METHOD FOR ESTABLISHING A CONNECTION TO A COMMUNICATION NODE AND CORRESPONDING COMMUNICATION NODE

Description

TECHNICAL FIELD

[0001] At least one embodiment relates to a method of connecting a node of a wireless communication coverage extension system. At least one embodiment relates to a communication node implementing said method. STATE OF PRIOR ART

[0002] In local area networks (LANs), wireless communication coverage extension systems can be used to increase the range of these local area networks (LANs) by coordinating several access points (APs).

[0003] Access Points (APs) are distributed. These different AP access points are integrated into communication nodes, simply called nodes hereinafter, interconnected via a backhaul subnetwork and all provide the same WLAN (Wireless Local Area Network). In the context of Wi-Fi technology (registered trademark), all these AP access points use the same SSID (Service Set IDentifier) ​​and the same password (also called a security key). Thus, the extension of wireless communication coverage is transparent for devices connected to the WLAN. Patent application US2017 / 272273 A1 discloses a WLAN system with an on-boarding function for new nodes.

[0004] There Fig. 1 schematically illustrates a communication system comprising a wireless communication coverage extension system built around a routing subnetwork comprising a set of interconnected nodes N1 121, N2 122, N3 123. Thus, each node N1 121, N2 122, N3 123 of the routing subnetwork comprises a plurality of radio interfaces: a radio interface called “AP-BH” (for “Access Point Backhaul” in English) corresponding to an access point interface of the routing subnetwork, a radio interface “ST-BH” (for “Station Backhaul” in English) corresponding to a client interface of the routing subnetwork, a radio interface “AP-FH” (for “Access Point Fronthaul” in English) corresponding to an access point interface of the local network LAN1, this interface being dedicated to the association of stations or terminals.

[0005] As part of Wi-Fi technology (registered trademark), all these AP-FH access points use the same SSID identifier and the same password. The coverage area of ​​the LAN1 local network thus constituted around the wireless communication coverage extension system is then extended transparently for each terminal, or station, which connects to it.

[0006] The nodes N1 121, N2 122, N3 123 of the routing subnetwork are connected to each other using a tree-like structure, whereby a node can serve as a relay between two other nodes of the routing subnetwork. The nodes N1 121, N2 122, N3 123 are thus interconnected using wired links, for example Ethernet, or wireless links. The nodes N1 121, N2 122, N3 123 of the routing subnetwork thus communicate with each other using logical links, for example IP communications or encrypted tunnels or communications according to a proprietary communication protocol. These logical links are typically established using probe and discovery messages. However, when a wired interface is used for the routing subnet, that wired interface cannot be used for any other purpose, including connecting a terminal to it.

[0007] Illustratively, the Fig. 1 shows that node N1 121 is connected to node N2 122 through a wireless link between the AP-BH access point radio interface of node N1 121 and the ST-BH client radio interface of node N2 122. Node N1 121 is also connected to node N3 123 through a wireless link between the AP-BH access point radio interface of node N1 121 and the ST-BH client radio interface of node N3 123. On the Fig.1 , wired links are shown as solid lines and wireless links as dotted lines. Links between two nodes in the routing subnetwork are called backhaul links and can be wired or wireless.

[0008] The wireless communication coverage extension system thus makes it possible to interconnect a GW1 110 Internet access gateway 120, a T1 terminal 131, a T2 terminal 132, a T3 terminal 133 and a T4 terminal 134. The T1 terminal 131 is connected by a wireless link to the N2 node 122. The T1 terminal 131 is thus connected to the LAN1 local area network thanks to the N2 node 122 acting as a so-called "fronthaul" access point.

[0009] Terminal T1 131 is, for example, a smartphone or a tablet. Terminal T2 132 is, for example, a PC connected by a wireless link to node N3 123. Terminal T3 133 is, for example, a television connected by a wired link, shown in solid lines, to gateway GW1. Terminal T4 134 is, for example, a network attached storage unit (NAS) connected by a wired link to gateway GW1.

[0010] The nodes of the routing subnetwork are coordinated centrally, by a master node, eg node N1 121 on the Fig. 1 , chosen from among said nodes of the routing subnetwork. All the nodes of the routing subnetwork are thus aware of the master node, and are able to identify it by its MAC address and / or its network address (e.g., IP address). All the nodes of the routing subnetwork are also aware of all the other nodes of the routing subnetwork and are able to identify them by their MAC addresses and / or their network addresses (e.g., IP addresses). The terminals thus connected to the LAN1 local network can benefit from various services. For example, the NAS network storage unit (T4 134) can offer the PC (T2 132) the mounting of a network disk using a particular protocol, e.g., the Samba protocol. The tablet (T1 131) can send a video stream to a connected TV (T3 133) using a particular protocol such as Chromecast.

