FR3057122B1 - METHOD AND DEVICE FOR DETECTING INTRUSIONS ON A NETWORK USING A HOMOMORPHIC ENCRYPTION ALGORITHM - Google Patents

Abstract

The intrusion detection method comprises: receiving from a security device (RG 6) having access to at least one intrusion detection rule comprising at least one regular expression established from at least one signature, at least one function describing the expression that can be evaluated by means of a homomorphic evaluation function of a homomorphic encryption algorithm, and an encryption of each signature by an encryption procedure of the homomorphic algorithm and a public key of the security device; - Receiving from a transmitter (TX 2) a T encrypted content derived from a message obtained by symmetric encryption by means of a secret key; obtaining an encryption T 'of the encryption T and an encryption S of the secret key corresponding to the encryption procedure of the homomorphic algorithm and the public key of the security device; the evaluation of a symmetric decryption on the encrypted T 'by the homomorphic evaluation function with the encrypted S, providing an encrypted V of the message; evaluating said at least one function describing said at least one regular expression on the encrypted V with the encrypted signatures, providing an encryption of a detection result; and the detection of an intrusion if the decrypted result indicates the existence of a regular expression corresponding to the message.

Description

BACKGROUND OF THE INVENTION The invention relates to the general field of telecommunications.

It relates more particularly to the detection of intrusions on a telecommunications network via which a sending device and a receiving device exchange dutrafic encrypted.

In a known manner, SSL (Secure Sockets Layer) protocols, and more recently Transport Layer Security (TLS), are security protocols commonly used on networks such as for example on the public Internet network by HTTPS (HyperText TransferProtocol Secure) for ensure the confidentiality of the exchanges. These protocols protect any sensitive data shared by various devices on the network, by encrypting the exchanges between these devices. Unfortunately, this encryption renders impossible the existing intrusion detection techniques, which are unable to inspect the encrypted traffic exchanged on the network.

Indeed, intrusion detection and protection systems (commonly referred to as Intrusion Detection Systems (IDS) and Intrusion ProtectionSystems (IPS)) are conventionally configured to monitor the traffic exchanged on the network and to identify signatures or characteristic behaviors in this network. traffic associated with various threats that may affect the network, such as for example the intrusion of malware or malware, the leakage of sensitive data, attacks on the network, etc. For this purpose, these systems implement an in-depth packet inspection more commonly referred to by DPI (for Deep Packet Inspection in English), which consists in analyzing the content of a network packet (eg IP packet) and not only its header. , and compare this content with signatures (or "patterns" or keywords in English) characteristics of scenarios known attacks. Such a comparison can be achieved by simple equality tests or by using more complete regular expressions derived from these signatures. We are talking about "full IDS" systems. These signatures or keywords, and where applicable the regular expressions, are determined and provided by security editors or other open source code software (ie "open source"), which compete with one another for offer an up-to-date design catalog covering the widest range of possible attacks knowing that new attacks are appearing every day.

The common point of these IDS systems is that they are based on the analysis of communications transmitted in clear on the network in order to be able to compare the content of these communications with the signatures pre-established by the security editors. Using network security procedures such as SSL or TLS makes it impossible to use these systems as they are, so that information systems that rely on encrypted exchanges on the network are vulnerable to many problems. cyber attacks.

To get around this limitation, many security vendors offer applications that behave unsafe by positioning themselves as a "man-in-the-middle" on an SSL / TLS connection connecting a transmitter device to a receiving device, so as to intercept communications between these two devices. This interception is implemented via the use of false trust certificates that make it possible to break the end-to-end encryption used between the two devices and to access the clear content of their exchange.

While such a solution is satisfactory from the point of view of intrusion detection, it nevertheless raises ethical, legal and privacy issues for users, so that many web browsers today and ship plug-ins that detect and revoke false trust certificates used by IDS systems.

It has long been considered that it is not possible to satisfy simultaneously the two network security conditions in terms of intrusion monitoring and detection, and guaranteeing the privacy of users via the encryption of their communications. J. Sherry et al., In "BlindBox: Deep Packet Inspection overEncrypted Traffic," SIGCOMM'15, August 17-21, 2015, provide a technique for inspecting encrypted traffic using advanced encryption protocols. This technique is used to detect attacks on encrypted traffic via an IDS proxy that is cut off from traffic (also known as the middlebox). It relies on the clear delivery, by the security editor, keywords to look for traffic and encryption by proxy IDS of these keywords in preliminary of each encrypted connection (eg with each SSL connection ) implementing a transmitting device and a receiving device. The IDS proxy then compares via equalization tests the keywords thus encrypted with the traffic exchanged between the sending device and the receiving device. If a match is detected, the traffic is considered suspect, and different actions can then be taken, such as sending a notification to the network administrator, deleting the packet identified as suspicious, stopping the connection. between the transmitting device and the receiving device, etc. The BlindBox solution also provides an embodiment in which, when a suspicious packet is identified, this packet is decrypted by the IDS proxy to apply a conventional IDS procedure to it. It is then possible to use IDS proxy during this procedure to perform on the plain data simple tests of equality from the keywords but also to search in the clear data more complex regular expressions built from the keywords.

The BlindBox solution proposed by Sherry et al. However, there are several major disadvantages.

In the first place, it is incompatible with the rules imposed today by the ecosystem in which security editors and IDS systems participate. Indeed, as previously mentioned, the BlindBox solution requires that all the keywords and detection rules (eg combination of several keywords and / or regular expressions) proposed by the security editor be accessible in clear by the user. proxy IDS so that it can encrypt them, and thus more generally, by each IDS proxy present in the network. Although this constraint is not a theoretical one, it is not at all in line with the practices of the security publishers, for obvious economic reasons, the basics of keywords and other rules of detection constituting the added value of security vendors. Therefore, although theoretically conceivable, the solution proposed by Sherry et al. is not applicable in practice in a network.

In addition, the BlindBox solution requires that all keywords be encrypted at each connection between a sending device and a receiving device processed by the IDS proxy (typically, at each SSL / TLS connection). The time required for this encryption can be considerable since it is directly proportional to the number of keywords to be taken into account, which can easily reach a few hundred or even a few thousand keywords. In addition, the encrypted keywords for each connection must be stored in memory for the duration of the connection. The memory space required for this purpose must therefore be, on the one hand, proportional to the number of keywords to be considered and, on the other hand, to the number of simultaneous connections that can be inspected by the IDS proxy. It is therefore clear that the use of the BlindBox solution is possible only under limited network conditions.

In addition, BlindBox's approach offers a "full IDS" solution only at the cost of decrypting data from a packet identified as suspicious. Even if the decryption of the data exchanged between the sending device and the receiving device is not systematic, this nevertheless constitutes an infringement of the confidentiality of their exchanges.

OBJECT AND SUMMARY OF THE INVENTION The invention overcomes these drawbacks by proposing an intrusion detection method on a network via which are able to communicate a transmitting device and a receiving device by using a symmetric encryption / decryption algorithmparameterized by a secret encryption key shared between the transmitting device and the receiving device, said detection method being intended to be implemented by an intrusion detection device and comprising: a reception step, originating from a security device having access at least one rule for detecting at least one intrusion capable of affecting the network, said at least one detection rule comprising a regular expression established from at least one characteristic of said at least one intrusion: o of at least one a function describing said at least one regular expression and be assessed through a homomorphic evaluation function of deciphering homomorphic algorithm; and o an encryption of each characteristic signature of said at least one intrusion, obtained by applying an encryption procedure of said homomorphic encryption algorithm parameterized by a public encryption key of the security device; A reception step, originating from the device transmitting an encryption T of a content of a message intended for the receiving device, this encryption T having been obtained by using an encryption procedure of the symmetric encryption / decryption algorithmparameterized by said secret encryption key; A step of obtaining an encryption T 'of the encryption T and an encryption S of the secret encryption key, the encrypts T' and S corresponding to the application on the encryption T and on the secret decryption key of the encryption key encryption procedure of said homomorphic encryption algorithm parameterized by the public encryption key of the security device; A first step of evaluating a procedure for decrypting the symmetric decryption / decryption algorithm on the encrypted T using said homomorphic evaluation function of said homomorphic encryption algorithm and the encryption S of the secret decryption key, this first step evaluation method providing an encryption V message for the receiving device by the encryption procedure of said homomorphic decryption algorithm parameterized by the public key encryption device security; A second step of evaluating said at least one function describing said at least one regular expression on the encrypted message V using the encrypted signatures, said second evaluation step providing an encryption of a detection result indicating the existence or not of a said regular expression corresponding to the message; and a step of detecting an intrusion on the network if the decrypted detection result indicates that there exists at least one said regular expression corresponding to the message.

Correlatively, the invention also relates to an intrusion detection device on a network via which are able to communicate a transmitting device and a receiving device using a symmetric encryption / decryption algorithm parameterized by a secret decryption key shared between the transmitting device and the device. receiving device, said detection device being intended to be located between the transmitting device and the receiving device andcomprising: a first receiving module, able to receive from a security device having access to at least one detection rule from least an intrusion capable of affecting the network, said at least one detection rule comprising a regular expression established from at least one characteristic signature of said at least one intrusion: at least one function describing said at least one regular expression and which can be evaluated by means a homomorphic evaluation function of a homomorphic decryption algorithm; and o an encryption of each characteristic signature of said at least one intrusion, obtained by applying an encryption procedure of said homomorphic encryption algorithm parameterized by a public encryption key of the security device; A second reception module, able to receive from the transmitting device a coded T of a content derived from a message intended for the receiving device, this encryption T having been obtained by using an encryption procedure of the symmetric decryption / decryption algorithm; set by said secret encryption key; A module for obtaining an encryption T 'of the encryption T and an encryption S of the secret encryption key, the encrypts T' and S corresponding to the application on the encryption T and on the secret encryption key of the encryption procedure of said homomorphic encryption algorithm parameterized by the public encryption key of the security device; A first evaluation module of a procedure for decrypting the symmetric decryption / decryption algorithm on the encrypted T configured to use said homomorphic evaluation function of said homomorphic encryption algorithm and the encryption S of the secret encryption key, this first an evaluation module being further configured to provide an encrypted V of the message intended for the receiving device by the encryption procedure of the homomorphic encryption algorithm parameterized by the public encryption key of the security appliance; A second evaluation module configured to evaluate said at least one function describing itadds at least one regular expression on the encrypted V of the message by using the encrypted signatures, this second evaluation module being furthermore configured to provide a result encrypted detecting whether or not a said regular expression corresponding to the message exists; and an intrusion detection module on the activated network if the decrypted detection result indicates that there exists at least one said regular expression corresponding to the message.

