SYSTEM AND METHOD FOR EXPOSING DATA FROM A BLACK DOMAIN TO A RED DOMAIN

Abstract

A data exposure system (190) is configured to expose metrology and topology data from a communication network (100) in a first-level security domain to a device (160). The device (160) belongs to a higher second-level security domain. The data exposure system (190) comprises: a proxy device (120), configured to collect metrology and topology data from said communication network (100), and a diode (150) that physically allows unidirectional transmissions only from the proxy device (120) to the second-level security domain. Thus, information enabling routing decisions can be transmitted from the first-level security domain to the second-level security domain without a security breach. Figure to be published with the abbreviation: Fig. 1

Description

Title of the invention: SYSTEM AND METHOD FOR EXPOSING DATA FROM A BLACK DOMAIN TO A DOMAIN RED Technical field

[0001] The present invention relates to an exposure of data from a black domain to a red domain, the data being more particularly relating to network transmission conditions (metrology and / or topology) in the black domain, the red domain being by definition a network domain with a higher level of security than the black domain. STATE OF PRIOR ART

[0002] The operation of WANs (Wide Area Networks) is today increasingly controlled centrally, typically by an SDN (Software Defined Network) controller. This centralized approach, which relies on a separation of the data and control planes, makes routing decisions based on determining an optimal route to a destination based on the topology, the quality of the network links and constraints. A CSPF (Constrained Shortest Path First) type algorithm is conventionally used to do this. This is notably, but not exclusively, the case in network infrastructures based on an MPLS (Multi-Protocol Label Switching) type transport protocol, as defined in the RFC 3031 normative document.With such a protocol, an outgoing router uses transport labels to determine an outgoing router for each packet, without each intermediate router needing to scan a large routing table during packet propagation.

[0003] However, network architectures may be based on communication networks having different requirements in terms of security of the data passing through them. Some communication networks having high security requirements may use other communication networks in which the level of security requirements is lower, to pass data from one communication subnetwork with high security requirements to another. We speak of a red type communication network for the communication network with the highest level of security and a black type communication network for the communication network with the lowest level of security. For example, a first group of devices in a first red type communication subnetwork communicates with a second group of devices in a second red type communication subnetwork via a unsecured transit communication network or a lower security level than the red type, called black type. We also speak of black domain to designate the black type communication network, and red domain to designate the set formed by the first and second red type communication subnetworks. The concept of black / red network is briefly explained at the following link: https: / / en.wikipedia.org / wiki / Red / black_concept

[0004] A disadvantage of this kind of communication infrastructure is that there is currently no adequate solution to allow a device in the red domain to obtain information from one or more devices in the black transit communication network, without having to compromise security requirements of the red communication subnetworks, which is detrimental to the aforementioned centralized approach to controlling the operation of wide area networks WANs. Thus, it is desirable to provide a solution that allows a device in the red domain to collect information relating to transmission conditions in the black domain, such as black domain topology information and black domain link quality information. Statement of the invention

[0005] For this purpose, a data exposure system is proposed configured to expose to an equipment metrology and topology data of a communication network of a domain of a first security level, the equipment belonging to a domain of a second security level higher than the first security level, the data exposure system comprising: a proxy device, configured to carry out a collection of metrology data of said communication network and topology data of said communication network from messages transmitted in said communication network and captured by said proxy device, and to expose the metrology and topology data of said communication network; a diode placed between the proxy device and said equipment, the diode physically authorizing unidirectional transmissions only from the proxy device to the domain of second security level.

[0006] Thus, thanks to the proxy device and the diode thus arranged, information relating to the transmission conditions in the first security domain (black domain) can be transmitted to equipment in the second security domain (red domain), without a security breach.

[0007] In a particular embodiment, the data exposure system further comprises: a first firewall, placed between said communication network and the proxy device, and configured to limit exchanges between the proxy device and said communication network to the collection of said data metrology and topology; a second firewall, placed between the proxy device and the diode, and configured to limit exchanges with the proxy device to an exposure of said metrology and topology data of said communication network.

[0008] In a particular embodiment, the first firewall and the second firewall include an intrusion prevention system.

