Electronic data filtering device and associated data filtering method

Abstract

Electronic Data Filtering Device and Associated Data Filtering Method. This electronic data filtering device (10) is configured to filter data (14) and includes a first filtering unit (16) comprising a filtering block (22). The filtering block (22) includes: a configuration module (26), configured to store a set of extraction instructions, a set of evaluation instructions, and a set of action instructions; a first extraction module (28) for initializing a set of filtering operands based on the frame (T); a first verification module (30) for verifying filtering rules based on the initialized filtering operands; and a first action module (32) for performing an action on the frame (T) based on the verification of the filtering rules. The first extraction (28), verification (30), and action (32) modules are implemented as an FPGA or an ASIC.Figure for the abbreviation: Figure 2.

Description

Title of the invention: Electronic data filtering device and associated data filtering method

[0001] The present invention relates to an electronic data filtering device. The present invention further relates to a data filtering method.

[0002] In the field of data processing in communication networks, it is known to use filtering devices to filter data between a first computer network and a second computer network. The filtered data may, for example, be data of different sensitivity levels, and filtering devices in such a context are generally called multi-level filtering devices.

[0003] In order to filter data between two computer networks, it is known to use software solutions that filter the data frames circulating between the first computer network and the second computer network.

[0004] Such software-implemented filtering devices allow the filtering devices to be easily configured. However, such devices do not provide complete satisfaction.

[0005] Indeed, the throughput of such devices is sometimes low, such software generally only being able to process a limited data stream with high latency between the first computer network and the second computer network.

[0006] The integrity of such filtering devices can, moreover, due to the software nature of the filtering, be easily called into question, resulting in unsatisfactory security of the device.

[0007] One of the aims of the invention is therefore to provide a filtering device which is configurable, which has low and controlled latency, high throughput and high integrity.

[0008] To this end, the invention relates to an electronic data filtering device configured to filter data between a first computer network and a second computer network, the electronic filtering device comprising a first filtering unit, configured to filter a data frame from the first computer network to the second computer network, the first filtering unit comprising a filtering block,

[0009] the filtering block comprising: - a configuration module, configured to store a set of extraction instructions, a set of evaluation instructions, and a set of action instructions, - a first extraction module, configured to execute at least one instruction from the extraction instruction set in order to initialize a set of filtering operands based on the frame, - a first verification module, configured to execute at least one instruction from the evaluation instruction set in order to verify filtering rules based on the initialized filtering operands, and - a first action module, configured to execute at least one instruction from the action instruction set in order to perform an action on the frame based on the verification of the filtering rules,

[0010] the first extraction module, the first verification module and the first action module being implemented in the form of an FPGA or an ASIC circuit.

[0011] The use of instruction sets within the extraction, verification, and action execution modules is particularly advantageous for ensuring the configurability of the device. The hardware architecture of the filtering device, and in particular the implementation of its first extraction, verification, and action modules in the form of FPGAs or ASICs, enables low-latency filtering while reducing the risk of security vulnerabilities in the filter, thus improving the filter's integrity.

[0012] According to other advantageous aspects of the invention, the electronic filtering device comprises one or more of the following features, taken individually or in all technically possible combinations:

[0013] - the filtering block further includes a configuration memory, configured to store initialization data, the first extraction module is configured to execute at least one instruction from the extraction instruction set in order to initialize the filtering operand set further according to the stored initialization data;

[0014] - the first action module is further configured to execute at least one instruction instruction of the action instruction set in order to store initialization data from the frame in configuration memory based on the verification of the filtering rules;

[0015] - the first filtering unit includes a conformity control block including:

[0016] - a conformance rule injection module,

[0017] - a control module, configured to:

[0018] + acquire the frame to be filtered from the first computer network;

[0019] + acquire a plurality of conformity rules from the injection module compliance rules; and

[0020] + transmit the frame to be filtered to the filtering block according to a control of the conformity between the frame to be filtered and the plurality of acquired conformity rules;

[0021] - the electronic device includes an operational memory, the first module extraction being configured to initialize the filtering operand set simultaneously with the storage of the frame on operational memory, the first action module being configured to perform an action on said stored frame;

[0022] - the instructions of the extraction and / or verification instruction set and / or execution plans are arranged in the form of decision trees;

[0023] - the device comprises:

