF is enabled. Therefore, according to the present disclosure, it is possible to provide a measure for a case where an unauthorized access point is installed in a Wi-Fi (registered trademark) network where PMF is enabled, which makes it difficult to reconnect after the communication connection is cut off. [Brief description of the drawings]

[0007] [Figure 1]FIG. 1 is a diagram for explaining a wireless communication network according to a first embodiment. [Diagram 2] 1 is a diagram showing an example of the configuration of a monitoring device 100 according to a first embodiment. [Diagram 3] 1 is a diagram showing an example of a hardware configuration of a monitoring device 100 according to a first embodiment. [Figure 4] 4 is a flowchart showing the operation of the monitoring device 100 according to the first embodiment. [Diagram 5] FIG. 13 is a diagram showing an example of a hardware configuration of a monitoring device 100 according to a modification of the first embodiment. [Figure 6] FIG. 13 is a diagram showing an example of the configuration of a monitoring device 100 according to a second embodiment. [Figure 7] 10 is a flowchart showing the operation of the monitoring device 100 according to the second embodiment. [Figure 8] 10 is a flowchart showing the operation of the monitoring device 100 according to a modification of the second embodiment. [Figure 9] FIG. 11 is a diagram showing an example of the configuration of a monitoring device 100 according to a third embodiment. [Figure 10] 11 is a flowchart showing the operation of the monitoring device 100 according to the third embodiment. [Figure 11] FIG. 13 is a diagram showing an example of the configuration of a monitoring device 100 according to a fourth embodiment. [Figure 12] 10 is a flowchart showing the operation of the monitoring device 100 according to the fourth embodiment. [Figure 13] FIG. 13 is a diagram showing an example of the configuration of a monitoring device 100 according to a modification of the fourth embodiment. [Figure 14] 13 is a flowchart showing the operation of the monitoring device 100 according to a modification of the fourth embodiment. [Figure 15] FIG. 13 is a diagram showing an example of the configuration of a monitoring device 100 according to a fifth embodiment. [Figure 16] 13 is a flowchart showing the operation of the monitoring device 100 according to the fifth embodiment. [Figure 17] FIG. 13 is a diagram for explaining a wireless communication network according to a modification of the fourth embodiment and a modification of the fifth embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0008] In the description of the embodiments and the drawings, the same elements and corresponding elements are given the same reference numerals. Descriptions of elements given the same reference numerals are omitted or simplified as appropriate. Arrows in the drawings primarily indicate data flow or processing flow. In addition, "part" may be read as "circuit," "step," "procedure," "processing," or "circuitry" as appropriate.

[0009] Embodiment 1 Hereinafter, the present embodiment will be described in detail with reference to the drawings. In this embodiment, the countermeasure against the unauthorized access point is a countermeasure in a situation where a unauthorized AP (access point) 10 has intruded into a wireless communication network and a communication connection has already been established between the unauthorized AP 10 and a legitimate CL (client) 20, as shown in FIG. 1. The wireless communication network is, for example, a Wi-Fi (registered trademark) network in which PMF (Protected Management Frames) is enabled. The legitimate CL 20 is a communication device, for example, a communication terminal such as a smartphone or a PC (Personal Computer). Here, among the legitimate CL 20, a CL that has already established a communication connection with the unauthorized AP 10 is particularly called a victim CL 21. The victim CL 21 is a communication device connected to the unauthorized AP 10. In addition, communication between the victim CL 21 and the unauthorized AP 10 is called unauthorized communication. In the unauthorized communication, the PMF is enabled, and there is a risk of damage such as information of the victim CL 21 being stolen by the unauthorized AP 10 or malware being downloaded to the victim CL 21 by the unauthorized AP 10. In this embodiment, measures that the monitoring device 100 can implement in the above-mentioned situation are shown. The monitoring device 100 may be at least a part of the legitimate AP 30, or may be a device installed separately from the legitimate AP 30. In addition, when the monitoring device 100 is at least a part of the legitimate AP 30, the legitimate AP 30 may include multiple radio devices, and the operation as an AP and the measures shown in this embodiment may be shared among the multiple radio devices.

[0010] ***Configuration Description*** Fig. 2 shows a configuration example of the monitoring device 100 according to the first embodiment. As shown in Fig. 2, the monitoring device 100 includes a communication unit 110, a control unit 120, and a storage unit 130. The monitoring device 100 is also called a wireless intrusion prevention device. When the monitoring device 100 is implemented in a legitimate AP 30, the monitoring device 100 may further include a communication processing unit that implements a function as an access point.

[0011] The communication unit 110 includes an antenna for wireless communication, and has a function of transmitting and receiving data to and from other devices via wireless communication.

[0012] The control unit 120 includes a communication monitoring unit 121, an information analyzing unit 122, an unauthorized device determining unit 123, a communication connecting unit 124, and a MAC (Medium Access Control) address generating unit 125.

[0013] The communication monitoring unit 121 acquires communication frames from each device in the surrounding device group. Here, the surrounding device group is composed of one or more devices that exist around the monitoring device 100 and perform wireless communication. The surrounding device group includes at least one of the unauthorized AP 10, the legitimate CL 20, and the victim CL 21.

[0014] The information analysis unit 122 analyzes the communication frames acquired by the communication monitoring unit 121 .

[0015] The unauthorized device determination unit 123 determines whether each device in the surrounding device group is an unauthorized device. As a specific example, the unauthorized device determination unit 123 determines whether or not an unauthorized AP 10 is present in the surrounding device group based on a communication frame transmitted by each device in the surrounding device group.

[0016] The communication connection unit 124 executes a process of connecting to other devices via wireless communication. In this specification, the term "connection" basically refers to a connection via wireless communication. The following describes a specific example of the process of the communication connection unit 124. In this example, the PMF may be valid in wireless communication between the unauthorized AP 10 and the victim CL 21. First, when a rogue AP 10 is present among the group of surrounding devices, the communication connection unit 124 repeatedly executes a connection to the rogue AP 10 using each piece of device identification information in the group of device identification information in order to fill the limit of the number of simultaneous connections of the rogue AP 10. Here, the group of device identification information is made up of one or more pieces of device identification information that are generated so as not to overlap with each other. Furthermore, each piece of device identification information in the group of device identification information is different from the device identification information of the victim CL 21. As a specific example, each piece of device identification information is a MAC address. Next, if the connection to the unauthorized AP 10 fails, the communication connection unit 124 disconnects the communication connection between the unauthorized AP 10 and the victim CL 21 by connecting to the unauthorized AP 10 using the device identification information of the victim CL 21. Next, in order to fill the vacant slot for the number of simultaneous connections of the unauthorized AP 10 caused by the disconnection of the communication connection, the communication connection unit 124 connects to the unauthorized AP 10 using device identification information different from any of the device identification information in the device identification information group.

[0017] The MAC address generation unit 125 generates a MAC address as appropriate.

[0018] The storage unit 130 stores communication frame information 131, unauthorized device information 132, victim device information 133, and a used MAC address table 134. The communication frame information 131 is made up of communication frames transmitted by each device in the surrounding device group. The unauthorized device information 132 is made up of device information for each unauthorized device. An unauthorized device is a device that is not a legitimate device. An unauthorized device may be a device that is not registered in the list indicating legitimate devices, or may be a device that is registered in the list indicating unauthorized devices. The victim device information 133 is made up of device information for each victim device. A victim device is a device that is connected to an unauthorized device. The used MAC address table 134 is table data showing a list of MAC addresses that are already in use.

