Method for distributing session keys in a telecommunications network, associated processing methods in a client and server, associated client and server module

Abstract

A method for distributing session keys in a telecommunications network (1) comprising N servers (1_1, 1_2), and clients (2_1, 2_2) of the type "publishers" or "subscribers" exchanging encrypted information using session keys (3), according to which: each server (1_1, 1_2), when it has the role of master server, the only one authorized to distribute session keys, sends a predefined message to the clients (2_1, 2_2) according to a predefined minimum periodicity; each client (2_1, 2_2), when it detects that said predefined message has not been received in accordance with said periodicity, sends a request to search for a new master server to the server of rank n+1 which follows the current master server of rank n in an ordered list of servers; each server (1_1, 1_2), as soon as it receives such a request, triggers an operation to elect a new master server from the servers;The master server elected by said election operation triggers, upon its election, a replacement of valid session keys with the clients (2_1, 2_2). Figure for the abbreviation: Fig. 1;

Description

Title of the invention: Method for distributing session keys in a telecommunications network, associated processing methods in a client and a server, client module and associated servers. Technical field

[0001] The invention lies in the field of key distribution in a telecommunications network comprising key distribution servers and client modules using these keys to communicate with each other.

[0002] It is particularly useful in critical embedded and / or real-time systems.

[0003] "Session keys" refer to all the cryptographic data used to ensure the confidentiality and / or integrity of communications between several clients, regardless of the type of encryption used. These keys are valid for a predefined period, and therefore subject to periodic renewal. They include, for example, symmetric or asymmetric keys, used to encrypt or sign data. Prior art

[0004] The significant increase in the performance of wireless communications as well as the development of standard protocols makes possible the massive use of connected objects in industrial (IIoT) or general public (loT) contexts.

[0005] Despite the advantages they bring in terms of flexibility and connectivity, the use of these systems, composed mainly of connected objects of the loT / IIoT type, are a factor of exposure to new risks which can strongly impact cyber-security and, consequently, operational safety. Indeed, the last decade has also been marked by the advent of increasingly complex attacks on industrial systems (Stuxnet in 2010, Black Energy in 2017, etc.), having caused considerable damage to their victims.

[0006] Among the many communication protocols for IoT and IIoT, the protocols of the transport and higher layers in the OSI model seem particularly suitable for carrying security, notably the DDS, MQTT, CoaP and OPC UA protocols. These support, for operational communication, producer-consumer paradigms: the publish / subscribe (PubSub) model is an alternative to the traditional "Client / Server" model. The "PubSub" model dissociates the client (called publisher) who sends a particular message, to which the subscribing clients (called subscribers) have access. A third actor, called the broker, known to both the publisher and the subscriber, filters all incoming messages from the publishers and distributes them in to subscribers (or notifies them of the availability of new data accessible from the broker) based on the type of message, subject or content and criteria indicated by the subscribers. As a result, the publisher does not know the list of subscribers called upon to receive the data that the publisher sends to the broker. It is important to note that authentication and key distribution can fall under other paradigms, for example client / server.

[0007] MQTT and CoaP are very lightweight communication protocols that do not natively incorporate any security. In the case of MQTT, a secure version called MQTT-S (or MQTT-SN), in the form of encryption with TLS with decryption / encryption of messages at the broker level. This solution is not satisfactory on a public network, because the broker can be compromised, exposing all communications to Man In The Middle (MITM) attacks.

[0008] DDS proposes a distributed architecture (DDS Security version 1.1, OMG) allowing the different communicating actors to exchange encryption keys between them. The key server functions (KeyFactory) can be implemented in any actor. The solution proposed by DDS is heavy in terms of exchanges generated at each connection and therefore not very compatible with the constraints of many critical embedded and / or real-time systems. In addition, no specific solution is proposed to ensure the resilience of the key server.

[0009] OPC UA PUBSUB (OPC Unified Architecture Specifications part 14, version 1.04, OPC Foundation) is a variant of the OPC UA protocol. It offers, among other things, an end-to-end encryption solution where key distribution is centralized, but remains compatible with OPC UA. The encryption keys are distributed to all actors by a specific service, the encryption key service (SKS). This solution is efficient in terms of network communication, and resistant to MITM attacks, but poses a problem from the point of view of operational safety, by introducing a single point of vulnerability: the SKS.

[0010] The mechanisms for ensuring SKS redundancy are not explicitly described in the part of the specification describing OPC UA PUBSUB. However, in PUBSUB, key distribution is done in OPC UA Client-Server, where the SKS is implemented in an OPC UA server, while the publisher or subscriber is implemented in an OPC UA client - and the OPC UA specification describes a solution for server redundancy (OPC Unified Architecture Specifications, part 4, version 1.04, section 6.6.2, OPC Foundation).

[0011] OPC UA defines two operating modes for generic server redundancy mechanisms: transparent and non-transparent. The transparent mode implements a proxy located between clients and servers, which is responsible for redirecting client requests depending on server availability. The non-transparent mode gives the customer the responsibility to choose a server from the redundant server pool.

[0012] In the non-transparent mode, there are four categories of switching, corresponding to varying degrees of synchronization of the SKSs:

[0013] - Cold: only the active server is functional, the others are off. No in training is therefore not synchronized between servers, and the client must maintain local information relating to inactive (non-synchronized) servers;

[0014] - Warm: all servers are started, and are listening to the different clients, but only the active server can transmit to a client. The servers therefore share the information received from the clients (synchronized);

[0015] - Hot: all clients are connected to all servers, and receive in training of the latter in parallel. The client is responsible for managing redundant flows;

[0016] - Hot and duplicated: clients are only connected to one server, which maintains on other servers a copy of the sessions that clients open with it. In case of failover, clients do not have to create a new session context (strongly synchronized).