[0024] - a second extraction module, configured to execute at least one instruction of the extraction instruction set in order to initialize a set of protocol automaton operands based on the frame,

[0025] - a second verification module, configured to execute at least one ins construction of the set of evaluation instructions in order to verify protocol automaton rules based on the operands of initialized protocol automata, and

[0026] - a second action module, configured to execute at least one instruction of the set of action instructions to perform a protocol automaton action based on the verification of protocol automaton rules;

[0027] - the first extraction module and the second extraction module are configured to simultaneously initialize the filtering operands, respectively of protocol automata and / or the first verification module and the second verification module are configured to simultaneously check the filtering rules, respectively of protocol automata;

[0028] - the first verification module, comprises a plurality of verification engines configuration of filtering rules, each engine being configured to check at least one filtering rule independently of the other checking engines;

[0029] - The actions performed by the first action module include:

[0030] - adding data to the frame, modifying data in the frame; and / or

[0031] - the deletion of the frame, the transmission of the frame to the second network in computer science;

[0032] - the first filtering unit includes at least one diode configured to block a transfer of data from the second computer network to the first computer network;

[0033] - the first filtering unit is configured to filter the data frame at OSI layer level of level 3 or higher; and

[0034] - the device includes a second filtering unit similar to the first unit of filtering, the second filtering unit being configured to filter data from the second computer network to the first computer network.

[0035] The invention further relates to a method for filtering data between a first computer network and a second computer network, implemented by a electronic device as described above comprising the following steps:

[0036] - initialization, by executing at least one instruction from the instruction set extraction in order to initialize a set of filtering operands based on a frame,

[0037] - verification, by executing at least one instruction from the instruction set evaluation to verify filtering rules based on initialized filtering operands, and

[0038] - action, by executing at least one instruction from the action instruction set in order to perform an action on the frame based on the verification of the filtering rules.

[0039] The invention will be better understood upon reading the following description, given solely by way of non-limiting example and made with reference to the following figures, in which:

[0040] [Fig-1] [Fig.1] is a schematic representation of an electronic device according to the invention;

[0041] [Fig.2] [Fig.2] is a schematic representation of the first filtering unit of the electronic device of [Fig. 1]; and

[0042] [Fig.3] [Fig.3] is a flowchart representing a filtering process implemented work by the device of [Fig.1].

[0043] With reference to [Fig.1], an electronic data filtering device 10, also referred to hereafter as filtering device 10, is configured to filter data between a first computer network 12 and a second computer network 14.

[0044] In particular, the filtering device 10 is configured to filter a data frame T, i.e. a set of data, between the first computer network 12 and the second computer network 14.

[0045] In unillustrated variants, the filtering device 10 is configured to filter data between more than two computer networks, for example between a first computer network 12 and a plurality of second 14 computer networks.

[0046] The first computer network 12 and the second computer network 14 are, for example, computer networks of different sensitivity levels. According to such an example, the filtering device 10 is then a multilevel filtering device.

[0047] As illustrated in figures 1 and 2, the filtering device 10 includes a first filtering unit 16 configured to filter a data frame T from the first computer network 12 to the second computer network 14.

[0048] In a particular variant, and as illustrated in [Fig.1], the filtering device 10 includes a second filtering unit 18, configured to filter data, and in particular a data frame T, from the second computer network 14 to the first computer network 12.

[0049] When the filtering device 10 is configured to filter data between more than two computer networks, the filtering device includes, for example, at least one filtering unit between each pair of first 12 and second 14 computer networks.

[0050] The second filtering unit 18 is preferably similar to the first filtering unit 16, which will be described in more detail later in this description.

[0051] The first filtering unit 16 is, for example, configured to filter a data frame T at any layer of the OSI model (English acronym for "Open Systems Interconnection"). The first filtering unit 16 is preferably configured to filter the data frame T at an OSI layer of level 3 or higher, that is, at a higher layer as defined by the OSI model, in particular a layer of the OSI model at a level higher than the hardware layers.

[0052] As illustrated in [Fig. 1], the first filtering unit 16 includes at least one diode 20 configured to block data transfer from the second computer network 14 to the first computer network 12. According to such a variant, the T frame can only pass through the first filtering unit from the first computer network 12 to the second computer network 14. As illustrated in [Fig. 1], and when the filtering device 10 includes a second filtering unit 18 similar to the first filtering unit 16, the second filtering unit 18 includes at least one diode 20 configured to block data transfer from the first computer network 12 to the second computer network 14.

