Monitoring device, monitoring method, and monitoring program

Abstract

A monitoring device (100) comprises a communication connection unit (124). When an unauthorized AP is present in a periphery, in order to fill a free connection of simultaneous connections to the unauthorized AP, the communication connection unit (124) uses each piece of device identification information of one or more pieces of device identification information generated so as not to overlap each other, to repeatedly connect to the unauthorized AP. Upon failure of the connection to the unauthorized AP, the communication connection unit (124) connects to the unauthorized AP using device identification information relating to a damaged CL connecting to the unauthorized AP, to thereby disconnect the communication connection between the unauthorized AP and the damaged CL. In order to fill a free connection which is of the simultaneous connections to the unauthorized AP and has become available as a result of disconnection of the communication connection, the communication connection unit (124) uses other device identification information to connect to the unauthorized AP.

Description

Monitoring device, monitoring method, and monitoring program

[0001] The present disclosure relates to a monitoring device, a monitoring method, and a monitoring program.

[0002] Wi-Fi (registered trademark) security standards up to the security standard WPA2 (Wi-Fi (registered trademark) Protected Access 2) had a vulnerability known as DoS (Denial of Service), which allowed a third party to forcibly terminate established communications using deauthentication frames. To address this vulnerability, the security standard WPA3 requires a mechanism called PMF (Protected Management Frames). Meanwhile, the Wireless Intrusion Prevention System (WIPS) has previously used the vulnerability related to the forced termination of communications using deauthentication frames to block communications from unauthorized devices (including both access points and clients). Fundamental countermeasures against unauthorized devices include physically removing the unauthorized devices or shutting off their power. However, these fundamental countermeasures cannot be implemented immediately after detecting unauthorized communications. Therefore, in order to mitigate damage that may occur between the detection of unauthorized communications and the implementation of fundamental countermeasures, a forced disconnection of communications using deauthentication frames has been used. However, with the spread of WPA3, forced disconnection of communications using deauthentication frames will no longer function. Therefore, an alternative method for blocking communications from unauthorized devices that does not rely on deauthentication frames is needed. Patent Document 1 discloses a technology in which, when an unauthorized client is detected in a PMF environment, a WIPS monitoring device spoofs the unauthorized client's MAC (Medium Access Control) address to connect to a legitimate access point, thereby updating the encryption key used to encrypt communication frames related to the MAC address. As a result of updating the encryption key, the unauthorized client becomes unable to communicate with the legitimate access point because it does not know the new encryption key.

[0003] Special table 2018-511282 publication

[0004] Patent Document 1 has the problem that it does not disclose measures to be taken when an unauthorized access point is installed, and does not disclose measures to prevent a communication connection from being easily reconnected after being disconnected. The present disclosure aims to provide a measure to be taken when an unauthorized access point is installed in a Wi-Fi (registered trademark) network where PMF is enabled, which prevents a communication connection from being easily reconnected after being disconnected.

[0005] The monitoring device according to the present disclosure is a monitoring device comprising: when a rogue access point is present among a group of surrounding devices, the monitoring device repeatedly connects to the rogue access point using each device identification information of a group of device identification information consisting of one or more device identification information generated so as not to overlap with each other, in order to fill the limit on the number of simultaneous connections to the rogue access point; if the connection to the rogue access point fails, the monitoring device disconnects the communication connection between the rogue access point and the victim client by connecting to the rogue access point using the device identification information of a victim client that is a communication device connected to the rogue access point; and a communication connection unit that connects to the rogue access point using device identification information different from any device identification information in the group of device identification information, in order to fill the limit on the number of simultaneous connections to the rogue access point that is vacant due to the communication connection being disconnected; wherein the group of surrounding devices consists of one or more devices that are present around the monitoring device and perform wireless communication, and each device identification information in the group of device identification information is different from the device identification information of the victim client.

[0006] According to the present disclosure, after a communication connection between a rogue access point and a victim client is terminated, the limit on the number of simultaneous connections to the rogue access point is filled, so that the victim client cannot easily reconnect to the rogue access point after the communication connection is terminated. The present disclosure also functions in a Wi-Fi (registered trademark) network where PMF is enabled. Therefore, according to the present disclosure, a countermeasure can be provided for a case where a rogue access point is installed in a Wi-Fi (registered trademark) network where PMF is enabled, which makes it difficult to easily reconnect to the rogue access point after the communication connection is terminated.

[0007] FIG. 1 is a diagram illustrating a wireless communication network according to a first embodiment. FIG. 2 is a diagram illustrating a configuration example of a monitoring device 100 according to the first embodiment. FIG. 3 is a diagram illustrating a hardware configuration example of the monitoring device 100 according to the first embodiment. A flowchart illustrating the operation of the monitoring device 100 according to the first embodiment. FIG. 4 is a diagram illustrating a configuration example of the monitoring device 100 according to a modification of the first embodiment. FIG. 5 is a diagram illustrating wireless communication networks according to a modification of the fourth embodiment and a modification of the fifth embodiment.

[0008] In the description of the embodiments and the drawings, the same elements and corresponding elements are given the same reference numerals. The description of elements given the same reference numerals will be omitted or simplified as appropriate. Arrows in the drawings mainly indicate the flow of data or the flow of processing. Furthermore, "unit" may be read as "circuit," "step," "procedure," "process," or "circuitry" as appropriate.

[0009] Embodiment 1. This embodiment will be described in detail below with reference to the drawings. In this embodiment, countermeasures against unauthorized access points are taken in a situation where, as shown in FIG. 1 , a unauthorized AP (access point) 10 has infiltrated a wireless communication network and a communication connection has already been established between the unauthorized AP 10 and a legitimate CL (client) 20. The wireless communication network is, for example, a Wi-Fi (registered trademark) network in which PMF (Protected Management Frames) is enabled. The legitimate CL 20 is a communication device, for example, a communication terminal such as a smartphone or a PC (Personal Computer). Here, among the legitimate CLs 20, a CL that has already established a communication connection with the unauthorized AP 10 is specifically referred to as a victim CL 21. The victim CL 21 is a communication device connected to the unauthorized AP 10. Furthermore, communication between the victim CL 21 and the unauthorized AP 10 is referred to as unauthorized communication. In unauthorized communication, PMF is enabled, and there is a risk of damage, such as information about the victim CL 21 being stolen by the rogue AP 10 or the victim CL 21 being forced to download malware to the rogue AP 10. In this embodiment, countermeasures that can be implemented by the monitoring device 100 in the above-mentioned situation are described. The monitoring device 100 may be at least a part of the legitimate AP 30, or may be a device installed separately from the legitimate AP 30. Furthermore, when the monitoring device 100 is at least a part of the legitimate AP 30, the legitimate AP 30 may be equipped with multiple radio devices, and the operation of the AP and the countermeasures described in this embodiment may be shared among the multiple radio devices.

[0010] *** Description of Configuration *** Fig. 2 shows an example configuration of the monitoring device 100 according to the first embodiment. As shown in Fig. 2, the monitoring device 100 includes a communication unit 110, a control unit 120, and a storage unit 130. The monitoring device 100 is also called a wireless intrusion prevention device. Note that when the monitoring device 100 is implemented in a legitimate AP 30, the monitoring device 100 may further include a communication processing unit that implements the function of an access point.

[0011] The communication unit 110 includes an antenna for wireless communication, and has the function of transmitting and receiving data to and from other devices via wireless communication.