[0011] As soon as terminals T1 and T2 are no longer connected to the same LAN as terminals T3 and T4, these services are no longer available. This is particularly the case if terminal T1 131 or T2 132 is moved by a user, e.g. when going on holiday. It is known to use IP tunnels to create virtual private networks, known as VPNs, ("Virtual Private Networks" in English). SSL (Secure Sockets Layer) and its successor TLS (Transport Layer Security) are protocols used by VPNs. This solution allows two remote portions of the same local network to communicate securely by using a third-party network. However, it requires setting up as many VPNs as there are terminals to be connected. Thus, in the case of the Fig. 1 , if terminals T1 and T2 are moved, e.g. to a holiday location, it is necessary to set up two VPNs, i.e. one for each terminal. This solution is therefore expensive to implement.

[0012] In addition, this solution requires prior knowledge of the address of the remote LAN network, as well as access parameters for establishing communication, similar to what is used to remotely connect to the corporate network when moving to a third-party network. This makes such a solution difficult to implement for a novice user.

[0013] It is then desirable to overcome these disadvantages of the state of the art. STATEMENT OF THE INVENTION

[0014] The invention is defined by the independent claims. Other embodiments are defined in the dependent claims.

[0015] According to a first embodiment, a method for connecting a node of a wireless communication coverage extension system is described. The wireless communication coverage extension system comprises a tree-shaped routing subnetwork comprising a set of nodes interconnected wirelessly or wired by so-called routing links. A plurality of nodes of the routing subnetwork implements an access point functionality of the same wireless communication network. The wireless communication coverage extension system is adapted to allow devices to be connected to said nodes via the wireless communication network or wired in order to form an initial local network. The connection method comprises the following steps executed by the node to be connected: determine whether said node has been moved out of said initial local network; and in case the node has been moved: setting up a local area network from said moved node by activating an address server functionality; connecting said moved node to an internet access point; setting up a secure tunnel between said moved node and a master node coordinating said initial local area network; deactivating the address server functionality and activating a client functionality of an address server of said initial local area network.

[0016] In a particular embodiment, determining whether said node has been moved out of said initial local network comprises: attempting to establish for a predefined period of time a routing link between said node and at least one other node of said routing subnetwork; determining that said node has been moved out of said initial local network in the event that said attempt has failed.

[0017] In a variant, determining whether said node has been moved out of said initial local area network comprises: determining that said node has been moved out of said initial local area network in the event that a list of access points visible to a radio interface of said node is significantly different from a second list of access points stored in memory, said second list being a list of access points that were visible to said radio interface when said node was in said initial local area network.

[0018] In a particular embodiment, setting up a local area network from said relocated node by activating an address server functionality comprises: activate its access point functionality of said wireless communication network; set up a DHCP server functionality and a DNS server functionality; and send a DHCP lease to the terminals that request it.

[0019] In a particular embodiment, connecting said moved node to an internet access point comprises: determining a list of at least one access point to which said node can connect; selecting an access point from said list from a web page displayed on a screen of a terminal connected to said moved node; and connecting said moved node to said selected access point.

[0020] In a particular embodiment, said selected access point is a first Internet access gateway.

[0021] In a particular embodiment, setting up a secure tunnel between the moved node and said master node, said master node being connected to a second internet access gateway, comprises: a) sending to a domain name corresponding to said second gateway through a predefined port a connection request, said connection request comprising a client certificate of said moved node signed by a root certificate of a current node; and b) if said client certificate is received and validated by said master node: receiving a server certificate of said master node signed by a root certificate of said master node; validating the received server certificate using the root certificate of said master node; establishing a tunnel between said node and said master node. c) otherwise repeating steps a) to c) until said tunnel is established between said node and said master node, said steps being repeated with said connection request comprising a client certificate of said moved node signed by a root certificate of another node different from said current node.

[0022] A node of a wireless communication coverage extension system is also described. The node is configured to perform the steps of the connection method according to one of the embodiments described above.

[0023] A computer program is described. The computer program comprises instructions for implementing, by a node of a routing subnetwork of a wireless communication coverage extension system, the connection method according to one of the embodiments described above, when said program is executed by a processor of said node.