[0019] 3 shows an example of a hardware configuration of the monitoring device 100 according to this embodiment. The monitoring device 100 is made up of a computer. The monitoring device 100 may be made up of multiple computers. Note that the monitoring device 100 may have a configuration in which a computer is built in.

[0020] As shown in the figure, the monitoring device 100 is a computer including hardware such as a processor 51, a memory 52, an auxiliary storage device 53, an input / output IF (Interface) 54, and a communication device 55. These pieces of hardware are appropriately connected via signal lines 59.

[0021] The processor 51 is an integrated circuit (IC) that performs arithmetic processing and controls hardware included in a computer. Specific examples of the processor 51 include a central processing unit (CPU), a digital signal processor (DSP), or a graphics processing unit (GPU). The monitoring device 100 may include a plurality of processors that replace the processor 51. The plurality of processors share the role of the processor 51.

[0022] The memory 52 is typically a volatile storage device, constitutes the storage unit 130, and is specifically a RAM (Random Access Memory). The memory 52 is also called a primary storage device or a main memory. Data stored in the memory 52 is saved in the auxiliary storage device 53 as necessary.

[0023] The auxiliary storage device 53 is typically a non-volatile storage device, also called storage, and specific examples thereof include a ROM (Read Only Memory), an HDD (Hard Disk Drive), or a flash memory. Data stored in the auxiliary storage device 53 is loaded into the memory 52 as necessary. The memory 52 and the auxiliary storage device 53 may be integrated into one unit.

[0024] The input / output IF 54 is a port to which an input device and an output device are connected. A specific example of the input / output IF 54 is a Universal Serial Bus (USB) terminal. Specific examples of the input device are a keyboard and a mouse. A specific example of the output device is a display.

[0025] The communication device 55 is a receiver and a transmitter, and is, for example, a communication chip or a network interface card (NIC).

[0026] Each unit of the monitoring device 100 may use the input / output IF 54 and the communication device 55 as appropriate when communicating with other devices.

[0027] The auxiliary storage device 53 stores a monitoring program. The monitoring program is a program that causes a computer to realize the functions of each unit of the monitoring device 100. The monitoring program stored in the auxiliary storage device 53 is loaded into the memory 52 and executed by the processor 51, thereby realizing the functions of this embodiment. The functions of each unit of the monitoring device 100 are realized by software.

[0028] Data used when executing the monitoring program and data obtained by executing the monitoring program are appropriately stored in the storage device. Each part of the monitoring device 100 uses the storage device as appropriate. As a specific example, the storage device is composed of at least one of the memory 52, the auxiliary storage device 53, a register in the processor 51, and a cache memory in the processor 51. Note that the terms "data" and "information" may have the same meaning. The storage device may be independent of the computer. The functions of the memory 52 and the auxiliary storage device 53 may be realized by other storage devices.

[0029] The monitoring program may be recorded in a computer-readable non-volatile recording medium. Specific examples of the non-volatile recording medium include an optical disk and a flash memory. The monitoring program may be provided as a program product.

[0030] ***Explanation of Operation*** The operational procedure of the monitoring device 100 corresponds to a monitoring method, and the program that realizes the operation of the monitoring device 100 corresponds to a monitoring program.

[0031] 4 is a flowchart showing an example of the operation of the monitoring device 100 according to the embodiment 1. The operation of the monitoring device 100 according to the embodiment 1 will be described with reference to FIG.

[0032] (Step S101) First, the communication unit 110 receives communication radio waves from each device in the surrounding device group using an antenna, demodulates the received radio waves, and performs analog-to-digital conversion on the demodulated result to obtain a digital signal. Next, the communication unit 110 transmits the obtained digital signal to the communication monitoring unit 121 . Next, the communication monitoring unit 121 interprets the received digital signal as a communication frame, thereby acquiring the communication frames transmitted and received by each device of the surrounding device group. The communication monitoring unit 121 stores the acquired communication frames in the storage unit 130 as a part of the communication frame information 131.

[0033] (Step S102) First, the information analysis unit 122 acquires information on each device of the surrounding device group by analyzing the communication frame information 131. As a specific example, the information on the rogue AP 10 is information obtained from a beacon frame periodically transmitted by the rogue AP 10, and indicates at least one of the BSSID (Basic Service Set Identifier), ESSID (Extended Service Set Identifier), channel (communication frequency) in use, PMF enabled / disabled, authentication method, encryption method, and MAC address (usually the same as the BSSID) of the rogue AP 10. The information on the legitimate CL 20 or the victim CL 21 is information obtained from a communication frame addressed to the AP or a probe request frame transmitted to search for the AP, and indicates at least one of the MAC address of the legitimate CL 20 or the victim CL 21, and the ESSID and BSSID of the AP to which the legitimate CL 20 or the victim CL 21 is connected (or is searching). Next, the unauthorized device determination unit 123 determines whether or not the unauthorized AP 10 exists in the surrounding device group based on the information acquired by the information analysis unit 122. Specific examples of the method of determining whether or not the unauthorized AP 10 exists include a method of determining that the unauthorized AP 10 exists when the surrounding device group includes a device that matches a device indicated in a predetermined list of unauthorized device information, a method of determining that the unauthorized AP 10 exists when the surrounding device group includes a device that is not indicated in a predetermined list of legitimate device information, a method of determining that the unauthorized AP 10 exists when the surrounding device group includes a device having device information that is the same as the device information of the monitoring device 100, or a method of accessing the AP indicated by the acquired information via a wired network to which the legitimate AP 30 is connected, and determining that the unauthorized AP 10 exists when there is an unexpected response (or no response).

[0034] (Step S103) If the unauthorized AP 10 is present among the group of surrounding devices, the monitoring device 100 proceeds to step S104. If the unauthorized AP 10 is not present among the group of surrounding devices, the monitoring device 100 returns to step S101.

[0035] (Step S104) The unauthorized device determination unit 123 stores the device information of the unauthorized AP 10 detected in step S102 in the storage unit 130 as a part of the unauthorized device information 132. Here, the device information corresponding to each device includes a countermeasure implementation flag corresponding to each device. The countermeasure implementation flag corresponding to each device is a flag for indicating whether or not a countermeasure has been implemented for each device. The fact that a countermeasure implementation flag corresponding to a certain device is set indicates that a countermeasure has been implemented for the certain device. Note that since it is possible that a unauthorized AP 10 that has once had countermeasures implemented recovers by rebooting or the like and attempts an attack again, the countermeasure implementation flag corresponding to each device may be implemented so that the countermeasure implementation flag corresponding to each device is released (reset to a state indicating that no countermeasure has been implemented) after a specified time has elapsed since the countermeasure implementation flag corresponding to each device was set. Regarding the unauthorized device information 132, each piece of device information may be erased when a specified time has elapsed since the device information was added to the unauthorized device information 132, or the unauthorized device information 132 may be reset every time step S104 is executed. Furthermore, the unauthorized device determination unit 123 may determine an upper limit on the number of unauthorized APs 10, and when the number of unauthorized APs 10 exceeds the determined upper limit, erase the oldest device information from the unauthorized device information 132, and then add new device information to the unauthorized device information 132.