[0053] As illustrated in [Fig.2], the first filtering unit 16 comprises a filtering block 22 and preferably includes a conformity control block 24.

[0054] As illustrated in [Fig. 2], and as explained in more detail later, the filtering block 22 comprises a configuration module 26, a first extraction module 28, a first verification module 30, and a first action module 32. The filtering block 22 preferably also comprises a second extraction module 34, a second verification module 36, and a second action module 38. The filtering block 22 further comprises, for example, a configuration memory 39. As will be described in more detail later, the configuration memory forms a data storage module configured to store data representative of a filtering context or constants for filtering.

[0055] The conformity control block 24 includes a conformity rule injection module 40 and a control module 42.

[0056] The conformance control block 24 is configured to check the conformance of the T frame. In particular, the conformance control block 24 is configured to check the syntactic and / or protocol conformance of the T frame filtered by the filtering device 10.

[0057] The injection module 40 is configured to inject conformance rules into the control module 42. The injection module 40 includes, for example, a memory (not shown) containing conformance rules and communicates with the control module to inject these rules. The injection module's memory can then be considered, for example, as a dictionary containing a plurality of conformance rules, the conformance rules being, for example, related to different communication protocols and syntaxes adopted by the frame, i.e., for example, to different arrangements of the data forming the frame T within the frame.

[0058] In the example of [Fig.2], the control module 42 is configured to acquire the T frame to be filtered from the first computer network 12.

[0059] The control module 42 is further configured to acquire a plurality of conformance rules from the injection module 40.

[0060] The control module 42 is configured to transmit the T frame to be filtered to the filtering block 22 according to a conformity check between the T frame to be filtered and the plurality of acquired conformity rules.

[0061] When the acquired compliance rules are syntactic rules, the control module 42 is configured for example to control the syntax of the acquired T frame to be filtered and to transmit the T frame to be filtered to the filtering block 22 according to the control of the syntax of the T frame.

[0062] The control module 42 is, for example, configured to transmit the frame T to be filtered to the filtering block 22 only if the conformity between the frame T to be filtered and the plurality of acquired conformity rules is verified. In the example where the acquired conformity rules are syntactic rules, the control module 42 is, for example, configured to transmit the frame to be filtered to the filtering block 22 only if the syntax of the frame T to be filtered conforms to the acquired syntactic rules, that is, if the frame T respects a syntax associated with the acquired syntactic rules.

[0063] In other words, the control module 42 is thus configured for example not to transmit the frame to be filtered to the filtering block 22 if the conformity between the frame T to be filtered and the plurality of acquired conformity rules is not verified.

[0064] As seen above, in the example of [Fig. 2], the filtering block 22 acquires the T frame to be filtered from the compliance control block. In an alternative not shown, the filtering block 22 acquires the T frame directly from the first network 12.

[0065] The configuration module 26 is configured to store a set of extraction instructions, a set of evaluation instructions, and a set of action instructions. For this purpose, the configuration module 26 includes, for example, a memory (not re presented) on which the instruction sets for extraction, evaluation and action are stored. In variants, the configuration module 26 includes a plurality of memories and / or at least one network on which the instruction sets for extraction, evaluation and action are stored and / or transit.

[0066] The instructions in the extraction and / or verification and / or action instruction set are preferably arranged in the form of decision trees. Thus, some instructions in the instruction set depend on other instructions in the instruction set. Alternatively, the instructions in the extraction and / or verification and / or execution instruction set are arranged in the form of unhierarchical tables.

[0067] As illustrated in [Fig.2], the configuration module 26 is connected to the first extraction module 28, the first verification module 30 and the first action module 32 and is configured to communicate at least one instruction from the extraction data set to the first extraction module 28, to communicate at least one instruction from the verification data set to the first verification module 30 and to communicate at least one instruction from the action data set to the first action module 32.

[0068] For example, as will be explained later and as illustrated in [Fig.2], the configuration module 26 is further connected to the second extraction module 34, the second verification module 36 and the second action module 38 and is further configured to communicate at least one instruction from the extraction dataset to the second extraction module 34, to communicate at least one instruction from the verification dataset to the second verification module 36 and to communicate at least one instruction from the action dataset to the second action module 38.

