FR2962868A1 - METHOD AND DEVICE FOR SECURING AN INTERLAYER BIDIRECTIONAL COMMUNICATION CHANNEL. - Google Patents

Abstract

The invention relates to a method for securing a two-way communication channel between at least one originating network (N1) and a destination network (N3) through a transit network (N2) with a lower level of security. as the originating and terminating networks. The method comprises the following steps during a transmission of a type of first data from the source network (N1) to the transit network (N2) and to the destination network (N3) through the network (N2) of transit: - implementation of a filtering (48) of said data, comprising an application (50, 52) of an analysis filter on said data to prevent the creation of a hidden communication channel, - transmission (76 ) said filtered data to the transit network (N2), - duplication (46) of said data, - cryptographic protection (42) of said duplicated data, - transmission (44) of said protected data to the destination network (N3). Said filtered data is not transmitted by the transit network (N2) to the destination network (N3).

Description

Method and device for securing an inter-level bidirectional communication channel

The present invention relates to a method of securing a bidirectional communication channel between at least one originating network and a destination network through a transit network of a lower security level than the departure and destination networks, comprising the following steps: - during transmission of at least one type of first data from the originating network to the transit network and to the destination network through the transit network: - implementation of a first filtering step of said first data, comprising an application of at least one analysis filter on said first data to counter the creation of a hidden communication channel, - transmission of said first filtered data to the transit network. It applies in particular to the transmission of signaling and control data during the establishment and maintenance of communication between two secure networks, through a weaker security network. The interconnection of secure networks, for example computer networks of subsidiaries of a company, is generally achieved through other non-dedicated communications networks and may have lower levels of security, for example a public network. a telecom operator. Security standards for communications between networks of different security levels often impose conflicting requirements with the requirements for interoperability between these networks, but also with the desired performance in terms of data transport. For example, in order to secure a communication channel between two secured networks, via a transit network with a lower security level, it is known to place on the periphery of the two secured networks a security device, for example an IP encryptor. , so as to encrypt, respectively decrypt, the data transmitted, respectively received by these networks. Thus, all the data transmitted by these networks are transmitted through the transit network in encrypted form, and no data coming from these secure networks transits unencrypted, that is to say in a non-encrypted form, over the network. transit network. However, this partitioning of the secure networks results in a break in interoperability between the secure networks and the transit network, causing a limitation of the services offered to the secured networks. In particular, the systematic encryption of the data transmitted by the secured networks makes it impossible to interact with the transit network. However, the transport of data between two secure networks through a transit network generally requires an exchange of signaling and control data between the transit network and the secure networks. These signaling and control data, which are notably used by the IP and Ethernet protocols, are for example reception acknowledgments or Resource ReSerVation Protocol (RSVP) signaling flows for managing the quality of service of data transmission sessions. . The systematic encryption of the data transmitted by the secure networks prevents the exchange of signaling and control data between the secured networks and the transit network, so that a requested service for a session between the secured networks can not be satisfied. only on these secure networks, and not on the entire path of the data exchanged. An alternative solution is to allow certain types of data to be transmitted in clear and uncontrolled through the transit network, ie to create an additional communication channel for certain types of data, but this solution includes risks because an attacker can exploit this channel to leak information from a secure network. To overcome this drawback, patent application FR 2 924 552-A1 discloses a method for securing a bidirectional communication channel, making it possible to secure this additional communication channel. According to this method, during a transmission of data transmitted by a secure initial network to a secure destination network through a lower security transit network, the data to be transmitted are analyzed by a switching module which determines whether these data are of a type authorized to transit in clear on the transit network. If this is the case, for example if these data are signaling or control data, this data is filtered, so as to prevent the creation of a hidden channel between the secure networks, and transmitted in clear on the network of data. transit then to the destination network. If not, the data is encrypted and then transmitted to the destination network via the transit network. This method, while improving the interoperability between networks of different security levels and preventing the creation of a hidden channel between the originating network and the transit network, does not, however, offer satisfactory security. . In particular, this method does not make it possible to guarantee the confidentiality of the data of the secured networks, because the data sent after filtering to the network may contain sensitive information. For example, when an RSVP request is sent by a transmitting terminal of the originating network to a receiving terminal of the destination network and to the transit network, to initiate a communication between these sending and receiving terminals, this request contains, in particular, the addresses IP transmitters and receivers, which can be confidential. However, this information is transmitted in clear on the transit network. Thus, the transit network can access sensitive or confidential information that is incompatible with its security level. In addition, the method described in the patent application FR 2 924 552-A1 authorizes the transmission of data from the transit network to the destination network at the initiative of the transit network. In fact, the filtered data transmitted by the originating network are transmitted to the transit network, which then transmits this data to the destination network. Therefore, a terminal placed on the transit network may, on its own initiative, transmit data to the destination network, for example by simulating a sending by the originating network, and possibly disturbing or making unavailable the destination network or the equipment computer network. Indeed, the destination network can not determine whether these data are consistent with the data originally issued by the originating network, or if these data were actually issued by these networks. The invention therefore aims to secure the transmission of data between two networks, through a network of lower security level, while allowing interoperability between these networks. To this end, the subject of the invention is a security method of the aforementioned type, characterized in that it furthermore comprises, during the transmission of said first data from the originating network to the transit network and to the destination network. the following steps: - duplication of said first data, - cryptographic protection of said first duplicate data, - transmission of said first protected data to the destination network, and in that said first filtered data are not transmitted by the transit network on the destination network. The security method according to the invention also comprises the following characteristics, taken separately or in combination: said first filtering step comprises a step of substitution of sensitive information included in said first data, which is incompatible with the security level of the data network; transit, by information compatible with the security level of the transit network; said first filtering step comprises a backup of a first connection context associated with said first data; it furthermore comprises, during a transmission of second data transmitted by the transit network to the originating network, a second step of filtering said second data, comprising: a comparison of a second connection context associated with said second data; data to said first connection context, - if said first and second contexts are inconsistent, a blocking of said second data, - if said first and second contexts are coherent, an application of at least one analysis filter to said second data and a transmitting said second filtered data to the network N1; said second filtering step comprises the introduction into said second data of said substituted sensitive information during said substitution step. The invention also relates to a device for securing a bi-directional communication channel between at least one originating network and a destination network through a transit network of a lower security level than the originating and terminating networks. destination, comprising: a first filtering module, comprising means for applying at least one analysis filter to data to be transmitted from the originating network to the transit network, to counter the creation of a hidden communication channel, a cryptographic data protection module capable of protecting data to be transmitted from the originating network to the destination network, said system being characterized in that it furthermore comprises at least one switching module, capable of guiding first data to be transmitted from the originating network to the transit network and to the destination network, to said first filtering module, to be duplicated by your first data, and to direct said first duplicate data to said cryptographic protection module.

