Method for communication between a first device and a remote server, corresponding method for managing communications, first device, remote server and computer program

Abstract

The invention relates to a method for managing the communications of a first device, implemented by a remote server, which method comprises: establishing (21) a first secure connection between the first device and the remote server, via a first communication interface of the first device; and transmitting (22), using the first secure connection, an instruction for managing at least one current MAC address associated with at least one second communication interface of the first device.

Description

[0001] DESCRIPTION

[0002] TITLE: Method of communication between a first device and a remote server, method of managing communications, first device, remote server and corresponding computer program.

[0003] 1. Field of the invention

[0004] The field of the invention is that of communications within at least one communication network, for example a computer network implementing the IP protocol.

[0005] More specifically, the invention relates to the management of at least one MAC address (in English “Media Access Control”) assigned to at least one interface of equipment connected to a communications network.

[0006] The invention notably proposes a solution making it possible to contribute to preserving the confidentiality of communications.

[0007] 2. Prior art

[0008] The QUIC protocol Error! Reference source not found. is a communication protocol based on the UDP (User Datagram Protocol) transport layer. Compared to the use of the TCP (Transmission Control Protocol), the QUIC protocol notably reduces the latency times generally observed when establishing TCP connections.

[0009] The QUIC protocol encrypts not only the payload, unlike the TLS (Transport Layer Security) protocol, but also the connection control information. Thus, traditional solutions for inserting application proxies are not directly reusable for communications established using the QUIC protocol. QUIC connection control information sent in clear text is limited to the strict minimum. For example, a QUIC packet includes an unencrypted header, including one or more flags, one or more connection identifiers, and a packet number.

[0010] In order to support a change of IP address of a device, such as a terminal, without having to close an ongoing QUIC connection, the QUIC protocol does not rely on transport identifiers, a transport identifier (also sometimes referred to as a "transport address") being defined by a quadruplet {source IP address, source port number, destination IP address, destination port number}, but on at least one connection identifier, called CID (for "Connection IDentifier") or CONNECTIONJD.

[0011] The QUIC specification defines two types of CID: Destination CID and Source CID.

[0012] The QUIC protocol supports a connection migration mechanism that allows a QUIC connection to be kept active in the event of a change in one of the addresses (or port numbers) of the devices involved in establishing and maintaining the QUIC connection (including address changes made by NATs (for "Network Address Translation") placed on a path taken by the data exchanged under a QUIC connection). Thus, a connection migration consists of moving from a transport identifier defined by a quadruplet {source address, source port, destination address, destination port} to another. In the following, and as an example, a communication path is identified by a transport identifier defined by a quadruplet {source address, source port, destination address, destination port}. The modification of at least one parameter of this quadruplet gives rise to a new communication path.It should be noted, however, that this definition does not require that the corresponding "physical" paths be wholly or partly disjoint (in other words, the modification of said at least one parameter does not mean that the physical paths, i.e. the routes taken by the data, differ). The devices participating in the establishment and maintenance of the QUIC connection can validate a new address used, for example, by the QUIC device at the origin of the establishment of the connection using the PATH_CHALLENGE and PATH_RESPONSE frames exchanged between these devices to validate a connection migration. The same connection migration procedure is implemented in the event of the announcement of a new address by the remote device.

[0013] Although this solution allows a QUIC connection to be maintained in the event of a change in the communication path (i.e., in the event of a modification of one of the addresses or port numbers in the quadruplet {source IP address, source port number, destination IP address, destination port number}), it has the disadvantage of allowing the tracing of communications by a user of a device with which the QUIC connection has been established. This may thus harm the confidentiality of data exchanged by users of such devices, or data characteristic of these users.

[0014] A first solution to try to limit the tracing of communications in the event of connection migration is based on the use of new connection identifiers for communications established on other paths, within the same QUIC connection.

[0015] However, such a solution is not sufficient to provide strict guarantees regarding the non-traceability of QUIC connections, particularly when the same MAC address is used by equipment such as a terminal for communications established on different paths.

[0016] It is worth noting that MAC addresses are identifiers assigned to network interfaces for communication purposes. These identifiers are generally assigned by network card manufacturers. A MAC address is often considered unique and permanent (i.e., unchanged over time), which makes it possible to track and identify equipment such as a terminal, even when it is in motion. There is therefore a need for a new solution to improve the confidentiality of communications.

[0017] 3. Statement of the invention

[0018] The invention proposes a solution in the form of a method for managing the communications of a first device, implemented by a remote server, comprising: establishing a first secure connection between said first device and said remote server, via a first communication interface of said first device, transmitting, using said first secure connection, an instruction for managing at least one current MAC address associated with at least one second communication interface of the first device.

[0019] It is noted that the first and second communication interfaces of the first device may be the same interface or separate interfaces. For example, the first device is a terminal (fixed or mobile, such as a computer, a smartphone, etc.) comprising one or more communication interfaces, for example a WLAN (Wireless LAN) interface, an Ethernet interface, etc.

[0020] The first device and the remote server may be connected to the same network, for example an access network, or to separate networks. For example, the first device is connected to a local area network, such as a home network or a corporate intranet. Such a network may optionally be a hierarchical network, i.e., a network in which one or more IP routers have been deployed. The first device may be connected to the remote server via an access router. The remote server may in particular be connected to the access network to which the terminal connects or to another network. The IP connectivity may be provided via a wired network, or a wireless network (for example, 5G), or both.

[0021] No assumption is made subsequently as to the nature of the equipment involved or the architecture of the network(s). Similarly, no assumption is made as to the nature of the service(s) implemented on the basis of MAC addresses.

[0022] According to at least one embodiment of the invention, the server can trigger a procedure for managing the current MAC address, by sending to the first device an instruction for managing this current MAC address. For example, such a management instruction belongs to the group comprising: a request for renewal of said at least one current MAC address, a request for extension of the validity period of said at least one current MAC address.

