EP3123691A1

EP3123691A1 - Method of processing a message in an interconnection device

Info

Publication number: EP3123691A1
Application number: EP15714868.5A
Authority: EP
Inventors: Liana BOZGA; Louis DAVY; Jean-Olivier GERPHAGNON
Original assignee: Bull SA
Current assignee: Bull SA
Priority date: 2014-03-26
Filing date: 2015-03-12
Publication date: 2017-02-01
Also published as: WO2015145018A1; FR3019417A1; US20170111320A1; FR3019417B1

Abstract

The invention relates to a method of processing a message by means of a first interconnection device, said method being characterised in that it comprises the following steps: recording a first database of processing rules in the first interconnection device, recording an identifier of a second interconnection device in the first interconnection device, and processing a communication in accordance with local processing rules of the first local database of rules and with remote processing rules obtained from a second interconnection device which is identified by means of the identifier of the second interconnection device.

Description

Method of processing a message in an interconnection device

TECHNICAL FIELD OF THE INVENTION

The invention relates to the interconnection device in the field of routing messages through a network. The invention also relates to the security of computer networks in which data packets, or messages, are routed.

Interconnection device, in the context of the present application, any device for intelligently interconnecting at least two data processing devices. We speak of interconnection device. In particular, the switches and routers are targeted.

STATE OF THE PRIOR ART

In a network environment, for security management, it is essential to be able to define access rules to the equipment that is connected through it. In a current solution, the network equipment makes it possible to define access control lists (ACLs) containing rules to be applied to the data (messages or frames) circulating through said equipment. The application of said rules is done on each device in a "stand-alone" manner and without overall coherence at the network level whether it is local or extended. This means that each piece of equipment must define the rules and apply them at its own level and not in a homogeneous overall way.

Thus, if configurations are changed on a device, in disagreement with the overall policy, voluntarily or involuntarily, the detection will be complex and a potentially open security gap. However, this solution is the best if the security rules are different on each equipment and inconsistent. However, this is rarely, if ever, the case.

In practice the configurations are copied identically on all devices which is a source of errors, inconsistencies and loss of performance. Indeed a device is found cluttered with rules corresponding to packages he will never receive. However, the device tries to take into account these rules.

It should be noted that in existing solutions, in the context of a "routed" network (ie a network in which one or more devices are responsible for defining the routes that packets must take according to their origin and their destination ) the management of ACLs is often carried out on these equipments and the non-defined rules on the terminal equipments.

In addition, if no ACL is defined at the switches connecting the terminal equipment (hosts) access controls will be applied only in the case where the network frames are forced to go through the routing equipment. . If the frames remain localized at the said switch, the application of the rules will not be performed.

SUMMARY OF THE INVENTION

The invention aims to remedy all or part of the disadvantages of the state of the art identified above, and in particular to provide means to allow interconnection devices to share a configuration, this configuration being a set of treatment rules.

In this purpose, one aspect of the invention relates to a method of processing a message by a first interconnection device characterized in that it comprises the following steps:

Recording, in the first interconnection device, a first database of processing rules

Recording, in the first interconnection device, an identifier of a second interconnection device,

Processing a communication according to

Local processing rules for the first local rule database

Remote processing rules obtained from a second interconnection device identified by the identifier of the second interconnection device.

In addition to the main characteristics which have just been mentioned in the preceding paragraph, the method / device according to the invention may present one or more of the following additional features, considered individually or as technically possible:

the remote processing rules are obtained for each processed message.

the remote processing rules are obtained on predetermined dates.

the remote rules, once obtained, are saved locally so that they can be reused.

a remote processing rule is associated with an interconnect device identifier.

a remote processing rule is associated with a timestamp.

the remote processing rules are erased based on at least their time stamp.

a rule has at least:

- A source address,

A destination address,

A treatment instruction code among at least:

-Block the message,

-Leave the message

- each treatment rule is associated with a priority

it comprises a step of authentication of the first interconnection device by the second interconnection device

The invention also relates to a digital storage device comprising a file corresponding to instruction codes implementing the method according to one of the preceding claims.

The invention also relates to a device implementing the method according to one of the preceding claims.

BRIEF DESCRIPTION OF THE FIGURES

Other features and advantages of the invention will emerge on reading the description which follows, with reference to the appended figures, which illustrate:

Figure 1, an illustration of means for illustrating the implementation of the invention; Figure 2, an illustration of steps of the method according to the invention.

[...] [...]

For clarity, identical or similar elements are identified by identical reference signs throughout the figures.

