Methods for protecting equipment and transmitting data, electronic devices and assemblies, computer programs and related information media

Abstract

Methods for protecting equipment and transmitting data, electronic devices, computer program products and corresponding information media. The invention relates to a method for protecting equipment in a communication network partitioned into a first portion, and a second portion interconnected with the first portion via a first device in the first portion and a second device in the second portion, the method comprising: a transmission to the second device of an address of equipment in the first portion of the network; a transcoding of data received from the second device into a structured data packet containing an addressing identifier of the equipment receiving the packet on the first portion; a transmission of the packet to the receiving equipment;It also relates in particular to a transmission method, implemented by a second electronic device of a second part of the communication network, as well as the corresponding electronic devices and assemblies, computer program products and information media. Figure for the abbreviation: Fig. 1;

Description

Title of the invention: Methods for protecting equipment and transmitting data, electronic devices and assemblies, computer program products and corresponding information media Technical field

[0001] The present application relates to the field of securing at least a portion of a communication network.

[0002] It relates in particular to a method for protecting at least one item of equipment, implemented by a first electronic device of a first portion of a communication network, and a method for transmitting data(s), implemented by a second electronic device of a second portion of a communication network, as well as the corresponding electronic devices and assemblies, computer program products and information media. 1. State of the art

[0003] The present invention relates to the protection of at least one piece of equipment accessible via a communications network. This may, for example, be equipment handling sensitive data, or carrying out sensitive processing, and may therefore be the target of attack by malicious third parties, either to unduly access sensitive data, or to disrupt, or even prevent, certain processing via the propagation of a computer virus to the equipment.

[0004] This equipment is for example part of a private company network or a home network, interconnected to a public network such as the Internet.

[0005] Examples of sensitive data include personal data (medical data, banking data, etc.), industrial data (such as plans of manufactured objects, data relating to the production of certain industrial machines such as measurement results, number of parts produced, etc.), order histories received by industrial equipment, alerts, etc.

[0006] Malicious third parties may, for example, be tempted to disable the equipment, to harm a company or obtain a ransom. Private network security solutions have been developed to protect one or more devices belonging to the same private network from such attacks. Examples include solutions based on firewalls and / or intrusion detection systems. Examples include the use of virtual private networks (VPNs) that isolate by encryption, within a network. extended, the exchanges between the equipment of the extended network belonging to the virtual private network, Such solutions make it possible to limit communications with equipment outside the private network to communications sent from the private network to this “external” equipment, and thus prevent access from outside the network to equipment to be protected.

[0007] However, these solutions, sometimes called "network diodes", are sometimes inappropriate and very restrictive for protecting certain electronic equipment such as industrial machines. Indeed, such solutions only allow information to be sent back at the initiative of the protected equipment. Software running on an electronic device outside the private network cannot therefore query a protected equipment to obtain data in return. Such solutions greatly limit, or even prevent, the use of certain communication protocols based on such requests and in particular certain protocols that are very widespread in the industrial field (such as, in the industrial field, the OPC-UA or ModBus protocols used by many machine tools on the market). They are therefore not suitable for protecting certain equipment on the market.

[0008] The object of the present application is to propose improvements to at least some of the drawbacks of the state of the art. 2. Statement of the invention

[0009] The present application aims to improve the situation using a method for protecting at least one piece of equipment of a communication network partitioned into a plurality of portions comprising at least a first portion, comprising said equipment, and at least a second portion interconnected with said first portion via a first device of said first portion and a second device of said second portion, said method comprising: • a transmission to said second device of an addressing identifier of at least one piece of equipment of said first portion of said communication network; • a transcoding of data received from said second device into at least one structured data packet comprising at least one addressing identifier of a device receiving said packet on said first portion; • a transmission of said packet to said recipient equipment;

[0010] at least one of said transcoding and / or transmission being carried out conditionally taking into account at least one filtering rule relating to the content of said packet.

[0011] In certain embodiments, said filtering rule takes into account at least one element contained in said packet among the following elements: • a designation of a device transmitting said packet;

[0012]

[0013]

[0014]

[0015]

[0016]

[0017]

[0018] • addressing information relating to at least one piece of data from said equipment • a type of access to be carried out on said data; • a designation of a communication protocol used by said package; • a combination of at least two of the above elements. In some embodiments, said filtering is performed before said transcoding. In some embodiments, said filtering is performed after said transcoding. In some embodiments, said first and second devices communicate with each other via at least two communication paths, a first unidirectional communication path allowing the first device to receive data from said second device, and a second, unidirectional communication path allowing the first device to send to said second device a response to said packet transmitted to said recipient equipment. In some embodiments, said transcoding comprises deserialization of said data. The present application also relates to a method for transmitting at least one piece of data intended for at least one piece of equipment in a communication network partitioned into a plurality of portions comprising at least a first portion, and at least a second portion interconnected with said first portion via a first device of said first portion and a second device of said second portion; said method comprising: • an assignment to said second device, as an addressing identifier on said second portion of said network, of at least one addressing identifier of a piece of equipment in said first portion • upon receipt of a structured data packet having as destination address said addressing identifier, a serialization of the data of said packet; and • a transmission of said serialized data to said first device. at least one of said serialization and / or said transmission being carried out conditionally taking into account at least one filtering rule relating to the content of said packet. In some embodiments, said filtering rule takes into account at least one element contained in said packet among the following elements: • a designation of a device transmitting said packet; • addressing information relating to at least one piece of data said equipment; • a type of access to be carried out on said data; • a designation of a communication protocol used by said packet; • a combination of at least two of the above elements.

[0019] In certain embodiments, the transmission method comprises obtaining a description relating to said equipment of said first portion of said communication network comprising said at least one addressing identifier of said at least one equipment on said first portion of said communication network.

[0020] In some embodiments, said filtering is performed on the serialized data.

[0021] In some embodiments, said filtering is performed before said serialization.

[0022] In some embodiments, said first and second devices communicate with each other via at least two unidirectional communication paths, a first unidirectional communication path allowing the second device to transmit data to said first device, and a second, unidirectional communication path allowing the second device to receive from the first device a response to said data transmitted to said first device.

[0023] The characteristics presented in isolation in the present application in connection with certain embodiments of one of the methods of the present application can be combined with each other according to other embodiments of this method.

[0024] According to another aspect, the present application also relates to an electronic device adapted to implement at least one of the methods of the present application in any one of its embodiments.

[0025] The present application thus relates to a first electronic device of a communication network partitioned into a plurality of portions comprising at least a first portion, comprising at least one piece of equipment to be protected and said first device, and at least a second portion interconnected with said first portion via the first device and a second device of said second portion, said first device comprising at least one processor configured to: • a transmission to said second device of an addressing identifier of at least one piece of equipment of said first portion of said communication network; • a transcoding of data received from said second device into at least one structured data packet comprising at least one addressing identifier of a device receiving said packet on said first portion; • a transmission of said packet to said recipient equipment;

[0026] at least one of said transcoding and / or transmission being carried out conditionally taking into account at least one filtering rule.

[0027] The present application also relates to a second electronic device of a communication network partitioned into a plurality of portions comprising at least one first portion, comprising at least one equipment, and at least one second portion comprising said second device, and interconnected with said first portion via a first device of said first portion and the second device; said second device comprising at least one processor configured to: • an assignment to said second device, as an addressing identifier on said second portion of said network, of at least one addressing identifier of a piece of equipment in said first portion • upon receipt of a structured data packet having as destination address said addressing identifier, a serialization of the data of said packet and; • a transmission of said serialized data to said first device.

[0028] at least one of said serialization and / or said transmission being carried out conditionally taking into account at least one filtering rule relating to the content of said packet.