[0069] In the embodiment of [Fig.2] in which the filtering block 22 further includes a configuration memory 39, and as will be described later, the configuration memory 39 is configured to store initialization data.

[0070] The first extraction module 28 is configured to execute at least one instruction from the extraction instruction set in order to initialize a set of frame filtering operands based on the frame T. Thus, the first extraction module 28 is configured to initialize the set of filtering operands based on the frame T and at least one instruction from the extraction instruction set.

[0071] As will be explained later, the filtering operands correspond for example to the data to which the frame is compared using operators for the purpose of filtering it.

[0072] The first extraction module 28 is, for example, configured to execute at least one instruction from the extraction instruction set in order to initialize at least one filter operand from the set of initialized filter operands, from the frame T. The first extraction module 28 is then configured for example to read the frame and to extract from frame T at least one filtering operand according to at least one instruction of the instruction set executed, the at least one operand extracted from the frame corresponding to at least one of the filtering operands initialized by the first extraction module.

[0073] The first extraction module 28 is, for example, further configured to execute at least one instruction from the extraction instruction set in order to initialize the filtering operand set further according to the initialization data stored on the configuration memory 39.

[0074] The first extraction module 28 is configured for example to execute at least one instruction from the extraction instruction set in order to initialize at least one filter operand from the set of initialized filter operands, from the initialization data stored in configuration memory 39.

[0075] The initialization data stored in the configuration memory 39 is, for example, a constant stored permanently or not in the configuration memory 39.

[0076] As will be described in more detail later, the first action module 32 is for example configured to execute at least one instruction from the action instruction set in order to store initialization data from the T frame in the configuration memory 39 according to the verification of filtering rules by the verification module 30. In this example, the initialization data stored in the configuration memory 39 is then data representative of a filtering context, the data being from a previously filtered frame and being used for the filtering of a T frame to be filtered.

[0077] The second extraction module 34 is configured to execute at least one instruction from the extraction instruction set in order to initialize a set of protocol automaton operands based on the frame. Thus, the second extraction module 34 is configured to initialize the set of protocol automaton operands based on the frame T and at least one instruction from the extraction instruction set.

[0078] As will be explained later, the operands of protocol automata correspond, for example, to control data of a protocol dynamic.

[0079] The second extraction module 34 is configured to execute at least one instruction from the extraction instruction set in order to initialize at least one protocol automaton operand from the set of initialized protocol automata, from the frame. The second extraction module 34 is then, for example, configured to read the frame and to extract from frame T at least one protocol automaton operand according to at least one instruction from the executed instruction set, at least one protocol automaton operand extracted from frame T corresponding to at least one of the protocol automaton operands initialized by the second extraction module 34.

[0080] The second extraction module 34 is, for example, further configured to execute at least one instruction from the extraction instruction set in order to initialize the protocol automaton operand set further according to the initialization data stored on the configuration memory 39.

[0081] The second extraction module 34 is configured for example to execute at least one instruction from the extraction instruction set in order to initialize at least one protocol automaton operand from the protocol automaton operand set, from the initialization data stored in configuration memory 39.

[0082] The initialization data stored in the storage module is, for example, a constant stored permanently in configuration memory 39.

[0083] As will be described in more detail later, the second action module 38 is configured for example to execute at least one instruction from the action instruction set in order to store initialization data from the T frame in the configuration memory 39 according to the verification of protocol automaton rules.

[0084] The initialization data stored in the storage module is then a data representative of a protocol context, the data being from a previously filtered frame and being used for the filtering of a frame T to be filtered.

[0085] In a preferred embodiment, and as illustrated in [Fig.2], the first extraction module 28 and the second extraction module 34 are configured to simultaneously initialize the filtering operands, respectively of protocol automata.

[0086] In a preferred embodiment, and as illustrated in [Fig.2], the electronic device 10 includes an operational memory 44. As will be described in more detail later, the operational memory 44 forms a data storage module configured to store data from the filtered T frame.

[0087] The operational memory 44 is for example formed by an entity distinct from the configuration memory 39. Alternatively, the operational memory 44 and the configuration memory 39 are formed by the same component.

[0088] The first extraction module 28 is configured for example to initialize the filtering operand set simultaneously with the storage of the frame T on operational memory 44.

