EP4115579A1

EP4115579A1 - Method for managing a request to access an internet site from an access device

Info

Publication number: EP4115579A1
Application number: EP21708282.5A
Authority: EP
Inventors: Eric Bouvet; Fabrice Fontaine
Original assignee: Orange SA
Current assignee: Orange SA
Priority date: 2020-03-02
Filing date: 2021-02-11
Publication date: 2023-01-11
Also published as: WO2021176156A1; CN115211077A; US20230283586A1; FR3107798A1

Abstract

The invention relates to a method for managing a request to access an internet site originating from a device (OBJ) and transmitted through a telecommunication network (RES), characterised in that it comprises the following steps: - a step (ET1) of receiving a request including a domain name, originating from a device, intended to be transmitted to a domain name resolution server; - a step (ET2) of routing the request to a domain name resolution server; - a step (ET6) of receiving a response including an IP address and information, called first information, linked to the IP address; - transmitting (ET9, ET7a) or not transmitting the request over the network (RES) as a function of the first information.

Description

DESCRIPTION

Method for managing a request for access to a website from an access device

Technical area

The invention relates to the field of telecommunications.

The invention relates more particularly to a method for managing access to an Internet site from a data processing device called access device in the following.

The access device chosen to illustrate the invention is a connected object.

State of the art

On the Internet, computers communicate with each other using a set of protocols including Internet Protocol (IP). This protocol uses digital addresses, commonly known as IP addresses (@ IP).

Also, the computers distributed in the network are associated with a domain name of the type “example.com”. This domain name corresponds to a URL (Uniform Resource Locator) which is the unique address which allows access to a computer on the network, for example a server hosting an Internet site.

Two methods exist for accessing a website from an access device. A first access method is performed using the IP address, a second method is performed using a URL.

When a URL is used, the access device transmits a request to a domain name resolution server or DNS server (for “Domain Name System”) to retrieve the corresponding IP address. Once the IP address is retrieved, the access device accesses the computer using the IP address.

The use of an IP address instead of a URL allows the access device to directly access Internet sites without requiring prior DNS queries.

Regardless of the method used above, accessing websites presents certain risks. For example, the website may belong to a malicious third party capable of taking control of the access device without the knowledge of the owner of the access device. When the access device is a connected object, for example a vacuum cleaner equipped with a camera, the malicious third party can install, in the object, malicious software capable of transmitting data from the object to the Internet network. The malicious software installed on the object can indeed order a video capture of the environment of the camera and transmit the resulting video content over the Internet.

The invention improves the situation.

The invention

To this end, according to a functional aspect, the invention relates to a method for managing a request for access to a website originating from a device and transmitted through a telecommunications network, characterized in that '' it includes the following steps,

A step of receiving a request including a domain name, originating from a device, intended to be sent to a domain name resolution server;

- A step of routing the request to a domain name resolution server;

- A step of receiving a response including an IP address and information, called first information, related to the IP address;

- Depending on the first information, transmission or not of the request on the network.

According to the invention, an entity external to the access device, intercepts requests for access to Internet sites and requires obtaining both an IP address to a domain name resolution server, and related information. to the IP address.

Upon receipt of the information, the entity analyzes it and decides whether or not to follow up on the access request. It will be seen that, in one embodiment, when the entity decides to act, the IP address is transmitted to the access device at the origin of the request. A domain name resolution server is located in a secure environment. The first information relating to the IP address is therefore stored in a trusted environment that is difficult to attack by a malicious third party. In addition, this trusted server ideally keeps the first information related to IP addresses up to date.

Finally, the entity is located outside the access device, ideally in a secure device such as a home gateway to which the access device is connected; the chances of compromising both the access device and the home gateway are therefore very low.

Note that “information” means any descriptive information capable of characterizing a computer (or website), namely its level of confidence, a category of computer (site for children, for adults, etc.). Further examples of descriptive information will be described below.