[0009] In a particular embodiment, the proxy device comprises: a first memory buffer dedicated to collecting metrology data transmitted via said communication network and relating to link qualities of said communication network; a first database used to expose the metrology data to said equipment; a metrology data processor configured to process the metrology data in the first memory buffer, responsible for transferring data stored in the first memory buffer to the first database, configured to add an identifier per set of metrology data transferred to the first database, the identifier in question making it possible to determine which data in the first database are the most recent; a second memory buffer dedicated to collecting topology data transmitted via said communication network and relating to said communication network;a second database used to expose the topology data to said equipment; a topology data processor configured to process the topology data in the second memory buffer, responsible for transferring data stored in the second memory buffer to the second database, configured to add an identifier per set of topology data transferred to the second database, the identifier in question making it possible to determine which data in the second database is the most recent.;

[0010] In a particular embodiment, the metrology data processor is configured to perform filtering in the first memory buffer to avoid inserting already obsolete metrology data into the first database, and the topology data processor is configured to perform filtering in the second memory buffer to avoid inserting already obsolete metrology data into the second database.

[0011] In a particular embodiment, the topology data processor is configured to perform filtering in the second memory buffer to retain a most recent stable link state when at least one link shows in the second memory buffer untimely link state changes.

[0012] In a particular embodiment, the proxy device comprises: a third database used to expose aggregated metrology data and of topology to said equipment; and an information aggregation processor, responsible for aggregating and transferring, into the third database, data stored in the first database and data stored in the second database, the information aggregation processor being configured to gather, by communication link, the most recent topology information stored in the second database and the most recent metrology information stored in the first database.

[0013] In a particular embodiment, the proxy device is a master proxy device in a group of proxy devices of the data exposure system further including a fallback proxy device which shares the same virtual addresses as the master proxy device and which is intended to replace the master proxy device in the event of failure of said master proxy device, the master proxy device being configured to update, as and when storages in its databases, the fallback proxy device.

[0014] In a particular embodiment, the diode only authorizes transmissions carried out according to predefined transport layer protocols.

[0015] In a particular embodiment, the data exposure system further comprises a reverse proxy device, placed between the diode and said equipment, and configured to receive the metrology and topology data of said communication network as exposed by the proxy device, and to carry out bidirectional exchanges with said equipment.

[0016] In a particular embodiment, the data exposure system comprises a third firewall, placed between the diode and the reverse proxy device, and configured to limit exchanges with the diode to obtaining said metrology and topology data of said communication network as exposed by the proxy device.

[0017] There is also provided a method for exposing to a device metrology and topology data of a communication network of a domain of a first security level, the equipment belonging to a domain of a second security level higher than the first security level, the method being implemented by a data exposure system comprising a proxy device and a diode, placed between the proxy device and said equipment. The method comprises the following steps: the proxy device carries out a collection of metrology data of said communication network and topology data of said communication network from messages transmitted in said communication network and captured by said proxy device, and exposes the metrology and topology data of said communication network; and the diode physically authorizes trans one-way missions only from the proxy device to the second-level security domain.

[0018] In a particular embodiment, the data exposure system further comprises a reverse proxy device, placed between the diode and said equipment. And the method comprises the following steps: the reverse proxy device receives the metrology and topology data of said communication network as exposed by the proxy device, and performs bidirectional exchanges with said equipment to expose the metrology and topology data of said communication network to the equipment. Brief description of the drawings

[0019] The following description of at least one embodiment is set forth in relation to the accompanying drawings, among which:

[0020] [Fig.l] schematically illustrates a network architecture including a data exposure system exposing data from a black domain to equipment in a red domain;

[0021] [Fig.2] schematically illustrates a proxy device arrangement of the data exposure system;

[0022] [Fig.3] schematically illustrates a hardware platform arrangement usable for implementing the proxy device;

[0023] [Fig.4] schematically illustrates an arrangement of grouping of proxy devices, in a particular embodiment of the data exposure system;

[0024] [Fig.5] schematically illustrates another arrangement of the data exposure system; and

[0025] [Fig.6] schematically illustrates a flowchart of an algorithm implemented by the data exposure system.