[0012] The control unit 120 includes a communication monitoring unit 121 , an information analyzing unit 122 , an unauthorized device determining unit 123 , a communication connecting unit 124 , and a MAC (Medium Access Control) address generating unit 125 .

[0013] The communication monitoring unit 121 acquires communication frames from each device in the surrounding device group. Here, the surrounding device group consists of one or more devices that exist around the monitoring device 100 and perform wireless communication. The surrounding device group includes at least one of the rogue AP 10, the legitimate CL 20, and the victim CL 21.

[0014] The information analysis unit 122 analyzes the communication frames acquired by the communication monitoring unit 121 .

[0015] The unauthorized device determination unit 123 determines whether each device in the surrounding device group is an unauthorized device. As a specific example, the unauthorized device determination unit 123 determines whether or not an unauthorized AP 10 exists in the surrounding device group based on a communication frame transmitted by each device in the surrounding device group.

[0016] The communication connection unit 124 executes a process for connecting with other devices via wireless communication. Note that, in this specification, the term "connection" basically refers to a connection via wireless communication. A specific example of the process performed by the communication connection unit 124 will be described below. In this example, PMF may be enabled for wireless communication between the rogue AP 10 and the victim CL 21. First, if the rogue AP 10 is present in the group of surrounding devices, the communication connection unit 124 repeatedly attempts to connect to the rogue AP 10 using each piece of device identification information in the device identification information group to fill the limit on the number of simultaneous connections for the rogue AP 10. Here, the device identification information group consists of one or more pieces of device identification information generated so as not to overlap with each other. Furthermore, each piece of device identification information in the device identification information group is different from the device identification information of the victim CL 21. A specific example of each piece of device identification information is a MAC address. Next, if the communication connection unit 124 fails to connect to the rogue AP 10, it connects to the rogue AP 10 using the device identification information of the victim CL 21, thereby severing the communication connection between the rogue AP 10 and the victim CL 21. Next, the communication connection unit 124 connects to the unauthorized AP 10 using device identification information that is different from any of the device identification information in the device identification information group, in order to fill the slot for the number of simultaneous connections of the unauthorized AP 10 that has become vacant due to the communication connection being disconnected.

[0017] The MAC address generation unit 125 generates a MAC address as needed.

[0018] The memory unit 130 stores communication frame information 131, unauthorized device information 132, victim device information 133, and a used MAC address table 134. The communication frame information 131 consists of communication frames transmitted by each device in the surrounding device group. The unauthorized device information 132 consists of device information for each unauthorized device. An unauthorized device is a device that is not a legitimate device. An unauthorized device may be a device that is not registered in a list indicating legitimate devices, or may be a device that is registered in a list indicating unauthorized devices. The victim device information 133 consists of device information for each victim device. A victim device is a device that is connected to an unauthorized device. The used MAC address table 134 is table data that shows a list of MAC addresses that are in use.

[0019] 3 shows an example of the hardware configuration of the monitoring device 100 according to this embodiment. The monitoring device 100 is composed of a computer. The monitoring device 100 may be composed of multiple computers. Note that the monitoring device 100 may also be configured to include a built-in computer.

[0020] As shown in the figure, the monitoring device 100 is a computer that includes hardware such as a processor 51, a memory 52, an auxiliary storage device 53, an input / output IF (Interface) 54, and a communication device 55. These pieces of hardware are appropriately connected via signal lines 59.

[0021] The processor 51 is an integrated circuit (IC) that performs arithmetic processing and controls the hardware of the computer. Specific examples of the processor 51 include a central processing unit (CPU), a digital signal processor (DSP), or a graphics processing unit (GPU). The monitoring device 100 may include multiple processors that replace the processor 51. The multiple processors share the role of the processor 51.

[0022] The memory 52 is typically a volatile storage device and constitutes the storage unit 130. A specific example of the memory 52 is a random access memory (RAM). The memory 52 is also called a primary storage device or a main memory. Data stored in the memory 52 is saved in the auxiliary storage device 53 as needed.

[0023] The auxiliary storage device 53 is typically a non-volatile storage device, also called storage, and specific examples thereof include a ROM (Read Only Memory), an HDD (Hard Disk Drive), or a flash memory. Data stored in the auxiliary storage device 53 is loaded into the memory 52 as needed. The memory 52 and the auxiliary storage device 53 may be configured integrally.

[0024] The input / output IF 54 is a port to which an input device and an output device are connected. Specific examples of the input / output IF 54 include a USB (Universal Serial Bus) terminal. Specific examples of the input device include a keyboard and a mouse. Specific examples of the output device include a display.

[0025] The communication device 55 is a receiver and a transmitter, and is specifically a communication chip or a NIC (Network Interface Card).

[0026] Each unit of the monitoring device 100 may use the input / output IF 54 and the communication device 55 as appropriate when communicating with other devices.

[0027] The auxiliary storage device 53 stores a monitoring program. The monitoring program is a program that causes a computer to realize the functions of each unit included in the monitoring device 100. The monitoring program stored in the auxiliary storage device 53 is loaded into the memory 52 and executed by the processor 51, thereby realizing the functions of this embodiment. The functions of each unit included in the monitoring device 100 are realized by software.

[0028] Data used when executing the monitoring program and data obtained by executing the monitoring program are stored in a storage device as appropriate. Each part of the monitoring device 100 uses a storage device as appropriate. As a specific example, the storage device comprises at least one of the memory 52, the auxiliary storage device 53, a register in the processor 51, and a cache memory in the processor 51. Note that the terms "data" and "information" may have the same meaning. The storage device may be independent of the computer. The functions of the memory 52 and the auxiliary storage device 53 may be realized by other storage devices.

[0029] The monitoring program may be recorded on a computer-readable non-volatile recording medium. Specific examples of the non-volatile recording medium include an optical disk and a flash memory. The monitoring program may be provided as a program product.

[0030] ***Explanation of Operation*** The operational procedure of the monitoring device 100 corresponds to a monitoring method. Also, the program that realizes the operation of the monitoring device 100 corresponds to a monitoring program.

[0031] 4 is a flowchart showing an example of the operation of the monitoring device 100 according to embodiment 1. The operation of the monitoring device 100 according to embodiment 1 will be described with reference to FIG.

[0032] (Step S101) First, the communication unit 110 receives communication radio waves from each device in the surrounding device group using an antenna, demodulates the received radio waves, and obtains a digital signal by performing analog-to-digital conversion on the demodulated result. Next, the communication unit 110 transmits the obtained digital signal to the communication monitoring unit 121. Next, the communication monitoring unit 121 interprets the received digital signal as a communication frame, thereby obtaining communication frames transmitted and received by each device in the surrounding device group. The communication monitoring unit 121 stores the obtained communication frames in the storage unit 130 as part of communication frame information 131.