[0024] Storage means are described. The storage means stores a computer program comprising instructions for implementing, by a node of a routing subnetwork of a wireless communication coverage extension system, the connection method according to one of the embodiments described above, when said program is executed by a processor of said node. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] The above-mentioned and other features of the invention will become more clearly apparent from the following description of an exemplary embodiment, said description being made in relation to the accompanying drawings, among which: [ Fig. 1 ] schematically illustrates the architecture of a communication system comprising a wireless communication coverage extension system built around a routing subnetwork comprising a set of interconnected nodes; [ Fig. 2 ] schematically illustrates the architecture of a communication system comprising a wireless communication coverage extension system built around a routing subnetwork comprising a set of interconnected nodes according to a particular embodiment; [ Fig. 3 ] schematically illustrates a method of connecting a nomadic node to an initial local network according to a particular embodiment; [ Fig. 4A ] schematically illustrates a particular implementation of a step of the connection method; [ Fig. 4B ] schematically illustrates a particular implementation of a step of the connection method; [ Fig. 5 ] schematically illustrates a particular implementation of a step of the connection method; [ Fig. 6 ] schematically illustrates a particular implementation of a step of the connection method; [ Fig. 7 ] schematically illustrates a process for configuring parameters (eg certificates, public and private keys) useful for implementing a secure tunnel; [ Fig. 8 ] schematically illustrates a particular implementation of a secure tunnel between a master node and a nomad node; and [ Fig. 9 ] schematically illustrates the hardware architecture of a node of a wireless communication network, the node being configured to execute all or part of the steps of the methods illustrated in the Figs. 3 à 8 . DETAILED PRESENTATION OF IMPLEMENTATION METHODS

[0026] At least one embodiment makes it possible to connect a node to its original local network, called the initial local network, after said node has been moved to another local network and thus offer the mobile terminals connected to it the services offered by the initial local network.

[0027] There Fig. 2 schematically illustrates a communication system comprising a wireless communication coverage extension system built around a routing subnetwork comprising a set of interconnected nodes N1 121, N2 122, N3 123. The nodes N1 121, N2 122, N3 123 were initially all part of the same initial local area network LAN1. The node N2 122 was then moved outside this initial local area network LAN1. For example, the node N2 122 was moved by a user who brought it to his vacation spot. In this figure, the moved node or nomadic node N2 122 is connected by its radio interface ST-BH to an internet access gateway GW2 115. The gateway GW2 presents a local area network LAN2. In the remainder of the document, nodes N1 121, N2 122 and N3 123 are referred to as N1, N2 and N3 respectively.

[0028] La Fig.3 schematically illustrates a method of connecting a moved node to the initial local area network LAN1.

[0029] In step S200, node N2 determines whether it has been moved out of its initial local network LAN1.

[0030] There Fig.4A schematically illustrates a particular implementation of step S200.

[0031] When it is powered up, the node N2 previously connected to the initial local network LAN1 seeks to reestablish its backhaul link (S200-1) for a duration T. For example, T is equal to 2 min. To this end, the node N2 searches on its different radio interfaces for an access point whose characteristics correspond to characteristics (e.g. the characteristics of the AP-BH access point of the node N1) stored in memory during a previous connection. An example of a characteristic is the BSSID

[0032] ("Basic Service Set Identifiers"). The prior connection took place before the movement of said node N2, i.e. when it was still part of the initial local network LAN1. If it finds such an access point, then node N2 connects to it, i.e. it reestablishes its backhaul link using a conventional method for implementing a Wi-Fi network using a wireless link. It can also probe for the presence of such a backhaul link through its wired interfaces in order to establish this link using a normal method for implementing a Wi-Fi network using a wired link. The backhaul link having been reestablished between node N2 and, for example, node N1, then node N2 determines that it has not been moved (S200-3). If the node has not succeeded in reestablishing this backhaul link (S200-2), then node N2 determines that it has been moved (S200-4).

