SECURE MANAGEMENT OF A LOCAL COMMUNICATIONS NETWORK WITH AT LEAST ONE COMMUNICATING OBJECT

Description

1. Field of the invention

[0001] The field of the invention is that of local communication networks, in particular, but not exclusively, domestic communication networks, comprising access equipment or gateway and a plurality of communicating objects, such as computers, tablets, smart phones (in English "smartphones"), but also webcam-type cameras, weather stations, sensors, thermostats, etc.

[0002] More specifically, the invention relates to the management of a security policy within such a local communication network. 2. Prior art and his disadvantages

[0003] Currently, when a communicating object is connected to a communication network and wishes to exchange data on this network, it is necessary to obtain certain configuration parameters, and in particular an IP address (for the English "Internet Protocol"). The most commonly used automatic configuration protocol for this is the DHCP protocol (for the English "Dynamic Host Configuration Protocol").

[0004] Typically, the communicating object broadcasts a datagram on the network DHCP DISCOVER. Upon receipt, a DHCP server, present for example in the network access gateway, sends an offer in response to the communicating object DHCP OFFER, if it is able to offer an address on the network to which the communicating object belongs. Such a DHCP offer includes the IP address of the server, as well as the IP address and subnet mask that it offers to the communicating object.

[0005] If it accepts this offer, the communicating object broadcasts a DHCP request datagram on the network ( DHCP REQUEST ), which includes the server's IP address and the one that has just been proposed to it. Its effect, in particular, is to ask the DHCP server to assign this address, and possibly send the values of certain parameters.

[0006] The DHCP server generates an acknowledgment datagram ( DHCP ACK For acknowledgment ) which assigns to the communicating object the IP address and its subnet mask, the lease duration of this address, and possibly other parameters, including the IP address of the default gateway, and the IP addresses of the DNS servers.

[0007] The DHCP server, which is most often integrated into the local network access gateway (the residential gateway in the case of a home network), thus allocates configuration parameters, of the same nature and scope, to all communicating objects on the network that request them, allowing them, on the one hand, to access the resources and data of the local network, and on the other hand, to access the global Internet network.

[0008] While this posed few problems at the beginning of local area networks, when only one or two personal computers of the PC type were present on the network, the multiplication of the number of communicating objects, of all types and from all sources, poses security problems for this approach.

[0009] Indeed, there is an increased risk that one of these communicating objects may have one or more security flaws that could allow a malicious individual to penetrate the local network, for example by installing malicious software (in English "malware") on the communicating object, with a view to carrying out malicious activities, such as data theft or a denial of service attack, for example.

[0010] The addition by a user of a communicating object on a local communication network, whether connected in wired mode by an Ethernet cable ®< , or wirelessly on a Wi-Fi type network in WPA2 mode (for "Wi-Fi Protected Access 2"), guarantees, as a general rule, that this communicating object has been voluntarily connected by the network administrator.

[0011] However, this administrator or user may not be aware of the existence of security flaws on this communicating object, especially since these security flaws are associated with a given version of software embedded on the communicating object. Thus, an object that is a priori reliable may cease to be so, following an update of its "firmware" (in French "micrologiciel", or "embedded software"), without the user realizing it.

[0012] To solve this problem, it was considered to classify the communicating objects of a local communication network into trust categories (i.e. the category of secure objects, the category of insecure objects, etc.), and to statically allocate common access rules to all communicating objects of the same trust category, within the network. This provides a protection mechanism allowing the static isolation of a group of equipment or communicating objects.

[0013] However, in practice it proves complex to define security or access rules that can be common to all communicating objects of the same trust category, these access or security rules being in practice closely linked to the specificities and functions of a particular communicating object. Thus, a webcam and a weather station can belong to the same trust category, but have very different needs in terms of activity and connection: for example, the webcam can, in normal operation, send video streams corresponding to the surveillance of a home to an address external to the local communication network, while such a practice corresponds a priori to a deviant operation for a weather station.For example, patent document US2017 / 0118240 A1 discloses a system for detecting security threats in a local network, making it possible to apply one or more predetermined security rules upon detection of a threat or malicious behavior.