[0017] Analysis of the application of OPC UA redundancy to key distribution in PUBSUB:

[0018] Determinism of key generation

[0019] The specificity of SKS is to hold a key (or a set of keys) whose illegitimate consultation calls into question the security of the system. In addition, they have an asymmetric behavior by nature, because of the source of entropy necessary for the generation of the key. Two SKS having the same inputs will have different behaviors (i.e. will generate different keys). This is why it must not be possible to have two clients subscribed to different SKS - otherwise they will not be able to communicate with each other. This mode of operation excludes warm switches, which are based on the determinism of the behaviors of the servers.

[0020] Synchronization and vulnerability

[0021] Data-replicating solutions (typically warm and beyond) would allow a server to be brought up with the current encryption key, which would introduce a vulnerability (a brought up SKS would immediately have to perform a new key generation, because the key of the faulty SKS must be considered potentially compromised). Furthermore, these solutions involve multiplying the number of connections in the system by the number of existing SKSs, which is very heavy in terms of performance impact. This solution is therefore not desirable.

[0022] Cold failover mode does not involve additional communication, but relies on a direct connection with the server to detect the failure of the latter. This assumption falls in the case of OPC UA PUBSUB, because of the presence of the broker and the disconnected nature of the protocol (general case of producer-consumer paradigms). Furthermore, the issue of SKS choice is only addressed in the standard from the perspective of load balancing, and in the case of unstable networks can lead to clients choosing different SKSs, which would call into question the availability of the system.

[0023] Detail of the vulnerabilities of the key exchange: the three residual risks present when using the techniques presented in the state of the art are explained below in the context of OPC UA PUBSUB for the example.

[0024] Risk 1: Customer compromise

[0025] In the case of using a set of keys of size K greater than 1 (i.e. the set of keys includes at least K keys associated with successive validity periods, the K keys therefore being intended to succeed one another over time) and specific to a group of clients (the electronic object of publisher or subscriber type is in fact a client with respect to the SKS server, which delivers secret keys to it), the security against a statistical attack against the session keys used to encrypt / decrypt the data published by the publisher is preserved (since the keys change), but the security against the compromise of a client of the group is reduced by a factor equal to the size of the set of keys: in fact, if the set of keys is obtained by an attacker, then the entire group is compromised for a correspondingly longer duration. This is a consequence of reducing the frequency of distribution of secure keys.

[0026] Such a situation is represented in [Fig.5]. First of all the SKS server distributes the session key set to the Publisher and the Subscriber, of size K. In a first phase <pl, la première clef secrète est utilisée pour le chiffrement par le Publisher des messages Ml, qu’il envoie ensuite au Broker, lequel les fait suivre aux Subscribers qui déchiffrent les messages Ml avec la première clef secrète. Au cours de cette phase q> 1, the attacker maliciously obtains the session key set, for example by reading the physical memory of the Publisher.After the date, T1, of expiration of the first secret key, a second phase q>2 begins (until the date, T2, of expiration of the second secret key), where the second secret key is used for encryption by the Publisher of the messages M2, which it then sends to the Broker, which forwards them to the Subscribers who decrypt the messages M2 with the second secret key; the attacker also publishes messages encrypted by the second secret key which reach the subscribers via the broker, and this intrusion can last as long as the set of secret keys remains valid, i.e. until the expiry of the validity of the Kth key.

[0027] Risk 2: Availability for renewal

[0028] The precise dates of key renewal requests by clients depend on their time source. If one of them is late with respect to the SKS, it may receive messages encrypted with a secret key that it does not possess. not yet, and will therefore lose these messages. Depending on the context of IIoT use, this can be a significant problem, as connected objects may be located in networks without access to reliable time sources.

[0029] Risk 3: SKS failure

[0030] The platform hosting the SKS may experience a failure, either caused by an attack or accidental. In both cases, the IIoT network will continue to operate until the keys in the current key set expire, and then shut down due to a lack of a new set. Since the failure of the SKS may very well be the result of a compromise of the SKS, and the keys stored in the SKS may now be known to the attacker, this continuity of activity is a secondary vulnerability (we then return to risk 1).

[0031] There is therefore a need to improve resilience and cybersecurity in communications of distributed systems in an embedded system context. Summary of the invention

[0032] To this end, according to a first aspect, the present invention describes a method for distributing session keys in a telecommunications network comprising a set of N session key distribution servers, N being strictly greater than 1, clients comprising “publisher” type clients and “subscriber” type clients, and an intermediate “broker” type communication module, said servers, clients and broker being interconnected by telecommunications links;

[0033] according to which a publisher client delivers to the broker module encrypted information based on at least one secret encryption key stored in the publisher client, at least one subscriber client associated with the publisher client then obtains via the broker intermediate communication module said consultable information and decrypts, and / or verifies, said information based on a decryption key associated with said encryption key; and each server is adapted to generate and distribute session keys to the clients, comprising the encryption, decryption and / or signature keys;

[0034] said method being characterized in that:

[0035] only one of the servers, at any given time, has the role of master server of the servers, and only the master server is authorized to distribute session keys to the clients;

[0036] each server and each client stores the same ordered list for the election of a new master, from rank 1 associated with the maximum priority to rank N associated with the minimum priority, of the servers of the set of servers, said ordered list of servers further indicating which is the current master server, each server storing a list of clients to which valid session keys have been distributed by the current master server and previous master servers;

[0037] each server, when it has the role of master server, sends to the clients, according to at least a predefined minimum periodicity, a periodic message of a first predefined type (heartbeat);

[0038] each client monitors that it receives, according to said predefined periodicity, messages of the first type from the current master server indicated in the ordered list of servers; and when it detects that a message of the first type has not been received in accordance with said minimum periodicity, the client sends a search request for a new master server to the server of rank n+1 which follows the current master server of rank n in the ordered list of servers;

[0039] each server of the set of servers, as soon as it receives a search request for a new master server, triggers an operation of election of a new master server from the servers of the set of servers;

[0040] the master server elected by said election operation triggers, upon its election, among the clients in its client list, a replacement of the valid session keys indicated in the client list and which have been assigned to them.

[0041] The invention ensures secure resilience of the distribution of session keys and increases the security of communications.