[0033] (Step S102) First, the information analysis unit 122 acquires information about each device in the group of surrounding devices by analyzing the communication frame information 131. As a specific example, the information about the rogue AP 10 is information obtained from a beacon frame periodically transmitted by the rogue AP 10, and is information indicating at least one of the BSSID (Basic Service Set Identifier), ESSID (Extended Service Set Identifier), channel (communication frequency) in use, PMF enabled / disabled, authentication method, encryption method, and MAC address (usually the same as the BSSID) of the rogue AP 10. The information on the legitimate CL 20 or the victim CL 21 is information obtained from a communication frame addressed to the AP or a probe request frame sent to search for the AP, and is information indicating at least one of the MAC address of the legitimate CL 20 or the victim CL 21 and the ESSID and BSSID of the AP to which the legitimate CL 20 or the victim CL 21 is connected (or is searching for). Next, the unauthorized device determination unit 123 determines whether or not a unauthorized AP 10 is present among the group of surrounding devices based on the information obtained by the information analysis unit 122. Specific examples of methods for determining whether or not a rogue AP 10 exists include a method of determining that a rogue AP 10 exists when the group of surrounding devices contains a device that matches a device indicated in a predetermined list of rogue device information, a method of determining that a rogue AP 10 exists when the group of surrounding devices contains a device that is not indicated in a predetermined list of legitimate device information, a method of determining that a rogue AP 10 exists when the group of surrounding devices contains a device that has the same device information as the device information of the monitoring device 100, or a method of accessing the AP indicated by the acquired information via the wired network to which the legitimate AP 30 is connected and determining that a rogue AP 10 exists when an unexpected response (or no response) is received.

[0034] (Step S103) If the unauthorized AP 10 is present in the group of surrounding devices, the monitoring device 100 proceeds to step S104. If the unauthorized AP 10 is not present in the group of surrounding devices, the monitoring device 100 returns to step S101.

[0035] (Step S104) The unauthorized device determination unit 123 stores the device information of the unauthorized AP 10 detected in step S102 in the storage unit 130 as part of the unauthorized device information 132. Here, the device information corresponding to each device includes a countermeasure implementation flag corresponding to the device. The countermeasure implementation flag corresponding to each device indicates whether countermeasures have been implemented for the device. The setting of a countermeasure implementation flag corresponding to a device indicates that countermeasures have been implemented for the device. Since it is possible that a countermeasure-implemented unauthorized AP 10 may recover by rebooting or the like and attempt another attack, the countermeasure implementation flag corresponding to each device may be cleared (reset to a state indicating that countermeasures have not been implemented) after a specified time has elapsed since the countermeasure implementation flag corresponding to the device was set. Each piece of device information may be erased after a specified time has elapsed since the device information was added to the unauthorized device information 132, or the unauthorized device information 132 may be reset each time step S104 is executed. In addition, the unauthorized device determination unit 123 may determine an upper limit on the number of unauthorized APs 10, and when the number of unauthorized APs 10 exceeds the determined upper limit, may delete the oldest device information from the unauthorized device information 132, and then add new device information to the unauthorized device information 132.

[0036] (Step S105) If the unauthorized device information 132 does not contain any device information for which the countermeasure implementation flag is not set (i.e., if the countermeasure implementation flag is set in the device information of all unauthorized APs 10 indicated by the unauthorized device information 132), the monitoring device 100 returns to step S101. Otherwise, the monitoring device 100 proceeds to step S106.

[0037] (Step S106) The unauthorized device determination unit 123 selects one piece of device information for which the countermeasure implementation flag is not set from the device information of the unauthorized APs 10 indicated by the unauthorized device information 132. Hereinafter, the unauthorized AP 10 selected in step S106 will be referred to as the selected unauthorized AP.

[0038] (Step S107) First, the unauthorized device determination unit 123 requests the information analysis unit 122 to acquire device information of each victim CL 21 connected to the selected unauthorized AP. Next, the information analysis unit 122 acquires the device information of each victim CL 21 connected to the selected unauthorized AP and transmits the acquired device information to the unauthorized device determination unit 123.

[0039] (Step S108) The unauthorized device determination unit 123 stores the device information of each victim CL 21 connected to the selected unauthorized AP, which is the device information transmitted by the information analysis unit 122, in the storage unit 130 as part of the victim device information 133. Here, the device information corresponding to each device includes a countermeasure implementation flag corresponding to each device. Each piece of device information may be deleted from the victim device information 133 after a specified time has elapsed since the device information was added to the victim device information 133, or the victim device information 133 may be reset each time step S108 is executed. Alternatively, the unauthorized device determination unit 123 may determine an upper limit on the number of victim CLs 21. If the number of victim CLs 21 exceeds the upper limit, the unauthorized device determination unit 123 may delete the oldest device information from the victim device information 133 and then add new device information to the victim device information 133. However, if two of the three methods described above other than the method of resetting the victim device information 133 each time step S108 is executed are employed, multiple pairs of unauthorized APs 10 and victim CLs 21 may exist. Therefore, it is necessary to store information indicating the unauthorized AP 10 to which each victim CL 21 is connected (for example, the BSSID of the unauthorized AP 10) in association with each piece of device information.

[0040] (Step S109) The MAC address generation unit 125 generates one MAC address. The MAC address generation unit 125 may generate the MAC address using a random number, or may generate the MAC address by incrementing the value of the MAC address indicated by the victim device information 133. The MAC address generation unit 125 references the victim device information 133 and the used MAC address table and confirms that the generated MAC address is different from any MAC address in the MAC address group to be confirmed. The MAC address group to be confirmed consists of the MAC addresses of each victim CL 21 and the MAC addresses stored in the used MAC address table. If the MAC address generation unit 125 confirms that the generated MAC address is different from any MAC address in the MAC address group to be confirmed, it adds the generated MAC address to the used MAC address table 134 and transmits data indicating the generated MAC address to the communication connection unit 124. If the generated MAC address overlaps with any MAC address in the MAC address group to be checked, the MAC address generation unit 125 regenerates the MAC address and then verifies that the regenerated MAC address is different from any MAC address in the MAC address group to be checked. If the generated MAC address continues to be permanently stored in the used MAC address table 134, there is a possibility that the MAC addresses will run out, resulting in an infinite loop of MAC address generation and verification failures. Therefore, each MAC address stored in the used MAC address table 134 may be deleted after a specified time has elapsed since it was added to the used MAC address table 134, or the used MAC address table 134 may be reset each time step S106 is executed. In addition, the MAC address generation unit 125 may determine an upper limit on the number of MAC addresses that can be stored, and when the number of MAC addresses exceeds the determined upper limit, it may delete the oldest MAC address from the used MAC address table 134, and then store a new MAC address in the used MAC address table 134.

[0041] (Step S110) The communication connection unit 124 generates a communication frame necessary for connection processing as a digital signal. At this time, the communication connection unit 124 sets the MAC address generated in step S109 as the MAC address of the sender.

[0042] (Step S111) The communication connection unit 124 performs connection processing by transmitting an authentication request frame, an association request frame, and the like to the unauthorized AP 10 via the communication unit 110. The communication connection unit 124 confirms that the connection processing is being performed normally by checking the response from the communication unit 110. Note that if communication encryption is set, the communication connection unit 124 may proceed with the connection processing up to the sharing of an encryption key.

[0043] (Step S112) If the monitoring device 100 is able to successfully connect to the unauthorized AP 10, the monitoring device 100 returns to step S109. If the monitoring device 100 is unable to successfully connect to the unauthorized AP 10, it determines that the maximum number of simultaneous connections for the unauthorized AP 10 has been reached, and the monitoring device 100 proceeds to step S113. Specific examples of when the monitoring device 100 is unable to successfully connect to the unauthorized AP 10 include when an error is returned, or when the monitoring device 100 is unable to successfully connect to the unauthorized AP 10 due to a communication timeout or other reason.

[0044] (Step S113) If the victim device information 133 does not contain device information for which the countermeasure implementation flag is not set (i.e., if the countermeasure implementation flag is set in the device information of all victim CLs 21 indicated by the victim device information 133), the unauthorized device determination unit 123 assumes that countermeasures have been implemented against the selected unauthorized AP and sets a countermeasure implementation flag in the device information of the selected unauthorized AP in the unauthorized device information 132, after which the monitoring device 100 returns to step S105. Otherwise, the monitoring device 100 proceeds to step S114.