[0023] The proposed solution thus makes it possible, according to at least one embodiment, to avoid the tracing of communications thanks to the management of MAC addresses (for example, the renewal of the current MAC address or the extension of its validity period), and consequently to contribute to the preservation of the confidentiality of data exchanged by users of such equipment or data characteristic of these users.

[0024] Such a server-initiated MAC address management procedure is, for example, called an ADET procedure for “ADvancEd anti-Tracking system”.

[0025] In particular, an extension of the validity period of said at least one current MAC address may prove more effective in certain situations and / or for certain services, or in anticipation of a possible renewal request. This makes it possible in particular to make the procedure more robust (for example by preventing the concomitant renewal of the MAC addresses of all active interfaces of a device).

[0026] In particular, this instruction for managing the current MAC address is transmitted using a secure connection, which improves the security of exchanges between the first device and the remote server.

[0027] For example, the first secure connection relies on a secure communication protocol, such as QUIC, MP-QUIC (Multipath QUIC), or CoAP (Constrained Application Protocol) when used in conjunction with DTLS (Datagram Transport Layer Security), etc.

[0028] When using the MP-QUIC protocol, connection migration can be replaced by a function of adding / removing communication paths between the server and the first device.

[0029] The proposed solution thus offers the advantage of using functions supported by a secure communication protocol.

[0030] If the secure connection implements a protocol such as QUIC, a request to renew at least one current MAC address is, for example, transmitted in a QUIC frame called "MAC_RENEW" here.

[0031] According to a particular embodiment, a communication being established on a first communication path between the first equipment and the remote server and using said at least one current MAC address, the instruction for managing said at least one current MAC address is transmitted following the detection of an event relating to said communication belonging to the group comprising: a duration of use of said at least one current MAC address, a duration of validity of said at least one current MAC address, or in other words a deadline for the renewal of said at least one current MAC address, a detection of migration of the communication established on the first communication path to at least one second communication path.According to at least one embodiment of the invention, the remote server can thus trigger the procedure for managing the current MAC address upon detection of an event relating to a communication using at least one current MAC address associated with an interface of the first device.

[0032] For example, the remote server may detect a long-term communication using said at least one current MAC address associated with at least one second interface of the first device, and request the first device to renew the current MAC address(es) concerned. The remote server may thus control the lifetime of a MAC address used by a client.

[0033] Alternatively, the remote server may detect a migration of communication from at least one first communication path to at least one second communication path. For example, the remote server detects a migration of communication following receipt of a message sent by the first device with a new transport identifier (e.g., a new source IP address).

[0034] The MAC address renewal request can also be sent to the first device prior to the migration. For example, a QUIC notification can be sent by the remote server to the first device to inform it of the upcoming migration.

[0035] According to this embodiment, it is thus possible to avoid, or at least reduce the risk of tracing the first device, particularly in the case of long-term communication or connection migration.

[0036] It is noted that such communication can be established between the first equipment and the server, or the first equipment and a second equipment connected to the same network as the first equipment or to a separate network.

[0037] In a particular embodiment, a communication being established on a first communication path between the first equipment and the remote server and using said at least one current MAC address, said remote server delays the transmission of data on the first path for a defined duration (for example of the order of a few milliseconds or a few seconds) or as long as the remote server has not received confirmation of association of at least one new MAC address with said at least one second interface of said first equipment to continue the communication on the first communication path.

[0038] The said set duration can be configurable.

[0039] In other words, the remote server does not use the first communication path during the renewal of at least one MAC address associated with at least one interface of the first device, and observes a timeout (hereinafter called a “pause” period) by storing, for example, the data in a buffer memory. Thus, no useful data is transmitted during a given period, for example of the order of 100 ms.

[0040] In another particular embodiment, a communication being established on a first communication path between the first equipment and the remote server and using said at least one current MAC address, said remote server transmits data on at least one second path between the first equipment and the remote server for a defined duration (for example of the order of a few milliseconds or a few seconds, this duration being configurable) or as long as said remote server has not received confirmation of association of at least one new MAC address with said at least one second interface of said first equipment to continue the communication on the first communication path.

[0041] In other words, the remote server does not use the first communication path during the renewal of at least one MAC address associated with at least one interface of the first device, and transmits the data on at least one second communication path (alternative path). Thus, the useful data can be transmitted on another available path for a given period, for example of the order of ls.

[0042] In a particular embodiment, the remote server may in particular send to the first device a request to extend the validity period of the MAC address associated with an interface of the first device used for communications with the remote server on the second path, so as to ensure that this MAC address is not modified during the defined duration or as long as the remote server has not received confirmation of association of a new MAC address with the interface of the first device and used for communications with the server on the first path.

[0043] These different embodiments make it possible to avoid, or at least reduce, the risk of data loss while a MAC address is being renewed.

[0044] In a particular embodiment, the instruction for managing at least one current MAC address comprises at least one element belonging to the group comprising: one or more interface identifiers (making it possible to identify the interface(s) of the first device which must be associated with a new MAC address), one or more network path identifiers (making it possible to identify the current and / or previously used communication path(s) between said first device and the remote server). For example, such identifiers may be an address, an address identifier, etc. etc.

[0045] These identifiers, when present, can be used by the first device to select the interface(s) associated with a MAC address to be managed. The invention also relates to a method of communication between a first device and a remote server, implemented by said first device, comprising: establishing a first secure connection between said first device and said remote server, via a first communication interface of said first device, receiving, using said first secure connection, an instruction for managing at least one current MAC address associated with at least one second communication interface of said first device, executing said management instruction.

[0046] According to this embodiment, the management of at least one MAC address of the first device is implemented at the request of the remote server.

[0047] As indicated above, the server can thus trigger a procedure for managing at least one current MAC address associated with at least one interface of the first device, for example following the detection of an event relating to a communication using this current MAC address.

