Method for managing website access requests from access devices

Abstract

The invention relates to a method for managing a website access request from a device (OBJ) and transmitted through a telecommunication network (RES), characterized in that it comprises the following steps: - a step (ET1) of reception of a request comprising a domain name, this request coming from a device, intended to be transmitted to a domain name resolution server; - a step (ET2) of routing of this request to the domain name resolution server; - a step (ET6) of reception of a response comprising an IP address and information related to this IP address, this information being called first information; - a transmission or not (ET9, ET7a) of this request through the network (RES) depending on this first information.

Description

Technical Field

[0001] This invention relates to the field of telecommunications.

[0002] More specifically, this invention relates to a method for managing access to a website from a data processing device (hereinafter referred to as an access device).

[0003] The access device selected for illustrating the present invention is a network object. Background Technology

[0004] On the Internet, computers communicate with each other using a set of protocols, including the Internet Protocol (IP). This protocol uses numeric addresses, commonly known as IP addresses (@IP).

[0005] Therefore, computers distributed across the network have associated domain names of type "example.com". This domain name has a corresponding URL (Uniform Resource Locator), which is a unique address used to access computers on the network (e.g., servers hosting websites).

[0006] There are two methods for accessing a website from a device. The first method is to use an IP address, and the second method is to use a URL.

[0007] When a URL is used, the accessing device sends a request to a domain name resolution server or DNS (Domain Name System) server to retrieve the corresponding IP address. Once the IP address is retrieved, the accessing device uses that IP address to access the computer.

[0008] Allow devices to access websites directly using their IP address instead of their URL, without any initial DNS requests.

[0009] Regardless of which method is used, accessing a website carries certain risks. For example, the website might belong to a malicious third party who could control the access device without the owner's knowledge. When the access device is a network-connected object (e.g., a vacuum cleaner equipped with a camera), a malicious third party could install malware on the object capable of transmitting data from the object to the internet. In fact, malware installed on the object could command the camera to capture video of its surroundings and transmit the resulting video content over the internet.

[0010] The present invention aims to improve this situation. Summary of the Invention

[0011] Therefore, according to one functional aspect, the present invention relates to a method for managing website access requests from devices and transmitted over a telecommunications network, characterized in that the method includes the following steps:

[0012] - The step of receiving a request including a domain name, which originates from the device and is intended to be transmitted to the domain name resolution server;

[0013] - The steps to route the request to the domain name resolution server;

[0014] - The step of receiving a response including an IP address and information associated with that IP address, referred to as first information;

[0015] - Depending on the first piece of information, the request may or may not be transmitted on the network.

[0016] According to the present invention, an entity outside the access device intercepts website access requests and seeks to obtain both the IP address and information related to the IP address from the domain name resolution server.

[0017] Upon receiving this information, the entity analyzes it and decides whether to proceed with the access request. As can be seen in one embodiment, when the entity decides to proceed, the IP address is transmitted to the access device that initiated the request.

[0018] The domain name resolution server is located in a secure environment. Therefore, primary information related to IP addresses is stored in a trusted environment that is difficult for malicious third parties to attack. Furthermore, this trusted server ideally ensures that the primary information related to IP addresses remains up-to-date.

[0019] Finally, the entity is located outside the access device, ideally within the security device (such as a home gateway) to which the access device is connected; therefore, the chance of both the access device and the home gateway being compromised is very low.

[0020] It should be noted that "information" is understood to mean any descriptive information that can characterize a computer (or website), especially its trust level, computer category (children's website, adult website, etc.). Other examples of descriptive information will be described below.

[0021] Currently, as described above, access devices such as network objects can directly access websites using their IP addresses, sometimes without the initial domain name resolution step performed by a domain name resolution server. According to a first specific mode of an embodiment of the present invention, when the initial request includes the IP address of the device to be accessed, a transmission step precedes the receiving step by transmitting a message to the access device requesting the transmission of the request to the domain name resolution server. This embodiment forces the access device to perform name resolution through the domain name resolution server to retrieve information related to the website corresponding to the received domain name. After verifying the received information, the management entity may or may not transmit the received request to the device associated with that IP address.