[0026] DETAILED DESCRIPTION OF EMBODIMENTS

[0027] [Fig.l] schematically illustrates a network architecture, including a data exposure system SYS 190 configured to expose data from a domain having a first security level (typically an unsecured domain), called a black domain, to an RNE device 160 of a domain having a second security level (typically an unsecured domain), called a red domain. The second security level is more secure than the first security level (thus, the red domain is more secure than the black domain). The data exposure system SYS 190 may be configured to expose data from the black domain to several RNE devices 160 of the red domain. For example, when the data exposure system SYS 190 is configured to expose data from the black domain to a single device of the red domain, the data exposure system SYS 190 can expose this data in an aggregated manner between metrology data and topology data. And when the SYS 190 data exposure system is configured to expose black domain data to multiple red domain devices, the SYS 190 data exposure system can:

[0028] - expose metrology data to red domain equipment and topology data to another device in the red domain, or

[0029] - expose metrology data to red domain equipment and data in an aggregated manner between metrology data and topology data to another piece of equipment in the red domain, or

[0030] - expose topology data to equipment in the red domain and data in an aggregated manner between metrology data and topology data to another piece of equipment in the red domain, or

[0031] - expose data in an aggregated manner between metrology data and data topology to each equipment concerned in the red domain.

[0032] The network architecture comprises a transit communication network BN 100 in the black domain. Typically, the communication network BN 100 makes it possible to interconnect, for example using secure tunnels, several subnetworks of the red domain. Purely for illustrative purposes, [Fig.l] shows four routers RI 110a, R2 110b, R3 110c and R4 110d in the communication network BN 100.

[0033] To enable the RNE 160 equipment in the red domain to obtain information relating to the transmission conditions in the BN 100 communication network, the network architecture comprises the SYS 190 data exposure system.

[0034] The data exposure system SYS 190 comprises a proxy device PXY 120, which is configured to receive information on the transmission conditions in the communication network BN 100 using a dedicated protocol implemented in the communication network BN 100, typically using one or more standard protocols, for example of the BGP-LS type (“Border Gateway Protocol - Link-State” in English or OSPF (“Open Shortest Path First” in English) or IS-IS (“Intermediate System to Intermediate System” in English). For example, by receiving messages of the BGP UPDATE type transiting in the communication network 100, the proxy device PXY 120 is able to collect and store data making it possible to construct a representation of the topology of the communication network 100.

[0035] It should be noted that the PXY proxy device 120 is passive, in that the PXY proxy device 120 is configured to collect information about transmission conditions in the BN communication network 100, but not to participate in routing decision making in the BN communication network 100 or route calculation in the BN communication network 100. The device The PXY 120 proxy device thus plays the role of a sensor for messages transmitted in the BN 100 communication network with regard to the transmission conditions in the BN 100 communication network (metrology and topology). It should therefore be noted in particular that the PXY 120 proxy device does not play the role of an SDN controller.

[0036] To ensure the security of the red domain, the data exposure system SYS 190 comprises a diode D 150 between the proxy device PXY 120 and the red domain. The diode D 150 is a device which physically authorizes unidirectional transmissions, namely only from the proxy device PXY 120 to the red domain (and therefore to the RNE equipment 160). The diode D 150 allows physical segregation by design, and not by configuration (unlike a firewall), which makes it a device which prevents data from the red domain from being received on its path, which prevents data or messages in clear text from the red domain from being potentially visible from the black domain. Preferably, the diode D 150 authorizes only transmissions carried out according to predefined transport layer protocols (4th layer of the OSI model (“Open Systems Interconnection” in English).For example, diode D 150 prohibits packets conforming to the ICMP (“Internet Control Message Protocol” in English), BGP-LS, OSPF or any other IGP (“Interior Gateway Protocol” in English) type protocols from being able to pass from the proxy device PXY 120 to the red domain (and therefore to the RNE 160 equipment). Transmissions from the proxy device PXY 120 to the RNE 160 equipment are therefore carried out in accordance with a transport layer protocol authorized by diode D 150, preferably UDP (“User Datagram Protocol” in English).

[0037] To ensure the protection of the PXY proxy device 120 of the communication network 100, the data exposure system SYS 190 preferably comprises a first firewall FW1 130 between the PXY proxy device 120 and the communication network 100, the first firewall FW1 130 being configured to limit the exchanges between the PXY proxy device 120 and the communication network 100 to the needs of obtaining by the PXY proxy device 120 information on the transmission conditions in the communication network 100. The first firewall FW1 130 eliminates the capacity of the communication network 100 to flood the PXY proxy device 120 with messages, typically by distributed denial of service (DDoS).