[0036] (Step S105) If the unauthorized device information 132 does not contain device information for which the countermeasure implementation flag is not set (i.e., if the countermeasure implementation flag is set in the device information of all unauthorized APs 10 indicated by the unauthorized device information 132), the monitoring device 100 returns to step S101. Otherwise, the monitoring device 100 proceeds to step S106.

[0037] (Step S106) The unauthorized device determination unit 123 selects one piece of device information for which the countermeasure implementation flag is not set from the device information of the unauthorized AP 10 indicated by the unauthorized device information 132. Hereinafter, the unauthorized AP 10 selected in step 306 is referred to as a selected unauthorized AP.

[0038] (Step S107) First, the unauthorized device determination unit 123 requests the information analysis unit 122 to acquire device information of each victim CL 21 connected to the selected unauthorized AP. Next, the information analysis unit 122 acquires device information of each victim CL 21 connected to the selected unauthorized AP, and transmits the acquired device information to the unauthorized device determination unit 123 .

[0039] (Step S108) The unauthorized device determination unit 123 stores the device information of each victim CL 21 connected to the selected unauthorized AP, which is the device information transmitted by the information analysis unit 122, in the storage unit 130 as a part of the victim device information 133. Here, the device information corresponding to each device includes a countermeasure implementation flag corresponding to each device. Regarding the victim device information 133, each piece of device information may be erased after a specified time has elapsed since each piece of device information was added to the victim device information 133, or the victim device information 133 may be reset every time step S108 is executed. In addition, the unauthorized device determination unit 123 may determine an upper limit on the number of victim CLs 21, and when the number of victim CLs 21 exceeds the determined upper limit, erase the oldest device information from the victim device information 133, and then add new device information to the victim device information 133. However, when adopting two methods other than the method of resetting the victim device information 133 every time step S108 is executed among the three methods described above, there may be a plurality of pairs of the unauthorized AP 10 and the victim CL 21. Therefore, it is necessary to store information indicating the unauthorized AP 10 to which each victim CL 21 is connected (for example, the BSSID of the unauthorized AP 10) in association with each piece of device information.

[0040] (Step S109) The MAC address generation unit 125 generates one MAC address. The MAC address generation unit 125 may generate the MAC address using a random number, or may generate the MAC address by incrementing the value of the MAC address indicated by the victim device information 133. The MAC address generation unit 125 refers to the victim device information 133 and the used MAC address table, and confirms that the generated MAC address is different from any MAC address in the MAC address group to be confirmed. The MAC address group to be confirmed consists of the MAC addresses of each victim CL 21 and the MAC addresses stored in the used MAC address table. If MAC address generation unit 125 confirms that the generated MAC address is different from any MAC address in the MAC address group to be checked, it adds the generated MAC address to used MAC address table 134, and also transmits data indicating the generated MAC address to communication connection unit 124. If the generated MAC address is a duplicate of any MAC address in the MAC address group to be checked, MAC address generation unit 125 regenerates a MAC address, and then confirms again that the regenerated MAC address is different from any MAC address in the MAC address group to be checked. Here, if the generated MAC addresses are kept permanently stored in the used MAC address table 134, there is a possibility that the MAC addresses will be exhausted, resulting in an infinite loop of MAC address generation and confirmation failure. Therefore, each MAC address stored in the used MAC address table 134 may be deleted after a specified time has elapsed since it was added to the used MAC address table 134, or the used MAC address table 134 may be reset every time step S106 is executed. Also, the MAC address generation unit 125 may determine an upper limit on the number of MAC addresses that can be stored, and when the number of MAC addresses exceeds the determined upper limit, the oldest MAC address may be deleted from the used MAC address table 134, and then a new MAC address may be stored in the used MAC address table 134.

[0041] (Step S110) The communication connection unit 124 generates a communication frame necessary for connection processing as a digital signal. At this time, the communication connection unit 124 sets the MAC address generated in step S109 as the MAC address of the transmission source.

[0042] (Step S111) The communication connection unit 124 performs connection processing by transmitting an authentication request frame, an association request frame, and the like to the unauthorized AP 10 via the communication unit 110. The communication connection unit 124 confirms that the connection processing is being performed normally by checking the response from the communication unit 110. Note that, when communication encryption is set, the communication connection unit 124 may proceed with the connection processing up to sharing an encryption key.

[0043] (Step S112) If the monitoring device 100 is able to normally connect to the unauthorized AP 10, the monitoring device 100 returns to step S109. If the monitoring device 100 is unable to normally connect to the unauthorized AP 10, it is determined that the maximum number of simultaneously connected unauthorized APs 10 has been reached, and the monitoring device 100 proceeds to step S113. Specific examples of when the monitoring device 100 is unable to normally connect to the unauthorized AP 10 include when an error is returned, or when the monitoring device 100 is unable to normally connect to the unauthorized AP 10 due to a communication timeout, or the like.

[0044] (Step S113) If device information for which the countermeasure implementation flag is not set does not exist in the victim device information 133 (i.e., if the countermeasure implementation flag is set in the device information of all victim CLs 21 indicated by the victim device information 133), the unauthorized device determination unit 123 assumes that countermeasures against the selected unauthorized AP have been implemented and sets a countermeasure implementation flag in the device information of the selected unauthorized AP in the unauthorized device information 132, and then the monitoring device 100 returns to step S105. Otherwise, the monitoring device 100 proceeds to step S114.

[0045] (Step S114) The communication connection unit 124 generates a communication frame required for connection processing as a digital signal. At this time, the communication connection unit 124 selects one victim CL 21 for which measures have not been implemented by referring to the victim device information 133, and sets the MAC address of the selected victim CL 21 as the source MAC address of the communication frame. Here, the victim CL 21 for which measures have not been implemented is a victim CL 21 corresponding to device information for which a measure implementation flag is not set, among the device information included in the victim device information 133. Hereinafter, the victim CL 21 selected in step S114 is referred to as a first selected victim CL.

[0046] (Step S115) The communication connection unit 124 performs connection processing by transmitting an authentication request frame, an association request frame, and the like to the unauthorized AP 10 via the communication unit 110. The communication connection unit 124 confirms that the connection processing is being performed normally by checking the response from the communication unit 110. If communication encryption is set, the communication connection unit 124 proceeds with the connection processing up to the sharing of an encryption key. When the connection process with the unauthorized AP 10 is completed, the communication connection unit 124 transmits a deauthentication frame with the MAC address of the first selected victim CL as the source MAC address to the unauthorized AP 10, and disconnects the communication connection between the unauthorized AP 10 and the first selected victim CL. Here, if encryption of communication is set, the monitoring device 100 can obtain the encryption key of communication by proceeding to the encryption key sharing process, so that the unauthorized AP 10 can process the deauthentication frame normally even if the PMF is valid. In addition, when communication encryption is set, depending on the implementation of the unauthorized AP 10, it may be possible to cut off the communication connection between the unauthorized AP 10 and the first selected victim CL by simply sending a deauthentication frame to the unauthorized AP 10 with the MAC address of the first selected victim CL as the source MAC address during the connection process, without the connection process progressing to the sharing of the encryption key. The above-mentioned process cuts off the unauthorized communication between the first selected victim CL and the unauthorized AP 10. The communication connection unit 124 sets a countermeasure implementation flag in the device information of the first selected victim CL in the victim device information 133 to record that the unauthorized communication has been cut off. On the other hand, the disconnection of the communication connection vacates one slot in the number of simultaneous connections of the unauthorized AP 10. In order to prevent the victim CL 21 from reconnecting to the vacant slot, the monitoring device 100 returns to step S109 after performing step S115.