Today, as indicated previously, access devices, such as connected objects, can directly access a website with an IP address sometimes without a prior domain name resolution step by a domain name resolution server. . According to a first particular embodiment of the invention, when the initial request includes an IP address of a device to be accessed, the reception step is preceded by a transmission step, intended for the access device , a message requesting transmission of a request intended for a domain name resolution server. This embodiment forces the access device to perform name resolution through a domain name resolution server, so as to retrieve information related to the website that corresponds to the received domain name. After checking the information received, the management entity transmits or not the received request to the device associated with the IP address.

According to yet a second particular embodiment of the invention, which may be implemented alternately or cumulatively with the previous embodiment, the method further comprises

- A step of obtaining information related to the access device, called second information; A step of comparing both the first and said second information;

- Depending on the comparison step, transmission or not of the request on the network.

This mode reinforces security by taking into account information not only on the website concerned, but also information on the access device. The management entity retrieves the information related to the access device and that related to the Internet site, and compares them and detects any incompatibilities between the first and the second information before deciding whether or not to transmit the IP address. For example, the website can be an adult website while the access device is a children's game, the entity decides in this case not to follow up the access request for incompatibility reasons. between the access device and the website for which access is requested.

Depending on the case, when there is an incompatibility, the entity does not transmit:

the IP address to the access device in the case where the initial access request received is based on a domain name; Where

- the request on the Internet network in the case where the initial access request received is based on an IP address.

According to yet a third particular embodiment of the invention, which may be implemented alternately or cumulatively with the previous ones, following the step of receiving a response including an IP address and information related to the IP address, the information received is stored. In this configuration, in this mode, the reception of a new subsequent access request is followed by a verification of the presence of information related to the domain name in memory, and of transmission or not of the IP address. depending on the information stored in memory.

It will be seen below that the steps described above are carried out in a home gateway and that the information received related to the IP address is stored in a memory of the home gateway. According to yet a fourth particular embodiment of the invention, which may be implemented alternately or cumulatively with the previous ones, a period of validity is associated with the stored information. In this configuration, the presence of information related to the domain name in memory is followed by a check that the information is still valid. If not, the method carries out the steps described above:

A step of routing the request to a domain name resolution server;

A step of receiving a response including an IP address and information related to the IP address;

Depending on the response, transmission or not of the request on the network.

According to yet a fourth particular embodiment of the invention, which may be implemented alternately or cumulatively with the previous ones, when the period of validity has expired, the method comprises

A step of transmitting, to a domain name resolution server, a request to obtain updating of the information associated with an IP address stored in memory;

A step of receiving a response including the information associated with the IP address and

A step of storing the information received.

This fourth mode has the advantage of updating the information stored in the gateway, for example, as soon as it is no longer valid. This makes it possible, when the entity receives an access request, to have valid information available. This prevents the entity from transmitting a domain name resolution request over the network. Having valid information stored in the gateway, the entity can therefore decide more quickly whether or not to authorize the transmission of the access request received to the IP address concerned.

According to a hardware aspect, the invention relates to a management entity comprising A module for receiving a request including a domain name, coming from a device, intended to be sent to a domain name resolution server;

- A module for routing the request to the resolution server

a module for receiving a response including an IP address and information, called first information, linked to the IP address;

a transmission module capable of transmitting or not the request over the network according to the first information.

According to another hardware aspect, the invention relates to a domestic gateway including the entity described above.

According to another hardware aspect, the invention relates to a computer program capable of being implemented on a management entity as defined above, the program comprising code instructions which, when it is executed by a processor, performs the process steps defined above.

Finally, the invention relates to a data medium on which has been stored at least one series of program code instructions for the execution of the method defined above.

The data medium can be any entity or device capable of storing the program. For example, the medium may comprise a storage means, such as a ROM, for example a CD ROM or a microelectronic circuit ROM, or else a magnetic recording means such as a hard disk. On the other hand, the information medium can be a transmissible medium such as an electrical or optical signal, which can be conveyed via an electrical or optical cable, by radio or by other means. The program according to the invention can in particular be downloaded from an Internet type network. Alternatively, the information medium can be an integrated circuit in which the program is incorporated, the circuit being adapted to execute or to be used in the execution of the method in question.

