GENERAL TECHNICAL FIELD
The invention relates to a secure interconnection device enabling bidirectional
communication between two communication networks; a first high–security network
and a second network whereof the security is lower than that of the first network. Su5 ch
a device can be used especially in an ETHERNET network, a network in which
ETHERNET frames transit.
PRIOR ART
10 Figure 1 illustrates general architecture of a system comprising an interconnection
device 10 for connecting a first network 11 to a second network 12. The two networks
11, 12 have different levels of security.
Network means an actual communication network and the set of connected
devices which can communicate with each other.
15 Level of security means a set of operating rules and constraints imposed on the
network to ensure that only authorized data stream can transit over this network.
When networks having different levels of security communicate with each other,
it is necessary to ensure that the high–security network cannot be corrupted by attacks
or erratic operations coming from the low–security network.
20 In some contexts needing a high level of security, this guarantee must be very
strong, or even absolute.
This is particularly necessary in the context of avionics where the data network
connecting the control units of the aircraft must absolutely offer a very high level of
security especially during flight phases.
25 It is however advantageous to connect this high–security network to a lower–
security network to, inter alia, recover data on the different parameters of flight during
maintenance phases of the aircraft.
It is also advantageous to be able to provide real–time information on and
during the flight over a passenger network.
30 It is known to construct one–way gateways between two networks having
different levels of security. In this case, the gateway authorizes data transfers from the
high–security network to the low–security network. The one–way aspect can even be
guaranteed at the physical level of communication, for example by using a diode such
as described in document EP 1 533 947 B1.
3
This type of gateway ensures that it is impossible to let pass data coming from
the low–security network and compromise the high–security network.
However, to enable operation of some applications it can prove necessary to
transmit information coming from the low–security network to the high–security
network. These can sometimes be simple 5 commands.
It is also advantageous to have stream control mechanisms during data
transfers from the high–security network to the low–security network. The stream
control needs to be able to return information to the source of the transfer and therefore
from the low–security network to the high–security network.
10 However, it is preferable for the level of security to be maintained at a very high
level. Control over information returning from the low–security network to the high–
security network should therefore be retained. This control ensures security of a very
high level.
It is conventional to set up gateways using a firewall in this type of situation.
15 These firewalls organize filtering of data circulating on the gateway. These instances of
filtering are done as a function of the communication protocols used and addresses
and port numbers involved in communication.
But the level of security contributed by such a firewall is insufficient in some
contexts where the need for security is particularly high.
20 It is advantageous to be able to raise the level of security of such a gateway to
ensure a level of security close to the level of security contributed by a one–way
gateway.
PRESENTATION OF THE INVENTION
25 The invention responds to this need and according to a first aspect proposes an
interconnection device of at least two data communication networks, connecting a first
network qualified as high–security network and at least one second network qualified
as low–security network, the device comprising:
- a one–way channel known as downlink channel between the high–security
30 network and the low–security network;
- a one–way channel known as uplink channel between the low–security
network and the high–security network, the uplink channel being configured, as a
function of at least one data model predetermined in advance originating from the low–
security network or a dedicated loading channel, to transmit a return signal to the high–
35 security network when an uplink data stream originating from the low–security network
4
to the high–security network comprises all or part of the predetermined data model, the
return signal being transmitted jointly to transmission of the uplink data stream or on
completion of transmission of the uplink stream to the high–security network.
The invention is advantageously completed by the following characteristics,
taken singly or in any of their technically possible combinatio5 ns.
The data stream comprising a succession of data packets, each packet
comprising several data fields, the uplink channel is configured to perform a detection
step of a set of data in conformity with a reference data model in the uplink data stream
originating from the low–security network.
10 The uplink channel is further configured to perform a triggering step of
transmission of a return signal to the high–security network when an uplink data stream
originating from the low–security network to the high–security network comprises all or
part of the predetermined data model.
The reference data model belongs to a set of at least one reference data model,
15 each reference data model of the set corresponding to a return stream associated with
the detected reference data model.
The reference data model is of a size greater than or equal to the return stream.
The uplink channel is further configured to perform a construction step of a
return stream from the data stream originating from the low–security network, the
20 construction consisting of extracting some of the data from the uplink data stream, the
return stream being the signal constructed as a result.
