Communication method, system and associated architecture

Abstract

Communication Method, System, and Associated Architecture The present invention relates to a communication method between a sending node and a target node, via an encryption system comprising a plurality of gateways directly connected to each other via IPsec tunnels, each node being connected to a gateway. The communication method comprises a transmission phase (P2) including: the sending (S202) of a data packet by the sending node to the gateway to which it is connected, called the sending gateway; the encryption (S206) of the data packet by the sending gateway; and the transmission of the encrypted data packet. The data packet is marked (S204) by the sending gateway with a mark corresponding to an IPsec tunnel to be used, and the transmission (S206) of the encrypted data packet by the sending gateway is carried out through the IPsec tunnel corresponding to the mark of the data packet. Figure for the abstract: Figure 4

Description

Title of the invention: Communication method, system and associated architecture

[0001] The present invention relates to a communication method, as well as an associated system and architecture.

[0002] In order for two nodes to send data packets to each other through secure tunnels, for example of the IPsec type (Internet Protocol Security), it is known to encapsulate the source and destination IP addresses of the exchanged data packets so that they transit through the IPsec tunnel. However, this requires that the nodes on either side of the IPsec tunnel belong to different subnets. To enable communication between nodes belonging to the same subnet through an IPsec tunnel, one solution is to encapsulate the data packets according to a generic routing encapsulation protocol, or GRE (Generic Routing Encapsulation).However, such encapsulation significantly reduces throughput because it increases the size of the headers due to over-encapsulation, and necessitates the use of a firewall to control packets entering and leaving IPsec tunnels, ensuring they are sent through the correct IPsec tunnel and to the correct node. This increases communication complexity and further reduces throughput.

[0003] The aim of the invention is therefore to propose a communication method enabling nodes belonging to the same subnetwork to communicate with each other in a secure, simple and high-throughput manner.

[0004] To this end, the invention relates to a method of communication between a sending node and a target node, belonging to a plurality of nodes connected to the same subnetwork, via an encryption system, the encryption system comprising a plurality of gateways, directly connected to each other via IPsec tunnels, each node being connected to a gateway, the sending node and the target node each being connected to a different gateway, the communication method comprising a transmission phase including: - the sending of a data packet by the sending node to the gateway to which it is connected, called the sending gateway; - encryption of the data packet by the sending gateway and sending, by the sending gateway, of the encrypted data packet to the gateway to which the target node is connected, called the target gateway; - decryption of the encrypted packet and sending of the decrypted data packet to the target node by the target gateway.

[0005] According to the invention, the data packet is marked by the sending gateway with a mark corresponding to an IPsec tunnel to be used connecting the sending gateway and the target gateway, and the sending of the encrypted data packet by the sending gateway to the target gateway is carried out through the IPsec tunnel corresponding to the mark of the data packet.

[0006] Thanks to the invention, for communication between two nodes in the same subnetwork via an IPsec tunnel, it is not necessary to encapsulate the data packets according to a GRE protocol before sending them to the target gateway via the IPsec tunnel. Thus, it is possible to obtain a high data packet throughput.

[0007] The absence of overencapsulation according to the GRE protocol also simplifies communication, as it is not necessary to have GRE tunnels in addition to IPsec tunnels.

[0008] Furthermore, thanks to the data packet marking, the sending gateway simply determines which IPsec tunnel to use to send the data packet. It is not necessary to use a firewall, in addition to the gateways, to distribute data packets across IPsec tunnels, since the gateways themselves read the mark associated with the IPsec tunnel through which the data packets are to be sent and send the data packet into the IPsec tunnel corresponding to that mark. This also increases the packet throughput.

[0009] Data packet encryption ensures data security during communication.

[0010] According to other advantageous aspects of the invention, the communication method comprises one or more of the following features, taken individually or in all technically possible combinations:

[0011] - the transmitting gateway includes a memory in which a routing table is recorded, and marking, encryption, sending and decryption are performed if a target route including an IP address associated with the target node and a mark corresponding to the IPsec tunnel connecting the sending gateway and the target gateway is recorded in the routing table;

[0012] - the process includes a resolution phase, comprising: - a marking of resolution requests by the issuing gateway, each resolution request being marked with the mark corresponding to a different IPsec tunnel connected to the issuing gateway, each request including the same target IP address, associated with the target node; - encryption of marked resolution requests and sending of encrypted resolution requests by the issuing gateway, each request being sent through the IPsec tunnel corresponding to its mark; - sending the resolution request to the nodes connected to the target gateway, when the resolution request is received by the target gateway; - when the target node receives the resolution request, the target node sends a response including a MAC address of the target node to the target gateway; - a marking of the response with the mark corresponding to the IPsec tunnel linking the sending gateway and the target gateway; - encryption of the marked response and sending of the encrypted response to the sending gateway by the target gateway through the IPsec tunnel linking the sending gateway and the target gateway; - when the target gateway receives the encrypted response, an addition to the target gateway's routing table of a route including the target IP address and the brand of the IPsec tunnel through which the response was sent, this route being the target route;