Note that there is no limitation on how an intrusion detected by the intrusion detection device is processed. The detection of such an intrusion can thus, for example, only be the subject of a notification sent by the intrusion detection device to the network administrator, or trigger a corrective action, such as for example the rejection of the message examined. interruption of the connection between the transmitting device and the receiving device, etc. The invention thus proposes a new approach allowing the encryption of a communication between a transmitting device and a receiving device while keeping a detection of intrusions on the DPI type network (ie Deep Packet Inspection or inspection of the packages in depth) by a device intermediate or "middlebox" between the transmitter device and the receiving device (intrusion detection device within the meaning of the invention). In other words, the invention offers the possibility of ensuring the security of the network while giving the users of this network respect for the confidentiality of their exchanges.

This approach is based on the use of a homomorphic encryption algorithm that complements the symmetric encryption / decryption algorithm used between the sending device and the receiving device (eg symmetric encryption algorithm used during SSL / TLS connections). . The homomorphic encryption algorithm advantageously makes it possible to look for regular expressions directly in the encrypted traffic exchanged between the sending device and the receiving device, these regular expressions being derived from signatures (or keywords) characteristic of intrusions and defined by a security editor (security device within the meaning of the invention). The intrusion detection scheme proposed by the invention is therefore "full IDS" and very effective. It requires no decryption for that, even partial, of the data exchanged between the sending device and the receiving device, unlike the BlindBox solution.

Indeed, a homomorphic encryption algorithm is conventionally defined by a cryptographic key generation algorithm, an encryption procedure noted here ENC and a decryption procedure noted here DEC, as well as by a homomorphic evaluation function, noted here HOM. This homomorphic evaluation function HOM takes as input a plurality of c, c2,..., CN, N denoting an integer greater than 1, obtained by means of the ENC encryption procedure and a function f which is presented under a form that can be evaluated by the homomorphic evaluation function, for example in the form of a circuitarithmetic. The function HOM then outputs the result of the application of the function f to the variables c1, c2,..., CN (it is said that the homomorphic evaluation function HOM "evaluates" the function f on the numbers c1, c2 ... cN). By misuse of notation, we note that the homomorphic evaluation function HOM satisfies the following relation: HOM (cl, ..., cN; f ') = / (cl, ..., cN) = ENC (f (ml, ..., ι · ηΝ ~), ρ1 <) where ci = ENC (mi) for i = l, ..., N, mi denoting a message which, once encrypted by the decryption procedure ENC parameterized by the public key pk, give the figure ci. The misuse of notation comes icidu fact that it is not exactly the same function f which is applied on the messages in clairml, ..., mN and on the encrypted messages cl, ..., cN. Indeed, as mentioned above and by itself, the homomorphic evaluation function imposes certain constraints on the form of the function f in order to be able to evaluate it on the c1, ..., cn, constraints that are not necessary to apply this function to unencrypted messages. In the strict sense of the term, we therefore have two functions f and f 'applied respectively to the ciphers and to the messages in the clear. However, for the sake of simplification in the remainder of the description, and to facilitate the understanding of the invention, consider a single notation f to designate this function and we mean by evaluation of a function f by the homomorphic evaluation function. evaluation of the function f in its transformed form. Thus, by way of example, and by abuse of language, evaluation of the decryption procedure is understood to mean the evaluation of this decryption procedure in a form that may be transformed and evaluated by the homomorphic evaluation function.

The homomorphic evaluation function HOM therefore makes it possible to perform any operation on encrypted data resulting from the ENC encryption procedure. Typically, according to the invention, it makes it possible to evaluate, on the one hand, the decryption algorithm corresponding to the symmetric encryption algorithm used to encrypt the clear data exchanged between the sending device and the receiving device, and on the other hand , functions that describe regular expressions to look for in encrypted traffic. By exploiting this property of the homomorphic evaluation function HOM, the invention enables the intrusion detection device to manipulate the encrypted data exchanged between the transmitting and receiving device without ever accessing the data in the clear, and to perform a search for Regular expressions derived by the security editor from the characteristic signatures of intrusions on the network.

More particularly, and schematically, according to the invention, the clear data exchanged between the transmitting device and the receiving device are encapsulated in two sealed boxes (that is to say locked with respect to each other), nested inside one another: the "internal" box results from the encryption of the data in the clear by means of the symmetric encryption algorithm used by the transmitter and receiver devices (giving a T-coded), and the "external" box results from the encryption by the encryption procedure of the homomorphic algorithm of the encryption T thus obtained (giving an encryption T '). Then, the inventionmanipulates somehow the data contained in these boxes to performDPI detection on the encrypted data by exploiting twice the properties of the homomorphic evaluation function: - a first time to delete the internal symmetric encryption layer. This is accomplished by evaluating using the HOM homomorphic evaluation function the symmetric decryption algorithm on the cipher T '. In this way, it is possible to decipher what is inside the external box, without, however, accessing the data directly and clearly, since the result of this first evaluation is an encryption V of the data in the clear via the homomorphic encryption procedure; And then a second time, to search in the encryption V for the regular expressions specified by the security editor and defined on the basis of the signatures of the characteristic signatures of the intrusions. This search is allowed via the evaluation by means of the homomorphic evaluation function of the regular expressions or more particularly of an appropriate description of each of the regular expressions supplied to the intrusion detection device and able to be evaluated by the homomorphic evaluation function. . Such a description is typically an arithmetic circuit (or boolean circuit), provided by the security device for one or more regular expressions to be searched for in encrypted traffic exchanged between the sending device and the receiving device. With this description in the form of an arithmetic circuit, the invention makes it possible not to be limited to simple equality tests but to be able to search the encrypted traffic exchanged between the sending device and the receiving device for more complex expressions defined from the signatures features of intrusions.

Note that the result of the second application of the homomorphic evaluation function is by definition an encryption of a result of the detection performed by the intrusion detection device. Its decryption makes it possible to detect whether a regular expression specified by the security editor has been detected in the data exchanged between the transmitting device and the receiving device and, as a corollary, detecting the presence or absence of an intrusion on the network.

This decryption can be operated either by the intrusion device itself. Thus, for example, in a particular embodiment, the detection method further comprises: a step of obtaining a decryption private key associated with the public key decrypting the security device and stored in a security hardware module; (or HSM for Hardware Security Module); and a step of decrypting the encryption of the detection result by using the decryption procedure of the homomorphic encryption algorithm parameterized by this private decryption key.

This makes it possible to make the intrusion detection device independent of the security device during the final step of detecting intrusions. This embodiment, however, requires the security device to "deliver" its private decryption key to the intrusion detection device. The use of a security hardware module to store the decryption private key of the security device makes it possible to secure this solution.

In another embodiment, the intrusion detection method is interactive and further comprises: - a step of transmitting the encryption of the detection result to the security device for decryption using a decryption procedure of said key parameterizedhomomorphic encryption algorithm private decryption associated with the public key decryption of the security device; and a step of receiving the decrypted detection result from the security device.

In this embodiment, it is not necessary for the security device to provide its secret key to the intrusion detection device. However, this interactive embodiment requires that, during the detection of intrusions implemented by the intrusion detection device, the security device is accessible by it.

As mentioned, the invention thus makes it possible to carry out a DPI type fullIDS detection on the network without compromising at any time the confidentiality of the exchanges between the transmitting device and the receiving device. In addition, for this purpose, only the structure of the regular expressions is provided by the security device to the intrusion detection device, the characteristic signatures of the intrusions being delivered to the latter only in encrypted form. The use of a Homomorphic encryption algorithm as proposed by the invention advantageously allows the security editor to keep secret with respect to the intrusion detection device the signatures it has established for the detection of intrusions. The approach proposed by the invention is therefore perfectly compatible with existing business models of security editors: no signature is provided in clear by the security editor to the intrusion detection device.

Furthermore, since the encryptions of the signatures characteristic of the intrusions are encrypted by means of the public key of the security device, they only need to be generated and transmitted once to the intrusion detection device, for example when a step of initialization, because of their independence vis-à-vis the sending and receiving devices. They can then be used by the intrusion detection device to manage several simultaneous or successive connections between different transmitting and receiving devices. The same is true of the description of regular expressions. This therefore results in a simplified implementation of the full IDS DPI detection proposed by the invention, and a substantial gain in terms of complexity compared to the BlindBox solution which requires the encryption of the keywords by the proxyIDS at each new connection between a transmitter device and receiver device. The invention also offers the possibility of easily and rapidly taking into account the updating of signatures and regular expressions by the security editor, for example due to the appearance of new types of intrusions that may affect the security editor. network.

In a particular embodiment, the content derived from the message is constitutedessessage for the receiving device or a concatenation of this message and a known hazard security device and the intrusion detection device.

Furthermore, in an embodiment in which the content derived from the message is formed of a concatenation of the message and a known hazard of the security device and the intrusion detection device, the first evaluation step can further provide an encryptionV 'of the hazard by the encryption procedure of the homomorphic encryption algorithmparamétrée by the public key encryption of the security device, the detection methodcomprenant then further a step of transmitting said encryption V' of the hazard to security device for verification.

This verification of the hazard carried out by the security device forces the transmitter device to correctly encrypt the message sent to the receiving device and the hazard under penalty of being "unmasked". This embodiment thus makes it possible to apply the invention only in a context where the sending device and the receiving device are honest only in a context where at least one of these devices is "dishonest", that is to say to say that it can be at the origin of the intrusion perpetrated on the network (voluntarily or involuntarily) or to collaborate with the entity at the origin of this intrusion. This corresponds for example to a case where a transmitter device, whose control has been taken by an attacker transmits sensitive data that is received and expected by the receiving device. Such a context is of paramount importance nowadays as it is seen today that most attacks come from information systems themselves, via malware that takes control of information system terminals. Therefore, both the sending device and the receiving device can be easily corrupted by a malicious remote entity that can take full or partial control over it (for example, an infected victim terminal may leak sensitive data to its master software via such a socket. control). However, here we will limit ourselves to the case where the two devices are "dishonest" independently of one another, that is to say that no prior agreement has been reached between them (for example to transmit sensitive data in a specific way by cutting and transmitting this data in such a way that the method would be ineffective in detecting how the data leakage was made). On the other hand, the approach proposed in the paper by J. Sherry et al. does not manage a situation in which the transmitter and receiver devices are both dishonest independently of each other.