[0038] The PXY proxy device 120 is intended to process the transmission condition information in the communication network 100 and to transmit this information after processing to the RNE equipment 160 in the red domain. An arrangement by A particular embodiment of the PXY proxy device 120 is detailed below in relation to [Fig. 2], and a method describing the operation of the PXY proxy device 120 is detailed below in relation to [Fig. 6] in a particular embodiment.

[0039] To reinforce the security of the red domain, the data exposure system SYS 190 comprises a second firewall FW2 140 between the proxy device PXY 120 and the red domain, in order to limit the exchanges between the proxy device PXY 120 and the red domain to the needs of the exposure by the proxy device PXY 120 of information on the transmission conditions in the communication network 100. The second firewall FW2 140 eliminates the capacity of the proxy device PXY 120 to flood the diode D 150 and consequently the red domain with messages.

[0040] Thus, thanks to the first firewall FW1 130 and the second firewall FW2 140, the proxy device PXY 120 is contained in a demilitarized zone DMZ (“DeMilitarized Zone” in English).

[0041] Preferably, the first firewall FW1 130 and the second firewall FW2 140 include an intrusion prevention system IPS (“Intrusion Prevention System” in English) in order to detect, prevent and counter possible malicious intrusion attempts.

[0042] Thus, preferably, the transmissions from the PXY proxy device 120 to the RNE equipment 160 are carried out in accordance with the UDP protocol as defined in the normative document RFC 768. A particular arrangement allowing secure exchanges with the RNE equipment 160 while using a bidirectional protocol, such as the TCP protocol (“Transmission Control Protocol” in English) defined in the normative document RFC 791, is presented below in relation to [Fig.5].

[0043] It should be noted that messages transmitted securely (tunnels, etc.) by the red domain through the black domain use a different data path than via the PXY 120 proxy device.

[0044] It should also be noted that one or more other firewalls may be present in the red domain between the data exposure system SYS 190 and the RNE equipment 160 in order to reinforce the security of the RNE equipment 160 and more generally of the red domain.

[0045] [Fig.2] schematically illustrates a particular arrangement of PXY proxy device 120.

[0046] The proxy device PXY 120 comprises a first database MDB 250 dedicated to the storage of metrology information relating to the communication network BN 100. When the equipment RNE 160 needs, by configuration, only metrology information relating to the communication network BN 100, the device PXY 120 proxy can be configured to export only the contents of the first MDB 250 database to said RNE 160 equipment.

[0047] The PXY proxy device 120 comprises a second database, herein referred to as the ITDB 260 intermediate topology database, dedicated to storing topology information relating to the BN 100 communication network. When the RNE 160 equipment needs, by configuration, only topology information relating to the BN 100 communication network, the PXY proxy device 120 can be configured to export only the contents of the second ITDB 260 database to said RNE 160 equipment.

[0048] The PXY proxy device 120 comprises a third database, herein referred to as the TDB 280 topology database, dedicated to storing aggregated metrology and topology information relating to the BN 100 communication network. When the RNE 160 equipment needs, by configuration, aggregated metrology and topology information relating to the BN 100 communication network, the PXY proxy device 120 can be configured to export only the contents of the third ITDB 260 database to said RNE 160 equipment.

[0049] The PXY proxy device 120 comprises a first memory buffer MB 210 dedicated to collecting metrology data MD 200a transmitted via the BN communication network 100 and relating to link qualities of the BN communication network 100. The PXY proxy device 120 is configured to store in the first memory buffer MB 210 each message which includes metrology data and which is received from the BN communication network 100 during a time window of predefined duration. The first memory buffer MB 210 makes it possible to absorb peaks in the volume of metrology data which could occur from the BN communication network 100.

[0050] The proxy device PXY 120 comprises a processor, or processing module, for metrology data MP 230, responsible for transferring data stored in the first memory buffer MB 210 to the first database MDB 250. The metrology data processor MP 230 is configured to add an identifier per set of metrology data stored in the first database MDB 250, the identifier in question making it possible to determine which data in the first database MDB 250 are the most recent. The metrology data processor MP 230 can be configured to carry out filtering in the messages stored in the first memory buffer MB 210, in particular to avoid inserting metrology data that is already obsolete in the first database MDB 250 and thus prevent this obsolete data from then being exposed to the RNE equipment 160.

