Gateway controlling access to an active network

Abstract

An access control gateway (E) for controlling access to a first data network (D), which gateway includes filter means for filtering data coming from a second data network. It is characterized in that the filter means are adapted to decide whether to transmit the data to the first network as a function of information contained in the data relating to the processing of the data by active routing systems of the first network.

Description

[0001] The present invention relates to telecommunications networks whose nodes are capable of processing in a specific way information messages that they receive; to be more precise, it relates to accessing telecommunications networks of the above kind.

[0002] The invention applies more particularly to active networks, i.e. networks in which some of the routing systems (nodes) are capable of processing in a specific way at least some of the messages conveyed by the network. In other words, this means that these nodes must be able to run an algorithm other than those known to them at the time they were designed, and that each message received may require processing resources.

[0003] Not all the nodes in an active network necessarily have processing capacity: a distinction is therefore drawn between active nodes and non-active nodes, which are usually called passive nodes. Similarly, not all messages require specific processing: a distinction is therefore drawn between active messages and non-active (passive) messages.

[0004] Computer and telecommunications networks can be divided into a plurality of domains, also known as sub-networks. This is known in the art. Controlling access to a domain by means of an access control gateway is also known in the art. In Internet Protocol networks the access control gateway is called an edge router and the routing systems (nodes) are called routers.

[0005] However, the function of access control gateways is primarily limited to verifying the right to use the bandwidth corresponding to the data transmitted by a sender.

[0006] The accompanying FIG. 1 shows the environment of an access control gateway E of the above kind. The access control gateway E administers access to a domain D made up of N nodes R1, R2, R3, . . . , RN. The figure shows two senders A and B of messages, for example host stations or nodes of another domain.

[0007] Sender A is not authorized to send messages to the domain D. The access control gateway E therefore blocks messages coming from sender A.

[0008] However, sender B is authorized to send messages to the domain D. The access control gateway can therefore pass messages coming from sender B. In a more sophisticated implementation of this access control gateway, it passes only a number of messages corresponding to the bandwidth to which the sender B has subscribed, for example.

[0009] It can therefore be seen that the above kind of access control gateway does not administer the processing generated by messages received from senders. If the domain D includes active routing systems, there is nothing to prevent senders A and B sending messages requiring considerable processing resources of the active routing systems.

[0010] Also, this can lead to congestion of the active routing systems and therefore collapse of network performance.

[0011] Similarly, this lack of control can generate security lapses, since a malevolent sender can render the network inoperative merely by sending messages requiring considerable processing resources.

[0012] Obviously, another drawback is the possibility of sending computer viruses that are not checked before they are executed by the routing systems.

[0013] An object of the invention is to alleviate the above problems by checking at the access control gateway the messages entering a domain.

[0014] Thus the invention firstly provides an access control gateway for controlling access to a first data network, which gateway includes filter means for filtering data coming from a second data network. It is characterized in that the filter means are adapted to decide whether to transmit the data to the first network as a function of information contained in the data and relating to the processing of the data by active routing systems of the first network.

[0015] The invention also provides a method of transmitting to a first network, which is a data network, data coming from a second network, which is an access network, via an access control gateway. This method is characterized in that it includes the following steps:

[0016] reading information contained in the data and relating to processing of the data by active routing systems of the first network, and

[0017] deciding whether to transmit the data as a function of that information.

The invention and its advantages will become clearer in the course of the following description of one embodiment of the invention, which is given with reference to the accompanying drawings.

[0018] FIG. 1, already commented on, is a diagram showing the environment of an access control gateway.

[0019] FIG. 2 shows a second embodiment of the invention.

[0020] The data received via the access control gateway is conventionally formatted into messages, which are known as packets in the case of the Internet. These messages (packets) include a message body and a header, which comprises a plurality of fields.

[0021] The information relating to the processing of the data by the routing systems can be inserted into the header fields of the message or into the body itself.