The uplink channel is configured to perform a construction step of a reference
data model from a data stream originating from the high–security network.
The uplink channel is configured to perform verification of integrity of the uplink
25 data stream.
Verification of the data stream integrity is made during transmission of said
uplink stream.
The uplink channel is configured, if the uplink stream is not correct, while part of
said uplink stream is transmitted to the high–security network, for inserting an
30 indication in a frame of the uplink stream indicating that the uplink stream is not correct.
If the uplink stream does not include automatic insertion of a CRC, the low–
security network is configured to formulate a CRC such that the uplink stream intended
for the secure network is correct.
The downlink comprises a module qualified to guarantee a one–way character
35 of said downlink said module preferably being a diode.
5
The construction step of a reference data model from a data stream originating
from the high–security network is performed after the following steps:
detection in the data stream originating from the high–security network of a set
of data in conformity with an initialization data stream;
verification of integrity of the data stream detected in this way originating fro5 m
the high–security network; and
construction of the reference data model from the data stream originating from
the high–security network or from the dedicated loading channel.
The invention also relates to an assembly comprising a plurality of devices
10 according to the invention, comprising one and the same dedicated channel for guiding
the reference data model to each uplink channel of each device.
The invention also relates to an assembly comprising a plurality of devices
according to the invention, arranged head to tail and having dedicated configuration
links independent of the uplink and downlink streams.
15 According to a second aspect, the invention relates to an assembly comprising
a plurality of devices according to the first aspect of the invention, comprising one and
the same dedicated channel for guiding the reference data model to each uplink
channel of each device.
According to a third aspect, the invention relates to an assembly comprising a
20 plurality of devices according to the first aspect of the invention, placed head to tail and
having dedicated configuration links independent of the uplink and downlink streams.
The invention can be implemented by hardware only, that is, without a
processor, with security increasing since no software is required. Implementation is
controlled end to end.
25 The invention is especially based on transmission of a return signal preceded
by a construction step of a return signal consecutively to recognition of a reference
model expected at the start of each packet of the uplink data stream.
In particular, construction of the return signal is dynamic. The return signal can
consist of static data and/or data coming directly from the uplink data stream
30 transmitted by the low–security network, the proportion of these data being flexible to
ensure passage of a plurality of protocols or adapting to different levels of security.
As a consequence, compared to the techniques of the prior art especially those
described in document FR 2 992 705, there is no passage of data via a dedicated low–
rate internal channel.
35
6
PRESENTATION OF THE FIGURES
Other characteristics, aims and advantages of the invention will emerge from
the following description which is purely illustrative and non–limiting and which must be
considered with respect to the appended drawings in which, apart from the figure 1
already 5 discussed:
- figure 2 schematically illustrates an interconnection device according to a first
aspect of the invention;
- figure 3 schematically illustrates a first embodiment of a method for controlling
a transmission of a data stream in an interconnection device according to the invention;
10 - figure 4 schematically illustrates a second embodiment of a method for
controlling a transmission of a data stream in an interconnection device according to
the invention;
- figure 5 schematically illustrates a third embodiment of a method for controlling
a transmission of a data stream in an interconnection device according to the invention;
15 - figure 6 schematically illustrates a fourth embodiment of a method for
controlling a transmission of a data stream in an interconnection device according to
the invention;
- figure 7 schematically illustrates an assembly according to a second aspect of
the invention;
20 - figure 8 schematically illustrates an assembly according to a third aspect of the
invention.
In all figures similar elements bear identical reference numerals.
DETAILED DESCRIPTION OF THE INVENTION
25 Figure 2 illustrates an interconnection device 20 of at least two data communication
networks, connecting a first network 11 qualified as high–security network and at least
one second network 12 qualified as low–security network.
Such a device further comprises a first communication interface 21 with the
low–security network 11 and a second communication interface 22 with the high–
30 security network 12.
The interconnection device also comprises a downlink 201 by which a downlink
data stream F–DES originating from the high–security network 11 intended for the low–
security network 12 transits.
The interconnection device also comprises an uplink channel 202 by which an
35 uplink data stream F–ASC transits which can trigger sending a return signal SIG–RET
7
to the low–security network 11. This triggering can be initiated as a function of at least
one datum of the uplink data stream.