[0089] As an alternative, or in addition, the first extraction module 28 is for example configured to store the initialized filtering operands on memory 44.

[0090] The second extraction module 34 is, for example, configured to initialize the protocol automaton operand set simultaneously with the storage of the frame T on operational memory 44.

[0091] As an alternative, or in addition, the second extraction module 34 is for example configured to store on memory 44 the initialized protocol automaton operands.

[0092] The first verification module 30 is configured to execute at least one instruction from the evaluation instruction set in order to verify filtering rules based on the initialized filtering operands. In other words, the first verification module 30 is configured to verify filtering rules based on the initialized filtering operands and at least one instruction from the evaluation instruction set.

[0093] The first verification module 30 is configured for example to obtain the filtering operands initialized from the first extraction module 28 or from the operational memory 44.

[0094] The first verification module 30 is configured for example to obtain filtering operators by executing at least one instruction from the evaluation instruction set, the frame T being compared to the filtering operands initialized using the operators obtained.

[0095] The second verification module 36 is configured to execute at least one instruction from the evaluation instruction set in order to verify protocol automaton rules based on the initialized protocol automaton operands. In other words, the second verification module 36 is configured to verify protocol automaton rules based on the initialized protocol automaton operands and at least one instruction from the evaluation set. The second verification module 36 is thus configured to verify the protocol dynamics of the T frame.

[0096] The second verification module 36 is configured for example to obtain the filtering operands initialized from the second extraction module 34 or from the operational memory 44.

[0097] The second verification module 36 is for example configured to obtain protocol rules by executing at least one instruction from the evaluation instruction set, the initialized protocol automaton operands being compared to the protocol rules obtained to verify the protocol automaton rules.

[0098] The first verification module 30 and the second verification module 36 are configured for example to simultaneously check the filtering rules of protocol automata respectively.

[0099] In a preferred embodiment, the first verification module 30 and / or the second verification module 36 comprise a plurality of filtering rule verification engines, respectively a plurality of protocol automaton rule verification engines.

[0100] Each engine of the first verification module 30 is preferably configured to check at least one filtering rule independently of the other engines, i.e. independently of the checking of filtering rules by the other verification engines.

[0101] Each engine of the second verification module 36 is preferably configured to check at least one protocol automaton rule independently of the other engines, i.e. independently of the checking of protocol automaton verification rules by the other verification engines.

[0102] The first action module 32 is configured to execute at least one instruction from the action instruction set in order to perform an action on the T frame based on the filtering rules being checked. In other words, the action on the T frame is performed based on the filtering rules being checked and the action instruction set being checked.

[0103] In the embodiment shown in [Fig.2] in which the T frame is stored on the operational memory 44, the first action module 32 is configured to perform an action on the stored T frame.

[0104] The first action module 32 is configured for example to perform the following actions on the frame: adding data to the frame, modifying data in the frame, deleting data in the frame.

[0105] Alternatively, or in addition, the first action module 32 is configured to delete the T frame or to forward the frame to the second computer network.

[0106] The first action module 32 is configured for example to transmit the T frame to the second computer network 14 if the filtering rules have been checked according to the initialized filtering operands, by the first verification module 30. For example, the first action module 32 is configured to transmit the T frame to the second computer network 14 if the comparison of the initialized filtering operands with the T frame using operators obtained by the first verification module 30 corresponds to a conformity of the frame to the filtering rules.

[0107] The first action module 32 is configured for example to delete the T frame if the filtering rules have not been checked according to the filtering operands initialized by the first verification module 30.

[0108] As seen above, the first action module 32 is further configured, for example, to store initialization data from the T frame in the configuration memory 39 according to the verification of the filtering rules. For example, the first action module 32 is configured to store a field from the T frame in the configuration memory 39, the field from the T frame thus stored forming initialization data to initialize the filtering operand set for filtering a subsequent T frame after the frame for which a field from the frame was stored in configuration memory 39.

[0109] The second action module 38 is configured to execute at least one instruction from the action instruction set in order to perform a protocol automaton action based on the verification of the protocol automaton rules.

[0110] Protocol automata actions include, for example, transferring the frame to the first action module 32, or blocking the frame.