[0042] In embodiments, such a method will further comprise at least one of the following features: - upon expiration of a predefined time after a client has sent a search request for a new server without the client having received a message from a server elected master server, said client sends a search request for a new master server to the server of rank n+2 in the ordered list of servers; - the election operation triggered by said server upon receipt of a search request for a new master server comprises the steps consisting of: - send to all other servers in the ordered list of servers a message of a second predefined type, indicating that a master server is to be elected, and identifying the server sending said message; - after a set time delay: - if said server has received during said timeout one or more messages of the second type from server(s) and, according to the ordered list, its priority is lower than the priority of the servers having sent said messages of the second type, it is not the master server elected by said election operation;

[0043] - if said server has not received any message from the second during said timeout type from server(s) or if it has received some and that, according to the ordered list, its priority is higher than the priority of the servers having sent said messages of the second type, it is the master server elected by said election operation; - the new keys intended to replace the session keys are generated by the master server at the time of its election from a new generation seed that it generates randomly; - the ordered list is an ordered loop, where after the server of rank N, we return to the server of rank 1; - upon a request for a session key by a client, said client sends a key request to the server of rank i in the list, starting with i = 1, and in the absence of a response claiming master server status from said server, increments the value of i, i = i+1, and iterates said sending of request; - a synchronization mechanism between servers includes synchronization of the server list indicating the current master server, no synchronization of the keys distributed by the servers and / or the entropy source of the servers having to take place.

[0044] According to another aspect, the invention describes a processing method, implemented in a client, for obtaining session keys, in a telecommunications network comprising a set of N session key distribution servers, N being strictly greater than 1, clients comprising “publisher” type clients and “subscriber” type clients, and an intermediate “broker” type communication module, said servers, clients and broker being interconnected by telecommunications links;

[0045] according to which a publisher client delivers to the broker module encrypted information according to at least one secret encryption key stored in the publisher client, at least one subscriber client associated with the publisher client then obtains via the broker intermediate communication module said consultable information and decrypts, and / or verifies, said information according to a decryption key associated with said encryption key; and each server is adapted to generate and distribute session keys to the clients, comprising the encryption, decryption and / or signature keys;

[0046] said method being characterized in that, the client having stored an ordered list for the election of a new master, from rank 1 associated with the maximum priority to rank N associated with the minimum priority, of the servers of the set of servers, said ordered list of servers further indicating which is the current master server, only one of the servers, at any given time, having the role of master server of the servers, and only the master server being authorized to distribute session keys to the clients:

[0047] the client monitors that it receives, according to a predefined minimum periodicity, periodic messages of a first predefined type (heartbeat) from the current master server indicated in the ordered list of servers; and

[0048] when it detects that a message of the first type has not been received in accordance with said minimum periodicity, the client sends a search request for a new master server to the server of rank n+1 which follows the current master server of rank n in the ordered list of servers;

[0049] the client receives, from a new master server, new session keys to replace the previous session keys.

[0050] According to another aspect, the invention describes a client in a telecommunications network comprising a set of N session key distribution servers, N being strictly greater than 1, clients comprising “publisher” type clients and “subscriber” type clients, each subscriber client being associated with a publisher client, and an intermediate “broker” type communication module, said servers, clients and broker being adapted to be interconnected by telecommunications links;

[0051] a publisher client being adapted to deliver to the broker module encrypted information based on at least one secret encryption key stored in the publisher client, at least one subscriber client associated with the publisher client being adapted to then obtain, via the broker intermediate communication module, said consultable information and decrypt, and / or verify, said information based on a decryption key associated with said encryption key; and each server is adapted to generate and distribute session keys to the clients, comprising the encryption, decryption and / or signature keys;

[0052] said client being an electronic device characterized in that, the client having stored an ordered list for the election of a new master, from rank 1 associated with the maximum priority to rank N associated with the minimum priority, of the servers of the set of servers, said ordered list of servers further indicating which is the current master server, only one of the servers, at any given time, having the role of master server of the servers, and only the master server being authorized to distribute session keys to the clients:

[0053] the client is adapted to monitor that it receives, according to a predefined minimum periodicity, periodic messages of a first predefined type (heartbeat) from the current master server indicated in the ordered list of servers; and

[0054] the client is adapted to, when it detects that a message of the first type has not been received in accordance with said minimum periodicity, send a search request for a new master server to the server of rank n+1 which follows the current master server of rank n in the ordered list of servers and to receive, from a new master server, new session keys to replace valid session keys previously assigned to the client.

[0055] According to another aspect, the invention describes a session key distribution server in a telecommunications network comprising a set of N session key distribution servers, N being strictly greater than 1, clients comprising “publisher” type clients and “subscriber” type clients, and an intermediate “broker” type communication module, said servers, clients and broker being interconnected by telecommunications links;

[0056] according to which a publisher client delivers to the broker module encrypted information according to at least one secret encryption key stored in the publisher client, at least one subscriber client associated with the publisher client then obtains, via the broker intermediate communication module, said consultable information and decrypts, and / or verifies, said information according to a decryption key associated with said encryption key; and each server is adapted to generate and distribute session keys to the clients, comprising the encryption, decryption and / or signature keys;

[0057] said server being characterized in that it is adapted to respect the following rule: only one of the servers, at any given time, has the role of master server of the servers, and only the master server is authorized to distribute session keys to the clients;

[0058] the server storing an ordered list for the election of a new master, from rank 1 associated with the highest priority to rank N associated with the lowest priority, of the servers in the set of servers, said ordered list of servers further indicating which is the current master server, and the server storing a list of clients to which valid session keys have been distributed by the current master server and previous master servers;

[0059] the server is adapted to, when it has the role of master server, send to the clients, according to at least a predefined minimum periodicity, a periodic message of a first predefined type (heartbeat);

[0060] the server is adapted to, when it receives a search request for a new master server from a client, trigger an operation of electing a new master server from the servers of the set of servers;

[0061] the server is adapted, if it is elected the master server by said election operation, to trigger, upon its election, among the clients in its client list, a replacement of the valid session keys indicated in the client list and which have been allocated to them. Brief description of the drawings

[0062] The invention will be better understood and other characteristics, details and advantages will appear more clearly on reading the following description, given without limitation, and thanks to the appended figures, given by way of example.