The downlink, uplink data streams and the return signal SIG–RET preferably
consist of data organized according to packets in ETHERNET format, which implies
that a CRC is automatically inserted into the frames composing the different streams5 .
In this way, the downlink 201 is configured to let pass all the data stream of the
high–security network 11 to the low–security network 12.
In particular, the downlink comprises a module qualified to guarantee a one–
way character of the downlink. Such a module is preferably similar to a function of
10 diode type.
Furthermore, as a function of at least one data model F–REF predetermined in
advance (hereinbelow reference data model F–REF) originating from the high–security
network 11 or a dedicated independent loading channel 30, the uplink channel 202 is
configured to transmit a return signal SIG–RET to the high–security network 11 when
15 an uplink data stream F–ASC originating from the low–security network 12 to the high–
security network 11 comprises all or part of the predetermined data model F–REF. The
return signal SIG–RET can be transmitted at the same time as the uplink stream F–
ASC or else on completion of the complete transmission of the uplink stream F–ASC.
It is under some particular conditions that transmission of a return signal SIG–
20 RET to the low–security network 12 will be initiated, conditions which will be described
hereinbelow in the embodiments of a method for controlling a transmission of a data
stream executed by the uplink channel 202 configured to perform the steps described
hereinbelow in relation to each of the embodiments.
Figure 3 illustrates a first embodiment of a method for controlling a
25 transmission of a data stream executed by the uplink channel 202 of the
interconnection device of figure 2.
According to this first embodiment, in a first step DET–F–REF a set of data in
conformity with a reference data model F–REF is detected in the uplink data stream F–
ASC originating from the low–security network 12 intended for the high–security
30 network 11. The reference data model F–REF can come either from the high–security
network or from a dedicated channel 30.
Next, in a second step VER–CRC, integrity of the uplink data stream F–ASC is
verified as is standard to avoid spreading content the integrity of which would not be
correct.
8
Next, if a set of data in conformity with a reference model F–REF is detected
and if the uplink data stream F–ASC is correct, in a third step DEC–EMI transmission
of a return signal SIG–RET to the high–security network 11 is triggered, the return
signal SIG–RET being a predetermined return data stream F–RET.
The return signal in this first embodiment is independent of the downlink strea5 m
F–DES and of the uplink stream F–ASC.
Also, this return data stream F–RET is predetermined in that it is in conformity
with a set of data pre–loaded in a memory (not shown) of the interconnection device.
The return signal SIG–RET in this first embodiment is transmitted on completion
10 of transmission of the uplink stream F–ASC.
Figure 4 illustrates a second embodiment, according to which, in addition to the
characteristics of the first embodiment the reference data model F–REF belongs to a
set of reference data models F–REF1, F–REF2, F–REF3, F–REF4 such that a
reference data model from these reference data models is detected DET–F–REFi with
15 i=1, 2, 3, 4 or more generally i =1, …, N, with N the number of reference data models,
and it is integrity of the detected reference data model F–REFi which is verified, with
detection and verification triggering transmission DEC–EMI of a return signal SIG–RET
which is a predetermined data stream F–RETi corresponding to the detected reference
data model. The reference data models F–REFi can come either from the high–security
20 network or a dedicated channel 30.
According to this embodiment, for each stored reference stream, a
predetermined return stream F–RET is stored.
For each of the first and second embodiments described hereinabove the
reference model is of a size greater than or equal to the return stream F–RET this
25 which intrinsically causes a rate reduction along the uplink channel.
Also, the uplink channel 202 can comprise a rate reducer (not shown) which
limits the number of packets transmitted per time unit on the uplink channel and
especially those of the return signal SIG–RET. Such rate reduction can be carried out
by means of a monostable device, a decimation device or else a sliding window.
30 The advantage of the resulting rate limitation is that the first high–security
network 11 will not be stressed beyond a predetermined load.
In this second embodiment, the return signal SIG–RET is transmitted on
completion of the transmission of the uplink stream F–ASC.
Figure 5 illustrates a third embodiment comprising a construction step CONS–
35 F–RET of the return stream F–RET from the uplink data stream originating from the
9
low–security network 12, the construction consisting of extracting some of the data
from the uplink data stream, the return signal SIG–RET being the signal constructed as
a result.
