METHOD FOR INSPECTING AN ENCRYPTED STREAM WITH PREDEFINED TRAPDOORS

Description

Background of the invention

[0001] The invention relates to the general field of telecommunications.

[0002] It relates more specifically to the detection of intrusions on a telecommunications network through which a sending device and a receiving device exchange encrypted traffic.

[0003] As is well known, SSL (Secure Sockets Layer) and, more recently, TLS (Transport Layer Security) are commonly used security protocols on networks, such as the public Internet via HTTPS (HyperText Transfer Protocol Secure), to ensure the confidentiality of communications. These protocols protect sensitive data shared by various devices on the network by encrypting the exchanges between them. Unfortunately, this encryption renders existing intrusion detection techniques ineffective, as they are unable to inspect the encrypted traffic exchanged on the network.

[0004] Indeed, intrusion detection and protection systems (also commonly referred to as IDS (Intrusion Detection Systems) and IPS (Intrusion Protection Systems)) are typically configured to monitor network traffic and identify signatures or characteristic behaviors in that traffic associated with various threats that could affect the network, such as malware intrusion, sensitive data leaks, attacks against the network, etc. To this end, these systems implement deep packet inspection, more commonly known as DPI (Deep Packet Inspection), which involves analyzing the content of a network packet (e.g., an IP packet), not just its header, and comparing this content with signatures or keywords ("patterns") characteristic of known attack scenarios.These signatures or keywords are determined and provided by security vendors or other open source software, who compete with each other to offer an up-to-date catalog of signatures covering the widest possible range of attacks, knowing that new attacks appear every day.

[0005] The common feature of these IDS systems is that they rely on analyzing unencrypted communications transmitted over the network to compare the content of these communications to signatures pre-established by security vendors. The use of network security protocols such as SSL or TLS renders these systems unusable in their current state, making information systems that rely on encrypted network exchanges vulnerable to numerous cyberattacks.

[0006] To circumvent this limitation, many security vendors offer applications that behave insecurely by positioning themselves as "man-in-the-middle" attackers on an SSL / TLS connection linking a sending device to a receiving device, thereby intercepting communications between these two devices. This interception is achieved through the use of fake trusted certificates that allow them to break the end-to-end encryption used between the two devices and access the content of their unencrypted exchanges.

[0007] While such a solution is satisfactory from the point of view of intrusion detection, it nonetheless poses ethical, legal and confidentiality problems in terms of user privacy, so that several web browsers today include plug-ins that allow the detection and revoke of fake trusted certificates used by IDS systems.

[0008] It was therefore long considered that it was not possible to simultaneously satisfy the two conditions of network security in terms of monitoring and intrusion detection, and of guaranteeing the privacy of users through the encryption of their communications.

[0009] J. Sherry et al., in their paper entitled "BlindBox: Deep Packet Inspection over Encrypted Traffic," SIGCOMM'15, August 17-21, 2015, propose a technique for inspecting encrypted traffic using advanced encryption protocols. This technique detects attacks targeting encrypted traffic via an IDS proxy located at the traffic's edge (also known as a "middlebox"). It relies on the security vendor providing keywords to search for in the traffic in plaintext, and the IDS proxy encrypting these keywords before each encrypted connection (e.g., each SSL connection) established between a sending and receiving device. The IDS proxy then compares these encrypted keywords with the traffic exchanged between the sending and receiving devices.If a match is detected, the traffic is considered suspicious, and various actions can then be taken, such as sending a notification to the network administrator, deleting the packet considered suspicious, stopping the connection between the sending device and the receiving device, etc.

[0010] However, the solution proposed by Sherry et al. suffers from a major drawback: it is incompatible with the rules currently imposed by the ecosystem in which security vendors and IDS systems participate. Indeed, as mentioned previously, the solution proposed by Sherry et al. requires that all keywords and detection rules (e.g., combinations of several keywords) offered by the security vendor be accessible in clear text by the IDS proxy so that it can encrypt them, and therefore, more generally, by every IDS proxy present in the network. While this constraint may not be one from a theoretical standpoint, it is completely out of step with the practices of security vendors in this area, for obvious economic reasons, as keyword databases and other detection rules constitute the added value of security vendors. Consequently, although theoretically feasible, the solution proposed by Sherry et al.is not applicable in practice within a network.

[0011] Furthermore, for the sake of efficiency, it is very common for a single IDS to be configured to use keywords or signatures from different security vendors. Given the likely lack of harmonization between security vendors, the IDS proxy proposed by J. Sherry et al. would therefore need to be able to integrate plaintext signatures potentially with different formats or semantics. This implies a high level of implementation complexity that is difficult to realistically address for such equipment. Subject matter and summary of the invention

[0012] The invention addresses these drawbacks by providing a method for detecting intrusions on a network through which a sending device and a receiving device communicate. This detection method uses a searchable encryption algorithm defined by a key generation algorithm, an encryption / decryption procedure, a trap generation algorithm, and a testing procedure capable of utilizing said traps. The detection method comprises: a step of generating, by means of said key generation algorithm, a trapdoor derivation key intended for a security device capable of determining a plurality of keywords characteristic of intrusions likely to affect the network; a step of generating, by the security device, a trapdoor for each keyword of said plurality of keywords using said trapdoor generation algorithm parameterized by the trapdoor derivation key, each trapdoor generated for a keyword enabling the detection of a string of characters representative of a ciphertext of that keyword obtained by means of said encryption / decryption procedure; a step of providing, by the security device, the trapdoors generated for said plurality of keywords to an intrusion detection device located in the network between the sending device and the receiving device;an interception step, by the intrusion detection device, of a plurality of encrypted character strings emitted on the network by the sending device to the receiving device, said plurality of encrypted character strings resulting from the encryption of a plurality of character strings resulting from a segmentation by the sending device of a message intended for the receiving device, said encryption being carried out by means of said encryption / decryption procedure and a public encryption key associated with the receiving device;a step of applying, by the intrusion detection device, the test procedure on the plurality of intercepted encrypted strings, said test procedure using the traps provided by the security device to detect whether there is at least one encrypted string among said plurality of intercepted encrypted strings representative of at least one ciphertext of a keyword among said plurality of keywords; and a step of detecting an intrusion on the network if the intrusion detection device detects the existence of such an intercepted encrypted string.

[0013] The invention also relates to a method of monitoring a network by means of an intrusion detection device using a searchable encryption algorithm defined by a key generation algorithm, an encryption / decryption procedure, a trap generation algorithm, and a testing procedure capable of using said traps, said intrusion detection device being located on the network between a sending device and a receiving device, said monitoring method comprising: a step of obtaining, from a security device having a plurality of keywords characteristic of intrusions likely to be committed on the network, a plurality of traps generated by the security device for said plurality of keywords using said trap generation algorithm parameterized by a trap derivation key generated for the security device by means of said key generation algorithm, said keywords being kept secret by the security device from the intrusion detection device;a step of intercepting a plurality of encrypted strings transmitted over the network by the sending device to the receiving device, said plurality of encrypted strings resulting from the encryption of a plurality of strings resulting from a segmentation by the sending device of a message intended for the receiving device, said encryption being carried out by means of said encryption / decryption procedure and a public encryption key associated with the receiving device; a step of applying the test procedure to the plurality of intercepted encrypted strings, said test procedure using the traps provided by the security device to detect whether there is at least one encrypted string among said plurality of intercepted encrypted strings representative of at least one ciphertext of a keyword among said plurality of keywords;and a step to detect an intrusion on the network if the intrusion detection device detects the existence of such an intercepted encrypted string.