The security device according to the invention also comprises the following characteristics, taken separately or in combination: said first filtering module comprises means for substituting sensitive information included in said first data, which is incompatible with the security level of the transit network; , by information compatible with the security level of the transit network; said first filtering module comprises means for saving a first connection context associated with said first data; it further comprises a second filtering module, comprising: means for comparing a second connection context associated with second data transmitted by the transit network to the originating network to said first connection context; means for blocking said second data if said first and second contexts are inconsistent, - means for applying at least one analysis filter to said second data and for transmitting said second filtered data to the originating network if said first and second contexts are coherent; said second filtering module comprises means for introducing into said second data said sensitive information substituted by said first filtering module.

The invention will be further understood with reference to embodiments of the invention which will now be described with reference to the appended figures in which: FIG. 1 is a diagram illustrating the overall architecture of networks adapted to the implementation of process of the invention; FIG. 2 is a diagram of a security device according to one embodiment of the invention; FIG. 3 is a block diagram illustrating steps of the method according to one embodiment of the invention, implemented by the securing device of FIG. 2; FIG. 4 is a block diagram illustrating other steps of the method according to one embodiment of the invention, implemented by the securing device of FIG. 2; and FIG. 5 is a block diagram illustrating the implementation of a security method according to one embodiment of the invention, between the networks illustrated in FIG. 1. FIG. networks adapted to the implementation of the method according to one embodiment of the invention. Two secure telecommunication networks N1 and N3, hereinafter referred to respectively as the departure and destination networks, are able to communicate through a transit N2 network, with a lower security level than the secure networks N1 and N3.