[0033] There Fig. 4B illustrates an alternative embodiment of step S200. During a step S200-5, the node N2, upon powering up, compares a list L1 of the access points visible in its vicinity by its radio interfaces to a list L2 stored in memory. The list L2 is a list of the access points that were visible by its radio interfaces before its possible movement. Thus, if the two lists are similar (S200-6) then the node N2 determines that it has not been moved (S200-7). It therefore reestablishes its backhaul link. If the lists are very different then the node N2 determines that it has been moved (S200-8). The lists are considered similar if a certain percentage of the access points is common to both lists, e.g. 50%. In one embodiment, the lists are considered similar if the percentage P of access points from list L1 that are found in list L2 stored in memory is greater than a threshold value S, e.g. 40% or 50%.Otherwise, ie P <S, les listes sont considérées comme très différentes. Par exemple, si la liste L1 comprend 5 points d'accès et que parmi ces 5 points d'accès 3 se retrouvent dans la liste L2, alors les deux listes sont considérées comme similaires car 60% des points d'accès de L1 se retrouvent dans L2. En revanche, si parmi ces 5 points d'accès un seul se retrouve dans la liste L2, alors les deux listes sont considérées comme très différentes car seuls 20% des points d'accès de L1 se retrouvent dans L2.Dans une autre variante de réalisation, la détermination du déplacement du nœud N2 hors du réseau local initial (S200) est effectuée par un utilisateur par appui sur un bouton du nœud N2 ou par une sélection d'une entrée dans un menu.

[0034] In reference to the Fig.3 , if node N2 determines that it has been moved out of the initial local network, then it implements step S210. In step S210, the nomadic node N2 sets up a local network LAN3 by activating an address server functionality.

[0035] There Fig.5 schematically illustrates a particular implementation of step S210. During a step S210-1, the node N2 activates its AP-FH access point radio interface, as it was configured in a normal operating situation, i.e. before the movement of the node N2. The node N2 uses in particular the same SSID and the same password as those used before the movement of the node N2, i.e. in the configuration of the Fig. 1 This allows all terminals, in this case T1 and T2 on the Fig. 2 , previously registered on the initial local network to connect again to node N2. In a step S210-2, node N2 activates a DHCP server functionality (acronym for "Dynamic Host Configuration Protocol") which is attached to its AP-FH access point. The DHCP server hosted by N2 self-assigns itself a fixed IP address which is defined in an IP address range, e.g. in the range 192.168.1.xxx.

[0036] The N2 node also implements a DNS (Domain Name System) server function that translates domain names into IP addresses and vice versa. The IP address of the DNS server is the same as the DHCP server.

[0037] In a step S210-3, the DHCP server of N2 delivers IP addresses to the terminals that request them. More precisely, the DHCP server provides a lease (IP address allocation) as defined by the normative document RFC 1531, modified and supplemented by the normative documents RFC 1534, RFC 2131 and RFC 2132. A lease generally includes an IP address and a validity period. Conventionally, the allocation of an IP address is done by the terminal T1 or T2 broadcasting a DHCPDISCOVER type request to locate a DHCP type server. The DHCPDISCOVER type request includes the physical address (or MAC address) of the terminal. The node N2 receives the DHCPDISCOVER message on its AP-FH access point. In response, it sends a DHCPOFFER type response, i.e. an IP lease offer, which includes in particular the IP address of the DHCP server, as well as the IP address that it offers to the terminal.Typically, the terminal will then send a DHCPREQUEST message selecting an IP lease offer. The DHCPREQUEST message includes the identification of the selected DHCP server. The selected DHCP server sends a DHCPACK message, which may include the DNS server address.

[0038] Thus, terminals T1 and T2 become functional with respect to the LAN3 local network. Node N2 then becomes the recipient of any IP request from T1 and T2 and destined for the Internet.

[0039] In reference to the Fig.3 , during a step S220, the moved node is connected to an Internet access point. According to a particular embodiment, this access point is selected from a terminal, eg T1 or T2, connected to said local network LAN3.

[0040] There Fig.6 schematically illustrates a particular implementation of step S220.

[0041] In a step S220-1, the node N2 determines a list of at least one access point to which it is likely to connect. For this purpose, probe messages (request and response) are exchanged between the node N2 and other access points. Thanks to the exchange of these probe messages, the node N2 receives information from the access points, e.g. the gateway GW2, to which it is likely to connect.

[0042] In a step S220-2, the node N2 presents a web page in response to any Internet browsing request issued by a terminal. This step is known as a captive portal. It consists of redirecting a user's Internet browsing requests to a special web page before he or she normally accesses the Internet. This web page includes in particular the list of access points obtained in step S220-1. The user, through the terminal that issued the Internet browsing request, selects, via the web page, one of the access points from the list and enters connection information, e.g., authentication information (e.g., SSID, password), payment (e.g., credit card number), email address, etc., in order to access the Internet.

[0043] During a step S220-3, the node N2 connects via its client radio interface ST-BH to the access point, i.e. to the gateway GW2 on the Fig. 2 , selected by the user in step S220-3.

