WO2007003764A2

WO2007003764A2 - Method for controlling the admission of data packets

Info

Publication number: WO2007003764A2
Application number: PCT/FR2006/001516
Authority: WO
Inventors: Thang Vu Duong; Armand Vandenbussche; Eric Barault
Original assignee: France Telecom S.A.
Priority date: 2005-06-30
Filing date: 2006-06-28
Publication date: 2007-01-11
Also published as: WO2007003764A3; FR2888066A1

Abstract

The invention relates to a method and a device for controlling the admission of data packets transferred via at least one telecommunication network, for the protection of telecommunication equipment, characterised in that, for each data packet transferred towards the protected equipment, it is determined (E301) whether the packet belongs to an authorised flow, and, in the event of identification of the packet as pertaining to an authorised flow, a service category associated with the authorised flow is determined, and a decision is taken concerning the transfer of the packet towards the protected equipment, said decision consisting in authorising the transfer of the packet towards the protected equipment or rejecting the packet, according to the service category associated with the authorised flow, the rate of the flow, and the rates of at least part of other flows transferred towards the protected equipment.

Description

Method of controlling the admission of data packets

The present invention relates to a method of admission control of a packet received from one or more telecommunication networks by an admission control device for the protection of at least one telecommunication equipment. The field of application of the present invention is that of the preventive and reactive security vis-à-vis attacks known under the name of denial of service. Denial-of-service denial of service is an attack aimed at rendering inoperative a telecommunication device, such as, for example, a server connected to an IP telecommunication network, by submerging the link connecting the telecommunication device to the telecommunication network or the telecommunication device itself, unnecessary traffic. Generally speaking, denial of service occurs when a person or an organization is deprived of a service that uses resources that they are entitled to expect in normal times. For example, there will be denials of service affecting the e-mail service, access to the Internet, access to shared resources such as web pages, etc.

A conventional admission control system such as a firewall is not suitable for dealing with such attacks. Indeed, a firewall, also called firewall or "Firewall" in English, is a system that protects ¹ A computer intrusion from an IP telecommunications network, such as for example the Internet, or to protect a LAN from attacks from the Internet. A firewall contains a set of predefined rules that allow only those communications that have been explicitly allowed or explicitly forbid sites.

A firewall works on the principle of controlling the admission of packets. It analyzes the headers of each packet exchanged between a protected machine and an external machine. The IP address of the sending machine, the IP address of the receiving machine, the port number associated with a service or an application are thus analyzed. For example, packets that do not correspond to an authorized quadruplet consisting of a source IP address, a source port, a destination IP address, an authorized destination port, are not transferred.

A firewall does not prevent the protected telecommunication device from being overwhelmed by unnecessary traffic when attacks are made using quadruplets allowed by the firewall.

The object of the present invention makes it possible to solve the disadvantages of the prior art and to propose a method of admission control of data packets transferred through at least one telecommunication network, for the protection of at least one piece of equipment. telecommunication, characterized in that, for a data packet transferred to said telecommunication equipment, the method comprises the steps of:

identification of the packet consisting in determining whether the packet belongs to an authorized stream, and in case of identification of the packet as belonging to an authorized stream,

determining a class of service associated with the authorized stream, and

decision making concerning the transfer of the packet to the protected equipment, said decision consisting in authorizing the transfer of the packet to the protected equipment or in rejecting said packet, according to the class of service associated with the authorized flow, the bit rate, this flow and flow rates of at least a portion of other flows transferred to the protected equipment. Correlatively, the invention relates to an admission control device of a received packet, transferred through a telecommunication network to at least one telecommunication equipment, for the protection of the or each telecommunication equipment, characterized in that the admission control device comprises:

means for identifying the packet, arranged to determine whether the received packet belongs to an authorized flow, means for determining the class of service associated with the authorized stream to which the packet belongs,

decision-making means concerning the transfer of the packet to the protected equipment, arranged for, in the case where the packet belongs to an authorized flow, determining whether the transfer of said packet to the protected equipment must be authorized or if the packet shall be rejected, depending on the class of service associated with the stream to which the packet belongs and the bit rates of at least some of the other flows transferred to the protected equipment.

Thus, telecommunication equipment is protected by denial of service attacks. By making the decision to transfer only packets to the telecommunication equipment when the packets received belong to authorized flows and according to the class of service associated respectively with these authorized flows, the flow rate and the flow rates at least a part of the other flows transferred to the telecommunication equipment, the telecommunication equipment is not saturated. - • In addition, by associating flows with different classes of service, the processing of the packet can be adapted to the class of the stream.

According to another aspect of the invention, the identification of the packet consists in determining whether the packet belongs to a stream of one of the two stream categories respectively comprising admitted current flows and flows that may be admitted.