[0063] [Fig-1] [Fig.l] represents a producer type communication system information-information consumers in one embodiment of the invention;

[0064] [Fig.2] [Fig.2] represents the steps for detecting an SKS server failure;

[0065] [Fig.3] [Fig.3] represents the steps of a master server election of the SKS servers;

[0066] [Fig.4] [Fig.4] is a diagram of the architecture of a system implementing the invention in the railway field;

[0067] [Fig.5] [Fig.5] illustrates a situation of compromise of a client in the prior art.

[0068] Identical references may be used in different figures when they designate identical or comparable elements. Description of the embodiments

[0069] [Fig.l] represents a distributed and secure resilient communication system for the exchange of session keys in one embodiment of the invention.

[0070] In the embodiment considered with reference to [Fig.l], the communication system 1 comprises a number P of client electronic devices 2_1, 2_2, ..., 2_P, for example computers or smartphones (P any number, greater than or equal to 2), a number N of secret key servers (N greater than or equal to 2 and in the case shown, N = 3) 1_1, 1_2, ... 1_N, here called SKS servers, and a broker device 3, typically a computer.

[0071] Telecommunications links 4, comprising for example wireless links, interconnect the SKS servers, the clients and the broker, which are adapted to communicate via said links 4. Among the clients are publisher clients and subscriber clients and the transmission of messages from a publisher to one or more subscribers is done via the broker 3.

[0072] A publisher and the subscribers having access to the publisher's messages constitute a group; session keys, specific to the group (in particular the broker does not obtain these keys), are distributed to them for encryption by the publisher of the messages it sends to the broker and decryption by the subscribers of the messages delivered by the broker from the publisher. The encryption key is for example a symmetric key, or a pair of asymmetric keys. The encryption complies with the AES 256 standard for example.

[0073]

[0074]

[0075]

[0076]

[0077]

[0078]

[0079] The architecture is specified in [Fig.l] for server 1_1, and each server has the same architecture as that of server 1_1. Similarly, the architecture is specified in [Fig.l] for client 2_1, and each client has the same architecture as that of client 2_1. The embodiment described here relates to a system which integrates the invention based on the OPC UA PUBSUB protocol, but the invention can of course be implemented using another communication protocol using the group communication paradigm (eg MQTT). The session key distribution function is redundant by the presence of N key servers. Key servers are, for example, computer servers that can be addressed, via communication links 4, from all points of the network, and their network address is known to all present and future clients. Each key server 1_1, 1_2, ... 1_N includes, in addition to a calculator and means of telecommunication via links 4: - an electronic module 13 for generating keys, for example of the OPC UA PUBSUB type on the SKS side, making it possible to (1) generate new session keys at the end of the lifetime of the previous ones or at the end of the election of a new master server and (2) transmit these keys to the clients concerned; as well as the four additional modules implemented in one embodiment of the invention: - an electronic election module 14, adapted to implement the steps of the master server elections (see below); - an electronic presence signaling module 15 adapted to send messages allowing the detection of SKS failure by customers (see below); - an electronic key renewal module 16, adapted to implement the distribution of keys at the initiative of the SKS during the election as master server of the key server (see below) and furthermore upon expiry of the validity period of the keys which have been generated by the key server; - an electronic module 17 for secure authentication adapted to implement the security of the authentication used in the distribution of keys (see below); Each key server 1_1, 1_2, ... 1_N includes a memory storing: - list 11 of servers 1_1, 1_2, ... 1_N as well as a cursor on the current master SKS; in list 11, the servers are ordered according to a priority order assigned to each of the servers; here, for example, the highest priority is assigned to server 1_1 and the lowest priority to server 1_N. The order of priority is, for example, arbitrary or a function of the capacity of the servers or their geographical position. It should be noted that the objective of redundancy is to ensure resilience, not performance - the invention therefore does not apply to redundancy applied for load balancing; - list 12 identifying the clients, listing for each client of system 1, in particular its network address, such as, for example, an IP address and a port in TCP / IP; - the expiry date of the keys that the said server distributed in association with the identifier of the clients receiving these keys.

[0080] Each client 2_1, ..., 2_P, whether of publisher or subscriber type, comprises, in addition to a calculator and telecommunication means via the links 4: - an electronic module 22 for publication / subscription and management of session keys received from an SKS (for example of OPC UA PUBSUB type on the client side, in one embodiment), - an electronic module 23 for detecting malfunction of the master SKS; - a 24-bit secure authentication electronic module suitable for implementing the authentication security used in key distribution (see below).

[0081] Each client comprises a memory storing the list 21 of key servers 1_1, ..., 1_N ordered according to the order of priority assigned to each of the servers, as well as their network address in order to carry out the physical routing of the frames, such as for example an IP address and a port in TCP / IP.

[0082] Each key server synchronizes with the other key servers and with all clients the ordered list of SKSs, as well as the cursor on the current master SKS. Each key server synchronizes with the other key servers the list 12 of clients.

[0083] Synchronization between key servers is performed in a lax manner: i.e. it is deliberately limited to two elements: the ordered list of SKSs (also containing a pointer to the master SKS) and the list of clients. Synchronization of the list of SKSs is a convergent property of the election of the master server (see below). This synchronization is said to be lax because it excludes a certain number of data whose replication would be a source of vulnerabilities. In particular, no synchronization of the keys (nor of their expiry date) distributed by the servers to the clients is performed between the key servers, nor of the source of entropy (mechanism and seed).

[0084] In one embodiment, the electronic modules in the clients, respec tively the servers are implemented in the form of software modules comprising software instructions which, when executed on a computer of the client or of the server, implement the steps described below and incumbent on the client or of the server.

[0085] Each key server 1_1, 1_2, ... 1_N is adapted to operate as a master server or a slave server depending on whether it is the last elected master server or not.

[0086] If and only if a key server is the master server, then its electronic presence signaling module 15 sends to each client, at the network address indicated in the client list 12, a message of a first type, here called a “heartbeat” message, at regular intervals, according to a predefined period or a cyclical profile defined and known to the clients. The objective of this message is to signify the fact that the transmitting SKS is operational.