[0045] (Step S114) The communication connection unit 124 generates a communication frame required for connection processing as a digital signal. At this time, the communication connection unit 124 refers to the victim device information 133 to select one victim CL 21 for which countermeasures have not been implemented, and sets the MAC address of the selected victim CL 21 as the source MAC address of the communication frame. Here, the victim CL 21 for which countermeasures have not been implemented is a victim CL 21 corresponding to device information for which the countermeasure implementation flag is not set, among the device information included in the victim device information 133. Hereinafter, the victim CL 21 selected in step S114 is referred to as the first selected victim CL.

[0046] (Step S115) The communication connection unit 124 performs connection processing by transmitting an authentication request frame, an association request frame, and the like to the rogue AP 10 via the communication unit 110. The communication connection unit 124 confirms that the connection processing is being performed normally by checking the response from the communication unit 110. If communication encryption is set, the communication connection unit 124 proceeds with the connection processing until the encryption key is shared. Upon completion of the connection processing with the rogue AP 10, the communication connection unit 124 transmits a deauthentication frame to the rogue AP 10, with the MAC address of the first selected victim CL as the sender MAC address, and disconnects the communication connection between the rogue AP 10 and the first selected victim CL. Here, if communication encryption is set, the monitoring device 100 has been able to obtain the communication encryption key by proceeding to the encryption key sharing processing, and therefore the rogue AP 10 can process the deauthentication frame normally even if the PMF is enabled. In addition, when communication encryption is enabled, depending on the implementation of the rogue AP 10, it may be possible to disconnect the communication connection between the rogue AP 10 and the first selected victim CL simply by sending a deauthentication frame to the rogue AP 10 with the MAC address of the first selected victim CL as the source MAC address during the connection process, without proceeding to the sharing of an encryption key. The above-described process disconnects the unauthorized communication between the first selected victim CL and the rogue AP 10. The communication connection unit 124 sets a countermeasure implementation flag in the device information of the first selected victim CL in the victim device information 133 to record that the unauthorized communication has been disconnected. Meanwhile, the disconnection of the communication connection frees up one slot in the number of simultaneous connections for the rogue AP 10. To prevent the victim CL 21 from reconnecting to the freed slot, the monitoring device 100 performs step S115 and then returns to step S109.

[0047] ***Explanation of the Effects of Embodiment 1*** As described above, in this embodiment, unauthorized communication between the victim CL 21 and the unauthorized AP 10 is cut off. Furthermore, because the monitoring device 100 fills the limit on the number of simultaneous connections to the unauthorized AP 10, the victim CL 21 whose unauthorized communication has been cut off cannot reconnect to the unauthorized AP 10. Therefore, this embodiment can mitigate damage such as information about the victim CL 21 being stolen by the unauthorized AP 10 or the victim CL 21 being forced to download malware to the unauthorized AP 10. Furthermore, this embodiment can buy time until fundamental measures such as physically removing the unauthorized device or cutting off power to the unauthorized device are implemented.

[0048] ***Other Configurations*** <Modification 1> Fig. 5 shows an example of the hardware configuration of the monitoring device 100 according to this modification. The monitoring device 100 includes a processing circuit 58 instead of the processor 51, the processor 51 and memory 52, the processor 51 and auxiliary storage device 53, or the processor 51, memory 52, and auxiliary storage device 53. The processing circuit 58 is hardware that realizes at least a portion of the components included in the monitoring device 100. The processing circuit 58 may be dedicated hardware, or may be a processor that executes a program stored in the memory 52.

[0049] When processing circuitry 58 is dedicated hardware, processing circuitry 58 may be, for example, a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or a combination thereof. Monitoring device 100 may include multiple processing circuits that replace processing circuitry 58. The multiple processing circuits share the role of processing circuitry 58.

[0050] In the monitoring device 100, some of the functions may be realized by dedicated hardware, and the remaining functions may be realized by software or firmware.

[0051] The processing circuitry 58 is realized by, for example, hardware, software, firmware, or a combination of these. The processor 51, memory 52, auxiliary storage device 53, and processing circuitry 58 are collectively referred to as the "processing circuitry." In other words, the functions of the functional components of the monitoring device 100 are realized by the processing circuitry. Monitoring devices 100 according to other embodiments may also have a configuration similar to that of this modification.

[0052] Second Embodiment. The following mainly describes the differences from the above-described embodiments with reference to the drawings. In the first embodiment, if there are a large number of victim CLs 21, it may take some time to implement measures for all of the victim CLs 21. Therefore, the second embodiment shows a form in which the victim CLs 21 are first evacuated to another channel as a preparation before filling the limit on the number of simultaneous connections of the unauthorized AP 10.

[0053] *** Description of Configuration *** Fig. 6 shows an example configuration of a monitoring device 100 according to embodiment 2. As shown in Fig. 6, the control unit 120 according to embodiment 2 further includes a probe response generation unit 126 and a channel selection unit 127, compared to the control unit 120 according to embodiment 1.

[0054] The probe response generation unit 126 generates a communication frame including information for switching the channel of the victim CL 21 to the channel selected by the channel selection unit 127. A specific example of this communication frame is a beacon frame or a probe response frame. Specifically, the probe response generation unit 126 switches the channel of the victim CL 21 to the first channel by transmitting first transmission data to the victim CL 21. The first transmission data is communication data including a communication frame in which the device identification information of the rogue AP 10 is set as the device identification information of the source so that the monitoring device 100 is recognized as the rogue AP 10, and in which the first channel is set as the channel to be switched to. The first channel is a channel on which the rogue AP 10 does not exist. Note that setting the device identification information of the rogue AP 10 as the device identification information of the source so that the monitoring device 100 is recognized as the rogue AP 10 is equivalent to the monitoring device 100 impersonating the rogue AP 10.

[0055] The channel selector 127 selects a channel where no malicious AP 10 exists as a switching destination for the victim CL 21 .

[0056] 6, the storage unit 130 according to the second embodiment further stores an association table 135, in comparison with the storage unit 130 according to the first embodiment. The association table 135 is table data indicating pairs of victim devices and channels on which the victim devices exist, and is also called a "victim device-channel association table."

[0057] ***Explanation of Operation*** Fig. 7 is a flowchart showing an example of the operation of the monitoring device 100 according to embodiment 2. The operation of the monitoring device 100 according to embodiment 2 will be described with reference to Fig. 7 .

[0058] (Step S201) First, the channel selection unit 127 refers to the victim device information 133 and selects one victim CL 21 for which no countermeasures have been implemented. Hereinafter, the victim CL 21 selected in step S201 is referred to as the second selected victim CL. Next, the channel selection unit 127 refers to the association table 135 and selects one channel to which the second selected victim CL is to be transferred, the channel being one that does not contain any rogue APs 10 and has the smallest number of associated victim CLs 21. If there are multiple applicable channels, the channel selection unit 127 may select the channel with the smallest channel number or may select a channel using a random number. Hereinafter, the channel selected in step S201 is referred to as the first selected channel. Note that if rogue APs 10 exist on all channels, transferring the second selected victim CL to another channel is ineffective, so the monitoring device 100 terminates the processing of step S201 and proceeds to step S109. Next, the channel selector 127 adds a pair of the second selected victim CL and the first selected channel to the association table 135. In addition, the channel selector 127 transmits data indicating the pair of the second selected victim CL and the first selected channel to the probe response generator 126.