Finally, let us point out here that, in the present text, the term “module” or “entity” can correspond as well to a software component as to a hardware component. or a set of hardware and software components, a software component itself corresponding to one or more computer programs or subroutines or more generally to any element of a program capable of implementing a function or a set functions as described for the modules concerned. Likewise, a hardware component corresponds to any element of a hardware assembly capable of implementing a function or a set of functions for the module concerned (integrated circuit, smart card, memory card, etc. .).

The invention will be better understood on reading the following description, given by way of example and made with reference to the appended drawings in which:

[Fig. 1] Figure 1 shows a computer system on which is illustrated an exemplary embodiment of the invention.

[Fig. 2] FIG. 2 is a schematic view of the architecture of a domestic gateway according to one embodiment of the invention.

[Fig. 3] FIG. 3 illustrates an example of steps implemented in the context of a method according to one embodiment.

[Fig. 4] FIG. 4 illustrates a possible variant of the embodiment described with reference to FIG. 3.

[Fig. 5] FIG. 5 illustrates another possible variant of the embodiment described with reference to FIG. 3.

Detailed description of one (or more) embodiment (s) illustrating the invention

FIG. 1 represents an access device of a user OBJ able to access a communication network RES via an interface device GTW. The communication network RES can be the Internet and the interface device GTW can be a home gateway or a router allowing the terminal of a user OBJ to access the Internet. Access to the communication network is provided by a provider of access to the communication network.

The access device OBJ can be any type of device configured to access a communication network such as the Internet via the home gateway GTW. The OBJ access device can be a cell phone or other mobile communication terminal, such as a tablet or a laptop, a computer desktop or home appliance capable of establishing a connection with the RES communication network.

In general, when a user enters a domain name in the browser installed on an access device, a domain name resolution request is sent by the access device to a resolution server or DNS server. .

The DNS server then responds to the access device 10 with a network address or “Internet Protocol” type address corresponding to the domain name, the access device then being able to access the IP address via the domestic gateway GTW.

The domestic gateway GTW is an interface device allowing exchanges between the access device OBJ and the communication network RES. Among other things, it plays a role of DNS relay. In other words, the gateway is responsible for addressing the REQ resolution requests to DNS resolution servers. A possible architecture of the interface device will be described later with reference to FIG. 2.

Remember here that it is necessary to obtain the IP address of the website to access it. Typically, a website has one (or more) IP address (es) (eg 93.184.216.34) and a domain name (www.example.com).

The translation of a domain name into a digital address is carried out by a DNS domain name resolution server (acronym for “Domain Name System”).

FIG. 2 illustrates a domestic gateway configured to implement the management method according to a particular embodiment of the invention.

According to this particular embodiment, the gateway has the conventional architecture of a computer and comprises in particular a processor CPU (or microcontroller), a memory MEM in which, in which, an ENT entity is stored. In our example, the entity ENT is a computer program which comprises instructions for implementing the steps of the management method which will be described below with reference to FIG. 3, when the program is executed by the processor CPU. The gateway further comprises a WiFi module and a RES module for communicating with a local network such as a WiFi network and a wide area network such as an ADSL, Fiber network, etc.

FIG. 3 illustrates a flowchart of the processing method according to a first embodiment of the invention.

In our example, the access device OBJ is a connected object.

When the connected object OBJ wishes to access the communication network RES via the domestic gateway GTW, the OBJ object 10 creates, during a first step ET1, a resolution request REQ of the domain name DN of an Internet site to which it wishes to access and transmits this resolution request REQ to the GTW gateway.

During a second step ET2, the domestic gateway GTW transmits the resolution request to the DNS server.