[0014] Correspondingly, the invention also relates to an intrusion detection device on a network configured to use a searchable encryption algorithm defined by a key generation algorithm, an encryption / decryption procedure, a trap generation algorithm, and a test procedure capable of using said traps, said intrusion detection device being intended to be located on the network between a sending device and a receiving device and comprising: a retrieval module, capable of obtaining from a security device having a plurality of keywords characteristic of intrusions likely to be committed on the network, a plurality of traps generated by the security device for said plurality of keywords using said trap generation algorithm parameterized by a trap derivation key generated for the security device by means of said key generation algorithm, said keywords not being known to the intrusion detection device;an interception module, configured to intercept a plurality of encrypted character strings transmitted over the network by the sending device to the receiving device, said plurality of encrypted character strings resulting from the encryption of a plurality of character strings resulting from a segmentation by the sending device of a message intended for the receiving device, said encryption being carried out by means of said encryption / decryption procedure and a public encryption key associated with the receiving device;a test module, configured to apply said test procedure to the plurality of intercepted encrypted strings, this test procedure using the traps obtained from the security device to detect whether there is at least one encrypted string among said plurality of intercepted encrypted strings representative of at least one ciphertext of a keyword among said plurality of keywords; and a network intrusion detection module, activated if the test module detects the existence of such an intercepted encrypted string.

[0015] The invention also relates to an intrusion detection system on a network through which a transmitting device and a receiving device are capable of communicating, this detection system being configured to use a searchable encryption algorithm defined by a key generation algorithm, an encryption / decryption procedure, a trap generation algorithm, and a testing procedure capable of using said traps, the detection system comprising: a security device, capable of determining a plurality of keywords characteristic of intrusions likely to affect the network; an intrusion detection device according to the invention located in the network between the transmitting device and the receiving device; and at least one key generation module configured to generate, by means of the key generation algorithm, a trap derivation key intended for the security device; and in which the security system includes: a trap generation module configured to generate a trap for each keyword in said plurality of keywords using said trap generation algorithm parameterized by the trap derivation key, each trap generated for a keyword enabling the detection of a string of characters representative of a ciphertext of that keyword obtained by means of the encryption / decryption procedure; and a delivery module, configured to provide the generated traps for the keywords to the intrusion detection device while keeping said keywords secret from the intrusion detection device.

[0016] It should be noted that there are no limitations on how an intrusion detected by the intrusion detection system is handled. The detection of such an intrusion may, for example, simply result in a notification being sent by the intrusion detection system to the network administrator, or it may trigger a corrective action, such as rejecting the message being examined, interrupting the connection between the sending and receiving devices, etc.

[0017] The invention thus proposes a new approach enabling the encryption of communication between a sending device and a receiving device while maintaining the possibility of detecting network intrusions using DPI (Deep Packet Inspection) by an intermediary device, or "middlebox," located between the sending and receiving devices (the intrusion detection device as defined in the invention). In other words, the invention offers the possibility of ensuring network security while guaranteeing the confidentiality of the communications of network users.

[0018] This approach relies on the use of a searchable encryption algorithm that enables equality tests between keywords defined by a security vendor (a security device as defined in the invention) and potentially malicious traffic exchanged in encrypted form over the network between the sending and receiving devices. Such a searchable encryption algorithm is typically defined by a cryptographic key generation algorithm, an encryption / decryption procedure, a trap generation algorithm, and a testing procedure capable of utilizing these traps.

[0019] As is well known in cryptography, a trapdoor associated with a word, or more generally with a message, is a piece of information that is difficult to reverse without knowing the key used to derive it (in other words, information from which it is virtually impossible to access the message for which it was generated). This information allows for a specific action that would be impossible without it. In this case, the trapdoors generated for the different keywords established by the security system allow for equality tests to be performed on encrypted data exchanged between the sending and receiving devices. This data was encrypted using the encryption procedure associated with the searchable encryption algorithm.More specifically here, the traps generated for the different keywords established by the security vendor allow the intrusion detection system to compare data in encrypted form to the keywords without, however, having direct access to these keywords in plain text.

[0020] Thus, according to the invention, only "trapdoors" generated by the security device itself from the keywords it has previously established are provided by the latter to the intrusion detection device. Providing these trapdoors allows the security device to avoid providing the keywords in plain text to the intrusion detection device. The use of a searchable encryption algorithm as proposed by the invention therefore advantageously allows the security vendor to keep the keywords it has established for intrusion detection secret from the intrusion detection device. The approach proposed by the invention is therefore perfectly compatible with the existing business models of security vendors: no detection rules, no keywords are provided in plain text by the security vendor to the intrusion detection device.

[0021] Furthermore, by providing only access points to the intrusion detection system without ever explicitly supplying the keywords associated with those access points, the invention standardizes the formats and semantics of the information used by the intrusion detection system to detect potential network attacks. This results in a simplified implementation at the intrusion detection system level.

[0022] It is important to note that the invention can be applied both in a context where the sending and receiving devices are both honest and in a context where at least one of these devices is "dishonest," that is, it may be the source of the intrusion perpetrated on the network (intentionally or unintentionally) or collaborate with the entity responsible for this intrusion. This corresponds, for example, to a case where a sending device, whose control has been taken by an attacker, transmits sensitive data that is received and expected by the receiving device. Such a context is of paramount importance given that today most attacks originate from the information systems themselves, via malware that takes control of the information system's endpoints.Therefore, both the sending and receiving devices can be easily compromised by a malicious remote entity that can take full or partial control of them (for example, an infected victim terminal can leak sensitive data to its master software through such a takeover). However, we will limit ourselves here to the case where both devices are "rogue" independently of each other, meaning that no prior agreement has been made between them (for example, to transmit sensitive data in a specific way by cutting and transmitting this data in such a way that the process would be ineffective in detecting how the data leak was carried out). Conversely, the approach proposed in the paper by J. Sherry et al. does not allow for the handling of a situation in which both the sending and receiving devices are rogue independently of each other.

[0023] In one particular embodiment, the trap derivation key is independent of a private decryption key of the receiving device associated with the public encryption key of the receiving device. For example, it is generated by the security device using the key generation algorithm associated with the searchable encryption algorithm. It is, of course, kept secret from the intrusion detection system in all cases.

[0024] The cryptographic key management proposed in this embodiment is particularly advantageous: having a trap derivation key independent of the receiving device's private decryption key allows the same trap derivation key to be used for different receiving devices communicating over the network. In other words, the traps associated with the keywords defined by the security device can be generated only once by the security device and then used by the intrusion detection device to manage multiple secure connections (e.g., SSL connections). It is not necessary to generate traps for each new secure connection that the intrusion detection device monitors. The invention in this embodiment therefore offers a substantial reduction in complexity compared to the scheme proposed in the document by Sherry et al.which requires the encryption of keywords by the proxy on each new connection between a sending device and a receiving device.