[0087] The malfunction detection module 23 in each client 2_1, ..., 2_P, monitors that it receives, according to said predefined periodicity, the heartbeat messages from the current master server as indicated by the cursor in the ordered list of servers 21; and when it detects that the heartbeat message has not been received according to said predefined periodicity (or in embodiments, that the number of messages not received according to this periodicity is greater than a fixed threshold, greater than or equal to 2), the detection module 23 of the client detects a malfunction and sends a search request (Master Request type message) for a new master server to the server of rank n+1 which follows the current master server (of rank n in the list) in the ordered list of servers.

[0088] The heartbeat type message is, in the case considered, for example parameterized by renewal, which defines the number of missed messages triggering a change of key server, and period, which defines the periodicity of sending the heartbeat. This periodicity value is typically the maximum duration during which message losses are acceptable from an operational point of view, divided by renewal.

[0089] [Fig.2] illustrates the sequence of these previous steps implemented in a situation of detection of a failure of the master SKS server by a client (here publisher).

[0090] Each election module 14 of each key server, excluding the previous master server, upon receipt by said key server of a Master Request type message sent by a client 2_i, i = 1 to P, sends to all the other servers in the list 11 of servers a message requesting an election, here called a Master Claim message, with the identifier of the server. It waits for a predefined time (a period called a timeout equal to at least twice the latency of the message, taking as a reference the sending of its own Master Claim). It can receive during this period one or more Master Claim messages coming from other key servers. At the end of the wait: - if the priority of the key server to which the election module 14 belongs is lower than those of other Master Claims received, it considers itself a slave server, and does not respond to the client; - otherwise, i.e. if it has not received any Master Claim message, the server becomes the current master key server, it then generates new session keys and the key server's key renewal module 16 responds to the client that requested it by the Master Request message with a SetSecurityKey (with an immediate key renewal regardless of the expiration date of its key) and more generally to each client in its client list. It also updates the cursor in its list of servers 11 and by synchronization, the list of servers in the other servers and in the clients is also updated.

[0091] SetSecurityKey is a set of protocol exchanges initiated by an SKS and intended for a client, and has the function of sending new session keys to the client. These exchanges include the mutual authentication of the interlocutors, the creation of a secure channel between them and the transmission of the session keys in this channel. A possible and efficient implementation solution would be to use the homonymous function defined in OPC UA PUBSUB.

[0092] [Fig.3] illustrates a master SKS server election in system 1, after a malfunction detected for example as illustrated in [Fig.2], with N=3. In the illustrated scenario, a Publisher client 2_i (i.e. 1,..., Q, Q <p) a détecté une défaillance du serveur alors maître (ici le 1_1) ; il envoie comme décrit précédemment un message master request au esclave 1_2. le 1_2 émet claim à destination de chacun des serveurs 1_1 et 1_3. ici seul reçu d’un client. il est donc émettre claim. procède l’envoi setsecuritykey après expiration timeout client 2_i.

[0093] In one embodiment, if the client has not received any feedback (SetSecurityKey message) after the expiration of a predefined time (typically equal to timeout times two) following the sending of its Master Request message, the client then sends a Master Request message to the next server in its list, and so on. Once the Nth server, server 1_N, in the list of servers is reached, the client loops back to the first server 1_1, incrementing the duration between each cycle, until it obtains a response. A mechanism external to the excluded master server makes it possible to ensure that it has not been compromised before reintroducing it into the list of SKS servers eligible for the master server position.

[0094] Redundancy is said to be cyclical because, after exhaustion of the list of key servers (due to failure of all of them) without receipt of a message indicating the Once the request has been taken into account, the client will return to the first server, and so on, until one of the key servers finally responds.

[0095] Redundancy is said to be adaptable because an arbitrary number N of servers can be provisioned, depending on the system's availability needs.

[0096] Risk 3 mentioned above is avoided, since the key server is redundant without theoretical limits. Any session keys that may be compromised will only be compromised for a maximum duration equal to period times renewal (plus the master server election time, which is generally extremely short).

[0097] It will be noted that the transmission of session keys is carried out according to the OPC UA PUBSUB standard, in the embodiment considered and therefore according to the following steps: 1. Sending by client 2_i (ie 1,..., P) of its certificates (containing in particular their public encryption key) to the master SKS server l_n (ne 1,..., N); 2. Verification of the certificate by the master SKS server (signature by a legitimate authority and expiration date); 3. Response from the SKS server by sending an unpredictable message encrypted with the client's public key (challenge); 4. Decryption by the client of the challenge using its own private key; 5. Customer response to the challenge with a message containing the same text, encrypted with the SKS public key; 6. Decryption by the SKS of the message received from the client (response to the challenge); 7. Calculation by the client of a temporary secret key SKI using the public key of the SKS and its private key; 8. Calculation by the SKS of a temporary secret key SK2 using the client's public key and its private key (by construction SKI = SK2); 9. Sending by the SKS of the session key (or group key) encrypted with SK2 by the SKS; 10. Client decrypts the session key with SKI.

[0098] In one embodiment of the invention, the conservation of the private keys is carried out, for each interlocutor (Client and SKS), in “Secure Elements” (SE) present in their respective hosts, for example according to the TPM2 standard (https: / / trustedcomputinggroup.org / resource / tpm-library-specification / ), or the Embedded Secure Element from Gemalto (https: / / www.thalesgroup.com / en / markets / digital-identity-and-security / mobile / secure-e lements / embedded-secure-element).