[0014] There is therefore a need for a technique for securely managing a local communication network that does not have these various drawbacks of the prior art. In particular, there is a need for such a technique that allows for better consideration of the specific communication needs of each communicating object. 3. Statement of the invention

[0015] The invention meets this need by proposing a method for managing a local communication network according to claim 1.

[0016] Thus, the invention is based on a completely new and inventive approach to the management of security rules which apply to equipment in a local communication network, such as a home network for example.

[0017] Indeed, the invention proposes to define security rules specific to each communicating object, according to the communication needs of the object considered.

[0018] During a first learning phase, which is initiated upon detection of the connection of a new communicating object in the network, or upon detection of the firmware update of a communicating object already present in the network, the connections necessary for operation described as "normal" of the connected object to its network ecosystem are observed, including the other equipment of the local communication network, but also the remote equipment of a wide-area communication network to which the communicating object can access via the access equipment or the residential gateway. It is in fact assumed that, during its initial connection to the local communication network, the communicating object has behavior that can be described as "normal" or "healthy", and is therefore not a priori configured to carry out malicious activities.

[0019] During this learning phase, we therefore observe all the interactions of the communicating object with other equipment, in terms of the nature, volume and frequency of incoming and outgoing data, and the addresses of the equipment contacted. The observation data is, for example, recorded in a database, then analyzed by inductive logic programming, or fuzzy logic, or any other machine learning method, in order to deduce a set of precepts characteristic of “normal” operation of the communicating object.

[0020] Based on these precepts, a set of one or more security rules specific to the communicating object whose operation has been observed is then created. These security rules are a priori only applicable to this communicating object.

[0021] According to a first aspect, the security rule(s) associated with said communicating object comprise a list of at least one piece of equipment of said local communication network and / or of said wide-area communication network to which said communicating object is authorized to access.

[0022] This allows for the creation of a white list of addresses that the communicating object is authorized to contact in the context of normal activity. All other accesses that it might attempt are considered to belong to a black list, which may or may not be defined.

[0023] According to another aspect, the security rule(s) associated with said communicating object include a maximum volume of data that the communicating object is authorized to exchange.

[0024] Indeed, a communicating object such as a temperature sensor, for example, is only intended to exchange small quantities of data, for example in the form of data packets containing the measured temperature, possibly time-stamped. It is therefore possible to define a maximum size of the data packets that the sensor must normally transmit, expressed in bytes or kilobytes, or a maximum authorized volume of data, corresponding to all the data packets that it must normally send, over a defined time range, for example per hour.

[0025] Sending by this sensor a volume of data greater than this maximum volume authorized by the established security rule is indicative of deviant behavior, or malicious activity.

[0026] According to another aspect, the security rule(s) associated with said communicating object include a maximum number of access requests that said communicating object is authorized to issue. A massive sending of requests by a communicating object may indeed be indicative of deviant behavior, such as participation in a botnet attack (from the English, contraction of “robot” and “network”).

[0027] According to another aspect, the learning phase has a duration that can be configured by a manager of the local communication network. This duration can take the form of a time duration (number of hours, number of days), or a number of requests that will be issued by the communicating object. It can be configured by the manager of the local network (for example the administrator user of this network, or a manager of the access provider of this local network) depending on the type of communicating object, the learning algorithm used for the creation of the security rules, etc.

[0028] According to yet another aspect, such a management method comprises a transmission, to at least one device of the wide area communication network, of data relating to the interactions observed for the communicating object. Thus, it is possible to pool the learning phase, for example at the operator's network level, for several communicating objects of the same nature, connected to several distinct local communication networks. To do this, the access device of a first local communication network can transmit data relating to the interactions observed for a given communicating object to a collection server of the wide area communication network. The latter can centralize the data collected in a plurality of local communication networks, for this type of communicating object, with a view to enriching, and possibly shortening, the learning phase which will be initiated for this type of communicating object in another local communication network.