The secure networks N1 and N3 are, for example, internal corporate networks, and the transit network N2 a public network such as the Internet. The originating network N1 comprises at least one transmitting terminal 3 and a securing device 5, connected by a wired or wireless connection 7 to the transmitting terminal 3.

The transmitting terminal 3, for example a computer, is able to exchange data with the transit network N2 and the destination network N3 via the security device 5, and in particular signaling and control data. The security device 5 is cut off between the originating network N1 and the transit network N2, so that all the data exchanged between the sending terminal 3 and the transit network N2 necessarily pass through the security device 5. The security device 5 is able to analyze the data transmitted by the sending terminal 3 to the transit network N2 or the destination network N3, to determine whether they are of a type authorized to transit in the clear on the network N2 of transit. In the remainder of the description, confidential data will be called data which are not of a type authorized to transit in the clear over the transit network N2, and non-confidential data of a type authorized to transit in clear on the N2 transit network. Non-confidential data is, for example, signaling or control data, for example data associated with Session Initialization Protocol (SIP) requests, RSVP resource reservation requests, or Domain Name System (DNS) queries. The security device 5 is able to encrypt data deemed confidential issued by the transmitting terminal 3 and to transmit these data, once encrypted, to the destination network N3 through the N2 transit network. Moreover, the security device 5 is able to duplicate the data deemed non-confidential, to filter on a first copy of this data and to transmit the filtered data to the transit network N2. The security device 5 is also able to encrypt a second copy of these data and to transmit these encrypted data to the destination network N3. In addition, the security device 5 is able to receive all the data transmitted by the transit network N2 or the destination network N3 to the transmitting terminal 3 and to transmit these data to the transmitting terminal 3 after filtering or decrypting these data. data. More precisely, the security device 5 is able to decrypt encrypted data transmitted by the destination network N3 and to transmit the decrypted data to the sending terminal 3. Moreover, the security device 5 is able to apply a filtering on data. transmitted in clear by the N2 transit network, to block this data if they present a risk for the originating network NI, and to transmit the filtered data to the transmitter terminal 3 otherwise. This security device 5 will be described in more detail with reference to FIG.

The destination network N3 comprises at least one receiving terminal 9 and a security device 11, connected by a wired or wireless connection 13 to the transmitting terminal 3. The receiving terminal 9, for example a computer, is able to exchange data with the transit network N2 and the originating network NI via the security device 11. The security device 11 is installed in a cutoff between the transit network N2 and the destination network N3. It is identical in structure and operation to the device 5 for securing the originating NI network. The transit network N2 comprises in particular several routers R 1, R 2, R 3, R n, interconnected by a mesh of links 13, which are, for example, wired links or radio links. Moreover, at least one router RI is connected to the security device 5 for securing the originating network NI, and at least one router Rn is connected to the security device of the network N3 of destination. In a known manner, the routers R1, R2, R3, Rn are capable of passing data between the devices 5, 11 for securing the originating and terminating networks N1, N3, to receive signaling and control requests transmitted by these devices 5, 11 securing, and to respond to these requests. FIG. 2 illustrates, in a simplified manner, the architecture of a security device 5, placed in a cutoff between the sending terminal 3 and the router RI of the transit network N2, both represented schematically. The security device 5 comprises a first switching module 20, a cryptographic protection module 22, and a first filtering module 24, as well as a second switching module 26, a cryptographic verification module 28 and a second module 30 filtering.