[0047] ***Explanation of the Effects of the First Embodiment*** As described above, in this embodiment, unauthorized communication between the victim CL 21 and the unauthorized AP 10 is cut off. Furthermore, since the monitoring device 100 fills the limit of the number of simultaneous connections of the unauthorized AP 10, the victim CL 21 whose unauthorized communication has been cut off cannot reconnect to the unauthorized AP 10. Therefore, according to this embodiment, it is possible to mitigate damage such as information of the victim CL 21 being stolen by the unauthorized AP 10, or the victim CL 21 being made to download malware to the unauthorized AP 10. Furthermore, according to this embodiment, it is possible to buy time until fundamental measures such as physical removal of the unauthorized device or cutting off power to the unauthorized device are implemented.

[0048] ***Other configurations*** <Variation 1> FIG. 5 shows an example of the hardware configuration of the monitoring device 100 according to this modified example. The monitoring device 100 includes a processing circuit 58 in place of the processor 51 , the processor 51 and a memory 52 , the processor 51 and an auxiliary storage device 53 , or the processor 51 , the memory 52 , and the auxiliary storage device 53 . The processing circuitry 58 is hardware that realizes at least a portion of each unit of the monitoring device 100 . The processing circuitry 58 may be dedicated hardware, or may be a processor that executes programs stored in the memory 52 .

[0049] When processing circuitry 58 is dedicated hardware, processing circuitry 58 may be, for example, a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or a combination thereof. The monitoring device 100 may include a plurality of processing circuits that replace the processing circuit 58. The plurality of processing circuits share the role of the processing circuit 58.

[0050] In the monitoring device 100, some of the functions may be realized by dedicated hardware, and the remaining functions may be realized by software or firmware.

[0051] Processing circuitry 58 is illustratively implemented in hardware, software, firmware, or a combination thereof. The processor 51, memory 52, auxiliary storage device 53, and processing circuit 58 are collectively referred to as the “processing circuitry.” In other words, the functions of the functional components of the monitoring device 100 are realized by the processing circuitry. Monitoring devices 100 according to other embodiments may also have the same configuration as this modified example.

[0052] Embodiment 2 The following mainly describes the differences from the above-described embodiment with reference to the drawings. In the first embodiment, when there is a large number of victim CLs 21, it may take some time to implement measures for all the victim CLs 21. Therefore, in the second embodiment, a form is shown in which the victim CLs 21 are evacuated to another channel in advance as a preparation before filling the limit of the number of simultaneous connections of the unauthorized AP 10.

[0053] ***Configuration Description*** FIG. 6 shows an example of the configuration of a monitoring device 100 according to the second embodiment. As shown in FIG. 6, the control unit 120 according to the second embodiment further includes a probe response generating unit 126 and a channel selecting unit 127, as compared with the control unit 120 according to the first embodiment.

[0054] The probe response generator 126 generates a communication frame including information for switching the channel of the victim CL 21 to the channel selected by the channel selector 127. A specific example of the communication frame is a beacon frame or a probe response frame. As a specific example, the probe response generator 126 switches the channel of the victim CL 21 to the first channel by transmitting the first transmission data to the victim CL 21. The first transmission data is communication data including a communication frame in which the device identification information of the rogue AP 10 is set as the device identification information of the transmission source so that the monitoring device 100 is recognized as the rogue AP 10, and the first channel is set as the channel switching destination. The first channel is a channel in which the rogue AP 10 does not exist. Note that setting the device identification information of the rogue AP 10 as the device identification information of the transmission source so that the monitoring device 100 is recognized as the rogue AP 10 corresponds to the monitoring device 100 impersonating the rogue AP 10.

[0055] The channel selection unit 127 selects a channel in which no unauthorized AP 10 exists as a switching destination of the channel of the victim CL 21.

[0056] As shown in FIG. 6, storage unit 130 according to the second embodiment further stores an association table 135 in comparison with storage unit 130 according to the first embodiment. The association table 135 is table data indicating a pair of each victim device and a channel on which the victim device exists, and is also called a "victim device-channel association table."

[0057] ***Explanation of Operation*** 7 is a flowchart showing an example of the operation of the monitoring device 100 according to the embodiment 2. The operation of the monitoring device 100 according to the embodiment 2 will be described with reference to FIG.

[0058] (Step S201) First, the channel selection unit 127 selects one damaged CL 21 for which no countermeasure has been implemented, by referring to the damaged device information 133. Hereinafter, the damaged CL 21 selected in step S201 is referred to as a second selected damaged CL. Next, the channel selection unit 127 refers to the association table 135 and selects one channel that does not have a rogue AP 10 and has the smallest number of associated CLs 21 as a channel to which the second selected victim CL is to be moved. If there are multiple applicable channels, the channel selection unit 127 may select the channel with the smallest channel number, or may select a channel using a random number. Hereinafter, the channel selected in step S201 is referred to as the first selected channel. If rogue APs 10 exist in all channels, there is no effect in moving the second selected victim CL to another channel, so the monitoring device 100 terminates the process of step S201 and proceeds to step S109. Next, the channel selection unit 127 adds a pair of the second selected victim CL and the first selected channel to the association table 135. In addition, the channel selection unit 127 transmits data indicating the pair of the second selected victim CL and the first selected channel to the probe response generation unit 126.

[0059] (Step S202) CSA (Channel Switch Announcement) is information that is sent to a CL when an AP switches a channel for communication. The CSA is included in a beacon frame, a probe response frame, or the like. The probe response generator 126 transmits a probe response frame in which the MAC address of the unauthorized AP 10 is set as the source MAC address and the first selected channel is set as the channel switching destination in the CSA to the second victim CL via the communication unit 110. Note that changing the contents of the CSA is equivalent to tampering with the CSA. After completing the transmission, the probe response generation unit 126 sets a countermeasure implementation flag in the device information of the second victim CL in the victim device information 133 to store the fact that the channel has been switched. Note that since the fraudulent AP 10 will not be able to communicate with the victim CL 21 once the victim CL 21 is moved to a channel different from that of the fraudulent AP 10, the flag indicating that the channel has been switched may be used in combination with the countermeasure implementation flag. Note that switching the channel corresponds to channel hopping.

[0060] (Step S203) If the device information in which the countermeasure implementation flag is not set does not exist in the victim device information 133 (i.e., if the countermeasure implementation flag is set in the device information of all the victim CLs 21 indicated by the victim device information 133), the monitoring device 100 proceeds to step S109 to fill the limit of the number of simultaneous connections of the unauthorized AP 10. Otherwise, the monitoring device 100 proceeds to step S201.