[0099] In this embodiment, the exchange of session keys is secured by adding the following steps:

[0100] In the provisioning phase: - Each client's private key is stored in a “Secure Element” (SE); - The client certificate is generated (cryptographic signature) by the OS without the private key being extracted from it; - The private key of each SKS is kept in the OS present in its host; - The SKS certificate is also generated using the OS. In operational phase (key distribution): - Decryption of the SKS challenge (phase 4) is carried out in the Client's OS; - The decryption of the response to the challenge by the Client (phase 6) is carried out in the SKS SE; - The calculation of the temporary secret key SKI (step 7) is carried out by the client's OS; - The calculation of the temporary secret key SK2 (step 8) is carried out by the SKS SE; Since the private keys never leave the SKS (or the client), and thanks to the non-readability properties of the OS, physical access to the machine does not simply allow them to be obtained, and it is therefore not possible for an attacker without very substantial means to compromise the integrity or confidentiality of the system by inserting an illegitimate node.

[0101] At the end of these key transmission steps between a publisher and an SKS implementing these principles, the publisher has received an encrypted session key, as well as the temporary key (SKI) which allows this secret key to be decrypted. At no time has the session key been transmitted in clear text, and a legitimate private key (signed by a certification authority known to the SKS) is necessary to calculate a temporary key. An attacker has no simple way of obtaining a legitimate private key, since these are protected by SEs.

[0102] When an initial key request is made, a client tries all key servers (in descending priority order in the list, from rank 1 to rank N) until one responds. It then establishes a secure connection and receives the session keys. Unlike what happens in the current version of the OPC UA PUBSUB protocol, the key server associates its network identifiers with the new client (in a format dependent on the protocol used, e.g. IP address and listening port in IP). This association can be implemented in a table indexed by the client identifier.

[0103] In case of an expired key, the key renewal in one embodiment of the invention is imposed by the master key server and not by the clients individually. Upon expiration of the key, the master key server and not the slave servers, uses its Client List to broadcast a SetSecurityKey message affecting the new keys in all known clients. A lag between key assignments to clients is always possible due to routing issues, but this will be much less than that linked to a faulty time source. Risk 2 is therefore mitigated. In this renewal operation, the SKS also provides its own identifier to the clients.

[0104] It will be noted that the session keys distributed by the key servers according to the invention may include keys other than those for encryption or decryption (different in the case of asymmetric encryption), for example signature keys used, or expiry date of these keys.

[0105] This solution addresses or mitigates the risks mentioned in OPC UA PUBSUB key distribution and more generally in group communication paradigms; it proposes mechanisms to ensure the secure resilience of the distribution and use of session keys by lax synchronization in producer-consumer type communication paradigms while providing the following benefits: - availability of communications: the failure of a server hosting the secure key service (SKS) has only a minimal and time-limited impact on the ability to communicate securely (encrypted and signed). - integrity of the secret key: a potentially compromised secret key is subject to minimal use by the producers and consumers of the group associated with this key. - communications security: communications are better protected against confidentiality or integrity attacks thanks to the additional guarantee concerning the integrity of the secret key. - low performance impact: the performance impact is minimal in terms of network throughput (between key servers, or between key servers and clients), computation time (in key servers or in clients), latency (for reception of a valid key by a client) and memory footprint (on key servers).

[0106] It is studied below how the invention makes it possible to address the three risks indicated in relation to the prior art.

[0107] Resolution of Risk 1: Customer Compromise

[0108] In the event of a client being compromised, the compromised keys are only the last keys distributed by the key server. The solution, in the embodiment where only unique keys (set size = 1) and not lists of keys are sent, makes it possible to reduce the duration of compromise of the exchanges.

[0109] As far as the compromise of key distribution is concerned, the fact that a key reception involves a secure exchange by an SE strictly prevents the re replication (or cloning) of the client certificate. In addition, since access to the physical element is protected, it makes it more difficult to obtain a new valid key from the key service.

[0110] Resolution of Risk 2: Availability for renewal

[0111] Due to the redundancy of the key servers, the resilience of the key server makes it possible to ensure the availability of the key distribution service even in the event of failure (accidental or malicious) of a key server.

[0112] The invention makes it possible to deploy the key servers on heterogeneous architectures (different software libraries, operating systems and / or hardware architectures). In this way, protection is provided against vulnerabilities not yet discovered (0-day) which would be present in these elements, at least if they are used to obtain a denial of service (DoS).

[0113] Resolution of Risk 3: Compromise of a key server

[0114] The proposed lax synchronization mechanism ensures that, in the event of a detectable compromise of a server (i.e. involving an interruption of service), the keys present on the compromised server are very quickly invalidated, and a new generation seed is randomly generated by another key server, before being used to generate a new key (and the following keys generated by this server) which will then be broadcast to the clients. The exposure of the data is limited in time and calculable. The existence of random generation means with satisfactory entropy is assumed on each SKS.

[0115] By way of illustration, the implementation of the invention is now presented in the case of a big data type application for predictive maintenance in the railway sector. This application uses data collected from sensors to obtain a flexible real-time status of the state of railway track equipment (rails, catenaries, etc.). The railway operator wishes to secure communications on the public network, including between the secure gateway and the APN (Access Public Network) provided by a telecom operator.

[0116] A secure producer-consumer communication protocol implementing the invention, as shown schematically in [Fig.4], is implemented in this system, to provide security while maintaining the availability of information. In the embodiment considered, an extension of the OPC UA PUBSUB protocol is created to implement the invention.

[0117] The embodiment of the invention described above in the particular case in the case of a system implementing the OPC UA PUBSUB standard comprises the use of the following protocol exchanges:

[0118] GetSecurityKey: Not modified from the OPC-UA PUBSUB standard.

[0119] SetSecurityKey: Modified from OPC-UA PUBSUB standard. Added the master SKS server ID to the information sent to the client.

[0120] HeartBeat: new. Informs a client of the availability of the master SKS. Parameters: renewal, period.

[0121] Master Claim: new. Informs an SKS of another SKS's candidacy for master election. Parameters: identifier, priority.

[0122] Master Request: new. Informs an SKS of a request for a new master server by a client. Parameters: identifier.

[0123] Another alternative would be to implement it through a new secure communication protocol layer that would be located above the OPC UA PUBSUB protocol. This alternative is a solution that limits the development effort, and allows both to take advantage of the OPC UA protocol and to be independent of OPC UA so that our invention can be used above any other producer-consumer communication protocol.

