FR3150676A1 - Methods for protecting equipment and providing data, electronic devices and assemblies, computer program products and corresponding information media - Google Patents

Abstract

Methods for protecting equipment and providing data, electronic devices and assemblies, computer program products and corresponding information carriers The invention relates to a method implemented in a first device of a communication network comprising a first portion comprising equipment, and a second portion, interconnected via the first device and a second device according to a one-way communication, the method comprising: transmission to the second device of an address of the equipment on the first portion; during a communication between the equipment and the first device, obtaining a value of a data item of the equipment; transmission to the second device of this value. It also relates in particular to a method for providing corresponding data, as well as the electronic devices, electronic assembly, computer program products and corresponding information carriers. Figure for the abstract: Fig. 1

Description

Methods for protecting equipment and supplying data, electronic devices and assemblies, computer programs and related information media

This application relates to the field of securing at least a portion of a communication network.

1. Etat de la technique

It relates in particular to a method of protecting at least one piece of equipment, implemented by a first electronic device of a first part of a communication network, and a method of providing data(s), implemented by a second electronic device of a second part of a communication network, as well as the corresponding electronic devices and assemblies, computer program products and information media.

1. State of the art

The present invention relates to the protection of at least one piece of equipment accessible via a communication network. This could be, for example, equipment handling sensitive data, or performing sensitive processing, and which could therefore be the target of attacks by malicious third parties, either to gain unauthorized access to sensitive data, or to disrupt, or even prevent, certain processing operations by spreading a computer virus to the equipment.

This equipment is, for example, part of a private corporate network or a home network, interconnected to a public network such as the internet.

Examples of sensitive data include personal data (medical, banking data, etc.), industrial data (such as plans for manufactured objects, data relating to the production of certain industrial machines such as measurement results, number of parts produced, etc.), order histories received by industrial equipment, alerts, etc.

Malicious third parties might, for example, be tempted to disable equipment to harm a company or obtain a ransom. Private network security solutions have been developed to protect equipment or groups of equipment within the same private network from such attacks. Examples include firewall-based solutions and/or intrusion detection systems. Another example is the use of Virtual Private Networks (VPNs), which isolate, through encryption, communications between devices on the wider network that belong to the virtual private network. Such solutions limit communication with devices outside the private network to communications originating from the private network and directed at those "external" devices, thus preventing access to the protected equipment from outside the network.

However, these solutions, sometimes called "network diodes," are often unsuitable and very restrictive for protecting certain electronic equipment, such as industrial machinery. Indeed, such solutions only allow information to be sent at the initiative of the protected equipment. Software running on an electronic device outside the private network cannot therefore query a protected device to obtain data in return. Such solutions severely limit, or even prevent, the use of certain communication protocols based on such requests, particularly some protocols widely used in industry (such as OPC-UA or Modbus protocols used by many machine tools on the market). They are therefore not suitable for protecting certain types of equipment available on the market.

The purpose of this application is to propose improvements to at least some of the drawbacks of the state of the art.

2. Description of the invention

• une transmission audit second dispositif d’un identifiant d’adressage dudit équipement sur ladite première portion dudit réseau de communication ;
• lors d’une connexion (ou d’une communication) entre ledit équipement à protéger et ledit premier dispositif, une obtention de la valeur courante d‘au moins une donnée dudit équipement ;
• une transmission audit second dispositif, via ladite communication unidirectionnelle, de la valeur courante obtenue.

This application aims to improve the situation by means of a method for protecting equipment in a communication network partitioned into a plurality of portions comprising at least a first portion, including said equipment, and at least a second portion interconnected with said first portion via a first electronic device and a second electronic device in unidirectional communication, so as to permit only communications from the first device to the second device, said method comprising:

• a transmission to said second device of an addressing identifier for said equipment on said first portion of said communication network;
• during a connection (or communication) between said equipment to be protected and said first device, obtaining the current value of at least one data point of said equipment;
• a transmission to said second device, via said unidirectional communication, of the current value obtained.

• ledit identifiant d’adressage dudit équipement à protéger sur ladite première portion dudit réseau de communication ;

• une désignation d’au moins un protocole de communication avec ledit équipement ;
• ladite information d’adressage d’au moins une donnée dudit équipement accessible en lecture via ledit équipement.