Thus, admission control can be performed differently, for example more quickly, when packets belonging to the stream have already been received.

According to another aspect of the invention, for a stream that may be admitted or for an admitted current stream, at least one of the information identifying said stream, information representative of a class of service associated with said stream, information representative of a theoretical flow rate of said flow and an admission rule associated with said flow that can be modified as a function of the flow rate of said flow and flow rates of at least a portion of other flows transferred to the flow equipment. telecommunication and packet transfer is performed according to the admission rule associated with the stream to which the packet belongs.

Thus, by modifying the admission rules according to the instantaneous bit rates of at least a portion of the other streams transferred to the telecommunication equipment, the telecommunication equipment is not saturated and is protected from denial-type attacks. service.

According to another aspect of the invention, when a packet belongs to a stream whose associated class of service is of maximum priority, at least one of the following checks is carried out: - check whether the sum of the instantaneous bit rates of all the flows transferred to the protected equipment is less than a predetermined threshold associated with the streams of maximum priority, and transfer the packet in the affirmative,

- Check if the instantaneous flow rate of the stream to which the packet belongs is less than a theoretical flow of said flow and transfer the packet in the affirmative or reject the packet in the negative.

According to another aspect of the invention, when a packet belongs to a stream whose associated class of service is of minimum priority, it is checked whether the sum of the instantaneous bit rates of all the flows transferred to the telecommunication equipment is below a predetermined minimum threshold, associated with the minimum priority streams, it is decided to transfer the packet in the affirmative, and it is decided to reject the said packet in the negative.

According to another aspect of the invention, when a packet belongs to a stream whose associated service class is of intermediate priority, it is checked whether the sum of the instantaneous bit rates of all the flows transferred to the telecommunication equipment is less than a predetermined threshold associated with the intermediate priority flows, the packet is transferred in the affirmative, it is checked in the negative, if the instantaneous flow rate of the flow to which the packet belongs is lower than the theoretical flow rate of said flow, the received packet is rejected. in the negative, and if so, modifying the admission rule associated with the stream to which the packet belongs to reject new packets belonging to said stream and rejecting said packet.

Thus, by associating flows with different service classes, the processing of the packet can be performed in different ways adapted to the class of the stream.

According to another aspect of the invention, if at least one admission rule associated with a stream is modified to reject new packets belonging to the stream, one checks if the sum of snapshots of all transferred flow rates ^{* 'to} the protected equipment is below a predetermined threshold and, if so, it is checked whether the date and / or time change of the rule admission is old and if so, resetting the admission rule associated with the stream to which said packet belongs to allow the transfer of new packets belonging to the stream.

Thus, the modification of an admission rule of a stream is performed temporarily.

According to another aspect of the invention, if at least one admission rule associated with a stream is modified to reject new packets belonging to the stream, it is checked whether the sum of the instantaneous flows of all the streams transferred to the stream. protected equipment is below a predetermined threshold and, if so, resetting the admission rule associated with each stream whose rule has been previously modified to allow the transfer of new packets belonging to each of said streams.

Thus, the modification of an admission rule of a stream is performed temporarily. When the sum of the flow rates of the flows transferred to the telecommunication equipment falls below a predetermined threshold, the transfer of packets belonging to flows whose admission rules have been modified then becomes possible.

The invention also relates to the computer program stored on a support * = information, said program comprising instructions for implementing the method described above, when it is loaded and executed by a computer system.

The characteristics of the invention mentioned above, as well as others, will appear more clearly on reading the following description of an exemplary embodiment, said description being made in connection with the attached drawings, among which: FIG. . 1 represents a telecommunication system in which the present invention is implemented; FIG. 2 is a block diagram of an admission control device according to the present invention; Figs. 3a, 3b, 3c, 3d and 3e represent the admission control algorithm according to the present invention; FIG. 4 represents a first algorithm for updating the admission rules table when at least one rule is modified so as not to authorize the transfer of packets belonging to a flow to ^'1 protected telecommunication equipment; FIG. 5 represents a second algorithm for taking advantage of the admission rule table when at least one rule is modified so as not to allow the transfer of packets belonging to at least one stream to the protected telecommunication equipment.

Fig. 1 represents a telecommunication system in which the present invention is implemented. In the telecommunication system of FIG. 1, a plurality of telecommunication devices 12a, 12b, 12c are respectively connected to telecommunication networks 15a, 15b and 15c. Telecommunication devices 12 are for example computers, personal assistants or even mobile phones. The telecommunication networks 15a, 15b and 15c are, for example, networks based on the Internet protocol (IP) such as the Internet network belonging to different telecommunication operators or ATM (Asynchronous Transfer Mode) networks.