[0029] According to another aspect, the present application also relates to an electronic assembly for protecting at least one piece of equipment of a communication network partitioned into a plurality of portions comprising at least a first portion, comprising said equipment, and at least a second portion interconnected with said first portion via at least a first device of said electronic assembly, said first device belonging to said first portion, and at least a second device of said electronic assembly, said second device belonging to said second portion, - said at least one first electronic device comprising at least one processor configured to: • a transmission to said second device of an addressing identifier of at least one piece of equipment of said first portion of said communication network; • a transcoding of data received from said second device into at least one first structured data packet comprising at least one addressing identifier of a recipient device of said first packet on said first portion; • a transmission of said first packet to said recipient equipment;

[0030] at least one of said transcoding and / or transmission being carried out conditionally taking into account at least one first filtering rule relating to the content of said first packet. - said at least one second electronic device comprising at least one processor configured to: • an assignment to said second device, as an addressing identifier on said second portion of said network, of at least one addressing identifier of a device of said first portion • upon receipt of a second structured data packet having as destination address said addressing identifier, a serialization of the data of said second packet and; • a transmission of said serialized data to said first device.

[0031] at least one of said serialization and / or said transmission being carried out conditionally taking into account at least one second filtering rule relating to the content of said second packet.

[0032] According to another aspect, the present application also relates to a system comprising at least one piece of equipment to be protected and at least one electronic assembly for protecting said at least one piece of equipment, in a communication network partitioned into a plurality of portions comprising at least a first portion comprising said equipment, and at least a second portion interconnected with said first portion via at least a first device of said electronic assembly, said first device belonging to said first portion and at least a second device of said electronic assembly, said second device belonging to said second portion,: - said at least one first electronic device comprising at least one processor configured to: • a transmission to said second device of an addressing identifier of at least one piece of equipment of said first portion of said communication network; • a transcoding of data received from said second device into at least one first structured data packet comprising at least one addressing identifier of a recipient device of said first packet on said first portion; • a transmission of said first packet to said recipient equipment;

[0033] at least one of said transcoding and / or transmission being carried out conditionally taking into account at least one first filtering rule relating to the content of said first packet - said at least one second electronic device comprising at least one processor configured to: • an assignment to said second device, as an addressing identifier on said second portion of said network, of at least one addressing identifier of a piece of equipment in said first portion • upon receipt of a structured data packet having as destination address said addressing identifier, a serialization of the data of said second package and; • a transmission of said serialized data to said first device.

[0034] at least one of said serialization and / or said transmission being carried out conditionally taking into account at least one second filtering rule relating to the content of said second packet.

[0035] The present application also relates to a computer program comprising instructions for implementing the various embodiments of at least one of the above methods, when said program is executed by a processor, and an information medium readable by an electronic device and on which the computer program is recorded.

[0036] The present application thus relates to a computer program comprising instructions for implementing, when the program is executed by a processor of a first electronic device, a method for protecting at least one piece of equipment of a communication network partitioned into a plurality of portions comprising at least a first portion, comprising said equipment and said first device, and at least a second portion interconnected with said first portion via the first device and a second device of said second portion, said method comprising: • a transmission to said second device of an addressing identifier of at least one piece of equipment of said first portion of said communication network; • a transcoding of data received from said second device into at least one structured data packet comprising at least one addressing identifier of a device receiving said packet on said first portion; • a transmission of said packet to said recipient equipment;

[0037] at least one of said transcoding and / or transmission being carried out conditionally taking into account at least one filtering rule relating to the content of said packet.

[0038] Furthermore, the present application relates to a computer program comprising instructions for implementing, when the program is executed by a processor of a second electronic device, a method for transmitting at least one piece of data from at least one piece of equipment of a communication network partitioned into a plurality of portions comprising at least a first portion, and at least a second portion, comprising said second device and interconnected with said first portion via a first device of said first portion and the second device; said method comprising: • an assignment to said second device, as an addressing identifier on said second portion of said network, of at least one addressing identifier of equipment of said first portion • upon receipt of a structured data packet having as destination address said addressing identifier, a serialization of the data of said packet and; • a transmission of said serialized data to said first device.

[0039] at least one of said serialization and / or said transmission being carried out conditionally taking into account at least one filtering rule relating to the content of said packet.

[0040] The present application also relates to an information medium readable by a processor of a first electronic device and on which is recorded a computer program comprising instructions for implementing, when the program is executed by the processor, a method for protecting at least one piece of equipment of a communication network partitioned into a plurality of portions comprising at least a first portion, comprising said equipment and said first device, and at least a second portion interconnected with said first portion via the first device of said first portion and a second device of said second portion, said method comprising: • a transmission to said second device of an addressing identifier of at least one piece of equipment of said first portion of said communication network; • a transcoding of data received from said second device into at least one structured data packet comprising at least one addressing identifier of a device receiving said packet on said first portion; • a transmission of said packet to said recipient equipment;

[0041] at least one of said transcoding and / or transmission being carried out conditionally taking into account at least one filtering rule relating to the content of said packet.

[0042] The present application further relates to an information medium readable by a processor of a second electronic device and on which is recorded a computer program comprising instructions for implementing, when the program is executed by the processor, a method for transmitting at least one piece of data originating from at least one piece of equipment of a communication network partitioned into a plurality of portions comprising at least a first portion, and at least a second portion comprising said second device and interconnected with said first portion via a first device of said first portion and the second device of said second portion, said method comprising: • an assignment to said second device, as an addressing identifier on said second portion of said network, of at least one addressing identifier of equipment of said first portion; • Upon receipt of a structured data packet having as destination address said addressing identifier, a serialization of the data of said packet and; • A transmission of said serialized data to said first device.

[0043] at least one of said serialization and / or said transmission being carried out conditionally taking into account at least one filtering rule relating to the content of said packet.

[0044] The above-mentioned programs may use any programming language, and be in the form of source code, object code, or intermediate code between source code and object code, such as in a partially compiled form, or in any other desirable form.

[0045] The information (or recording) media mentioned in the present application may be any entity or device capable of storing the program. For example, an information medium may comprise a storage means, such as a ROM, for example a CD ROM or a microelectronic circuit ROM, or a magnetic recording means.

[0046] Such a storage means may for example be a hard disk, flash memory, etc.

[0047] On the other hand, an information carrier may be a transmissible information carrier such as an electrical or optical signal, which may be conveyed via an electrical or optical cable, by radio or by other means. A program according to the invention may in particular be downloaded from a network such as the Internet.

[0048] Alternatively, an information carrier may be an integrated circuit in which a program is incorporated, the circuit being adapted to execute or to be used in the execution of any of the embodiments of at least one of the methods which are the subject of the present patent application.

[0049] Generally speaking, by obtaining an element, is meant in the present application for example a reception of this element from a communication network, an acquisition of this element (via for example user interface elements, sensors, etc.), a creation of this element by various processing means such as by copying, encoding, decoding, transformation etc. and / or an access of this element from a local or remote storage medium accessible to at least one device (such as the first and / or the second device of the set) implementing, at least partially, this obtaining. 3. Brief description of the drawings

[0050] Other characteristics and advantages of the invention will appear more clearly on reading the following description of particular embodiments, given as simple illustrative and non-limiting examples, and appended drawings, among which:

[0051] [Fig.l] presents a simplified view of a system, cited as an example, in which at least certain embodiments of the methods of the present application can be implemented,

[0052] [Fig.2] shows a simplified view of a device suitable for implementation in at least some embodiments of at least one of the methods of the present application,

[0053] [Fig. 3] presents an overview of the protection method of the present application, in certain of its embodiments.

[0054] [Fig.4] shows an overview of the data transmission method of the present request, in some of its embodiments

[0055] [Fig. 5] a simplified view of an exemplary system 500 in which at least some embodiments of the method of the present application may be implemented. 4. Description of the embodiments

[0056] The present application aims to provide a simple and effective solution making it possible to both protect one or more pieces of equipment of a communication network against computer attacks, in particular external to this communication network, while allowing electronic devices, located for example in an unprotected portion of the communication network or outside the communication network, to access (in reading and writing) and in a secure manner, at least certain data of these pieces of equipment to be protected. To this end, the application proposes to equip the communication network with at least two devices, these devices partitioning the communication network into at least two portions.

