TECHNICAL FIELD OF THE INVENTION

The field of the invention is that of the security of a communication network, more precisely of the configuration of a firewall equipment in such a network.

The invention is applicable in particular to a local area communication network, for example a wireless one, managed by an access equipment for accessing a wide area communication network, for example the Internet.

PRIOR ART

A firewall equipment is an important element in the security of a computer network, since it makes it possible to apply an access policy for accessing the resources of this network. Its main task is that of controlling data traffic between the network that it protects and other networks, by filtering data flows transiting through it. It is generally placed in a home or business local area communication network, intercepting the whole flow of data traffic with a wide area network, such as the Internet.

The firewall filters data packets in accordance with various criteria. The most common ones are:the origin or the destination of the packets (IP address, TCP or UDP port, network interface, etc.);the options contained in the data (fragmentation, validity, etc.);the data themselves (size, correspondence to a pattern, etc.).

A firewall often acts as router and thus makes it possible to form multiple secure zones, called demilitarized zones or DMZ, in the network that it protects. These zones are separated in line with the level of trust afforded to them by the administrator of the network.

There are multiple types of firewall, for example stateless firewalls that do not take into account the state of communication between the source equipment and the client equipment receiving the data traffic that it processes, and stateful firewalls that, on the contrary, apply filtering rules that depend on a state of this communication, this being based for example on a TCP (for “Transmission Control Protocol”) connected mode communication protocol.

Regardless of the type of firewall, configuring it is a delicate but still strategic task. Specifically, without a firewall, a host equipment is extremely vulnerable to all sorts of attacks via the network to which it is connected. It may even be subjected to an attack in the first few seconds after it connects to the Internet. Good protection of the host equipment connected to a local area network of an access equipment for accessing the Internet is therefore essential.

However, it is important to define suitable configuration rules, that is to say that are neither too strict nor too lax. With excessively strict firewall rules, the client equipment is more resistant to attacks, but this resistance is obtained at the expense of the one or more services deployed by this client equipment, the operation of which may be worsened by these rules.

This configuration problem is very particularly pronounced for firewalls embedded in home gateways that are configured so as both to manage a local area communication network and to route the data traffic with an Internet-type wide area communication network. Its configuration of the firewall of an Internet gateway is performed manually, but requires knowing all of the features of the host equipment connecting to its local area network. However, an administrator user of this network does not necessarily have a level of computing knowledge sufficient to obtain such features or to choose the appropriate configuration rules.

There are also a few predefined configuration modes, but these only allow a configuration of the firewall that is global to all of the services deployed by the host equipment. For example, such predefined configuration modes comprise:a “deactivated” mode, in which the firewall is inactive;a “medium” mode, in which the firewall blocks all incoming data traffic and authorizes all outgoing data traffic; anda “strong” mode, in which the firewall blocks all incoming data traffic and all outgoing data traffic.

This global and fixed configuration does not make it possible to adapt to the specific features of a particular host equipment connecting to the local area communication network.

There is therefore a need for a solution for facilitating customized configuration of a firewall in a local area communication network.

The invention aims to improve the situation.

Presentation of the Invention

The invention meets this need by way of a method for configuring a firewall equipment in a first communication network managed by an access equipment for accessing a second communication network, characterized in that it implements:obtaining characteristic information of the user equipment in said first network by analyzing its active interfaces in said network;generating at least one configuration rule for configuring the firewall equipment on the basis of the obtained features and of a predetermined configuration model; andtransmitting, to the firewall equipment, an update command message to update a configuration, comprising said at least one generated configuration rule.

The invention proposes an entirely novel and inventive approach for configuring a firewall equipment in a first network, such as a home network or a private company network, based on observing characteristics of a user equipment connected to the first network in order to automatically generate configuration rules for configuring the firewall equipment, adapted to the hardware and software configuration of this user equipment and to its behavior in the first network. In contrast to the prior art, which allows only a completely manual configuration beyond the ability of a computing novice or, conversely, a few predefined configuration modes, the invention automatically adapts the configuration of the firewall to the user equipment connected to the first network and takes into account its behavior in this first network. The fact that these configuration rules are in accordance with a predetermined security model or policy guarantees a high security level for the user equipments connected to the first network and accessing the second network via the access equipment.

According to one aspect of the invention, the obtaining of characteristic information is triggered upon detecting arrival of the user equipment in the first network.

One advantage is that of automating the configuration of the firewall for a new user equipment.

According to another aspect of the invention, the obtaining of characteristic information of a user equipment connected to said first network, called current characteristic information, is triggered regularly.

One advantage is that of continuously monitoring the first network, thereby making it possible to adapt the configuration of the firewall to any change in behavior of the user equipment.

According to yet another aspect of the invention, the characteristic information of at least one active interface of this user equipment in the first communication network comprises at least one item of information representative of server software, called service, executed by said user equipment on said active interface and of a port opened by said service, and the generated configuration rule defines the network, from among the first network and the second network, on which the service is made accessible.

One advantage is that of achieving a tailored configuration for each service implemented by the user equipment.

According to yet another aspect of the invention, said obtained characteristic information furthermore comprises at least one network address that has accessed said service, and the generated configuration rules comprise a network address filtering rule determined on the basis of the predetermined configuration model and of said network address.