The device 5 comprises a first input 5a connected to the transmitter terminal 3 by the link 7, a second input 5b connected to the router RI, a first output 5c and a second output 5d connected to the transmitter terminal 3 via the link 7, a third output 5e and a fourth output 5f connected to the router R1. The first switching module 20 comprises an input 20a and two outputs 20b, 20c, its input 20a being connected to the first input 5a of the device 5. The second switching module 26 comprises an input 26a and two outputs 26b, 26c, its input 26a being connected to the second input 5b of the device 5. The cryptographic protection module 22 comprises an input 22a, connected to the first output 20b of the first switching module 20, and an output 22b, connected to the third output 5e of the device 5. The cryptographic verification module 28 comprises an input 28a, connected to the first output 26b of the second switching module 26, and an output 28b, connected to the first output 5c of the device 5. The first filtering module 24 comprises an input 24a, connected to the second output 20c of the first switching module, and two outputs 24b, 24c, its first output 24b being connected to the fourth output 5f of the device 5. The second filtering module 30 comprises a first input 30a, connected to the second output 26c of the second switching module, a second input 30b, connected to the second output of the first filtering module 24, and an output 30c, connected. at the second output 5d of the device 5. The first switching module 20 is able to receive data transmitted by the transmitting terminal 3 to the receiving terminal 9, and to analyze these data to determine whether they must also be transmitted. to the N2 network. For example, the first routing module 20 is able to analyze the metadata associated with this data by the transport protocol used, and to determine from these metadata the nature of the data transmitted by the sending terminal 3. This metadata is by for example, Open Source Interconnection (OSI) layer 3 IP protocol metadata including IP addresses, protocol numbers of the sender and receiver terminals, and the communication ports used. Indeed, certain IP addresses and / or communication port numbers are associated with services or types of flows, for example signaling flows, authorized to transit through the N2 transit network. Other types of flows are dedicated to transfers of confidential information, thus requiring systematic cryptographic protection.

Furthermore, the first routing module 20 is able to duplicate the data to be transmitted both to the network N2 and the receiver terminal 9, to transmit a first copy of this data to the first filtering module 24, and to transmit a second copy of this data to the encryption module 22. The first routing module 20 is able to transmit the data to the cryptographic protection module 22 if they must be transmitted only to the network N3.

The cryptographic protection module 22 comprises means for analyzing data transmitted by the first routing module 20, according to a predefined security policy, to determine whether this data is authorized to be transmitted to the destination network N3 and which type of protection cryptographic needs to be applied, depending on the level of confidentiality of these data. IPsec mechanisms are an example of applicable cryptographic protection. The cryptographic protection module 22 also comprises means of cryptographic protection of the data authorized to be transmitted to the destination network N3, according to a certain type of cryptographic protection, and to transmit protected data, for example encrypted, to the destination network N3. , through the N2 network. The cryptographic protection module 22 is furthermore capable of blocking unauthorized data to be transmitted to the destination network N3. The first filter module 24 is able to receive data transmitted by the first switching module 20, to determine the nature of these data, to apply several filters to these data, depending on the nature of these data, in particular a filter syntactical analysis, a semantic analysis filter and a substitution filter, to transmit these data, after filtering, to the transit network N2, or to block the transmission of these data if the parsing filters, or semantic analysis detect an anomaly.

The first filter module 24 comprises for this purpose a database of filters, each filter corresponding to a type of data to be checked. A filter is formed, for example, of a set of parameters and / or software components. In particular, the database includes a filter for controlling RSVP protocol resource reservation requests.

The filters for parsing, semantic analysis and substitution are able to counter the creation of a hidden communication channel. In particular, the parsing filter is able to verify that the data to be transmitted respect the format defined in the standards and standards of the protocol used, and that no field of these data is diverted from its object. In particular, the parsing filter is able to detect anomalies in the values of the fields, which could hide a data leak. The semantic analysis filter is able to check the automaton of the possible states for a given protocol, and the consistency of the sequences of these states, and to detect any hidden meaning concealed in a query. For example, the semantic analysis filter is able to prohibit the transmission of data corresponding to an intermediate state of the protocol used if the data corresponding to the previous states have not been transmitted. In addition, the semantic analysis filter is able to extract data to transmit a connection context associated with them, to save this context and to transmit it to the second filtering module 30. The substitution filter is able to replace sensitive information contained in the data to be transmitted, a level of security incompatible with the security level of the transit network N2, with information of a level of security compatible with the network N2. , so as to reduce the risk of information leakage from the network N1 to the network N2, and to transmit these sensitive information substituted for the second filtering module 30. Indeed, this data may contain information considered as sensitive, which must not be communicated to the network N2, for example the IP addresses of the sending and receiving terminals, the telephone numbers of these terminals if they are telephones, or any other information relating to the identity of the transmitter and the receiver. The substitution filter is thus able to substitute the IP addresses of the transmitter 3 and receiver terminals 9 by the respective IP addresses of the security devices 5 and 11. The second switching module 26 is able to receive data transmitted by router R1 to the network NI, for example from the transmitting terminal 3. These data are for example encrypted data transmitted by the receiving terminal 9, via the device 11 of FIG. securing, or unencrypted data transmitted by the N2 network. The second switching module 26 is thus able to direct the cryptographically protected data to the cryptographic verification module 28, and the unprotected data to the second filtering module 30. The cryptographic verification module 28 is able to apply a cryptographic processing, according to the data transmitted by the second routing module 26, and to transmit these data, once decrypted, to the transmitting terminal 9. The second filtering module 30 is adapted to receive data transmitted by the second switching module 26, to determine the nature of these data, to apply several filters to these data, depending on their nature, in particular a parsing filter, an analysis filter semantics and a transposition filter, to transmit these data, after filtering, to the transmitting terminal 9, or to block the transmission of these data if the parsing or semantic analysis filters detect an anomaly.