[0013] - during the resolution phase, the request is generated by the sending node and sent to the issuing gateway, and the issuing gateway copies the resolution request to obtain multiple resolution requests;

[0014] - when the request is sent to the issuing gateway, if the target route is once recorded, a response including a MAC address of the sending gateway is sent to the sending node;

[0015] - the process comprising a suppression phase, comprising: - if sending the decrypted data packet to the target node from the target gateway fails, transmission of an encrypted data packet including an error message to the sending gateway; - when the sending gateway receives the encrypted data packet containing the error message, the target route is deleted.

[0016] - the removal phase further includes: - measurement, by the transmission gateway, of the time elapsed since the last use of the target route; and - if the time since the last use of the target route is greater than or equal to a duration threshold, the target route is deleted.

[0017] The invention also relates to an encryption system comprising a plurality of gateways, each gateway being configured to be connected to at least one node, the nodes belonging to the same subnet, the gateways being connected to each other via IPsec tunnels, the system being configured to implement a method as described above.

[0018] According to other advantageous aspects of the invention, each gateway is connected to each other gateway by an IPsec tunnel.

[0019] The invention also relates to an architecture comprising a plurality of nodes, the nodes belonging to the same subnetwork, and comprising an encryption system as described above, each node being connected to one of the gateways of the system.

[0020] The invention will become clearer upon reading the following description, given solely by way of non-limiting example, and made with reference to the drawings in which: - [Fig.1] [Fig.1] is a diagram of an architecture according to a first embodiment of the invention; - [Fig.2] [Fig.2] is a flowchart of a communication process according to the invention, implemented by the architecture of [Fig.1]; - [Fig.3] [Fig.3] is a flowchart of a phase of the process resolution communication represented on the [Fig.2]; - [Fig. 4] [Fig. 4] is a flowchart of a transmission phase of the process communication represented on the [Fig.2]; - [Fig. 5] [Fig. 5] is a flowchart of a phase of process suppression of communication represented in [Fig. 2]; and - [Fig.6] [Fig.6] is a diagram of an architecture according to a second mode of the realization of the invention. - [Fig.7] [Fig.7] is a diagram of an architecture according to a third mode of the realization of the invention.

[0021] Figure 1 is a diagram of an architecture 10 comprising a plurality of nodes 11, 12, 14. Nodes 11, 12, and 14 belong to the same subnet, that is, they have the same network address and the same subnet mask in the IP or Internet Protocol. The subnet is characterized by a range of usable IP addresses in a given network, the latter being, for example, a wide area network or WAN, which is, for example, the Internet. The subnet is, for example, that of a company network whose sites are distributed across different geographical areas.

[0022] Nodes 11, 12 and 14 represent, for example, devices such as servers, routers, computers or calculators, which need to exchange information.

[0023] Each node 11, 12, and 14 advantageously includes a physical address, or MAC address, from the English "Media Control Access". Advantageously, an Internet Protocol address, more commonly known as an IP address, from the English "Internet Protocol", is associated with each node 11, 12, 14 when it is connected to the subnet. In particular, in a known manner, the IP address of a node 11, 12, 14 can change for example in case of a new connection of node 11, 12, 14 to the subnet, while the MAC address is fixed for each node 11, 12, 14.

[0024] Nodes 11, 12, 14 are connected to the same subnetwork via an encryption system 20.

[0025] The encryption system 20 comprises a plurality of gateways 21, 22, 24. Each gateway 21, 22, 24 advantageously comprises an external interface 21a, 22a, 24a, configured to be connected with a node 11, 12, 14, and an internal interface 21b, 22b, 24b, configured to be connected to the other internal interfaces of gateways 21, 22, 24.

[0026] Each node 11, 12, 14 is connected to a gateway 21, 22, 24. In particular, each node 11, 12, 14 is connected to a single gateway. In the example of [Fig. 1], node 11 is connected to gateway 21, node 12 is connected to gateway 22, and node 14 is connected to gateway 24. Advantageously, and as shown in [Fig. 1], each node 11, 12, and 14 is connected to an external interface, respectively 21a, 22a, and 24a.