[0044] At the end of step S220, the node N2 is located at the intersection of the local network LAN3 of which the terminals T1 and T2 are part and the local network LAN2 presented by the access point selected in step S220-2, in this case the gateway GW2 on the Fig.2 . The IP addresses delivered by the DHCP server embedded in node N2 must be different from the addresses used by the LAN2 local network offered by the gateway GW2. In the particular case where there is a conflict between the two, step S210 is restarted after step S220 with a range of IP addresses different from those delivered by GW2, the AP-FH radio interface of node N2 is also restarted to force the terminals to reconnect and obtain an IP address in LAN3 belonging to the new IP address range.

[0045] Being at the intersection of the two networks LAN2 and LAN3, the node N2 implements a routing functionality to route to the gateway GW2 the data destined for the Internet transmitted by the terminals of its local network LAN3.

[0046] It thus acts as an intermediate gateway or hub. It allows T1 and T2 terminals to access the Internet through a single physical connection to the LAN2 network, which is supported by the N2 node.

[0047] In reference to the Fig.3 , during a step S230, a secure tunnel is set up between the moved node N2 and a master node of the initial local network, in this case N1 on the Fig. 2 . For this purpose, a logical interface IL.N2 is mounted in node N2 on the LAN3 side and a logical interface IL.N1 is mounted in node N1. A tunnel is then set up between the two logical interfaces. Thus, all traffic in node N2 destined for IL.N2 will end up on IL.N1 in node N1. The parameters (e.g. certificates) for access to the secure tunnel are configured and therefore known to all nodes in the initial LAN1. For example, the parameters are generated and stored for each node in the initial LAN1 when they connect to the initial LAN1 or when they first communicate with the initial LAN1. In particular, node N2 is aware of these parameters before its move, i.e. while it is physically part of the initial LAN1. An example of a method for configuring these parameters is illustrated in Fig. 7 . There Fig.8 schematically illustrates a particular implementation of step S230.

[0048] In reference to the Fig.3 , during a step S240, the address server functionality of the moved node is deactivated and a client functionality of an address server of said initial local network LAN1 is activated.

[0049] According to a particular embodiment, the DHCP server set up in step S210-2 is deactivated and a client functionality of a DHCP server is activated. The fixed IP address assigned to the DHCP server hosted by the node N2 in step S210-2 is therefore deleted. The Wi-Fi links between the radio interface AP-FH and the terminals are restarted by switching the radio interface off and on again. In a variant, disassociation requests are sent. In this way, the node N2 and the terminals connected to the access point AP-FH of the node N2 each obtain an IP address provided by the DHCP server of the LAN1. Thus, N2 and the terminals T1 and T2 are part of the LAN1. A backhaul link is established between the nomadic node N2 and the master node N1. In this way, the nomadic node N2 is an extension of the wireless communication coverage system.

[0050] The routing table then updates itself. Once the routing table is updated, if terminal T1 tries to reach an address that is not part of the initial LAN1, routing propagates the messages to GW2. Terminals T1 and T2 connected directly to N2 thus share the Internet access provided by GW2.

[0051] The terminals, whether connected to the part that remains local, or to the nomadic node N2 are therefore connected to the same initial local network LAN1. Thus, the terminal T1 and T2 can access the services (e.g. mounting a network disk using a particular protocol such as Samba, sending a video stream to a connected TV using a particular protocol such as Chromecast, etc.) offered by the LAN1 as if they were at home. For example, the terminal T1, if it has a UPnP navigation functionality (acronym for "Universal Plug and Play"), can access the multimedia content offered by a NAS server, e.g. the node N3, equipped with the same UPnP functionality. The terminals T1 and T2 can also benefit from the same firewall while traveling as at home.

[0052] There Fig. 7 schematically illustrates a process for configuring, in the nodes of the initial local network LAN1, parameters (e.g. certificates, public and private keys) useful for implementing a secure tunnel. On the Fig.7 , node N1 is assumed to be a new node in the initial LAN1 while nodes N2 and N3 are assumed to be already present in the initial LAN1. The configuration of parameters for node N1 takes place, for example, when it connects to the initial LAN1.

[0053] In step S700, node N1 creates a certification authority which issues a root certificate CA1.crt. This root certificate is self-signed for its Distinguished Name, e.g. its domain name, with an associated private key. Generally, a certificate is issued by a certification authority. It contains a public key and various information mainly concerning the identity of the issuer.

[0054] In step S702, node N1 sends its self-signed root certificate CA1.crt to all other nodes connected to the initial local network LAN1, notably to N2 and N3.