Then the DNS server performs two tasks. A first task consisting in obtaining, during a third step ET3, the IP address associated with the domain name; a second task consisting in obtaining descriptive information on the IP address by interrogating the SRV server during a fourth step ET4, the descriptive information having the function for example of providing a level of confidence N-IP associated with the device to which corresponds the IP address resolved. This information, called descriptive information, can be stored in the DNS server or stored on a server external to the DNS server. During a fifth step ET5, the DNS server obtains and transmits to the entity ENT the descriptive information obtained N-IP on the IP address concerned.

This descriptive information can be diverse and varied. Descriptive information can be a type of website associated with the IP address: social network, video games, crypto-mining, etc.

Another descriptive information can be the geographical location of the server: China, Russia, United States, Brazil, France

Another descriptive information can be a confidence score associated with the IP address, for example given on a scale of one to ten. During a sixth step ET6, the gateway receives the response from the DNS server, the response including the resolved IP address and a set of descriptive information associated with the IP address.

It is assumed here, to simplify the exemplary embodiment, that all of the descriptive information received is a confidence level N-IP provided in the form of a confidence score on a scale of 1 to 10, for example 9 for the website concerning.

During a seventh step ET7, the management entity ENT receives the response, verifies VRF the information received N-IP and decides to transmit the IP address to the object according to the descriptive information received, in our example the score of trust received.

It is assumed here that the entity transmits the IP address only if the confidence score is greater than or equal to 7. In this example, the score received by the ENT entity being 9, the entity transmits the IP address to the object during an eighth step ET8.

If the score received from the DNS server had been less than 7, the entity would not have transmitted the IP address.

After receiving the IP address, the OBJ object accesses the website having the received IP address.

According to a first variant, the access request is based on an IP address instead of a domain name.

With reference to FIG. 4, in the case where the object OBJ wishes to access, during a step ETla, an Internet site via a URL address instead of a domain name, a REQ (IP) request is transmitted from the OBJ object to the ENT entity. On receipt of the request REQ (IP), instead of transmitting a request as in step ET2 described above, responds to the object OBJ during a step ETlb, by requesting the object to transmit a request access to the website using a domain name.

In a subsequent ETlc step, the OBJ object sends back an access request REQ (DN) to the Internet site using a domain name.

The entity receives the access request. At this stage ; the method proceeds again as described above from step ET2 to step ET6.

Then, during a sixth step ET6a, the management entity ENT receives the response, verifies the information received N-IP VRF and decides to transmit the IP address to the object according to the descriptive information received, in our example. the confidence score received.

It is assumed here again that the entity transmits the IP address only if the trust score is greater than or equal to 7.

In this example, the score received by the ENT entity being 9, the entity transmits the request received on the Internet network, during a seventh step ET7a, to the Internet site having the IP address.

According to a second variant, the method takes into account information related to the connected object in the decision making. In this configuration, the ENT entity takes into account not only descriptive information relating to the Internet site to which the object OBJ wishes to access but also descriptive information on the OBJ object itself.

Descriptive information about the object can be of any kind. For example, descriptive information is a category of user likely to use the object: child / adult, a category of object (toy, video game for children or adults, "IoT" object (for "Internet of Things" ) such as a camera or refrigerator, etc.).

The object is for example a connected game for children (a soft toy, an electric car for children, etc.)

In this configuration, the entity ENT compares the information received relating to the Internet site with the information relating to the object. The entity detects any incompatibilities between the object and the website. For example, if the website is an adult site, not malicious, and the user category of the object is "child", the ENT entity does not pass the IP address to the object or not transmit the access request as appropriate.

Likewise, if the website is a crypto-mining site (that is to say a site allowing to "mine" crypto-currencies), and the object is of type “IoT”, the ENT entity does not transmit the IP address to the object or does not transmit the access request as the case may be.

A confidence level can also be assigned to the OBJ object. In this case, the entity can use this level of trust to decide whether to transmit the IP address or not.

According to one embodiment, the descriptive information received from the resolution server is stored in the memory MEM of the GTW gateway. A duration TM can also be set beyond which the information is out of date.

In this configuration, when an access request based on a domain name is received, the ENT entity checks whether this domain name DN has already been the subject of a resolution by consulting the memory of the gateway (step DN / MEM).

