IT architecture with distributed cybersecurity functionality

Abstract

A computer architecture comprising nodes, one running a main cybersecurity program and the others running a cybersecurity agent program. Each cybersecurity agent program is configured to perform at least one action to neutralize target nodes and to make target node allocation decisions using a consensus decision algorithm with the agent programs running on neighboring nodes. The main program is configured to perform a plurality of actions, including collecting interface probe summaries from the agent programs, deducing target nodes, and proposing them to the agent programs. (Figure from the abstraction: Fig. 1)

Description

Title of the invention: Computer architecture with distributed cybersecurity function

[0001] The present invention relates to the field of computing and more specifically to that of cybersecurity of computer networks.

[0002] BACKGROUND OF THE INVENTION

[0003] Computer architectures are known comprising a network having nodes each comprising an electronic computing unit and interfaces connected to data links allowing the electronic units to exchange data. Each electronic computing unit comprises a processor (or any other computing device) and a memory containing computer programs executable by the processor.

[0004] Such architectures are frequently implemented in computer networks that may have a few nodes or hundreds or even thousands. But such architectures can also be found in complex devices, such as vehicles, comprising several separate computers inserted into a network allowing them to communicate with each other.

[0005] One of the main difficulties in managing this type of architecture is the protection of these, which is now commonly called cybersecurity.

[0006] Cybersecurity aims to prevent any action by unauthorized third parties aimed in particular at collecting, corrupting or destroying data present on the network and, more generally, at diverting the operation of electronic computing units for the benefit of unauthorized third parties.

[0007] While ensuring the cybersecurity of an electronic computing unit is relatively simple, at least in principle, this is not the case for a network comprising several electronic units interfaced with each other, the number of possible attacks increasing with the complexity of the architecture.

[0008] SUBJECT OF THE INVENTION

[0009] The invention aims in particular to provide a means for strengthening the cybersecurity of complex architectures. Summary of the invention

[0010] To this end, according to the invention, a computer architecture is provided comprising a network having nodes each comprising an electronic computing unit and interfaces connected to data links enabling the electronic units to exchange data, a node of the network executing a main cybersecurity program and at least some of the remaining nodes each executing a program cybersecurity agent; each cybersecurity agent program being arranged to perform a plurality of actions including at least one neutralization action and the actions of: probing the data at the interfaces of the node on which it is executed to detect a vulnerability with respect to the nodes whose data transits via said interface, transmitting an interface probing report to the main program, identifying target nodes from the interface probing report, and making decisions for allocating the target nodes by means of a consensus decision algorithm with the agent programs executed on neighboring nodes to determine and plan the neutralization action to be taken on the target nodes, the agent programs implementing a time synchronization module to coordinate their neutralization actions;the main program being arranged to carry out a plurality of actions including collecting the balances, deducing target nodes and proposing them to the agent programs.;

[0011] The target nodes are nodes constituting a vulnerability of the architecture, that is to say a node from which an attack on the architecture is in progress or possible. Thus, the invention makes it possible to protect the architecture by combining autonomy of the agent programs to carry out concerted actions and a global view of the architecture via the main program. This combination provides responsiveness for carrying out neutralization actions since these are decided and planned by agent programs of nodes present in a proximity zone, while retaining the possibility of taking into account target nodes that the main program considers relevant to neutralize.

[0012] Other characteristics and advantages of the invention will emerge from reading the following description of a particular and non-limiting embodiment of the invention. Brief description of the drawings

[0013] Reference will be made to the accompanying drawings, among which:

[0014] [Fig-1] [Fig.l] is a schematic view of an architecture according to the invention,

[0015] [Fig.2] [Fig.2] is a schematic view of one of the electronic units of the architecture according to the invention. DETAILED DESCRIPTION OF THE INVENTION

[0016] With reference to figures 1 and 2, the computer architecture according to the invention comprises a network R having nodes 1 connected to each other by data links symbolized at 2. The nodes 1 are also connected to a set symbolized at 3 of other nodes connected to each other by data links.