[0025] It also offers the possibility of easily and quickly taking into account an update of keywords by the security publisher, for example due to the emergence of new types of intrusions that may affect the network.

[0026] In a particular embodiment, the intrusion detection method, or the monitoring method, includes, after the test procedure application step, if no intrusion has been detected by the intrusion detection device: a reconstruction step, by the intrusion detection device, of an encrypted version of the message from the plurality of intercepted encrypted character strings; and a transmission step, by the intrusion detection device, of this encrypted version of the message to the receiving device.

[0027] Correspondingly, the intrusion detection device further includes a reconstruction module and a transmission module, activated by the test module when no intrusion has been detected on the network, the reconstruction module being configured to reconstruct an encrypted version of the message from the plurality of intercepted encrypted character strings, and the transmission module being configured to transmit this encrypted version of the message to the receiving device.

[0028] By transmitting to the receiving device an encrypted version of the message reconstructed by the intrusion detection system, this embodiment allows the receiving device to decrypt this encrypted version rather than a message generated directly by the sending device and not subject to any checks by the intrusion detection system. This embodiment thus allows the receiving device to protect itself against a malicious sending device that might, for example, send a message intended to be decrypted by the receiving device and containing a virus, while the plurality of character strings supposedly resulting from the segmentation of this message and intended to be analyzed by the intrusion detection system would be virus-free.By ensuring that the decryption performed by the receiving device is based on the encrypted version of the message reconstructed by the intrusion detection device, one can guard against such a situation.

[0029] In a particular embodiment, during the monitoring method supply step, the security device further provides the intrusion detection device with detection rules to be applied during the test step.

[0030] Providing detection rules in addition to keyword-associated traps allows the intrusion detection system to perform more comprehensive equality tests, for example, on Boolean combinations of keywords instead of isolated keywords. It should be noted that knowledge of these rules, which essentially structures the search performed by the intrusion detection system, is independent of knowledge of the keywords and does not require the security system to disclose the keywords to the intrusion detection system.

[0031] In a particular embodiment, the size of the resulting message strings is fixed according to the size of the keywords determined by the security device. Typically, slicing a message into k-dimensional strings, where k is an integer greater than 1, allows for testing keywords of dimension k. The slicing can be performed by the sending device using a sliding window of dimension k, which it moves one character at a time across the message. If keywords of different sizes are determined by the security device, such message slicing can be repeated for each different keyword size.

[0032] According to another aspect, the invention relates to a method of communication between a transmitting device and a receiving device via a network, this communication method using a searchable encryption algorithm defined by a key generation algorithm, an encryption / decryption procedure, a trap generation algorithm, and a testing procedure capable of using said traps, said communication method comprising: a step of splitting, by the sending device, a message intended for the receiving device into a plurality of character strings; a step of encrypting, by the sending device, the plurality of character strings by means of said encryption / decryption procedure and a public encryption key associated with the receiving device; a step of sending, by the sending device, said plurality of encrypted character strings to the receiving device, said plurality of encrypted character strings being intercepted by the intrusion detection device; a step of detecting intrusions in accordance with an intrusion detection method according to the invention using the searchable encryption algorithm; and a step of decrypting, by the receiving device, by means of said encryption / decryption procedure, an encrypted version of the message.

[0033] Correspondingly, the invention also relates to a communication system configured to use a searchable encryption algorithm, this searchable encryption algorithm being defined by a key generation algorithm, an encryption / decryption procedure, a trap generation algorithm, and a testing procedure capable of using said traps. The communication system comprises, according to the invention: a transmitting device and a receiving device capable of communicating via a network, said receiving device having a key pair comprising a public encryption key and a private decryption key; and an intrusion detection system on said network according to the invention and configured to use said searchable encryption algorithm, this detection system comprising a security device and an intrusion detection device according to the invention located in the network between the transmitting device and the receiving device; in which: The sending device includes: ∘ a slicing module, configured to slice a message intended for the receiving device into a plurality of character strings; ∘ an encryption module, configured to encrypt the plurality of character strings using said encryption / decryption procedure and the public encryption key associated with the receiving device; and ∘ a sending module, configured to send said plurality of encrypted character strings to the receiving device, said plurality of encrypted character strings being intercepted by the intrusion detection device; and the receiving device includes a decryption module, configured to decrypt, using said encryption / decryption procedure, an encrypted version of the message.

[0034] The communication method and system benefit from the same advantages as those mentioned previously for the intrusion monitoring and detection methods and for the intrusion detection device and system according to the invention.

[0035] It can also be envisaged, in other embodiments, that the intrusion detection method, the intrusion detection system, the communication method and the communication system according to the invention have in combination all or part of the aforementioned characteristics.

[0036] In a particular embodiment, the different stages of the intrusion detection process are determined by instructions from computer programs distributed across the security device and the instruction detection device.

[0037] Consequently, the invention also relates to a computer program on an information medium, this program being capable of being implemented in a security device or more generally in a computer, this program comprising instructions adapted to the implementation of the steps of generating a trap derivation key, generating traps and supplying the traps of an intrusion detection method as described above.

[0038] The invention also relates to a computer program on an information medium, this program being capable of being implemented in an intrusion detection device or more generally in a computer, this program comprising instructions adapted to the implementation of the interception, application and intrusion detection steps of an intrusion detection process as described above or adapted to the implementation of the steps of a surveillance process as described above.

[0039] Each of these programs can use any programming language, and be in the form of source code, object code, or code somewhere between source code and object code, such as in a partially compiled form, or in any other desirable form.

[0040] The invention also relates to a computer-readable information or recording medium, and comprising instructions for a computer program as mentioned above.

[0041] The information or recording medium can be any entity or device capable of storing the program. For example, the medium can include a storage means, such as a ROM, for example a CD-ROM or a microelectronic circuit ROM, or a magnetic recording means, for example a floppy disk or a hard disk drive.

[0042] On the other hand, the information or recording medium can be a transmissible medium such as an electrical or optical signal, which can be transmitted via an electrical or optical cable, by radio, or by other means. The program according to the invention can, in particular, be uploaded to a network such as the Internet.

[0043] Alternatively, the information or recording medium may be an integrated circuit in which the program is incorporated, the circuit being adapted to execute or to be used in the execution of the process in question. Brief description of the drawings

[0044] Other features and advantages of the present invention will become apparent from the description below, with reference to the accompanying drawings, which illustrate an example of an embodiment without being limiting in any way. In the figures: there figure 1 represents, schematically, a communications system according to the invention, in a particular embodiment; the figure 2 illustrates the hardware architecture of an intrusion detection device according to the invention, belonging to the communications system of the figure 1 ; and the figure 3, illustrates in diagram form the main steps of a communication method, an intrusion detection method and a monitoring method according to the invention in a particular embodiment in which they are implemented by the entities constituting the communication system of the figure 1 . Detailed description of the invention

[0045] There figure 1 represents, in its environment, a communications system 1 conforming to the invention, in a particular embodiment.

