NETWORK SECURITY SYSTEM, COMPUTER, ACCESS POINT RECOGNIZING METHOD, ACCESS POINT CHECKING METHOD, PROGRAM, STORAGE MEDIUM, AND WIRELESS LAN DEVICE

• US 20030117985A1
• Filed: 12/19/2002
• Published: 06/26/2003
• Est. Priority Date: 12/26/2001
• Status: Active Grant

• Current Assignee: Lenovo PC International Limited (Lenovo Group Ltd.)
• Original Assignee: International Business Machines Corporation
• Inventors: MATSUNAGA, KOZO, FUJII, KAZUO, ITOH, MASAHARU
• Granted Patent: US 7,639,640 B2
• Time in Patent Office: Days
• US Class Current: 370/338
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/162 at the data link layer
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 48/16 Discovering, processing access restriction or access information
• CPC Class Codes: H04W 88/08 Access point devices

Abstract

Abstract of the Disclosure

In a network security system, clients search for neighbor access points (APs) in order to establish wireless connections to a LAN. As a result of the search, each of the clients dispatches alist of access points obtained to a controller. The controller detects non-registered access pointsby comparing a list of previously registered access points with the lists dispatched by the clients.

Claims

1. Apparatus comprising:

1. a client permitted to establish a wireless connection to a network through an access point;

and

a controller permitted to receive data dispatched by said client, through said network,

wherein said client scans electromagnetic waves within bands permitted to be used forwireless communication, and dispatches to said controller identification information onaccess points detected as a result of the scan, and

said controller stores said identification information on access points permitted to accesssaid network, and on the basis of the identification information on the permitted accesspoints and said identification information dispatched by said client, extracts non-registeredaccess points that are not registered as permitted access points.

2. Apparatus according toClaim 1, wherein said client dispatches to said controller saididentification information on said access points not used for said wireless connection.

3. Apparatus according to Claim 1, wherein said client dispatches to said controller the intensities ofsignals received from said access points and, on the basis of said intensities, said controllerestimates areas in which said non-registered access points are installed.

4. A computer permitted to communicate wirelessly with an access point connected to a network,comprising:

4. a recognizing section that recognizes identification information on access points on thebasis of electromagnetic waves generated by the access points;

a storage section that stores said identification information recognized by said recognizingsection; and

a dispatching section that dispatches through said network said identification informationstored in the storage section.

5. The computer according toclaim 4, wherein said dispatching section dispatches identificationinformation every predetermined time or in response to a request transmitted via said network.

6. A computer permitted to transmit and receive data via a network to and from a client permitted tobe wirelessly connected to the network via an access point, the computer being furthercomprising;

6. a storage section storing a permission list of permitted access points permitted to accesssaid network;

a collecting section that collects a recognition list of recognized access points recognizedby said client scanning electromagnetic waves within bands permitted to be used forwireless communication; and

an extracting section that extracts those non-registered access points of said recognizedaccess points included in said recognition list which are not included in said permissionlist on the basis of the permission list and the recognition list.

7. The computer according toclaim 6, further comprising:

7. an installed position information storage section that stores installed position informationon said permitted access points in said network;

a signal collecting section that collects the intensities of signals generated by saidrecognized access points; and

a calculating section that calculates positions at which said non-registered access pointsare installed, on the basis of said intensities and said installed position information.

8. An access point recognizing method executed by a computer permitted to communicate wirelesslywith access points connected to a network, comprising the steps of:

8. scanning electromagnetic waves within bands permitted to be used for wirelesscommunication;

obtaining a list of access points detected by said scan; and

dispatching said list obtained, through said network.

9. The access point recognizing method according toClaim 8, further comprising the steps of:

9. obtaining the intensities of signals generated by said access points; and

dispatching said intensities through said network.

10. A method of checking an access point connected to a network in order to connect a computer to thenetwork by radio, comprising the steps of:

10. obtaining a permission list of access points permitted to access said network;

obtaining a detection list of access points recognized by said computer; and

comparing said permission list with said detection list to recognize those non-registeredaccess points of said access points included in the detection list which are not included inthe permission list.

11. The access point checking method according toClaim 10, further comprising the steps of:

11. registering positions at which said access points included in said permission list areinstalled;

obtaining the intensities of signals from said access points detected by scan carried out bythe computer; and

calculating positions at which said non-registered access points are installed, on the basisof said intensities.

12. A program executed by a computer permitted to communicate wirelessly with access pointsconnected to a network, comprising:

12. a procedure of scanning electromagnetic waves within bands permitted to be used forwireless communication;

a procedure of recording a list of access points detected by said scan; and

a procedure of dispatching said list through said network.

13. The program executed by a computer according toClaim 12, further comprising:

13. a procedure of obtaining the intensities of vibration occurring at said access points; and

a procedure of dispatching said intensities through said network.

14. A program for checking an access point connected to a network in order to connect acomputer to the network by radio, comprising:

14. a procedure of obtaining a permission list of access points permitted to access saidnetwork;

a procedure of obtaining a detection list of access points recognized by said computer; and

a procedure of comparing said permission list with said detection list to recognize thosenon-registered access points of said access points included in the detection list which arenot included in the permission list.

15. The program executed by a computer according to Claim 14, further comprising:

15. a procedure of registering positions at which said access points included in saidpermission list are installed;

a procedure of obtaining the intensities of signals from said access points detected by scancarried out by the computer; and

a procedure of calculating positions at which said non-registered access points areinstalled, on the basis of said intensities.

16. A storage medium storing a program executed by a computer permitted to communicate wirelesslywith access points connected to a network, the storage medium being wherein the program can beread by the computer, and the program allows said computer to carry out:

16. a function of scanning electromagnetic waves within bands permitted to be used forwireless communication;

a function of recording a list of access points detected by said scan; and

a function of dispatching said list through said network.

17. A storage medium storing a program for checking an access point connected to a network in orderto connect a computer to the network by wireless LANwherein the program can be read by the computer, and the program allows said computer to carryout:

17. a function of obtaining a permission list of access points permitted to access said network;

a function of obtaining a detection list of access points recognized by said computer; and

a function of comparing said permission list with said detection list to recognize those non-registered access points of said access points included in the detection list which are notincluded in the permission list.

18. A wireless LAN device that can be installed into a computer to transmit and receive data to andfrom a network via a wireless LAN, comprising:

18. a scan section that carries out scan to search for an access point;

an ID recording section that records the ID of said access point detected by said scansection; and

a dispatching section that dispatches to said network said ID recorded in said recordingsection.