[0027] Gateways 21, 22, and 24 are directly connected to each other by IPsec tunnels 31, 32, and 33, from the English "Internet Protocol Security." By "directly connected to each other" by IPsec tunnels 31, 32, and 33, it is meant that the IPsec tunnels 31, 32, and 33 are established between gateways 21, 22, and 24, without any intermediate device. Advantageously, and as shown in [Fig. 1], the internal interfaces 21b, 22b, and 24b of gateways 21, 22, and 24 are linked by IPsec tunnels 31, 32, and 33.

[0028] Advantageously, two given gateways are connected to each other by at most one IPsec tunnel. Advantageously, each gateway is connected to every other gateway, as shown in [Fig. 1], where gateways 21 and 22 are connected to each other by IPsec tunnel 31, gateways 21 and 24 are connected to each other by IPsec tunnel 32, and gateways 22 and 24 are connected to each other by IPsec tunnel 33. This configuration is called a "full mesh" configuration.

[0029] Gateways 21, 22, 24 are configured to receive data packets from nodes 11, 12, 14 and to send data packets between them via IPsec tunnels 31, 32, 33.

[0030] Each gateway 21, 22, 24 is configured to mark the data packets it receives with a mark corresponding to an IPsec tunnel to be traversed, to which gateway 21, 22, 24 is connected. Marking a packet is, for example, the addition of ephemeral metadata, which does not modify the packet. The mark is, for example, a series of alphanumeric characters and / or symbols.

[0031] According to an example, gateway 21 is configured to mark a data packet either with a mark indicating the IPsec tunnel 31, called mark_l, or with a mark indicating the IPsec tunnel 32, called mark_2, and gateway 22 is configured to mark a data packet either with the mark mark_l or with a mark indicating the IPsec tunnel 33, called mark_3. Thus, each IPsec tunnel 31, 32, 33 corresponds to a respective mark mark_l, mark_2, mark_3, the correspondence being direct.

[0032] Alternatively, the mark corresponding to an IPsec tunnel to be used indicates a destination gateway. For example, gateway 21 is configured to mark a data packet it receives either with a mark corresponding to gateway 22, called mark_22, when the data packet is destined for gateway 22, or with a mark corresponding to gateway 24, called mark_24, when the data packet is destined for gateway 24. The gateway determines, from the mark, the IPsec tunnel to be used. Since each destination gateway is connected via an IPsec tunnel to the gateway that received the data packet, the mark corresponding to the destination gateway identifies the IPsec tunnel to be used.Thus, if the gateway that received the data packet is gateway 21, the mark_22 corresponds to IPsec tunnel 31, since IPsec tunnel 31 connects gateways 21 and 22, and the mark_24 corresponds to IPsec tunnel 32. If the gateway that received the data packet is gateway 22, a mark_21, indicating that gateway 21 is the destination gateway, corresponds to IPsec tunnel 31, and the mark_24 corresponds to IPsec tunnel 33. The marks_21,_22, and_24 therefore correspond to an IPsec tunnel to be used indirectly, depending on the gateway that received the data packet.

[0033] The data forming the data packets are, for example, images, videos, or sensor data. They are, for example, stored in a server connected to the subnet, and a user connected remotely wishes to access this data, which must then be sent to their computer, also connected to the subnet.

[0034] Data packets advantageously include layers organized according to the OSI model, from the English "Open Systems Interconnection".

[0035] Advantageously, each gateway 21, 22, 24 is configured to mark requests, for example resolution requests, or responses, in a manner similar to what has been described for data packets.

[0036] Advantageously, each gateway 21, 22, 24 is configured to encrypt data packets, and where appropriate requests and / or responses, according to an IPsec protocol.

[0037] Each gateway 21, 22, 24 is therefore configured to send a data packet and, where applicable, a request and / or a response through the IPsec tunnel to be used, corresponding to the mark of the data packet, or where applicable, of the request and / or the response. To this end, each gateway 21, 22, 24 advantageously includes a traffic selector, configured to select the IPsec tunnel to be used based on the mark on the data packet, the request, and / or the response. More precisely, the traffic selector is configured to determine the mark on the data packet, the request, and / or the response and select the tunnel to be used, that is, the tunnel through which to send the data packet, the request, and / or the response based on the mark. The data packet, the request, and / or the response is then encrypted and sent by the gateway through the IPsec tunnel corresponding to the selected IPsec tunnel to be used.

[0038] Advantageously, each node 11, 12, 14 includes a memory in which a routing table is stored. This routing table includes a list of remote IP addresses, associated with the MAC address of the gateway to which the node is connected.

[0039] A remote IP address is remote with respect to a given node, which is associated with a given IP address. The remote IP address then corresponds to an IP address to which data can only be sent by first sending it to a gateway other than the gateway to which the given node is connected. For a given node, local IP addresses are the addresses to which data can be sent by the gateway to which the given node is connected, without going through another gateway.