In a variant, the communication networks 15a, 15b and 15c form a single telecommunication network. An admission control device 100 is connected to the telecommunication networks 15. According to the present invention, the admission control device 100 protects at least one telecommunication equipment 17 from any denial of service attacks carried out by the telecommunication networks. telecommunication devices connected to telecommunication networks 15. Telecommunication equipment 17 means telecommunication equipment such as a local area network or part of a telecommunications network, or a web server or personal computer or part of the network. telecommunication 15 that one wishes to protect.

The telecommunication devices 12 transmit data streams in the form of packets to the telecommunication equipment 17 on the telecommunication networks. According to the invention, a stream is a set of packets transiting in the telecommunication network 15 comprising at least one information identifying the same source and at least one information identifying the same destination. For example, and without limitation, a flow is a set of packets transiting in the telecommunication network 15 which has the same source IP address, the same destination IP address, the same source port identifier and the same destination port identifier.

According to the invention, the admission control device 100 authorizes the transfer of a packet to the telecommunication equipment 17 protected only when the packet received from a telecommunications network 15a, 15b or 15c belongs to a stream authorized and to a service class associated with this authorized stream to which the packet belongs, the flow rate and the bit rates of at least some of the other flows transferred to the telecommunication equipment. is not allowed to be transferred to telecommunication equipment 17, it is rejected. Here we mean by rejection, a treatment consisting in prohibiting its transfer to the protected equipment such as, for example, the deletion thereof, a marking thereof or a storage thereof.

The admission control device 100 also verifies whether the received packet is syntactically and semantically authorized, i.e. the admission control device checks whether the packet size is correct and if the package fits well in the data stream.

For this, each stream sent by a telecommunication device 12 must first be registered with the admission control device 100. More specifically, for each flow authorized by the admission control device 100, a class of service and possibly flows are associated with this flow and recorded with the admission control device.

The administrator of the admission control device 100 records and updates the information identifying the source and destination of each stream that may be authorized to be transferred to the telecommunication equipment 17 as well as the class of service, or even the flow associated with it. The flow rate that is associated with a flow is for example an instantaneous flow rate.

Fig. 2 shows a block diagram of an admission control device according to the present invention. The admission control device 100 consists of a flow filtering unit 110 and a flow admission control unit 120. The admission control device 100 comprises means for deciding whether a package should whether or not transferred to telecommunication equipment 17. Admission control device 100 also comprises means for transferring or not a packet to the telecommunication equipment 17.

The stream filtering unit 110 comprises a network interface 111, a filtering module 112, an admission control rules table 114 and an admitted flows table 116.

The function of the flow filtering unit 110 is to accept or not the transfer of packets from the telecommunication network or networks 15 to the flow admission control unit 120 as a function of at least one identifier of the stream transmitter of the packet and at least one identifier of the recipient of the packet and an admission control rule associated with the stream to which the packet belongs.

The network interface 111 comprises a routing module which receives, from at least one telecommunications network 15a, 15b 15c, the different packets of the streams coming from the telecommunication devices 12 and transfers the packets received to the filtering module 112. L The network interface 111 receives, via the admission control unit 120 and the filter module 112, packets from the telecommunications equipment 17 and transfers them to the telecommunication network 15 to which it is connected. connected the telecommunication device 12 whose destination IP address is included in the header of the packets.

The filtering module 112 determines, for each packet received from the telecommunications network 15, whether the latter must be transferred or not to the flow admission control unit 120. For this, the filtering module 112 interrogates the table admitted flows 116 or admission rules table 114, determines the flow to which each received packet belongs and transfers or not, the received packet to the admission control unit 120 according to the information included in the tables 114 or 116 and associated with the stream to which the packet belongs.

The admission rules table 114 includes information associated with each flow that may be admitted and transferred to the telecommunication equipment 17. The admission rules table 114 is created and maintained by the controller of the control device 100 and is updated by the filter module 112 according to the present invention. The admission rules table 114 includes, for each stream that may be transferred to the telecommunication equipment 17, information identifying the stream such as, for example, the IP address of the source of the stream, the IP address of the destination of the stream, the identifier of the source port of the stream and the identifier of the destination port of the stream. Table admission rules 114 also includes, for each flow 'likely to be transferred to the telecommunications equipment 17, a rule authorizing or not the transfer of the stream to the telecommunication equipment 17. The rules authorizing or not the transfer the flow to the telecommunication equipment 17 are modified by the filtering module 112 at the request of the flow admission control unit 120 and under certain conditions, as will be explained hereinafter with reference to FIG. 3. The admission rules table 114 also includes, for each flow likely to be admitted and transferred to the telecommunications equipment 17, information representative of the class of service associated with each stream. The admission rules table 114 also includes, for some of the flows that may be authorized, an authorized bit rate. The authorized flow rate is preferably a peak flow. In a variant, the authorized flow rate is an average flow rate. Indeed, different classes of service are associated with the flows likely to be admitted. These classes of service are for example defined or updated by the administrator of the admission control device 100. For example, and without limitation, the administrator of the admission control device 100 assigns each flow a class of service among three different classes of service: a first class of service called priority or maximum priority with a maximum authorized rate threshold, a second class of intermediate priority service with an associated peak rate, a third class of service minimum or minimum priority without associated peak flow. Of course, a much larger number of classes of service can be defined.