[0051] The proxy device PXY 120 comprises a second memory buffer TB 220 dedicated to collecting topology data TD 200a transmitted via the communication network BN 100 and relating to said communication network BN 100. The proxy device PXY 120 is configured to store in the second memory buffer TB 220 each message which includes topology data and which is received from the communication network BN 100 during the time window of predefined duration. The second memory buffer TB 220 makes it possible to absorb peaks in the volume of topology data which could occur from the communication network BN 100.

[0052] The proxy device PXY 120 comprises a processor, or processing module, for topology data TP 240, responsible for transferring data stored in the second memory buffer TB 220 to the second database ITDB 260. The topology data processor TP 240 is configured to add an identifier to each set of topology data stored in the second database ITDB 260, the identifier in question making it possible to determine which data in the second database ITDB 260 are the most recent. The topology data processor TP 230 can be configured to carry out filtering in the messages stored in the second memory buffer MB 210, in particular to avoid inserting already obsolete topology data into the second database ITDB 260 and thus prevent this obsolete data from then being exposed to the equipment RNE 160.In a particular embodiment, the topology data processor TP 230 is configured to retain a most recent stable link state when the contents of the second memory buffer show untimely link state changes ("link state flapping" in English) for one or more links in the communication network BN 100.

[0053] The PXY proxy device 120 comprises an information aggregation processor, or processing module, IAP 270, responsible for aggregating and transferring, into the third database TDB 280, data stored in the first database MDB 250 and data stored in the second database ITDB 260. The information aggregation processor IAP 270 is configured to gather, via a communication link, the most recent topology information from the second database ITDB 260 and the metrology information stored in the first database MDB 250. The information aggregation processor IAP 270 can rely, to do this, on indications of communication link identifiers, host names, addressing (eg, IP addresses ("Internet Protocol" in English) ...) contained in the metrology and topology information contained in the messages received from the communication network 100.

[0054] The proxy device PXY 120 comprises an exposure manager EM 290, responsible for exposing the metrology and / or topology information to one or several devices of the red domain. The PXY proxy device 120 is configured to retrieve, by configuration according to the needs of the red domain, the information contained in the third database TDB 280 (aggregated data) or in the second database ITDB 260 (topology data only) or in the first database MDB 250 (metrology data only), and to transmit them to the RNE device 160.

[0055] The transmissions from the exposure manager EM 290 to the red domain can be carried out according to a predefined timing, or alternatively, when a change in topology or link capacity in the communication network 100 beyond a predetermined threshold is noted by the exposure manager EM 290. The RNE equipment 160 is therefore waiting for transmissions, from the proxy device PXY 120, of the metrology and / or topology data of the communication network 100.

[0056] Alternatively, a particular embodiment based on a reverse proxy device RPXY 520, detailed below in relation to [Fig. 5], allows the RNE equipment 160 to request metrology and / or topology data from the communication network 100 at its own pace, without harming the security of the red domain relative to the black domain.

[0057] [Fig. 3] schematically illustrates an exemplary device DEV 300 adapted to implement the proxy device PXY 120. The exemplary device DEV 300 is also adapted to implement the reverse proxy device RPXY 520. The exemplary device DEV 300 is also adapted to implement a firewall, such as the first firewall FW1 130 and the second firewall FW2 140.

[0058] The DEV device 130 comprises, connected by a communication bus 310: a processor or CPU (for “Central Processing Unit” in English) 301; a RAM (for “Random Access Memory” in English) 302; a ROM (for “Read Only Memory” in English) 303, or a rewritable memory of the EEPROM type (“Electrically Erasable Programmable ROM” in English), for example of the Flash type; a data storage device, such as a hard disk HDD (for “Hard Disk Drive” in English) 304, or a storage media reader, such as an SD (for “Secure Digital” in English) card reader; a set of COM communication interfaces 305, allowing in particular the DEV device 300 to interact with other equipment.

