Network security system, computer, access point recognizing method, access point checking method, program, storage medium, and wireless LAN device

• US 7,639,640 B2
• Filed: 12/19/2002
• Issued: 12/29/2009
• Est. Priority Date: 12/26/2001
• Status: Active Grant

• Current Assignee: Lenovo PC International Limited (Lenovo Group Ltd.)
• Original Assignee: Lenovo Singapore Pte Limited (Lenovo Group Ltd.)
• Inventors: Itoh, Masaharu, Fujii, Kazuo, Matsunaga, Kozo
• Primary Examiner(s): HSU, ALPUS
• Application Number:
  US10/248,116
• Publication Number:
  US 20030117985A1
• Time in Patent Office: 2,567 Days
• Field of Search: 370/329, 370/331, 370/254, 370/235, 370/229, 370/328, 370/338, 370/401, 455/432.1, 455/435.1
• US Class Current: 370/328
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/162 at the data link layer
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 48/16 Discovering, processing access restriction or access information
• CPC Class Codes: H04W 88/08 Access point devices

Abstract

In a network security system, clients search for neighbor access points (APs) in order to establish wireless connections to a LAN. As a result of the search, each of the clients dispatches a list of access points obtained to a controller. The controller detects non-registered access points by comparing a list of previously registered access points with the lists dispatched by the clients.

Claims

1. An apparatus comprising:

a client that establishes a wireless connection to a network through an access point; and

a controller that receives data dispatched by said client, through said network,

wherein said client scans electromagnetic waves within bands used for wireless communication, and dispatches to said controller first identification information on access points detected as a result of the scan, and said controller stores second identification information on access points permitted to access said network, and on the basis of the second identification information and said first identification information, extracts non-registered access points that are not registered as said permitted access points.

2. The apparatus according to claim 1, wherein said client dispatches to said controller third identification information on access points not used for said wireless connection.

3. The apparatus according to claim 1, wherein said client dispatches to said controller intensities of signals received from said access points and, on the basis of said intensities, said controller estimates areas in which said non-registered access points are installed.

4. The apparatus according to claim 1, wherein the apparatus is a computer network security system, the client is a desktop computer, a laptop computer, or a handheld computer, and the network is a computer network.

5. The apparatus according to claim 1, wherein at least one of the access points is a wireless base station connected to a computer network.

6. A computer that transmits and receives data via a network to and from a client wirelessly connected to the network via an access point, the computer comprising;

a storage section storing a permission list of permitted access points permitted to access said network;

a collecting section that collects a recognition list of recognized access points recognized by said client scanning electromagnetic waves within bands permitted to be used for wireless communication; and

an extracting section that extracts those non-registered access points of said recognized access points included in said recognition list which are not included in said permission list on the basis of the permission list and the recognition list.

7. The computer according to claim 6, further comprising:

an installed position information storage section that stores installed position information on said permitted access points in said network;

a signal collecting section that collects the intensities of signals generated by said recognized access points; and

a calculating section that calculates positions at which said non-registered access points are installed, on the basis of said intensities and said installed position information.