[0046] The communications system 1 includes: a transmitter device TX 2; a receiver device RX 3; and an intrusion detection system 4 according to the invention.

[0047] The transmitting device TX 2 and the receiving device RX 3 are capable of communicating with each other via a telecommunications network NW. There are no limitations regarding the nature of this network, except that communications between the transmitting device TX 2 and the receiving device RX 3 are secured using a cryptographic encryption algorithm, detailed later. The NW network can therefore be a public network such as the Internet or a private network, a fixed or mobile network, a wired or wireless network, and it can consist of a single network or multiple subnets, etc.

[0048] Intrusion detection system 4 is configured to enable the detection of intrusions likely to affect communications on the NW network, and more specifically here in the example considered in the figure 1, communications between the transmitting device TX 2 and the receiving device RX 3. For this purpose, it includes: an intrusion detection device MB 5 (also referred to as a "middlebox"), according to the invention, located in the NW network as a flow interrupt between each TX transmitting device capable of transmitting data on this network and each RX receiving device capable of receiving data via this network. In this case, in the example illustrated in the figure 1The intrusion detection device MB 5 is located in the NW network between the transmitting device TX 2 and the receiving device RX 3. It is configured to intercept communications on the NW network between these two devices. A security device RG 6, managed by (i.e., under the control of) a security vendor, is also involved. This vendor is capable of determining (i.e., establishing) a plurality of keywords (or patterns or signatures) characteristic of intrusions likely to affect the NW network, and, in the embodiment described here, one or more detection rules (RULs) specific to these keywords. Such detection rules define, for example, combinations of several keywords, such as logical combinations defined by means of logical or Boolean operators such as OR, AND, XOR (exclusive OR), etc.In the embodiment described here, the KEYW keywords and the RUL detection rules established by the security editor are stored in non-volatile memory (referenced by 6A on the . figure 2 ) of the RG 6 security device.

[0049] The method by which security vendors determine KEYW keywords and RUL detection rules is known and depends on each vendor's expertise. It is not described in detail here. It should be noted that KEYW keywords and the RUL detection rules associated with them are subject to change or updates, for example, following the emergence of new types of intrusions that could affect the NW network.

[0050] Furthermore, it's also worth noting that a single security vendor may interact with several distinct intrusion detection devices, whether located on the same network or on different networks. Similarly, an intrusion detection device located on a network may interact with multiple security vendors (and therefore with multiple security devices managed by those vendors). For the sake of simplicity, however, we will limit ourselves here to a single security vendor and a single intrusion detection device.

[0051] According to the invention, a deep penetration inspection (DPI) of the type is permitted on the NW network even though communications between the transmitting device TX 2 and the receiving device RX 3 are encrypted, without the security vendor being required to disclose to the intrusion detection device MB 5 the keywords it has established to detect intrusions affecting the NW network. Furthermore, this DPI inspection is permitted without the traffic exchanged between the transmitting device TX and the receiving device RX being disclosed to the intrusion detection device MB 5, even partially, so that the confidentiality of the exchange between the two devices is preserved and their privacy guaranteed.To this end, the invention relies on a searchable encryption algorithm denoted ALG-DSE (for Decryptable Searchable Encryption in English), and more particularly, in the embodiment described here, on the searchable encryption algorithm described in the article by T. Fuhr and P. Paillier entitled "Decryptable Searchable Encryption", ProvSec 2007, volume 4784 of Lecture Notes on Computer Science, pages 228-236, Springer, 2007.

[0052] As is known, such an algorithm is defined by several procedures detailed later, namely: a key generation algorithm denoted KEYGEN, parameterized by a security parameter λ known in itself, taken for example here equal to 128 bits, in accordance with the security recommendations in force; an encryption / decryption procedure comprising an encryption algorithm ENC and a decryption algorithm DEC; a trap generation algorithm TRAP (or “trapdoors” in English), denoted TRAPGEN; and a test procedure denoted TEST capable of using the traps generated via the TRAPGEN algorithm.

[0053] A TRAP is an element or piece of information that allows a specific action to be performed only when that trap is in possession. In this case, the TRAPs generated via the TRAPGEN trap generation algorithm allow the MB 5 intrusion detection device to perform equality tests defined by the TEST test procedure on the data packets exchanged (more generally referred to as messages in the description) between the TX 2 sending device and the RX 3 receiving device, provided that these data packets (messages) are encrypted using the ENC encryption procedure associated with the ALG-DSE searchable encryption algorithm.In this way, the invention makes it possible to disclose to the intrusion detection device MB 5 only the TRAP traps and to keep secret from the intrusion detection device MB 5 the keywords KEYW established by the security publisher and stored in the memory of the security device RG 6, for example in the non-volatile memory 6A.

[0054] In the embodiment described here, the MB 5 intrusion detection device has the architecture of a computer, as illustrated in the figure 2 . It includes in particular a processor 7, a random access memory 8, a read-only memory 9, a non-volatile flash memory 10 as well as communication means 11 enabling it, on the one hand, to intercept any communication between the transmitting device TX 2 and the receiving device RX 3 on the NW network, and on the other hand to communicate with the security device RG 6. Such means are known in themselves and are not described in more detail here.

[0055] The read-only memory 9 of the intrusion detection device MB 5 constitutes a recording medium according to the invention, readable by the processor 7 and on which is recorded here a computer program PROG according to the invention.

[0056] The PROG computer program defines functional and software modules configured to implement the steps of a network monitoring method and certain steps of an intrusion detection method according to the invention. These functional modules rely on and / or control the hardware components 7-11 of the MB 5 intrusion detection device mentioned above. They include, in particular, as illustrated in the figure 1 : an acquisition module 5A, capable of obtaining from the security device RG 6 the TRAP traps generated by the latter for the plurality of keywords KEYW, as well as, in the embodiment described here, the detection rules RUL; an interception module 5B, configured to intercept a plurality of encrypted character strings, also commonly called "encrypted tokens" and denoted TOK here, transmitted on the NW network by the transmitting device TX 2 to the receiving device RX 3. As detailed later, the character strings that are encrypted come from the parsing of a message M produced by the transmitting device TX 2 and intended for the receiving device RX 3; a test module 5C, configured to apply the TEST test procedure associated with the searchable encryption algorithm ALG-DSE on the plurality of encrypted character strings TOK intercepted by the interception module 5B.The TEST test procedure uses the traps obtained by the acquisition module 5A to detect if there is at least one ciphertext string among the ciphertext strings TOK intercepted by the interception module 5B representative of a ciphertext of at least one keyword among the keywords KEYW; and a network intrusion detection module 5D, activated if the test module 5C detects the existence of such an intercepted ciphertext string.

[0057] In the embodiment described here, the computer program further defines two other functional modules, activated by the test module when no intrusion has been detected on the network, namely: a reconstruction module 5E configured to reconstruct an encrypted vENC(M) version of the message M produced by the transmitting device TX 2 from the plurality of encrypted character strings TOK intercepted by the intercepting module 5B; and a transmission module 5F, configured to control the communication means 11 of the intrusion detection device to transmit this encrypted vENC(M) version of the message M to the receiving device RX 3.