According to the invention, the evaluation of the symmetric decryption algorithm by the homomorphic evaluation function requires the provision to this evaluation function of an encrypted (ie the encrypted T '), but also of an encrypted S of the secret encryption key used during the symmetric encryption, generated using the encryption procedure of the homomorphic decryption algorithm parameterized by the public encryption key of the security device.

In a particular embodiment, the encryption S of the secret encryption key is obtained from the sending device.

This embodiment is particularly simple to implement, the transmitter device having the secret key.

However, in this embodiment, the secret key being encrypted by means of the public key encryption of the security device, nothing prevents a security device a little curious to access the secret key and decrypt by means of this key the encrypted message exchanged between the transmitting device and the receiving device.

To mitigate this possibility, in a particular embodiment, the step of obtaining the encryption S of the secret encryption key comprises: a step of receiving, from the sending device, a so-called intermediate encryption the secret encryption key obtained by using the encryption procedure of the homomorphic encryption algorithm parameterized by a public encryption key of the receiving device; A step of obtaining a re-encryption key from the receiver device to the security device; and - a step of re-encrypting the intermediate encryption S 'using said re-encryption key, this re-encrypting step providing said encryption S of the secret encryption key.

In other words, in this embodiment, this device is protected against an excessively curious security device by combining with the homomorphic encryption algorithm used in the invention a re-encryption scheme (or "proxy reencryption"). In a known manner, such a re-encryption scheme makes it possible to give access to a third party B to encrypted data, for example by means of a public-key encryption algorithm using the public key of entity A, and this without entity A did not disclose his private key encryption and even if the data was not initially intended for the third party. For this purpose, the re-encryption scheme is based on a so-called re-encryption or transition key addressed to the third party B giving a right of access to the third party B to the data encrypted with the public key of the entity A. This key is used to re-encrypt the encrypted data of the entity A so as to make them accessible to the third party B using its own private decryption key.

Thus, in this "combined" embodiment, the secret key used by the symmetric encryption algorithm is no longer encrypted using the security device's public encryption key but by using a public key for encrypting the receiving device, which is the only one to hold the associated decryption private key. To enable the security device to perform the tasks incumbent on it (eg decryption of the detection result encryption, hazard checking, etc.) despite not knowing the decryption private key of the receiving device , the intrusion detection device uses a re-encryption key of the receiving device to the security device to re-encrypt the encrypted S 'secret keytransmitted by the transmitter device. This allows the intrusion detection device to obtain a decrypted S of the secret encryption key corresponding to the public encryption key of the security appliance which it can then use when evaluating the decryption algorithm. Thanks to this re-encryption, the security device is able to decrypt the elements sent to it by the intrusion detection device in an interactive mode.

According to another aspect, the invention relates to a method for communicating a security device with an intrusion detection device on a network, the security device having access to at least one rule for detecting at least one intrusion capable of allocating the network, said at least one detection rule comprising a regular expression established from at least one characteristic signature of said at least one intrusion, the communication methodcomprenant: a step of transforming said at least one regular expression into a function describing said at least one regular expression and evaluable by means of an evaluation function of a homomorphic encryption algorithm; A step of generating an encryption of each characteristic signature of said at least one intrusion by applying an encryption procedure of said homomorphic encryption algorithm parameterized by a public encryption key of the security device; and a step of transmitting said at least one function describing said at least one regular expression and each cipher of each characteristic signature of said at least one intrusion to an intrusion detection device on the network.

Correlatively, the invention also relates to a security device having access to at least one rule for detecting at least one intrusion capable of affecting a network, said at least one detection rule comprising a regular expression established from at least one signature characteristic of said at least one intrusion, the security device comprising: - a transformation module, configured to transform said at least one regular expression into a function describing said at least one regular expression and which can be evaluated by means of an evaluation function a homomorphic encryption algorithm; An encryption module, configured to generate an encryption of each signaturecharacteristic of said at least one intrusion by applying a cryptographic procedure of a homomorphic encryption algorithm parameterized by a public encryption key of the security device; and a transmission module, configured to transmit said at least one describing function ,adds at least one regular expression and each cipher of each characteristic signature of said at least one intrusion to an intrusion detection device on the network.

In a particular interactive embodiment, the communication method further comprises: a reception step from the device for detecting an encryption of a detection result; A step of decrypting the encryption of the detection result by using a decryption procedure of the homomorphic encryption algorithm parameterized by a decryption private key associated with the public encryption key of the security device; and i - a step of transmitting the decrypted detection result to the intrusion detection device.

Correlatively, the security device further comprises: a reception module, able to receive from the detection device a code of a detection result; i - a decryption module, configured to decrypt said encryption of the detection result using a decryption procedure of said encryption algorithm homomorphousparamétrée by a private decryption key associated with the public key encryption of the security device; and a transmission module, configured to transmit the decrypted detection result to the intrusion detection device.

The communication method and the security device in these various embodiments have the same advantages as those mentioned above for the method and the intrusion detection device according to the invention.

It should be noted that, in accordance with the invention, the security device provides the intrusion detection device with different elements enabling it to carry out DPI full IDS detection, without ever giving it the characteristic signatures of the intrusions it has established. These are advantageously kept secret by the security device with respect to the intrusion detection device which only has access to the structure of the regular expressions and the encrypted signatures.

In a particular embodiment, during the step of transforming the communication method, at least one function describing said at least one regular expression is an arithmetic circuit obtained by means of a finite state automaton of non-deterministic statesemodeling the expression and a function for selecting the states of this PLC.

This embodiment provides a simple and efficient means for generating a description of the regular expressions proposed by the security device that can be evaluated by the homomorphic evaluation function of the homomorphic encryption algorithm.

In a particular embodiment, the various steps of the intrusion detection method and / or the different steps of the communication method are determined by instructions of computer programs.

Consequently, the invention also relates to a computer program on an information carrier, this program being capable of being implemented in a security device or more generally in a computer, this program comprising instructions adapted to the implementation of steps of a communication method as described above. The invention also relates to a computer program on an information carrier, this program being capable of being implemented in an intrusion detection device or more generally in a computer, this program comprising instructions adapted to the measurement steps of an intrusion detection method as described above. Each of these programs can use any programming language, and be in the form of source code, object code, or intermediate code between source code and object code, such as in a partially compiled form, or in any form. what other forms are desirable. The invention also relates to a computer-readable information or recording medium and comprising instructions of a computer program as mentioned above.

The information or recording medium may be any entity or device capable of storing the program. For example, the medium may comprise means of clearance, such as a ROM, for example a CD ROM or a microelectronic circuit ROM, or>> still a magnetic recording means, for example a floppy disk or hard disk . On the other hand, the information carrier or recording medium may be a transmissible carrier such as an electrical or optical signal, which may be conveyed via an electrical or optical cable, by radio or by other means. The program according to the invention can in particular be downloaded on an Internet type network.

Alternatively, the information or recording medium may be an integrated circuit in which the program is incorporated, the circuit being adapted to execute or to be used in the execution of the method in question.

According to another aspect, the invention is an intrusion detection system on a network via which are able to communicate a transmitting device and a receiving device by using a symmetric encryption / decryption algorithm parameterized by a secret decryption key shared between the device transmitter and the receiving device, this intrusion detection system comprising: an intrusion detection device according to the invention; and a safety device according to the invention. The invention also relates to a communications system comprising: at least one transmitting device and at least one receiving device able to communicate on a network by using a symmetric encryption / decryption algorithm parameterized by a secret encryption key shared between the sending device and the receiving device; and - an intrusion detection system according to the invention, the intrusion detection device detecting system being intended to be located between said at least one transmitting device i and said at least one receiving device.

The intrusion detection and communication systems benefit from the same advantages as those mentioned above for the method and device for detecting intrusions according to the invention and for the communication method and the security device according to the invention.

In other embodiments, it is also possible to envisage the method of: intrusion detection, the communication method, the intrusion detection device, the security device, the intrusion detection system, and the communication system according to the invention present in combination all or some of the above-mentioned features.

BRIEF DESCRIPTION OF THE DRAWINGS Other features and advantages of the present invention will become apparent from the description given below, with reference to the accompanying drawings which illustrate an embodiment thereof without any limiting character. In the figures: - Figure 1 shows schematically a communications system according to the invention, in a first embodiment of the invention; FIG. 2 illustrates the hardware architecture of an intrusion detection device according to the invention belonging to the communications system of FIG. 1; FIG. 3 illustrates the hardware architecture of a security device according to the invention belonging to the communications system of FIG. 1; FIGS. 4, 5 and 7 respectively represent, in the form of a flow chart, the main steps of a communication method according to the invention, an intrusion detection method according to the invention and an emission method. of a message as implemented in the first embodiment of the invention by the security device, by the intrusion detection device, and by a transmitter device of the communications system of Figure 1; FIG. 6 represents by way of illustration a state of finite state automaton that can be used by the safety device during the process illustrated in FIG. 4; and FIGS. 8 and 9 respectively represent, in the form of a flow chart, the main steps of an intrusion detection method according to the invention and of a method of issuing a message as implemented. in a second embodiment of the inventionby the intrusion detection device and by a transmitting device of the communication system according to the invention. Detailed Description of the Invention

FIG. 1 represents, in its environment, a communication system 1 according to the invention, in a first embodiment.

The communications system 1 comprises: a TX 2 transmitter device; I - a receiver device RX 3; and an intrusion detection system 4 according to the invention.

The transmitter device TX 2 and the receiver device RX 3 are able to communicate with each other via a telecommunications network NW. No limitation is attached to the nature of this network, except that on this network, the communications between the TX 2 sending device and the RX 3 receiving device are secured via the use of a symmetric encryption / decryption cryptographic algorithm noted ALG-SYM relying on a secret decryption key K shared between the transmitting device TX 2 and the receiving device RX 3. Here SYM-ENC, respectively SYM-DEC, the procedure (or algorithm) of encryption or decryption, corresponding symmetrical. The ALG-SYM symmetric encryption / decryption algorithm is for example identical to the symmetric decryption / decryption algorithm used by the secure protocols TLS or SSL.