[0017] Each node 1 comprises an electronic calculation unit 10, such as a processor connected to a memory, having interfaces 11 connected to the data links 2. The Memory includes computer programs that are executed by the processor. Nodes 1 can be routers, computers, servers, calculators, or any other equipment containing an electronic computing unit. Such nodes are known in themselves and will not be discussed in more detail here.

[0018] Each data link 2 is arranged to allow the electronic units 10 to exchange data. A data link may be a physical link, such as a cable comprising twisted electrical conductors or conductive tracks of a printed circuit, or a wireless link such as a Wi-Fi or GSM type radio link, or any other type of link, with or without wire, allowing the transmission of data between two electronic units. The data links are known in themselves and will not be detailed further here.

[0019] In the architecture according to the invention, a node of the network executes a main cybersecurity program and at least some of the remaining nodes each execute a cybersecurity agent program.

[0020] Each cybersecurity agent program comprises instructions arranged to carry out a plurality of actions including at least one neutralization action and the actions of: - probe data at the interfaces of the node on which it is executed to detect malicious behavior of the nodes whose data passes through said interface, - transmit an interface probe report to the main program, - identify target nodes from the interface probe report, and - make target node allocation decisions using an al consensus decision algorithm with agent programs running on neighboring nodes to determine and plan the neutralization action to be taken on the target nodes.

[0021] More precisely, the probing of data at the interfaces is carried out in a manner known per se by inspecting the data packets arriving on said interfaces. This probing can be carried out using a deep packet inspection or DPI program.

[0022] Once extracted, the data is analyzed to detect a vulnerability represented here by malicious or faulty behavior of the node sending the data. To this end, each agent program implements an adversarial behavior model allowing each agent program to be able to detect in the data a set of clues revealing such behavior. There are many adversarial behavior models and in particular those bearing the following names: Game-theoretic modeling, attack graph model (MORDA, MODA, DACCA, Bayesian attack graph), Dolev-Yao, Bellare-Rogaway, Lockheed Martin Cyber ​​Kill Chain, Mitre's attack matrix... In a well-known manner, the implementation of these models calls upon artificial intelligence. For example, such behavior can involve the transmission of viruses on the network, the capture of data for which the node is not the final recipient, massive sending of data to saturate the interfaces of other nodes...

[0023] Each agent program can thus identify target nodes that need to be neutralized.

[0024] Each agent program is here arranged to carry out a plurality of neutralization actions on the target nodes for which malicious behavior has been detected. The neutralization actions comprise defensive actions and offensive actions. The defensive actions comprise blocking exchanges with at least one of the target nodes and filtering exchanges with at least one of the target nodes. The offensive actions comprise saturating the interfaces of at least one of the target nodes.

[0025] The decision algorithm, here of the PAXOS type, is configured to result in a distribution of the target nodes between the agent programs of the neighboring nodes so that an agent program only has to neutralize a single target node simultaneously. The decision algorithm is configured to result in a coordination in time of the neutralization actions carried out by the agent programs against the target nodes.

[0026] The agent programs further implement a time synchronization module to coordinate their neutralization actions. The synchronization module implements a distributed time synchronization algorithm of the WELCH-LYNCH type.

[0027] Each agent program includes a planning module arranged to establish a schedule for neutralizing the target node. This planning schedule is shared with the agent programs of neighboring nodes so that neighboring nodes are informed of the progress of the neutralization.

[0028] Coordination of the action of the agent programs is particularly important when the action in question aims to isolate a target node or to saturate the interfaces of a target node (the agent programs of all the nodes connected to the target node must act together to achieve this isolation or saturation).

[0029] Furthermore, each agent program is arranged to replicate itself on neighboring nodes in such a way that, after a certain time, all nodes execute the agent program. Each agent program is arranged to replicate itself on the node that currently hosts it in the event of a failure, for example.