[0111] As seen above, the second action module 38 is further configured, for example, to store initialization data from the T frame in the configuration memory 39 according to the verification of the protocol automaton rules. For example, the second action module 38 is configured to store a field from the T frame in the configuration memory 39, the T frame field thus stored forming initialization data to initialize the protocol automaton operand set for filtering a T frame subsequent to the frame for which a frame field was stored in the configuration memory 39.

[0112] As illustrated in [Fig.2] and as seen above, the second action module 38 is for example configured to also transmit the T frame to the first action module 32, the second action module 38 thus being logically positioned upstream of the first action module 32.

[0113] In particular, the second action module 38 is configured for example to transmit the T frame to the first action module 32 only if the protocol automaton rules have been checked according to the initialized protocol automaton operands, by the second verification module 36.

[0114] The first extraction module 28, the first verification module 30, and the first action module 32, and preferably the second extraction module 34, the second verification module 36, and the second action module 38, are each implemented as a programmable logic component, that is, implemented or realized in such a component, and in particular in the form of an FPGA (Field Programmable Gate Array) or an ASIC (Application-Specific Integrated Circuit). Implemented in the form of an FPGA or an ASIC, it will be understood that the module(s) are integrated into the FPGA or the ASIC, so that they are formed by the components of the FPGA or the ASIC.

[0115] In a particular embodiment, the configuration module 26 is implemented in the form of an FPGA or an ASIC circuit so that the filtering block 22 is entirely implemented in the form of an FPGA or an ASIC circuit.

[0116] For example, the injection module 40 and the control module 42 are also implemented as an FPGA or an ASIC circuit, so that the first filtering unit is entirely implemented as at least one FPGA or at least one ASIC circuit.

[0117] With reference to [Fig.3], a filtering process 100, implemented by a filtering device 10 as described above, will now be presented.

[0118] The process 100 includes an initialization step 110, an evaluation step 120 and an action step 130.

[0119] During the initialization step 110, at least one instruction from the extraction instruction set is executed in order to initialize a set of filtering operands based on the T frame.

[0120] For example, the first extraction module 28 executes at least one instruction from the extraction instruction set in order to initialize at least one filter operand from the set of filter operands initialized directly from the T frame. Alternatively, or in addition, the first extraction module 28 executes, for example, at least one instruction from the extraction instruction set in order to initialize at least one filter operand from the set of filter operands initialized from an initialization data stored on the configuration memory 39. In this case, the initialization data stored on the configuration memory 39 is a constant or is, for example, data that has been stored by the first action module 32 as initialization data.

[0121] When the filtering block 22 includes a second extraction module 34, the second extraction module 34 further executes, for example, at least one instruction from the extraction instruction set in order to initialize at least one protocol automaton operand during the initialization step 110.

[0122] During the verification step 120, at least one instruction from the evaluation instruction set is executed in order to check filtering rules based on the initialized filtering operands.

[0123] For example, the first verification module 30 compares the filter operands initialized to the frame T using operators resulting from the execution of the evaluation instruction set.

[0124] When the filtering block 22 includes a second verification module 36, the second verification module 36 further executes, for example, at least one instruction from the extraction set in order to check protocol automaton rules according to the initialized protocol automaton operands.

[0125] During action step 130, at least one instruction from the action instruction set is executed in order to perform an action on the frame based on the verification of the filtering rules.

[0126] The first action module 32 adds data to the T frame, modifies data in the T frame or deletes data from the frame, for example, according to the verification of the filtering rules.

[0127] The first action module 32 further deletes, for example, the T frame or further transmits, for example, the T frame to the second computer network 18.

[0128] The first action module 32 further stores, for example, initialization data from the T frame in the configuration memory 39 according to the verification of the filtering rules.

[0129] When the filtering block 22 includes a second configuration module 34, a second extraction module 36 and a second action module 38, the second action module 38 further executes, for example, at least one instruction from the set of action instructions in order to perform a protocol automaton action based on the verification of the protocol automaton rules.