The admitted flow table 116 includes information identifying each flow admitted by the filtering module 112. Each admitted stream is at least identified by a source IP address, a destination IP address, a source port identifier and a port identifier of destination.

The admitted flow table 116 is updated by the filtering module 112 when it accepts a packet of a stream, when the stream is interrupted or considered interrupted, or when the flow admission control unit 120 notifies the filtering module 112 the rejection of a packet of a stream authorized by the filtering module 112. A counter is associated with the information identifying each stream included in the admitted flow table 116. The value of this counter is incremented by the internal clock (not shown in Fig. 2) of the admission control device 100. The value of the counter associated with a flow is set to zero when transferring each packet belonging to said flow and, when is equal to a threshold predetermined, the information identifying the flow corresponding to the counter are removed from the admitted flow table 116 by the filtering module 112.

The admitted flow table 116 allows the filtering module 112 to quickly check whether a packet can be transferred to the flow admission control unit 120 without having to consult the admission rules table 114.

The flow admission control unit 120 comprises an intake module 122, a current flow table 124 and a table of the theoretical characteristics 126 of the flows that can be transferred to the telecommunication equipment 17.

The function of the admission module 122 is to calculate the flow rate of the different flows transferred to the protected telecommunication equipment 17 and to check whether these flows satisfy the conditions defined in the current flow table 124 and the theoretical characteristics table 126 The admission module 122 notifies the filtering module 112 of the updates to be made on the admitted flow table 116 and on the admission rules table 114. The admission module 122 transfers each packet received from the admission module. filtering 112 whose flow to which it belongs satisfies the conditions of tables 124 and 126.

The current flow table 124 comprises, for each current flow, that is to say for each flow identified in the admitted flow table 116, the IP address of the source of the flow, the IP address of the destination of the stream, the identifier of the source port of the stream and the identifier of the destination port of the stream. The current flow table 124 includes, for each current flow, the rate calculated by the admission module 122. A rate is calculated by counting the number of packets transmitted for a predetermined duration. Preferably, and in a nonlimiting manner, the calculated flow rate is an instantaneous flow rate. The table of the theoretical characteristics of the streams 126 stores, for each flow likely to be transferred on the protected network 17, the theoretical characteristics such as the class of service of the stream, the theoretical peak flow allowed for the stream.

The table of the theoretical characteristics of the streams 126 also stores the different thresholds used by the present invention, the maximum threshold Smax of the rate that can be transferred to the telecommunication equipment 17, the maximum threshold Spriomax associated with the streams of maximum priority, the intermediate threshold

Sprioint associated with intermediate priority flows and the associated minimal Spriomin threshold minimum priority flows. The table of the theoretical characteristics of stream 126 also stores a threshold denoted SRST.

It should be noted here that the threshold Smax is greater than the threshold Spriomax; the Spriomax threshold is greater than the Sprioint threshold; the Sprioint threshold is greater than the Sprimin threshold and the Spriomin threshold is greater than the SRST threshold.

It should be noted here that the admission control device is alternatively distributed in two separate devices interconnected by a dedicated link or a telecommunications network. According to this variant, a first device comprises the flow filtering unit 110 and a second device comprises the flow admission control unit 120. The flow control unit 120 receives packets from one or more units filtering 110 and the information that will be explained later and decides whether the admission rules must be changed for the flow corresponding to each packet received.

The flow control unit 120, in another embodiment, notifies the decision it takes for each packet and notifies it to a remote device that transfers the packet or rejects it depending on the decision of the unit of the packet. flow control 120.

Figs. 3a, 3b, 3c, 3d and 3e represent the admission control algorithm according to the present invention. The algorithm of FIG. 3a represents the steps of a process executed by the filtering module 112, while the algorithm of Figs. 3b-3e represents the steps of a process executed by the admission module 122.

In an alternative embodiment, the steps of the processes shown in FIG. 3 to 3 are grouped together to form a single process. According to another variant, when the admission control device 100 is implemented in a computing device such as for example a computer, the present algorithm is executed by the processor of the computing device.