[0055] In a step S704, node N1 sends to all other nodes connected to the initial local network LAN1, in particular to N2 and N3, a request for collection of a root certificate. In a step S706, node N1 receives the self-signed root certificates issued by the certification authorities of nodes N2 and N3, i.e. CA2.crt and CA3.crt respectively. In a step S708, node N1 generates a PKi (Public Key Infrastructure) server whose public key is signed with its root certificate CA1.crt. The public key will be transmitted by a tunnel management server application (e.g. VPN / TLS server) via the CA_SERVER_EXT1.crt certificate when the connection is established. It will allow a tunnel management client application (e.g. VPN / TLS client) to identify the PKi server with certainty thanks to its validation by the root certificate CA1.crt.

[0056] In a step S710, node N1 sends to the other nodes of the network, in particular N2 and N3, a request for generation of a client Pki. Upon receipt of this request, nodes N2 and N3 generate a client Pki and send a certificate signing request (CSR) to node N1. The CSR contains identification information of the sending node, and the public key chosen by said node. The corresponding private key is not included in the CSR, but is used to digitally sign the request.

[0057] In step S712, node N1 receives the CSRs from nodes N2 and N3.

[0058] In step S714, node N1 signs the received CSRs with its root certificate CA1.crt. In step S716, node N1 sends to nodes N2 and N3 their CSRs signed by its root certificate. The CSR issued by node N2 and signed by the root CA of N1 is noted CA_CLIENT_EXT2_POUR_EXT1.crt and the CSR issued by node N3 and signed by the root CA of N1 is noted CA_CLIENT_EXT3_POUR_EXT1.crt.

[0059] During a step S718, the node N1 will also generate a client Pki and send during a step S720 a CSR to all the nodes of the initial local network LAN1, notably N2 and N3.

[0060] The network nodes will then sign, during a step S722, the CSR received from node N1 with their own root certificate. The signed CSR is then sent back to node N1. The CSR issued by node N1 and signed by the root CA of N2 is noted

[0061] CA_CLIENT_EXT1_POUR_EXT2.crt and the CSR issued by node N1 and signed by the root CA of N3 is noted CA_CLIENT_EXT1_POUR_EXT3.crt

[0062] All private keys (CA, PKi server and PKi client) can be encrypted using PEM (Privacy Enhanced Mail) technology with a secret known only to the node (e.g., the use of a hardware-based secret if one is available). This ensures that any device that could steal this information would not be able to use it. A TMP (Trusted Platform Module) cryptoprocessor is an example of such a hardware-based secret. It allows the security of a system by embedding encryption keys in the hardware. The keys, which can be unique per device, are flashed at the factory and can never be read again. The cryptoprocessor provides encryption / decryption application programming interfaces (APIs) but never reveals the keys.

[0063] The nodes in the initial LAN1 also need to know the domain name corresponding to the gateway GW1 and a specific port number to reach it in order to set up a secure tunnel with the master node. The port number is predefined, for example 5253. The domain name was registered in the dynamic DNS or DynDNS, at construction, or on a user configuration.

[0064] At the end of the configuration, each node of LAN1 has: a) A DH (Diffie-Hellman) key for tunnel encryption; b) The private key of its CA and the root certificates of all extenders (including its own); c) The private key of its Pki server and the associated certificate, i.e. CA_SERVER_EXT1.crt; d) The private key of its Pki client and the client certificates issued by all nodes (except its own); e) The domain name corresponding to the gateway GW1; and f) The specific port number to be used to reach it in order to set up the tunnel.

[0065] At the end of the configuration, each node therefore has all the parameters at its disposal to establish a secure tunnel as a master node of the initial local network LAN1 or as a nomadic node.

[0066] Thus, the master node of the initial local network LAN1 can start a VPN server using the private key of its Pki server, the associated certificate, the root certificate used to encrypt it and its DH key. Advantageously, the server will only be set up when at least one of the nodes is detected as absent.

[0067] There Fig. 8 schematically illustrates a particular implementation of a secure tunnel between a master node N1 and a nomadic node N2. In an exemplary embodiment, the implementation of the secure tunnel complies with the TLS protocol, successor to SSL. This protocol is described in particular in the following documents: RFC 4346 TLS v1.1, RFC 5246 TLS v1.2 and RFC 8466 TLS v1.3. More specifically, section 7.3 of the document RFC 5246 TLS v1.2 describes the “Handshake protocol” which describes in particular how a TLS server and client can authenticate themselves in particular by exchanging their certificates.