[0022] This information can include:

[0023] information on the sender and the receiver or receivers of the message,

[0024] information on the execution environment needed to process the message, and

[0025] information on whether the message requires specific processing.

[0026] The above list is not necessarily comprehensive, and can be added to, in particular as a function of future developments in the technology of active networks.

[0027] The information on the sender and the receiver or receivers of the message can conventionally be Internet Protocol (IP) parameters such as IP addresses, port or protocol numbers, etc.

[0028] The information on whether the message requires specific processing can simply be a flag indicating if the message in question is an active message or a normal message.

[0029] Finally, the information on the execution environment specifies the execution environment required to process the message, for example in the form of identifiers. The execution environment can be an operating system that the routing system must have, for example. It can also specify a version of the operating system, or even supplementary software modules required to process the message, etc.

[0030] The manner in which the above information is inserted into the messages is outside the scope of the invention and will be evident to the person skilled in the art. In particular, it can depend in part on future specifications emanating from the Internet Assigned Number Authority (IANA), on which subject information can be found on the World Wide Web site www.iana.org, or from the Active Network Assigned Number Authority (ANANA).

[0031] In one embodiment of the invention, the access control gateway determines whether a message must be transmitted on receiving the message.

[0032] In a second embodiment, the access control gateway determines whether a message must be transmitted only for the first message of a stream, i.e. for the first message of a set of messages having the same sender, the same receiver or receivers, and the same network characteristics (protocol, port, etc.). The decision (to transmit the message or not) is then applied to all the other messages of the stream.

[0033] The decision taken by the filter means of the access control gateway can be of various kinds.

[0034] Firstly, it could be a rejection decision, in which case the message (or the stream) is not transmitted to the domain controlled by the access control gateway.

[0035] Another decision could be to transmit the message but to convert it into a passive message, in which case it can be transmitted in the domain D controlled by the access control gateway but without generating any processing and thus without consuming processing resources. If the receiver of the message is outside the domain D, the message can leave the domain D and be converted back into an active message, such reactivation of the message being effected either by the last node of the domain D through which it passes or by an access control gateway of another domain (for example the domain of the receiver of the message).

[0036] Messages can be marked conventionally, i.e. a field (in the header, for example) can indicate if a message is an active message or a passive message. In this case, conversion into a passive message merely consists in modifying the value of this field.

[0037] Another solution is to leave this field alone, so that it indicates an active message, but to indicate in another field that the message must not be processed by the routing systems handling it. For example, this field could be the field indicating the execution environment, which would then take a special value.

[0038] Another decision, encompassing the preceding decision, would be to transmit the message and allocate a limited quantity of processing resources, in which case it can be transmitted in the domain controlled by the access control gateway, with each active node processing the message only within the limits of the resources allocated to the message in question.

[0039] Using this method, a message can be transmitted with a resource allocation equal to zero, which corresponds to transmitting a message as if it were not active. The advantage of this is that if the message is transmitted to another domain made up of active nodes it can be allocated non-zero processing resources and be processed as an active message.

[0040] This allocation of processing resources can be effected conventionally by placing the corresponding value in a dedicated field. Modifying the allocation of processing resources simply consists in modifying the value of this field.

[0041] Another decision that could be taken by the filter means of the access control gateway is to accept the message and transmit it in the controlled domain without modification. If the access control gateway also has a routing function, it can transmit the message to its routing system, and if it has an execution environment, it can transmit the message to that environment and initiate specific processing.

[0042] The decision can be taken by the filter means on the basis of information inserted into the received messages, as previously described.

[0043] It can also be based on a profile database that the filter means can access. The profile database can be contained in the access control gateway, for example, and match message sender identifiers and authorization parameters.

[0044] The profile database can correspond to agreements entered into between customers and the operator managing the domain controlled by the access control gateway.