[0124] In the case considered, three key servers as described above are instantiated, with key renewal carried out daily at 4 a.m. 500 instances of connected sensors (producers) were deployed, recording the physical tension of the catenaries. Two consumers were deployed: one for the visualization and analysis center, and one for the command center. Other producers and consumers may be added during the life cycle of the system (for example for supervision by civil authorities), in accordance with the dynamic nature of the architectures covered by the invention.

[0125] The settings are for example as follows: Heartbeat: 1 minute; Renewal: 3 missing Heartbeat messages -, Timeout: 30 seconds.

[0126] Furthermore, the latency of a client-SKS communication is estimated (after operational measurements) to be around 1 second, and the availability of a server is estimated at 99%.

[0127] The SKS does not send a set of keys, but only individual keys. Risk 1 is thus mitigated. The cost of this measure is that of a secure connection (in terms of network throughput), with a periodicity equal to the lifetime of the key (expiration date minus creation date). This measure is only feasible if the bandwidth during the cryptographic lifetime of the symmetric key is greater than the cost of this connection. This is valid in the vast majority of cases, and in particular in the proposed case study.

[0128] Thus, by implementing the invention, the only case of lasting unavailability of the SKS is the collective failure of all the key servers (i.e. a service availability rate of 99.9999%). For a client, the worst waiting time to receive a key following a request will be equal to 32 seconds (SKS election timeout plus twice the latency of an SKS-client communication). The maximum time using a potentially invalid key (i.e. key from a faulty key server) will be 3 minutes.

[0129] In summary, the invention comprises the following elements (or at least some of the elements depending on the embodiments): - resilience of the key distribution service by using mechanisms allowing the implementation of configurable cyclic redundancy of the key server; - loose synchronization between key servers (by "loose" - corresponding to the meaning of the English term "loose" - we mean the fact that certain information is not synchronized between key servers as described above); - detection of failure in key servers by clients; - election of a master key server; - secure transmission of keys, reinforced by the use of an SE; - implementation for example by creating a secure extension of the OPC UA PUBSUB protocol or other producer-consumer communication protocol.

[0130] This invention is particularly useful in critical industrial fields based on a set of distributed or geodistributed computers or computing elements supporting the client-server environment and having a communication system by exchange of producer-consumer type messages with the presence of a mediating agent between transmitters and receivers ("broker") requiring a high level of Cyber-security. It makes it possible to increase the confidentiality, integrity and availability of communications between the different components of the industrial system: sensors, computers and actuators, from end to end (from the transmitting application to the receiving application) while having a low impact on performance.

[0131] The industrial fields likely to deploy our invention to secure their communication systems include in particular any field relating to Industry 4.0, and any field of the following types: IIoT (Industrial Internet of Things), smart city, space, aeronautics, automotive, naval, railway (infrastructure, train, tramway), military (connected battlefield).

Claims

1. Claims Method for distributing session keys in a telecommunications network (1) comprising a set of N session key distribution servers (1_1, 1_2), N being strictly greater than 1, clients (2_1, 2_2) comprising “publisher” type clients and “subscriber” type clients, and an intermediate “broker” type communication module (3), said servers, clients and broker being interconnected by telecommunications links; according to which a publisher client delivers encrypted information to the broker module based on at least one secret encryption key stored in the publisher client, at least one subscriber client associated with the publisher client then obtains via the broker intermediate communication module said consultable information and decrypts, and / or verifies, said information based on a decryption key associated with said encryption key; and each server is adapted to generate and distribute session keys to the clients, comprising the encryption, decryption and / or signature keys; said method being characterized in that: any one of the servers (1_1, 1_2), at any given time, has the role of master server of the servers, and only the master server is authorized to distribute session keys to the clients (2_1, 2_2); each server (1_1, 1_2) and each client (2_1, 2_2) stores a same ordered list for the election of a new master server, from rank 1 associated with the highest priority to rank N associated with the lowest priority, of the servers in the set of servers, said ordered list of servers further indicating which is the current master server, and each server stores a list of clients to which valid session keys have been distributed by the current master server and previous master servers; each server (1_1, 1_2), when it has the role of master server, sends to the clients (2_1, 2_2), according to at least a predefined minimum periodicity, a periodic message of a first predefined type (heartbeat); each client (2_1, 2_2) monitors that it receives, according to said predefined periodicity, messages of the first type from the current master server indicated in the ordered list of servers; and when it detects that a message of the first type from the master server

2.

3. current master server indicated in the ordered list of servers has not been received in accordance with said minimum periodicity, the client (2_1, 2_2) sends a search request for a new master server to the server of rank n+1 which follows the current master server of rank n in the ordered list of servers; each server (1_1, 1_2) of the set of servers, as soon as it receives a search request for a new master server, triggers an operation to elect a new master server from the servers of the set of servers; the master server elected by said election operation triggers, upon its election, among the clients (2_1, 2_2) in its client list, a replacement of the valid session keys indicated in the client list and which have been assigned to them. A method of distributing session keys in a telecommunications network (1) according to claim 1, wherein upon expiry of a predefined time period after a client (2_1, 2_2) has sent a search request for a new server without the client having received a message from a server elected master server, said client (2_1, 2_2) sends a search request for a new master server to the server of rank n+2 in the ordered list of servers. Method for distributing session keys in a telecommunications network (1) according to one of the preceding claims, according to which the election operation triggered by said server (1_1, 1_2) upon receipt of a search request for a new master server comprises the steps consisting of: - send to all other servers in the ordered list of servers a message of a second predefined type, indicating that a master server is to be elected, and identifying the server sending said message; - after a set time delay: - if said server (1_1, 1_2) has received during said time delay one or more messages of the second type from server(s) and, according to the ordered list, its priority is lower than the priority of the servers having sent said messages of the second type, it is not the master server elected by said election operation; - if said server (1_1, 1_2) has not received during said time delay any message of the second type from server(s) or if it has received some and, according to the ordered list, its priority is higher than the priority of the servers having sent said messages of the second type, it is the master server elected by said election operation.