[0030] The main program is arranged to carry out a plurality of actions including: - collecting the balances, deduce balances of target nodes and propose them to agent programs, stop the operation of faulty agent programs (an agent program can be an agent program rendered inoperative by a bug for example or an agent program corrupted by a virus for example), isolate faulty agent programs.

[0031] The main program can thus establish and maintain up-to-date a map of the nodes making it possible to identify the nodes constituting a source of vulnerability of the architecture and to propose to the agent programs target nodes which would not have been processed by the agent programs. The agent programs decide to process the target nodes proposed by the main program by resorting to a consensus decision.

[0032] It will be noted that, when a target node has been assigned to a faulty agent program, the remaining agent programs are arranged to reassign said target node to one of the remaining agent programs as soon as they have the information that the agent program is faulty. This information comes for example from the main program announcing to the remaining agent programs that the faulty agent program is deactivated.

[0033] The main program also has the ability to replicate itself to another node or to the same node in the event of failure.

[0034] Of course, the invention is not limited to the embodiment described but encompasses any variant falling within the scope of the invention as defined by the claims.

[0035] In particular, the architecture may have a structure different from that illustrated.

[0036] The nodes 1 can be routers, computers, servers, calculators belonging to different devices or to the same device.

[0037] The invention applies for example to these autonomous vehicles each comprising a main computer, a cybersecurity computer, a range computer and one or more other dedicated computers. The computer architecture according to the invention can be deployed within the same vehicle. In the case where several vehicles operate in a group, the computer architecture according to the invention can be deployed on all the vehicles in the group so that the computers of all the vehicles belong to a single architecture.

Claims

Claims

1. Computer architecture comprising a network having nodes each comprising an electronic computing unit and interfaces connected to data links allowing the electronic units to exchange data, a node of the network executing a main cybersecurity program and at least some of the remaining nodes each executing a cybersecurity agent program;each cybersecurity agent program being arranged to carry out a plurality of actions including at least one neutralization action and the actions of: probing the data at the interfaces of the node on which it is executed to detect a vulnerability of the nodes whose data transits via said interface, transmitting an interface probing report to the main program, identifying target nodes from the interface probing report, and making decisions for allocating the target nodes by means of a consensus decision algorithm with the agent programs executed on neighboring nodes to determine and plan the neutralization action to be taken on the target nodes, the agent programs implementing a time synchronization module to coordinate their neutralization actions;the main program being arranged to carry out a plurality of actions including collecting the balances, deducing target nodes and proposing them to the agent programs.;

2. Architecture according to claim 1, in which the neutralization action is a defensive action such as blocking exchanges with at least one of the target nodes.

3. Architecture according to claim 1 or 2, in which the neutralization action is an offensive action such as saturation of the interfaces of at least one of the target nodes.

4. Architecture according to any one of the preceding claims, in which the decision algorithm is configured to result in a distribution of the target nodes between the agent programs of the neighboring nodes such that an agent program only has to simultaneously neutralize a single target node.

5. Architecture according to claim 4, in which the decision algorithm is configured to result in a coordination in time of the neutralization actions carried out by the agent programs against the target nodes.

6. Architecture according to claim 5, in which each agent program comprises a planning module arranged to establish a schedule for neutralizing the target node.

7. Architecture according to claim 4, in which the decision algorithm is of the PAXOS type.

8. Architecture according to any one of the preceding claims, in which the synchronization module implements a distributed time synchronization algorithm of the WELCH-LYNCH type.

9. Architecture according to any one of the preceding claims, wherein each agent program implements an adversarial behavior model to detect vulnerability in relation to a target node.

10. Architecture according to any one of the preceding claims, wherein the main program is arranged to stop or isolate faulty agent programs.

11. The architecture of claim 9, wherein, if a target node had been assigned to a failed agent program, the remaining agent programs are arranged to reassign said target node to one of the remaining agent programs.

12. Architecture according to any one of the preceding claims, in which a proximity zone is configured in each agent program allowing it to identify the nodes which are neighbors to it.

Images