[0061] ***Explanation of the Effects of the Second Embodiment*** As described above, in this embodiment, the channel is switched before the limit of the number of simultaneous connections of the unauthorized AP 10 is filled, thereby cutting off the unauthorized communication between the victim CL 21 and the unauthorized AP 10. Furthermore, by filling the limit of the number of simultaneous connections of the unauthorized AP 10, the cut-off victim CL 21 does not reconnect to the unauthorized AP 10. Furthermore, according to this embodiment, it is possible to obtain the same effect as that of the first embodiment. Moreover, in the first embodiment, since the process of filling the limit of the number of simultaneous connections of the unauthorized AP 10 is executed first, it takes time to cut off the unauthorized communication between the victim CL 21 and the unauthorized AP 10. However, according to the present embodiment, since the unauthorized communication can be cut off before the process of filling the limit of the number of simultaneous connections of the unauthorized AP 10 is executed, the damage can be mitigated more than in the first embodiment.

[0062] ***Other configurations*** <Variation 2> In the second embodiment, the victim CL 21 is moved to an appropriately determined channel, so that if there is no legitimate AP 30 at the destination, the victim CL 21 to which the victim CL 21 has been moved cannot communicate at all. In this modification, therefore, assuming a case where multiple wireless devices exist, legitimate communication and measures against the unauthorized AP 10 are carried out in parallel. Here, multiple wireless devices may exist because the legitimate AP 30 is equipped with multiple wireless devices, or multiple wireless devices may exist because the legitimate AP 30 and the monitoring device 100 independent of the legitimate AP 30 each include one or more wireless devices. In this modified example, after executing the processing of step S203 and before executing the processing of step S109, the victim CL21 that was moved to a separate channel is moved back to the channel of the legitimate AP30, thereby enabling legitimate communication to be carried out with one wireless device while simultaneously filling the limit on the number of simultaneous connections of the unauthorized AP10 with another wireless device. The following mainly describes the differences from the second embodiment.

[0063] ***Configuration Description*** The configuration of the monitoring device 100 according to this modification is the same as the configuration of the monitoring device 100 according to the second embodiment. When the monitoring device 100 functions as a legitimate AP 30, the probe response generator 126 according to this modification switches the channel of the victim CL 21 to the second channel by transmitting second transmission data to the victim CL 21 whose channel has been switched to the first channel. The second transmission data is communication data including a communication frame in which device identification information of the unauthorized AP 10 is set as device identification information of the sender so that the monitoring device 100 is recognized as the unauthorized AP 10, and the second channel is set as the channel switching destination. The second channel is a channel in which the unauthorized AP 10 does not exist. After that, the probe response generator 126 switches the channel of the monitoring device 100 to the second channel in order to establish legitimate communication with the victim CL 21.

[0064] ***Explanation of Operation*** 8 is a flowchart showing an example of the operation of the monitoring device 100 according to this modification. The operation of the monitoring device 100 will be described with reference to FIG.

[0065] (Step S221) The channel selection unit 127 selects, as a channel for resuming regular communication, one channel on which no unauthorized AP 10 exists. Hereinafter, the channel selected in step S221 is referred to as a second selected channel. However, in this modified example, the channel selection unit 127 assumes that the unauthorized AP 10 may move channels in accordance with the CSA transmitted in step S202, and acquires surrounding communication frames again before selecting a channel, and checks the channel on which the unauthorized AP 10 is located based on the acquired communication frames.

[0066] (Step S222) The probe response generation unit 126 sends a probe response frame to the victim CL21 indicated in the association table 135 in order via the communication unit 110, with the source MAC address set to the MAC address of the unauthorized AP10 and the second selected channel set as the channel switching destination in the CSA. When transmitting a probe-response frame, the monitoring device 100 transmitting the probe-response frame needs to switch to a channel in which the victim CL 21, which is the transmission destination of the probe-response frame, exists.

[0067] (Step S223) The probe response generator 126 shifts the channel of the regular AP 30 to the second selected channel, and transmits a probe response frame to the victim CL 21 as the regular AP 30. This allows the victim CL 21 to connect to the regular AP 30 and resume regular communication. On the other hand, the wireless device in charge of filling the limit of the number of simultaneous connections of the unauthorized AP 10 switches the channel to the channel on which the unauthorized AP 10 exists, and proceeds to step S109 to continue the process.

[0068] ***Explanation of the effect of Modification 2*** In the second embodiment, the victim CL 21 is moved to an appropriately determined channel, so that the victim CL 21 cannot communicate at all if there is no legitimate AP 30 at the destination. However, according to this modification, the communication between the legitimate AP 30 and the legitimate CL 20 and the countermeasure against the unauthorized AP 10 can be implemented in parallel.

[0069] Embodiment 3 The following mainly describes the differences from the above-described embodiment with reference to the drawings. In the first and second embodiments, it takes a relatively long time to implement measures for each victim CL 21 because measures must be implemented for each victim CL 21. Therefore, in the third embodiment, when there are many victim CLs 21, a form is shown in which the damage is mitigated by disrupting unauthorized communications more quickly.

[0070] ***Configuration Description*** FIG. 9 shows an example of the configuration of a monitoring device 100 according to the third embodiment. As shown in FIG. 9, the control unit 120 according to the third embodiment further includes a deauthentication frame generating unit 128 in comparison with the control unit 120 according to the first embodiment.

[0071] When the PMF is valid in wireless communication between the unauthorized AP 10 and the victim CL 21, the deauthentication frame generating unit 128 generates a deauthentication frame using the encryption key received from the unauthorized AP 10, and transmits communication data including the generated deauthentication frame to the victim CL 21. The encryption key is a common key in the wireless communication network in which the unauthorized AP 10 participates.

[0072] ***Explanation of Operation*** 10 is a flowchart showing an example of the operation of the monitoring device 100 according to Embodiment 3. The operation of the monitoring device 100 will be described with reference to FIG.

[0073] (Step S301) If the monitoring device 100 is able to normally connect to the unauthorized AP 10, the monitoring device 100 proceeds to step S302. If the monitoring device 100 is unable to normally connect to the unauthorized AP 10, the monitoring device 100 returns to step S109.

[0074] (Step S302) The deauthentication frame generating unit 128 transmits a deauthentication frame, with the MAC address of the unauthorized AP 10 as the source MAC address, to the wireless communication network in which the selected unauthorized AP participates by broadcasting the deauthentication frame in the LAN (Local Area Network) of the selected unauthorized AP a specified number of times. Broadcast communication in the PMF is protected by the Broadcast Integrity Protocol (BIP). In this case, in the integrity verification of the broadcast communication frame in the BIP, an encryption key IGTK (Integrity Group Transient Key) common within the LAN received from the AP is used. Therefore, the monitoring device 100 normally connects to the unauthorized AP 10 as a CL, receives the IGTK, and transmits a broadcast deauthentication frame masquerading as the unauthorized AP 10 using the received IGTK, thereby disconnecting the communication between the unauthorized AP 10 and the victim CL 21 in the LAN in which the unauthorized AP 10 participates. Note that setting the MAC address of the unauthorized AP 10 as the source MAC address corresponds to masquerading as the unauthorized AP 10.

[0075] (Step S303) First, the communication monitoring unit 121 acquires a communication frame from each device in the surrounding device group via the communication unit 110. Next, the information analyzing unit 122 checks whether or not the communication frames acquired by the communication monitoring unit 121 include a communication frame from the selected unauthorized AP (that is, a communication frame whose source is the MAC address of the selected unauthorized AP). In step S303, the communication monitoring unit 121 and the information analyzing unit 122 appropriately execute at least a part of steps S101 and S102.