[0029] According to a corollary aspect, the creation of the security rule(s) also takes into account data relating to interactions observed for a communicating object of the same type as said communicating object, in at least one other local communication network.

[0030] This information is received, for example, by the access equipment or the residential gateway, from a collection server, managed by the operator of the wide area communication network. It makes it possible to enrich the learning process, and possibly reduce its duration.

[0031] According to one aspect of the invention, in the event of detection of an interaction of said communicating object with at least one other device of said local network and / or at least one device of a wide area communication network accessible via said access device contrary to said created security rule, it comprises a step of blocking said interaction.

[0032] Thus, as soon as deviant behavior of the communicating object is observed, which does not correspond to the interactions observed in "normal" operation of the latter, it can be isolated, within the local communication network. This blocking can consist, for example, of a prohibition of access to a configuration service of the UPnP-IGD ("Universal Plug and Play-Internet Gateway Device") type, or a prohibition of routing to another device of the local communication network, depending on the security rule created.

[0033] According to another aspect, such a method also comprises storing the blocked interaction in a log of suspicious interactions and / or alerting a user of said communicating object.

[0034] This log of suspicious interactions can be advantageously consulted by the user or administrator of the local communication network. It is also possible that the detection of deviant behavior of a communicating object automatically triggers the emission of an alert to the user or administrator of the local communication network, for example by sending a message to the latter. Such an alert can also be triggered when a certain number of suspicious interactions have been stored in the log.

[0035] According to another aspect, such a method comprises a modification of said created security rule, in the event of the presence of a user of said communicating object within said local communication network. Thus, it is possible, for example, to relax the security rules, when it is detected that the user is physically present in the local communication network, and therefore able to monitor the behavior of his communicating objects. This avoids problems linked to overly strict security, which can have a negative impact on the use of the services of the local communication network. According to the techniques of the prior art, the security rules associated with a communicating object are static, without it being planned to adapt them, for example to reinforce them, in the event of the user's absence from his home.It may therefore be advantageous to provide strict security rules, which apply by default when the user is not at home, but to be able to relax and lighten them when the presence of an authorized user is detected near the communicating object, or in the ecosystem of the local communication network.

[0036] The invention also relates to a computer program product according to claim 11.

[0037] Another aspect provides a computer-readable recording medium on which is recorded a computer program comprising program code instructions for executing the steps of the method for managing a local communication network according to the invention as described above.

[0038] Such a recording medium may be any entity or device capable of storing the program. For example, the medium may include a storage medium, such as a ROM, for example a CD-ROM or a microelectronic circuit ROM, or a magnetic recording medium, for example a USB flash drive or a hard disk.

[0039] On the other hand, such a recording medium may be a transmissible medium such as an electrical or optical signal, which may be conveyed via an electrical or optical cable, by radio or by other means, so that the computer program contained therein is remotely executable. The program according to the invention may in particular be downloaded over a network, for example the Internet.

[0040] Alternatively, the recording medium may be an integrated circuit in which the program is incorporated, the circuit being adapted to perform or to be used in performing the aforementioned display control method.

[0041] The invention also relates to equipment for accessing a local communication network according to claim 12.

[0042] According to a complementary aspect, such access equipment is integrated into a residential gateway.