The network NW can thus be indifferently a public network such as the Internet network or a private network, a fixed or mobile network, a wired or wireless network, it can be formed of a single network or be composed of a plurality of sub-networks. networks, etc. The intrusion detection system 4 is configured to allow the detection of intrusions likely to affect the communications on the network NW, and more particularly, in the example envisaged in FIG. 1, the communications between the transmitting device TX 2. and the RX receiver device 3. For this purpose, it comprises: an intrusion detection device MB (also referred to as a "middlebox") according to the invention, which is in the NW network between each transmitting device TX susceptible transmitting data on this network and each RX receiving device capable of receiving data via this network. Here, in the example illustrated in FIG. 1, the intrusion detection device MB5 is located in the network NW between the transmitting device TX2 and the receiving device RX 3 and is capable of intercepting the exchanges. on the NW network these two devices; and a security device RG 6, managed by (ie under the control of) a security editor capable of determining (i.e., establishing) a plurality of intrusion detection rules capable of affecting the NW network. . These detection rules are in the form of signatures (orpatterns or keywords) SIGi, i = l, ..., I where I designating an integer greater than 1, characteristics of the intrusions likely to affect the NW network, as well as one or more regular expressions REGj, j = 1,..., J, J denoting an integer greater than or equal to 1, established from these signatures. A regular expression, in a known computer fashion, is a string of characters or a pattern that defines a set of strings of available characters. In other words, in the context described here, each regular expression REGj defines a set of possible character strings from one or more signatures. It can rely for this purpose on various operators known per se including: o the group operator "()" which indicates the characters that can be framed starting and other characters before and after the operator; for example "Blind (B | b) ox" includes "BlindBox" and "Blindbox"; o the asterisk * indicating, for the string in which it is used, zero or at least one occurrence of the character or a set of characters preceding the asterisk and delimited by the grouping operator (). For example "ab *": includes the strings "a", "ab", "abb", etc. o the operator "or" or "| Which translates alternative characters or alternative character strings on both sides of the operator. For example "rootkit | trojan" means the strings "rootkit" or "trojan"; o the question mark "? Which indicates zero or an occurrence of a yes character of a set of characters delimited by the grouping operator (); for example "https? "Includes" http "or" https "; and o the "+" operator which indexes one or more occurrences of a character or a set of characters delimited by the grouping operator (); for example, "/ content / p +" includes "/ content / p", "/ content / pp", "/ content / ppp", and so on. Thus, for illustrative purposes, the regular expression "p (a | b) *" includes character strings that contain the character p followed by an arbitrary number (ie zero or more) of "a" or "b" . It therefore includes the strings "p", "pa", "pb", "paaaabb", "pbbba", etc.

In the first embodiment described here, the signatures SIGi, i = 1, ..., 1 and the regular expressions REGj, j = 1, ..., J established by the security editor are stored in a non-volatile memory referenced 15 (see Figure 3) of the safety device RG 6 (and thereforeaccessible by it).

As a variant, the SIG signatures and REG regular expressions established by the security editor can be stored in a remote memory, preferably protected in a manner known per se, and accessible by the security device RG 6.

The way in which the security editor determines the detection rules, especially the GIS signatures and the REG regular expressions, is known per se and depends on the know-how of each security editor. It is not described in detail here. It is noted that GIS signatures and REG regular expressions associated with these signatures are likely to evolve or be updated, for example due to the appearance of new types of intrusions that may affect the NW network.

In addition, it should also be noted that the same security editor may be required to interact with several different intrusion detection devices located in the same network or in different networks. Similarly, an intrusion detection device located in a network may be required to interact with several security editors (and thus with several security devices managed respectively by these security editors). For the sake of simplification however here, it is limited to a security editor and an intrusion detection device.

In accordance with the invention, a DPI and full IDS in-depth inspection is enabled on the NW network although the communications between the TX 2 transmitter device and the RX 3 receiver device are encrypted, and this without the security editor it is obliged to disclose to the intrusion detection device MB 5 the signatures it has established to detect: intrusions likely to affect the NW network. In addition, this full IDS DPI inspection is permitted without the traffic exchanged between the transmitting device TX and the receiving device RX being disclosed to the intrusion detection device MB 5, even partially, so that the confidentiality of the exchange between the two devices are preserved and their privacy guaranteed. In effect, the invention is based on a homomorphic encryption algorithm noted below ALG-FHEi (for Fully Homomorphic Encryption).

No limitation is attached to the homomorphic encryption algorithm per se which may be used: it may be for example the homomorphic encryption algorithm described in C. Gentry's document entitled "Fully homomorphic encryption using ideal lattices", Proceedings of the 41st Annual ACM Symposium on Theory of Computing, STOC 2009, Bethesda, MD, USA, May 31 - June 2, 2009, or an algorithm described in J. Fan et al. "Somewhat practical fully homomorphic encryption", IACR Cryptology ePrint Archive 2012: 144, etc.

In a known manner, such a homomorphic encryption algorithm is defined by several procedures, namely: a key generation algorithm, noted FHE.KEYGEN, parameterized by a security parameter λ known per se, taken here for example equal to 128 bits, in accordance with safety recommendations in force. This algorithm is capable of generating a pair of pyrolytic keys comprising a public encryption key generally noted pk and a private decryption key denoted sk corresponding; An encryption / decryption algorithm comprising a FHE.ENC encryption procedure capable of generating an encryption from a message and the public encryption key pk, and a FHE.DEC decryption procedure able to decrypt an encryption from the private decryption key sk corresponding; A homomorphic evaluation function FHE.HOM, which takes as input several cipherscl, ..., cL and a function f which is in a form that can be evaluated by the homomorphic evaluation function (for example in the form of an arithmetic circuit, further detailed later), said homomorphic evaluation function then outputting f (cl, ..., cL). As mentioned above, if cl, 1 = 1, ..., L designates the cipher of a message ml obtained by means of the encryption algorithm ENC parameterized by the public decryption key pk, by misuse of notation, we can write that the homomorphic evaluation function HOM checks the following relation: FHE.HOM (cl, = / (cl, ..., ci) = FHE.INC (/ (ml, ..., mL), pk) i Abuse This notation is due to the fact that it is not exactly the same function that is applied to messages in the clear ml, ..., ml and on the encrypted messages c1,..., in effect, in a known manner. in itself, the homomorphic evaluation function imposes certain constraints on the form of the function f in order to be able to evaluate it on the c1, ..., cL, constraints which are not necessary to apply this function to the plaintext messages: In the strict sense of the term, therefore, there are two functions f and f 'applied respectively to the ciphered and to the plaintext messages. As a result of the description, and to facilitate the understanding of the invention, we consider a single notationf to designate this function and by evaluation of a function f by the homomorphic evaluation function, the evaluation of the function f in its transformed form. Thus, by way of example, and by abuse of language, evaluation of the decryption procedure is understood to mean the evaluation of this decryption procedure in a form that is eventually transformed and evaluable by the homomorphic evaluation function.

The various procedures defining the ALG-FHE homomorphic encryption algorithm are implemented in whole or in part, in the first embodiment described here, by the different entities of the communication system 1 (transmitting device TX 2, detection device of FIG. intrusions MB 5 and safety device RG 6), as detailed beforehand.

In the first embodiment described here, the intrusion detection device MB5 has the architecture of a computer, as illustrated in FIG. 2. It notably comprises a processor 7, a random access memory 8, a read-only memory 9 , a nonvolatile flash memory 10 and communication means 11 enabling it, on the one hand, to intercept all communication between the transmitter devices TX 2 and receiver RX 3 on the network NW, and on the other hand to communicate with the security device Such means are known per se and are not described in more detail here.

The read-only memory 9 of the intrusion detection device MB 5 constitutes a recording medium in accordance with the invention, readable by the processor 7 and on which is recorded here a computer program PROG1 according to the invention.

The computer program PROG1 defines functional and software modules here configured to implement the steps of an intrusion detection method on the NW network. These functional modules rely on and / or control the hardware elements 7-11 of the intrusion detection device MB 5 mentioned above. They include in particular here, as illustrated in FIG. 1: a first reception module 5A capable of receiving different elements from the security device RG6, and in particular: a function CIRC-REGj describing each regular expression REGj, j = l , ..., J and can be evaluated by means of the homomorphic evaluation function FHE.HOM of i the homomorphic algorithm ALG-FHE. Such a function is here an arithmetic circuit (or Boolean circuit), known per se. The way in which this arithmetic circuit is obtained from the regular expression REGj, j = l, ..., J by the safety device RG 6 is described later; and o an encryption FHE-SIGi, i = 1, ..., I of each signature SIGi, i = 1, ..., I, obtained here by the security device RG 6 by applying the encryption procedure FHE. ENC of the ALG-FHE homomorphic encryption algorithm parameterized by a public keypk (RG) for encrypting the security device RG 6 generated using the FHE.KEYGEN algorithm.

The first receiving module 5A is configured to use in particular the communication means 11 of the intrusion detection device MB 5; A second reception module 5B, able to receive from the transmitting device TX 2 an encrypted denoted T of a content derived from a message m intended for the receiver device RX 3. The coded T is generated by the transmitting device TX 2 by means of of the encryption procedure SYM-ENC of the symmetric encryption / decryption algorithm ALG-SYM, parameterized by the secret encryption key K shared between the transmitting device TX 2 and the receiving device RX 3. The second receiving module 5B is also configured to use the communication means 11 of the intrusion detection device MB 5.

Furthermore, in the first embodiment described here, the second receiving module 5B is configured to receive an encryption S of the secret encryption key K generated by the transmitting device TX 2 by applying to the secret key K the encryption procedure FHE. ENC of the homomorphic algorithm ALG-FHE, parameterized by the public encryption key pk (RG) of the security device RG 6 (in other words, the receiving module 5B is, in the first embodiment, a module for obtaining a encrypted S of the secret decryption key K within the meaning of the invention); A module 5C obtaining a coded encryption T. The encryption results from the application by the obtaining module 5C on the encryption T of the encryption procedure FHE.ENC of the homomorphic encryption algorithm ALG-FHE parameterized by the public encryption key pk (RG) of the security device RG 6.