[0022] According to another specific mode of the present invention, which can be implemented as an alternative to or supplement to the foregoing mode, the method further includes:

[0023] - The step of obtaining information related to the access device, referred to as second information;

[0024] - The step of comparing the first information with the second information;

[0025] - Depending on the comparison step, the request may or may not be transmitted on the network.

[0026] This model enhances security by considering not only information about the website in question but also information about the accessing device. The management entity retrieves information related to the accessing device and information related to the website, compares the information, detects any incompatibility between the first and second pieces of information, and finally decides whether to transmit the IP address. For example, if the website is an adult website and the accessing device is a children's game, the entity will decide not to proceed with the access request due to the incompatibility between the accessing device and the requested website.

[0027] Depending on the circumstances, if incompatibility exists, the entity will not perform the following operations:

[0028] - If the initial access request received is based on a domain name, then the IP address is not transmitted to the access device; or

[0029] - If the initial access request received is based on an IP address, the request will not be transmitted over the Internet.

[0030] According to another third specific mode of the present invention, which can be implemented as an alternative or supplement to the foregoing mode, after receiving a response including an IP address and information associated with that IP address, the received information is stored. In this configuration, in this mode, after receiving a new subsequent access request, the presence of information associated with the domain name in the memory is verified, and then the IP address is transmitted or not transmitted based on the information stored in the memory.

[0031] As will be seen below, the above steps are performed in the home gateway, and the received information related to the IP address is stored in the memory of the home gateway.

[0032] According to another fourth specific mode of the present invention, which can be implemented as an alternative or supplement to the aforementioned mode, the validity period is associated with the stored information. In this configuration, after information related to the domain name exists in the memory, it is verified whether the information is still valid. If not, the method performs the steps described above:

[0033] - The steps to route the request to the domain name resolution server;

[0034] - The step of receiving a response that includes an IP address and information associated with that IP address;

[0035] - Depending on the response, the request may or may not be transmitted over the network.

[0036] According to another fourth specific mode of the present invention, which can be implemented as an alternative to or supplement to the foregoing mode, the method includes the following when the expiration date has expired:

[0037] - The step of sending a request to the domain name resolution server to obtain updates to the information associated with the IP address and stored in memory;

[0038] - The step of receiving a response including information associated with the IP address; and

[0039] - The steps to store the received information.

[0040] The advantage of this fourth mode is that, for example, the information stored in the gateway is updated when it becomes invalid. This ensures that valid information is available when an entity receives an access request. This avoids the entity having to transmit a domain name resolution request over the network. With valid information stored in the gateway, the entity can therefore more quickly decide whether to authorize or not to transmit the received access request to the IP address in question.

[0041] According to one hardware aspect, the present invention relates to a management entity, comprising...

[0042] - A receiving module for receiving requests, including domain names, from the device and intended to be transmitted to a domain name resolution server;

[0043] - A routing module used to route the request to the DNS server;

[0044] -A receiving module for receiving a response including an IP address and information related to that IP address, referred to as first information;

[0045] - A transmission module that can transmit or not transmit the request on the network depending on the first information.

[0046] According to another hardware aspect, the present invention relates to a home gateway including the aforementioned entities.

[0047] According to another hardware aspect, the present invention relates to a computer program that can be implemented on a management entity such as those defined above, the program comprising code instructions that, when executed by a processor, perform the steps of the methods defined above.

[0048] Finally, the present invention relates to a data carrier on which at least one sequence of program code instructions for performing the methods defined above is stored.

[0049] The data carrier can be any entity or device capable of storing a program. For example, the carrier can include a storage device such as a ROM (e.g., a CD-ROM or microelectronic circuit ROM) or a magnetic recording device (e.g., a hard disk). Furthermore, the information carrier can be a transmissible carrier, such as an electrical or optical signal, which can be routed via cable or optical fiber, radio, or otherwise. The program according to the invention can be downloaded, in particular, from a network such as the Internet. Alternatively, the information carrier can be an integrated circuit incorporating the program, designed to execute or be used to execute the methods discussed.