[0059] (Step S202) A CSA (Channel Switch Announcement) is information transmitted to a CL when an AP switches the channel on which it communicates. The CSA is included in a beacon frame, a probe response frame, or the like. The probe response generation unit 126 transmits a probe response frame to the second victim CL via the communication unit 110, with the MAC address of the rogue AP 10 set as the source MAC address and the first selected channel set as the destination channel in the CSA. Note that changing the contents of the CSA is equivalent to tampering with the CSA. After completing the transmission, the probe response generation unit 126 sets a countermeasure implementation flag in the device information of the second victim CL in the victim device information 133 to record that the channel has been switched. Note that, since the malicious AP 10 will no longer be able to communicate with the victim CL 21 once the victim CL 21 is moved to a channel different from that of the malicious AP 10, a flag indicating that the channel has been switched may be used in combination with a countermeasure implementation flag. Note that switching channels corresponds to channel hopping.

[0060] (Step S203) If the victim device information 133 does not contain device information for which the countermeasure implementation flag is not set (i.e., if the countermeasure implementation flag is set in the device information of all victim CLs 21 indicated by the victim device information 133), the monitoring device 100 proceeds to step S109 to fill the limit on the number of simultaneous connections of the malicious AP 10. Otherwise, the monitoring device 100 proceeds to step S201.

[0061] ***Explanation of the Effects of the Second Embodiment*** As described above, in the present embodiment, unauthorized communication between the victim CL 21 and the unauthorized AP 10 is terminated by switching the channel before the limit on the number of simultaneous connections of the unauthorized AP 10 is filled. Furthermore, by filling the limit on the number of simultaneous connections of the unauthorized AP 10, the disconnected victim CL 21 will not reconnect to the unauthorized AP 10. Furthermore, according to the present embodiment, the same effects as those of the first embodiment can be obtained. Furthermore, in the first embodiment, the process of filling the limit on the number of simultaneous connections of the unauthorized AP 10 is executed first, so it takes time to terminate unauthorized communication between the victim CL 21 and the unauthorized AP 10. However, according to the present embodiment, unauthorized communication can be terminated before the process of filling the limit on the number of simultaneous connections of the unauthorized AP 10 is executed, thereby further mitigating damage compared to the first embodiment.

[0062] ***Other Configurations*** <Variation 2> In the second embodiment, the victim CL 21 is moved to an appropriately determined channel. Therefore, if there is no legitimate AP 30 at the destination, the victim CL 21 cannot communicate at all. Therefore, in this variation, assuming the presence of multiple wireless devices, legitimate communication and countermeasures against the rogue AP 10 are implemented in parallel. Here, multiple wireless devices may be present because the legitimate AP 30 is equipped with multiple wireless devices. Multiple wireless devices may also be present because the legitimate AP 30 and the monitoring device 100, which is independent of the legitimate AP 30, each have one or more wireless devices. In this variation, after executing the process of step S203 and before executing the process of step S109, the victim CL 21, which has been moved to a different channel, is moved back to the channel of the legitimate AP 30. This allows legitimate communication to be performed with one wireless device while simultaneously filling the limit on the number of simultaneous connections of the rogue AP 10 with another wireless device. Below, the differences from the second embodiment will be mainly described.

[0063] *** Description of Configuration *** The configuration of the monitoring device 100 according to this modification is the same as the configuration of the monitoring device 100 according to the second embodiment. When the monitoring device 100 functions as a legitimate AP 30, the probe response generator 126 according to this modification switches the channel of the victim CL 21 to the second channel by transmitting second transmission data to the victim CL 21 whose channel has been switched to the first channel. The second transmission data is communication data including a communication frame in which the device identification information of the rogue AP 10 is set as the device identification information of the sender so that the monitoring device 100 is recognized as the rogue AP 10, and the second channel is set as the channel to which the channel is to be switched. The second channel is a channel on which the rogue AP 10 does not exist. The probe response generator 126 then switches the channel of the monitoring device 100 to the second channel to establish legitimate communication with the victim CL 21.

[0064] ***Explanation of Operation*** Fig. 8 is a flowchart showing an example of the operation of the monitoring device 100 according to this modification. The operation of the monitoring device 100 will be described with reference to Fig. 8.

[0065] (Step S221) The channel selection unit 127 selects one channel on which the rogue AP 10 does not exist as a channel for resuming legitimate communication. Hereinafter, the channel selected in step S221 will be referred to as the second selected channel. However, in this modification, the channel selection unit 127 assumes that the rogue AP 10 may change channels in response to the CSA sent in step S202, and so before selecting a channel, the channel selection unit 127 acquires surrounding communication frames again and checks the channel on which the rogue AP 10 exists based on the acquired communication frames.

[0066] (Step S222) The probe response generation unit 126 sequentially transmits probe response frames to the victim client 21 indicated in the association table 135 via the communication unit 110, with the MAC address of the rogue AP 10 set as the source MAC address and the second selected channel set as the channel switching destination in the CSA. Note that when transmitting the probe response frame, the monitoring device 100 that transmits the probe response frame needs to switch to a channel on which the victim client 21, the destination of the probe response frame, is located.

[0067] (Step S223) The probe response generator 126 shifts the channel of the legitimate AP 30 to the second selected channel and transmits a probe response frame to the victim client 21 as the legitimate AP 30. This allows the victim client 21 to connect to the legitimate AP 30 and resume legitimate communication. Meanwhile, the wireless device responsible for filling the limit on the number of simultaneous connections for the rogue AP 10 shifts the channel to the channel on which the rogue AP 10 is present, and proceeds to step S109 to continue processing.

[0068] ***Explanation of the Effect of Modification 2*** In the second embodiment, the victim CL 21 is moved to an appropriately determined channel, so if there is no legitimate AP 30 at the destination, the moved victim CL 21 cannot communicate at all. However, according to this modification, communication between the legitimate AP 30 and the legitimate CL 20 and measures against the unauthorized AP 10 can be implemented in parallel.

[0069] Embodiment 3. The following mainly describes the differences from the above-described embodiments with reference to the drawings. In Embodiments 1 and 2, it is necessary to implement countermeasures for each victim CL 21 one by one, which takes a relatively long time to implement. Therefore, in Embodiment 3, when there are many victim CLs 21, a form is shown in which damage is mitigated by more quickly disrupting unauthorized communications.

[0070] *** Description of Configuration *** Fig. 9 shows an example configuration of a monitoring device 100 according to embodiment 3. As shown in Fig. 9, compared to the control unit 120 according to embodiment 1, the control unit 120 according to embodiment 3 further includes a deauthentication frame generation unit 128.

[0071] When the PMF is valid for wireless communication between the unauthorized AP 10 and the victim CL 21, the deauthentication frame generator 128 generates a deauthentication frame using the encryption key received from the unauthorized AP 10 and transmits communication data including the generated deauthentication frame to the victim CL 21. The encryption key is a common key in the wireless communication network in which the unauthorized AP 10 participates.

[0072] ***Explanation of Operation*** Fig. 10 is a flowchart showing an example of the operation of the monitoring device 100 according to embodiment 3. The operation of the monitoring device 100 will be described with reference to Fig. 10 .

[0073] (Step S301) If the monitoring device 100 is able to successfully connect to the unauthorized AP 10, the monitoring device 100 proceeds to step S302. If the monitoring device 100 is unable to successfully connect to the unauthorized AP 10, the monitoring device 100 returns to step S109.