In a second embodiment, described in more detail later, the obtaining module 5C is furthermore configured to obtain an encryption S of the secret encryption key K, this encryption corresponding to the application of the homomorphic encryption algorithm ALG. FHE parameterized by the public encryption key pk (RG) of the security device RG 6. Note that in this second embodiment, the encryption S is obtained by the obtaining module 5C by re-encrypting an intermediate encryption S 'of the secret encryption key K supplied to the intrusion detection device MB 5 by the transmitting device TX 2. The encryption Is the result of the application on the secret key K of the homomorphic encryption algorithm ALG-FHEi parameterized by an encryption key pk (RX) of the receiver device RX 3, so that the intrusion detection device MB 5 is never in possession of the shared secret key K. The obtaining module 5C is then configured, in the second embodiment, to use a re-encryption key of the receiver device RX 3 to the security device RG 6 to generate the encrypted S; I - a first evaluation module 5D of the symmetric decryption procedure SYM-DEC of the symmetric encryption algorithm ALG-SYM. The first evaluation module is configured to perform this evaluation on the encrypted T and to use for this purpose the homomorphic evaluation function FHE.HOM of the homomorphic algorithm ALG-FHE and the encryption S of the secret key K. The first 5D evaluation module is further configured to provide an encrypted message V m by the FHE.ENC encryption procedure set by the encryption public key pk (RG) of the security device RG 6; A second evaluation module 5E configured to evaluate using the evaluation function FHE.HOM as well as the digits FHE-SIGi, i = 1, ..., I of the signatures SIGi, each function CIRC-REGj describing a regular expression REGj, j = l, ..., J, on the encryption V of the message m. This second evaluation module 5E is furthermore configured to provide an encryption of a detection result indicating the existence or not of a regular expression among the expressions REGj, j = 1, ..., J corresponding to the message m ; and a detection module 5F of an intrusion on the activated network if the detection result once deciphered indicates that there exists at least one regular expression REGj, j = 1, ..., corresponding to the message m.

The functions of these different modules 5A-5F are described in more detail later.

The security device RG 6 also has here the hardware architecture of a computer, as illustrated in FIG. 3. It notably comprises a processor 12, a random access memory 13, a read-only memory 14, the nonvolatile flash memory 15 in which are stored the signaturesSIGi, i = 1, ..., I, the digits FHE-SIGi, i = 1, ..., I and the regular expressions REGj, j = 1, ..., J and i CIRC-REGj arithmetic circuits, j = l, ..., J describing these regular expressions. The security device RG 6 also comprises communication means 16 enabling it to communicate with the intrusion detection device MB 5.

The read-only memory of the security device RG 6 is a recording medium, readable by the processor of the security device and on which is recorded here a computer program PROG2 defining functional modules, configured to implement the steps of a communication method according to the invention. These functional modules rely on and / or control the hardware elements 12-16 of the security device RG 6 mentioned previously. They comprise in particular in the first embodiment described here, as illustrated in FIG. 1: i - a key generation module 6A, configured to use the key generation algorithm FHE.KEYGEN of the homomorphic encryption algorithm ALG-FHE in order to generate the triggered pair of the security device RG 6 comprising the public encryption key pk (RG) and the corresponding decryption key sk (RG); A transformation module 6B, configured to transform each regular expression REGj, j = 1,..., J into a function describing this regular expression and that can be evaluated by means of an evaluation function of an encryption algorithm homomorphic. In the first embodiment described here, as mentioned above, the transformation module 6B is configured to transform each regular expression REGj into an arithmetic circuit CIRC-REGj; an encryption module 6C, configured to generate the encrypted FHE-SIGi, i = 1,..., I from the signatures SIG 1, i = 1,..., I using the encryption procedure FHE.ENC of the homomorphic encryption algorithm ALG-FHE parameterized by the encryption public key pk (RG) of the security device RG 6; and a transmission module 6D, configured to transmit each of the functions (circuits and arithmetic here) CIRC-REGj, j = 1,..., J describing each regular expression REGj, j = 1, ..., J and each cipher FHE-SIGi, i = l, ..., I of each signature SIGi, i = l, ..., I to the detection device of intrusions MB 5. This transmission module 6D is based on the communication means16 of the safety device RG 6.

In the first embodiment described here, the computer program PROG2 also defines the following functional and software modules: a reception module 6E, also relying on the communication means 16, and able to receive from the detection device MB intrusion 5 an encryption of the detection result generated by the MB 5 intrusion detection module; and a decryption module 6F, configured to decrypt this encryption of the detection result by using the FHE.DEC decryption procedure of the homomorphic algorithm ALG-FHE, parameterized by the private key sk (RG) of the security device RG 6 .

In addition, the transmission module 6D is configured to transmit the detection result decrypted by the module 6F to the intrusion detection device MB 5.

The functions of these different modules 6A-6F are described in more detail later.

As a variant, the key pair pk (RG) / sk (RG) associated with the security device RG 6 may be generated by a trusted authority, which is then responsible for publishing the public key pk (RG) and for transmitting the private key sk (RG) securely to the security device RG 6.

It should be noted that no limitation is attached to the nature of the TX 2 transmitter and RX 3 receiver devices. It may be computers, servers or any terminals, provided that they are able to communicate on the network. NW in a secure way by using here the procedure of encryption / decryption of the symmetric encryption algorithm ALG-SYM and for the transmitter device TX 2, the FHE.ENC encryption procedure of the homomorphic encryption algorithm ALG-FHE. It is assumed here that the TX 2 and RX 3 devices are able to exchange or share the secret encryption key K.

In the first embodiment described here, the transmitter devices TX 2 and receiver RX have the hardware architecture of a computer, this architecture being identical to that of the intrusion detection device MB 5 or that of the security device RB 6. namely, that they comprise a processor, a RAM, a read-only memory, the nonvolatile flash memory, as well as communication means enabling them to communicate on the NW network.

The read-only memory of the transmitting device TX 2 constitutes a recording medium, readable by the processor of the transmitting device TX 2 and on which is recorded here a computer program defining functional modules based on and / or control the elements of the equipment. transmitter device TX 2 mentioned above. These functional modulesinclude in particular here, as illustrated in FIG. 1: a module 2A for generating an encryption from a content derived from a message m intended for the receiver device RX 3 by using the encryption procedure SYM-ENC of the symmetric encryption algorithm ALG-SYM, parameterized by the secret encryption key K; A module 2B for generating an encryption of the secret encryption key K, configured to use for this purpose the encryption procedure FHE.ENC of the homomorphic algorithm ALG-FHE; and a transmission module 2C, configured to transmit the two ciphers generated by the module 2A and by the module 2B on the network NW.

Moreover, the read-only memory of the receiver device RX 3 constitutes a recording medium, readable by the processor of the receiver device RX 3 and on which is recorded a computer program defining functional modules based on and / orcommit the hardware elements. of the receiver device RX 3 mentioned above, and in particular a decryption module 3A configured to apply the SYM-DEC decryption procedure of the symmetric encryption / decryption algorithm ALG-SYM parameter set by the secret key K shared with the TX 2 sending device. The functions of the different modules 2A-2C and 3A of the transmitter devices TX 2 and receiver RX 3 are described in more detail later.

In the first embodiment described here, it is assumed that the device 2 is the transmitter of a message m and the device 3 the recipient of this message. Of course, these roles are interchangeable, and the device 2 can be provided with a module identical to the module 3A of the device 3 for receiving and decrypting an encrypted message via the network NW, as well as device 3 can be provided with modules identical to the modules 2A-2C of device 2 for sending encrypted messages on the NW network.

We will now describe, with reference to FIGS. 4 and 5 respectively, the main steps of a communication method and an intrusion detection method according to the invention as implemented respectively by the security device. RG 6 and by the intrusion detection device MB 5 of the communication system 1 of Figure 1.

With reference to FIG. 4, it is assumed here that during an initialization phase, the security device RG 6 generates, via its key generation module 6A, a pair of encryptographic keys comprising its public key pk (RG) and its key private sk (RG) (step E10). For this purpose, it uses, as mentioned above, the FHE.KEYGEN algorithm of the homomorphic algorithm ALG-FHE, parameterized by the security parameter λ with λ = 128 bits here.

The public key pk (RG) of the security device RG 6 is published (i.e. made public) on the network NW, so as to be known in particular of the intrusion detection device RG 6 and the transmitting device TX 2 (step E20). ) The security device RG 6 then transforms, via its transformation module 6B, each regular expression REGj, j = 1, ..., J relating to one or more signatures SIGi, i = 1, ..., I, in a function describing this expression and that can be evaluated by a homomorphic evaluation function and in particular by the homomorphic evaluation function FHE.HOM of the homomorphic algorithm ALG-FHE (step E30). In the first embodiment described here, the transformation effected by the module 6B consists in transforming each regular expression REGj, j = 1,..., J into an arithmetic circuit CIRC-REGj, j = 1,... . Partransformation of the regular expression REGj, we mean transformation of its structure, that is to say of its algorithmic part strictly speaking, this regular expression being intended to be applied here on ciphered elements. This transformation is intended to allow the comparison of an encrypted character string with the regular expression in question to determine whether a concordance exists, ie whether the encrypted string of characters being examined (ie, observed) coincides with one of the character strings. defined by the regular expression. In the first embodiment described here, the transformation module 6B uses, to transform each regular expression REGj into an arithmetic circuit, a finite state automaton of non-deterministic states or NFA (for Non Finite Automaton) modeling this regular expression as well as a function for selecting the states of this automaton. By way of illustration, FIG. 6 represents such an NFAex automaton for the regular expression "p (a | b)". It is a uni-graph oriented, whose vertices are states and the edges characterize transitions allowing to pass from one state to another.

For example in FIG. 6, the NFAex automaton comprises three distinct states, namely: an initial state q1; - an accepted (or verified) state q2; etl - a rejected (or unverified) state q3.

The transitions from one state to another are shown in Figure 6 in association with the character values controlling these transitions. The NFAex automaton thus makes it possible to compare any string of characters with the regular expression "p (a | b)". Indeed, starting from the initial state ql, if the first character of the string of characters observed is a "p", then a transition to the state q2 ("accepted") of the NFAex automaton is operated. If the character is different from "p" (modeled by p), then a transition to state q3 ("rejected") is made. If the state q2 is reached, then the second character of the string is observed. If it is an "a", the automaton remains in the state q2. Otherwise, a transformation to q3 is performed, and so on for the other characters in the string of characters examined. Thus, starting from the initial state ql, if after examination of all the characters of the character string, the final state obtained is the accepted state q2, then this means that the string of characters observed is well defined by the regular expression "P (a | b)". On the other hand, if the final state obtained is the accepted state q3, it means that the observed regular expression does not meet the definition of the regular expression "p (a | b)". > This automaton is translated as an arithmetic circuit by introducing the following Select selection function:

Select (x, y, z) = x.y + (lx) .z where y, z denote relative integers here, and x takes the values 0 or 1. The select function uninsidefined returns the value "y" if x = l and the value "z" if x = 0. This selection function Selecti is used here to model each transition of the automaton, applying the following convention: x = l - ([ci] - [ci ']) Y = [q2] z = [q3] where i denotes the position of the character observed in the string of characters being examined (i = 1, ..., P if P denotes the number of characters in the string), and ci designates the character associated with the automaton at the transition between the state [qi] and the state [qi + 1]. According to this convention, if the: characters ci and ci 'are identical, then c is 1, and the accepted state q2 is selected, otherwise c is 0 and the rejected state q3 is selected.