[0040] Each gateway 21, 22, 24 advantageously includes a routing table comprising a list of routes, each route including an IP address and the mark corresponding to the IPsec tunnel through which the data must transit to reach a node connected to that IP address. Advantageously, the route is represented in CIDR notation, from the English "Classless Inter-Domain Routing", by the IP address followed by " / 32". The route is thus specific to each node that one wishes to reach.

[0041] Each gateway 21, 22, 24 further advantageously includes an address table, comprising a list of local IP addresses and for each local IP address, the MAC address of the node associated with that local IP address.

[0042] A communication method between nodes 21, 22, 24 is now explained. This method is implemented by architecture 10.

[0043] The communication method advantageously includes a PL resolution phase. The PI resolution phase is implemented automatically by the architecture 10, or alternatively, only when a node belonging to the plurality of nodes 11, 12, 14, for example node 11, called the transmitting node, wishes to send A data packet is sent to a node with an unknown MAC address and associated with a known IP address, called the target IP address. The PI resolution phase comprises steps S102 to S124.

[0044] The transmitting node 11 wants to know the MAC address of the node, called the target node, connected to the target IP address, the transmitting node 11 knowing the target IP address. The target node is, for example, node 12.

[0045] During the PI resolution phase, a resolution request, also simply called a request, is generated by the sending node 11 during a generation step S102. The request includes the target IP address and a request for the MAC address of the target node associated with the target IP address.

[0046] Advantageously, the S102 generation step is performed when the routing table of the transmitting node 11 does not include a MAC address associated with the target IP address, or does not include the target IP address.

[0047] The request is sent by the sending node 11 to the gateway 21 to which it is connected, hereafter referred to as the sending gateway, during an S104 sending step. Advantageously, the request is sent by the sending node 11 to the external interface 21a of the sending gateway 21.

[0048] During an S106 copy step, the issuing gateway 21 copies the resolution request to obtain multiple resolution requests, all containing the same target IP address. Advantageously, the S106 copy step occurs when the routing table of the issuing gateway 21 does not contain a route containing the target IP address.

[0049] The issuing gateway 21 marks each resolution request with a mark corresponding to a different IPsec tunnel connected to the issuing gateway 21 during an S108 marking step.

[0050] For example, during step S108, the sending gateway 21 marks a first resolution request from the copy step S106 with the mark mark_l corresponding to the IPsec tunnel 31, and a second resolution request with the mark mark_2 corresponding to the IPsec tunnel 32.

[0051] Then during an S110 transmission step, the resolution requests are encrypted according to the IPsec protocol, and the first encrypted resolution request is sent through the IPsec tunnel 31 and the second encrypted resolution request is sent through the IPsec tunnel 32.

[0052] Advantageously, the traffic selector selects the IPsec tunnel corresponding to the mark on each of the encrypted resolution requests and removes the mark. The sending gateway then sends each encrypted resolution request into the IPsec tunnel corresponding to the mark, namely IPsec tunnel 31 and IPsec tunnel 32.

[0053] Gateways connected to the sending gateway 21 via an IPsec tunnel, here gateways 22 and 24, receive the encrypted resolution requests and decrypt them during a reception step SI 12. Advantageously, gateways 22 and 24 determine whether their address table includes the target IP address and the associated MAC address.

[0054] If this is not the case, then gateways 22 and 24 send the resolution request respectively to nodes 12 and 14 to which they are connected during a sending step SI 14. Advantageously, the resolution requests are sent via external interfaces 22a and 24a.

[0055] When the target node, here node 12, associated with the target IP address, receives the request, it generates a response including the MAC address of the target node 12 and sends it to the target gateway 22, advantageously to the external interface 22a of the gateway 22, during a sending step SI 16. Advantageously, the response also includes the IP address associated with the sending node, so that it can be sent to the sending node 11.

[0056] The target gateway 22 marks the response with the mark mark_l, corresponding to the mark of the IPsec tunnel to be used, which here is the IPsec tunnel 31 which connects the sending gateway 21 and the target gateway 22, during a marking step SI 18.

[0057] The target gateway 22 encrypts the response and sends it through the IPsec tunnel 31, corresponding to the mark_l of the encrypted response, during an S120 transmission step. Advantageously, during the S120 transmission step, the traffic selector determines that the mark is mark_l, selects the IPsec tunnel 31 corresponding to mark_l, and removes the mark. The target gateway 22 then encrypts the response and sends the encrypted response through the IPsec tunnel 31.

[0058] If gateway 22 determines that its address table includes the target IP address and associated MAC address, target gateway 22 does not perform SI step 14, generates the response and performs SI step 18.