[0043] The aforementioned access equipment and corresponding computer program have at least the same advantages as those conferred by the method for managing a local communication network according to the present invention. 4. List of figures

[0044] Other aims, characteristics and advantages of the invention will appear more clearly on reading the following description, given as a simple illustrative, and non-limiting, example, in relation to the figures, among which: there figure 1 presents a schematic view of a local communication network and the various communicating objects connected to it, according to one embodiment of the invention; the figure 2 presents in the form of a flowchart the different stages of the management method according to one embodiment of the invention; the figure 3 provides a block diagram of access equipment or a residential gateway implementing the method of the figure 2 . 5. Detailed description of embodiments of the invention

[0045] The general principle of the invention is based on the establishment of security rules specific to each communicating object of a local communication network, according to its communication needs observed during a learning phase. During this learning phase, no restrictive security measure is applied to the communicating object, which is considered to have, initially, a behavior that can be described as healthy, or normal, i.e. non-deviant. This learning phase is based, for example, on a "machine learning" type mechanism (for the French "apprentissage automatique"), and makes it possible to deduce a certain number of security rules to be associated with the communicating object. It can implement inductive logic programming (ILP), fuzzy logic, etc.

[0046] The remainder of this document describes in more detail the implementation of an embodiment of the invention within the framework of a home network, at a particular user's home. The invention also applies, of course, to any other type of local communication network (LAN, for "Local Area Network"), to which a plurality of communication devices are connected.

[0047] In such a home network, shown schematically on the figure 1 ,a residential gateway HGW referenced 10 makes it possible to connect a local communication network and a wide area network such as the Internet network (not shown). Such a residential gateway HGW 10 integrates a DHCP server: it performs the routing of data packets on the network, and can also act as a firewall, proxy, DNS relay (for the English "Domain Name Server"), IGD service provider (for the English "Internet Gateway Device"), Internet gateway device, etc.

[0048] It also integrates a database, used during the learning phase, from which security rules specific to each communicating object can be developed.

[0049] In the example of the figure 1 , many devices are present on the local network, namely: a smartphone 11; a laptop 12; a PC-type computer 13; a tablet 14; a weather station 15; a webcam 16; a thermostat 17.

[0050] This list is of course not exhaustive, and many other communicating objects may be present on the user's local network.

[0051] These communicating objects can be connected to the network by wire (Ethernet cable, USB port (for "Universal Serial Bus"), etc.) or wirelessly (Wi-Fi ®< , Bluetooth ®< , ZigBee, Z-Wave ®< , etc.). They include all types of physical objects, capable of communicating digitally on the local network, for the purpose of exchanging data. They also include software applications associated with certain non-IP ("Internet Protocol") connected objects, operating on wireless technologies such as BLE (for "Bluetooth ®< Low Energy"), Z-wave ®< , Thread ®< , etc.

[0052] Indeed, the use of such communicating objects most often requires the installation of a management application on an access gateway to the local communication network. Such an application relies on a virtual machine, or a container, to which the access parameter configuration server (DHCP server) provides an IP address. Such communicating objects that are not naturally compatible with the IP protocol require the implementation of an IoT to IP gateway and / or the "6LowPan" protocol.

[0053] Thus, in the following, we refer to communicating objects as both the physical objects connected to the network and the “virtualized” software applications associated with some of these objects.

[0054] Such communicating objects can be designated by the acronym loT, for "Internet of Things".

[0055] Among the communicating objects of the figure 1,it can be imagined that the smartphone 11 and the tablet 14 were provided to the user by an Internet Service Provider (ISP), which also provided the user with the network termination equipment that constitutes the residential gateway HGW 10. As a result, the access provider knows this equipment 11, 14, and can possibly provide the administrator of the local communication network with predefined security rules for these communicating objects, which could be completed and / or refined during the learning phase that follows their first connection to the network, or the updating of their “firmware” (in French “micrologiciel”).Conversely, other communicating objects such as the webcam 16 or the weather station 15 may come from other sources and other origins: the access provider may nevertheless have data resulting from the interactions observed for these communicating objects in other local networks, which it would have collected, and which may also be used to establish security rules for these objects in the network of the . figure 1 .

[0056] In any event, it is important to be able to establish specific security rules applicable to each of these different communicating objects referenced 11 to 17, in particular to adapt the rights allocated to these different objects by the DHCP server embedded in the HGW 10 residential gateway, or to adapt the additional mechanisms for limiting network access to these objects, such as the firewall, in order to improve the security of the local network against possible malicious attacks.