By applying this selection function step by step, the transformation module 6Bcan model each test implemented by the automaton from an observed string of characters. Thus, in the example of the NFAex automaton, if we consider an observed string of characters comprising two characters [cl c2] that we wish to compare with the regular expression "p (a | b)", the path in the NFAex automaton can be translated as follows: - for the first character [cl], starting from ql, we go to a state el defined by: el = [l - ([p] - [cl])]. [q2 ] + ([p] - [cl]). [q3] (eql) let el be q2 (accepted state) if [cl] = [p] and q3 (rejected state) otherwise; i - for the second character [c2], two comparisons are made by means of the automaton with respect to the two possible alternatives "a" and "b" defined by the regular expression (ie (a | b)), which translate by the following states e2 and e3 in which [el == q2] equals 1 siel is equal to q2 and 0 otherwise: e2 = [el == q2]. ([l - ([a] - [c2])]. [q2] + ([a] - [c2]). [q3J) (eq2) I is e2 is q2 (accepted state) if [c2] = [a] and q3 (rejected state) otherwise, ete3 = [el = = q2]. ([l - ([b] - [c2])]. [q2] + ([b] - [c2]). [q3]) (eq3) where e3 is q2 (accepted state) if [ c2] = [b] and q3 (rejected state) otherwise. The final state is the accepted state q2 if e2 or e3 is q2. The result RES of the detectionoperation via the automaton can thus be translated into Boolean language in the following form: i RES = [e2 == q2] + [e3 == q2] (eq4).

The function defining the result RES and given by the equation (eq4), in which the states el, e2 and e3 have been replaced by their definitions given to the equations (eql), (eq2) and (eq3), constitutes a function representing the regular expression "p (a | b)" in the form of CIRC circuitry. Such a function can advantageously be evaluated by the evaluation function FHE.HOM of the homomorphic encryption algorithm.

Note that the relatively simple example of the regular expression "p (a | b)" has been enumerated here for illustrative purposes only. The article by S. Fau et al. titled "Towards practical programexecution overfully homomorphic encryption schemes", 2013 Eighth International Conference on P2P, Parallel, Grid, Cloud, and Internet Computing, pages 284-290 introduces other examples based on the Select selection function and allowing various algorithms to be translated into form. arithmetic circuits.

In the first embodiment, the transformation module 6B proceeds in a manner identical to that previously described in the example of the regular expression "p (a | b)" to transform each regular expression REGj, j = 1, ..., J in an arithmetic circuit CIRC-REGj.In other words, it relies on the one hand, on a NFA automaton with a finite number of states not determinemodélisant this regular expression, and on the other hand, on the function previously introduced, and provides an arithmetic circuit CIRC-REGj defining a detection result RESj, j = 1, ..., J. It will be noted that each arithmetic circuit CIRC-REGj is intended to be applied to encrypted elements and that the detection result RESj that it provides is itself an encrypted element.

It should also be noted that the arithmetic circuit CIRC-REGj obtained by the transformation module 6B for each regular expression REGj offers a compact representation of the regular expression REGj, evaluable by the homomorphic evaluation function FHE.HOM. Other representations may however be envisaged alternatively. For example, another function describing the regular expression REGj consisting of enumerating all the possible character strings defined by the regular expression REGj can be envisaged. It is understood, however, that such a representation can become very complex or even inappropriate for certain regular expressions including for example the operator *.

Further, in the embodiment described here, the transformation module 6B determines a separate arithmetic circuit for each regular expression: that is, an arithmetic circuit represents a single regular expression. In another embodiment, it can be envisaged that the transformation module 6B defines a single circuitarithmetic representing all the regular expressions, or several arithmetic circuits each representing one or more regular expressions.

The CIRC-REGj arithmetic circuits are stored here by the transformation module 6B in the non-volatile memory 15 of the safety device RG 6. As previously mentioned, these arithmetic circuits CIRC-REGj, j = 1, ..., J, are intended to to be applied on: ciphered elements and require for this purpose the knowledge of the cipherings of the characteristic signatures SIGi, i = l, ..., I.

Referring again to FIG. 4, the security device RG 6 thus generates for each signature SIGi, i = 1, an encrypted FHE-SIGi of this signature, via its encryption module 6C (step E40). It is noted that steps E30 and E40 can be reversed chronologically or implemented in parallel.

More precisely, in the first embodiment described here, the decryption module 6C encrypts each signature SIGi, i = 1,..., I by applying to it the encryption procedure FHE.ENC of the homomorphic encryption algorithm ALG-FHE, parameterized by the public key of encryption pk (RG) of the security device RG 6.

Then the transmission module 6D of the safety device RG 6 transmits to the intrusion detection device MB 5, via the communication means 16 of the safety device RG 6, the arithmetic circuits CIRC-REGj, j = 1, ..., J, describing the regular expressions REGj, j = l, ..., J as well as the encrypted signatures FHE-SIGi, i = 1,..., I (step E50). It is noted that the lightning signatures SIGi, i = 1, ..., I are kept secret by the security device RG 6 with respect to the intrusion detection device MB 5: only their encrypted forms and the structure of the regular expressions (In the form of arithmetic circuits) are transmitted to the intrusion detection device MB 5. With reference to FIG. 5, the detection device MB 5 stores the arithmetic circuits CIRC-REGj, j = 1,. and the encrypted signatures FHE-SIGi, i = 1,..., I received from the security device RG 6 by its first reception module 5A in its non-volatile memory 10 (step F10).

It is now assumed that the transmitting device TX 2 wishes to transmit a message i to the receiver device RX 3. The message m may consist of one or more data packets. In the following description for the sake of simplification, consider a single data packet consisting of a plurality of characters ml, m2, ..., mL, L describing an integer greater than 1.

In preparation for this exchange, the intrusion detection device MB 5 generates, i in the first embodiment described here, a random number (ie random) xO that it sends via the NW network to the transmitter device TX 2 (step F20 ). In the first embodiment described here, this random number xO is intended to allow the security device RG 6 to check if the transmitter device TX2 is honest, as detailed further later. It is therefore also transmitted to the safety device RG 6.

FIG. 7 illustrates the main steps implemented by the transmitter device TX 2 during its exchange of the message m with the receiver device RX 3.

In preparation for sending the message m, the transmitting device TX 2 generates an encryption key K, which it shares with the receiver device RX 3, for example, via a secure exchange implemented between the two devices (step G10) . This secure exchange may, for example, rely on the standard procedure provided by the SSL / TLS protocols. The secret key K is here ephemeral, in the sense that it is generated for the connection present with the receiver device RX 3.

Then, in the first embodiment described here, following the receipt of the random event xO (step G20), the transmitting device TX 2 generates a content CONT by concatenating the hazard xO with the message m that it wishes to send to receiver device RX 3 (step G30). The content CONT is a content derived from the message m within the meaning of the invention. In another embodiment not using the xO hazard, the CONT content derived from the message m consists of only the message m.

The transmitting device TX 2 then generates, by means of its module 2A, an encryption T of content CONT by applying to it the encryption procedure SYM-ENC of the symmetric decryption algorithm ALG-SYM parameterized by the secret encryption key K (step G40).

The transmitting device TX 2 also generates, in the first embodiment described here, via its module 2B, an encryption S of the secret encryption key K (step G50).

The encryption S is generated by the module 2B by applying to the secret key K the encryption procedure FHE.ENC of the homomorphic encryption algorithm ALG-FHE, parameterized by laclé public encryption pk (RG) of the security device RG 6.

Then, the transmitting device TX 2 by means of its transmission module 2C transmits the difference T of the content CONT and the encryption S of the secret key K to the receiver device RX 3 (step G60).

With reference to FIG. 5 again, the encryption T and the encryption S transmitted by the transmitter device TX 2 to the receiver device RX 3 are intercepted by the intrusion detection module MB 5, and more particularly by its second reception module 5B (step F30). The interception of the encrypted S by the intrusion detection device MB 5 constitutes a step of obtaining the encryption S within the meaning of the invention.

The transmitting device TX 2 also generates, by means of its obtaining module 5C, an encryption T 'of the encryption T by applying to the encryption T the encryption procedure FHE.ENC of the homomorphic encryption algorithm ALG-FHE, parameterized by the public encryption keypk (RG) of the security device RG 6 (step F40). This results in the following relation: T '= FHE.ENC (SYM-ENC ((xO | m), K), pk (RG)).

Then, via its first evaluation module 5D, the intrusion detection device MB 5 evaluates the decryption procedure SYM-DEC of the encryption / decryption algorithm ALG-SYM on the encryption T '(step F50). For this purpose, it uses a description of the decryption procedure SYM-DEC in the form of an arithmetic circuit and the encryption S of the shared secret key K, on which it applies the homomorphic evaluation function FHE.HOM of: the homomorphic encryption algorithm ALG-FHE. It is noted that obtaining a description of the SYM-DEC decryption procedure in the form of an arithmetic circuit or, more generally, a form that can be evaluated by the homomorphic evaluation function FHE.HOM does not pose any difficulty in itself. most of the decryption algorithms are already in this form.

By virtue of the properties of the homomorphic encryption, the first evaluation module 5D obtains, on the one hand, an encryption V of the message m by the encryption procedure FHE.ENCparametered by the public encryption key pk (RG) of the security device RG 6, and on the other hand, an encryption V 'of the hazard xO by the encryption procedure FHE.ENC parameterized by the encryption public key pk (RG) of the security device RG 6, namely: i V = FHE.ENC ( m, pk (RG)) and V '= FHE.ENC (xO, pk (RG))

The intrusion detection device MB 5, via its second evaluation module 5E, then evaluates on the cipher V each regular expression REGj, j = 1, ..., J. It uses for this purpose the description of each regular expression REGj in the form of arithmetic circuit CIRC-REGj and the encrypted FHE-SIGi, i = 1, ..., I of the signatures on which it applies the evaluation functionomorph FHE.HOM of the homomorphic encryption algorithm ALG-FHE (step F60).

Because of the properties of homomorphic encryption, the second evaluation module5E obtains at the end of this evaluation an intermediate encrypted detection result RESj for each regular expression REGj, j = 1, ..., J. Each intermediate detection result RESj is equal to 1 if the cipher V corresponds to the regular expression REGj, and to 0 otherwise.