[0050] Finally, it should be noted that the terms "module" or "entity" in this document may be equivalent to a software component or a hardware component or a set of software and hardware components. A software component, in itself, corresponds to one or more computer programs or subroutines, or more generally, to any element of a program capable of implementing, for example, a function or set of functions described for a module under discussion. In the same manner, a hardware component corresponds to any element (integrated circuit, chip card, memory card, etc.) of a hardware assembly capable of implementing a function or set of functions for a module under discussion. Attached Figure Description

[0051] The invention will be better understood by reading the following description, which is given by way of example and with reference to the accompanying drawings, in which:

[0052] [ Figure 1 ] Figure 1 The computer system on which an exemplary embodiment of the present invention is based is shown.

[0053] [ Figure 2 ] Figure 2 This is a schematic view of the architecture of a home gateway according to an embodiment of the present invention.

[0054] [ Figure 3 ] Figure 3 An example of steps implemented in the context of a method according to one embodiment is shown.

[0055] [ Figure 4 ] Figure 4 References were shown Figure 3 A possible variation of the described embodiment.

[0056] [ Figure 5 ] Figure 5 References were shown Figure 3 Another possible variation of the described embodiment. Detailed Implementation

[0057] Figure 1 The diagram illustrates a user's access device OBJ, which is able to access a communication network RES via an interface device GTW. The communication network RES can be the Internet, and the interface device GTW can be a home gateway or router that allows the user's terminal OBJ to access the Internet. Access to the communication network is provided by the communication network access provider.

[0058] The access device OBJ can be any type of device configured to access a communication network (such as the Internet) via the home gateway GTW. The access device OBJ can be a cellular phone or other mobile communication terminal, such as a tablet or laptop computer, a desktop computer, or a home appliance capable of establishing a connection to the communication network RES.

[0059] Generally speaking, when a user enters a domain name in the browser installed on the access device, the access device will transmit the domain name resolution request to the resolution server or DNS server.

[0060] The DNS server then responds to the accessing device 10 with a network address or Internet Protocol address corresponding to the domain name, and the accessing device is then able to access the IP address via the home gateway GTW.

[0061] A home gateway (GTW) is an interface device that allows exchange between the access device (OBJ) and the communication network (RES). Among other things, it also acts as a DNS relay. In other words, the gateway is responsible for sending resolution requests (REQ) to DNS resolvers. (Further details will follow.) Figure 2 Describe a possible architecture for the interface device.

[0062] It's important to note that you need the website's IP address to access it. Typically, a website has one or more IP addresses (e.g., 93.184.216.34) and a domain name (www.example.com).

[0063] Domain names are converted into numerical addresses by DNS (Domain Name System) domain name resolution servers.

[0064] Figure 2 A home gateway configured to implement a management method according to a specific embodiment of the present invention is shown.

[0065] According to this particular embodiment, the gateway has a conventional computer architecture and specifically includes a processor CPU (or microcontroller) and a memory MEM in which an entity ENT is stored. In our example, the entity ENT is a computer program containing instructions that, when executed by the processor CPU, are used to implement the following references. Figure 3 The steps of the described management method.

[0066] The gateway also includes a Wi-Fi module and a RES module for communicating with local area networks (such as Wi-Fi networks) and wide area networks (such as ADSL, fiber optic, etc.).

[0067] Figure 3 A flowchart illustrating a processing method according to a first embodiment of the present invention is shown.

[0068] In our example, the access device OBJ is a networking object.

[0069] When a network object OBJ wants to access the communication network RES via the home gateway GTW, object OBJ 10 creates a DNS resolution request REQ in the first step ET1 to resolve the domain name DN of the website it wants to access, and transmits the DNS resolution request REQ to the gateway GTW.

[0070] In the second step, ET2, the home gateway GTW transmits the resolution request to the DNS server.

[0071] Then, the DNS server performs two tasks. The first task, in step ET3, is to obtain the IP address associated with the domain name; the second task, in step ET4, is to obtain descriptive information about the IP address through the query server SRV. This descriptive information serves, for example, to provide the confidence level N-IP associated with the device corresponding to the resolved IP address. This information, called descriptive information, can be stored in the DNS server or on a server external to the DNS server. In step ET5, the DNS server obtains and transmits the obtained descriptive information N-IP about the IP address in question to the entity ENT.

[0072] This descriptive information can be diverse. It can include the type of website associated with the IP address: social networks, video games, cryptocurrency mining, etc.