[0074] (Step S302) The deauthentication frame generation unit 128 broadcasts a deauthentication frame, with the MAC address of the rogue AP 10 as the source MAC address, to the wireless communication network in which the selected rogue AP participates, over the LAN (Local Area Network) of the selected rogue AP a specified number of times. Broadcast communication in the PMF is protected by the Broadcast Integrity Protocol (BIP). Here, the integrity verification of the broadcast communication frame in the BIP uses an encryption key IGTK (Integrity Group Transient Key) common within the LAN received from the AP. Therefore, the monitoring device 100 successfully connects to the rogue AP 10 as a CL, receives the IGTK, and then uses the received IGTK to send a broadcast deauthentication frame masquerading as the rogue AP 10, thereby disconnecting communication between the rogue AP 10 and the victim CL 21 within the LAN to which the rogue AP 10 participates. Note that using the MAC address of the rogue AP 10 as the source MAC address is equivalent to masquerading as the rogue AP 10.

[0075] (Step S303) First, the communication monitoring unit 121 acquires communication frames from each device in the peripheral device group via the communication unit 110. Next, the information analysis unit 122 checks whether or not a communication frame from the selected unauthorized AP (i.e., a communication frame whose source is the MAC address of the selected unauthorized AP) is present among the communication frames acquired by the communication monitoring unit 121. Note that in step S303, the communication monitoring unit 121 and the information analysis unit 122 appropriately execute at least a part of steps S101 and S102.

[0076] (Step S304) If a communication frame exists between the selected unauthorized AP and the victim CL 21, it indicates that the communication was not successfully disconnected or that the victim CL 21 reconnected to the selected unauthorized AP after the communication was successfully disconnected, so the monitoring device 100 returns to step S109. If a communication frame does not exist from the selected unauthorized AP, the monitoring device 100 returns to step S101.

[0077] ***Explanation of the Effects of the Third Embodiment*** As described above, according to this embodiment, it is possible to use a deauthentication frame to disrupt unauthorized communication between the victim CL 21 and the unauthorized AP 10. Furthermore, according to this embodiment, it is possible to obtain the same effects as those of the first embodiment.

[0078] Fourth Embodiment. The following mainly describes the differences from the above-described embodiments with reference to the drawings. The third embodiment has a problem in that if the unauthorized AP 10 has very high processing power, the load on the unauthorized AP 10 cannot be made large enough, and therefore the interference may not function. Therefore, the fourth embodiment shows a form in which unauthorized communication is interfered with by having the victim CL 21 refrain from communicating with the unauthorized AP 10, rather than interfering with the unauthorized AP 10.

[0079] *** Description of Configuration *** Fig. 11 shows an example of the configuration of a monitoring device 100 according to embodiment 4. As shown in Fig. 11 , the control unit 120 according to embodiment 4 includes a probe response generation unit 126 instead of the communication connection unit 124 and the MAC address generation unit 125.

[0080] The probe response generation unit 126 according to this embodiment generates a beacon frame or a probe response frame. As a specific example, the probe response generation unit 126 transmits fourth transmission data to the victim client 21 to extend the time until the victim client 21 next communicates. The fourth transmission data is communication data including a communication frame in which the device identification information of the rogue AP 10 is set as the device identification information of the sender so that the monitoring device 100 is recognized as the rogue AP 10, and the communication data includes a communication frame in which either a QoS (Quality of Service)-related field or a communication control-related field is set so that the waiting time until the victim client 21 transmits a communication frame to the rogue AP 10 is equal to or longer than a first reference waiting time. The first reference waiting time may be determined in any manner.

[0081] 11, the storage unit 130 according to the fourth embodiment stores QoS parameters 136 instead of storing a used MAC address table 134. In the fourth embodiment, the QoS parameters 136 are values ​​of QoS-related fields in the Institute of Electrical and Electronics Engineers (IEEE) 802.11 frame format, and specific examples thereof include CWmin (Contention Windows minimum, the minimum value of a communication waiting counter) or AIFSN (Arbitration InterFrame Space Number, the unit time of communication waiting time) of EDCA (Enhanced Distributed Channel Access) parameters. As a specific example, the QoS parameter 136 is set to a large value in advance. By transmitting a beacon frame or a probe response frame with the QoS parameter 136 set to a large value to the victim CL 21, the victim CL 21 can be forced to wait a very long time until it transmits a communication frame. Note that setting the value of the QoS parameter 136 is equivalent to tampering with the QoS parameter 136. Furthermore, depending on the implementation of the victim CL 21, the counter for the wait time may be reset each time the victim CL 21 receives a tampered beacon frame or probe response frame. In this case, it is possible to prevent the victim CL 21 from communicating at all.

[0082] ***Explanation of Operation*** Fig. 12 is a flowchart showing an example of the operation of the monitoring device 100 according to embodiment 4. The operation of the monitoring device 100 will be described with reference to Fig. 12 .

[0083] (Step S401) The probe response generation unit 126 refers to the victim device information 133, and transmits a probe response frame, in which the QoS parameters 136 are appropriately set, to each victim CL 21 indicated by the victim device information 133, via the communication unit 110. At this time, the probe response generation unit 126 sets the destination MAC address to the MAC address of each victim CL 21. The probe response generation unit 126 may transmit a broadcast beacon frame instead of a probe response frame.

[0084] ***Explanation of the Effects of the Fourth Embodiment*** As described above, according to this embodiment, it is possible to disrupt unauthorized communication between each victim CL 21 and the unauthorized AP 10 by causing each victim CL 21 to refrain from communication using the QoS parameter 136. Furthermore, according to this embodiment, it is possible to obtain the same effects as those of the first embodiment.

[0085] ***Other Configurations*** <Variation 3> In the fourth embodiment, the waiting time of the victim CL 21 is lengthened, which poses a risk that the victim CL 21 will communicate with the rogue AP 10 after the waiting time has elapsed. Therefore, this variation illustrates a configuration in which the victim CL 21 refrains from communication by utilizing the RTS / CTS (Request To Send / Clear To Send) method, a communication control method. The RTS / CTS method is a method in which an AP controls communication by assigning transmission rights to CLs. In the RTS / CTS method, a CL transmits an RTS frame to an AP, and the AP designates one CL with a CTS frame in response to the RTS. Only the designated CL can transmit data to the AP. Using this mechanism, the CL to which the transmission right is assigned in the CTS frame can be tampered with to a CL that does not exist among the surrounding devices, and the tampered CTS frame can be transmitted to cause all victim CLs 21 to refrain from transmission. Note that this modification is based on the premise that the RTS / CTS method is used, and therefore may not always be applicable to the monitoring device 100. However, APs often have a function for switching to the RTS / CTS method when communication quality deteriorates. Below, we will mainly explain the differences from embodiment 4.

[0086] *** Description of Configuration *** Fig. 13 shows an example configuration of a monitoring device 100 according to this modification. As shown in Fig. 13, the control unit 120 according to this modification includes a CTS generation unit 129 and a MAC address generation unit 125 instead of the probe response generation unit 126.

[0087] The CTS generation unit 129 generates a CTS frame. As a specific example, when the RTS / CTS method is used in a wireless communication network in which the rogue AP 10 and the victim CL 21 participate, the CTS generation unit 129 broadcasts, to the wireless communication network, data including a communication frame in which device identification information different from any of the device identification information of devices present in a group of surrounding devices is set as device identification information of a device to which a transmission right is assigned, in order to cause the victim CL 21 to refrain from communication.