Thus, a match with a detection rule established by the security editor is detected if at least one of the intermediate results RESj is equal to 1. The second evaluation module evaluates here, from the intermediate results, a detection result. B-number according to the expression:

B = RESl + RES2 + ... + RESJ where "+" here designates the OR Boolean operator, so that the result B is equal to 0 or 1.

Note that in the embodiment described here, each regular expression is described by means of a separate arithmetic circuit. As mentioned above, in another embodiment, it is conceivable to have a single function, that is to say here one single and same arithmetic circuit, describing the set of regular expressions in which case the result of encrypted detection B is directly obtained at the output of the FHE.HOM evaluation function. In another embodiment, several arithmetic circuits are described, each writing one or more regular expressions, the encrypted detection result B then obtained by summing the intermediate results obtained after evaluation of each of these circuits.

The encrypted detection result B also satisfies the following relationship: B = FHE.ENC (det (m), pk (RG)). where det (m) denotes the detection result that would be obtained by applying the expressions: regular REGj directly to the message m.

In the first embodiment described here, the intrusion detection device MB5 transmits via its communication means 11 the encrypted detection result B to the security device RG 6 (step F70). He also transmits the encrypted V '.

With reference to FIG. 4, on receipt of the digits B and V 'by its receiving module 6E (step E60), the security device RG 6 decrypts the encrypted detection result B (step E70). Its decryption module 6F uses for this purpose FHE.DEC decryption procedure of the homomorphic encryption algorithm ALG-FHE parameterized by the private decryption key sk (RG) of the security device RG 6. It thus obtains the result of detectiondet ( m), which it transmits back via its transmission module 6D to the intrusion detection device MB 5 (step E80).

Moreover, in the first embodiment described here, the security device RG 6 also checks the integrity of the random event xO (step E90). For this purpose, it decrypts by means of its decryption module 6F the encrypted V 'by applying to it the decryption procedure FHE.DEC parameterized by the private decryption key sk (RG) of the security device RG 6. The result of this decryption is compared to the value of the hazard xO previously transmitted in step F20 by the intrusion detection device. If the two values coincide (ie are equal), the verification is validated, that is, the transmitting device TX 2 has acted honestly and transmitted the bonalea to the intrusion detection device MB 5. Otherwise, this means that the transmitting device TX 2 is dishonest.

The security device RG 6 can then when discordant values are detected during the verification step E90, inform the intrusion detection device MB 5, and / or an administrator of the network NW.

It should be noted that this verification step, and correlatively the use of the xO hazard by the transmitting device TX 2, by the intrusion detection device MB 5 and by the security device RG 6, are optional. The invention can be implemented by considering a contentCONT consisting solely of the message m.

Referring to Figure 5, on receipt. of the detection result det (m) of the safety device RG 6, the detection module 5F of the intrusion detection device determines whether an intrusion has been made on the NW network (step F90). More specifically, it determines here that there exists an intrusion on the network if det (m) is equal to 1, and deduces the absence of intrusion if det (m) is equal to 0.

In the first embodiment described here, if no intrusion has been detected by the detection module 5F (answer no to the test step F90), the intrusion detection device MB transmits the encryption T of the message m to RX receiver device for decryption. The receiving device RX 3, via its decryption module 3A, can then decrypt the encryption Ten by applying it the decryption procedure SYM-DEC of the symmetric decryption / decryption algorithm ALG-SYM parameterized by its private key of decryption: sk (PG ).

If, on the other hand, an intrusion is detected by the detection module 5F (yes response to the test step F90), different actions can be taken by the intrusion detection device MB 5 according to its configuration (step Fl 10). For example, it can, via its communication means 11, notify the NW network administrator of this detection. Alternatively, or in addition, the intrusion detection device MB 5 can suppress the encrypted message T and not transmit it to the receiver device RX 3, the latter being corrupt, etc. The invention thus makes it possible, through the use of the homomorphic algorithm ALG-FHE, to apply a full IDS depth inspection procedure on the encrypted traffic exchanged between the transmitting device TX 2 and the receiving device RX 3 without that the intrusion detection device MB 5 is aware of the keywords defined by the security device RG 6. The invention thus ensures the confidentiality of the exchanges between the transmitter device TX 2 and the receiver device RX 3 and their privacy, while allowing the detection of intrusions on the network used by these devices.

Note that the first embodiment is an interactive mode in that it is based on an exchange between the intrusion detection device MB 5 and the security device RG 6 for the intrusion detection device MB 5 to access the detected detection result det (m). This interactive mode allows the security device RG 6 not to divulge saclé private decryption sk (RG).

However, alternatively, the invention may be implemented in a noninteractive mode. For this purpose, for example, the private decryption key sk (RG) of the security device RG 6 can be stored in a hardware security module (or HSM for Hardware SecureModule), accessible by the MB 5 intrusion detection device. In known manner, an HSM telmodule is an electronic module considered inviolable offering encryptographic functions, such as cryptographic key storage. Thus, in a variant of the first embodiment, it can be envisaged that the intrusion detection device MB 5 obtains the private key for decryption sk (RG) of the HSM module and then decrypts the encrypted detection result B by means of this private decryption key. in order to obtain the detection result det (m). In another variant, it can be envisaged that it is the module HSM which itself decrypts the code B and in return provides the detection result det (m) of the intrusion detection device MB 5. It is of course also possible to envisage complementing these alternative embodiments by additional mechanisms to protect against dishonest behavior of the intrusion detection device MB (such as for example a verification by the HSM of the coherence of what is decrypted by the intrusion detection device MB 5).

In the first embodiment which has just been described, the secret key K shared between the transmitting device TX 2 and the receiver device RX 3 and used to encrypt the exchanges between these two devices, is encrypted by the transmitter device TX 2 by means of the public keyI encryption of the security device RG 6. As a result, a security device RG 6 can unsuspicious can listen to the exchanges between the transmitter device TX 2 and the receiver device RX3, access the encrypted message T and the encrypted S of the shared key K, decrypt the encrypted S and access the message m in the clear. To overcome this drawback, in a second embodiment of the invention, the secret key K shared between the transmitting device TX 2 and the receiving device RX 3 is no longer encrypted by the transmitting device TX 2 by means of the public key of encryptionpk (RG) of the security device RG 6 but by means of a public encryption key pk (RX) of the RX 3 receiver device, previously published. The second embodiment also relies on a re-encryption procedure of the secret key, as detailed now.

FIG. 8 illustrates the steps implemented by the TX 2 transmitter device in this second embodiment. The steps having the same references as the steps illustrated in FIG. 7 are identical to the steps implemented in the first embodiment.

Thus, with reference to FIG. 8, in preparation for sending the message m, the transmitting device TX 2 generates a secret encryption key K which it shares with the receiver device RX 3 (step G10). Then, following the reception of the random event xO (step G20), it generates the CONT content enconcaténant the xO hazard with the message m he wants to send to the receiver device RX 3 (step G30). The transmitting device TX 2 generates, by means of its module 2A, the encryption T of the contentCONT by applying to it the SYM-ENC encryption procedure of the ALG-SYMsymmetric encryption algorithm parameterized by the secret encryption key K (step G40).

The transmitting device TX 2 also generates, in the second embodiment described here, via its module 2B, an intermediate code S 'of the secret decryption key K (step G50'). The intermediate encryption has been generated in the second embodiment by applying to the secret key K the FHE.ENC encryption procedure of the homomorphic algorithm ALG-FHE, parameterized by the public encryption key pk (RX) of the receiver device RX 3.

Then, the transmitting device TX 2 by means of its transmission module 2C transmits the difference T of the CONT content and the intermediate encryption S 'of the secret key K to the receiver device RX 3 (step G60').

In other words, the method implemented by the transmitter device TX 2 differs in this second embodiment of the method implemented by the transmitting device TX 2 in the first embodiment by the steps G50 'and G60'.

FIG. 9 illustrates the steps implemented by the MB detection device 5 in the second embodiment. The steps bearing the same references as the steps illustrated in FIG. 5 are identical to the steps implemented in the first embodiment. Note that the safety device RG 6 is not affected by the modifications made in the second embodiment so that the steps implemented by the safety device RG 6 in the second embodiment are identical to the steps E10 to E90 shown. in Figure 4 and implemented in the first embodiment.

In particular, the steps E10 to E50 for generating and transmitting the CIRC-REGj arithmetic circuits, j = 1,..., Regular expressions and FHE-SIGi ciphers, i = 1, ..., I dessignatures by the device of FIG. security RG 6 to the intrusion detection device MB 5 identical to those implemented in the first embodiment. It is the same in Figure 10 of steps F10 and F20 implemented by the intrusion detection device MB 5.

The encryption T and the intermediate encryption S 'transmitted by the transmitter device TX 2 to the destination of the receiver device RX 3 are intercepted by the intrusion detection device MB 5, and more particularly by its second reception module 5B (step F30').

On receipt of the intermediate encryption S ', in the second embodiment, the intrusion detection device MB 5 then obtains from the receiver device RX 3 a key rk (RX-> RG) of the receiver device RX 3 to the security device RG 6 (step F31 '). In the second embodiment described here, this re-encryption key rk (RX-> RG) comprises: a first part rk1 equal to the public encryption key pk (RG) of the security deviceRG 6,

A second part rk2 obtained by encrypting a secret decryption key sk (RX) associated with the public encryption key pk (RX) of the receiver device RX 3 by means of the encryption procedure FHE.ENC of the homomorphic encryption algorithm ALG- FHE parameterized by the public encryption key pk (RG) of the security device RG 6, that is:

After obtaining the re-encryption key rk (RX-> RG), the intrusion detection device MB 5 re-encrypts the intermediate encryption S 'of the secret key S by means of the encryption key rk (RX-> RG) and the FHE.ENC encryption procedure of the homomorphic algorithm ALG-FHE (step F32 '). It obtains, via this encrypted encryption step S, from the encrypted shared key K by means of the public encryption key pk (RG) of the security device RG 6, namely:

The notions of key re-encryption and re-encryption of a cipher are known ensoi and are not described in detail here.