Furthermore, as in the first and second embodiments, the method comprises a
step DET–F–REF according to which a set of data in conformity with 5 a reference data
model F–REF is detected in the uplink data stream F–ASC originating from the low–
security network 12 intended for the high–security network 11. The reference data
model F–REF can come either from the high–security network or from a dedicated
channel 30.
10 And if a set of data in conformity with a reference model is detected,
transmission of the return signal SIG–RET to the high–security network 11 is triggered.
The return stream F–RET, and therefore the return signal SIG–RET, comprises
data coming from the uplink stream and data F–INIT predetermined in advance. As a
consequence, the return stream comprises both static and dynamic data (since they
15 depend on data from the uplink stream which can be different from one stream to the
other).
According to this embodiment, the return signal SIG–RET can be transmitted
after complete receipt of the uplink stream F–ASC or else jointly on transmission of the
uplink stream.
20 More precisely the reference data model F–REF includes a set of information
defining byte by byte the way of working out on the fly (such as a partition) the return
stream F–RET from the uplink stream F–ASC. It indicates placing on the return stream
F–RET:
- either a static datum F–INIT which is a sub–set of the reference data model F–
25 REF;
- or a datum coming from the uplink stream F–ASC, which is further maskable bit
by bit to finely select the extent of what will be authorized to return from the
non–secure network 12 to the secure network 11;
- or automatic insertion, or not, of an integrity check word CRC at the end of the
30 frame relating to the stream now formulated on the fly.
According to this embodiment and in the case of joint transmission of the uplink
stream F–ASC and of the return signal SIF–RET, the CRC is calculated during
transmission of the uplink stream F–ASC and verification VER–CRC of integrity of the
stream is done on the fly. If the verified stream is not correct, while part is received, a
35 CRC indicating non–integrity of the stream will be inserted in the frame during
10
transmission of the uplink stream to indicate to the high–security network that the
received stream is not correct.
Advantageously, if addition of the automatic CRC is deactivated and the
corresponding placement is attributed to the uplink stream F–ASC, the non–secure
network 12 will be responsible for working out a correct value for CRC relating for th5 e
entire return stream F–RET formulated dynamically. To this end, the non–secure
network 12 has to have complete knowledge of the return signal F–RET and the
corresponding static data F–INIT. In the absence of this information it will be impossible
for the non–secure network 12 to submit an uplink stream F–ASC valid for the secure
10 network 11.
In addition, as in the second embodiment illustrated in figure 4, the reference
data model F–REF can belong to a set of reference data models F–REF1, F–REF2, F–
REF3, F–REF4 (not shown), the return streams F–RETi further comprise data F–INITi
predetermined in advance, a reference data model F–REF of the set of reference data
15 models.
Figure 6 illustrates a fourth embodiment in conformity with the third
embodiment but in which the uplink channel 202 is further configured to perform a
construction step CONS–F–REF of a reference data model in this case from the data
stream originating from the high–security network 11.
20 Advantageously and in addition, the construction step CONS–F–REF of the
reference stream from a data stream originating from the high–security network 11 is
performed after the following steps:
detection in the data stream originating from high–security network of a set of
data in conformity with an initial reference data stream F–REF0;
25 verification, of known type, VER–CRC0 of integrity of the initial reference data
stream detected in this way originating from the high–security network.
As is evident from figure 6, the construction step CONS–F–REF of the
reference stream is performed if and only if the reference data stream F–REF0 is
correct, i.e, with a correct CRC.
30 In addition, it is possible in conformity with this fourth embodiment to construct
several reference streams, and as for the first embodiment the return stream belongs
to a set of several return streams, a return stream corresponding to a reference stream.
The reference data model F–REFi can originate either from the high–security
network or from a dedicated channel 30.
11
According to a second aspect, Figure 7 illustrates a set of interconnection
devices in conformity with the first aspect of the invention and operating according to
the first, second or even third embodiments aggregated such that one and the same
dedicated channel 30 feeds each interconnection arrangement 201, 202, 20N with
reference data models F–REFi,n with n=1, N and i the index of the reference 5 data
model.
According to a third embodiment, Figure 8 illustrates a set of two
interconnection devices 20#1, 20#2 in conformity with the first aspect of the invention
operating according to a method in conformity with the first, second or even third
10 embodiments arranged relative to each other head to tail. According to this
embodiment, access both to the high–security network 11 and also the low–security
network 12 is controlled by uplink and downlink channels described earlier. Each
device 20#1, 20#2 further comprises a dedicated channel 30 for guiding reference data
models F–REFi#1, F–REFi#2. Such a configuration produces an assembly offering
15 controlled security independently in each direction.