[0057] By partition, we mean here a division of the communication network into a plurality of portions each comprising at least one electronic device, separated two by two (except for certain interconnection elements between the at least two devices as specified below) and the joining of which reconstitutes the communication network.

[0058] At least a first of these portions is a portion (called "protected") inaccessible directly from an electronic device located outside this first portion, this first portion comprising at least one piece of equipment to be protected. At least a second portion called "exposed" (i.e. external to this first protected portion) is accessible, directly and / or via interconnection equipment, to devices outside the first portion (such as devices located in a "first" protected portion other than the first "protected" portion where the equipment is located, and / or devices of the second portion, and / or devices outside the communication network).

[0059] The equipment(s) to be protected may for example be industrial machines- trielles.

[0060] According to the present application, requests for access to equipment from a device external to the first portion are filtered by the first and / or the second device, in application of filtering rules, so as to retain only access requests deemed safe. For example, only requests relating to non-critical equipment of the first portion may be retained. According to another example, only requests to read memory zone(s) of equipment of the first portion may be retained. According to yet another example, only write requests relating to “non-critical” memory zones of equipment of the first portion issued by certain devices (such as a device of a network administrator) may be retained.

[0061] Different filtering rules may be applied by the first and / or the second device.

[0062] For example, in network topologies where the first device is likely to receive requests from multiple second devices each interconnecting the first (protected) portion with different exposed second portions, the filtering rule(s) applied by the first device may take into account the second device from which the requests were received. In particular, in some embodiments, the first device may receive requests from a "second device" implementing no filtering.

[0063] These may also be identical or similar rules. Applying the same rule at the second device and then at the first device may allow, at the second device, certain packets to be deleted earlier in the processing chain (in accordance with the filtering rules), thus avoiding unnecessary processing. At the first device, it may allow protection against possible corruption of the second device (located in an “exposed” portion of the network) and in particular of its filtering rules.

[0064] In some embodiments, the first device and the second device communicate only via one-way communication means. Thus, third-party device requests received by the second device may be forwarded by the second device (from the exposed portion) to the first device via a first one-way communication path.

[0065] Allowing only one-way communications can help to better control exchanges between a third-party device and equipment (via the electronic assembly) and therefore to better prevent attacks from third-party devices.

[0066] It is noted that messages, corresponding for example to “UDP” messages from the equipment or to possible responses to requests, can be transmitted via a second unidirectional communication path from the protected portion to the exposed portion. Examples of responses include, in the case of a read request, data values ​​from the equipment receiving the request and / or in the case of a write request, a confirmation of receipt of the request or a confirmation of writing. In some embodiments, as illustrated 1, the messages (such as “UDP” messages or responses) are transmitted from the first device to the second device (via the second communication path). Alternatively, they may be transmitted transparently to the first and second devices (via a second communication path not passing through the first and second devices).

[0067] In certain embodiments, where the messages pass via the first and second devices, message filtering may optionally be implemented by the first device and / or the second device (so as to ensure, for example, that no sensitive data can be communicated to an external device of the first portion). This filtering may be based on rules identical or similar to those used during the first communication path (for example, they may relate to the same registers) or on different rules.

[0068] Thus, according to the present application, it is possible to receive requests from a third-party device wishing to obtain data from the equipment to be protected, and to provide it with this data in return, in complete security for the equipment to be protected.

[0069] The present application can in particular help both in the protection of a portion of the network, while allowing the control of at least certain equipment of this first portion from outside the network.

[0070] The logical assembly comprising the at least one first and second devices and the means of communication (unidirectional for example) between these at least two devices is also called in the present patent application "electronic assembly", "electronic protection assembly" or "Smart Diode" (or Smart Diode according to the English terminology). Depending on the embodiments, it may be a virtual assembly, virtually encapsulating the first and second devices and first unidirectional communication means in a first direction of communication (from the second device to the first device), and optionally second unidirectional communication means in a second direction of communication, opposite to the first direction) or a physical assembly (such as a hardware element), having for example a housing in which the at least one first and second devices and their mutual communication means are installed.This assembly may comprise, depending on the embodiments and the topology of the network (for example the number of portions to be protected), a variable number of “first” devices and “second” devices.

[0071] Such an electronic assembly offers the advantage of being easy to install in a communication network, for example as an “intermediary” between a (particular) piece of equipment to be protected and the rest of the communication network, or so as to limit access to this equipment to be protected to only accesses made by the first device or simply to limit access to the equipment to be protected to devices located in a (protected) portion of the communication network, to which this equipment belongs. Such an assembly can also help to offer a “turnkey” product to a communication network administrator.

[0072] Such an electronic assembly can thus help, at least in certain embodiments, to secure equipment to be protected, without requiring modification and / or replacement of this equipment.

[0073] For the sake of clarity, the term “electronic equipment”, or “equipment”, to refer to equipment that may be protected by the electronic assembly. The term “electronic device”, or “device”, will be used to refer to the first or second electronic device of the electronic assembly 160 introduced above. The term “electronic device” or “device” relates to any electronic device (it may sometimes be equipment to be protected or a device of the electronic assembly).

[0074] The present application will now be described in more detail in connection with [Fig. 1].

[0075] [Fig.l] represents a system 100 in which certain embodiments of the invention can be implemented. The system 100 comprises one or more electronic devices, at least some of which can communicate with each other via one or more communication networks 110, 120, 130 which may be partitioned and / or interconnected. In the example illustrated, the system thus comprises a private network partitioned into two portions 110, 120. One of the portions 120 is further interconnected with another network 130 (such as a wide area and / or public network), thus enabling communications between electronic devices 150, 164, 170 of this portion 120 and electronic devices 180 not belonging to the private network.

[0076] The private network may for example be a private business or home network, for example a local private network (or LAN for Local Area Network, according to English terminology). The other network 130 may for example be another local network, or a “wide” network with significant geographical coverage, such as a metropolitan area network (or MAN, for Metropolitan Area Network, according to English terminology) or a network whose geographical area covers at least one region of a country, or a country (or WAN, for Wide Area Network, according to English terminology). It may for example be a WAN network of the internet type, or cellular, GSM - Global System for Mobile Communications, UMTS - Universal Mobile Telecommunications System, Wifi - Wireless, etc.).

[0077] As illustrated in [Fig.l], the system 100 may also comprise a non-interconnected portion 110 of the private network, called protected, comprising one or more electronic devices 140. These may be devices such as a terminal (such as a laptop, a smartphone, a tablet or a connected object), a connected object (such as a robot, an automatically and / or remotely guided mobile device, an energy meter, a machine tool in the case of an industrial private network, and / or household appliance in the case of a home network), a server, for example an application server, and / or a storage device.

[0078] The equipment of the non-interconnected portion 100 may use different communication protocols depending on the embodiments, such as OPCUA (for OPen Connectivity - Unified Architecture), MQTT (for Message Queuing Telemetry Transport in English), ModBus TCP, Siemens S7, MTConnect, LabView. These protocols may differ depending on the equipment of the non-interconnected portion.

[0079] According to the present application, a device not belonging to a first protected portion (such as a device not belonging to the communication network, or belonging to the second “exposed” portion of the communication network) transmits a data packet (a request to read or write from / in a memory area for example) intended for equipment in the first portion.The second device intercepts this data packet, optionally decides whether or not to keep this data packet based on a filtering rule (hereinafter called the “second” filtering rule with reference to the “second” device) and, if applicable (if the packet complies with this second filtering rule), transcodes this packet into serialized data and transmits it to the first device, located in the protected portion, where this data is again filtered by the first device before being transcoded in the form of at least one new data packet (having, depending on the embodiments, a structure identical to or different from that of the packet sent by the third-party device). This or these new packets is / are then transmitted to a device receiving the first portion.The response from the third-party equipment can then be transmitted via the first and second devices to the third-party device that sent the data packet (e.g., using a data serialization / deserialization mechanism with and / or without filtering).