[0057] To do this, one embodiment of the invention is based on the flowchart of the figure 2 .

[0058] A communicating object loT 20 (for example the webcam 16 of the figure 1 ),present on the home network, has just been installed in the local network ecosystem by its manager. It initially has no IP address, and therefore sends a datagram in broadcast mode DHCP DISCOVER which is addressed to the DHCP servers present on the local network. This datagram notably includes the physical address (MAC for Media Access Control) of the IoT 20.

[0059] In the example of the network of the figure 1 ,a single DHCP server referenced 22 is present on the local network, for example integrated into the residential gateway HGW 10. It thus detects the connection of this new loT communicating object 21 within the local communication network (because it sees a new MAC address that it does not know), and then triggers a learning phase APP. 201, during which the interactions of the loT communicating object 21 with its network ecosystem will be observed, without any specific security constraints being applied.

[0060] Detecting the presence of a new loT 21 communicating object within the local communication network can also be carried out by a dedicated service which monitors ARP (Address Resolution Protocol) traffic and detects a new MAC address which does not appear in the router's ARP tables.

[0061] These interactions of the IoT 20 with its environment in “normal” operating mode (i.e. healthy or non-malicious) are symbolized on the figure 2 by the arrows referenced INTER. 203 and INTER. 204. For the sake of simplification, a single piece of equipment SERV. 24 has been represented with which the IoT 20 interacts: however, this piece of equipment SERV. 24 can symbolize one or more pieces of equipment of the local communication network (for example the weather station 15, the tablet 14 or the smartphone 11), and one or more servers or pieces of equipment remote from the extended communication network, for example one or more Internet services.

[0062] All these interactions of the IoT 20 with its network environment are stored (REC. 202) by the residential gateway HGW 10 in a database BDD 21, integrated into the gateway. The data thus stored include the number of transmissions and receptions by the IoT 20, the size and frequency of the associated packets, the level 3 and 4 protocols of the OSI model (for "Open Systems Interconnection") used, the communication ports used, the addresses of the equipment contacted, the servers accessed, etc.

[0063] The duration of collection of this information can be configured, by the manager / administrator of the home network for example, depending on the type of communicating object considered, the learning mechanism (PLI, fuzzy logic, etc.) used, a degree of security requirement, etc. This configuration can take the form of a time duration of the APP. 201 learning phase, expressed in hours or days, or a number of requests, or a volume of data exchanged by the communicating object with other equipment in its immediate or distant surroundings.

[0064] Following a deep learning process based on all this data collected for IoT 20, it is possible to obtain a behavior profile, or a digital signature, specific to a communicating IoT 20 object or to the software or firmware that it contains.

[0065] During this APP. 201 learning phase, it is also possible, for example, to compare this communicating object and / or firmware signature, in the cloud, with other similar signatures obtained, for a communicating object of the same type (for example, the same webcam reference from the same manufacturer), in other home networks. This comparison can be made by a dedicated server of the operator's network, after sending this signature, representative of all the observation data collected for the IoT 20, by the residential gateway HGW 10.

[0066] From this signature, a set of security rules for the IoT 20 can be deduced, which are created and stored in the database BDD 21 (step RG. SEC. 205). This list of security rules is specific to the IoT 20, and applicable only to this communicating object. It can be refined, depending on a result of the comparison of the different signatures collected for the IoT 20 by the operator or the access provider.

[0067] This list of security rules allows you to exercise different network access controls for the loT 20 communicating object by: limiting routing to other equipment on the local network of the figure 1; limiting access to the Internet, with a DNS relay (for the English "Domain Name System") limited to a white list of domain names; limiting access to the Internet, with filtering of TCP / UDP ports (for "Transmission Control Protocol" / "User Datagram Protocol") likely to be used; prohibiting access to configuration services, for example UPnP-IGD.

[0068] Such a security rule may, for example, take the form of restricting, for the IoT 20, access to another device on the local network, for example the laptop 12, on a given TCP port, with a specific known protocol type, and packets limited in number and size.