[0059] Alternatively, when the target gateway 22 has received the response from the target node 12, the target gateway 22 forwards the response to all gateways to which it is connected via an IPsec tunnel, i.e. to the sending gateway 21 and gateway 24, by copying the response, marking each response with the mark_1 and mark_3 respectively during the SI step 18, and during the S120 transmission step, encrypting each copied response and sending the encrypted responses in the IPsec tunnels 31 and 33. Advantageously, during the S120 transmission step, the traffic selector selects the tunnel corresponding to the mark on the response, removes the mark, and the target gateway 22 encrypts the response and sends the encrypted response in the corresponding IPsec tunnel, respectively IPsec tunnel 31 and IPsec tunnel 33.

[0060] When the transmitting gateway 21 receives the encrypted response, it decrypts the encrypted response and performs an append step S122, during which it adds to its A routing table contains a route, called the target route, comprising the target IP address and the mark of the IPsec 31 tunnel through which the encrypted response was sent. Advantageously, the target route includes the target IP address represented in CIDR notation followed by " / 32" and the mark_l of the IPsec 31 tunnel through which the encrypted response was sent.

[0061] The S122 addition step further includes adding the target IP address and the MAC address of the transmitting gateway 21 to the routing table of the transmitting node 11, such that the target IP address is associated with the MAC address of the transmitting gateway 21.

[0062] Alternatively, the sending gateway 21 directly generates the requests for resolving a target IP address, and the generation (S102), sending (S104), and copying (S106) steps are not performed. This is the case, for example, when the routing table of the sending node 11 includes an entry with the target IP address associated with the MAC address of the sending gateway 21, but the target route, including the target IP address, does not exist in the routing table of the sending gateway 21.

[0063] Advantageously, following the S102 generation and S104 sending steps, if the transmitting gateway 21 determines that its routing table includes the target route, then the transmitting gateway 21 directly performs the S120 step and adds the MAC address of the transmitting gateway 21 to the routing table of the transmitting node 11, without adding the target route to its routing table, since it is already present.

[0064] According to an optional variant, the requests issued during the PI resolution phase are ARP requests, from the English "Address Resolution Protocol".

[0065] Optionally, once the addition step S122 has been carried out, a conclusion step S124 is carried out.

[0066] The process includes a transmission phase P2. The transmission phase P2 advantageously takes place after the resolution phase PL. The transmission phase P2 advantageously comprises steps S202 to S208.

[0067] During an S202 sending step, the sending node 11 sends a data packet to the sending gateway 21, advantageously on the interface 21a of the sending gateway 21. The data packet advantageously includes the target IP address, which is the IP address to which the sending node 11 wishes to send the data packet, as well as the MAC address of the sending gateway 21, which is associated with the target IP address in the routing table of the sending node 11.

[0068] When the sending gateway 21 receives the data packet, it determines whether the target route, including the target IP address and the IPsec tunnel brand 31, is present in its routing table. If not, the PI resolution phase is performed to add the target route to the routing table of gateway 21, and this is the gateway 21 directly generates resolution requests for a target IP address, and the S102 generation, S104 sending and S106 copy steps are not performed.

[0069] If the target route is present in the routing table of the sending gateway 21, the sending gateway 21 marks the data packet with a mark identical to the mark included in the target route, i.e. with the mark mark_l, during an S204 marking step.

[0070] The sending gateway 21 then performs an S206 data packet transmission step, in which the data packet is encrypted by the sending gateway 21 and sent to the target gateway 22 through the IPsec tunnel 31 corresponding to the mark mark_l of the encrypted data packet. Advantageously, and as described for requests and responses, during the S206 transmission step, the traffic selector determines that the mark is mark_l, selects the tunnel through which to send the packet, here the IPsec tunnel 31, and removes the mark. The sending gateway 21 then encrypts the data packet and sends the encrypted data packet through the IPsec tunnel 31.

[0071] When the target gateway 22 receives the encrypted data packet, it decrypts the encrypted data packet during a decryption step S208, and sends the now decrypted data packet to the target node 12 during a send step S210.

[0072] Advantageously, the communication method includes a suppression phase P3, which includes steps S302 to S314.

[0073] The sending gateway 21 measures a duration T during which no data packets have been sent to the target IP address during a measurement step S302. In other words, the duration T is the time since the last use of the target route. If the duration T is greater than or equal to a predetermined duration T1, then the sending gateway 21 performs a removal step S304 of the target route from its routing table.

[0074] Alternatively or in addition, if, during phase P2, the S210 send step fails, i.e., the target gateway 22 is unable to send the data packet to the target node 12, then the deletion phase P3 is implemented. The target gateway 22 generates a data packet containing an error message during an S310 generation step.