[0080] Thus, according to the present application, it is possible to receive requests from a third-party device wishing, for example, to access, in reading and / or writing, data from the equipment to be protected, and to provide it with this data in return, in complete security for the equipment to be protected.

[0081] The system comprises at least one electronic assembly 160 as introduced above. before aiming to protect at least certain electronic equipment 140 of the private network 110. The first device 162 of the electronic assembly 160 is located in a portion 110 called "to be protected" of the private network comprising the equipment 140 to be protected. The first device 162 communicates with the second device 164 (located in the interconnected portion 120) via unidirectional communication means 1622, 1624, 1642, 1644, comprising for example first unidirectional communication means 1622, 1642 in a first direction of communication, and second unidirectional communication means 1624, 1644 in a second direction of communication, opposite to the first direction. Such unidirectional communication means may vary according to the embodiments (and in particular according to the hardware capabilities of the first and / or second device).In certain embodiments, the unidirectional communication means may comprise at least one optocoupler, and / or bidirectional communication means having been limited to a single direction of transmission, such as an Ethernet cable, a serial link and / or an optical fiber and / or at least one digital isolator with galvanic, capacitive, inductive and / or optical isolation.

[0082] In some embodiments, the first and second communication means may be different. For example, the second device may transmit data to the first device via an Ethernet link limited to one direction of communication and the first device may transmit data to the second device via an optocoupler. In other embodiments, the first and second communication means may be similar. For example, each of the first and second unidirectional communication means may include an optocoupler 166.

[0083] The presence of optocoupler(s) makes it possible to physically separate the two devices (no electrical flow is exchanged, simply light), and therefore to reinforce the security of the exchanges. The electrical isolation of the devices from each other can help, for example, to prevent attacks by injection of current or electrical signal on the second portion of said network.

[0084] The system may also comprise network management and / or interconnection elements 164, 170. In particular (and even if not illustrated in [Fig.l]), in certain embodiments, the electronic assembly 160 may comprise at least one interconnection gateway with another network. In certain embodiments, this gateway may for example be connected to the second device of the electronic assembly (and therefore allow an interconnection between the “exposed” portion of the private network and the other network). In other embodiments, the second device may itself play a role as an interconnection gateway between the “exposed” portion of the private network and the other network.

[0085] The private network may for example use wired connections as at least one serial link and / or an Ethernet link, or wireless communication means. The network can implement a communication protocol such as ModBus Serial, or CAN (acronym for "Controller Area Network") in the case of a serial link, or such as ModBus TCP, OPC-UA, MQTT in the case of an Ethernet link.

[0086] [Fig. 2] illustrates a simplified structure of an electronic device 200 of the system 100, for example the first device 162, the first device 162, and / or the equipment to be protected 140 of [Fig. 1]. Depending on the embodiments, it may be a server, and / or a terminal, or even a microcomputer with a simple human-machine interface such as a RaspberryPi ©, an OrangePi © or even a NanoPI NEO.

[0087] The apparatus 200 comprises in particular at least one memory M 210. The apparatus 200 may in particular comprise a buffer memory, a volatile memory, for example of the RAM type (for “Random Access Memory” according to English terminology), and / or a non-volatile memory (for example of the ROM type (for “Read Only Memory” according to English terminology). The apparatus 200 may also comprise a processing unit UT 220, equipped for example with at least one processor P 222, and controlled by a computer program PG 212 stored in memory M 210. At initialization, the code instructions of the computer program PG are for example loaded into a RAM memory before being executed by the processor P.In the case where the apparatus is the first device 162 and / or the second device 164 of the electronic assembly, said at least one processor P 222 of the processing unit UT 220 can in particular implement, individually or collectively, any one of the embodiments of at least one of the methods of the present application (described in particular in relation to figures 3 and 4), according to the instructions of the computer program PG.

[0088] The device may also comprise, or be coupled to, at least one FO input / output module 230. The at least one I / O input / output module 230 of the device may comprise, in certain embodiments, at least one module for interfacing with a user of the device (also referred to more simply in this application as a “user interface”). By user interface of the device, we mean for example an interface integrated into the device 200, or a part of a third-party device with which it is coupled by wired or wireless communication means. For example, it may be a secondary screen of the device.

[0089] A user interface may in particular be a user interface, called an “output” interface, adapted to rendering (or controlling rendering) of an output element of a computer application used by the device 200, for example an application running at least partially on the device 200 or an “online” application running at least partially remotely, for example on a server. Examples of device output user interface include one or more screens, including at least one graphical screen (e.g., touchscreen), one or more speakers, a connected object.

[0090] By rendering, we mean here a restitution (or “output” according to English terminology) on at least one user interface, in any form, for example comprising textual, audio and / or video components, or a combination of such components.

[0091] Furthermore, a user interface may be a so-called “input” user interface, adapted to acquiring a command from a user of the device 200. This may in particular be an action to be performed in connection with a returned item, and / or a command to be transmitted to a computer application used by the device 200, for example an application running at least partially on the device 200 or an “online” application running at least partially remotely, for example on a server. Examples of input user interfaces include a sensor, an audio and / or video acquisition means (microphone, camera (webcam) for example), a keyboard, a mouse.

[0092] The device may also comprise, or be coupled to, at least one I / O input / output module 230, such as a communication module, allowing the device 200 to communicate with at least one other device of the system 100, via wired or wireless communication interfaces. For example, it may be at least one Ethernet type interface, and / or Wifi, Bluetooth type.

[0093] In the case where the apparatus is the first device 162 or the second device 164 of the electronic assembly, the communication means 1622, 1622, 1642, 1644 comprise for example first unidirectional communication means 1622, 1642 in a first direction of communication, and second unidirectional communication means 1624, 1644 in a second direction of communication, opposite to the first direction, such as at least one Ethernet type interface, or at least one serial interface with an optocoupler of the electronic assembly 160.

[0094] In the example of [Fig.l], the optocoupler can be connected directly to the serial interface. For example, the transmit port of the first device (protected portion) can be connected to one pin of the optocoupler and the receive port of the second device (exposed portion) can be connected to another pin of the optocoupler. Each side of the optocoupler can be supplied with voltage by the first and second devices respectively (for example with a voltage of 3.3V).

[0095] In certain embodiments, when the apparatus 200 belongs to a first portion to be protected, the communication means of the apparatus (except possibly the unidirectional communication means above when the apparatus is the first device) may be only wired communication means, so as to physically limit the possibilities of access (directly or via this device) to equipment to be protected located in the same portion of the network to be protected (and therefore the possibilities of attacks by third parties). Thus, at least one of the first and second devices 162, 164 can be a microcomputer of the “NanoPi NEO” © type, equipped only with an Ethernet port (and no Wifi).

[0096] Said at least one microprocessor of the first device 162 can in particular be adapted for: • a transmission to said second device of an addressing identifier of at least one piece of equipment of said first portion of said communication network; • a transcoding of data received from said second device into at least one structured data packet comprising at least one addressing identifier of a device receiving said packet on said first portion; • a transmission of said packet to said recipient equipment;

[0097] at least one of said transcoding and / or transmission being carried out conditionally taking into account at least one filtering rule relating to the content of said packet.

[0098] Said at least one microprocessor of the second device 164 can in particular be adapted for: • an assignment to said second device, as an addressing identifier on said second portion of said network, of at least one addressing identifier of a piece of equipment in said first portion • upon receipt of a structured data packet having as destination address said addressing identifier, a serialization of the data of said packet and; • a transmission of said serialized data to said first device.

[0099] at least one of said serialization and / or said transmission being carried out conditionally taking into account at least one filtering rule relating to the content of said packet.

[0100] Some of the above input-output modules are optional and may therefore be absent from the equipment to be protected, from the first device and / or from the second device in certain embodiments.