The invention will be better understood on reading the description which follows and the examination of the figures that accompany it. These are presented as an indication and in no way limitative of the invention.

DETAILED DESCRIPTION OF AN EMBODIMENT

Figure 1 shows a hardware architecture in which the invention can be implemented. Figure 1 shows a first connected device 1 01 and a second device 1 02 connected through a first device 1 03 interconnection.

An interconnection device is at least one message processing device issued by the devices to which the interconnection device is connected. As a processing device, the first interconnection device comprises at least:

A microprocessor 104,

A program memory comprising at least instruction codes corresponding to all or part of the invention. For the present description these instruction codes are at least those of a client part of the invention

A storage memory 106,

A set of connectors 1 07 for connecting the device

1 03 interconnection.

The elements described are those useful for a clear description of the invention. The memories are elements, in the sense of at least one electronic component, separated or are distinct zones of the same element.

We talk about all or part of the invention because it relates to a client-server application. There are therefore instruction codes that correspond to the client part, and instruction codes that correspond to the server part. In the implementations of the invention the client parties and servers may be present on the same device.

In practice when lending an action to a device it is performed by a microprocessor of the device controlled by instruction codes stored in a device memory.

FIG. 1 shows that the storage memory 106 of the first interconnection device 103 includes a first database 108 of processing rules data. In our example, this first database of processing rules is limited to a table, each row of the table corresponding to a rule, each rule having properties corresponding to columns of the table. A line is also called a record.

Figure 1 shows that the storage memory 106 of the first interconnection device 1 03 has a zone 1 09 to record an address of a second interconnection device 203 connected to the first device 1 03 interconnection. This zone is designated as the identification memory of the remote interconnection device. This is for example:

a dedicated configuration file,

a section of an existing configuration file,

an area located at a predetermined address on the storage means,

a line in a database

The second device 203 interconnection is also a processing device. It is similar to the first interconnection device 103. The second interconnection device 203 comprises a rules database and instruction codes corresponding to the invention. For the purposes of this illustration, these instruction codes correspond to a server part of the invention.

An address is for example an address in the format I PV4, that is to say an address according to version 4 of the protocol I P. It could be an IPV6 address. It is only an example, in practice it is a routable identifier on a network, whether it is an Ethernet network, InfiniBand, ARI ES, ... the list n ' is not exhaustive. In these cases the IP address is to be replaced by its equivalent: memory address, unique hardware identifier (GUI D) ... [0026] Thus a rule comprises at least:

A property 1,081 source identifier (s),

A property 1,082 identifying destination (s),

A property 1,083 action code.

For the properties we speak of identifier to designate:

An address, as previously defined, or

A network, that is, a set of addresses.

An action code is at least among:

Let go, or

- Block.

Thus, the processing of a message consists of determining which rules apply to it, and thus of applying to it the action corresponding to the corresponding rule or rules. If several rules correspond with contradictory actions, one applies a known mode of conflict resolution like for example:

Each rule having a sequence number, that is to say of classification, it is the action of the first found rule which is applied, or the blocking is priority, or

Each rule to a priority is the action of the rule with the highest priority that is applied, or

... The list is not exhaustive.

Figure 1 shows a third device 301 connected, connected to the second device 203 interconnection.

Figure 1 also shows that the storage memory 106 of the first interconnection device 1 03 includes a second database 1 1 0 of data having the same structure as the first database 108 of processing rules data. This second database 1 1 0 of data is intended to record processing rules from other interconnection devices. We can then speak of a base 10 of remote processing rules.

In practice there could be only one database with lines having an additional property named "Origin" to record the origin of the rule as it is: Local: that is to say specific to the device comprising the database, or

Remote: that is from another device than the one containing the database. This Origin property can also register an interconnect device identifier to determine which device it came from.

In general, the following interconnected devices:

First interconnection device, and

Second interconnection device

are together called a network. By extension it is considered that the devices connected to those previously mentioned are also part of the network which will be designated as the first network thereafter.

FIG. 2 shows a step 500 of configuration of the first interconnection device 1 03. In this step a user, generally administrator of the first network, updates the first base 108 of processing rule data. Such an update requires a secure connection and is done in a traditional way:

Remote

Via a web interface (http), or a secure web interface (https), and an internet browser

Via an ssh connection, that is to say in console mode,

In local

By having a physical access to the device which allows to connect via a cable connected to a dedicated connector, historically RS232, the device: it is then in graphics mode or console mode depending on the device.

These are modes of configuration of a known interconnection device.