[0075] The failure of the S210 sending step is caused, for example, by a disconnection of the target node from the subnet, or by a change in the IP address of the target node 21.

[0076] The data packet containing the error message is simply referred to as the error message hereafter.

[0077] The error message includes instructions to the issuing gateway 21 to remove the target route from its routing table.

[0078] The error message is marked by the mark of the IPsec tunnel 31 through which the data packet that was not transmitted to the target node 12 was sent to the target gateway 22 during a marking step S312, and is transmitted to the sending gateway 21 during a transmission step S314 by being encrypted and sent to the sending gateway 21 through the IPsec tunnel 31.

[0079] When the transmitting gateway 21 receives the encrypted error message, it decrypts it and performs the deletion step S304.

[0080] Phase P3 thus makes it possible to remove routes that are no longer used, and, alternatively or in addition, to remove routes that do not allow data packets to be sent to the target node.

[0081] In the event of a change of IP address of the target node 12, following the P3 phase, if the node 11 wishes to send a new data packet to the target node 12, the PI resolution phase is carried out again.

[0082] The method is described with node 11 as the transmitting node and node 12 as the target node. Of course, any other nodes in the subnetwork can be chosen as transmitting and target nodes, provided they are distinct. In particular, in practice, the nodes of the network alternately act as transmitting and target nodes, and the gateways to which the nodes are connected alternately act as transmitting and target gateways.

[0083] The method is described using markers that indicate the IPsec tunnel to be used. The method is identical when using markers that indicate the destination gateway, with the traffic selector of each gateway matching the markers and the IPsec tunnel to be used.

[0084] Figure 6 is a diagram of an architecture 10 in which node 11 is a server, or router, and nodes 12 and 14 are connected to a node 50 which is outside the architecture 10. In particular, node 50 belongs to a different subnet than the other nodes 11, 12 and 14. Node 50 includes a MAC address and an IP address, the latter having a subnet mask different from that of nodes 11, 12 and 14.

[0085] In addition, nodes 12 and 14 are configured to communicate with node 50, via, for example, local area networks, or LANs.

[0086] Each node 12, 14, being a router, contains in memory a list of IP addresses and the MAC addresses of the nodes respectively connected to each IP address. In particular, router 12 contains in memory the MAC address of node 50 as well as its IP address, and router 14 contains in memory the MAC address of node 50 as well as its IP address.

[0087] In the example in [Fig. 6], the gateway 21 includes a MAC address, referred to as the "real" MAC address, which is its physical address, as well as at least one, here two so-called "virtual" MAC addresses, in order to implement dynamic routing, explained in detail below.

[0088] The communication method is similar to the communication method described above, with the differences described below. In what follows, node 11 is the transmitting node and node 50 is the target node, whose IP address is the target IP address.

[0089] In the PI resolution phase, during the SI response step 16, routers 12 and 14 scan the list of IP addresses stored in their respective memories, determine that the target IP address is included in the list of stored IP addresses, and is associated with a MAC address, which is then the MAC address of the target node 50. Routers 12 and 14 then both send a response including the MAC address of the target node, respectively the MAC address of node 12, and of node 14.

[0090] Since nodes 12 and 14 have both sent a response, it is not possible to add a target route to the routing table of the outgoing gateway 21. However, the outgoing gateway 21 includes in its routing table a so-called "static" target route, which includes the target IP address but no brand. This static target route is advantageously configured in advance by a user.

[0091] In order to still allow data exchange, during the S122 add step, the target IP address, along with two virtual MAC addresses of the transmitting gateway 21, are added to the routing table of the transmitting node 11. Each virtual MAC address includes the real MAC address of the transmitting gateway 21, as well as information about the IPsec tunnel to be used for future data exchanges between the transmitting node 11 and the target node 50. For example, the first virtual MAC address includes the MAC address of the gateway 21 followed by the mark "mark_1", and the second virtual MAC address includes the MAC address of the gateway 21 followed by the mark "mark_2". Each virtual MAC address thus corresponds to a possible route for the data sent by the node 11 to the node 50: the first address via the IPsec tunnel 31 and the second address via the IPsec tunnel 32.

[0092] In the transmission phase P2, during the sending step S202, the sending node 11 sends a data packet to the sending gateway 21. The data packet advantageously includes the target IP address, here, the IP address of the target node 50, as well as one of the two virtual MAC addresses of the sending gateway 21, which is associated with the target IP address in the routing table of the sending node 11. Advantageously, the choice of the virtual MAC address is predetermined by a user, or, alternatively, by network equipment within the framework of a load balancing function, which defines for example a priority level, a distribution of the choice between virtual MAC addresses in order to arrive at a predetermined distribution of the number of selections between the two MAC addresses, or according to the traffic in the IPsec 31 and 32 tunnels.