[0101] The electronic assembly introduced above may comprise, in certain embodiments, a physical housing in which the first and second devices and the bidirectional communication means between the first device and the second device are housed. The housing may for example limit or prevent physical access to the first and second devices and to their mutual communication means. It may in particular be a housing closed by a non-repositionable guarantee strip, or of a sealed housing, so as to make any opening of the housing visible, due to deterioration of a seal or the warranty strip, or to make it difficult to open. The housing may, for example, allow physical access to at least some communication interfaces of the first and / or second device (other than the means of mutual communication between these two devices, for example) and / or include communication interfaces connected to at least some of the communication interface(s) of the first and second devices.

[0102] In certain embodiments, the housing may only provide access to certain wired communication interfaces of the first device. For example, this may involve "forcing" the use of certain communication interfaces between the equipment and the first device, offering, for example, advantages in terms of security (for example, due to the protocol used by such interfaces) or favoring the use of "wired" interfaces. In certain embodiments, the housing may allow free access to several communication interfaces of the first and second devices, so as to provide a set adapted to different network environments.

[0103] In certain embodiments, for example when the electronic assembly introduced above does not prevent access to certain interfaces of the first device, some of these interfaces can be deactivated in software (for example not providing any service), so that third-party equipment cannot access in reading and / or writing (via an SHH connection in the case of an Ethernet link for example) the description of the first device and data of the equipment stored by the first device.

[0104] The term "module" or the term "component" or "element" of the device is understood here to mean a hardware element, in particular wired, or a software element, or a combination of at least one hardware element and at least one software element. The method according to the invention can therefore be implemented in various ways, in particular in wired form and / or in software form.

[0105] [Fig. 3] illustrates certain embodiments of the protection method 300 of the present application (implemented for example by a first device of an electronic assembly according to the invention) and [Fig. 4] illustrates certain embodiments of the data supply method 400 of the present application (implemented for example by a second device of an electronic assembly according to the invention). The method 400 (before the method 300) is now described to respect a chronological order of processing of a request (such as read / write access to equipment) received from a third-party device, and thus facilitate the reading of the present patent application.

[0106] The method 400 can for example be implemented by a second device located in a portion of a communication network completely distinct from a portion protected from this network, like the second device 164 of the electronic assembly 160 of the system 100.

[0107] Depending on the embodiments, the method can be implemented automatically at startup of the second device (via a script executed at startup ("boot") of the device) or later, for example following the launch, manually or automatically (via a background task for example) of an executable implementing at least one embodiment of the method 400. The method can notably comprise, as illustrated in [Fig. 4], a so-called initialization phase 410 (during startup of the second device for example or subsequently, upon receipt of a user command for example). This initialization phase 410 comprises an establishment 412 (initialization and / or establishment) of communications (for example unidirectional) from the second device to the first device, and optionally unidirectional communications from the first device to the second device.

[0108] This initialization phase 410 also includes obtaining 414 a description, which may take the form of one or more files in YAML, XML or JSON format for example. This description may in particular include information relating to the requests that the second device will receive (format of the packets to be received for example), and / or information relating to filtering rules that the second device must apply, and / or information relating to equipment for which a packet that will be received by the second device may be intended (such as an identifier of this equipment, a designation of at least one protocol that it can use, etc.), information relating to the data to be transmitted to the first device (protocol to be used, format, etc.).In some embodiments, the description may also include information necessary for establishing one-way communication between the second device and the first device and vice versa (such as an address of the first device on the communication network, a data format and / or a protocol to be used to communicate with the first device, etc.).

[0109] In other embodiments, where the description is for example at least partially received from the first device via the mutual communication means, the information necessary for establishing a one-way communication between the second device and the first device can be obtained by the second device (via configuration data locally accessible to the second device or remotely for example) prior to setting up 412 the two-way communication means and obtaining 414 the description. When the description is received by the second device, obtaining the description can comprise a deserialization of the data (corresponding to the description) received (if the content of the description has been serialized before its transmission to the second device).

[0110] The format for receiving the description may differ depending on the embodiments. For example, it may be an XML or JSON format. The pseudo-code below illustrates, as an example, the transmission of the description in a serialized manner in the case of the JSON protocol: [YES] {'m' : 'description', {JSONdescription}} where in this example • m announces the type of data transmitted (here announcement of data corresponding to a description) • description is a text label announcing the transmission of a description {JSON description} in JSON format.

[0112] As explained above, in some embodiments, the description may be received from the first device. In other embodiments, the description may be obtained by accessing a storage area accessible to the second device, such as a storage area local to the second device or accessible from the second portion of the network or a removable storage area (such as a USB key) coupled to the second device.

[0113] Concerning more precisely the information relating to the packets to be received, the description obtained 414 can notably include information describing at least one protocol (such as Ethernet) to be used to receive these packets, a size of the packets, a format (or structure) of the packets, a reception rate, etc.

[0114] Examples of protocols include hierarchical protocols, using standardized data structures, such as the Open Platform Communications Unified Architecture (OPC-UA) and ModBus protocols, or non-hierarchical protocols such as MQTT and Direct Datagram Protocol (UDP).

[0115] Concerning the information relating to at least one filtering rule that the second device must apply, they may include for example: - a designation of at least one accepted or prohibited protocol; - a designation of at least one network domain whose requests, when issued from this domain, will be accepted or prohibited; - an identifier of at least one device, issuing a request, accepted or prohibited; - a designation of at least one portion of the network accepted or prohibited as a portion belonging to a recipient of a request; - an identifier of at least one piece of equipment accepted or prohibited as the recipient of a request; - a type of access request (read, write, etc.) accepted or prohibited; - a range of addresses accepted or prohibited as parameters of a request; - an accepted or prohibited parameter in relation to a particular protocol (such as a "topic" for MQTT for example) - a combination of at least two of said information.

[0116] Some of this information may be optional in certain embodiments.

[0117] Concerning the information relating to a piece of equipment to which a packet may be intended, it may in particular include an addressing identifier of this piece of equipment (for example, depending on the protocols, an IP address, a MAC address of at least one access point, etc.), a designation of at least one protocol that it accepts, a communication port open on this piece of equipment.

[0118] In embodiments where the electronic assembly comprises means for unidirectional communication from the first device to the second device, the description may also comprise information relating to data to be received from the first device in response to the second device sending a request from a third-party device. This may for example be a protocol to be used to receive this data, and / or a size, type and / or format of this data, or a protocol to be used to transmit this data, and / or an output format of this data to be used for its transmission to a third-party device.

[0119] Some of the above information may be optional in the description in certain embodiments.

[0120] An example of a description is presented below.

[0121] In this example, the description concerns several devices. The term "devices" announces a list of devices to be protected (designated by their respective IP addresses), each accessible by a different protocol in this example. For each, we find the authorized ports, the authorized transmitters (sources) (designated by their respective IP addresses), the type of possible access and the registers, the "namespaces" (for OPC-UA), topic (for MQTT), http requests (for MTConnect) authorized by type of access.