[0045] Accordingly, a customer identified by a sending address (typically an IP address) may have entered into an agreement providing only for the transmission of passive messages and not for the transmission of active messages. In this case, the profile database can indicate the customer's rights of access in the form of authorization parameters, and the filter means can accept or reject messages coming from this customer as a function of their status (active, passive).

[0046] Similarly, a customer might have entered into an agreement providing for only some types of execution environment. In this case, the field indicating the execution environment required to process the message must also be tested, and a decision taken as a function of the match between the execution environments covered by the agreement and the execution environment indicated in the message.

[0047] In the embodiment of the invention shown in FIG. 2, the data filter means can operate in collaboration with a control server S.

[0048] For example, the control server can be an active code server conventionally used to supply active code to the nodes of an active network.

[0049] The collaboration between the access control gateway E and the control server S can be implemented by means of a communications protocol, for example the COPS protocol defined by RFC 2748 of the Internet Engineering Task Force (IETF).

[0050] The collaboration can be implemented in two modes:

[0051] In one mode, the access control gateway E interrogates the control server S when necessary (i.e. each time an active packet, or the first packet of a stream of active packets, is received). The control server S decides whether to transmit the active packet or packets. It transmits its response to the access control gateway E which initiates transmission of the packets, or not, as a function of that response.

[0052] In the other mode the control server S transmits a set of rules to the access control gateway E.

[0053] The access control gateway uses these rules to decide whether to transmit the active packets received.

[0054] In an embodiment using the COPS protocol, the first mode conforms to the Outsourcing mechanism and the second to the Provisioning mechanism.

[0055] In the first mode, on receiving an active packet, the access control gateway first determines the information pertinent to the access control function contained in the active packet. This information typically includes an identifier of the active code and data relating to the execution environment required for the active code.

[0056] This information is then extracted and inserted into a protocol message sent to the control server S. In the light of this information, the control server S can decide whether the active packet can be transmitted in the domain; if it can be transmitted, it decides whether other operations must be carried out (for example, converting the packet into a passive message, or allocating it limited processing resources, as explained above).

[0057] The control server S then transmits its decision to the access control gateway E, which can implement the decision by means of the filter means.

Claims

1. An access control gateway (E) for controlling access to a first data network (D), which gateway includes filter means for filtering data coming from a second data network and is characterized in that said filter means are adapted to decide whether to transmit said data to said first network as a function of information contained in said data and relating to the processing of said data by active routing systems of said first network.

2. An access control gateway according to claim 1, wherein said filter means are adapted to access a profile database matching identifiers of the sender of said data and authorization parameters in order to decide whether to transmit.

3. An access control gateway according to claim 1 or claim 2, wherein said data is formatted in the form of active messages or passive messages and said filter means are adapted to convert active messages into passive messages.

4. An access control gateway according to claim 1 or claim 2, wherein said data is formatted in the form of active messages or passive messages and said filter means are adapted to allocate active messages a quantity of processing resources.

5. An access control gateway according to claim 1, wherein said filter means can operate in collaboration with an access server (S).

6. An access control gateway according to claim 5, wherein said filter means are adapted to transmit some of said data to said access server and to implement a decision received from said access server.

7. An access control gateway according to claim 6, wherein communications with said access server conform to the COPS protocol.

8. A method of transmitting to a first network, which is a data network, data coming from a second network, which is an access network, via an access control gateway, characterized in that said method includes the following steps: reading information contained in said data and relating to processing of said data by active routing systems of said first network, and deciding whether to transmit said data as a function of said information.

9. A transmission method according to the preceding claim, wherein the decision step is preceded by a step of reading a profile database for matching identifiers of the sender of said data and authorization parameters and the decision step is performed as a function of said step of reading the profile database.

10. A transmission method according to either claim 8 or claim 9, wherein said data is formatted in the form of active messages or passive messages and said decision can be to convert an active message into a passive message.

11. A transmission method according to either claim 8 or claim 9, wherein said data is formatted in the form of active messages or passive messages and said decision can be to allocate active messages a quantity of processing resources.