[0093] When the sending gateway 21 receives the data packet, it determines whether the static target route, including the target IP address, is present in its routing table. In the example in [Fig. 6], it further determines whether the MAC address included in the data packet sent by the sending node 11 is a virtual MAC address or not. If the MAC address is a virtual MAC address of the sending gateway 21, then, during the S204 marking step, the sending gateway 21 marks the data packet with a mark identical to the mark included in the virtual MAC address. If the MAC address is the actual MAC address of the sending gateway 21, the S204 marking step is performed as described previously.

[0094] The [Fig.7] is a diagram of an architecture 100 according to a second embodiment of the invention.

[0095] The architecture 100 comprises a plurality of groups 101, 102, 104 each comprising nodes, respectively 110, 112, for group 101, 114, 116, 118 for group 102 and 120 and 122 for group 104.

[0096] The nodes are similar to nodes 11, 12, 14 described previously.

[0097] For a given group, the nodes included in that group are connected to a network switch. Nodes 110 and 112 are connected to network switch 131, nodes 114, 116, 118 are connected to network switch 132 and nodes 120 and 122 are connected to network switch 134.

[0098] Each node is connected to a single network switch 131, 132 or 134.

[0099] Nodes 110, 112, 114, 116, 118, 120 and 122 are connected to the same subnetwork via a 140 encryption system.

[0100] Elements of encryption system 140 similar to encryption system 20 are not described again in detail.

[0101] The encryption system 140 includes gateways 141, 142, 144, similar, at least functionally, to gateways 21, 22 and 24.

[0102] Gateways 141, 142 and 144 are connected to each other by a network switch 148 and by IPsec tunnels 151, 152 and 153, which respectively connect gateways 141, 142 and 144 to network switch 148.

[0103] Gateways 141, 142 and 144 are connected to nodes 110, 112, 114, 116, 118, 120 and 122 via network switches, respectively 131, 132 and 134. In particular, each gateway 141, 142, 144 is connected to a single network switch 131, 132, 134.

[0104] The communication method implemented by architecture 100 is similar to the communication method described previously for architecture 10, with the differences described below.

[0105] The sending of data packets, and where applicable requests, from a sending node, for example node 110, to the gateway 141 to which it is connected, called the sending gateway, is carried out in two stages, with a sending to the network switch 131 to which the sending node 110 is connected, which in turn sends the data packets, and where applicable requests, to the sending gateway 141.

[0106] The same applies to advantageously emitted responses from the target node, for example node 114, during the PI resolution phase: they are sent to the network switch 132 to which the target node 114 is connected, and then to the gateway 142, called the target gateway, connected to the target node 114 by the network switch 132.

[0107] The sending of data packets, and where applicable of requests and / or responses through IPsec tunnels 151, 152 and 153, is similar to that described previously.

[0108] In the case where the gateways are connected in an incomplete mesh, the communication process is identical, however, the data packets will eventually pass through several gateways before reaching the target gateway and the target node.

[0109] The 20 and 140 encryption systems are advantageously further configured to implement, or to be compatible with, features such as redundancy, VLAN, Virtual Local Network, DHCP relay, Dynamic Host Configuration Protocol, or global redundancy.

[0110] Any feature described for an embodiment or variant in the foregoing may be implemented for the other embodiments and variants described above, provided that it is technically feasible.

Claims

1.

2. Demands A method of communication between a sending node (11; 110) and a target node (12; 114), belonging to a plurality of nodes (11, 12, 14; 110, 112, 114, 116, 118, 120, 122) connected to the same subnet, via an encryption system (20; 140), the encryption system (20; 140) comprising a plurality of gateways (21, 22, 24; 141, 142, 144), directly connected to each other via IPsec tunnels (31, 32, 33; 151, 152, 153), each node (11, 12, 14; 110, 112, 114, 116, 118, 120, 122) being connected to a gateway (21,22, 24; 141, 142, 144), the transmitting node (11; 110) and the target node (12; 114) each being connected to a different gateway, the communication process comprising a transmission phase (P2) including: - a sending (S202) of a data packet by the sending node (11; 110) to the gateway (21; 141) to which it is connected, called the sending gateway; - an encryption (S206) of the data packet by the sending gateway (21; 141) and a sending, (S206) by the sending gateway (21; 141), of the encrypted data packet to the gateway (22; 142) to which the target node (11; 114) is connected, called the target gateway; - a decryption (S208) of the encrypted packet and the sending (S210) of the decrypted data packet to the target node (12; 114) via the target gateway (22; 142), characterized in that the data packet is marked (S204) by the sending gateway (21; 141) with a mark corresponding to an IPsec tunnel to be used (31; 151, 152) connecting the sending gateway (21; 141) and the target gateway (22; 142), and in that the sending (S206) of the encrypted data packet by the sending gateway (21; 141) to the target gateway (22; 142) is carried out through the IPsec tunnel (31; 151, 152) corresponding to the mark of the data packet. A method according to claim 1, wherein the transmitting gateway (21; 141) comprises a memory in which a routing table is stored, and marking (S204), encryption (S206), sending (S206), and decryption (S208) are performed if a target route