[0088] ***Explanation of Operation*** Fig. 14 is a flowchart showing an example of the operation of the monitoring device 100 according to this modification. The operation of the monitoring device 100 will be described with reference to Fig. 14 .

[0089] (Step S421) The MAC address generation unit 125 generates one MAC address. The MAC address generation unit 125 may generate the MAC address using a random number, or may generate the MAC address by incrementing the value of the MAC address indicated by the victim device information 133. The MAC address generation unit 125 references the victim device information 133 and confirms that the generated MAC address is different from any of the MAC addresses of the victim CLs 21 indicated by the victim device information 133. If the MAC address generation unit 125 confirms that the generated MAC address is different from any of the MAC addresses of the victim CLs 21 indicated by the victim device information 133, it transmits data indicating the generated MAC address to the CTS generation unit 129. In addition, if the generated MAC address overlaps with any of the MAC addresses of the victim CL21 indicated by the victim device information 133, the MAC address generation unit 125 generates the MAC address again and confirms once again that the generated MAC address is different from any of the MAC addresses of the victim CL21 indicated by the victim device information 133.

[0090] (Step S422) First, the CTS generation unit 129 designates the MAC address indicated by the data received from the MAC address generation unit 125 as the target to which the transmission right is to be assigned. Next, the CTS generation unit 129 generates a CTS frame with the MAC address of the unauthorized AP 10 as the source MAC address and broadcasts the generated CTS frame to the LAN of the unauthorized AP 10 via the communication unit 110. Note that the CTS generation unit 129 may unconditionally generate a CTS frame each time step S422 is executed and transmit the generated CTS frame each time a CTS frame is generated. Alternatively, each time step S422 is executed, the communication monitoring unit 121 may newly acquire communication frames from each device in the surrounding device group, and the CTS generation unit 129 may transmit the generated CTS frame only if the information analysis unit 122 confirms an RTS frame from the victim CL 21 among the communication frames acquired by the communication monitoring unit 121.

[0091] ***Explanation of the Effects of Modification 3*** As described above, according to this modification, by using the RTS / CTS method to cause the victim CL 21 to refrain from communication, it is possible to disrupt unauthorized communication between the victim CL 21 and the unauthorized AP 10. Furthermore, according to this modification, it is possible to obtain the same effects as those of embodiment 1. Furthermore, according to this modification, it is possible to cause the victim CL 21 to refrain from communication regardless of the waiting time of the victim CL 21. Therefore, according to this modification, it is possible to further mitigate damage compared to embodiment 4.

[0092] <Modification 4> The fourth embodiment and modification 3 are countermeasures against the rogue AP 10. However, as shown in Fig. 17, it is also possible to reverse the roles of the access point and the client, and have the monitoring device 100 masquerade as a legitimate AP 30 to make the rogue CL 22 refrain from communication. In other words, by appropriately utilizing the configurations of the fourth embodiment and modification 3, it is also possible to implement countermeasures against the rogue CL 22.

[0093] The following describes a case where the configuration of the fourth embodiment is used. It is assumed that a legitimate AP 30 is present among the group of surrounding devices, and that a rogue CL 22 is connected to the legitimate AP 30. The probe response generator 126 transmits fifth transmission data to the rogue CL 22 to cause the rogue CL 22 to refrain from communication. The fifth transmission data is communication data including a communication frame in which the device identification information of the legitimate AP 30 is set as the device identification information of the sender so that the monitoring device 100 is recognized as the legitimate AP 30, and the communication data includes a communication frame in which either a QoS-related field or a communication control-related field is set so that the waiting time until the rogue CL 22 transmits a communication frame to the legitimate AP 30 is equal to or longer than the second reference waiting time. The second reference waiting time may be determined in any manner.

[0094] The following describes a case where the configuration of Modification 3 is used. It is assumed that a legitimate AP 30 exists in a group of surrounding devices, and that a rogue CL 22 is connected to the legitimate AP 30. When the legitimate AP 30 and the rogue CL 22 are participating in a wireless communication network, the CTS generation unit 129 broadcasts, to the wireless communication network, data including a communication frame in which device identification information different from the device identification information of any of the devices existing in the group of surrounding devices is set as device identification information of a device to which a transmission right is assigned, in order to cause the rogue CL 22 to refrain from communication.

[0095] Furthermore, Patent Document 1 has a problem in that an unauthorized client that is no longer able to communicate due to an encryption key being updated can relatively easily reconnect to a legitimate access point by requesting reconnection to the legitimate access point using the same MAC address, just as a WIPS monitoring device does. According to this variation, the unauthorized client refrains from requesting reconnection to the legitimate access point, so it is not easy to reconnect to the legitimate access point.

[0096] Embodiment 5. The following mainly describes the differences from the above-described embodiments with reference to the drawings. In embodiment 2 and the modified embodiment of embodiment 2, a method is adopted in which the victim client 21 is temporarily moved to another channel to prevent communication with the victim client 21, so it takes time for the victim client 21 to resume regular communication. Therefore, in embodiment 5, in order to more quickly mitigate damage and more quickly resume regular communication, the monitoring device 100 directly deprives the malicious AP 10 of the communication connection with the victim client 21.

[0097] *** Description of Configuration *** Fig. 15 shows an example configuration of a monitoring device 100 according to embodiment 5. The configuration of the monitoring device 100 is the same as that of the monitoring device 100 according to embodiment 1 except that the MAC address generation unit 125 and the used MAC address table 134 are removed.

[0098] The communication connection unit 124 according to the present embodiment transmits sixth transmission data to the victim client 21 in order to disconnect the communication connection between the rogue AP 10 and the victim client 21. The sixth transmission data is communication data including a communication frame in which the device identification information of the rogue AP 10 is set as the device identification information of the sender so that the monitoring device 100 is recognized as the rogue AP 10, communication data including a communication frame set to disconnect the communication connection between the rogue AP 10 and the victim client 21, and communication data including a communication frame set to establish the communication connection with the victim client 21.

[0099] ***Explanation of Operation*** Fig. 16 is a flowchart showing an example of the operation of the monitoring device 100 according to embodiment 5. The operation of the monitoring device 100 will be described with reference to Fig. 16 .

[0100] (Step S501) The communication connection unit 124 selects one victim CL 21 for which no countermeasure has been implemented, by referring to the victim device information 133. Hereinafter, the victim CL 21 selected in step S501 is referred to as a third selected victim CL.

[0101] (Step S502) The communication connection unit 124 performs connection processing with the third selected victim CL by transmitting a probe response frame, the source of which is the MAC address of the rogue AP 10 and the destination of which is the MAC address of the third selected victim CL, to the third selected victim CL via the communication unit 110. After the connection processing is successfully completed, the communication connection unit 124 sets a countermeasure implementation flag in the device information of the third selected victim CL in the victim device information 133.

[0102] (Step S503) If there is no device information for which the countermeasure implementation flag is not set in the damaged device information 133 (i.e., if the countermeasure implementation flag is set in all damaged CLs 21 indicated by the damaged device information 133), the monitoring apparatus 100 proceeds to step S504. Otherwise, the monitoring apparatus 100 proceeds to step S501.

[0103] (Step S504) The unauthorized device determination unit 123 sets a countermeasure implementation flag for the device information of the selected unauthorized AP in the unauthorized device information 132, assuming that countermeasures have been implemented against the selected unauthorized AP. Furthermore, since each victim CL 21 had been communicating with the selected unauthorized AP until just before the selected unauthorized AP, it may have been forced to download malware and may transmit attack frames to the legitimate AP 30. Therefore, after the monitoring device 100 seizes the communication connection of each victim CL 21, the legitimate AP 30 may monitor the communication of each victim CL 21 for a certain period of time and implement countermeasures as necessary. Specific examples of countermeasures include displaying a warning screen to each victim CL 21, throttling the communication bandwidth of each victim CL 21, or ignoring communication from each victim CL 21. After completing the processing of step S504, the monitoring device 100 returns to step S101.