12
I/We Claim:
1. An interconnection device (20) of at least two data communication networks,
connecting a first network (11) qualified as high–security network and at least 5 t one
second network (12) qualified as low–security network, the device comprising
- a one–way channel (201) known as downlink channel between the high–
security network and the low–security network;
- a one–way channel (202) known as uplink channel between the low–security
10 network (12) and the high–security network (11), the uplink channel (202) being
configured, as a function of at least one data model predetermined in advance
originating from the low–security network (12) or a dedicated loading channel (30), to
transmit a return signal (SIG–RET) to the high–security network (11) when an uplink
data stream (F–ASC) originating from the low–security network (12) to the high–
15 security network (11) comprises all or part of the predetermined data model, the return
signal (SIG–RET) being transmitted jointly to transmission of the uplink data stream (F–
ASC) or on completion of transmission of the uplink stream (F–ASC) to the high–
security network (11).
20 2. The interconnection device according to claim 1, wherein the data stream
comprising a succession of data packets, each packet comprising several data fields,
the uplink channel is configured to perform a detection step (DET–F–REF, DET–F–
REFi) of a set of data in conformity with a reference data model in the uplink data
stream originating from the low–security network (12).
25
3. The interconnection device according to claim 2, wherein the uplink channel is
further configured to perform a triggering step (DEC–EMI) of transmission (F–RET, F–
RETi) of a return signal (SIG–RET) to the high–security network (11) when an uplink
data stream (F–ASC) originating from the low–security network (12) to the high–
30 security network (11) comprises all or part of the predetermined data model.
4. The interconnection device according to one of claims 2 to 3, wherein the
reference data model belongs to a set of at least one reference data model, each
reference data model of the set corresponding to a return stream associated with the
35 detected reference data model.
13
5. The interconnection device according to one of claims 2 to 4, wherein the
reference data model is of a size greater than or equal to the return stream.
6. The device according to claim 2, wherein the uplink channel is further configured to
perform a construction step (CONS–F–RET) of a return stream from the data strea5 m
originating from the low–security network (12), the construction consisting of extracting
some of the data from the uplink data stream, the return stream being the signal
constructed as a result.
10 7. The device according to one of claims 1 to 6, wherein the uplink channel is
configured to perform a construction step (CONS–F–REF) of a reference data model
from a data stream originating from the high–security network (11).
8. The interconnection device according to one of the preceding claims, wherein the
15 uplink channel is configured to perform verification (VER–CRC) of integrity of the uplink
data stream (F–ASC).
9. The interconnection device according to claim 8, wherein the uplink channel is
configured, if the uplink stream is not correct, while part of said uplink stream (F–ASC)
20 is transmitted to the high–security network (11), for inserting an indication in a frame of
the uplink stream indicating that the uplink stream is not correct.
10. The interconnection device according to one of claims 1 to 7, wherein if the uplink
stream does not include automatic insertion of a CRC, the low–security network (12) is
25 configured to formulate a CRC such that the uplink stream (F–ASC) intended for the
secure network (12) is correct.
11. The device according to one of claims 1 to 10, wherein the downlink (201)
comprises a module qualified to guarantee a one–way character of said downlink, said
30 module preferably being a diode.
12. The device according to one of claims 6 to 11, wherein the construction step
(CONS–F–REF) of a reference data model from a data stream originating from the
high–security network (11) is performed after the following steps:
14
detection in the data stream originating from the high–security network of a set
of data in conformity with an initialization data stream (F–REF0);
verification (VER–CRC0) of integrity of the data stream detected in this way
originating from the high–security network; and
construction of the reference data model from the data stream originating fro5 m
the high–security network (11) or from the dedicated loading channel (30).
13. An assembly comprising a plurality of devices according to one of claims 1 to 12,
comprising one and the same dedicated channel (30) for guiding the reference data
10 model to each uplink channel of each device.
14. The assembly comprising a plurality of devices according to one of claims 1 to 13,
arranged (20#1, 20#2) head to tail and having dedicated configuration links
independent of the uplink and downlink streams.