[0048] The proposed solution makes it possible in particular, according to at least one embodiment, to avoid the tracing of communications thanks to the management of MAC addresses, and consequently to contribute to the preservation of the confidentiality of data exchanged by users of such equipment or data characteristic of these users.

[0049] In a particular embodiment, the execution of said management instruction comprises the association of at least one new MAC address with said at least one second interface.

[0050] This way, at least one current MAC address can be renewed and replaced with a new MAC address.

[0051] In a particular embodiment, said at least one new MAC address is chosen so that it cannot be correlated with said at least one current MAC address.

[0052] This way, malicious equipment cannot detect that these MAC addresses are associated with the same equipment.

[0053] In particular, it is recalled that if the same MAC address associated with at least one interface of the terminal is exposed on different communication paths, the communications established on the different paths can be correlated.

[0054] According to this embodiment, the proposed solution thus offers a solution to contribute to preserving the confidentiality of communications by avoiding exposing information which makes it possible to deduce that it is a migration of a communication established on a first communication path to a communication established on at least one second communication path. In a particular embodiment, the association of at least one new MAC address with said at least one second interface implements a conventional MAC address renewal technique, for example a technique for randomly generating MAC addresses ("randomization").

[0055] In another embodiment, the association of at least one new MAC address with said at least one second interface implements a new technique called here MUSC (in English “Efficient MAC address Update for Service Continuity”), as described in the French patent application FR2205880 filed on 06 / 16 / 2022.

[0056] In particular, such a procedure can be implemented when said at least one current MAC address is used to communicate with or via at least one second device located on a communication path between said first device and said remote server, or one intermediate device located on a communication path between said first device and said second device.

[0057] In particular, such a second device may be an access router that allows said first device to be connected to the remote server. The intermediate device may be another router located on the path between the first device and the second device.

[0058] For example, the first equipment implements: the establishment of a second secure connection between said first equipment and said second equipment, via a third communication interface of said first equipment, the transmission, using said second secure connection, of a message comprising at least one encrypted MAC address, associated or capable of being associated with said third interface and used to communicate with or via said second equipment or said intermediate equipment.

[0059] It is noted that the first, second and third communication interface of the first equipment may be the same interface or separate interfaces.

[0060] Thus, according to this embodiment of the invention, the first device can declare to the second device the current MAC address that it uses to communicate with or via the second device, or at least one candidate MAC address that it wishes to use to communicate with or via the second device. The encryption of at least one MAC address makes it possible to reinforce the confidentiality of the transmitted information. In addition, this embodiment makes it possible to communicate this or these MAC addresses to the second device when it is not directly connected to the first device (case of a hierarchical network for example). Finally, it is possible for a device receiving said message to compare the source MAC address of the message (which can be transported in clear text in the header of the message) with the encrypted MAC address as declared in the message, to detect possible fraudulent manipulation of the MAC addresses.

[0061] The proposed solution thus makes it possible, according to at least one embodiment, to contribute to the preservation of the confidentiality of communications.

[0062] For example, the second secure connection relies on a secure communication protocol, such as the QUIC protocol, the CoAP protocol over DTLS, etc. The proposed solution thus offers the advantage of using functions supported by a secure communication protocol, and does not simply rely on the use of MAC addresses. The use of a secure channel and the encryption of MAC addresses makes it possible, in particular, to obtain authorization for access to the network based on the MAC address even if the access control is activated by equipment that is not on the same link (i.e. located several IP hops away).

[0063] The message corresponds for example to at least one frame belonging to the group comprising: a frame which describes the current MAC address that the first device uses to communicate with or via the second device, for example a QUIC frame called here “CURRENT_MAC_ADDRESS”, a frame which describes a candidate MAC address that the first device plans to use to communicate with or via the second device, for example a QUIC frame called here “CANDIDATE_MAC_ADDRESS”, a frame which describes a list of MAC addresses that the first device plans to use to communicate with or via the second device, for example a QUIC frame called here “LIST_MAC_ADDRESS”.

[0064] In a particular embodiment, the proposed solution makes it possible in particular to offer continuity of service, even in the event of MAC address renewal.

[0065] In particular, the proposed solution does not require explicit authentication or establishment of a security association between the first device (terminal for example) and the second device (access router for example) for each exchange of packets with devices external to the network.

[0066] In a particular embodiment, the first device and the server can exchange messages to confirm that they are capable of implementing the invention, according to at least one embodiment.

[0067] For example, the first device implements the transmission of a first parameter signaling to the server that the first device supports the MAC address management procedure initiated by the server (ADET procedure). The server also implements, for example upon receipt of this first parameter, the transmission of a second parameter signaling to the first device that the server is capable of managing the MAC addresses of the first device. For example, such parameters are QUIC transport parameters called here “mac-update”, and valued at “1” to indicate that the device sending the QUIC message comprising such a parameter supports the method according to the invention.

[0068] The exchange of such parameters can be implemented before the transmission, by the server, of the MAC address management instruction.

[0069] In other embodiments, the invention relates to a first equipment and a corresponding remote server.

[0070] An embodiment of the invention also aims to protect one or more computer programs comprising instructions adapted to the implementation of at least one step of the methods according to at least one embodiment of the invention as described above, when this or these programs are executed by a processor, as well as at least one information medium readable by a computer comprising instructions of at least one computer program as mentioned above.

