Wireless intrusion prevention system, wireless network system comprising same, and method for operating wireless network system
Provided herein are a wireless intrusion prevention system, a wireless network system including the wireless intrusion prevention system, and a method for operating the wireless network system. Of these, the wireless intrusion prevention system includes an access point, a plurality of stations configured to transmit/receive a wireless frame to/from the access point over a wireless network, and a wireless intrusion prevention system configured to monitor the wireless frame, wherein the wireless intrusion prevention system transmits a dis-association request to a specific station, among the plurality of stations, and prevents the access point from responding to the specific station.
1. A wireless network system, comprising:
an access point;
a plurality of stations configured to transmit/receive a wireless frame to/from the access point over a wireless network; and
a wireless intrusion prevention system configured to monitor the wireless frame,
wherein the wireless intrusion prevention system transmits a dis-association request to a specific station, among the plurality of stations, and prevents the access point from responding to the specific station when there is a failure of a two-way exchange of protected communications between the specific station and the access point.
2. The wireless network system according to claim 1 , wherein the wireless intrusion prevention system transmits an interference signal to the access point in order to prevent the access point from responding to the specific station.
3. The wireless network system according to claim 2 , wherein the interference signal includes a Clear to Send (CTS) frame or a Request to Send (RTS) frame.
4. The wireless network system according to claim 2 , wherein the interference signal includes a signal for increasing a degree of congestion of the access point.
5. The wireless network system according to claim 4 , wherein the interference signal includes a spoofed packet.
6. The wireless network system according to claim 5 , wherein the spoofed packet includes a frame requesting a new association (Association frame), a frame requesting a re-association (Re-Association frame), or a frame requesting a dis-association for a current associated state (Dis-Association frame).
7. The wireless network system according to claim 1 , wherein the specific station transmits a protected query to the access point in response to the dis-association request.
8. The wireless network system according to claim 7 , wherein:
the specific station instructs the access point to respond to the protected query within a predetermined first time, and
the specific station terminates an association with the access point when no response is received within the first time.
9. The wireless network system according to claim 8 , wherein the specific station sends an authentication request frame to the access point after the association with the access point is terminated.
10. The wireless network system according to claim 9 , wherein the wireless intrusion prevention system sends a deauthentication frame to the access point or the specific station after the authentication request frame is sent.
11. The wireless network system according to claim 1 , wherein the specific station is a station connected to an unauthorized station or an unauthorized attacker over a network.
12. The wireless network system according to claim 1 , wherein the wireless network includes IEEE 802.11w technology.
13. A method for operating a wireless network system, comprising:
maintaining, by an access point, an association with a specific station, among a plurality of stations configured to transmit/receive a wireless frame to/from the access point over a wireless network; and
transmitting, by a wireless intrusion prevention system configured to monitor the wireless frame, an interference signal which prevents the access point from responding to the specific station or te prevents the access point from transmitting a protected query to the specific station when there is a failure of a two-way exchange of protected communications between the specific station and the access point.
14. The method according to claim 13 , further comprising:
transmitting, by the wireless intrusion prevention system configured to monitor the wireless frame, a dis-association request to the specific station;
transmitting, by the specific station, a protected query to the access point;
instructing, by the specific station, the access point to respond to the protected query within a predetermined first time; and
when no response is received within the first time, terminating, by the specific station, an association with the access point.
15. The method according to claim 14 , further comprising:
after the association with the access point is terminated, sending, by the specific station, an authentication request frame to the access point; and
after the authentication request frame is sent, sending, by the wireless intrusion prevention system, a deauthentication frame to the access point or the specific station.
16. The method according to claim 13 , further comprising:
transmitting, by the specific station, an access request to the access point,
wherein the interference signal includes a signal for preventing the access point from transmitting an access request denial to the specific station or preventing the access point from transmitting the protected query to the specific station.
17. The method according to claim 13 , further comprising:
transmitting, by the wireless intrusion prevention system, an access request to the access point,
wherein the interference signal includes a signal for preventing the access point from transmitting the protected query to the specific station.
18. A wireless intrusion prevention system, comprising:
a sensing device configured to monitor a wireless frame that is transmitted/received between an access point and a plurality of stations over a wireless network and to process information based on the wireless frame; and
a server configured to determine whether the access point and the plurality of stations are unauthorized and are operating abnormally, based on the processed information,
wherein the wireless intrusion prevention system comprises a function of providing an interference signal for terminating an association of a specific station, among the plurality of stations, with the access point when there is a failure of a two-way exchange of protected communications between the specific station and the access point.
19. The wireless intrusion prevention system according to claim 18 , further comprising:
a function of sending a deauthentication frame to the access point or the specific station when the specific station sends an authentication request frame to the access point so as to request access to the access point.
20. The wireless intrusion prevention system according to claim 18 , wherein the interference signal includes a signal for preventing the access point from responding to the specific station or from transmitting a protected query to the specific station.