[0058] The functions of these different 5A-5F modules are described in more detail later.

[0059] The RG 6 security device also has the hardware architecture of a computer, identical to that of the MB 5 intrusion detection device. This architecture comprises a processor, RAM, ROM, 6A non-volatile flash memory, and communication means enabling it to communicate with the MB 5 intrusion detection device. The ROM of the security device serves as a storage medium, readable by the security device's processor, on which a computer program is stored. This program defines functional modules configured to implement certain steps of the intrusion detection process according to the invention. These functional modules rely on and / or control the hardware components of the RG 6 security device mentioned above. They include, in particular, as illustrated in the... figure 1 : a 6B key generation module configured to generate, using the KEYGEN key generation algorithm of the ALG-DSE searchable cipher algorithm, a trapdoor derivation key denoted tk(RG) for the RG 6 security device; a 6C trapdoor generation module configured to generate a trapdoor for each keyword of the KEYW keyword plurality using the TRAPGEN trapdoor generation algorithm of the ALG-DSE searchable cipher algorithm, parameterized by the trapdoor derivation key tk(RG), each trapdoor generated for a keyword enabling the detection of a character string representative of a ciphertext of that keyword obtained using the ENC encryption procedure of the ALG-DSE searchable cipher algorithm;and a 6D supply module controlling the communication means of the RG 6 security device, and configured to provide the TRAP hatches generated for the keywords KEYW to the intrusion detection device MB 5 while keeping the keywords KEYW secret from the intrusion detection device MB 5. ;

[0060] The functions of these different 6B-6D modules are described in more detail later.

[0061] It should be noted that there are no limitations regarding the nature of the transmitting device TX 2 and the receiving device RX 3. They can be computers, servers, or any terminals, provided they are capable of communicating securely over the NW network using the ENC encryption / DEC decryption procedure associated with the searchable ALG-DSE encryption algorithm. In the embodiment described here, this encryption / decryption procedure is an asymmetric encryption / decryption procedure based on a key pair generated for the receiving device RX 3, comprising a public encryption key pk(RX) and a private decryption key sk(RX) kept secret by the receiving device RX 3.

[0062] In the embodiment described here, the transmitter TX 2 and receiver RX 3 devices have the hardware architecture of a computer, this architecture being identical to that of the intrusion detection device MB 5, namely that they include a processor, RAM, ROM, non-volatile flash memory, as well as means of communication enabling them to communicate on the NW network.

[0063] The read-only memory (ROM) of the TX 2 transmitter constitutes a storage medium, readable by the processor of the TX 2 transmitter, on which is stored a computer program defining functional modules that rely on and / or control the hardware components of the TX 2 transmitter mentioned previously. These functional modules include, in particular, as illustrated in the... figure 1 : a 2A slicing module, configured to slice a message M produced by the transmitting device TX 2 and intended for the receiving device RX 3 into a plurality of character strings or "tokens"; a 2B encryption module, configured to encrypt the plurality of character strings using said ENC encryption procedure of the ALG-DSE searchable encryption algorithm and the pk(RX) encryption public key of the receiving device; and a 2C transmission module, configured to transmit said plurality of encrypted character strings TOK to the receiving device RX 3 via the NW network.

[0064] Furthermore, the read-only memory of the RX 3 receiver serves as a storage medium, readable by the RX 3 receiver's processor, and on which is stored a computer program defining functional modules that rely on and / or control the hardware components of the RX 3 receiver mentioned previously. These functional modules include, in particular, as illustrated in the... figure 1 : a 3A key generation module, configured to execute the KEYGEN key generation algorithm of the ALG-DSE searchable encryption algorithm to generate the public key pair pk(RX) and private key pair sk(RX) of the receiving device RX 3; and a 3B decryption module, configured to decrypt using the DEC decryption procedure of the ALG-DSE searchable encryption algorithm an encrypted version vENC(M) of the message M reconstructed and transmitted by the intrusion detection device MB 5.

[0065] The functions of the different modules 2A-2C and 3A, 3B of the transmitter TX 2 and receiver RX 3 devices are described in more detail later.

[0066] It is noted that in another embodiment, the public / private key pair allocated to the receiving device RX 3 can be generated by a trusted authority and then transmitted by that authority to the receiving device RX 3, the public encryption key pk(RX) being made public elsewhere, in particular with respect to the sending device TX 2.

[0067] Furthermore, in the embodiment described here, device 2 is assumed to be the sender of message M and device 3 the recipient of this message. These roles are interchangeable, of course, and device 2 can be equipped with modules identical to modules 3A and 3B of device 3 to receive encrypted messages via the NW network, just as device 3 can be equipped with modules identical to modules 2A-2C of device 2 to send encrypted messages on the NW network.

[0068] We will now describe, with reference to the figure 3 , the main steps of a communication method according to the invention as implemented by the communication system 1 of the figure 1 As will become apparent from the description, this communication method incorporates the steps of an intrusion detection method according to the invention as implemented by the intrusion detection system 4 of the figure 1 , itself incorporating the steps of a NW network monitoring process as implemented by the MB 5 intrusion detection device of the figure 1 .

[0069] It is assumed here that during an initialization phase, the RG 6 security device generates its trapdoor derivation key tk(RG) by executing, via its 6A module, the KEYGEN key generation algorithm of the ALG-DSE searchable encryption algorithm, parameterized by the security parameter λ, where λ = 128 bits (step E10). This trapdoor derivation key tk(RG) is kept secret by the RG 6 security device.

[0070] In one embodiment, the trapdoor derivation key tk(RG) is derived by a trusted authority equipped with a key generation module using the KEYGEN key generation algorithm of the ALG-DSE searchable cipher algorithm, parameterized by the security parameter λ. In this embodiment, the trusted authority then securely transmits the trapdoor derivation key tk(RG) to the RG 6 security device.

[0071] Furthermore, during the initialization phase, each receiving device, and more specifically the receiving device RX 3, also executes, via its 3A module, the KEYGEN key generation algorithm of the ALG-DSE searchable encryption algorithm, parameterized by the security parameter λ=128 bits, to generate its public key pair pk(RX) and private key pair sk(RX) (step E20). The public key pk(RX) of the receiving device RX 3 is shared with the sending device TX 2 (step E30).

[0072] It should be noted that, in the embodiment described here, as mentioned previously, the searchable encryption algorithm used by the communication system 1 is the algorithm described in the article by Fuhr and Paillier. This algorithm is remarkable in that the key generation algorithm KEYGEN associated with it allows the generation of a trapdoor derivation key tk(RG) for the security device RG 6 that is independent of the private key sk(RX) generated for the receiving device RX 3.

[0073] In one embodiment, the RG 6 security device uses a first key generation algorithm to generate the trapdoor derivation key tk(RG), while the RX 3 receiving device uses a second key generation algorithm to independently generate the public key pair pk(RG) / private key sk(RG) from the trapdoor derivation key tk(RG), the first and second algorithms being distinct and independent of each other.