Furthermore, the second filtering module 30 is adapted to receive connection contexts transmitted by the first filtering module 24 and to save them. The second filtering module 30 also comprises a filter database, each filter corresponding to a type of data to be checked.

The parsing filter is similar to the parsing filter of the first filtering module 24. The semantic analysis filter is able to compare the connection context of the data to be transmitted to one or more saved connection contexts and block the transmission of these data if these contexts are inconsistent, that is to say if these data do not correspond to a response to a request sent by the transmitting terminal 3. The semantic analysis filter is therefore able to prevent the transmission to the sending terminal 3, hence on the network N1, of requests initiated by the network N2. The transposition filter is able to introduce in the data to be transmitted the sensitive information replaced by the substitution filter of the first filtering module 24, for example the IP addresses of the transmitting terminal 3 and the receiving terminal 9, so that these data can subsequently be transmitted to the transmitting terminal 3. The security device 5 is preferably installed in a controlled space, for example in an enclosure of the NI network, to physically protect its inputs and outputs against potential attackers. Advantageously, the securing device 5 is physically shielded, in particular, to prevent attacks by auxiliary channels, in particular by analyzing the electric current consumed by the device or the electromagnetic radiation emitted by the device. FIG. 3 shows the steps implemented by the security device 5 when it receives data D transmitted by the transmitting terminal 3 to the receiving terminal 9, the data D being transmitted according to a given protocol P. D data transmitted by the transmitter terminal 3 are received by the first switching module 20. In a switching step 40, the latter analyzes the data D to determine whether they are to be transmitted or not to the network N2.

If this data D is to be transmitted only to the network N3, the first routing module 20 sends them to the module 22 cryptographic protection. During an encryption step 42, the cryptographic protection module 22 encrypts the data D, then transmits these encrypted data in a step 44 to the network N3, through the network N2.

If the data D has to be sent to the network N2 and the network N3, in a step 46 of duplication, the first routing module 20 duplicates the data D, sends a first copy D, of these data to the protection module 22 cryptographic and a second copy D2 to the first filtering module 24. For example, a request sent by a resource reservation service from the transmitting terminal 3 to intermediate relay equipment, some of which are located on the network N2, is directed to the first filter module 24 before being transmitted to N2 network equipment. This same request is also directed to the encryption module 22 so that it can be transmitted, securely, to the remote network N3 security level higher than N2. This example can, of course, be extended to a multitude of services.

The data DI is then encrypted and sent to the network N3 according to the steps 42 and 44. In parallel, the data D2 are received by the first filtering module 24, which applies, during a first filtering step 48, several filters. these data, in particular a parsing filter, a semantic analysis filter and a substitution filter, as described with reference to FIG. 2. In particular, during a parsing step 50, the first module 24 filtering ensures that the data D2 respect the format defined in the standards and standards of the protocol P, and that no field of these data D2 is diverted from its object.