One advantage is that of taking into account the effective data traffic from and/or to the user equipment, in addition to the model, in order to define more suitable rules.

According to yet another aspect of the invention, the method implements preliminary validation of the generated configuration rules with an administrator of the first communication network before they are transmitted to the firewall equipment.

One advantage is that of giving the administrator the opportunity to adjust or to correct certain rules according to his wishes.

Advantageously, the validation implements transmission of a validation request and reception of a validation response via a human/machine interface of a user equipment of said administrator connected to said first communication network.

For example, the validation request formulates closed questions to the administrator in natural language, and the received responses make it possible to validate or invalidate each of the generated configuration rules.

According to yet another aspect of the invention, the method implements storage of the characteristic information obtained for the user equipment in memory in the form of reference characteristic information.

One advantage is that of making it possible to keep track of the state of the user equipment when it arrives in the network and thus of being able to detect a change in behavior of the equipment, following a new collection of characteristic information.

According to another aspect of the invention, the method implements a comparison of the current characteristic information with the reference characteristic information, and the generation of configuration rules is triggered upon detecting a difference between the current characteristic information and the reference characteristic information.

One advantage is that of updating the configuration rules only when necessary.

According to yet another aspect of the invention, when the difference relates to characteristic information representative of activation of a new interface, at least one additional configuration rule relating to said active new interface is generated and the update command message comprises said at least one additional rule where strictly necessary.

One advantage is that of limiting the extent of the configuration changes to the firewall.

According to yet another aspect, when the difference relates to characteristic information representative of deactivation of an interface, the update command message comprises a command to erase the at least one configuration rule relating to the deactivated interface.

One advantage is that of not overloading the memory of the firewall with configuration rules that have become obsolete.

The invention also relates to a computer program product comprising program code instructions for implementing a method for configuring a firewall equipment according to the invention as described above when it is executed by a processor.

The invention also targets a computer-readable recording medium on which the computer programs as described above are recorded.

Such a recording medium may be any entity or device capable of storing the program. For example, the medium may contain a storage means, such as a ROM, for example a CD-ROM or a microelectronic circuit ROM, or else a magnetic recording means, for example a USB key or a hard drive.

On the other hand, such a recording medium may be a transmissible medium such as an electrical or optical signal, which may be routed via an electrical or optical cable, by radio or by other means, such that the computer program that it contains is able to be executed remotely. The program according to the invention may in particular be downloaded from a network, for example the Internet.

As an alternative, the recording medium may be an integrated circuit in which the program is incorporated, the circuit being designed to execute or to be used in the execution of the abovementioned configuration method.

The invention also relates to a configuration device for configuring a firewall equipment in a local area communication network managed by an access equipment for accessing a wide area communication network.

Such a device is configured so as to:obtain characteristic information of a user equipment connected to the first network by analyzing active interfaces of this user equipment in the first communication network; andgenerate at least one configuration rule for configuring the firewall equipment on the basis of the obtained features and of a predetermined configuration model; andtransmit, to the firewall equipment, an update command message to update a configuration, comprising said at least one determined configuration rule.

Advantageously, said device is configured so as to implement the method for configuring a firewall equipment according to its various embodiments.

Advantageously, said device is integrated into an access equipment for accessing a second communication network, configured so as to manage a first communication network, said first network comprising a firewall equipment. This is for example a home gateway or business gateway.

The abovementioned corresponding access equipment, configuration device and computer program have at least the same advantages as those conferred by the abovementioned method according to the various embodiments of the present invention.

In correlation, the invention relates to a method for updating a configuration of a firewall equipment in a first communication network managed by an access equipment for accessing a second communication network.

According to the invention, such a method implements:receiving an update command message to update a configuration, comprising configuration rules associated with a user equipment present in the first communication network; andupdating the configuration of the firewall equipment in accordance with the received command.

According to the invention, the firewall equipment is designed to take into account the configuration rules generated by the abovementioned configuration device and to apply them.

The invention also relates to a computer program product comprising program code instructions for implementing a method for updating a configuration of a firewall equipment according to the invention as described above when it is executed by a processor.

The invention also targets a computer-readable recording medium on which the computer programs as described above are recorded.

Such a recording medium may be any entity or device capable of storing the program. For example, the medium may contain a storage means, such as a ROM, for example a CD-ROM or a microelectronic circuit ROM, or else a magnetic recording means, for example a USB key or a hard drive.

On the other hand, such a recording medium may be a transmissible medium such as an electrical or optical signal, which may be routed via an electrical or optical cable, by radio or by other means, such that the computer program that it contains is able to be executed remotely. The program according to the invention may in particular be downloaded from a network, for example the Internet.

As an alternative, the recording medium may be an integrated circuit in which the program is incorporated, the circuit being designed to execute or to be used in the execution of the abovementioned method for updating a configuration.

Advantageously, such a method is implemented by a firewall equipment in a first communication network managed by an access equipment for accessing a second communication network.

Such a firewall equipment is configured so as to:receive an update command message to update a configuration, comprising at least one configuration rule associated with a user equipment present in the first communication network; andupdate the configuration of the firewall equipment in accordance with the received configuration rules.

Advantageously, the firewall equipment is integrated into the abovementioned access equipment.