[0068] In a situation of mobility of one of the nodes, in this case N2, the gateway GW1 is configured to let the tunnel setup requests reach the master node (N1 in the example of the Fig. 2 ). Thus, a request arriving on a predefined port (for example 5253) on a WAN interface (English acronym for “Wide Area Network”) of GW1 is redirected to the master node N1 which is able to process the request.

[0069] The nomadic node N2 can at any time try to connect a secure tunnel, e.g. a VPN tunnel, using a triplet (private key of its Pki client, associated certificate, e.g. CA_CLIENT_EXT2_POUR_EXT1.crt, root certificate used to encrypt it, e.g. CA1.crt) to the domain name corresponding to the gateway GW1 through the predefined port number. A connection using this information will only be possible with the node containing the private key associated with the root certificate.

[0070] In step S230-1, the nomadic node N2 sends a connection request to the node N1. The connection request includes a certificate

[0071] CA_CLIENT_EXT2_POUR_EXT1.crt. The VPN / TLS server will only accept a client when the certificate is signed by the master node's CA. This ensures that the client is well known and authorized.

[0072] In step S230-2, node N1 validates the received certificate using CA1.crt. Thus, node N2 is identified by node N1 as belonging to the local network LAN1.

[0073] In step S230-3, node N1 confirms the connection request by sending a CA_SERVER_EXT1.crt certificate.

[0074] In step S230-4, node N2 validates the received certificate using CA1.crt. Thus, node N1 is identified by node N2 as the target node for tunnel setup.

[0075] From then on, the dialogue between nodes N1 and N2 is authenticated and a tunnel is set up during a step S230-5 which is encrypted by a DH key (English acronym for “Diffie-Hellman”).

[0076] Optionally, the private key of the nomadic node N2 is protected by a buried hardware secret. This makes it impossible for a foreign nomadic node or a malicious device that knows the private key to connect to the local network LAN1.

[0077] In case of connection failure, for example if the master has changed since the departure of the nomadic node N2 and is no longer the node N1, the nomadic node uses the following triplet (private key of its Pki client, associated certificate, eg CA_CLIENT_EXT2_POUR_EXT3.crt, root certificate used to encrypt it, eg CA3.crt), until the connection succeeds.

[0078] There Fig. 9 schematically illustrates the hardware architecture of an electronic device or node of a wireless communication network, the node being configured to execute all or part of the steps of the methods illustrated in the Figs. 3 à 8 .

[0079] Thus, the electronic device 900 comprises, connected by a communication bus: a processor or CPU (Central Processing Unit) 901; a memory MEM 902 of the RAM (Random Access Memory), ROM (Read Only Memory) and / or EPROM (Erasable Programmable Read Only Memory), possibly a network module NET 903, for example of the Ethernet type, a storage module STCK 904 of the internal storage type and possibly a plurality of radiofrequency modules 905 to 90N conforming to a standard of the IEEE 802.11 type. The electronic device 900 may optionally comprise one or more input / output interfaces not shown in the Fig. 9 (eg a keyboard, a mouse, a touchpad, a webcam, etc.), each being configured to display information and / or allow a user to enter commands or data. The electronic device 900 may also include a power source not shown in the Fig. 9 which can also be external to the electronic device.

[0080] The STCK 904 storage module can be of the HDD (“Hard Disk Drive”) or SSD (“Solid-State Drive”) type, or of the external storage media reader type, such as an SD (“Secure Digital”) card reader.

[0081] The CPU processor 901 can record data, or information, in the memory MEM 902 or in the storage module STCK 904. The CPU processor 901 can read data recorded in the memory MEM 902 or in the storage module STCK 904. This data can correspond to configuration parameters, e.g. certificates. The network module NET 903, if present, typically allows the connection of the electronic device 900 to a local network and / or the Internet. Each radio frequency module 905 to 90N allows the electronic device 900 to establish a plurality of radio frequency interfaces compliant with a standard called Wi-Fi. A radio frequency interface can be an access point, ie AP-FH or AP-BH, or on the contrary a radio frequency interface called user, ST-BH, allowing an association with a radio frequency interface called access point of another electronic device.