In the invention we go from step 500 to a step 501 for recording an identifier of the second interconnection device 203 in the memory 1 09. This is done by adapting one of the configuration modes. previously described. In the case of a graphical configuration mode adds an input field for entering a value for the identifier of the second interconnection device. The validation of this input area causes the updating of the memory 09 to identify the remote interconnection device. In the case of a configuration mode command line, using a new command, due to the invention, the execution of which causes the updating of the memory 1 09 identification of the remote interconnection device.

The memory 1 09 may contain:

An address I PV4, I PV6 or other.

A string of characters that can be resolved into an address via a DNS server or equivalent.

From step 501 we proceed to a step 502 for obtaining remote processing rules. In step 502, the first interconnection device 1 03 produces a processing rule request message comprising at least:

A destination address, the identifier stored in the memory 1 1 09 identification of the remote interconnection device,

A response address, that of the first device 1 03 interconnection.

A predetermined instruction code: This instruction code is a rule request code.

Once the rules request message product, it is issued by the first device 1 03 interconnection.

In a step 51 0 for receiving a rule request message the second interconnection device 203 receives the processing rule request message issued by the first interconnection device 1 03. This message is identified as a request message for processing rules because:

It is intended for the second interconnection device, in fact the destination address is that of the second interconnection device;

It has an appropriate instruction code.

In this step the second device produces a processing rules transmission message comprising at least: A destination address that is worth the response address value of the rule request message;

An issuer address which is the address of the device producing and transmitting this message;

A predetermined instruction code: This instruction code is a code designating the message as a processing rule transmission message.

Zero or N message processing rules, where N is greater than or equal to 1.

Once the rule transmission message is produced, it is sent by the second interconnection device.

In a step 51 1, the first interconnection device 1 03 receives the transmission message processing rules. There he recovers the treatment rules. It has thus obtained remote processing rules of a second interconnection device. This message is identified as a processing rule transmission message because:

It is intended for the first interconnection device, in fact the destination address is that of the first interconnection device;

It has an appropriate instruction code.

According to implementations of the invention, the remote processing rules are:

Maintained in a working memory, or

Registered in a local database, for example the database

1 10 of remote processing rules data.

Step 502 is implemented, for example, according to a predetermined interval. This predetermined interval makes it possible to determine dates at which step 502 is implemented.

In a message processing step 520 the first processing device receives a message. This message is processed according to its characteristics, in particular source and destination addresses. This processing is performed according to the local processing rules and the remote processing rules. The processing of a communication message is here comparable to a filtering. In a variant, which is not the most optimal, remote rules are required for each processing of a communication message.

In a practical example consider that:

The first device 101 connected to address A1,

The second device 1 02 connected to address A2,

The third device 301 connected to address A3

The Local Rule Database 1 08 has the following rule:

Source = A1, Destination = A2, Action = Skip

A local rule database of the second interconnect device has the following second rule:

Source = *, Destination = A3, Action = Block

The first device receives the following communication message:

Source = A1,

- Destination = A3,

Message = Hello world!

Without the invention, the communication message would be blocked by the second interconnection device that it must cross to reach the third connected device 301.

With the invention the first interconnection device has obtained the second rule. He knows that the communication message must be blocked. This saves him from having to transmit the communication message and thus saves bandwidth.

Similarly, before the invention, in a network environment, for security management, the network equipment used to define access control lists (ACLs) containing rules to be applied to the messages circulating. through the said equipment. The application of said rules is done on each device in a "standalone" manner and without overall coherence at the network level. This means that each piece of equipment must define the rules and apply them at its own level and not in a homogeneous overall way. This homogeneity had to be maintained by hand. It is not uncommon, without the invention, to have some equipment blocking messages while others let them pass. This can be security breaches. With the invention it is possible to have a reference device that supports the configuration of a set of interconnection devices.

In a variant of the invention, the local processing rules and the remote processing rules are recorded in the same database which then comprises an additional column for recording the origin of the rule, for example the address of its user. original device, or simply a Boolean marker indicating whether or not it is acting on a local rule.

In another variant of the invention an interconnection device obtains processing rules of several remote devices. It is noted here that a remote device is not necessarily an interconnection device. There is at least one processing device that implements the server part of the invention. The server portion of the invention is the ability to respond to rule request messages. The client portion of the invention is the ability to issue policy request messages and process responses to these messages.

In a variant of the invention a remote rule is associated with a timestamp. This makes it possible to define a default lifetime for the rule, and / or a duration at the end of which it is necessary to ask the remote device from which the rule originates if this one is still valid. Such a time stamp also makes it possible to calculate an age for the rule. An age is the time calculated between the current date and the time stamp. In a variant, rules whose age exceeds a predetermined value are ignored.