[0076] (Step S304) If a communication frame exists between the selected unauthorized AP and the victim CL21, this suggests that the communication could not be properly disconnected or that the victim CL21 reconnected to the selected unauthorized AP after the communication was properly disconnected, so the monitoring device 100 returns to step S109. If there is no communication frame from the selected unauthorized AP, the monitoring device 100 returns to step S101.

[0077] ***Explanation of the Effects of the Third Embodiment*** As described above, according to the present embodiment, it is possible to use a deauthentication frame to disrupt unauthorized communication between the victim CL 21 and the unauthorized AP 10. Furthermore, according to the present embodiment, it is possible to obtain the same effects as those of the first embodiment.

[0078] Embodiment 4 The following mainly describes the differences from the above-described embodiment with reference to the drawings. The third embodiment has a problem that, when the unauthorized AP 10 has a very high processing capacity, the load on the unauthorized AP 10 cannot be made large enough, and therefore the unauthorized communication may not function. Therefore, the fourth embodiment shows a form in which unauthorized communication is disrupted by making the victim CL 21 refrain from communicating with the unauthorized AP 10, rather than executing the disruption on the unauthorized AP 10.

[0079] ***Configuration Description*** FIG. 11 shows an example of the configuration of a monitoring device 100 according to the fourth embodiment. As shown in FIG. 11, the control unit 120 according to the fourth embodiment includes a probe response generation unit 126 instead of the communication connection unit 124 and the MAC address generation unit 125.

[0080] The probe response generator 126 according to this embodiment generates a beacon frame or a probe response frame. As a specific example, the probe response generator 126 transmits fourth transmission data to the victim CL 21 to lengthen the time until the victim CL 21 next communicates. The fourth transmission data is communication data including a communication frame in which device identification information of the rogue AP 10 is set as device identification information of the transmission source so that the monitoring device 100 is recognized as the rogue AP 10, and in which either a QoS (Quality of Service) related field or a field related to communication control is set so that the waiting time until the victim CL 21 transmits a communication frame to the rogue AP 10 is equal to or longer than a first reference waiting time. The first reference waiting time may be determined in any manner.

[0081] As shown in FIG. 11, the storage unit 130 according to the fourth embodiment stores QoS parameters 136 instead of storing a used MAC address table 134. In the fourth embodiment, the QoS parameter 136 is a value of a QoS-related field in an IEEE (Institute of Electrical and Electronics Engineers) 802.11 frame format, and a specific example is CWmin (Contention Windows minimum, a minimum value of a communication waiting counter) or AIFSN (Arbitration InterFrame Space Number, a unit time of communication waiting time) of an EDCA (Enhanced Distributed Channel Access) parameter. As a specific example, the QoS parameter 136 is set to a large value in advance. By transmitting a beacon frame or a probe response frame in which the QoS parameter 136 is set to a large value to the victim CL 21, the waiting time until the victim CL 21 transmits a communication frame can be forcibly made very long. Note that setting the value of the QoS parameter 136 corresponds to tampering with the QoS parameter 136. Furthermore, depending on the implementation of the victim CL 21, the waiting time counter may be reset every time the victim CL 21 receives a tampered beacon frame or probe response frame. In this case, it is possible to prevent the victim CL 21 from communicating at all.

[0082] ***Explanation of Operation*** 12 is a flowchart showing an example of the operation of the monitoring device 100 according to Embodiment 4. The operation of the monitoring device 100 will be described with reference to FIG.

[0083] (Step S401) The probe response generation unit 126 refers to the victim device information 133, and transmits a probe response frame, in which the QoS parameters 136 are appropriately set, to each victim CL 21 indicated by the victim device information 133 via the communication unit 110. At this time, the probe response generation unit 126 sets the MAC address of each victim CL 21 as the destination MAC address. The probe response generation unit 126 may transmit a broadcast beacon frame instead of the probe response frame.

[0084] ***Explanation of the effect of the fourth embodiment*** As described above, according to this embodiment, it is possible to disrupt unauthorized communication between each victim CL 21 and the unauthorized AP 10 by refraining from communication with each victim CL 21 using the QoS parameter 136. Furthermore, according to this embodiment, it is possible to obtain the same effect as that of the first embodiment.

[0085] ***Other configurations*** <Variation 3> In the fourth embodiment, the waiting time of the victim CL 21 is lengthened, so that there is a risk that, once the waiting time has elapsed, the victim CL 21 will communicate with the unauthorized AP 10. Therefore, in this modified example, a form is shown in which the victim CL 21 is made to refrain from communication by using the RTS / CTS (Request To Send / Clear To Send) method, which is one method of communication control. The RTS / CTS method is a method in which an AP controls communication by assigning transmission rights to CLs. In the RTS / CTS method, a CL sends an RTS frame to an AP, and the AP designates one CL with a CTS frame in response to the RTS, and only the designated CL can send data to the AP. By using this mechanism, it is possible to tamper with the CL that assigns transmission rights in the CTS frame to a CL that does not exist among the surrounding devices, and then to send the tampered CTS frame, thereby forcing all victim CLs 21 to refrain from transmission. Note that this modified example is based on the premise that the RTS / CTS method is used, and therefore may not always be applicable to the monitoring device 100. However, APs often have a function for switching to the RTS / CTS method when communication quality deteriorates. The following mainly describes the points that differ from the fourth embodiment.

[0086] ***Configuration Description*** FIG. 13 shows an example of the configuration of a monitoring device 100 according to this modification. As shown in FIG. 13, the control unit 120 according to this modification includes a CTS generation unit 129 and a MAC address generation unit 125 instead of the probe response generation unit 126.

[0087] The CTS generation unit 129 generates a CTS frame. As a specific example, when the RTS / CTS method is used in a wireless communication network in which the unauthorized AP 10 and the victim CL 21 participate, the CTS generation unit 129 broadcasts data to the wireless communication network including a communication frame in which device identification information of the device to which the transmission right is assigned that is different from any of the device identification information of devices present in the group of surrounding devices, in order to cause the victim CL 21 to refrain from communication.

[0088] ***Explanation of Operation*** 14 is a flowchart showing an example of the operation of the monitoring device 100 according to this modification. The operation of the monitoring device 100 will be described with reference to FIG.

[0089] (Step S421) The MAC address generation unit 125 generates one MAC address. The MAC address generation unit 125 may generate the MAC address using a random number, or may generate the MAC address by incrementing the value of the MAC address indicated by the victim device information 133. The MAC address generation unit 125 refers to the victim device information 133, and confirms that the generated MAC address is different from any of the MAC addresses of the victim CL21 indicated by the victim device information 133. When the MAC address generation unit 125 confirms that the generated MAC address is different from any of the MAC addresses of the victim CL 21 indicated by the victim device information 133, it transmits data indicating the generated MAC address to the CTS generation unit 129. Note that when the generated MAC address overlaps with any of the MAC addresses of the victim CL 21 indicated by the victim device information 133, the MAC address generation unit 125 regenerates a MAC address and confirms again that the regenerated MAC address is different from any of the MAC addresses of the victim CL 21 indicated by the victim device information 133.

