Terminal device and method for identifying malicious ap by using same

Patent metadata

Field	Value
Publication number	US-2021204135-A1
Application number	US-201917057848-A
Country	US
Kind code	A1
Filing date	May 28, 2019
Priority date	May 28, 2018
Publication date	Jul 1, 2021
Grant date	—

Abstract

A method of identifying a malicious AP by a terminal apparatus includes obtaining first performance information related to hardware of a first AP based on a first beacon signal received from the first AP, comparing the first performance information with previously stored second performance information of a second AP, and determining whether the first AP is a malicious AP, based on a result of the comparing.

First claim

1 . A method of identifying a malicious AP by a terminal apparatus, the method comprising:
obtaining first performance information related to hardware of a first AP based on a first beacon signal received from the first AP; comparing the first performance information with previously stored second performance information of a second AP; and determining whether the first AP is a malicious AP, based on a result of the comparing.

2 . The method of claim 1 , further comprising:
obtaining first time information related to the first beacon signal; comparing the first time information with second time information related to a second beacon signal of the second AP; and determining whether the first AP is a malicious AP, based on a result of the comparing.

3 . The method of claim 2 , wherein the first time information comprises first timestamp information included in the first beacon signal and first receiving time information of the first beacon signal,
the second time information comprises second timestamp information included in the second beacon signal and second receiving time information of the second beacon signal, and the determining of whether the first AP is a malicious AP comprises determining the first AP to be a malicious AP when a difference value between the first timestamp information and the second timestamp information does not correspond to a difference value between the first receiving time information and the second receiving time information.

4 . The method of claim 1 , wherein the first AP is an AP to be accessed by the terminal apparatus after the terminal apparatus is disconnected from the second AP, and
identification information of the first AP is the same as identification information of the second AP.

5 . The method of claim 1 , wherein the comparing of the first performance information with the previously stored second performance information of the second AP comprises, when an SSID of the first AP is included in a previously stored SSID list, comparing second performance information of the second AP received from a server device with the first performance information.

6 . The method of claim 1 , further comprising:
transmitting, to the first AP, a request message including at least one of predetermined identification information and predetermined channel information; receiving a response message from the first AP in response to the request message; and determining the first AP to be a malicious AP, when the response message includes at least one of the predetermined identification information and the predetermined channel information.

7 . The method of claim 1 , further comprising:
predicting pieces of first time information on or after an (n+1)th beacon signal, based on pieces of first time information related to first beacon signals received from the first AP on or before an n-th beacon signal, where n is a natural number; comparing the predicted pieces of first time information with the pieces of first time information of the first beacon signals received on or after an (n+1)th beacon signal; and determining whether the first AP is a malicious AP, based on a result of the comparing.

8 . The method of claim 7 , wherein the predicting of the pieces of first time information comprises predicting the pieces of first time information on or after the (n+1)th beacon signal through a linear regression analysis.

9 . The method of claim 7 , wherein the determining of whether the first AP is a malicious AP comprises determining the first AP to be a malicious AP when difference values between the predicted pieces of first time information and the pieces of first time information of the first beacon signals received on or after the (n+1)th beacon signal increase or decrease according to time.

10 . The method of claim 1 , further comprising:
comparing a first arrangement order of information elements in the first beacon signal with a previously stored second arrangement order of information elements; and determining whether the first AP is a malicious AP, based on a result of the comparing.

11 . A program stored in a medium to execute a method of identifying a malicious AP according to claim 1 in combination with hardware.

12 . A terminal apparatus comprising:
a memory storing one or more instructions; and a processor configured to execute the one or more instructions stored in the memory, wherein the processor is configured to: obtain first performance information related to hardware of the first AP based on a first beacon signal received from the first AP; compare the first performance information with previously stored second performance information of the second AP; and determine whether the first AP is a malicious AP, based on a result of the comparing.

13 . The terminal apparatus of claim 12 , wherein the processor is configured to:
obtain first time information related to the first beacon signal; compare the first time information with second time information related to a second beacon signal of the second AP; and determine whether the first AP is a malicious AP, based on a result of the comparing.

14 . The terminal apparatus of claim 12 , wherein the processor is configured to:
transmit, to the first AP, a request message including at least one of predetermined identification information and predetermined channel information; receive a response message from the first AP in response to the request message; and determine the first AP to be a malicious AP, when the response message includes at least one of the predetermined identification information and the predetermined channel information.

15 . The terminal apparatus of claim 12 , wherein the processor is configured to:
predict pieces of first time information on or after an (n+1)th beacon signal, based on pieces of first time information related to first beacon signals received from the first AP on or before an n-th beacon signal, where n is a natural number; compare the predicted pieces of first time information with the pieces of first time information of the first beacon signals received on or after an (n+1)th beacon signal; and determine whether the first AP is a malicious AP, based on a result of the comprising.

Assignees

• Samsung Electronics Co Ltd

Inventors

• Cho Jungil
• Kwon Soonhong
• Kim Hyunwoo
• Song Minkyu
• Lee Jongsung
• Lee Joonghwan
• Chung Yongsu
• Choi Daesung

Classifications

• H04W12/61

  Time-dependent · CPC title

• H04W12/73

  Access point logical identity · CPC title

• H04W12/122 Primary

  Counter-measures against attacks; Protection against rogue devices · CPC title

• H04W12/02

  Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII] · CPC title

• H04W12/71

  Hardware identity · CPC title