[0059] In particular, in the case of the PXY 120 proxy device, the set of COM 305 communication interfaces comprises a first uNET (for “untrusted network” in English) communication interface intended to serve as an interface with the black domain, and a second tNET (for “trusted network” in English) communication interface intended to serve as an interface with the red domain. In a In a particular embodiment, as described below in relation to [Fig. 4], the set of COM communication interfaces 305 may comprise a third rNET (for “resiliency network” in English) communication interface intended to serve as a communication interface within the framework of a grouping (“cluster” in English) of proxy devices.

[0060] The processor 301 is capable of executing instructions loaded into the RAM 302 from the ROM 303, from an external memory (not shown), from a storage medium, such as an SD card or the HDD 304, or from a communication network. When the DEV device 300 is powered on, the processor 301 is capable of reading instructions from the RAM 302 and executing them. These instructions form a computer program causing the processor 301 to implement all or part of the steps, behaviors and algorithms described herein.

[0061] All or part of the steps, behaviors and algorithms described herein can thus be implemented in software form by executing a set of instructions by a programmable machine, such as a DSP (Digital Signal Processor) or a processor, or be implemented in hardware form by a dedicated machine or component (chip) or a dedicated set of components (chipset), such as an FPGA (for Field-Programmable Gate Array) or an ASIC (for Application-Specific Integrated Circuit).

[0062] Generally speaking, the device DEV 300 (and more generally the data exposure system SYS 190) therefore comprises electronic circuitry arranged and configured to implement the steps, behaviors and algorithms described herein.

[0063] As already mentioned, [Fig. 4] schematically illustrates a grouping arrangement of proxy devices, in a particular embodiment of the data exposure system SYS 190. The arrangement relies on hardware redundancy of proxy devices, in order to provide resilience to the data exposure system SYS 190. Two proxy devices PXY_1 120a and PXY_2 120b are schematically illustrated in [Fig. 4] in a grouping PXYC 400 in place of the single proxy device PXY 120 of [Fig. 1].

[0064] The proxy devices PXY_1 120a and PXY_2 120b share the same communication addresses (one for communication with the black domain and one for communication with the red domain), typically the same virtual addresses, such as virtual IP addresses. The VRRP protocol (Virtual Router Redundancy Protocol) can be used to do this. One of the proxy devices, for example the proxy device PXY_1 120a, is declared by default. as a master proxy device, and any other proxy device in the group, for example the PXY_2 120b proxy device is declared as a backup proxy device, in order to replace the master proxy device in the event of its failure.

[0065] The master proxy device acts as described herein in relation to the PXY proxy device 120. When the master proxy device fails, a so-called fallback proxy device, called the active fallback proxy device, takes its place. To do this, the master proxy device is configured to update, as storage in its databases progresses, the active fallback proxy device with the data contained in the first database MDB 250 and in the second database ITDB 260, and possibly with the data contained in the third database TDB 280. Preferably, the master proxy device is configured to update the active fallback proxy device only with the data contained in the first database MDB 250 and in the second database ITDB 260.It is then the responsibility of said active fallback proxy device to operate its information aggregation processor IAP 270 to reconstruct the data contained in the third database TDB 280. This approach makes it possible to limit the volume of exchanges between the master proxy device and the active fallback proxy device.

[0066] In the case where the grouping includes several fallback proxy devices, another fallback proxy device becomes active. If by chance the fallback proxy device that has taken the place of the master proxy device in turn becomes faulty, this other active fallback proxy device then takes the place of the master proxy device.

[0067] As already mentioned, [Fig.5] schematically illustrates another arrangement of the data exposure system, having a reverse proxy device RPXY 520.

[0068] The reverse proxy device RPXY 520 is placed between the diode D 150 and the red domain. To reinforce security, a third firewall FW3 510 is preferably interposed between the diode D 150 and the reverse proxy device RPXY 520. The third firewall FW3 510 is configured to limit the exchanges between the reverse proxy device RPXY 520 and the diode D 150 to obtaining the metrology and topology data of said communication network BN 100 as exposed by the proxy device PXY 120.

[0069] Preferably, the third firewall FW3 510 includes an IPS intrusion prevention system in order to detect, prevent and counter possible malicious intrusion attempts.

[0070] The PXY proxy device 120 is configured to transmit the media data trology and / or topology of the black domain as the PXY 120 proxy device would do directly with the RNE 160 equipment (i.e., without the presence of the RPXY 520 reverse proxy device). The RPXY 520 reverse proxy device then includes one or more databases allowing the storage of data transmitted by the PXY 120 proxy device while waiting to transmit them to the RNE 160 equipment.