[0071] 4. List of figures

[0072] Other characteristics and advantages of the invention will appear more clearly on reading the following description of a particular embodiment, given as an illustrative and non-limiting example, and the appended drawings, among which: Figure 1 presents an example of network architecture; Figure 2 illustrates the main steps implemented by a first device and a remote server according to at least one embodiment of the invention; Figure 3 illustrates the exchange of parameters to verify the compatibility of the first device and the remote server according to one embodiment of the invention; Figure 4 illustrates an example of network architecture implementing a MUSC procedure on one of the communication paths between the first device and the remote server;Figure 5 shows examples of messages exchanged between a first device, a first access router and a remote server when the MUSC procedure is implemented following the reception of a management instruction from the remote server; Figure 6 illustrates an example of a network architecture implementing a MUSC procedure on each of the available communication paths following the reception of a management instruction from the remote server; Figure 7 shows examples of messages exchanged between the first device, the first access router, and the remote server, and between the first device, a second access router, and the remote server, when the MUSC procedure is implemented for each of the available communication paths following the reception of a management instruction from the remote server;Figure 8 shows the simplified structure of a first piece of equipment, respectively of a remote server, according to a particular embodiment.;

[0073] 5. Description of an embodiment of the invention

[0074] 5.1 General principle

[0075] The general principle of the invention is based on the management, by a remote server, of at least one current MAC address associated with at least one communication interface of a first device, so as to limit the risks of tracing the first device and thus to contribute to the preservation of the confidentiality of communications.

[0076] The first device and the remote server may be connected to the same network, for example to an access network, or to separate networks. For example, as illustrated in FIG. 1, the first device H 11 is considered to be a multi-interface terminal, which may use the same interface or separate interfaces to connect to one or more access networks. In the following, the first device is considered to be connected to at least one access network, for example to a first access network NET. #1 121 and to a second access network NET. #2 122. The remote server S 13 may be connected to an external network, for example the network of an operator with which the user of the first device has subscribed to an Internet service offer 131 (ISP, "Internet Service Provider") or to another network managed by a third party, or directly to the access networks NET. #1 121 and / or NET. #2 122.The first equipment 11 can communicate with the remote server 13 via the first access router RI 1211 of the first access network NET. #1 121 and / or via a second access router R2 1221 of the second access network NET. #2 122.

[0077] As indicated previously, other network architectures or other types of equipment may be used within the framework of the invention.

[0078] As discussed in relation to the prior art, the first equipment 11 conventionally uses the same MAC address (e.g. @MAC1) to communicate with the server 13, regardless of the communication path used (first communication path via the first access router 1211 or second communication path via the second access router 1221), particularly when the same interface is used to connect to these access networks. In other words, the same MAC address is exposed on the different communication paths, and the communications established on these different paths can be correlated. A malicious equipment can therefore easily trace the communications emanating from the first equipment 11, even if the access network to which the first equipment connects changes.

[0079] The proposed solution makes it possible to manage at least one MAC address associated with at least one interface of the first device 11, for example by modifying this MAC address in the event of migration of the communication from a first communication path to at least one second communication path. The same procedure can also be used in the event of maintaining the communication on several communication paths (i.e. during simultaneous use of the resources associated with the different paths in the absence of migration of the communication). It is also possible to control the duration of use of a MAC address, for example depending on the service invoked, or to extend its validity period.

[0080] Figure 2 illustrates the main steps implemented by a remote server and by a first piece of equipment, for example the server 13 and the first piece of equipment 11 of Figure 1, for implementing the methods according to at least one embodiment of the invention.

[0081] During a first step 21, a first secure connection between the first device and the remote server is established, via a first communication interface of the first device. Since the establishment of such a secure connection is conventional, it is not described in more detail here.

[0082] The server 13 can then transmit (22) to the first device 11, using the first secure connection, an instruction for managing at least one current MAC address associated with at least one second communication interface of the first device (the first and second communication interfaces being able to be the same interface or separate interfaces).

[0083] Such a management instruction is, for example, of the type request for renewal of the current MAC address or request for extension of the validity period of the current MAC address.

[0084] For example, the server can trigger the sending of an instruction for managing at least one MAC address when the duration of use of the current MAC address is greater than a defined duration, when a validity duration of the current MAC address is reached (corresponding to a deadline for the renewal of the current MAC address) and / or following the migration of a communication established on a first communication path to at least a second communication path, etc.

[0085] The first equipment 11 can thus receive (23) the management instruction of at least one current MAC address associated with at least one second communication interface of the first equipment, using the first secure connection.

[0086] The first device can then execute (24) the corresponding management instruction, for example renewing the current MAC address @MAC1 and associating at least one new MAC address @MAC2 with the relevant interface of the first device.

[0087] According to a particular embodiment, the first device can implement a conventional procedure for associating at least one MAC address with at least one of its interfaces.

[0088] In another embodiment, the first device can implement a new procedure for associating at least one MAC address with at least one of its interfaces, called the MUSC procedure, as described in the aforementioned French patent application FR2205880.

[0089] Such a MUSC procedure can in particular be implemented between the first device and a second device located on a communication path between the first device and the server, for example the first access router 1211 and / or the second access router 1221 of FIG. 1.

[0090] 5.2 Examples of implementation

[0091] Various examples of implementation of the invention are described below, according to which the first secure connection between the server and the first device uses the QUIC protocol. As already indicated, in other embodiments, the first secure connection can use the CoAP over DTLS protocol or any other protocol allowing the establishment of a secure connection. No assumption is made as to the use of the QUIC protocol. The proposed solution can also be applied to QUIC communications established on several paths by exploiting the MP-QUIC resources. The exploitation of all or part of these different paths can be the subject of a negotiation between the server and the first device.

[0092] As illustrated in Figure 3, according to a particular embodiment, the first device can use a new QUIC transport parameter (as provided in section 7.4.2 of the RFC 9000 document, May 2021), called here “mac-update”, to signal to the server that it supports the MAC address management procedure initiated by the server (ADET procedure). For example, the first device 11 implements the transmission 31 of a first parameter signaling to the server 13 that the first device 11 is able to modify its current MAC address or to extend its validity period, using the first secure connection. If the server also supports the ADET procedure, it can respond using the new QUIC transport parameter “mac-update”, also using the first secure connection.In other words, the server 13 implements the transmission 32 of a second parameter signaling to the first equipment 11 that the server 13 is capable of managing at least one MAC address associated with at least one interface of the first equipment.