Furthermore, during a semantic analysis step 52, the first filtering module 24 checks the automaton of the possible states for the protocol P, and the coherence of the sequences of these states, and detects a possible hidden meaning concealed in these data. In addition, during step 52, the first filtering module 24 extracts D2 data the connection context associated with them, saves this context and transmits it to the second filtering module 30. Then, during a substitution step 54, the first filtering module 24 replaces the sensitive information contained in the data D2, a security level incompatible with the security level of the network N2, by one-level information. security compatible with the N2 network. The first filtering module 24 transmits the substituted sensitive information to the second filtering module. If the parsing or semantic analysis filters detect an anomaly, the data is blocked at 56 and not transmitted to the network N2. If no anomaly is detected, the first filtering module transmits during a step 58 the data obtained after the filtering 48 to the network N2.

FIG. 4 also shows the steps implemented by the security device 5 when it receives data D transmitted by the receiving terminal 9 or the network N 2 to the sending terminal 3, following a data transmission as described with reference to Figure 3. The data D 'are received by the second switching module 30. In a switching step 60, the second routing module 30 transmits the data D 'to the cryptographic verification module 28 if it is cryptographically protected, and to the second filtering module 30 if it is not. If the data D 'is cryptographically protected, during a decryption step 62, the cryptographic verification module 28 applies a cryptographic verification process (for example, a decryption) on the data D'. Then, in a step 64, it transmits the data resulting from the processing to the transmitting terminal 3. If the data D 'is not protected cryptographically, the second filtering module 30 applies on these data, during a second filtering step 66 , a parse filter, a semantic filter and a transpose filter.

In particular, during a parsing step 68, the second filtering module 30 verifies that the data D 'respect the format defined in the standards and standards of the protocol P, and that no field of these data D' n ' is diverted from his object. During a semantic analysis step 70, the second filtering module 30 compares the connection context of the data D 'to the connection context transmitted by the first filtering module 24 during the step 52. If an anomaly is detected during steps 68 or 70, for example if the data connection context D 'does not correspond to any connection context, the second filtering module blocks at 72 the transmission of the data D'.

If no anomaly is detected, during a transposition step 74, the second filtering module 30 reintroduces into the data D the sensitive information replaced by the first filtering module 24 during the step 54, for example the IP addresses of the transmitting terminal 3 and the receiving terminal 9. Then, during a step 76, the second filtering module 30 transmits the filtered data to the transmitting terminal 3. FIG. 5 is a diagram illustrating an example of implementation of FIG. method according to the invention, during the initiation of a resource reservation communication between the sending terminal 3 of the network N1 and the receiving terminal 9 of the network N3, then during the transmission of the data of this communication between the sending terminals 3 and receiver 9.

The routers R 1, R 2, R 3, R n of the transit network N 2 are not represented in this figure. To initiate this communication, for example a multimedia data exchange with the receiving terminal 9, the transmitting terminal 3 transmits an RSVP message M, requesting a reservation of resources between the transmitting terminal 3 and the receiving terminal 9. The RSVP message M must therefore to be transmitted both on the network N2, between the security devices 5 and 11, so as to reserve the necessary resources between the routers of the network N2, and on the network N3, to reserve the necessary resources between the security device 11 and the receiving terminal 9.

This RSVP message M, generally called "Path", is sent by the sending terminal 3 to establish the list of routers of the path that will be followed by the data of the communication. It includes a header, including a field indicating that it is a message type "Path", and several objects indicating the IP address of the transmitter terminal 3, denoted IP3, the IP address of the terminal receiver 9, rated IP9, the port numbers of the transmitter terminals 3 and receiver 9, denoted respectively P3 and P9, and the quantity Q of resources to reserve. The message M can thus be written in the form M = (Path, IP3, IP9, P3, P9, Q). The message M transmitted by the transmitting terminal 3 is transmitted to the security device 5, and more precisely to the first routing module 20.

The latter analyzes the message M and determines that it is a signaling flow that must be transmitted to the network N2. The first routing module 20 duplicates the message M, and transmits first a first copy of this message to the first filtering module 24 and a second copy of this message to the cryptographic protection module 22.