[0069] Taking the example, for the communicating object loT 20, of the webcam 16, it can for example be observed, during the learning phase APP. 201, that a “normal” behavior of the webcam 16 includes: obtaining an IP address from the DHCP server ROUT. 22; searching for the time, by NTP (for “Network Time Protocol”) request, on a timestamp server 24 of the wide area communication network; sending video streams to an IP (for “Internet Protocol”) address specified by the manager / user of the home network, when the latter is away from home, and the webcam 16 is used for home surveillance.

[0070] The security rules RG. SEC. 205 created at the end of the APP. 201 learning phase may then include the creation of a whitelist of authorized addresses / domain names, reached by the webcam 16 during its normal operation (namely, that of the timestamp server 24, and the IP address specified by the user), and the configuration of a maximum volume and frequency of sending video packets, corresponding to what was observed during the learning phase for sending video surveillance streams. All other addresses or domain names are “blacklisted”, i.e. entered on a blacklist of prohibited addresses or access.

[0071] It is understood that these security rules are specific and applicable only to the IoT 20, in this case the webcam 16: in fact, the communication needs of the smartphone 11 or the weather station 15 are obviously very different from those of the webcam 16, both in terms of the volume of data exchanged and the servers and addresses to be accessed.

[0072] At the end of this APP. 201 learning phase, the communicating object loT 20 enters a phase of operation in SEC. 210 security mode, governed by the RG. SEC. 205 security rules stored in the BDD 21 database.

[0073] During this operating phase SEC. 210, the communicating object loT 20 interacts with the server SERV. 24 of the extended communication network, in compliance with the security rules recorded in the database BDD 21: these interactions, illustrated by double arrow INTER. 211 on the figure 2, correspond to so-called “normal” interactions, i.e. authorized by the HGW 10 residential gateway.

[0074] On the other hand, the communicating object loT 20 can also attempt to access a server or equipment not normally used (i.e. in “normal” operation), for example the server SERV. HACK. 23 on the figure 2 . This access attempt, corresponding to potentially deviant behavior of the communicating object IoT 20, is symbolized by the double arrow DEV. 212. The address of this server SERV. HACK. 23 therefore does not appear on the white list stored in the security rules associated with IoT 20 in the database BDD 21.

[0075] In this case, this unusual interaction is immediately blocked by the residential gateway HGW 10, as illustrated by the arrow BLOK. 213. The loT communicating object 20 can then be isolated, in order to prevent its use in the context of malicious activities, likely to jeopardize the security of the home network. This blocking BLOK. 213 can be accompanied by an action ACT. 214 linked to the detected security problem, which can for example take the form of the emission of an alert to the user, or the storage of the deviant behavior in a suspicious activity log (MEM. / AL. 215).

[0076] Taking the aforementioned example of the webcam 16, such deviant behavior DEV. 212 may consist of sending the video surveillance stream from the user's home to an address other than that specified by the latter, for example an address abroad. The residential gateway HGW 10 may then send an alert message to the user (ACT. 214) and block the video stream emitted by the webcam 16 (BLOK. 213).

[0077] The residential gateway HGW 10 can also detect that the webcam 16 is sending mass DNS queries to a SERV. HACK. 23 server, and suspect that it is participating in a Botnet attack (a concatenation of "robot" and "network"). In this case, it can cut off the stream emitted by the webcam 16 (BLOK. 213), but also isolate the webcam 16 in quarantine (ACT. 214), for example until a possible update of its "firmware" to correct the security flaw affecting this communicating object.

[0078] Finally, this deviant behavior DEV. 212 can also be internal to the local communication network. The webcam 16 can, for example, attack another communicating object in the home network of the figure 1, for example by unintentionally encrypting the hard disks of the personal computer 13. Again, it is then possible to block access of the webcam 16 to the local equipment attacked, and to quarantine this deviant communicating object, until the security flaw affecting it is corrected, or action by the administrator of the home network (for example, replacement of the webcam 16 by another equipment deemed to be more secure and providing the same function).