[0122] config_version: 1.0

[0123] config_date: 2023-05-15

[0124] diode:

[0125] hostname: SmartDiode

[0126] devices:

[0127] "192.168.0.5":

[0128] type: modbus

[0129] ports:

[0130] - 9400

[0131] -502

[0132] sources:

[0133] -'192.168.0.1'

[0134] read:

[0135] - 0-105

[0136] - 200-420

[0137] Write:

[0138] -1-12

[0139] - 200-202

[0140] - 400

[0141] "192.168.0.11":

[0142] type: opcua

[0143] ports:

[0144] - 48040

[0145] - 4840

[0146] read:

[0147] - 'ns=l ;s=Ul-A@ supervision\exports-4-0-4statistics-l :sigma2'

[0148] - 'ns=2;i=1234'

[0149] Write:

[0150] - 'ns=3;i=568'

[0151] - 'ns=2;i=1234'

[0152] "192.168.0.12":

[0153] type: s7

[0154] read:

[0155] - '1:10-20'#DB=1, range 10 to 20

[0156] Write:

[0157] - '10:50'

[0158] - '10:60-70'

[0159] "192.168.0.100":

[0160] type: mqtt

[0161] ports:

[0162] -1883

[0163] read:

[0164] -

[0165] Write:

[0166] - ’ / topic / whatever'

[0167] "192.168.0.13":

[0168] type: mtconnect

[0169] read:

[0170] - / probe #All devices

[0171] - / M12345 / probe # Spécifie device

[0172] - / (M12345\M45678) / probe # Spécifie devices

[0173] - / ([a-zA-zO-9-]+) / probe # Any device

[0174] - / current?path= / / Axes( ? A / ^S]+)*&at=(\d+) # / / Axes and ail its children

[0175] - / current?path= / / Rotary / / DataItem[type= "LOAD"](?:V[A\- ]+)*&at=(\d+)

[0176] - / sample ?path= / / Axes( ?:V[A\ ]+) *&from=(\d+)&count=(\d+)

[0177] - / asset / ([a-zA-zO-9,’-]+).?type=(\w+)&count=(\d+)&device=([a-zA-zO-9-]+)&removed =(true\false)

[0178] In certain embodiments, the transmission method 400 may comprise an (optional) update of the obtained description 414, either automatically by the second device, or via a user interface of the second device, to delete certain information from the description or add new information (for example to create, delete and / or modify at least one filtering rule).

[0179] As illustrated in [Fig.4], the method may comprise processing 420 of a data packet originating from a third-party device located outside the protected portion. This may for example be a request for read or write access to a memory area of ​​a device in the first portion. The packet may for example be obtained 422 (i.e. received here) by the second device via the second portion of the communication network. For example, when the second device is connected to the second portion via an Ethernet link, the second device may intercept the data packets circulating on the second portion of the network and having a destination address corresponding to an addressing identifier contained in the description.

[0180] As illustrated in [Fig.4], the method may comprise an examination 430 of the received packets, taking into account at least one filtering rule (called a “second” filtering rule with reference to the “second” device). The at least one second filtering rule may for example be obtained 432 from the information present in the description (and detailed above). The method may thus comprise a filtering 434 of the received packets to retain only those consistent with the at least one “second” filtering rule obtained.

[0181] Thus, according to a first example, packets having the MQTT protocol can be kept or deleted according to their “topic”. According to a second example, packets having the OPC-UA protocol can be kept or deleted according to the designated nodes and a type of request (read or write access) to which the packet corresponds. According to a third example, packets having the ModBus protocol can be kept or deleted according to the designated registers and a type of request (read or write access) to which the packet corresponds. The destination equipment can also be taken into account when keeping or deleting packages.

[0182] For example, in connection with the example description above, a packet intended for the “ModBus” machine will be retained only if they have port 9400 as their destination port and concern “registers” 0 to 105 of “coils” 0 to 1 in the case of a read access request. On the other hand, only write access requests to registers 0-12 will be retained. Thus, a write request to register 13, for example, will be eliminated.

[0183] As illustrated, the method may comprise a transcoding 440 of the stored packets. Thus, the method may comprise an extraction 442 of the data contained in the obtained packet 422 taking into account the structure of the packet and in particular the protocol used in the encoding of the packet. The extracted data may for example comprise, in addition to the address of the recipient of the packet, at least one destination port on the destination equipment, a type of request to be addressed to the equipment, data related to the command (address range, data values, etc.).

[0184] For example, in the case of an MQTT protocol, the following pseudo code can be implemented during extraction:

[0185] # Extract destination IP

[0186] destinationjip = packet[16:20]

[0187] # Extract destination port

[0188] destination jiort = packet[20:22]

[0189] # Extract MQTT topic

[0190] topic _length = packet

[30]

[0191] topic = packet[31:31+topic_length]

[0192] # Extract MQTT payload

[0193] payload_length = packet[31+topic _length+1 ]

[0194] payload = packet[31+topic_length+2:31+topic_length+2+payload_length]

[0195] In the example of [Fig.4], the method may comprise a serialization of the extracted data. This serialization may for example take into account the description obtained 414 (in particular a designation, in the description; of a protocol to be used for the serialization, such as XML or JSON).

[0196] For example, the serialized data may include in the header an announcement of a type of data (protocol used or announcement of data corresponding to a description, etc.), a label identifying this type of data, as well as possible text labels or digital code announcing the meaning of the elements which follow them. These announcements may be optionally included in certain embodiments, in particular when the description of the second device (and that of the first device) provides only a single protocol.

[0197] As illustrated in [Fig.4], the method may comprise a transmission 450 to the first device of the transcoded data (via one of the unidirectional communication paths set up for example)

[0198] Alternatively, filtering may be performed on the extracted / serialized data (and not on the received packets).

[0199] Filtering performed on packets (rather than on serialized data) allows relying on the structure of the packets (and therefore on the semantics of the fields of these packets) to perform the filtering. In addition, it avoids performing unnecessary serialization processing of data that will not be preserved.

[0200] Optionally, the method may comprise processing 460 of a message from the equipment (such as a UDP message or a response to the request sent to the first device (and transmitted by the latter to the equipment)). Upon reception 462 of a message, the method may comprise transmission 464 of the response to the third-party device for which it is intended. In certain embodiments, this may in particular involve a simple retransmission of a received packet. The processing may possibly comprise filtering of the received packets (similarly to what has already been described above, but possibly with different filtering rules (for example to prohibit communication of the content of certain registers), or to filter the recipients of the messages).

[0201] Depending on the embodiments, the way in which the second device obtains a packet intended for a device in the first portion may vary. For example, in some embodiments where the second device is connected to the second portion of the communication network via an Ethernet link, the second device may intercept data packets traveling on the second portion of the network when their destination address matches that of the device. In other embodiments, the second device may use, as its own addressing identifier on the second portion, an addressing identifier of at least one device on the first portion.The addressing identifier of the equipment on the first portion may for example be obtained by reading the description or received from the first device and the method may comprise a definition or modification of its own addressing identifier to be equal to the addressing identifier of the equipment on the first portion. It may also involve an addition of the addressing identifier of the equipment on the first portion to its addressing identifier(s) on the second portion.

[0202] Such embodiments may allow the second device to "impersonate" the equipment, vis-à-vis devices of the second portion or external to the communication network.

[0203] Such embodiments can thus help a communications network administrator to have a “plug and play” solution. Thus, the insertion of the electronic assembly in the network, for the protection of a piece of equipment, may be transparent to other devices already present in the network and may not require changing a routing (or addressing) plan of the entire network or changing the software of any of the third-party devices wishing to obtain data from the equipment.

[0204] In particular, when the second device is part of an electronic assembly protecting several pieces of equipment, the second device can be assigned several addresses (IP for example) on the second portion (via “subnets” for example) each identical to one of the addressing identifiers of a piece of equipment to be protected on the first portion.

[0205] For example, in some embodiments, the electronic assembly may be installed in an existing network comprising equipment that is (newly) to be protected. When the electronic assembly is installed so as to be able to communicate (for example via a wired link) with the equipment to be protected, thus constituting a first portion of the network (comprising at least the equipment and the first device), a network operator may not have to take any action (other than this installation). Since requests intended for the equipment are received by the second device and any responses from the equipment are transmitted by the second device, devices and software external to the protected portion of the network may continue to make requests to the equipment, without modifying the access routine that they used before the installation of the electronic assembly to protect the equipment.The insertion of the electronic assembly into the network can therefore be transparent to these devices and software.

[0206] We now describe the method 300 illustrated in [Fig.3], and implemented for example by a first device located in a protected portion of a communication network such as the first device 162 of the electronic assembly 160 of the system 100.