In step E300 of FIG. 3a, a packet from the telecommunication network 15 is received by the network interface 111 and is transferred to the filtering module 112. In the next step E301, the filtering module 112 checks whether the received packet belongs to a stream for which packages have already been admitted. For this, the filtering module 112 checks whether the received packet is the first packet of a stream, for example, a packet of SYN type that conforms to the TCP protocol or reads, in the received packet, the source IP address, the destination IP address, the source port identifier, and the destination port identifier and verifies whether these addresses and these identifiers correspond to a set of information identifying a flow in the admitted flow table 116. TCP is the acronym for "Transmission Control Protocol" or in French Control Protocol Transmission. If there is no set of information identifying a stream in the admitted flow table 116 corresponding to the read addresses and identifiers or if it is a first packet of a stream, the filtering module 112 proceeds to step E306.

If there is a set of information identifying a stream in the flow table 116 corresponding to the read addresses and identifiers, the filtering module 112 proceeds to step E302.

In step E302, the filtering module 112 checks whether the received packet is representative of an end of flow. This is for example performed, if the packet is compliant with the TCP protocol, checking if the received packet is a packet type FIN or RST. If the received packet is representative of a flow end, the filtering module 112 proceeds to step E303 and modifies the admitted flow table 116 by removing from it the set of information identifying the flow to which the packet belongs in the flow table 116.

In the next step E304, the filtering module 112 transfers the packet to the admission module 122 and returns to the step E300 previously described. The admission module 122 transfers the packet to the telecommunication equipment 17 and deletes the data associated with the stream to which the packet belongs from the current stream table 124.

If the received packet is not representative of a flow end, the filtering module 112 goes from step E302 to step E305 and transfers at this step the packet received to the admission module 122. This operation carried out , the filtering module 112 returns to step E300.

In step E306, the filtering module 112 queries the admission rules table to check whether the read addresses and identifiers correspond to a set of information identifying a flow in the admission rules table 114 and to obtain the admission rule associated with the corresponding flow. If no set of information identifying a stream matches the read addresses and identifiers, or if the admission rule does not allow the flow transfer, the filtering module 112 proceeds to step E307. If a set of information identifying a stream corresponds to the read addresses and identifiers and if the admission rule allows the transfer of flows, the filtering module 112 proceeds to step E308.

In step E307, the filtering module 112 decides to reject the packet, rejects and erases the received packet and returns to step E300 previously described. In step E308, the filtering module 112 modifies the admitted flow table 116 by adding thereto the set of information identifying the flow to which the packet belongs.

In the next step E309, the filtering module 112 transfers the set of information identifying this stream obtained in step E309 to the current flow table 124.

Once this is done, the filtering module 112 transfers the packet received to the admission module 122 to the step E310. This operation carried out, the filtering module 112 returns to the step E300 waiting for a new packet to be processed.

In step E311 of FIG. 3b, a packet from the filter module 112 is received by the admission module 122.

In step E312, the admission module 122 determines the state of congestion of the telecommunication equipment 17.

It should be noted here that in parallel to the execution of this algorithm, the intake module 122 calculates for each stream being included in the table - ^'current stream 124, the instantaneous flow rate of each stream transmitted to telecommunication equipment 17 and stores each instantaneous flow calculated in the current flow table 124.

The admission module 122 determines the state of congestion of the telecommunication equipment 17 by calculating the sum of the instantaneous flows of the flows transferred to the telecommunication equipment 17.

In the next step E313, the admission module 122 checks whether the sum of the instantaneous flows of the flows transferred to the telecommunication equipment 17 is greater than or equal to a predetermined threshold called Smax.

If so, the intake module 122 proceeds to step E314. At this stage, the admission module 122 decides to reject the packet being processed and rejects it. The admission module modifies the current flow table 124 and returns to step E311 waiting for a new packet to be processed. If the sum of the instantaneous bit rates of the flows transferred to the telecommunication equipment 17 is less than the predetermined threshold Smax, the admission module 122 proceeds to the step E315.

In step E315, the admission module 122 determines the class of service denoted Cos associated with the stream to which the packet being processed belongs. For this, the admission module 122 queries the theoretical characteristics table 126 which, in return, transfers the class of service associated with the stream to which the packet belongs.

In the next step E316, the admission module 122 checks whether the associated class is a maximum priority class. If so, the admission module 122 proceeds to step E320 of the algorithm shown in FIG. 3c. If not, the intake module 122 proceeds to step E317.