4. Method for distributing session keys in a telecommunications network (1) according to one of the preceding claims, according to which the new keys intended to replace the session keys are generated by the master server at the time of its election from a new generation seed which it generates randomly.

5. Method for distributing session keys in a telecommunications network (1) according to one of the preceding claims, according to which the ordered list is an ordered loop, where after the server of rank N, we return to the server of rank 1.

6. Method for distributing session keys in a telecommunications network (1) according to one of the preceding claims, according to which upon a request for a session key by a client (2_1, 2_2), said client sends a key request to the server (1_1, 1_2) of rank i in the list, starting with i = 1, and in the absence of a response claiming master server status from said server, increments the value of i, i = i+1, and iterates said sending of the request.

7. Method for distributing session keys in a telecommunications network (1) according to one of the preceding claims, according to which a synchronization mechanism between the servers (1_1, 1_2) comprises the synchronization of the list of servers indicating the current master server, no synchronization of the keys distributed by the servers and / or of the entropy source of the servers having to take place.

8. Processing method, implemented in a client (2_1, 2_2), for obtaining session keys, in a telecommunications network (1) comprising a set of N servers (1_1, 1_2) for distributing session keys, N being strictly greater than 1, clients (2_1, 2_2) comprising clients of the “publisher” type and clients of the “subscriber” type, and an intermediate communication module (3) of the “broker” type, said servers, clients and broker being interconnected by telecommunications links;according to which a publisher client delivers to the broker module encrypted information based on at least one secret encryption key stored in the publisher client, at least one subscriber client associated with the publisher client then obtains, via the broker intermediate communication module (3), said consultable information and decrypts, and / or verifies, said information based on a decryption key associated with said encryption key; and;

9. each server (1_1, 1_2) is adapted to generate and distribute session keys to clients, including encryption, decryption and / or signature keys; said method being characterized in that, the client (2_1, 2_2) having stored an ordered list for the election of a new master, from rank 1 associated with the maximum priority to rank N associated with the minimum priority, of the servers of the set of servers (1_1, 1_2), said ordered list of servers further indicating which is the current master server, only one of the servers, at any given time, having the role of master server of the servers, and only the master server being authorized to distribute session keys to the clients: the client (2_1, 2_2) monitors that it receives, according to a predefined minimum periodicity, periodic messages of a first predefined type (heartbeat) from the current master server indicated in the ordered list of servers; and when it detects that a message of the first type from the current master server indicated in the ordered list of servers has not been received in accordance with said minimum periodicity, the client sends a search request for a new master server to the server of rank n+1 which follows the current master server of rank n in the ordered list of servers; the client (2_1, 2_2) receives, from a new master server, new session keys to replace the previous session keys. Client (2_1, 2_2) in a telecommunications network (1) comprising a set of N servers (1_1, 1_2) for distributing session keys, N being strictly greater than 1, clients (2_1, 2_2) comprising “publisher” type clients and “subscriber” type clients, each subscriber client being associated with a publisher client, and an intermediate “broker” type communication module, said servers, clients and broker being adapted to be interconnected by telecommunications links; a publisher client being adapted to deliver to the broker module encrypted information based on at least one secret encryption key stored in the publisher client, a subscriber client associated with the publisher client being adapted to then obtain, via the broker intermediate communication module, said consultable information and decrypt, and / or verify, said information based on a key decryption associated with said encryption key; and each server (1_1, 1_2) is adapted to generate and distribute session keys to clients, comprising the encryption, decryption and / or signature keys; said client (2_1, 2_2) being an electronic device characterized in that, the client having stored an ordered list for the election of a new master, from rank 1 associated with the maximum priority to rank N associated with the minimum priority, of the servers of the set of servers, said ordered list of servers further indicating which is the current master server, only one of the servers, at any given time, having the role of master server of the servers, and only the master server being authorized to distribute session keys to the clients: the client (2_1, 2_2) is adapted to monitor that it receives, according to a predefined minimum periodicity, periodic messages of a first predefined type (heartbeat) from the current master server indicated in the ordered list of servers; and the client (2_1, 2_2) is adapted to, when it detects that a message of the first type from the current master server indicated in the ordered list of servers has not been received in accordance with said minimum periodicity, send a search request for a new master server to the server of rank n+1 which follows the current master server of rank n in the ordered list of servers and to receive, from a new master server, new session keys for replacement of valid session keys previously assigned to the client.

10. Session key distribution server (1_1, 1_2) in a telecommunications network (1) comprising a set of N session key distribution servers, N being strictly greater than 1, clients (2_1, 2_2) comprising “publisher” type clients and “subscriber” type clients, and an intermediate “broker” type communication module (3), said servers, clients and broker being interconnected by telecommunications links; according to which a publisher client delivers to the broker module encrypted information based on at least one secret encryption key stored in the publisher client, at least one subscriber client associated with the publisher client then obtains via the broker intermediate communication module said consultable information and decrypts, and / or verifies, said information based on a decryption key associated with said encryption key; and each server is adapted to generate and distribute session keys to clients, including encryption, decryption and / or signature keys; said server (1_1, 1_2) being characterized in that: the server (1_1, 1_2) is adapted to comply with the following rule: only one of the servers, at any given time, has the role of master server of the servers, and only the master server is authorized to distribute session keys to the clients; the server storing an ordered list for the election of a new master, from rank 1 associated with the maximum priority to rank N associated with the minimum priority, of the servers in the set of servers, said ordered list of servers further indicating which is the current master server, and the server storing a list of the clients to which valid session keys have been distributed by the current master server and the previous master servers; the server (1_1, 1_2) is adapted to, when it has the role of master server, send to the clients (2_1, 2_2), according to at least a predefined minimum periodicity, a periodic message of a first predefined type (heartbeat); the server (1_1, 1_2) is adapted to, when it receives a search request for a new master server from a client (2_1, 2_2), trigger an operation of electing a new master server from the servers of the set of servers; the server (1_1, 1_2) is adapted, if it is elected the master server by said election operation to trigger, upon its election, among the clients (2_1, 2_2) of its client list, a replacement of the valid session keys indicated in the client list and which have been assigned to them.

Images