[0090] (Step S422) First, the CTS generating unit 129 designates the MAC address indicated by the data received from the MAC address generating unit 125 as the target to which the transmission right is to be assigned. Next, the CTS generation unit 129 generates a CTS frame with the MAC address of the unauthorized AP 10 as the source MAC address, and transmits the generated CTS frame via the communication unit 110 by broadcast to the LAN of the unauthorized AP 10. The CTS generation unit 129 may generate a CTS frame unconditionally every time step S422 is executed, and transmit the generated CTS frame every time a CTS frame is generated. Alternatively, every time step S422 is executed, the communication monitoring unit 121 may acquire a communication frame from each device of the surrounding device group again, and only when the information analysis unit 122 confirms an RTS frame from the victim CL 21 among the communication frames acquired by the communication monitoring unit 121, the CTS generation unit 129 may transmit the generated CTS frame.

[0091] ***Explanation of the effect of modification 3*** As described above, according to this modification, the RTS / CTS method is used to cause the victim CL 21 to refrain from communication, thereby disrupting unauthorized communication between the victim CL 21 and the unauthorized AP 10. Furthermore, according to this modification, the same effects as those of the first embodiment can be obtained. Moreover, in this modification, the victim CL 21 can be made to refrain from communication regardless of the waiting time of the victim CL 21. Therefore, according to this modification, the damage can be further mitigated compared to the fourth embodiment.

[0092] <Modification 4> The fourth embodiment and the third modification are measures against the unauthorized AP 10. However, as shown in Fig. 17, the positions of the access point and the client can be reversed so that the monitoring device 100 poses as a legitimate AP 30 and makes the unauthorized CL 22 refrain from communication. That is, by appropriately utilizing the configurations of the fourth embodiment and the third modification, measures against the unauthorized CL 22 can be implemented.

[0093] The following describes a case where the configuration of the embodiment 4 is used. It is assumed that a legitimate AP 30 exists in the group of surrounding devices, and that an unauthorized CL 22 is connected to the legitimate AP 30. The probe response generator 126 transmits fifth transmission data to the unauthorized CL 22 to cause the unauthorized CL 22 to refrain from communication. The fifth transmission data is communication data including a communication frame in which device identification information of the legitimate AP 30 is set as device identification information of the transmission source so that the monitoring device 100 is recognized as the legitimate AP 30, and in which either a QoS-related field or a field related to communication control is set so that the waiting time until the unauthorized CL 22 transmits the communication frame to the legitimate AP 30 is equal to or longer than a second reference waiting time. The second reference waiting time may be determined in any manner.

[0094] The following describes a case where the configuration of Modification 3 is used. It is assumed that a legitimate AP 30 exists in the group of surrounding devices, and that an unauthorized CL 22 is connected to the legitimate AP 30. When a legitimate AP 30 and an unauthorized CL 22 participate in a wireless communication network, the CTS generating unit 129 broadcasts data to the wireless communication network including a communication frame in which device identification information different from any of the device identification information of devices present in the group of surrounding devices is set as device identification information of the device to which the transmission right is assigned, in order to cause the unauthorized CL 22 to refrain from communication.

[0095] Furthermore, Patent Document 1 has a problem that an unauthorized client that is unable to communicate due to an encryption key being updated can relatively easily reconnect to a legitimate access point by requesting reconnection to the legitimate access point using the same MAC address, as the WIPS monitoring device does. According to this modified example, an unauthorized client refrains from requesting reconnection to the legitimate access point, so it is not easy to reconnect to the legitimate access point.

[0096] Embodiment 5. The following mainly describes the differences from the above-described embodiment with reference to the drawings. In the second embodiment and the modified example of the second embodiment, a method is adopted in which the victim CL 21 is temporarily moved to another channel to prevent communication with the victim CL 21, so it takes time for the victim CL 21 to resume regular communication. Therefore, in the fifth embodiment, in order to mitigate the damage as quickly as possible and resume regular communication as quickly as possible, the monitoring device 100 directly deprives the unauthorized AP 10 of the communication connection with the victim CL 21.

[0097] ***Configuration Description*** FIG. 15 shows an example of the configuration of a monitoring device 100 according to the fifth embodiment. The configuration of the monitoring device 100 is the same as that of the monitoring device 100 according to the first embodiment except that the MAC address generation unit 125 and the used MAC address table 134 are excluded.

[0098] The communication connection unit 124 according to the present embodiment transmits sixth transmission data to the victim CL 21 in order to disconnect the communication connection between the unauthorized AP 10 and the victim CL 21. The sixth transmission data is communication data including a communication frame in which device identification information of the unauthorized AP 10 is set as device identification information of the transmission source so that the monitoring device 100 is recognized as the unauthorized AP 10, the communication data including a communication frame set to disconnect the communication connection between the unauthorized AP 10 and the victim CL 21, and the communication data including a communication frame set to establish a communication connection with the victim CL 21.

[0099] ***Explanation of Operation*** 16 is a flowchart showing an example of the operation of the monitoring device 100 according to Embodiment 5. The operation of the monitoring device 100 will be described with reference to FIG.

[0100] (Step S501) The communication connection unit 124 selects one damaged CL 21 for which no countermeasure has been implemented, by referring to the damaged device information 133. Hereinafter, the damaged CL 21 selected in step S501 is referred to as a third selected damaged CL.

[0101] (Step S502) The communication connection unit 124 performs connection processing with the third selected victim CL by sending a probe response frame to the third selected victim CL via the communication unit 110, the probe response frame having the MAC address of the unauthorized AP 10 as the source and the MAC address of the third selected victim CL as the destination. After the connection process is normally completed, the communication connection unit 124 sets a countermeasure implementation flag in the device information of the third selected victim CL in the victim device information 133.

[0102] (Step S503) If there is no device information in which the countermeasure implementation flag is not set in the damaged device information 133 (i.e., if the countermeasure implementation flag is set in all the damaged CLs 21 indicated by the damaged device information 133), the monitoring device 100 proceeds to step S504. Otherwise, the monitoring device 100 proceeds to step S501.

[0103] (Step S504) The unauthorized device determination unit 123 sets a countermeasure implementation flag in the device information of the selected unauthorized AP in the unauthorized device information 132, assuming that countermeasures have been implemented for the selected unauthorized AP. Furthermore, since each victim CL21 may have been forced to download malware because it had been communicating with the selected unauthorized AP until just before, there is a possibility that the victim CL21 may transmit an attack frame to the legitimate AP 30. Therefore, after the monitoring device 100 seizes the communication connection of each victim CL21, the legitimate AP 30 may monitor the communication of each victim CL21 for a certain period of time and implement countermeasures as necessary. Specific examples of countermeasures include displaying a warning screen to each victim CL21, narrowing the communication bandwidth of each victim CL21, or ignoring communication from each victim CL21. After completing the process of step S504, the monitoring device 100 returns to step S101.

[0104] ***Explanation of the effect of the fifth embodiment*** As described above, according to the fifth embodiment, the monitoring device 100 can cut off unauthorized communication between the unauthorized AP 10 and each victim CL 21 by directly intercepting the communication connection between the unauthorized AP 10 and each victim CL 21. Furthermore, according to the present embodiment, it is possible to obtain the same effect as that of the first embodiment. Furthermore, according to the fifth embodiment, the monitoring device 100 provides legitimate communication to each victim CL 21, so that legitimate communication can be provided to each victim CL 21 more quickly than in the second embodiment.