[0093] These first and second parameters are for example set to “1” (mac-update = 0x1) to indicate support for the ADET procedure.

[0094] The server can then transmit to the first device a MAC address management instruction, for example a request to renew at least one of its current MAC addresses in a QUIC frame called here “MAC_RENEW” 33.

[0095] An example of implementation of the invention is presented below in relation to Figures 4 and 5. Figure 4 illustrates an example of network architecture, according to which the first equipment 11 can communicate with the remote server 13 via the first access router RI 1211 of the first access network NET. #1 121.

[0096] Figure 5 illustrates examples of messages exchanged between the first equipment 11, the first access router 1211 and the server 13 when the MUSC procedure is implemented following the reception of a management instruction from the remote server.

[0097] A secure QUIC Connect connection #1 (51) is established between the first device 11 and the server 13. The secure QUIC Connect connection #1 established between the first device 11 and the server 13 via the first access router 1211 is characterized by CID connection identifiers (in particular source CID).

[0098] As explained in relation to Figure 3, QUIC “mac-update” transport parameters can be exchanged between the first device 11 and the server 13 to verify that they support the MAC address management procedure (ADET procedure) according to one embodiment of the invention.

[0099] It is subsequently assumed that the first device 11 and the server 13 support the ADET procedure.

[0100] Data D can in particular be exchanged between the first device 11 and the server 13 via the secure connection QUIC Connect. #1, by the first communication path via the first access router 1211.

[0101] For example, it is considered that the server 13 detects that the first device 11 has established a long-term communication (for example of duration greater than a given threshold recommended for the current service) with a second device located on the first communication path (for example with the server 13 or with the first access router 1211), using a current MAC address @MAC1 associated with a communication interface of the first device to communicate with or via the second device.

[0102] The server 13 can then trigger the MAC address management procedure so as to prevent the first device from establishing ongoing communications based on the use of the same MAC address.

[0103] To do this, the server 13 can send a request to renew the @MAC1 address used by the first device 11, so that the MAC address used for transmitting packets on the first path is modified. The server 13 can for example send a MAC_RENEW frame to the first device 11 via the secure QUIC Connect connection. #1, and a MAC address negotiation cycle can then be triggered.

[0104] A MUSC procedure may in particular be implemented between the first device 11 and the second device, to associate a new MAC address with the interface used by the first device to communicate with or via the second device. For example, the second device is considered to be the first access router 1211.

[0105] To do this, a secure connection QUIC Connect. #2 (52) is established between the first device 11 and the first access router 1211. For example, such a secure connection uses the QUIC protocol, the CoAP over DTLS protocol, etc.

[0106] The first device 11 can then transmit a message to the first access router 1211, using the secure QUIC Connect connection. #2. Such a message comprises at least one encrypted MAC address, associated or capable of being associated with the interface in question of the first device, and used to communicate with or via the first access router 1211 or an intermediate device located on a communication path between the first device and the first access router 1211.

[0107] The first access router 1211 can thus receive such a message, and validate the MAC address(es) received.

[0108] Different types of messages can be sent from the first device 11 to the first access router 1211.

[0109] In the example of Figure 4, the first device 11 can generate at least one new MAC address @MAC 2 and transmit this new encrypted @MAC 2 address in a message using the secure connection QUIC Connect. #2. The first access router 1211 can then validate the new @MAC 2 address and, if necessary, update the filtering rules that it maintains.

[0110] For example, once the new @MAC 2 address is associated with the relevant interface of the first device, the new @MAC 2 address becomes the current MAC address associated with the relevant interface. A message corresponding to at least one QUIC frame that describes the current MAC address that the first device uses to communicate with or via the first access router 1211, called for example here “CURRENT_MAC_ADDRESS”, can then be transmitted from the first device 11 to the first access router 1211.

[0111] The insertion of the current MAC address in the new frame, and therefore its encryption linked to the use of the secure QUIC connection, allows the first access router 1211 to compare information transported in the encrypted part of the message (for example the current MAC address) with information conveyed in clear in the QUIC connection (for example the source MAC address) and to detect possible manipulation of the information conveyed in clear.

[0112] Inserting the current MAC address into the new frame also makes it possible to communicate the current MAC address to the first access router 1211 even if it is not directly connected to the first device (case of an intermediate device of the router type for example). The first device 11 can then use the @MAC2 address to communicate with the server 13 using the first secure connection QUIC Connect. #1 (53), via the first access router 1211.

[0113] It is noted that prior to the transmission of the encrypted message on the secure connection QUIC Connect #2, QUIC transport parameters “mac-update” can be exchanged between the first device 11 and the first access router 1211 to verify that they support the MUSC procedure according to an embodiment of the invention.

[0114] For example, the first device uses the new QUIC transport parameter "mac-update" to signal to the first access router 1211 that it supports the MUSC procedure. If the first access router 1211 also supports the MUSC procedure, it can respond using the new QUIC transport parameter "mac-update".

[0115] These first and second parameters are for example set to “1” (mac-update = 0x1) to indicate support for the MUSC procedure.

[0116] We now present, in relation to Figures 6 and 7, another example of implementation of the invention, according to which the MUSC procedure can be implemented before the ADET procedure. Indeed, no assumption is made as to the order of invocation of these different steps of the invention.

[0117] Figure 6 illustrates an example of network architecture, according to which the first equipment 11 can communicate with the remote server 13 via the first access router RI 1211 of the first access network NET. #1 121 and / or via the second access router R2 1221 of the second access network NET. #2 122.