In a variant of the invention a remote rule is associated with a version identifier which makes it possible not to re-issue remote rules whose version has not changed on the reference device.

In a variant of the invention, each rule being associated with a unique identifier of the rule, the remote rules are deleted if they are not received in the response to a request message for issuing rules. This absence means that the rules in question have been deleted on the source device of the rules and that this deletion and cascaded on the devices that synchronize on the source device.

In a variant of the invention each rule is associated with a priority, the rule having the highest priority primarily applying to others. We have just described an implementation mode in which the client, that is to say the first interconnection device, requests processing rules. We are talking about "pull" mode.

The invention remains valid with an embodiment in which the second interconnection device, or a remote device, pushes rules to the first interconnection device. In this case, by symmetry, the equivalent of the memory 1 09 to record an address of a second interconnection device on the second device becomes an area for recording at least one address of a device to which it is necessary to push treatment rules. In this case, the rule transmission message is produced without a request being received. This is called "push" mode or subscription mode: a client device subscribes to a server device.

In a variant of the invention at the server device the rules to be transmitted are marked as such. This marking is, for example, carried out via an additional column in a rule table. It can also be a file containing rules to emit. The fact of being in this file is then a marking.

The stages of the invention are distributed over time. In practice, the processing rule databases are up-to-date at the time of processing a message.

A time stamp is:

a date,

a time stamp (timestamp), or

a version number. In the case of a version number one can use an operation of the type used for the serial number management of SOA records for DNS. In the latter case we can consider managed rule files as zone files of a DNS server.

The list is not exhaustive.

The invention has been described with simple processing rules, based on source addresses and destinations. In practice the invention remains valid with more complex rules using, for example, the concepts of protocols (tcp, udp, ftp, http ...) or packet inspection. The description implicitly includes the concept of recursion. That is, a first interconnect device, when retrieving rules from a second interconnect device, can obtain rules that the second device itself has obtained from a third device. interconnection.

In a variant of the invention the zone 1 09 to record an address of a second device allows to register multiple addresses, each of these addresses corresponding to an interconnection device. In this case, the first interconnection device obtains processing rules from several second interconnection devices. In this case also, if necessary, a conflict resolution mode is used.

In a variant of the invention, the step 51 0 of receiving a rule request message comprises a preliminary step 51 0.1 authentication of the issuer of the request message rules. A simple version is the existence test of the response address of the message in a list of authorized applicants. If the response address exists, then the rules are issued. If the address does not exist then no response is made to the rule request message.

In a more elaborate variant, the authentication is based on the implementation of a challenge, for example based on certificates each device having his own, between the device to emit the message and the recipient device of the message.

In a variant of the invention, an attempt to obtain processing rules is triggered by the receipt of a specific message. Such a message is, for example, sent in broadcast mode by an interconnection device of which at least one processing rule has just been modified.

Claims

1. Method of processing a message by a first interconnection device (103) characterized in that it comprises the following steps:

- Registering (500), in the first interconnection device, a first base (108) of processing rule data

Recording (501), in the first interconnection device, an identifier (109) of a second interconnection device,

Processing (520) of a communication according to

- Local processing rules of the first local rule database (108)

Remote processing rules obtained (51 1) of a second interconnection device identified by the identifier of the second interconnection device.

2. Method according to claim 1 characterized in that the remote processing rules are obtained for each processed message.

3. Method according to claim 1, characterized in that the remote processing rules are obtained at predetermined dates.

4. Method according to claim 1 or 3 characterized in that the remote rules, once obtained, are recorded locally so as to be reused.

5. Method according to claim 4 characterized in that a remote processing rule is associated with an interconnection device identifier.

6. Method according to one of claims 4 or 5 characterized in that a remote processing rule is associated with a timestamp.

7. Method according to claim 6 characterized in that the remote processing rules are erased according to at least their time stamp.

8. Method according to one of the preceding claims characterized in that a rule comprises at least:

- A source address,

A destination address,

A treatment instruction code among at least:

Block the message, Leave the message.

9. Method according to one of the preceding claims, characterized in that each treatment rule is associated with a priority.

10. Method according to one of the preceding claims, characterized in that it comprises a step of authentication of the first interconnection device by the second interconnection device.

1 1. Digital storage device comprising a file corresponding to instruction codes implementing the method according to one of the preceding claims.

12. Device implementing the method according to one of the preceding claims.