In the next step E317, the admission module 122 checks whether the associated class is a minimum priority class. If so, the admission module 122 proceeds to step E330 of the algorithm shown in FIG. 3d. If not, the admission module 122 proceeds to step E340 of the algorithm shown in FIG. 3rd.

In step E320 of FIG. 3c, the admission module 122 checks whether the sum of the instantaneous flows of the flows transferred to the telecommunication equipment 17 is less than the maximum threshold authorized for the Spriomax maximum priority streams. If so, the admission module 122 proceeds to step E321 and makes the decision to transfer the packet being processed to the telecommunication equipment 17 and / or proceeds with the transfer thereof. Once this is done, the admission module 122 returns to step E311 waiting for a new packet to be processed.

If the sum of the instantaneous bit rates of the flows transferred to the telecommunication equipment 17 is greater than or equal to the maximum threshold associated with the Spriomax maximum priority flows, the admission module 122 proceeds to the step E322.

In step E322, the admission module 122 checks whether the instantaneous flow rate of the stream to which the packet being processed belongs is less than the theoretical flow rate of the stream to which the packet being processed belongs. For this, the admission module 122 interrogates the tables 124 and 126. If so, the admission module 122 goes to the step E323 and makes the decision to transfer the packet being processed to the equipment of telecommunication 17 and / or proceeds with the transfer thereof. Once this is done, the admission module 122 returns to step E311 waiting for a new packet to be processed. If the instantaneous flow rate of the stream to which the packet being processed belongs is greater than or equal to the theoretical flow rate of the stream to which the packet being processed belongs, the admission module 122 proceeds to step E324 and decides to reject the packet. In progress. When the packet is rejected, the admission module 122 returns to the step E311 waiting for a new packet to be processed.

According to an alternative embodiment, the admission module 122 transfers to the step E324 a message to the filtering module 112 inviting to modify the table of the admission rules 114 so that the filtering module 112 modifies the rule allowing or not the transfer of the stream to which the packet belongs to the telecommunication equipment 17. The filtering module 112 puts the admission rule in a state which does not allow the transfer of the stream to the telecommunication equipment 17 Preferably, the filtering module 112 timestamps the rule which does not authorize the transfer of the stream to the telecommunication equipment 17. The filtering module 112 modifies the admitted flow table 116 by removing from it the information identifying the stream to which the package belongs.

In step E340 of FIG. 3e, the admission module 122 checks whether the sum of the instantaneous flows of the different flows transferred to the telecommunication equipment 17 is less than the intermediate threshold associated with the intermediate priority flows noted Sprioint. If so, the intake module 122 changes to ' ^! step E341 and makes the decision to transfer the packet being processed to the telecommunication equipment 17 and / or proceeds with the transfer thereof. Once this is done, the admission module 122 returns to step E311 waiting for a new packet to be processed.

If the sum of the instantaneous bit rates of the flows transferred to the telecommunication equipment 17 is greater than or equal to the intermediate threshold associated with the intermediate priority flows noted Sprioint, the admission module 122 proceeds to the step E342.

In step E342, the admission module 122 checks whether the instantaneous flow rate of the stream to which the packet being processed belongs is less than the theoretical flow rate of the stream to which the packet in process which is stored in the characteristics table belongs. theoretical flows 126 likely to be transferred to the telecommunication equipment 17. If so, the admission module 122 goes to the step E343, decides the rejection of the packet being processed and proceeds to the rejection of it. Once this is done, the admission module 122 returns to step E311 waiting for a new packet to be processed.

If the instantaneous flow rate of the stream to which the packet being processed belongs is greater than or equal to the theoretical flow rate of the stream to which the packet being processed belongs, the admission module 122 proceeds to step E344 and transfers a message to the module filter 112 invites to modify the table of admission rules 114 so that the filtering module 112 modifies the rule allowing or not the transfer of the stream to which the packet belongs to the telecommunication equipment 17. The module In a particular embodiment, the filtering module 112 timestamps this rule with the date and the time. of the rule change. The filtering module 112 also modifies the admitted flow table 116 by removing from it the information associated with the flow to which the packet belongs so that when new packets belonging to the stream are received, they will be rejected.

In the next step E345, the admission module 122 decides to reject the packet being processed and proceeds to reject it. Once this is done, the admission module 122 returns to step E311 waiting for a new packet to be processed. _'• At the step E330 of FIG. 3d, the admission module 122 checks whether the sum of the instantaneous flows of the flows transferred to the telecommunication equipment 17 is less than the minimum threshold associated with the Spriomin minimum priority flows. If so, the admission module 122 goes to the step E331, makes the decision to transfer the packet being processed to the telecommunication equipment 17 and / or proceeds with the transfer thereof. Once this is done, the admission module 122 returns to step E311 waiting for a new packet to be processed.