[0105] ***Other configurations*** <Variation 5> The fifth embodiment is a measure against the unauthorized AP 10. However, as shown in Fig. 17, the positions of the access point and the client can be reversed, and the monitoring device 100 can directly intercept the communication with the unauthorized CL 22 from the legitimate AP 30. That is, by appropriately utilizing the configuration of the fifth embodiment, it is also possible to implement a measure against the unauthorized CL 22.

[0106] The following describes the use of the configuration of the fifth embodiment. It is assumed that a legitimate AP 30 exists in the group of surrounding devices, and that an unauthorized CL 22 is connected to the legitimate AP 30. The communication connection unit 124 transmits the seventh transmission data to the unauthorized CL 22 in order to disconnect the communication connection between the legitimate AP 30 and the unauthorized CL 22. The seventh transmission data is communication data including a communication frame in which the device identification information of the legitimate AP 30 is set as the device identification information of the sender so that the monitoring device 100 is recognized as the legitimate AP 30, the seventh transmission data is communication data including a communication frame set to disconnect the communication connection between the legitimate AP 30 and the unauthorized CL 22, and the seventh transmission data is communication data including a communication frame set to establish a communication connection with the unauthorized CL 22.

[0107] Moreover, according to this modification, the problems in Patent Document 1 mentioned above can be solved.

[0108] ***Other embodiments*** The above-described embodiments may be freely combined, or any of the components in each embodiment may be modified, or any of the components in each embodiment may be omitted. Moreover, the embodiments are not limited to those shown in the first to fifth embodiments, and various modifications are possible as necessary. The procedures explained using the flowcharts and the like may be modified as appropriate. [Explanation of symbols]

[0109] 10 Rogue AP, 20 Genuine CL, 21 Victim CL, 22 Rogue CL, 30 Genuine AP, 51 Processor, 52 Memory, 53 Auxiliary storage device, 54 Input / output IF, 55 Communication device, 58 Processing circuit, 59 Signal line, 100 Monitoring device, 110 Communication unit, 120 Control unit, 121 Communication monitoring unit, 122 Information analysis unit, 123 Rogue device determination unit, 124 Communication connection unit, 125 MAC address generation unit, 126 Probe response generation unit, 127 Channel selection unit, 128 Deauthentication frame generation unit, 129 CTS generation unit, 130 Memory unit, 131 Communication frame information, 132 Rogue device information, 133 Victim device information, 134 Used MAC address table, 135 Related table, 136 QoS parameters.

Claims

1. In a wireless communication network, an unauthorized device determination unit determines whether or not an unauthorized access point that is an access point other than a properly installed access point is present in a surrounding device group based on communication between each device included in the surrounding device group; when the unauthorized access point is present in the group of surrounding devices, repeatedly connecting to the unauthorized access point using each device identification information of a device identification information group consisting of one or more device identification information pieces generated so as not to overlap with each other, in order to fill the limit of the number of simultaneous connections of the unauthorized access point; when the connection to the unauthorized access point fails, disconnecting the communication connection between the unauthorized access point and the victim client by connecting to the unauthorized access point using device identification information of the victim client which is a communication device connected to the unauthorized access point; a communication connection unit that connects to the unauthorized access point using device identification information different from any of the device identification information groups in order to fill a slot for the number of simultaneous connections to the unauthorized access point that has become vacant due to the disconnection of the communication connection; A monitoring device comprising: the group of surrounding devices is made up of one or more devices that are present around the monitoring device and perform wireless communication; A monitoring device in which each piece of device identification information in the device identification information group is different from the device identification information of the victim client.

2. The monitoring device of claim 1, wherein the unauthorized device determination unit determines whether or not the unauthorized access point is present among the surrounding device group based on at least one of device identification information indicated by a communication frame transmitted by each device in the surrounding device group and a response from each device in the surrounding device group.

3. 3. The monitoring device according to claim 1, wherein each piece of device identification information in the device identification information group is a MAC address, and the device identification information of the victim client is a MAC address.

4. 3. The monitoring device according to claim 1, wherein Protected Management Frames are effective in wireless communication between the unauthorized access point and the victim client.

5. The monitoring device further comprises: a probe response generating unit that switches the channel of the victim client to the first channel by transmitting to the victim client transmission data, the communication data including a communication frame in which device identification information of the rogue access point is set as device identification information of a transmission source so that the monitoring device is recognized as the rogue access point, and in which a first channel, which is a channel in which the rogue access point is not present, is set as a channel switching destination. The monitoring device according to claim 1 or 2, comprising:

6. When the monitoring device functions as a legitimate access point, the probe response generation unit switching the channel of the victim client to the second channel by transmitting, to the victim client whose channel has been switched to the first channel, communication data including a communication frame in which device identification information of the rogue access point is set as device identification information of a transmission source so that the monitoring device is recognized as the rogue access point, and in which a second channel, which is a channel in which the rogue access point is not present, is set as a channel switching destination; 6. The monitoring device of claim 5, further comprising: switching a channel of the monitoring device to the second channel in order to establish a regular communication with the victim client.

7. The computer that is the monitoring device In a wireless communication network, a determination is made as to whether or not an unauthorized access point, which is an access point that is not a properly installed access point, is present in a group of surrounding devices based on communication between each device included in the group of surrounding devices; when the unauthorized access point is present in the group of surrounding devices, repeatedly connecting to the unauthorized access point using each device identification information of a device identification information group consisting of one or more device identification information pieces generated so as not to overlap with each other, in order to fill the limit of the number of simultaneous connections of the unauthorized access point; when the connection to the unauthorized access point fails, disconnecting the communication connection between the unauthorized access point and the victim client by connecting to the unauthorized access point using device identification information of the victim client which is a communication device connected to the unauthorized access point; a monitoring method for connecting to the unauthorized access point using device identification information different from any of the device identification information group in order to fill a slot for simultaneous connections to the unauthorized access point that has become vacant due to the disconnection of the communication connection, the monitoring method comprising: the group of surrounding devices is made up of one or more devices that are present around the monitoring device and perform wireless communication; A monitoring method in which each device identification information of the device identification information group is different from the device identification information of the victim client.

8. In a wireless communication network, an unauthorized device determination process is performed to determine whether or not an unauthorized access point, which is an access point that is not a properly installed access point, is present in a surrounding device group based on communication between each device included in the surrounding device group; when the unauthorized access point is present in the group of surrounding devices, repeatedly connecting to the unauthorized access point using each device identification information of a device identification information group consisting of one or more device identification information pieces generated so as not to overlap with each other, in order to fill the limit of the number of simultaneous connections of the unauthorized access point; when the connection to the unauthorized access point fails, disconnecting the communication connection between the unauthorized access point and the victim client by connecting to the unauthorized access point using device identification information of the victim client which is a communication device connected to the unauthorized access point; a communication connection process for connecting to the unauthorized access point using device identification information different from any of the device identification information groups in order to fill a slot for simultaneous connections to the unauthorized access point that has become vacant due to the disconnection of the communication connection; A monitoring program for causing a monitoring device that is a computer to execute the above, the group of surrounding devices is made up of one or more devices that are present around the monitoring device and perform wireless communication; A monitoring program in which each piece of device identification information in the device identification information group is different from the device identification information of the victim client.

Images