[0074] Following the generation of its trap derivation key tk(RG), the RG 6 security device generates, via its module 6C, a TRAP(ki) trap for each keyword ki of the plurality of keywords KEYW stored in its non-volatile memory 6A, i=1,...,N where N denotes an integer greater than 1 (step E40). To this end, module 6C executes the TRAPGEN trap generation algorithm parameterized by its trap derivation key tk(RG). As is known, as mentioned in the previously cited article by Fuhr and Paillier, each TRAP(ki) generated for a keyword ki allows the detection of a string of characters representing a ciphertext of that keyword obtained using the ENC encryption procedure of the ALG-DSE searchable cipher algorithm.

[0075] Then, the RG 6 security device, via its 6D supply module and its communication means, provides the TRAP traps thus generated for the different keywords of the KEYW plurality to the MB 5 intrusion detection device (step E50). In the embodiment described here, the 6D supply module also provides the MB 5 intrusion detection device with the RUL detection rules, having first substituted the relevant keywords for their associated traps within these RUL detection rules. In the embodiment described here, the RUL detection rules allow the encrypted exchanges between the TX 2 transmitting device and the RX 3 receiving device to search for logical combinations of keywords in addition to the keywords taken individually.They define equivalently, by substituting the keywords with the associated traps, logical combinations of traps to be sought in the encrypted traffic exchanged between the transmitting device TX 2 and the receiving device RX 3, and are transmitted in this form by the security device RG 6 to the intrusion detection device MB 5.

[0076] It is noted that the transmission of the TRAP traps and the RUL detection rules by the RG 6 security device to the MB 5 intrusion detection device is done without disclosing the KEYW keywords to the MB 5 intrusion detection device. In other words, at all times, the plurality of KEYW keywords established by the RG 6 security device is kept secret from the MB 5 intrusion detection device, i.e., the MB 5 intrusion detection device never has knowledge of these keywords.

[0077] Furthermore, due to the independence of the trap derivation key tk(RG) and the private key sk(RX), the TRAP traps generated by the RG 6 security device and transmitted to the MB 5 intrusion detection device can be used by the latter to process exchanges between the TX 2 transmitter and the RX 3 receiver, as well as between other transmitter / receiver pairs. It is not necessary to generate new traps for each connection between a transmitter and a receiver.

[0078] The TRAP traps and RUL detection rules are stored by the MB 5 intrusion detection device in its non-volatile memory 10 (step E60).

[0079] We now assume that the transmitting device TX 2 wishes to send a message M to the receiving device RX 3. The message M may consist of one or more data packets. For the sake of simplicity, we will consider a single data packet in the following description.

[0080] According to the invention, the message M is segmented ("tokenized" or "parsed") by the TX 2 transmitting device via its segmentation module 2A into a plurality of character strings called tokens (step E70). In the embodiment described here, the size of the tokens resulting from the segmentation of the message M is fixed according to the size of the keywords determined by the RG 6 security device.

[0081] More specifically, suppose that the message M is composed of L bits M1,...,ML, and that the keywords specified by the security device RG 6 are of sizes k=3, 4 or 5 bits.

[0082] In the embodiment described here, for each possible size k of keywords, the message M is sliced ​​by module 2A by applying to the message M a sliding window of k bits, shifted successively by 1 bit, so as to obtain the following strings of characters wj (tokens): w1(k)=[M1,M2,...,Mk], w2(k)=[M2,M3...,Mk+1], w3(k)=[M3,M4,...,Mk+2], etc. until complete scanning of the message M.

[0083] Note that the size of the keywords determined by the RG 6 security device can be configured beforehand within the 2A switching module (for example, on indication from the RG 6 security device), or default sizes can be predefined at the level of the TX 2 transmitting device.

[0084] In another variant, the TX 2 transmitting device can apply a different type of segmentation, for example, independent of keyword length. This segmentation can rely, for instance, on the presence of specific delimiters in the message M (e.g., tags, particular typographic characters) which naturally divide the message M into several strings. It should be noted that in this variant, there is no redundancy between the strings obtained by module 2A, unlike the embodiment described herein.

[0085] In yet another variant, the TX 2 sending device breaks the message M into fixed-size character strings, known to the RG 6 security device, and it is the RG 6 security device that breaks the keywords KEYW when their size is greater than the fixed size used by the TX 2 sending device. In this case, the redundancy introduced is limited.

[0086] Then, the character strings thus obtained by module 2A for each size k are encrypted by encryption module 2B (step E80). For this purpose, encryption module 2B uses the ENC encryption procedure of the ALG-DSE searchable encryption algorithm using (i.e., parameterized by) the public encryption key pk(RX) of the receiving device RX 3. At the end of this step, it obtains a plurality of encrypted character strings or encrypted tokens TOK.

[0087] The transmitting device TX 2, via its transmitting module 2C and its communication means, then transmits the plurality of encrypted character strings TOK on the NW network to the receiving device RX 3 (step E90).

[0088] The plurality of encrypted TOK character strings emitted on the NW network by the TX 2 transmitting device is intercepted by the MB 5 intrusion detection device (step E100).

[0089] The MB 5 intrusion detection device then applies, via its 5C test module, to the plurality of intercepted encrypted TOK character strings, the TEST test procedure of the searchable encryption algorithm ALG-DSE (step E110).

[0090] To this end, it proceeds as described in the article by Fuhr and Paillier cited above, using the TRAP traps and the RUL detection rules obtained at step E50 of the RG 6 safety device and stored in its non-volatile memory 10.

[0091] More specifically, for each distinct keyword size k, the 5C test module uses the ciphertext strings wj(k) corresponding to that keyword size k from among the intercepted TOK strings, and determines, by executing the TEST test procedure on each ciphertext string wj(k) using each of the TRAP(i) traps corresponding to a keyword of dimension k determined by the RG 6 security device, whether one of the wj(k) strings corresponds to a keyword ki of dimension k. In the example considered here, the TEST test procedure is configured to provide a "1" if a match exists (i.e., the tested ciphertext string corresponds according to the TRAP(i) trap to a ciphertext of a keyword ki defined by the RG 6 security device and associated with the TRAP(i) trap), and a "0" otherwise.

[0092] Since the TEST procedure used is identical to that described in the previously cited article by Fuhr and Paillier, it is not described in detail here. It is applied by the 5C test module to each intercepted encrypted string and to each trap provided by the RG 6 security device. When RUL detection rules are further specified, the 5C test module evaluates the RUL detection rules, based on the results obtained for each trap independently, as regular expressions applied to the set of traps defining these RUL detection rules. The result of evaluating an RUL detection rule is 1 if the regular expression defined on the traps is verified, given the results of the test procedures applied to these traps, and 0 otherwise.

[0093] If the 5C test module detects the presence of a match between at least one of the intercepted encrypted strings and at least one keyword trap provided by the RG 6 security device (when RUL detection rules are specified, this means that a match is detected by the 5C test module between intercepted encrypted strings and a detection rule defined from keyword traps, which matches where the regular expression defined by this RUL detection rule is equal to 1) (yes answer in test step E120), then the 5C test module notifies the 5D detection module of this match (step E130): the existence of such a match and its notification to the 5D module constitute a network intrusion detection step within the meaning of the invention.