[0082] The CPU 901 processor is capable of executing instructions loaded into the MEM 902 memory, for example from the STCK 904 storage module. When the electronic device 900 is powered on, the CPU 901 processor is capable of reading instructions from the MEM 902 memory and executing them. These instructions form a computer program causing the CPU 901 processor to implement all or part of the methods and steps described above, particularly the method described in the Figs. 3 à 8. Thus, all or part of the methods and steps described above can be implemented in software form by executing a set of instructions by a programmable machine, such as a DSP (Digital Signal Processor) or a microcontroller. All or part of the methods and steps described here can also be implemented in hardware form by a machine or a dedicated component, such as an FPGA (Field-Programmable Gate Array) or an ASIC (Application-Specific Integrated Circuit). The functions of the electronic device 900 can be integrated into a node of a wireless network compliant with an IEEE 802.11 standard by updating software, i.e. for example by updating the firmware of the electronic device 900.

Claims

1. A method for connecting a node of a wireless-communication coverage-extension system comprising a backhaul subnetwork in tree form comprising a set of nodes interconnected by wireless or cable by so-called backhaul connections, a plurality of backhaul subnetwork nodes implementing an access-point functionality of one and the same wireless communication network, the wireless-communication coverage-extension system being adapted for making it possible to connect devices to said nodes by means of the wireless communication network or by cable in order to form an initial local area network, said connection method comprising the following steps performed by said node: - determining (S200) whether said node has been moved out of said initial local area network; and, in the case where the node has been moved: - establishing (S210) a local area network from said moved node by activating an address-server functionality; - connecting (S220) said moved node to a point of access to the internet; - establishing (S230) a secure tunnel between said moved node and a master node coordinating said initial local area network; - deactivating (240) the address-server functionality and activating a client functionality of an address server of said initial local area network.

2. The method according to claim 1, wherein determining whether said node has been moved out of said initial local area network comprises: - attempting to establish, during a predefined time, a backhaul connection between said node and at least one other node of said backhaul subnetwork; - determining that said node has been moved out of said initial local area network in the case where said attempt has failed.

3. The method according to claim 1, wherein determining whether said node has been moved out of said initial local area network comprises determining that said node has been moved out of said initial local area network in the case where a list of access points visible to a radio interface of said node, referred to as first list, is very different from a second list of access points stored in memory, said second list being a list of access points that were visible to said radio interface when said node was in said initial local area network, said first and second lists being very different in the case where a percent-age of access points of the first list that are found in the second list is below a threshold value.

4. The method according to one of claims 1 to 3, wherein establishing a local area network from said moved node by activating an address-server functionality comprises: - functionalising its access-point functionality of said wireless communication network; - establishing a DHCP server functionality and a DNS server functionality; and - sending a DHCP lease to the terminals that so request.

5. The method according to one of claims 1 to 4, wherein connecting said moved node to a point of access to the internet comprises: - determining a list of at least one access point to which said node can connect; - selecting an access point in said list from a web page displayed on a screen of a terminal connected to said moved node; and - connecting said moved node to said selected access point.

6. The method according to one of claims 1 to 5, wherein said selected access point is a first access gateway to the internet.

7. The method according to one of claims 1 to 6, wherein establishing a secure tunnel between the moved node and said master node, said master node being connected to a second access gateway to the internet, comprises: a) sending a connection request to a domain name corresponding to said second gateway through a predefined port, said connection request comprising a client certificate of said moved node signed by a root certificate of a current node; and b) if said client certificate is received and validated by said master node: - receiving a server certificate of said master node signed by a root certificate of said master node; - validating the server certificate received using the root certificate of said master node; - establishing a tunnel between said node and said master node; c) otherwise repeating the steps a) to c) until said tunnel is established between said node and said master node, said steps being repeated with said connection request comprising a client certificate of said moved node signed by a root certificate of another node different from said current node.

8. A node of a wireless-communication coverage-extension system comprising a backhaul subnetwork in tree form comprising a set of nodes interconnected by wireless or cable by so-called backhaul connections, a plurality of nodes of the backhaul subnetwork implementing an access-point functionality of one and the same wireless communication network, the wireless-communication coverage-extension system being adapted for making it possible to connect devices to said nodes by means of the wireless communication network or by cable in order to form an initial local area network, said node being configured for performing the steps of the method according to any one of claims 1 to 7.

9. A computer program, characterised in that it comprises instructions for implementing, by a node of a backhaul subnetwork of a wireless-communication coverage-extension system, the method according to any one of claims 1 to 7, when said program is executed by a processor of said node.

10. Storage means, characterised in that they store a computer program comprising instructions for implementing, by a node of a backhaul subnetwork of a wireless-communication coverage-extension system, the method according to any one of claims 1 to 7, when said program is executed by a processor of said node.