After receiving the message M, the first filtering module 24 determines the nature of this message, in this case detects that it is a reservation message, and applies the syntax and semantic analysis filters of its base. data adapted to the reservation messages. The parsing filter thus verifies that the message M respects the format defined in the standards and standards of the RSVP protocol used. In addition, the semantic analysis filter determines the connection context of the message M, in particular the fact that it is a reservation request of the "Path" type, and transmits this connection context to the second module 30. filtering. The first filter module 24 then applies to the message M a substitution filter, which replaces, in the message M, the IP3 and IP9 addresses of the transmitter 3 and receiver terminals 9 by the IP addresses of the security devices 5 and 11, noted IP5 and IP11. At the end of this filtering, the first filtering module 24 transmits a filtered message M = (Path, IP5, IP11, P3, P9, Q) to the transit network N2.

At the same time, after receiving the message M, the cryptographic protection module 22 encrypts this message, for example using IPsec cryptographic mechanisms, and transmits the encrypted message M, of the form IV / = f (Path, IP3, 1P9, P3, P9 , Q), where f designates an encryption function, to the destination network N3, through the transit network N2.

The filtered message M contains no sensitive information relating to the identity of the transmitter 3 and receiver 9 terminals, so that this information does not circulate in clear on the network N2. In addition, since this filtered message M includes only the IP5 and IP ~ 1 addresses of the devices 5 and 11 of security, it is only transmitted on the network N2 between these devices 5 and 11, and is not transmitted at any time. the N3 network. The filtered message M is therefore a resource reservation request between the security devices 5 and 11. It is transmitted on the network N2 via at least some of the routers R 1, R 2, R 3, R n, until the device 11 for securing, and the reservation of the requested resources is performed on the network N 2. It is never transmitted on the N3 network. In case of failure of the reservation, the network N2, for example one of the routers of the network N2, transmits to the security device 5 an error message E = (ErrRes, IP5, IP11, P3, P9, Q ), indicating that the requested resources could not be reserved between the securing devices 5 and 11.

The message E is received by the second routing module 26, which transmits it to the second filtering module 30 since this message E is not encrypted. The second filtering module 30 then analyzes the message E to counter any attempt to create a hidden communication channel and intrusion on the network NI by the network N2. In particular, the second filter module 20 applies a semantic filter to the message E and verifies that its connection context corresponds to a saved connection context. In the present case, the message E actually being a response to a request sent by the security device 5, it is authorized to be transmitted to the transmitting terminal 3.

Before this transmission, the second filtering module 20 applies a transposition filter to the message E, so as to reintroduce in this message the IP3 and IP9 addresses of the transmitter 3 and receiver 9 terminals. The second filtering module 20 then transmits a first message. filtered confirmation E = (ErrRes, IP3, IP9, P3, P9, Q) to the transmitting terminal 3, which therefore receives the error message indicating a failure of the reservation. Meanwhile, the encrypted message Û = f (Path, IP3, IP9, P3, P9, Q) is transmitted through the network N2 to the network N3. This message Û is received by the referral module of the security device 11, which transmits it to the cryptographic verification module of this device. The encrypted message Û is then decrypted, and the decrypted message M transmitted on the network N3 to the receiving terminal 9. The necessary resources are then reserved between the device 11 and the receiving terminal 9. If the sending terminal 3 receives no message an error indicating a failure when reserving resources, it then emits the DM data for which the resources have been reserved. This DM data is received by the security device 5, encrypted because it is confidential data not allowed to be transmitted to the network N2, then the encrypted data D0 = f (DM) are transmitted through the network N2 to the device 11 for securing. The device 11 then decrypts this data, then transmits the decrypted data DM to the receiver terminal 9. It is understood from the foregoing description how the method and the device according to the invention make it possible to improve the security of secure networks communicating through a network. security network, while ensuring interoperability between these networks. In particular, the verification of the connection context associated with any data transmitted by the N2 network to the NI network or the N3 network makes it possible to prevent any potentially dangerous communication on the initiative of the N2 network.

In addition, since all the data transmitted by the network N1 to the network N3 are encrypted data, no data in the clear is relayed by the network N2 to the network N3, also preventing a communication at the initiative of the network N2 to the N3 network.