[0073] Other descriptive information could be the server's geographical location: China, Russia, the United States, Brazil, or France.

[0074] Other descriptive information could be a confidence score associated with the IP address, given on a scale of one to ten.

[0075] In step ET6, the gateway receives a response from the DNS server, which includes the resolved IP address and a set of descriptive information associated with that IP address.

[0076] To simplify this exemplary embodiment, it is assumed that the received set of descriptive information is provided in the form of confidence level N-IP in the form of confidence scores on a scale of 1 to 10, for example, 9 for the website in question.

[0077] In step ET7, the management entity ENT receives the response, verifies the N-IP information received by the VRF, and decides to transmit the IP address to the object based on the received descriptive information (in our example, the received confidence score).

[0078] Here we assume that an entity only transmits its IP address if its confidence score is greater than or equal to 7. In this example, since entity ENT receives a score of 9, the entity transmits its IP address to the object in step ET8.

[0079] If the score received from the DNS server is less than 7, the entity will not transmit an IP address.

[0080] After receiving the IP address, object OBJ accesses the website with the received IP address.

[0081] According to the first variant, access requests are based on IP addresses rather than domain names.

[0082] refer to Figure 4 In step ET1a, if object OBJ wishes to access the website via a URL address instead of a domain name, a request REQ(IP) is transmitted from object OBJ to entity ENT. Upon receiving the request REQ(IP), instead of transmitting the request as in step ET2 above, in step ET1b, object OBJ is responded to by requesting the object to transmit a request to access the website using a domain name.

[0083] In the subsequent step ET1c, object OBJ transmits back the access request REQ(DN) that uses the domain name to access the website.

[0084] The entity receives the access request.

[0085] At this stage, the method is again performed as described above from step ET2 to step ET6.

[0086] Next, in step ET6a, the management entity ENT receives the response, verifies the N-IP information received by the VRF, and decides to transmit the IP address to the object based on the received descriptive information (in our example, the received confidence score).

[0087] Here we again assume that an entity will transmit its IP address only if its confidence score is greater than or equal to 7.

[0088] In this example, since the score received by entity ENT is 9, in step ET7a, the entity will transmit the request received on the Internet to the website with that IP address.

[0089] According to the second variant, the method considers information related to the networked object when making a decision. In this configuration, the entity ENT considers not only descriptive information about the websites that the object OBJ wishes to access, but also descriptive information about the object OBJ itself.

[0090] Descriptive information about an object can be varied. For example, descriptive information could be the category of users who might use the object: children / adults; or the category of the object (toys, video games for children or adults, "IoT" (for the Internet of Things) objects, such as cameras or refrigerators).

[0091] For example, the object is online games for children (stuffed toys, electric cars for children, etc.).

[0092] In this configuration, the entity ENT compares the received information related to the website with the information related to the object. The entity detects any incompatibilities between the object and the website. For example, if the website is a non-malicious adult website and the object's user category is "children," then the entity ENT will not transmit the IP address to the object or will not transmit the access request (depending on the situation).

[0093] Similarly, if the website is a mining website (i.e., a website used to "mine" cryptocurrency) and the object is of the "IoT" type, then the entity ENT will not transmit the IP address to the object or will not transmit the access request (depending on the situation).

[0094] A confidence level can be assigned to an object OBJ. In this case, the entity can use this confidence level to decide whether to transmit the IP address.

[0095] According to one embodiment, descriptive information received from the parsing server is stored in the memory MEM of the gateway GTW. A time period TM can also be set, after which information is considered expired.

[0096] In this configuration, when a domain-based access request is received, the ENT entity verifies whether the domain name (DN) has been resolved by querying the gateway's memory (step DN / MEM).

[0097] If not, then repeat step ET2 and the subsequent steps.

[0098] If so, then optionally, refer to Figure 5 The entity verifies the validity of the descriptive information (step TM?).

[0099] If the data is no longer valid due to expiration, repeat step ET2 and subsequent steps.

[0100] If the data is valid, proceed to step ET8 or ET7a according to the conditions defined above. Figure 5 Only step ET8 is shown in the text.