[0071] The protection of the red domain being ensured mainly by the diode D 150, preferably supplemented by the firewalls FW2 140 and FW3 510, the exchanges between the reverse proxy device RPXY 520 and the equipment RNE 160 can be bidirectional.

[0072] Thus, with such an arrangement, the reverse proxy device RPXY 520 may be configured to transmit the metrology and / or topology data of the black domain to the RNE equipment 160 using an acknowledgment protocol, such as TCP, to manage potential packet losses. Any other protocol suitable for operation in the red domain may be used, such as for example BGP-LS to emulate the network structure of the black domain as part of the red domain.

[0073] It is also possible in this arrangement to avoid the constraint of using a transport layer protocol forced by diode D 150 (4th layer of the OSI model).

[0074] Thus, as a variant, such an arrangement allows the RNE 160 equipment or any other device in the red domain to request the metrology and / or topology data from the black domain at its own pace, or even to request the metrology data at certain times, the topology data at other times and the aggregated data at still other times, depending on its own needs (SDN controller, metrology collector, etc.). For example, the reverse proxy device RPXY 520 can be configured to export an application programming interface (API), allowing the RNE 160 equipment to request data via a GET type call and the reverse proxy device RPXY 520 to respond to it in a standardized manner, for example using an application layer protocol of the RPC type (Remote Procedure Call).

[0075] As already mentioned, [Fig.6] schematically illustrates a flowchart of a particular algorithm for exposing data from the black domain to the RNE equipment 160, which is implemented by the data exposure system SYS 190, and more particularly by the proxy device PXY 120.

[0076] In a step 601, the PXY proxy device 120 collects metrology data from the dark domain, more precisely from the communication network 100, as already detailed.

[0077] In a step 602, the PXY proxy device 120 processes and stores in a database data the metrology data collected in step 601, as already detailed.

[0078] In a step 603, the PXY proxy device 120 collects topology data of the black domain, more precisely of the communication network 100, as already detailed.

[0079] In a step 604, the PXY proxy device 120 processes and stores in a database the topology data collected in step 603, as already detailed.

[0080] In a step 605, the PXY proxy device 120 aggregates and stores in a database the metrology data stored in step 602 and the topology data stored in step 604, as already detailed.

[0081] In a step 605, the data exposure system SYS 190 transmits the aggregated data to the RNE equipment 160, according to any one of the embodiments previously described.

[0082] Thus, thanks to the metrology and topology data relating to the communication network 100, the RNE equipment 160 can establish a routing policy according to the needs of its topology, for example a red domain with a meshed structure (“meshed” in English) which needs to manage its QoS (“Quality of Service” in English) in depth. Indeed, in network architectures where several security levels coexist, the routing established by a higher security domain (red domain) may prove to be suboptimal due to a lack of topology and quality information of underlying links belonging to a lower security domain (black domain). The data exposure system SYS 190 described above makes it possible to overcome this lack, without calling into question the integrity of the higher security domain (red domain).

Claims

Claims

1. Data exposure system (190) configured to expose (606) to equipment (160) metrology and topology data of a communication network (100) of a domain of a first security level, the equipment (160) belonging to a domain of a second security level higher than the first security level, the data exposure system (190) comprising: - a proxy device (120), configured to perform a collection (601, 603) of metrology data of said communication network (100) and topology data of said communication network (100) from messages transmitted in said communication network (100) and captured by said proxy device (120), and to expose (606) the metrology and topology data of said communication network (100);- a diode (150), placed between the proxy device (120) and said equipment (160), the diode (150) physically authorizing unidirectional transmissions only from the proxy device (120) to the second security level domain.;

2. Data exposure system (190) according to claim 1, further comprising: - a first firewall (130), placed between said communication network (100) and the proxy device (120), and configured to limit exchanges between the proxy device (120) and said communication network (100) to the collection (601, 603) of said metrology and topology data; - a second firewall (140), placed between the proxy device (120) and the diode (150), and configured to limit exchanges with the proxy device (120) to an exposure of said metrology and topology data of said communication network (100).

3. The data exposure system (190) of claim 2, wherein the first firewall (130) and the second firewall (140) include an intrusion prevention system.