Claims

Claims

1. An electronic data filtering device (10) configured to filter data between a first computer network (12) and a second computer network (14), the electronic filtering device (10) comprising a first filtering unit (16), configured to filter a data frame (T) from the first computer network to the second computer network, the first filtering unit (16) comprising a filtering block (22), the filtering block (22) comprising: - a configuration module (26), configured to store a set of extraction instructions, a set of evaluation instructions and a set of action instructions, - a first extraction module (28), configured to execute at least one instruction from the set of extraction instructions in order to initialize a set of filtering operands according to the frame (T), - a first verification module (30), configured to execute at least one instruction of the evaluation instruction set in order to verify filtering rules according to the initialized filtering operands, and - a first action module (32), configured to execute at least one instruction from the set of action instructions in order to perform an action on the frame (T) based on the verification of the filtering rules, the first extraction module (28), the first verification module (30) and the first action module (32) being implemented in the form of an FPGA or an ASIC circuit, the instructions of the extraction and / or verification and / or execution instruction set being arranged in the form of decision trees.

2. Electronic device (10) according to claim 1, wherein the filtering block (22) further comprises a configuration memory (39), configured to store an initialization data item, the first extraction module (28) being configured to execute at least one instruction of the set of extraction instructions in order to initialize the set of filtering operands further according to the initialization data item stored.

3. Electronic device (10) according to claim 2, wherein the first action module (32) is further configured to execute at least one instruction of the action instruction set in order to store an initialization data from the frame (T) in the configuration memory (39) according to the verification of the filtering rules.

4. Electronic device (10) according to any one of the preceding claims, wherein the first filtering unit (16) comprises a conformity control block (24) comprising: - a conformity rule injection module (40), - a control module (42), configured to: • acquire the frame to be filtered from the first computer network (12); • acquire a plurality of conformity rules from the conformity rule injection module (40); and • transmit the frame (T) to be filtered to the filtering block (22) according to a conformity control between the frame (T) to be filtered and the plurality of conformity rules acquired.

5. Electronic device (10) according to any one of the preceding claims, wherein the electronic device comprises an operational memory (44), the first extraction module (34) being configured to initialize the set of filtering operands simultaneously with the storage of the frame (T) on the operational memory (44), the first action module (32) being configured to perform an action on said stored frame (T).

6. Electronic device (10) according to any one of the preceding claims, wherein the device comprises: - a second extraction module (34), configured to execute at least one instruction of the extraction instruction set in order to initialize a set of protocol automaton operands according to the frame (T), - a second verification module (36), configured to execute at least one instruction of the evaluation instruction set in order to verify protocol automaton rules according to the protocol automaton operands initialized, and - a second action module (38), configured to execute at least one instruction from the action instruction set in order to perform a protocol automaton action based on the verification of the protocol automaton rules.

7. Electronic device (10) according to claim 5, wherein: - the first extraction module (28) and the second extraction module (34) are configured to simultaneously initialize the filtering operands, respectively of protocol automata; and / or - the first verification module (30) and the second verification module (36) are configured to simultaneously verify the filtering rules, respectively of protocol automata.

8. Electronic device (10) according to any one of the preceding claims, wherein the first verification module (30) comprises a plurality of filtering rule verification engines, each engine being configured to verify at least one filtering rule independently of the other verification engines.

9. Electronic device (10) according to any one of the preceding claims, wherein the actions performed by the first action module (32) comprise: - adding data to the frame (T), modifying data from the frame (T), deleting data from the frame (T); and / or - deleting the frame (T), transmitting the frame (T) to the second computer network (14).

10. An electronic device (10) according to any preceding claim, wherein the first filtering unit (16) comprises at least one diode (20) configured to block a transfer of data from the second computer network (18) to the first computer network (16).

11. An electronic device (10) according to any preceding claim, wherein the first filtering unit (16) is configured to filter the data frame (T) at an OSI layer of level greater than or equal to 3.

12. An electronic device (10) according to any preceding claim, wherein the device (10) comprises a second filtering unit (18) similar to the first filtering unit (16), the second filtering unit (18) being configured to filter data from the second computer network (14) to the first computer network (12).

13. A method of filtering data (100) between a first computer network (12) and a second computer network (14), implemented by an electronic device (10) according to any one of claims 1 to 12 comprising the following steps: initialization (110), by executing at least one instruction from the set of extraction instructions in order to initialize a set of filtering operands according to a frame (T), - verification (120), by executing at least one instruction from the evaluation instruction set in order to verify filtering rules based on the initialized filtering operands, and - action (130), by executing at least one instruction from the action instruction set in order to perform an action on the frame (T) based on the verification of the filtering rules.

Images