Furthermore, the substitution of the sensitive information with non-sensitive information during the transmission of data from the network N1 to the network N2 makes it possible to avoid the potentially confidential information being carried on the network N2. In addition, interoperability between the NI, N2 and N3 networks is maintained, since non-confidential data can be transmitted on both the N2 and the N3 networks. The method according to the invention can therefore be seen as a cryptographic protection method with controlled interoperability. The level of interoperability with less secure networks is configured according to the proportion of services allowed to transmit information to the N2 network of lesser security via the filtering step and according to the context of use and the associated level of threats. However, it should be understood that the embodiments described above are not limiting. In particular, according to other embodiments, the security method is implemented between more than two secured networks, through several networks of lower security levels, each of the secured networks being equipped with at least one security device. according to the invention.

Claims (11)

REVENDICATIONS1. A method of securing a bidirectional communication channel between at least one originating network (NI) and a destination network (N3) through a transit network (N2) of a lower security level than the networks (NI , N3) of departure and destination, comprising the following steps: - during transmission of at least one type of first data of the network (NI) of departure to the network (N2) transit and to the network (N3) ) of destination through the network (N2) transit: - implementation of a first step (48) for filtering said first data, comprising an application (50, 52) of at least one analysis filter on said first data to counter the creation of a hidden communication channel, - transmission (76) of said first filtered data to the transit network (N2), said method being characterized in that it further comprises, during the transmission of said first data from the network (NI) of d to the transit network (N2) and to the destination network (N3), the following steps: - duplication (46) of said first data, - cryptographic protection (42) of said first duplicate data, - transmission (44) of said first data protected data to the destination network (N3), and in that said first filtered data is not transmitted by the transit network (N2) on the destination network (N3). 2. A security method according to claim 1, characterized in that said first filtering step (48) comprises a step (54) of substitution of sensitive information included in said first data, incompatible with the security level of the network ( N2) through information compatible with the security level of the transit network (N2). 3. Securing method according to one of claims 1 or 2, characterized in that said first step (48) of filtering comprises a backup of a first connection context associated with said first data. 4. Securing method according to claim 3, characterized in that it further comprises, during a transmission of second data transmitted by the network (N2) transit to the network (NI) departure, a second step (66) filtering said second data, comprising: - a comparison of a second connection context associated with said second data to said first connection context, - if said first and second contexts are inconsistent, a blocking (72) of said second data, if said first and second contexts are coherent, an application of at least one filter (68, 70) of analysis on said second data and a transmission (76) of said second filtered data to the network N1. 5. Securing method according to claim 4 taken in combination with claim 2, characterized in that said second step (66) of filtering comprises the introduction (74) in said second data of said sensitive information substituted during said step of substitution. 6. A device (5, 11) for securing a bidirectional communication channel between at least one originating network (NI) and a destination network (N3) through a transit network (N2) of a level of lower security than the networks (Ni, N3) of departure and destination, comprising: - a first filtering module (24) comprising means for applying at least one analysis filter to data to be transmitted from the network (Ni ) to the transit network (N2), to counter the creation of a hidden communication channel, - a data cryptographic protection module (22), able to protect data to be transmitted from the originating network (NI). to the destination network (N3), said system being characterized in that it furthermore comprises at least one switching module (20) able to direct first data to be transmitted from the originating network (NI) to the network (N2) transit and to the destination network (N3), to ledi t first filtering module (24), to duplicate said first data, and to direct said first duplicate data to said cryptographic protection module (22). 7.- Device (5, 11) for securing according to claim 6, characterized in that said first filtering module (24) comprises means for substituting sensitive information included in said first data, incompatible with the security level of the network (N2) transit, by information compatible with the security level of the transit network (N2). 8.- Device (5, 11) for securing according to one of claims 6 or 7, characterized in that said first filtering module (24) comprises means for saving a first connection context associated with said first data. 9.- Device (5, 11) for securing according to claim 8, characterized in that it further comprises a second filtering module (30), comprising: - means for comparing a second connection context associated with second data transmitted by the network (N2) of transit to the network (Ni) starting at said first connection context, - means for blocking said second data if said first and second contexts are inconsistent, - means for applying at least one filter analyzing said second data and transmitting said second filtered data to the originating network (NI) if said first and second contexts are coherent. 10.- Device (5, 11) according to claim 9 taken in combination with claim 7, characterized in that said second filtering module (30) comprises means for introducing into said second data said sensitive information substituted by said first filtering module (24) .