4. Data exposure system according to one of claims 1 to 3, in which the proxy device (120) comprises: - a first memory buffer (210) dedicated to collecting the metrology data transmitted via said communication network (100) and relating to qualities of links of said communication network (100); - a first database (250) used to expose the metrology data to said equipment (160); - a metrology data processor (230) configured to process (602) the metrology data in the first memory buffer (210), in charge of transferring data stored in the first memory buffer (210) to the first database, configured to add an identifier per set of metrology data transferred to the first database (250), the identifier in question making it possible to determine which data in the first database (250) are the most recent; - a second memory buffer (220) dedicated to collecting the topology data transmitted via said communication network (100) and relating to said communication network (100); - a second database (260) used to expose the topology data to said equipment (160);- a topology data processor configured to process (604) the topology data in the second memory buffer (220), in charge of transferring data stored in the second memory buffer (220) to the second database (260), configured to add an identifier per set of topology data transferred to the second database (260), the identifier in question making it possible to determine which data in the second database (260) are the most recent.;

5. The data exposure system (190) of claim 4, wherein the metrology data processor (230) is configured to perform filtering in the first memory buffer (210) to avoid inserting already obsolete metrology data into the first database (250), and the topology data processor (240) is configured to perform filtering in the second memory buffer (220) to avoid inserting already obsolete metrology data into the second database (260).

6. The data exposure system (190) of claim 5, wherein the topology data processor (240) is configured to perform filtering in the second memory buffer (220) to retain a most recent stable link state when at least one link exhibits in the second memory buffer (220) untimely link state changes.

7. A data display system (190) according to one of claims 4 to 6, wherein the proxy device (120) comprises: - a third database (280) used to expose aggregated metrology and topology data to said equipment (160); and - an information aggregation processor (270), responsible for aggregating and transferring, into the third database (280), data stored in the first database (250) and data stored in the second database (260), the information aggregation processor (270) being configured to gather, by communication link, the most recent topology information stored in the second database (260) and the most recent metrology information stored in the first database (250).

8. The data exposure system (190) of any one of claims 4 to 7, wherein the proxy device (120) is a master proxy device (120a) in a proxy device cluster (400) of the data exposure system (190) further including a fallback proxy device (120b) that shares the same virtual addresses as the master proxy device (120a) and is intended to replace the master proxy device (120a) in the event of failure of said master proxy device (120a), the master proxy device (120a) being configured to update, as storages in its databases (250, 260, 280), the fallback proxy device (120b).

9. A data exposure system (190) according to any one of claims 1 to 8, wherein the diode (150) only allows transmissions performed according to predefined transport layer protocols.

10. Data exposure system (190) according to any one of claims 1 to 9, further comprising a reverse proxy device (520), placed between the diode (150) and said equipment (160), and configured to receive the metrology and topology data of said communication network (100) as exposed (606) by the proxy device (120), and to carry out bidirectional exchanges with said equipment (160).

11. The data exposure system (190) of claim 10, comprising a third firewall (510), positioned between the diode (150) and the reverse proxy device (520), and configured to limit exchanges with the diode (150) to obtaining said me- trology and topology of said communication network (100) as exposed by the proxy device (120).

12. Method for exposing (606) to a device (160) metrology and topology data of a communication network (100) of a domain of a first security level, the device (160) belonging to a domain of a second security level higher than the first security level, the method being implemented by a data exposure system (190) comprising: - a proxy device (120), - a diode (150), placed between the proxy device (120) and said device (160); the process comprising the following steps: - the proxy device (120) performs a collection (601, 603) of metrology data of said communication network and topology data of said communication network (100) from messages transmitted in said communication network (100) and captured by said proxy device (120), and exposes (606) the metrology and topology data of said communication network (100); and - the diode (150) physically authorizes unidirectional transmissions only from the proxy device (120) to the second security level domain.

13. The method of claim 12, wherein the data exposure system (190) further comprises: - a reverse proxy device (520), placed between the diode (150) and said equipment (160); and the process comprising the following steps: - the reverse proxy device receives the metrology and topology data of said communication network (100) as exposed by the proxy device (120), and performs bidirectional exchanges with said equipment (160) to expose the metrology and topology data of said communication network (100) to the equipment (160).

Images