If the sum of the instantaneous bit rates of the flows transferred to the telecommunication equipment 17 is greater than or equal to the minimum threshold associated with the Spriomin minimum priority flows, the admission module 122 proceeds to the step E332. In the next step E332, the admission module 122 decides and rejects the packet being processed. Once this is done, the admission module 122 returns to step E311 waiting for a new packet to be processed. Fig. 4 represents a first algorithm for updating the admission rule table when at least one rule is modified so as not to allow the transfer of packets belonging to a stream to the telecommunication equipment.

The filtering module 112 executes the present algorithm in parallel with the various steps of the algorithm previously described in FIG. 3.

The step E400 is a waiting loop for the modification of at least one rule of the admission table 114 so as not to allow the transfer of packets belonging to at least one stream to the telecommunication equipment 17.

When an admission rule has been modified so as not to allow the transfer of at least one stream to the telecommunications equipment 17, the filtering module 112 proceeds to the next step E401.

At this step, the filtering module 112 obtains from the admission module 122 the sum of the bit rates of the different flows transferred to the telecommunication equipment 17. At the next step E402, the filtering module 112 determines whether the sum obtained at step E401 is greater than or equal to a predetermined threshold called SRST. If not, the admission module 122 returns to step E401.

If the sum obtained in step E401 is less than the threshold SRST, the filtering module 112 proceeds to step E403. If the sum obtained in step E401 is greater than or equal to the threshold SRST, the filtering module 112 returns to step E401.

In step E403, the filtering module 112 reads in the admission rules table 1-14 each admission rule that has been modified so as not to allow the transfer of packets belonging to at least one stream to the packet. telecommunication equipment 17 as well as their time stamp. In the next step E404, the filtering module 112 considers the first of the admission rules obtained previously.

In the next step E405, the filtering module 112 checks whether the timestamp associated with the rule being processed is considered old. A timestamp is considered old if the difference between the current time and date with the rule's timestamp is greater than a predetermined threshold.

If not, the filtering module 112 proceeds to step E407. If so, the intake module 122 proceeds to step E406.

In step E406, the filtering module 112 modifies the admission rule table 114 so that the rule being processed is reset. in the state where it was before the change, thus allowing the transfer of packets belonging to the flows associated with the modified rules. The filtering module 112 deletes the time stamp associated with the rule. Once this has been done, the filtering module 112 proceeds to the next step E407. In step E405, the filtering module 112 checks whether all the rules obtained in step E403 have been considered. If all the rules have been processed, the filtering module 112 returns to step E400.

If all the rules have not been considered, the filtering module 112 proceeds to step E408, considers the next rule and returns to step E405. As long as all the rules have not been considered, the filtering module 112 repeats the loop consisting of steps E405 to E408.

Fig. 5 represents a second algorithm for updating the admission rule table when at least one rule is modified so as not to allow the transfer of packets belonging to at least one stream to the telecommunication equipment.

The step E500 is a waiting loop for the modification of at least one rule of the admission table 114 so as not to allow the transfer of packets belonging to at least one stream to the telecommunication equipment 17.

When an admission rule has been modified so as not to authorize the transfer of at least one stream to the telecommunication equipment 17, the filtering module 112 proceeds to the next step E501.

At this stage, the filtering module 112 obtains from the admission module 122 the sum of the bit rates of the different flows transferred to the telecommunication equipment 17.

In the next step E503, the filtering module 112 determines whether the sum obtained in step E501 is greater than or equal to a predetermined threshold called SRST. If not, the admission module 122 returns to step E501. If the sum obtained in step E503 is less than the threshold SRST, the filtering module 112 proceeds to step E504. At this step, the filtering module 112 modifies the admission rules table 114 so that each rule that has been modified is reset in the state where it was before the modification, thus allowing the transfer of the packets belonging to the streams. associated with the changed rules. If the sum obtained in step E503 is greater than or equal to the threshold SRST, the filtering module 112 returns to step E501.

The steps of the method described above are performed by a computer device, in this case the admission control device 100, under the control of software instructions. Therefore, the invention also relates to a computer program for an admission control device comprising software instructions for executing the method previously described by the admission control device. The computer program can be stored in or transmitted by a data carrier. This may be a hardware storage medium, for example a CD-ROM, a magnetic diskette or a hard disk, or a transmissible medium such as an electrical signal, optical or radio. The invention also relates to the data medium comprising the program.

Of course, the present invention is not limited to the embodiments described herein, but encompasses, on the contrary, any variant within the scope of those skilled in the art.