[0094] Depending on its configuration, the MB 5 intrusion detection device can take various actions. For example, it can notify the network administrator of the detection via its 5D module and communication means 11. Alternatively, the MB 5 intrusion detection device can delete the suspicious data packet, i.e., the TOK tokens associated with it, and prevent their transmission to the RX 3 receiving device, as these tokens are corrupted, etc.

[0095] In the embodiment described here, if it results that no TOK character string corresponds to a ciphertext of a keyword after successive application of the TEST test procedure to all the ciphertext character strings, to all the TRAP traps provided by the RG 6 security device and to all the RUL detection rules (response "no" in test step E120), then this means that no intrusion has been detected by the MB 5 intrusion detection device on the TOK ciphertext character strings intercepted between the TX 2 sending device and the RX 3 receiving device. In the embodiment described here, in such a case, the MB 5 intrusion detection device, via its reconstruction module 5E, then proceeds to reconstruct a v-ENC(M) encrypted version of the message M from the plurality of intercepted TOK ciphertext character strings (step E140).This reconstruction can be easily done by keeping only the encrypted character strings corresponding to distinct and successive characters of the message M, and concatenating these character strings. For example v-ENC(M)=w1(k),wk+1(k),wk+2(k),.

[0096] Alternatively, another reconstruction algorithm can be used by the reconstruction module 5E to determine an encrypted version of the message M. This algorithm can take into account, in particular, the redundancy available where applicable in the plurality of encrypted character strings TOK intercepted by the intrusion detection device MB 5 due to the segmentation applied by the transmitting device TX 2. It should be noted, however, that if the segmentation implemented is based on delimiters, there is no redundancy between the tokens.

[0097] Then the intrusion detection device MB 5 transmits the encrypted v-ENC(M) version of the message M thus reconstructed to the receiving device RX 3 via its transmission module 5F and its means of communication on the NW network (step E150).

[0098] Upon receiving the v-ENC(M) encrypted version of message M, the receiving device RX 3, via its decryption module 3B, decrypts the v-ENC(M) encrypted version (step E160). To this end, it uses the DEC decryption procedure of the ALG-DSE searchable encryption algorithm and its private decryption key sk(RX), in a manner known per se.

[0099] The invention thus enables, through the use of the searchable ALG-DSE encryption algorithm, the application of a deep inspection procedure to the encrypted traffic exchanged between the transmitting device TX 2 and the receiving device RX 3 without the intrusion detection device MB 5 having knowledge of the keywords defined by the security device RG 6. It should be noted that in the embodiment described here, the searchable ALG-DSE encryption algorithm is considered to be the algorithm proposed by Fuhr and Paillier in the previously cited article. This algorithm has the particularity and advantage of allowing the generation of a trap derivation key independent of the secret decryption key of the receiving device.However, this hypothesis is not limiting in itself, and other searchable encryption algorithms can be considered for the implementation of the invention, including in particular algorithms for which such independence is not assured, as for example in the article by D. Boneh and G. Di Crescenzo entitled "Public Key Encryption with keyword search", Advances in Cryptology, EUROCRYPT 2004, volume 3027 of the Lecture Notes in Computer Science series, pages 506-522.

[0100] Furthermore, in the embodiment described here, the invention accommodates the scenario where both the transmitting device TX 2 and the receiving device RX 3 are compromised to some degree. Indeed, the encrypted version of the message M that the receiving device RX 3 decrypts is the version tested and reconstructed by the intrusion detection device MB 5. Thus, a transmitting device TX 2, if taken over by an attacker and therefore compromised, could transmit sensitive data or viruses under the attacker's control. However, such a transmission would be detected by the intrusion detection device MB 5. This device tests and reconstructs the encrypted version of the message M. It is therefore capable of detecting the transmission of sensitive data or viruses during this test.

[0101] It should be noted, however, that as an alternative, a less secure embodiment can be considered in which the transmitting device TX 2, in addition to the encrypted character strings TOK, transmits an encrypted version of message M to the receiving device RX 3. If no intrusion is detected by the device MB 5, this encrypted version of message M is transmitted to the receiving device RX 3 and decrypted by it. It is clear, however, that in this embodiment, a rogue transmitting device TX 2 could transmit encrypted character strings containing no malware, while introducing malware only in the encrypted version of message M. Unfortunately, such a situation could not be detected by the intrusion detection device MB 5.

Claims

1. Method for detecting intrusions on a network (NW) via which a sender device (TX 2) and a receiver device (RX 3) communicate, this detection method using a searchable encryption algorithm defined by a key generation algorithm, an encryption / decryption procedure, a trapdoor generation algorithm, and a test procedure able to use said trapdoors, said detection method comprising: - a step (E10) of generating, by way of said key generation algorithm, a trapdoor bypass key (tk(RG)) intended for a security device (RG 6) able to determine a plurality of keywords (KEYW) characteristic of intrusions liable to affect the network; - a step (E40) of generating, by the security device, a trapdoor (TRAP) for each keyword of said plurality of keywords using said trapdoor generation algorithm parameterized by the trapdoor bypass key, each trapdoor generated for a keyword making it possible to detect a character string representative of a cipher of this keyword obtained by way of said encryption / decryption procedure; - a step (E50) of providing, by the security device, the trapdoors (TRAP) generated for said plurality of keywords to an intrusion detection device (MB 5) located in the network between the sender device and the receiver device; - a step (E100) of intercepting, by the intrusion detection device (MB 5), a plurality of encrypted character strings (TOK) sent on the network by the sender device to the receiver device, said plurality of encrypted character strings resulting from the encryption of a plurality of character strings resulting from the sender device dividing a message intended for the receiver device, said encryption being performed by way of said encryption / decryption procedure and of a public encryption key (pk(RX)) associated with the receiver device; - a step (E110) of applying, by the intrusion detection device, the test procedure to the plurality of intercepted encrypted character strings, said test procedure using the trapdoors provided by the security device in order to detect whether there is at least one encrypted character string from among said plurality of intercepted encrypted character strings representative of at least one cipher of a keyword from among said plurality of keywords; and - a step (E130) of detecting an intrusion on the network if the intrusion detection device detects the existence of such an intercepted encrypted character string.

2. Detection method according to Claim 1, wherein the trapdoor bypass key (tk(RG)) is independent of a private decryption key of the receiver device (RX 3) associated with the public encryption key (pk(RX)) of said receiver device.

3. Detection method according to Claim 2, wherein said trapdoor bypass key is generated by the security device.

4. Detection method according to any one of Claims 1 to 3, furthermore comprising, after the step of applying the test procedure, if no intrusion has been detected by the intrusion detection device: - a step (E140) of reconstructing, by the intrusion detection device, an encrypted version of the message from the plurality of intercepted encrypted character strings; and - a step (E150) of transmitting, by the intrusion detection device, this encrypted version of the message to the receiver device.