[0207] Similar to what was described above for the method 400 implemented by the second device, the method 300 can be implemented, depending on the embodiments, when starting the first device, or later, and can comprise, as illustrated in [Fig. 3], a so-called initialization phase 310 (when starting the first device for example or later, upon receipt of a user command for example). This initialization phase can comprise obtaining 312 a description which can take the form of one or more files for example and which can in particular comprise information relating to the establishment of a bidirectional communication between the first device and the second device (such as an address of the second device on the communication network, a protocol to be used, etc.) and / or information relating to the data which will receive the first device from the second device (protocol to be used, format, etc.), and / or information relating to rules for filtering this data that the first device must apply, and / or information relating to at least one piece of equipment for which this data may be intended (such as an identifier of this equipment, a designation of at least one protocol that it may use, etc.), and / or information relating to the structuring of this data into data packet(s) before their transmission to a piece of equipment, and information relating to communication to be established with a piece of equipment for the transmission of at least one such packet (such as a password, or a public or private key necessary for a connection to the equipment).

[0208] The information relating to the establishment of a bidirectional communication between the first device and the second device, the information relating to the data that the first device will receive from the second device (protocol to be used, format, etc.), and / or the information relating to the structuring of this data into packet(s) may be similar to that described in connection with the transmission method 400 (the format of the packets received by the second device may be different from the format of the packets transmitted by the first device).

[0209] The information relating to filtering rules may be similar to those described in connection with the transmission method 400. In certain embodiments, the filtering rules may differ from the filtering rules applied by the second device. For example, the filtering rules to be applied by the first device may take into account the second device from which the data is received (when the first device can receive data from several “second” devices) so as, for example, to eliminate certain data corresponding to write requests originating from a second portion interconnected with a public network such as the Internet.

[0210] The information necessary for the identification of equipment to be protected may include at least one of the following identification information: - a textual label; - an address (or addressing identifier) ​​of the equipment on the first portion (for example, depending on the protocols, an IP address, a MAC address of at least one access point of the equipment, etc.); - a manufacturer's reference for the equipment; - a serial number of the equipment; - a combination of at least two of the above identification information.

[0211] The information necessary for establishing communication between the first device and the equipment (in addition to the identification information) may include in particular at least one of the so-called communication information, following: - information designating a protocol that can be used to communicate with the equipment; - a port of the equipment usable for dialoguing with the equipment according to said protocol; - at least one connection security element (such as an access identifier, a password, a public or private key, etc.); - additional parameters specific to certain protocol(s) (such as a “topic” in the case of the MQTT protocol). - a combination of at least two of the above communication information.

[0212] Examples of protocols for communicating with the equipment include hierarchical protocols, using standardized data structures, such as Open Platform Communications Unified Architecture (OPC-UA) ModBus protocols, or non-hierarchical protocols such as MQTT or Direct UDP.

[0213] Some of the information in the description may be optional in some embodiments. For example, communication information such as connection security features may be absent when access to the equipment is not restricted within the first portion. In addition, some of the data descriptive information may depend on the protocol(s) designated in the communication information.

[0214] In certain embodiments, the description may for example be obtained by accessing a storage area accessible to the first device (such as a storage area local to the first device or located in the first portion of the network or a removable storage area (such as a USB key) coupled to the first device or accessible via a serial connection on a micro-USB port of the first device. This may in particular be a micro-USB port inaccessible to a third party when the housing of the electronic assembly comprising the first device is closed.

[0215] In some embodiments (for example, some embodiments where the description is obtained by reading a storage area accessible to the first device), the method 300 may comprise a transmission 316 of at least a portion of the obtained description 312 to the second device.

[0216] In some embodiments, the description may be created, or completed, dynamically (and at least partially automatically) by the first device itself.

[0217] In such an embodiment, the method may comprise a polling (or exploration) (or ARP scan (for Address Resolution Protocol according to the terminology English) of the first portion, to discover the devices present in the first portion, then at least one connection attempt to these devices using one or more candidate protocol(s) (depending on the embodiments), allowing, when a connection attempt is successful, to detect at least one protocol used by the equipment. The connection attempts may optionally use additional elements (such as at least one port value (to discover at least one open port on the device concerned) and / or additional parameters consistent with this (or these) candidate protocol(s). For example, the method may comprise, for each device discovered in the first portion, a connection attempt with a set of candidate protocols defined by configuration (manual or automatic) of the device.

[0218] When at least one connection attempt has been successfully made for at least one discovered device, the method may comprise a recording of the address of the discovered device in association with the protocols which enabled the connection, and any additional elements in said description.

[0219] Such an embodiment can make it possible not only to create a description, but also to automatically update an existing description. This can thus involve adding information relating to a newly discovered piece of equipment or modifying information in the description relating to a piece of equipment, for example to add information relating to a new protocol accepted by this piece of equipment (following a software update of the equipment for example), or to delete the designation of a port that has become inaccessible (defective for example).

[0220] In certain embodiments, the method may further comprise an (optional) update of the description obtained by the first device. Thus, an automatic update may comprise, for example, an addition of default filtering information, applicable for access requests to a newly discovered device (and recorded in the description), such as retaining only read access requests, or an addition of filtering information prohibiting the use, regardless of the device concerned, of a low-security protocol for example) or prohibiting the use of a defective port.

[0221] An update can also be carried out manually by an operator, via a user interface of the first device, in particular to create and / or delete and / or modify filtering information. This may involve, for example, manually completing a descriptive file created automatically by the first device.

[0222] In some embodiments, the obtained description 312 may be identical to the description described in connection with the method 400 implemented in the first device. For example, both descriptions may be obtained by copying from the same removable storage medium, or the second device may receive from the first device the entirety of the description that the first device itself previously obtained 312 (or vice versa). In such embodiments, the description of the second device may then contain certain information not useful to the second device (such as a password, or a public or private key necessary for a connection to the equipment from which the data originates). Such an embodiment may offer advantages in terms of simplicity of processing (for one of the first and second devices) and / or simplicity of configuration, therefore time saving, on the second device side, since it is not necessary to provide a “description” specific to the second device.

[0223] In other embodiments, the descriptions may be different. In particular, certain information contained in the description obtained by the first device and relating to the equipment to be protected and / or to communications with this equipment (such as a password for example) may be omitted in the description obtained by the second device. In addition, in certain embodiments where the format of the packets to be created by the first device and the format of the packets received by the second device are different, information contained in the descriptions and relating to the formats of the packets to be received or created will be different.

[0224] The initialization phase 310 may comprise an establishment 314 of the bidirectional communication means with the second device and, optionally, a

[0225] transmission 316 of at least a portion of the description obtained 310 to the second device.

[0226] The transmission 316 may in particular comprise the transmission of at least one item of identification information for the equipment such as an address of the equipment on the first portion (for example, according to the protocols, an IP address, a MAC address, etc.), (also called an addressing identifier on the first portion in the present application).

[0227] It may also include at least some information for communication with the equipment (for example information relating to a protocol and / or a communication port).

[0228] In particular in certain embodiments, the transmitted descriptive portion may comprise descriptive information likely to help the second device to "impersonate" the equipment, with respect to devices of the second portion or external to the communication network.

[0229] The method may comprise obtaining 320 data, corresponding to a request from a third-party device, received (obtained) from the second device, via the bidirectional communication means. The method may further comprise transcoding, for example deserialization (or structuring) 330 of this data to obtain a structured data packet. The structuring of the data may take into account information present in the description designating a protocol used by the equipment.

[0230] For example, taking the example of the data extraction pseudo-code cited previously in connection with the transmission method 400, the pseudo-code allowing the deserialization of this data into a structured packet, according to the MQTT protocol, could be the following:

[0231] mqttjKickel = byleamiyC)

[0232] mqtt_packet += bytes(packet['destination_ip'])

[0233] mqtt_packet+= bytes(packet['destination _port'])

[0234] mqtt_packet += b\x00\x00'

[0235] mqttjiacket+= bytes([len(packet['topic'])])

[0236] mqttjiacket += packet['topic']

[0237] mqttjiacket += packet['payload']

[0238] The method may comprise an examination 340 of the extracted data taking into account of at least one filtering rule (called “first” filtering rule with reference to the “first” device). The at least one “first” filtering rule can for example be obtained 342 from the information present in the description of the first device (and detailed above). The method can thus comprise a filtering 344 of the received data, or alternatively a filtering of the packets formed from the received data, to retain only those (or those) consistent with the at least one “first” filtering rule obtained.