[0104] ***Explanation of the Effects of Embodiment 5*** As described above, according to embodiment 5, the monitoring device 100 can directly deprive the unauthorized AP 10 of the communication connection with each victim CL 21, thereby cutting off unauthorized communication between the unauthorized AP 10 and each victim CL 21. Furthermore, according to this embodiment, it is possible to obtain the same effects as those of embodiment 1. Furthermore, according to embodiment 5, the monitoring device 100 provides legitimate communication to each victim CL 21, so that legitimate communication can be provided to each victim CL 21 more quickly than in embodiment 2.

[0105] ***Other Configurations*** <Modification 5> The fifth embodiment is a countermeasure against the rogue AP 10. However, as shown in Fig. 17, it is also possible to reverse the roles of the access point and the client, and have the monitoring device 100 directly deprive the legitimate AP 30 of communication with the rogue CL 22. In other words, by appropriately utilizing the configuration of the fifth embodiment, it is also possible to implement countermeasures against the rogue CL 22.

[0106] The following describes the reuse of the configuration of the fifth embodiment. It is assumed that a legitimate AP 30 is present among the group of surrounding devices, and that a rogue CL 22 is connected to the legitimate AP 30. The communication connection unit 124 transmits seventh transmission data to the rogue CL 22 to disconnect the communication connection between the legitimate AP 30 and the rogue CL 22. The seventh transmission data is communication data including a communication frame in which the device identification information of the legitimate AP 30 is set as the device identification information of the sender so that the monitoring device 100 is recognized as the legitimate AP 30, the communication data including a communication frame set to disconnect the communication connection between the legitimate AP 30 and the rogue CL 22, and the communication data including a communication frame set to establish a communication connection with the rogue CL 22.

[0107] Furthermore, this modification can solve the problems of the above-mentioned Patent Document 1.

[0108] ***Other Embodiments*** The above-described embodiments can be freely combined, or any of the components of each embodiment can be modified, or any of the components can be omitted from each embodiment. Furthermore, the embodiments are not limited to those shown in embodiments 1 to 5, and various modifications are possible as needed. The procedures described using flowcharts, etc., can be modified as appropriate.

[0109] 10 Rogue AP, 20 Normal CL, 21 Victim CL, 22 Rogue CL, 30 Normal AP, 51 Processor, 52 Memory, 53 Auxiliary storage device, 54 Input / output IF, 55 Communication device, 58 Processing circuit, 59 Signal line, 100 Monitoring device, 110 Communication unit, 120 Control unit, 121 Communication monitoring unit, 122 Information analysis unit, 123 Rogue device determination unit, 124 Communication connection unit, 125 MAC address generation unit, 126 Probe response generation unit, 127 Channel selection unit, 128 Deauthentication frame generation unit, 129 CTS generation unit, 130 Storage unit, 131 Communication frame information, 132 Rogue device information, 133 Victim device information, 134 Used MAC address table, 135 Association table, 136 QoS parameters.

Claims

1. When an unauthorized access point is present among the group of surrounding devices, in order to fill the limit of the number of simultaneous connections to the unauthorized access point, repeatedly connect to the unauthorized access point using each piece of device identification information of a group of device identification information consisting of one or more pieces of device identification information generated so as not to overlap with each other; when the connection to the unauthorized access point fails, disconnecting the communication connection between the unauthorized access point and the victim client by connecting to the unauthorized access point using device identification information of the victim client which is a communication device connected to the unauthorized access point; a communication connection unit that connects to the unauthorized access point using device identification information different from any of the device identification information groups in order to fill the slot for simultaneous connections to the unauthorized access point that is vacant due to the disconnection of the communication connection; A monitoring device comprising: the group of surrounding devices is made up of one or more devices that are present around the monitoring device and perform wireless communication; A monitoring device in which each piece of device identification information in the device identification information group is different from the device identification information of the victim client.

2. The monitoring device further comprises: an unauthorized device determination unit that determines whether or not the unauthorized access point is present in the surrounding device group based on a communication frame transmitted by each device in the surrounding device group; The monitoring device according to claim 1 .

3. 3. The monitoring device according to claim 1, wherein each piece of device identification information in the device identification information group is a MAC address, and the device identification information of the victim client is a MAC address.

4. 3. The monitoring device according to claim 1, wherein Protected Management Frames are effective in wireless communication between the unauthorized access point and the victim client.

5. The monitoring device further comprises: a probe response generating unit that switches the channel of the victim client to the first channel by transmitting to the victim client transmission data, the communication data including a communication frame in which device identification information of the rogue access point is set as device identification information of a transmission source so that the monitoring device is recognized as the rogue access point, and in which a first channel, which is a channel in which the rogue access point is not present, is set as a channel switching destination. The monitoring device according to claim 1 or 2, comprising:

6. When the monitoring device functions as a legitimate access point, the probe response generation unit switching the channel of the victim client to the second channel by transmitting, to the victim client whose channel has been switched to the first channel, communication data including a communication frame in which device identification information of the rogue access point is set as device identification information of a transmission source so that the monitoring device is recognized as the rogue access point, and in which a second channel, which is a channel in which the rogue access point is not present, is set as a channel switching destination; 6. The monitoring device of claim 5, further comprising: switching a channel of the monitoring device to the second channel in order to establish a regular communication with the victim client.

7. The computer that is the monitoring device When an unauthorized access point is present among the group of surrounding devices, in order to fill the limit of the number of simultaneous connections to the unauthorized access point, repeatedly connect to the unauthorized access point using each piece of device identification information of a group of device identification information consisting of one or more pieces of device identification information generated so as not to overlap with each other; when the connection to the unauthorized access point fails, disconnecting the communication connection between the unauthorized access point and the victim client by connecting to the unauthorized access point using device identification information of the victim client which is a communication device connected to the unauthorized access point; a monitoring method for connecting to the unauthorized access point using device identification information different from any of the device identification information group in order to fill a slot for simultaneous connections to the unauthorized access point that has become vacant due to the disconnection of the communication connection, the monitoring method comprising: the group of surrounding devices is made up of one or more devices that are present around the monitoring device and perform wireless communication; A monitoring method in which each device identification information of the device identification information group is different from the device identification information of the victim client.

8. When an unauthorized access point is present among the group of surrounding devices, in order to fill the limit of the number of simultaneous connections to the unauthorized access point, repeatedly connect to the unauthorized access point using each piece of device identification information of a group of device identification information consisting of one or more pieces of device identification information generated so as not to overlap with each other; when the connection to the unauthorized access point fails, disconnecting the communication connection between the unauthorized access point and the victim client by connecting to the unauthorized access point using device identification information of the victim client which is a communication device connected to the unauthorized access point; A communication connection process for connecting to the unauthorized access point using device identification information different from any of the device identification information groups in order to fill the slot for simultaneous connections to the unauthorized access point that has become vacant due to the disconnection of the communication connection. A monitoring program for causing a monitoring device that is a computer to execute the above, the group of surrounding devices is made up of one or more devices that are present around the monitoring device and perform wireless communication; A monitoring program in which each piece of device identification information in the device identification information group is different from the device identification information of the victim client.