[0118] Figure 7 illustrates examples of messages exchanged between the first equipment 11, the first access router 1211 and the server 13, and between the first equipment 11, the second access router 1221 and the server 13, when the MUSC procedure is implemented for each of the communication paths between the first equipment and the remote server available following the reception of a management instruction from the remote server.

[0119] According to this second example, a MUSC procedure can be implemented between the first equipment 11 and a second equipment located on a communication path between the first equipment 11 and the server 13. For example, a first MUSC procedure can be implemented between the first equipment 11 and the first access router 1211, and a second MUSC procedure can be implemented between the first equipment 11 and the second access router 1221. As many MUSC procedures as there are communication paths between the first equipment 11 and the server 13 can be implemented.

[0120] The first MUSC procedure implements the following steps.

[0121] A secure connection QUIC Connect. #1 (71) is established between the first device 11 and the first access router 1211. For example, such a secure connection uses the QUIC protocol, or alternatively the CoAP over DTLS protocol, etc.

[0122] As explained above, QUIC “mac-update” transport parameters may optionally be exchanged between the first equipment 11 and the first access router 1211 to verify that they support the MUSC procedure according to an embodiment of the invention.

[0123] The first device 11 can then transmit a message to the first access router 1211, using the secure QUIC Connect connection. #1. As indicated above in relation to FIG. 5, such a message comprises at least one encrypted MAC address, associated or capable of being associated with the interface in question of the first device, and used to communicate with or via the first access router 1211 or an intermediate device located on a communication path between the first device and the first access router 1211.

[0124] The first access router 1211 can thus receive such a message, and validate the MAC address(es) received.

[0125] Different types of messages can be sent from the first device 11 to the first access router 1211.

[0126] According to a first example, the message corresponds to a QUIC “CURRENT_MAC_ADDRESS” frame which describes the current MAC address that the first device uses to communicate with or via the first access router 121. Such a current MAC address is therefore already assigned to the interface used to contact the first access router 1211.

[0127] According to a second example, the first device 11 can prepare the migration of MAC addresses by indicating in advance to the first access router 1211 at least one MAC address that it plans to use, called a candidate MAC address.

[0128] According to this second example, the message sent from the first device 11 to the first access router 1211, via the secure connection QUIC Connect. #1, corresponds to a QUIC frame, called for example here “LIST_MAC_ADDRESSES”, comprising at least one encrypted candidate MAC address that the first device plans to use to communicate with or via the first access router 1211 (for example a5:c7:ef:82:58:e9, el:44:5c:32:3c:72, ee:3c:50:18:7e:44). At this stage, none of these candidate MAC addresses is associated with the interface considered of the first device 11.

[0129] In particular, before associating a candidate MAC address with an interface of the first device 11, the first device 11 can check with the first access router 1211 that the candidate MAC address is available. This makes it possible in particular to avoid a conflict with the MAC addresses used by other devices connected to the same network and avoids impacting the service access delay induced by a change of MAC address.

[0130] According to a third example, the message sent by the first device 11 to the first access router 1211, via the secure connection QUIC Connect #1, corresponds to a QUIC frame, called for example here “CANDIDATE_MAC_ADDRESS”, comprising at least one encrypted candidate address.

[0131] Thus, according to these different examples, the first device implements a MUSC procedure to associate a MAC address with at least one of its interfaces and validate this MAC address.

[0132] Alternatively, the first device may use a default MAC address, configured for example by a user of the first device or by the operating system.

[0133] In the example illustrated in Figure 7, we consider for example that the first device 11 transmits to the first access router 1211 a message corresponding to a QUIC frame “CURRENT_MAC_ADDRESS” carrying the address @MAC1.

[0134] A secure connection QUIC Connect. #2 (72) is also established between the first device 11 and the server 13 (before, during or after the establishment of the secure connection QUIC Connect. #1). Several connection identifiers can be used.

[0135] For example, the secure connection QUIC Connect #2 established between the first device 11 and the server 13 via the first access router 1211 (resp. second access router 1221) is characterized by first (resp. second) connection identifiers, in particular source CID, negotiated beforehand (Section 19.15 of RFC 9000) with the server 13. It is therefore considered that there is a single secure connection between the first device 11 and the server 13, corresponding to the different communication paths between the first device 11 and the server 13.

[0136] As explained in relation to Figure 3, QUIC “mac-update” transport parameters can be exchanged between the first device 11 and the server 13 to verify that they support the MAC address management procedure (ADET) according to one embodiment of the invention.

[0137] Data D can in particular be exchanged between the first device 11 and the server 13 via the secure connection QUIC Connect. #2, by the first communication path via the first access router 1211.

[0138] If the first device 11 is mobile for example, or if the traffic via the first access router 1211 is congested, the first device 11 can migrate a communication established with the server 13 on the first path via the first access router 1211 to a second path via the second access router 1221.

[0139] For example, it is considered that the server 13 detects the use of a new transport identifier (for example a new source IP address when the data packets from the first device 11 and destined for the server 13 arrive by at least one new path or during an attempt at connection migration). For example, the server 13 detects that it receives data packets from different source addresses. The server 13 can trigger the MAC address management procedure according to an embodiment of the invention, so as to prevent the first device from always using the current MAC address @MAC1 to communicate with or via the second access router 1221.

[0140] To do this, the server 13 can send a request to renew the @MAC1 address used by the first device 11, so that the MAC address used for transmitting packets via the second path is different from that used for transmitting data on the first path. The server 13 can for example send a MAC_RENEW frame to the first device 11 via the secure connection QUIC Connect. #2, and a MAC address negotiation cycle can be triggered. It is recalled that the order of the different connections QUIC Connect. #1 (71) and QUIC Connect. #2 (72) is not important.

[0141] A MUSC procedure may in particular be implemented between the first device 11 and the second access router 1221, to associate a new MAC address with the interface used by the first device to communicate with or via the second access router 1221.