Claims

1) Method for controlling the admission of data packets transferred through at least one telecommunication network, for the protection of at least one telecommunication equipment, characterized in that, for a data packet transferred to said equipment of telecommunication, the method comprises the steps of:

- identification of the packet (E301) of determining whether the packet belongs to an authorized stream, and

- in case of identification of the packet as belonging to an authorized flow, - determination (E316, E317) of a class of service associated with the authorized flow, and

- making a decision concerning the transfer of the packet to the protected equipment (E321, E325, E327, E331, E341), said decision consisting of authorizing the transfer of the packet to the protected equipment or rejecting said packet, according to the class of service associated with the authorized stream, the rate of this stream and the bit rates of at least a portion of other streams transferred to the protected equipment.

2) Method according to claim 1, characterized in that the step of identifying (E301) the packet consists in determining whether the packet belongs to a stream of one of the two categories of flows respectively comprising admitted flows and flows likely to be admitted.

3) Method according to claim 2, characterized in that, for a flow that may be admitted or for a current flow admitted, at least are stored information identifying said flow, information representative of a class of service associated with said auditory flow, information representative of a theoretical flow of said flow and an admission rule associated with said flow can be modified according to the flow rate of said flow and flow rates of at least a portion of other flows transferred to the telecommunication equipment and in that the packet transfer is performed according to the admission rule associated with the stream to which the packet belongs. 4) Method according to claim 3, characterized in that, when a packet belongs to a stream whose associated class of service is of highest priority, the method comprises at least one of the following steps consisting in: - checking (E320 ) if the sum of the instantaneous bit rates of all flows transferred to the protected equipment is less than a predetermined threshold associated with the maximum priority flows and, if so, to transfer the packet (E321),

- checking (E322) whether the instantaneous flow rate of the stream to which the packet belongs is less than a theoretical flow rate of said flow and transferring the packet (E323) in the affirmative or rejecting the packet in the negative (E324).

5) Method according to claim 4, characterized in that, when a packet belongs to a stream whose associated class of service is of minimum priority, the method comprises the following steps: - checking (E330) whether the sum of the instantaneous bit rates of all flows transferred to the telecommunication equipment is less than a predetermined minimum threshold, associated with the minimum priority streams, and decide to transfer the packet (E331) in the affirmative, and decide to reject said packet (E332) in the negative.

_"6) The method of claim 5, characterized in that, when a packet belongs to a flow whose associated service class is of intermediate priority, the method comprises the following steps:

checking (E340) whether the sum of the instantaneous bit rates of all the flows transferred to the telecommunication equipment is less than a predetermined threshold associated with the intermediate priority flows,

- to transfer the packet (E341) in a flash,

in the negative, verify (E342) whether the instantaneous flow rate of the flow to which the packet belongs is lower than the theoretical flow rate of said flow, and

- if not, reject the received packet (E343), - if yes, modify (E344) the admission rule associated with the stream to which the packet belongs to reject new packets belonging to said stream, and reject (E345) said package. 7) A method according to claim 5 or 6, characterized in that if at least one admission rule associated with a stream is modified to reject new packets belonging to the stream, the method comprises the following successive steps of: - checking ( E402) if the sum of the instantaneous flows of all flows transferred to the protected equipment is less than a predetermined threshold and, in the affirmative P,

- check (E405) whether the admission rule modification date and / or time is old and, if so, reset (E406) the admission rule associated with the stream to which said packet belongs to allow the transfer of new packets belonging to the stream.

8) Method according to claim 5 or 6, characterized in that if at least one admission rule associated with a stream is modified to reject new packets belonging to the stream, the method comprises the following successive steps consisting of:

- checking (E5O3) whether the sum of the instantaneous flows of all flows transferred to the protected equipment is less than a predetermined threshold and, if so,

- reset (E504) the admission rule associated with each stream whose rule has been modified beforehand to allow the transfer of new packets belonging to each of said streams.

9) Admission control device of a received packet, transferred through a telecommunication network to at least one telecommunication equipment, for the protection of the or each telecommunication equipment, characterized in that the device for admission control comprises: - packet identification means (112, 114, 116), arranged to determine whether the received packet belongs to an authorized flow,

means for determining the class of service (114, 124) associated with the authorized stream to which the packet belongs, decision-making means (112, 122) concerning the transfer of the packet to the protected equipment, arranged for, in the case where the packet belongs to an authorized flow, determining whether the transfer of said packet to the protected equipment must be authorized or if the packet is to be rejected, depending on the class of service associated with the stream to which the packet belongs and the bit rates of at least some of the other flows transferred to the protected equipment.

10) computer program for an admission control device, said program comprising instructions for controlling the execution of the method according to any one of claims 1 to 8 by the admission control device, when it is charged and executed by it.

11) Data carrier comprising the computer program according to claim 10.