5. Detection method according to any one of Claims 1 to 4, wherein, in the provision step, the security device furthermore provides the intrusion detection device with detection rules (RUL) to be applied in the test step.

6. Detection method according to any one of Claims 1 to 5, wherein the keywords determined by the security device are kept secret from the intrusion detection device by the security device.

7. Method for communication between a sender device (TX 2) and a receiver device (RX 3) via a network (NW), this communication method using a searchable encryption algorithm defined by a key generation algorithm, an encryption / decryption procedure, a trapdoor generation algorithm, and a test procedure able to use said trapdoors, said communication method comprising: - a step (E70) of dividing, by the sender device, a message (M) intended for the receiver device into a plurality of character strings; - a step (E80) of encrypting, by the sender device, the plurality of character strings by way of said encryption / decryption procedure and of a public encryption key associated with the receiver device; - a step (E90) of sending, by the sender device, said plurality of encrypted character strings (TOK) to the receiver device, said plurality of encrypted character strings being intercepted by the intrusion detection device; - a step of detecting intrusions in accordance with an intrusion detection method according to any one of Claims 1 to 6 using said searchable encryption algorithm; and - a step (E160) of decrypting, by the receiver device, an encrypted version of the message by way of said encryption / decryption procedure.

8. Communication method according to Claim 7, wherein the size of the character strings resulting from the message being divided is set depending on the size of the keywords determined by the security device.

9. Method for monitoring a network by an intrusion detection device (MB 5) by way of a searchable encryption algorithm defined by a key generation algorithm, an encryption / decryption procedure, a trapdoor generation algorithm, and a test procedure able to use said trapdoors, said intrusion detection device being located on the network between a sender device and a receiver device, said monitoring method comprising: - a step (E50) of obtaining, from a security device having a plurality of keywords (KEYW) characteristic of intrusions liable to be committed on the network, a plurality of trapdoors (TRAP) generated by the security device for said plurality of keywords by using said trapdoor generation algorithm parameterized by a trapdoor bypass key generated for the security device by way of said key generation algorithm, said keywords being kept secret from the intrusion detection device by the security device; - a step (E100) of intercepting a plurality of encrypted character strings (TOK) sent on the network by the sender device to the receiver device, said plurality of encrypted character strings resulting from the encryption of a plurality of character strings resulting from the sender device dividing a message intended for the receiver device, said encryption being performed by way of said encryption / decryption procedure and of a public encryption key associated with the receiver device; - a step (E110) of applying the test procedure to the plurality of intercepted encrypted character strings, said test procedure using the trapdoors provided by the security device to detect whether there is at least one encrypted character string from among said plurality of intercepted encrypted character strings representative of at least one cipher of a keyword from among said plurality of keywords; and - a step (E130) of detecting an intrusion on the network if the intrusion detection device detects the existence of such an intercepted encrypted character string.

10. Device (MB 5) for detecting intrusions on a network (NW), configured so as to use a searchable encryption algorithm defined by a key generation algorithm, an encryption / decryption procedure, a trapdoor generation algorithm, and a test procedure able to use said trapdoors, said intrusion detection device being intended to be located on the network between a sender device and a receiver device and comprising: - an obtaining module (5A), able to obtain, from a security device having a plurality of keywords characteristic of intrusions liable to be committed on the network, a plurality of trapdoors generated by the security device for said plurality of keywords by using said trapdoor generation algorithm parameterized by a trapdoor bypass key generated for the security device by way of said key generation algorithm, said keywords not being known to the intrusion detection device; - an interception module (5B), configured so as to intercept a plurality of encrypted character strings sent on the network by the sender device to the receiver device, said plurality of encrypted character strings resulting from the encryption of a plurality of character strings resulting from the sender device dividing a message intended for the receiver device, said encryption being performed by way of said encryption / decryption procedure and of a public encryption key associated with the receiver device; - a test module (5C), configured so as to apply said test procedure to the plurality of intercepted encrypted character strings, this test procedure using the trapdoors obtained from the security device in order to detect whether there is at least one encrypted character string from among said plurality of intercepted encrypted character strings representative of at least one cipher of a keyword from among said plurality of keywords; and - a module (5D) for detecting the existence of an intrusion affecting the network, activated if the test module detects the existence of such an intercepted encrypted character string.

11. Intrusion detection device (5) according to Claim 10, furthermore comprising a reconstruction module (5E) and a transmission module (5F), which are activated by the test module when no intrusion has been detected on the network, said reconstruction module being configured so as to reconstruct an encrypted version of the message from the plurality of intercepted encrypted character strings, and the transmission module being configured so as to transmit this encrypted version of the message to the receiver device.

12. System (4) for detecting intrusions on a network via which a sender device and a receiver device are able to communicate, this detection system being configured so as to use a searchable encryption algorithm defined by a key generation algorithm, an encryption / decryption procedure, a trapdoor generation algorithm, and a test procedure able to use said trapdoors, the detection system comprising: - a security device (RG 6), able to determine a plurality of keywords characteristic of intrusions liable to affect the network; - an intrusion detection device (MB 5) according to Claim 10 or 11 located in the network between the sender device and the receiver device; and - at least one key generation module (6B) configured so as to generate a trapdoor bypass key intended for the security device by way of the key generation algorithm; and wherein the security device (RG 6) comprises: - a trapdoor generation module (6C) configured so as to generate a trapdoor for each keyword of said plurality of keywords by using said trapdoor generation algorithm parameterized by the trapdoor bypass key, each trapdoor generated for a keyword making it possible to detect a character string representative of a cipher of this keyword obtained by way of the encryption / decryption procedure; and - a provision module (6D), configured so as to provide the trapdoors generated for the keywords to the intrusion detection device.

13. Communication system (1) configured so as to use a searchable encryption algorithm, said searchable encryption algorithm being defined by a key generation algorithm, an encryption / decryption procedure, a trapdoor generation algorithm, and a test procedure able to use said trapdoors, said communication system comprising: - a sender device (2) and a receiver device (3) that are able to communicate via a network (NW), said receiver device having a key pair comprising a public encryption key and a private decryption key; and - a system (4) for detecting intrusions on said network according to Claim 12 and configured so as to use said searchable encryption algorithm, said detection system comprising a security device (6) and an intrusion detection device (5) according to Claim 10 or 11 located in the network between the sender device and the receiver device; wherein: - the sender device (2) comprises: ∘ a division module (2A), configured so as to divide a message intended for the receiver device into a plurality of character strings; ∘ an encryption module (2B), configured so as to encrypt the plurality of character strings by way of said encryption / decryption procedure and of the public encryption key associated with the receiver device; and ∘ a sending module (2C), configured so as to send said plurality of encrypted character strings to the receiver device, said plurality of encrypted character strings being intercepted by the intrusion detection device; and - the receiver device (3) comprises a decryption module (3B), configured so as to decrypt an encrypted version of the message by way of said encryption / decryption procedure.

14. Computer program including instructions for executing the steps of the monitoring method according to Claim 9 when said program is executed by a computer.

15. Computer-readable recording medium on which there is recorded a computer program comprising instructions for executing the steps of the monitoring method according to Claim 9.