[0142] To do this, a secure connection QUIC Connect. #3 (73) is established between the first device 11 and the second access router 1221. For example, such a secure connection uses the QUIC protocol, or alternatively the CoAP over DTLS protocol, etc.

[0143] In the example of Figure 7, the first device 11 can generate at least one new MAC address @MAC 2 and transmit this new encrypted @MAC 2 address in a CURRENT_MAC_ADDRESS message using the secure QUIC Connect connection. #3. The second access router 1221 can then validate the new @MAC 2 address and, if necessary, update the filtering rules that it maintains.

[0144] The first device 11 can then use the @MAC2 address to communicate with the server 13 using the secure connection QUIC Connect. #2 (74), via the second access router 1221. A new connection identifier can be used during the migration. This identifier can be exchanged beforehand according to the procedure described in Section 19.15 of RFC 9000.

[0145] The secure connection QUIC Connect. #2 is therefore established on both paths via the first access router 1211 and via the second access router 1221, and one and / or the other of the paths can be used to exchange data between the first device 11 and the server 13.

[0146] In a particular embodiment, the remote server may, as a variant or in addition, send a request to extend the validity period of at least one current MAC address, for example the @MAC1 address used for communications on the first path.

[0147] The @MAC1 address can thus be retained for communications via the first access router 1211, and the @MAC2 address can be used for communications via the second access router 1221. Note that the MAC addresses used on the alternative paths are not communicated to the access routers located on the other paths. The proposed solution thus makes it possible to negotiate different MAC addresses for the first device 11, depending on the access network to which it is attached, even if the same interface of the first device 11 would be used for communications with the different access networks. For example, the first device 11 can communicate with the first access router 1211 via a first interface of the first device 11 using the MAC address @MAC1, and the first device 11 can communicate with the second access router 1221 via the first interface of the first device 11 using the MAC address @MAC2.

[0148] In these different embodiments, the new MAC address(es) are chosen so that they cannot be correlated with the current MAC address(es), so as to prevent the traceability of the first device. Thus, the first device uses a new MAC address which cannot be correlated with a previously used MAC address, for example during the last 24 hours.

[0149] According to at least one embodiment, the first device 11 can in particular confirm the renewal of its MAC address, by transmitting a message via the secure connection established with the server 13 (QUIC Connect #1 according to FIG. 5 or QUIC Connect #2 according to FIG. 7). For example, such a message transmitted from the first device to the server is named here “MAC_RENEWED” and includes the new MAC address associated with the interface considered of the first device 11.

[0150] According to at least one embodiment, a communication using the current MAC address @MAC1 being established on the first communication path via the first access router 1211, the remote server 13 delays the transmission of data on the first path for a defined duration or as long as the remote server has not received confirmation of association of at least one new MAC address with the first device to continue the communication on the first path (for example as long as the remote server has not received a MAC_RENEWED message). In other words, the server 13 can observe a “pause” period during the renewal of the MAC address of the first device 11 and associated with the first path, to avoid, or at least reduce, the risk of packet loss while the MAC address is being modified by the first device 11 according to the indications received from the server 13.For example, server 13 does not send payload data on the first path for a short configurable time, for example of the order of 100 ms.

[0151] According to at least one embodiment, a communication using the current MAC address @MAC1 being established on the first communication path via the first access router 1211, the remote server 13 transmits data on at least one other path for a defined duration or as long as the remote server has not received confirmation of association of at least one new MAC address with the first equipment to continue the communication on the first path (for example as long as the remote server has not received a MAC_RENEWED message).

[0152] In other words, the server 13 can use another path during the renewal of the MAC address of the first device 11 associated with the first path, to avoid, or at least reduce, the risk of packet loss while the MAC address is being modified by the first device 11 according to the indications received from the server 13. For example, the server 13 sends the useful data on at least one other available path (for example the second path via the second access router) for a short configurable duration, for example of the order of Is. It can also proceed with the duplicate sending of the data by the first path and by at least one other available path, so as to ensure that the first device receives the useful data.

[0153] According to a particular embodiment, the server can send a request to extend the validity period of the MAC address @MAC2 used for communications on the second path during the renewal of the MAC address @MAC1 used for communications on the first path.

[0154] According to at least one embodiment, the first device may refuse to implement the ADET procedure, in particular if a similar management instruction has already been received (for example, the same instruction has been received several times, a similar management instruction has been received from another server, etc.) or is in conflict with a previously received management instruction. To do this, a new error message may be transmitted by the first device to the server, for example using a new QUIC frame called here “REJECT_MAC_RENEW”.

[0155] In the embodiments presented above, the server 13 is the one who initiates the renewal of at least one MAC address of the first device. It is therefore the server that sends a QUIC “MAC_RENEW” frame to the first device. On the other hand, it is considered that the first device cannot send a QUIC “MAC_RENEW” frame to the server. In other words, the first device is not the one who initiates the renewal of at least one MAC address associated with one of its interfaces. If a “MAC_RENEW” type message is received by the server, the server can ignore it.

[0156] The implementation of a MUSC procedure for associating MAC addresses on the interfaces of the first device for all available paths between the first device and the server has been described above in relation to Figures 6 and 7. Alternatively, such a procedure can be implemented on certain paths only. Alternatively, such a procedure can be implemented upon receipt of a MAC address renewal request sent by the remote server (reception of a QUIC MAC_RENEW frame by the first device). According to one embodiment, a new MAC address can be generated in a conventional manner for at least one interface of the first device or one path. In this case, the first device locally implements a procedure for generating MAC addresses that cannot be correlated with the MAC addresses used in the past (for example during the last 24 hours).

[0157] In a particular embodiment, the random generation of MAC addresses is implemented locally by the first device. The server may in particular request the first device to extend the validity of at least one MAC address associated with at least one of its interfaces (which may be the one for which the address renewal is carried out or another interface, in particular in the case of short-term communication).