[0079] Furthermore, in one embodiment of the invention, it is also possible to unlock the security upon detection of the presence of an authorized user (for example the administrator of the home network, or a user whose identifier is duly recorded by the residential gateway HGW 10) in the home network.

[0080] Such presence detection can be based on the detection of the subscriber's smartphone on the local communication network. It can also be based, for example, on the detection of movement in the home, using Z-Wave type sensors (a radio protocol designed for home automation), for example.

[0081] Thus, when the HGW 10 residential gateway detects that the user is present near a communicating object of the network of the figure 1 ,or more generally at home, corresponding to the home network environment, it may decide to relax the security rules associated with IoT 20 communicating objects, in order to facilitate access to home network services by the user. It is indeed assumed that, when the user is present, he can monitor the behavior of the communicating objects himself to detect any possible deviation, or voluntarily cause an unusual interaction for an IoT 20 communicating object with its network environment, without this unusual interaction constituting a real malicious action or a security breach.

[0082] This relaxation of security rules may consist of raising an authorized ceiling for the volume of data exchanged by IoT 20, tolerating access to a server whose address does not appear on the white list of authorized accesses, etc.

[0083] Conversely, when it is detected that an authorized user is present in the local communication network, it is also possible to strengthen certain security rules, such as preventing remote interactions, such as the transmission of video streams over the extended communication network by local cameras in the home network. Indeed, when the user is at home, it is not a priori necessary to transmit the home video surveillance stream to a remote address.

[0084] We now present, in relation to the figure 3 , the hardware structure of access equipment according to an embodiment of the invention, in which this access equipment, integrating a learning module and a module for creating security rules associated with communicating objects, is integrated into a residential gateway HGW 10.

[0085] The term "module" can correspond to a software component as well as to a hardware component or a set of hardware and software components, a software component itself corresponding to one or more computer programs or sub-programs or more generally to any element of a program capable of implementing a function or a set of functions.

[0086] More generally, such a residential gateway HGW 10 comprises a random access memory 33 (for example a RAM memory), a processing unit 32 equipped for example with a processor, and controlled by a computer program, representative of the module for detecting new or updated communicating objects, the learning module and the module for creating security rules, stored in a read-only memory 31 (for example a ROM memory or a hard disk). Upon initialization, the code instructions of the computer program are for example loaded into the random access memory 33 before being executed by the processor of the processing unit 32. The random access memory 33 contains in particular the data collected during the observation of the interactions of the communicating objects with their network environment described above in relation to the figure 2, as well as, for each communicating object, the set of security rules which are generated by the creation module and which are associated with the communicating object at the end of a learning phase. The processor of the processing unit 32 controls the recording of the data relating to the interactions of the communicating objects with their network environment in the RAM 33, the compilation of this data by the learning module, and the consequent creation of security rules by the creation module, in accordance with the logic diagram of the figure 2 . In safe operating mode, the processor of the processing unit 32 also controls the detection of unusual interactions, their blocking, and the triggering of actions related to the detected safety problem, in accordance with the logic diagram of the figure 2 .

[0087] There figure 3illustrates only one particular way, among several possible ones, of making the HGW residential gateway, so that it carries out the steps of the process detailed above, in relation to the figure 2 . Indeed, these steps can be carried out indifferently on a reprogrammable computing machine (a PC computer, a DSP processor or a microcontroller) executing a program comprising a sequence of instructions, or on a dedicated computing machine (for example a set of logic gates such as an FPGA or an ASIC, or any other hardware module).

[0088] In the case where the HGW 10 residential gateway is produced with a reprogrammable computing machine, the corresponding program (i.e. the sequence of instructions) may be stored in a removable storage medium (such as for example a floppy disk, a CD-ROM or a DVD-ROM) or not, this storage medium being partially or totally readable by a computer or a processor.