If not, steps ET2 and following are executed again.

If so, optionally, with reference to FIG. 5, a check of the validity of the descriptive information is carried out by the entity (step TM?).

If the data is no longer valid because the validity period has expired, steps ET2 and following are performed again.

If the data is valid, steps ET8 or ET7a are executed according to the use case defined above. In FIG. 5, only step ET8 is shown.

According to another variant, when the information related to an IP address, stored in memory in the home gateway, is out of date and therefore no longer valid, the ENT entity transmits a domain name resolution request in order to obtain the latest updated descriptive information.

More precisely, when the information is no longer valid, this embodiment comprises the following steps:

A step of transmitting, to a domain name resolution server, a request to obtain updating of the information associated with an IP address stored in memory

A step of receiving a response including the information associated with the IP address and A step of storing the information received.

In this variant, the trigger for the transmission of the resolution request is not a receipt of a request for access to a domain name DN from the access device but a state of the descriptive information stored in memory, more precisely. an expiration of descriptive information.

Finally, to conclude, let us specify here that the “descriptive information” relates to data capable of characterizing a remote object or server.

Descriptive information relating to the object is for example permissions and / or metadata which are known by the domestic gateway, the latter keeping the connected objects to which it is connected up to date.

The permissions target for example an administrator, a normal user, etc.

The metadata is for example

- a type of equipment: Camera, PC, Telephone, Tablet, Printer, TV

- a confidence level such as a confidence score: 0 - 10

- a type of equipment: dangerous, insecure, parental, social network, video games

- a category of equipment / software: dangerous / not dangerous; among the dangerous software, for example cryptomining software is known which has the function of using the processing power of a peripheral in order to generate cryptocurrency. These websites can be used legitimately by the user of the object but are also used illegitimately by malicious third parties.

- a country of origin: China, Russia, United States, France, etc.

Claims

1. A method of managing a request for access to a website originating from a device (OBJ) and transmitted through a telecommunications network (RES), characterized in that it comprises the following steps,

- A reception step (ET1) of a request including a domain name, coming from a device, intended to be sent to a domain name resolution server;

- A routing step (ET2) of the request to a domain name resolution server;

- A receiving step (ET6) of a response including an IP address and information, called first information related to the IP address;

- Depending on the first information, transmission (ET9, ET7a) or not of the request on the network (RES).

2. Management method according to claim 1, characterized in that, when the initial access request includes an IP address of a device, the reception step is preceded by a transmission step, to the device, a message requesting transmission of a request intended for a domain name resolution server.

3. Management method according to one of claims 1 to 2, characterized in that it further comprises

- A step of obtaining information related to the device (OBJ), called second information;

A step of comparing both the first and said second information;

4. Management method according to one of claims 1 to 3, characterized in that, following the step of receiving a response including an IP address and information related to the IP address, the information received is stored, and in that a receipt of a new access request is followed by a verification of the presence of information related to the domain name in memory and transmission or not of the IP address according to the information stored in the gateway.

5. Management method according to claim 4 characterized in that a period of validity is associated with the stored information.

6. Management method according to claim 5, characterized in that when the period of validity has expired, the method comprises

- A step of transmitting, to a domain name resolution server, a request to obtain update of the information associated with an IP address stored in memory

- A step of receiving a response including the information associated with the IP address and

- A step of storing the information received.

7. Management entity (ENT) of a request for access to a website from a device (OBJ), characterized in that it comprises

A module for receiving a request including a domain name, coming from a device, intended to be sent to a domain name resolution server;

- A module for routing the request to a domain name resolution server;

- A module for receiving a response including an IP address and information, called first information, linked to the IP address;

8. Home gateway comprising a management entity as defined in claim 7.

9. Computer program capable of being implemented on a mobile terminal, the program comprising code instructions which, when it is executed by a processor, carries out the steps of the method defined in one of claims 1 to 6.

10. Data carrier on which has been stored at least one series of program code instructions for the execution of a method defined in one of claims 1 to 6.