[0158] 5.3 Corresponding devices

[0159] Finally, in relation to figure 8, we present the simplified structures of a first equipment H and of a server S according to at least one embodiment of the invention.

[0160] The first equipment H (resp. the server S), according to one embodiment of the invention, comprises a memory 81 H (resp. 81s), a processing unit 82 H(resp. 82s), equipped for example with a programmable computing machine or a dedicated computing machine, for example a processor P, and controlled by the computer program 83 H (resp. 83s), implementing steps of the communication method (resp. of the communications management method) according to at least one embodiment of the invention.

[0161] At initialization, the computer program code instructions 83 H (resp. 83s) are for example loaded into a RAM memory before being executed by the processor of the processing unit 82 H (respectively 82s).

[0162] The Processing Unit 82 processor H of the first equipment implements steps of the communication method described previously, according to the instructions of the computer program 83 H, to: establish a first secure connection between a first device and said remote server, via a first communication interface of said first device, transmit, using said first secure connection, an instruction for managing at least one current MAC address associated with at least one second communication interface of the first device.

[0163] The processor of the processing unit 82s of the server implements steps of the communications management method described previously, according to the instructions of the computer program 83s, to: establish a first secure connection between said first equipment and a remote server, via a first communication interface of said first equipment, receive, using said first secure connection, an instruction for managing at least one current MAC address associated with at least one second communication interface of said first equipment, execute said management instruction.

Claims

DEMANDS 1. A method for managing communications for a first piece of equipment (11), implemented by a remote server (13), comprising: - the establishment (21) of a first secure connection between said first equipment and said remote server, via a first communication interface of said first equipment, said first equipment and said remote server being connected to separate networks, - the transmission (22), using said first secure connection, of a management instruction of at least one current MAC address associated with at least one second communication interface of the first equipment, said instruction being transmitted for execution of the management instruction by the first equipment.

2. A method according to claim 1, characterized in that, a communication being established on a first communication path between said first equipment (11) and said remote server (13) and using said at least one current MAC address, said instruction for managing at least one current MAC address is transmitted following the detection of an event relating to said communication belonging to the group comprising: - a usage period for said at least one current MAC address, - a validity period for said address, at least one current MAC address, - a migration detection of said communication established on said first communication path to at least a second communication path.

3. A method according to any one of claims 1 and 2, characterized in that, a communication being established on a first communication path between said first equipment (11) and said remote server (13) and using said at least one current MAC address, said remote server delays the transmission of data on said first path for a defined period or until said remote server has received confirmation of association of at least one new MAC address to said at least one second interface of said first equipment to continue said communication on said first communication path.

4. A method according to any one of claims 1 to 3, characterized in that, after communication has been established on a first communication path between said first equipment (11) and said remote server (13) and using said at least one current MAC address, said remote server transmits data on at least a second communication path between said first equipment and said remote server for a defined duration or until said remote server has received confirmation of association of at least one new MAC address to said at least a second interface of said first equipment to continue said communication on said first communication path.

5. A method according to any one of claims 1 to 4, characterized in that said instruction for managing at least one current MAC address comprises at least one element belonging to the group comprising: - at least one identifier allowing the identification of said at least one second interface, - at least one communication path identifier enabling identification of at least one current and / or previously used communication path between said first equipment (11) and said remote server (13).

6. A communication method between a first piece of equipment (11) and a remote server (13), implemented by said first piece of equipment, comprising: - the establishment (21) of a first secure connection between said first equipment and said remote server, via a first communication interface of said first equipment, said first equipment and said remote server being connected to separate networks, - the reception (23), using said first secure connection, of a management instruction for at least one current MAC address associated with at least one second communication interface of said first equipment, - the execution (24) of said management instruction.

7. Method according to claim 6, characterized in that the execution of said management instruction implements the association of at least one new MAC address to said at least one second interface.

8. Method according to claim 7, characterized in that said at least one new MAC address is chosen so as not to be correlated with said at least one current MAC address.

9. A method according to any one of claims 6 to 8, characterized in that said at least one current MAC address is used to communicate with or through at least one second piece of equipment (1211, 1221) located on a communication path between said first piece of equipment (11) and said remote server (13), or an intermediate piece of equipment located on a communication path between said first piece of equipment and said second piece of equipment.

10. A method according to claim 9, characterized in that it comprises: - the establishment of a second secure connection between said first equipment (11) and said second equipment (1211, 1221), via a third communication interface of said first equipment, - the transmission, using said second secure connection, of a message containing at least one encrypted MAC address, associated or capable of being associated with said third interface and used to communicate with or through said second equipment or said intermediate equipment.

11. A method according to any one of claims 1 to 10, characterized in that said first and / or second secure connections implement the QUIC protocol.

12. A method according to any one of claims 1 to 11, characterized in that said instruction for managing at least one current MAC address belongs to the group comprising: - a request to renew said address, including at least one current MAC address, - a request to extend the validity period of said at least one current MAC address.

13. Remote server (13) comprising at least one processor configured for: - establish an initial secure connection between a first piece of equipment (11) and said remote server, via a first communication interface of said first piece of equipment, said first piece of equipment and said remote server being connected to separate networks, - transmit, using said first secure connection, a management instruction of at least one current MAC address associated with at least one second communication interface of the first equipment, for execution of the management instruction by the first equipment.

14. First piece of equipment (11) comprising at least one processor configured to: - establish a first secure connection between said first equipment and a remote server (13), via a first communication interface of said first equipment, said first equipment and said remote server being connected to separate networks, - receive, using said first secure connection, a management instruction for at least one current MAC address associated with at least one second communication interface of said first equipment, - execute said management instruction.

15. Computer program comprising instructions which, when executed by a processor, cause the processor to carry out the steps of the processes according to any one of claims 1 to 12.

Images