[0101] According to another variant, when the IP address-related information stored in the home gateway's memory has expired and is therefore no longer valid, the ENT entity transmits a domain name resolution request to obtain the latest updated descriptive information.

[0102] More specifically, when the information is no longer valid, this embodiment includes the following steps:

[0103] - The step of sending a request to the domain name resolution server to obtain updates to the information associated with the IP address and stored in memory.

[0104] - The step of receiving a response including information associated with the IP address; and

[0105] - The steps to store the received information.

[0106] In this variant, the trigger for the transmission resolution request is not receiving a request for the access domain name (DN) from the access device, but rather the state of the descriptive information stored in memory, or more precisely, the expiration of the descriptive information.

[0107] In conclusion, "descriptive information" here refers to data that can characterize an object or a remote server.

[0108] Descriptive information about objects includes, for example, permissions and / or metadata known to the home gateway, which keeps networked objects connected to it up-to-date.

[0109] Permissions refer to things like administrators and regular users.

[0110] Metadata refers to, for example,

[0111] - Device types: Camera, PC, Phone, Tablet, Printer, TV

[0112] - Confidence level, such as confidence score: 0-10

[0113] - Device types: dangerous, unsafe, parental, social networking, video games

[0114] - Device / Software Category: Dangerous / Not Dangerous; Dangerous software is known to include, for example, cryptocurrency mining software that uses the processing power of peripheral devices to generate cryptocurrency. These websites may be used legitimately by the intended users, but could also be used illegally by malicious third parties.

[0115] - Country of origin: China, Russia, the United States, France, etc.

Claims

1. A method for managing website access requests originating from a device (OBJ) and transmitted over a telecommunications network (RES), the method being performed by a management entity (ENT), characterized in that, The method includes the following steps: - The step of receiving the first request to access the website from the device and transmitting it over the telecommunications network (ET1); - When the first request includes the IP address of the website, the step of transmitting a message to the device that requests the device to transmit a second request, including the domain name of the website, to access the website using the domain name of the website; - After receiving the returned second request, the second request is transmitted to the domain name resolution server (ET2). - Step (ET6) to receive a response from the domain name resolution server including the IP address and first information associated with the IP address, the first information being descriptive information for providing a confidence level associated with the website associated with the IP address; - Depending on the first information, the second request (ET9, ET7a) may or may not be transmitted to the server hosting the website.

2. The management method as described in claim 1, characterized in that, The method also includes - The steps to obtain second information related to the device (OBJ); - The step of comparing the first information with the second information; - Depending on the comparison step, the second request may or may not be transmitted to the server.

3. The management method as described in claim 1 or 2, characterized in that, After receiving a response including an IP address and first information associated with that IP address, the received information is stored in a memory in association with the domain name, and is characterized in that, after receiving a new access request to the website, the presence of received information associated with the domain name in the memory is verified, and the IP address is transmitted to or not transmitted to the device based on the stored information.

4. The management method as described in claim 3, characterized in that, The validity period is associated with the information stored.

5. The management method as described in claim 4, characterized in that, When the validity period expires, the method includes - The step of sending a request to the domain name resolution server to obtain updates to the information associated with the IP address and stored in memory. - The step of receiving a response including information associated with the IP address, and - The steps to store the received information.

6. A management entity (ENT) for managing website access requests from a device (OBJ), characterized in that, The management entity includes: -A receiving module for receiving the first request to access a website from the device and transmitted over a telecommunications network; - A routing module that, when the first request includes the IP address of a website, transmits a message to the device requesting the device to transmit a second request, including the domain name of the website, to access the website using the domain name of the website, and, upon receiving the returned second request, transmits the second request to the domain name resolution server. - A receiving module for receiving a response from the domain name resolution server, including the IP address and first information related to the IP address, the first information being descriptive information for providing a confidence level associated with the website associated with the IP address; - A transmission module that can transmit or not transmit the second request to the server hosting the website depending on the first information.

7. A home gateway comprising a management entity as defined in claim 6.

8. A computer program product comprising code instructions that, when executed by a processor, perform the steps of the method as claimed in any one of claims 1 to 5.

9. A data carrier storing at least one sequence of program code instructions for performing the method as claimed in any one of claims 1 to 5.

Images