[0239] Alternatively, filtering can be performed on the extracted data, so as to structure only the data to be retained into packets. As explained above, performing filtering on packet-structured data makes it possible to rely on the structure of the packets for the application of the filtering rules.

[0240] As illustrated in [Fig.3], the method comprises a transmission 350 of the packet obtained on the first portion of the network, to a device receiving this packet.

[0241] Following the transmission of at least one packet which corresponds to a request from a third-party device (intended for the equipment), the first device can optionally process a response from the equipment, more precisely the first device can receive a message 362 from the equipment and transmit 364 this message (after serialization and / or filtering before or after this possible serialization) to the second device.

[0242] In certain detailed embodiments in connection with figures 3 and 4, the first device and the second device can be adapted to communicate according to several protocols with, respectively, at least one piece of equipment to be protected and at least one third-party device.

[0243] In a variant, the first device and the second device may communicate with equipment to be protected and a third-party device with a single protocol. For example, the network may comprise several electronic protection assemblies, each protecting one or more devices having the same protocol. Such embodiments may allow simpler descriptions. In particular, in certain embodiments the electronic assembly may be dedicated to a particular protocol and programmed for this protocol only.

[0244] Alternatively, upon initialization, multiple second devices may communicate with the first device to respectively transmit requests from third-party devices using different protocols.

[0245] In another variant, the same second device can communicate with several “first devices”, this second device being able for example to have several different addresses, each chosen to correspond to that of a piece of equipment protected by one of the first devices and directing the requests received to the appropriate “first” device.

[0246] The present application proposes an electronic assembly constituting, at least in some of its embodiments, a simple and effective solution for requesting data securely from an industrial machine connected to a public network such as the Internet. In particular, in at least some embodiments, the configuration of at least one of the first and second devices of the electronic assembly can be easy (in particular when it is automatic) and one or other of the devices of the electronic assembly can be usable with several different protocols, which can therefore make it possible to offer a solution adaptable to different industrial environments.

[0247] The solution presented in the present application can find applications in many fields, and in particular in areas that are privileged targets of computer attacks. Thus, in the manufacturing industry, the solution that is the subject of the present application can help to protect industrial machines (to prevent their corruption for example), by preventing access to certain sensitive data of these machines such as data relating to the industrial processes implemented, while making other data (such as production data) available to monitoring and control applications. In the example of [Fig. 5], the electronic protection assembly 160 is implemented to allow secure remote interrogation of an industrial machine (the equipment 140) by a third-party SCADA (Supervisory Control and Data Acquisition) type remote management device from an unsecured portion of the communication network.

[0248] Another example of implementation concerns the field of distribution. The solution that is the subject of the present application can in fact be used to help protect electronic point-of-sale equipment, by limiting the possibilities of access to data stored on this equipment, such as sales data and / or to in- sensitive training on clients.

[0249] Yet another example of implementation concerns the field of finance (banking, financial services) and in particular the sensitive financial and personal information handled, which the solution which is the subject of the present application can help to protect from attacks (while offering possibilities of access to other data, less sensitive for example).

[0250] The solution which is the subject of the present application may also find applications in the field of health, to protect sensitive medical data of patients while leaving possibilities of access to at least some of this data to health professionals.

Claims

Claims

1. Method for protecting at least one piece of equipment of a communication network partitioned into a plurality of portions comprising at least a first portion, comprising said equipment, and at least a second portion interconnected with said first portion via a first device of said first portion and a second device of said second portion, said method comprising: • a transmission to said second device of an addressing identifier of at least one piece of equipment of said first portion of said communication network; • a transcoding of data received from said second device into at least one structured data packet comprising at least one addressing identifier of a recipient piece of equipment of said packet on said first portion; • a transmission of said packet to said recipient piece of equipment;at least one of said transcoding and / or transmission being carried out conditionally taking into account at least one filtering rule relating to the content of said packet.;

2. Protection method according to claim 1 where said filtering rule takes into account at least one element contained in said packet among the following elements: - a designation of a device transmitting said packet; - addressing information relating to at least one data item of said equipment; - a type of access to be carried out on said data item; - a designation of a communication protocol used by said packet; - a combination of at least two of said elements above;

3. A protection method according to claim 1 or 2 wherein said filtering is performed before said transcoding.

4. A protection method according to claim 1 or 2 wherein said filtering is performed after said transcoding.

5. Protection method according to one of claims 1 to 4 where said first and second devices communicate with each other via at least two communication paths, a first unidirectional communication path allowing the first device to receive data from said second device, and a second unidirectional communication path allowing the first device to send to said second device a response to said packet transmitted to said recipient equipment.

6. A protection method according to any one of claims 1 to 5 wherein the method said transcoding comprises a deserialization of said data.

7. Method for transmitting data intended for at least one device of a communication network partitioned into a plurality of portions comprising at least a first portion, and at least a second portion interconnected with said first portion via a first device of said first portion and a second device of said second portion, said method comprising: • An assignment to said second device, as an addressing identifier on said second portion of said network, of at least one addressing identifier of a device of said first portion; • On receipt of a structured data packet having said addressing identifier as destination address, a serialization of the data of said packet; and • a transmission of said serialized data to said first device.at least one of said serialization and / or said transmission being carried out conditionally taking into account at least one filtering rule relating to the content of said packet.

8. Transmission method according to claim 7 where said filtering rule takes into account at least one element contained in said packet among the following elements: - a designation of a device transmitting said packet; - addressing information relating to at least one data item of said equipment; - a type of access to be carried out on said data item; - a designation of a communication protocol used by said packet; - a combination of at least two of said elements above;

9. Transmission method according to claim 7 or 8 comprising obtaining a description relating to said equipment of said first portion of said communication network comprising said at least one addressing identifier of said at least one equipment on said first portion of said communication network.

10. Transmission method according to one of claims 7 to 9 where said filtering is carried out on the serialized data

11. A transmission method according to one of claims 7 to 10 wherein said filtering is performed before said serialization.

12. Transmission method according to one of claims 7 to 11 wherein said first second devices communicate with each other via at least two unidirectional communication paths, a first unidirectional communication path allowing the second device to transmit data to said first device, and a second, unidirectional communication path allowing the second device to receive from the first device a response to said data transmitted to said first device.

13. Electronic assembly for protecting at least one piece of equipment of a communication network partitioned into a plurality of portions comprising at least a first portion, comprising said equipment, and at least a second portion interconnected with said first portion via at least a first device of said electronic assembly, said first device belonging to said first portion, and at least a second device of said electronic assembly, said second device belonging to said second portion, - said at least one first electronic device comprising at least one processor configured for: • transmission to said second device of an addressing identifier of at least one piece of equipment of said first portion of said communication network; a transcoding of data received from said second device into at least one first structured data packet comprising at least one addressing identifier of a device receiving said first packet on said first portion; • a transmission of said first packet to said recipient equipment; at least one of said transcoding and / or transmission being carried out conditionally taking into account at least a first filtering rule relating to the content of said first packet. - said at least one second electronic device comprising at least one processor configured to: • an assignment to said second device, as an addressing identifier on said second portion of said network, of at least one addressing identifier of a piece of equipment in said first portion • upon receipt of a second structured data packet having as destination address said addressing identifier, a serialization of the data of said second packet and; • a transmission of said serialized data to said first device. at least one of said serialization and / or said transmission being carried out conditionally taking into account at least one second filtering rule relating to the content of said second packet.

Images