The steps F30 ', F31' and F32 'constitute as a whole a step of obtaining an encryption S of the shared key K within the meaning of the invention. The steps subsequently implemented by the intrusion detection device MB 5 and by the security device RG 6 respectively in the second embodiment are identical to the steps F40 to Fl10 and E60 to E90 described previously in the first embodiment. . The same is true of the decryption of the encryption T by the receiver device RX 3. The invention therefore makes it possible, in this second embodiment as in the first embodiment, to allow a full depth inspection procedure to be applied. IDSsec encrypted traffic exchanged between the transmitting device TX 2 and the receiving device RX 3 without the intrusion detection device MB 5 is aware of the keywords defined by the security device RG 6. It also allows to guarantee the confidentiality of the exchanges between the transmitter transmitter device TX 2 and the receiver device RX 3 and their privacy, not only with respect to the intrusion detection device MB 5 but also the security device RG 6.

Claims (11)

A method of detecting intrusions on a network (NW) via which a transmitting device (TX 2) and a receiving device (RX 3) are able to communicate using a symmetric encryption / decryption algorithm parameterized by a secret encrypted key shared between the transmitting device and the receiving device, said detecting method being intended to be implemented by an intrusion detection device (MB 5) and comprising: - a receiving step (F10), coming from a security device (RG 6) having access to at least one rule for detecting at least one intrusion capable of affecting the network, said at least one detection rule comprising at least one regular expression established from at least one characteristic signature of said at least one least an intrusion: o of at least one function (CIRC-REGj) describing said at least one regular expression (REGj) and which can be evaluated by means of a homomorphic evaluation function of a homomorphic encryption algorithm; and o an encryption (FHE-SIGi) of each signature (SIGi) characteristic of said at least one intrusion, obtained by applying an encryption procedure of said homomorphic decryption algorithm parameterized by a public encryption key of the security device; A reception step (F30, F30 ') originating from the device transmitting an encryption T of a content derived from a message intended for the receiving device, this encryption T having been obtained by using an encryption procedure of the algorithm of symmetric encryption / decryption parameterized by said secret encryption key; A step of obtaining (F40, F30, F32 ') an encryption T' of the encryption T and an encryption S of the secret decryption key, said encrypts T 'and S corresponding to the application on the encryption T andon the secret encryption key of the encryption procedure of saidhomomorphic encryption algorithm parameterized by the public encryption key of the security device; A first evaluation step (F50) of a procedure for decrypting the symmetric decryption / decryption algorithm on the encrypted T 'using said homomorphic evaluation function of said homomorphic encryption algorithm and the encryption S of the secret decryption key; , this first evaluation step providing a V-message encryption for the receiving device by the encryption procedure of said homomorphic decryption algorithm parameterized by the public key encryption of the security device; A second evaluation step (F60) of said at least one function describing said at least one regular expression on the encrypted value V of the message using the encryption codes, this second evaluation step providing an encryption of a detection result indicating the existence or not of a said regular expression corresponding to the message; and a step of detecting (F90) an intrusion on the network if the decrypted detection result indicates that there exists at least one said regular expression corresponding to the message. 2. The detection method according to claim 1, wherein the encryption S of the secret decryption key is obtained (F30) from the transmitting device (TX 2). 3. Detection method according to claim 1 wherein the step of obtaining (F30'-F32 ') the encryption S of the secret encryption key comprises: - a reception step (F30'), from the transmitting device an intermediate encryption code S 'of the secret encryption key obtained by using the procedure of decryption of said homomorphic encryption algorithm parameterized by a public decryption key of the receiving device; A step of obtaining (F31 ') a re-encryption key from the receiving device to the security device; and - a step of re-encrypting (F32 ') the intermediate encryption S' using said decryption key, this re-encrypting step providing said encryption S of the secret encryption key. 4. Detection method according to any one of claims 1 to 3 furthermore comprising: a step of transmitting (F70) the encryption of the detection result to the security device for decryption by using a decryption procedure of said homomorphic decryption algorithm parameterized by a private decryption key associated with the public key encryption of the security device; and a step of receiving (F80) the detected detection result from the security device. 5. Detection method according to any one of claims 1 to 3 furthermore comprising: a step of obtaining a decryption private key associated with the public key decryption of the security device and stored in a security hardware module; and a step of decrypting the encryption of the detection result by using the decryption procedure of said homomorphic encryption algorithm parameterized by this private decryption key. 6. Detection method according to any one of claims 1 to 5 whereinat least one function describing at least one regular expression received from the transmitter device is an arithmetic circuit (CIRC-REGj). 7. Detection method according to any one of claims 1 to 6 wherein the CONT item (CONT) derived from the message consists of the message (m) for the receiving device or a concatenation of this message (m) and a random (xO) known from the security device and the intrusion detection device. 8. Detection method according to claim 7, in which the content derived from the message consists of a concatenation of the message (m) and a known hazard (xO) of the security device and the intrusion detection device, and in which the first evaluation step (F50) furthermore provides an encryption V 'of the hazard by the encryption procedure of said homomorphous decryption algorithm parameterized by the public key of encryption of the security device, said detection method further comprising a step transmitting (F70) said encrypted V 'del'aléa to the security device for verification. 9. A method of communicating a security device (RG 6) with an intrusion detection device (MB 5) on a network, said security device having access to at least one detection rule of at least one intrusion capable of allocating the network, said at least one detection rule comprising at least one regular expression established from at least one characteristic sign of said at least one intrusion, said communication method comprising: a transformation step (E30) of said at least one a regular expression (REGj) in a function (CIRC-REGj) describing said at least one regular expression and which can be evaluated by means of a homomorphic evaluation function of a homomorphic encryption algorithm; A generation step (E40) of an encryption (FHE-SIGi) of each signature (SIGi) characteristic of the said at least one intrusion by applying a cryptographic procedure of the homomorphic encryption algorithm parameterized by a public encryption key of the security device; ; and a step of transmitting (E50) said at least one function describing said at least one regular expression and each cipher of each characteristic signature of said at least one intrusion to an intrusion detection device on the network. 10. The communication method as claimed in claim 9, in which, during the transforming step, at least one function describing at least one regular expression is a circuitarithmetic obtained by means of a non-deterministic finite state automaton modeling at least one regular expression and a function for selecting the states of said automaton. The communication method of claim 9 or 10 further comprising: - a receiving step (E60) from the detection device of a cipher of a detection result; A step of decrypting (E70) said encryption of the detection result by using a decryption procedure of said homomorphic encryption algorithm parameterized by a private decryption key associated with the public encryption key of the security device; and a transmission step (E80). ) of the decrypted detection result at the intrusion detection device. Computer program (PROG1, PROG2) comprising instructions for executing steps of the intrusion detection method according to any one of claims 1 to 8 or the communication method according to any one of claims 9 to 11 when said program is executed by a computer. 13. Computer-readable recording medium on which is recorded a computer program comprising instructions for executing the steps of the intrusion detection method according to any one of claims 1 to 8 or the communication method according to the present invention. any one of claims 9 to 11. 14. Intrusion detection device (MB 5) on a network via which are able to communicate a transmitting device (TX 2) and a receiving device (RX 3) using an encryption / decryption algorithm symmetrical parameter set by a secret encryption key shared between the transmitting device and the receiving device, said detection device being intended to be located between the transmitting device and the receiving device and comprising: a first receiving module (5A), able to receive in from a security device having access to at least one detection rule of at least one intruder it is possible to affect the network, said at least one detection rule comprising a regular expression established from at least one signature that is characteristic of said at least one intrusion: at least one function describing said at least one regular expression and that can be evaluated at least one by means of a homomorphic evaluation function of a homomorphic decryption algorithm; and o an encryption of each characteristic signature of said at least one intrusion, obtained by applying an encryption procedure of said homomorphic encryption algorithm parameterized by a public encryption key of the security device; A second reception module (5B), able to receive from the transmitted device a coded T of a content derived from a message intended for the receiving device, this encryption T having been obtained by using an algorithm encryption procedure symmetric decryption / decryption parameterized by said secret encryption key; A module (5C) for obtaining an encryption T 'of encrypted T and an encryption S of the secret encryption key, said encryptions T' and S corresponding to the application on the encryption T and on the decryption key secret of the encryption procedure of said homomorphic encryption algorithm parameterized by the public encryption key of the security device; A first evaluation module (5D) of a procedure for decrypting the symmetric decryption / decryption algorithm on the encrypted device T 'configured to use said homomorphic evaluation function of said homomorphic encryption algorithm and the encryption S of the encryption key; secret, the first evaluation module being further configured to provide an encrypted V of the message intended for the receiving device by the encryption procedure of the homomorphic encryption algorithm parameterized by the public encryption key of the security device; A second evaluation module (5E) configured to evaluate said at least one function writing said at least one regular expression on the encrypted V of the message using the encrypted signatures, this second evaluation module being furthermore configured to provide an encrypted a detection result indicating the existence or not of a said regular expression corresponding to the message; and a detection module (5F) for an intrusion on the activated network if the detected detection result indicates that there exists at least one said regular expression corresponding to the message. 15. Security device (6) having access to at least one detection rule of at least one intrusion capable of affecting a network, said at least one detection rule comprisinga regular expression established from at least one characteristic signature of said at least one intrusion, said security device comprising: - a transformation module (6B), configured to transform said at least one regular expression into a function describing said at least one regular expression and that can be evaluated by means of an evaluation function homomorphic of a homomorphic encryption algorithm; An encryption module (6C) configured to generate an encryption of each signaturecharacteristic of said at least one intrusion by applying an encryption procedure of said homomorphic encryption algorithm parameterized by a public encryption key of the security device; and a transmission module (6D), configured to transmit said at least one function describing said at least one regular expression and each cipher of each signaturecharacteristic of said at least one intrusion to an intrusion detection device on the network. 16. Safety device according to claim 15 further comprising: - a receiving module (6E), adapted to receive from the unenciphered detection device of a detection result; A decryption module (6F), configured to decrypt said encryption of the detection result by using a decryption procedure of said homomorphic encryption algorithm parameterized by a decryption private key associated with the public decryption key of the security device; and a transmission module (6D), configured to transmit the deciphered detection result to the intrusion detection device. 17. System for detecting (4) intrusions on a network via which are able to communicate a transmitting device and a receiving device by using a symmetric decryption / decryption algorithm parameterized by a shared secret encryption key between the transmitting device and the receiving device, said intrusion detection system comprising: - an intrusion detection device (MB 5) according to claim 14; and a safety device (RG 6) according to claim 15 or 16. 18. Communications system (1) comprising: - at least one transmitting device (TX 2) and at least one receiving device (RX 3) able to communicate on a network by using a encryption / decryption algorithm parameterized by a secret encryption key shared between the sending device and the receiving device; and - an intrusion detection system (4) according to claim 17, the intrusion detection device of said detection system being intended to be located between said at least one emitting device and said at least one receiving device.