[0089] The different embodiments have been described above in relation to a residential gateway of the Livebox ®< type, but can more generally be implemented in all gateways, routers, DHCP servers, and more generally in any network equipment located between the communicating object and the extended communication network.

Claims

1. Method for managing a local area communication network comprising an access equipment (10) for accessing said network, and at least one communicating object (11-17; 20) having a MAC address and able to be connected to said network, said access equipment (10) carrying out the following steps: - upon detecting connection of a communicating object (20) to said network having a new MAC address that said access equipment does not know and / or upon detecting installation of new firmware on said at least one communicating object connected to said network, a learning phase (201) that stores interactions (203, 204) of the communicating object in question with at least one other equipment (24) of said local area network and / or at least one equipment (24) of a wide area communication network accessible via said access equipment (10), followed by obtaining, on the basis of the stored interactions, a digital signature specific to the communicating object in question or to the firmware embedded therein; - creating (205) at least one security rule associated with said communicating object in question on the basis of said obtained digital signature; - controlling network access for the communicating object in question in accordance with said at least one created security rule.

2. Method for managing a local area communication network according to Claim 1, characterized in that said at least one security rule associated with said communicating object comprises a list of at least one equipment of said local area communication network and / or of said wide area communication network that said communicating object is authorized to access.

3. Method for managing a local area communication network according to either one of Claims 1 and 2, characterized in that said at least one security rule associated with said communicating object comprises a maximum volume of data that said communicating object is authorized to exchange.

4. Method for managing a local area communication network according to any one of Claims 1 to 3, characterized in that said at least one security rule associated with said communicating object comprises a maximum number of access requests that said communicating object is authorized to transmit.

5. Method for managing a local area communication network according to any one of Claims 1 to 4, characterized in that said learning phase has a duration able to be parameterized by a manager of said local area communication network.

6. Method for managing a local area communication network according to any one of Claims 1 to 5, characterized in that it comprises transmitting data relating to said interactions observed for said communicating object to at least one equipment of said wide area communication network.

7. Method for managing a local area communication network according to any one of Claims 1 to 6, characterized in that said creation of said at least one security rule also takes into account data relating to interactions observed for a communicating object of the same type as said communicating object, in at least one other local area communication network.

8. Method for managing a local area communication network according to any one of Claims 1 to 7, characterized in that, in the event of detecting an interaction (212) of said communicating object with at least one other equipment of said local area network and / or at least one equipment of a wide area communication network accessible via said access equipment that contravenes said created security rule, it comprises a step of blocking (213) said interaction.

9. Method for managing a local area communication network according to Claim 8, characterized in that it also comprises storing (215) said blocked interaction in a log of suspicious interactions and / or alerting (215) a user of said communicating object.

10. Method for managing a local area communication network according to any one of Claims 1 to 9, characterized in that it comprises modifying said created security rule if a user of said communicating object is present within said local area communication network.

11. Computer program product comprising program code instructions for implementing a method according to any one of Claims 1 to 10 when it is executed by a processor.

12. Access equipment (10) for accessing a local area communication network comprising at least one communicating object having a MAC address and able to be connected to said network, comprising: - a module for detecting connection of a communicating object to said network having a new MAC address that said access equipment does not know and / or installation of new firmware on said at least one communicating object connected to said network; - a learning module that stores interactions of the communicating object in question with at least one other equipment of said local area network and / or at least one equipment of a wide area communication network accessible via said access equipment, followed by obtaining, on the basis of the stored interactions, a digital signature specific to the communicating object in question or to the firmware embedded therein; - a module for creating at least one security rule associated with said communicating object in question on the basis of said digital signature; - a module for controlling network access for said communicating object in question in accordance with said created security rule.

13. Access equipment according to Claim 12, characterized in that it is able to implement a method for managing a local area communication network according to any one of Claims 1 to 10.

14. Access equipment according to either one of Claims 12 and 13, characterized in that it is integrated into a home gateway (HGW).