3. including an IP address associated with the target node (12; 114) and a mark corresponding to the IPsec tunnel (31; 151, 152) connecting the sending gateway (21; 141) and the target gateway (22; 142) is recorded in the routing table. A communication method according to claim 2, wherein the method comprises a resolution phase (RP), including:

4. - a marking (S 108) of resolution requests by the issuing gateway (21; 141), each resolution request being marked with the mark corresponding to a different IPsec tunnel (31, 32; 151, 152, 153) connected to the issuing gateway (21; 141), each request including the same target IP address, associated with the target node (12; 114); - encryption (SI 10) of marked resolution requests and sending (SI 10) of encrypted resolution requests by the sending gateway (21; 141), each request being sent through the IPsec tunnel corresponding to its mark; - a sending (S 114) of the resolution request to the nodes (12, 114, 116, 118) connected to the target gateway (22; 142), when the resolution request is received by the target gateway (22; 142); - when the target node (12; 114) receives the resolution request, a sending (SI 16) by the target node (12; 114) of a response including a MAC address of the target node (12; 114) to the target gateway (22; 142); - a marking (S 118) of the response with the mark corresponding to the IPsec tunnel (31; 151, 152) linking the sending gateway (21; 141) and the target gateway (22; 142); - an encryption of the marked response (S 120) and a sending (S 120) of the encrypted response to the sending gateway (21; 141) by the target gateway (22; 142) through the IPsec tunnel (31; 151, 152) linking the sending gateway (21; 141) and the target gateway (22; 142); and - when the target gateway (22; 142) receives the encrypted response, an addition (S 122) in the routing table of the target gateway (22; 142) of a route including the target IP address and the mark of the IPsec tunnel (31; 151, 152) through which the response was sent, this route being the target route. A communication method according to claim 3, wherein during the resolution phase (PI), the request is generated by the the sending node (11; 110) and sent to the sending gateway (21; 141), and the sending gateway (21; 141) copies the resolution request to obtain multiple resolution requests.

5. A communication method according to claim 3, wherein when the request is sent to the sending gateway (21; 141), if the target route is registered, a response including a MAC address of the sending gateway (21; 141) is sent to the sending node (11; 110).

6. A communication method according to any one of claims 2 to 5, the method comprising a suppression phase (P3), comprising: - if the sending (S210) of the decrypted data packet to the target node (12; 114) by the target gateway (22; 142) fails, transmission (S314) of an encrypted data packet including an error message to the sending gateway (21; 141); - when the sending gateway (21; 141) receives the encrypted data packet including the error message, suppression (S304) of the target route.

7. A communication method according to claim 6, wherein the suppression phase further comprises: - measurement (S302), by the transmitting gateway (21; 141), of a duration (T) since the last use of the target route; and - if the duration (T) since the last use of the target route is greater than or equal to a duration threshold (T2), suppression (S304) of the target route.

8. An encryption system (20; 140) comprising a plurality of gateways (21, 22, 24; 141, 142, 144), each gateway (21, 22, 24; 141, 142, 144) being configured to be connected to at least one node (11, 12, 14; 110, 112, 114, 116, 118, 120, 122), the nodes (11, 12, 14; 110, 112, 114, 116, 118, 120, 122) belonging to the same subnet, the gateways (21, 22, 24; 141, 142, 144) being connected to each other via IPsec tunnels (26, 28, 30; 151, 152, 153), the system (20; 140) being configured to implement a method according to any one of the preceding claims.

9. System (20; 140) according to claim 8, wherein each gateway (21, 22, 24; 141, 142, 144) is connected to each other gateway (21, 22, 24; 141, 142, 144) by an IPsec tunnel (26, 28, 30; 151, 152, 153).

10. Architecture (10; 100) comprising a plurality of nodes (11, 12, 14; 110, 112, 114, 116, 118, 120, 122), the nodes (11, 12, 14; 110, 112, 114, 116, 118, 120, 122) belonging to the same subnet, and comprising an encryption system (20, 140) according to claim 8 or 9, each node (11, 12, 14; 110, 112, 114, 116, 118, 120, 122) being connected to one of the gateways (21, 22, 24; 141, 142, 144) of the system.

Images