According to at least one embodiment, the protection method includes obtaining a description relating to the equipment to be protected and comprising at least:

• said addressing identifier of said equipment to be protected on said first portion of said communication network;

• a designation of at least one communication protocol with said equipment;
• said addressing information of at least one piece of data of said equipment accessible for reading via said equipment.

According to at least one embodiment, the protection method includes transmitting to said second device information identifying said protocol.

According to at least one embodiment, the protection method includes, upon updating at least one of said at least one accessible data, a transmission to said second device, via said unidirectional communication, of said updated value.

According to at least one embodiment, said description is obtained during the launch of said protection process.

According to at least one embodiment, said description is obtained dynamically by said first device by scanning said first portion.

According to at least one embodiment, said current value and/or update of said first data is obtained by querying said equipment.

According to at least one embodiment, said query of said equipment is carried out several times and a time interval between two successive queries of said equipment takes into account temporal information included in said description.

According to at least one embodiment, said first electronic device is in wired connection (direct for example) with said equipment to be protected.

• une obtention d’un descriptif relatif à au moins un équipement de ladite première portion dudit réseau de communication comportant au moins un identifiant d’adressage dudit au moins un équipement sur ladite première portion dudit réseau de communication ;

• une affectation audit second dispositif dudit au moins un identifiant d’adressage obtenu, comme identifiant d’adressage sur ladite seconde portion dudit réseau,

• sur réception d’une requête ayant comme adresse de destination ledit identifiant d’adressage et relative à au moins une première donnée dudit équipement, une transmission d’une valeur de ladite au moins une première donnée, préalablement obtenue via ladite communication unidirectionnelle, à un émetteur de ladite requête.

This application also relates to a method for supplying data from at least one piece of equipment in a communication network partitioned into a plurality of portions comprising at least a first portion, and at least a second portion interconnected with said first portion via a first electronic device and a second electronic device in unidirectional communication, so as to permit only communications from the first device to the second device, said method comprising:

• obtaining a description relating to at least one piece of equipment on said first portion of said communication network, including at least one addressing identifier for said at least one piece of equipment on said first portion of said communication network;

• an assignment to said second device of at least one obtained addressing identifier, as an addressing identifier on said second portion of said network,

• upon receipt of a request having as its destination address said addressing identifier and relating to at least one first piece of data of said equipment, a transmission of a value of said at least one first piece of data, previously obtained via said unidirectional communication, to a sender of said request.

According to at least one embodiment, said description is obtained via said one-way communication.

• une désignation d’au moins un protocole de communication avec ledit équipement ;
• d’une information d’adressage d’au moins une donnée dudit équipement accessible en lecture via ledit équipement de ladite première portion dudit réseau ;

According to at least one embodiment, said description obtained via said supply process comprises:

• a designation of at least one communication protocol with said equipment;
• of an addressing information of at least one piece of data of said equipment accessible for reading via said equipment of said first portion of said network;

and said request is received according to said protocol and relates to said addressing information.

The characteristics, presented in isolation in this application in connection with certain embodiments of one of the processes of this application, may be combined with each other according to other embodiments of this process.

In another respect, the present application also relates to an electronic device adapted to implement at least one of the methods of the present application in any of its embodiments.

• une transmission audit second dispositif d’un identifiant d’adressage dudit équipement sur ladite première portion dudit réseau de communication ;
• lors d’une connexion (ou d’une communication) entre ledit équipement à protéger et ledit premier dispositif, une obtention de la valeur courante d‘au moins une donnée dudit équipement;
• une transmission audit second dispositif, via ladite communication unidirectionnelle, de la valeur courante obtenue.

This application therefore relates to a first electronic device of a communication network partitioned into a plurality of portions comprising at least a first portion, including equipment to be protected, and at least a second portion interconnected with said first portion via the first device and a second device in unidirectional communication with the first device, so as to permit only communications from the first device to the second device, said first device comprising at least one processor configured to:

• a transmission to said second device of an addressing identifier for said equipment on said first portion of said communication network;
• during a connection (or communication) between said equipment to be protected and said first device, obtaining the current value of at least one data point of said equipment;
• a transmission to said second device, via said unidirectional communication, of the current value obtained.

• une affectation audit second dispositif, comme identifiant d’adressage sur ladite seconde portion dudit réseau, d’au moins un identifiant d’adressage, sur ladite première portion dudit réseau de communication ; d’au moins un équipement sur ladite première portion ;

• sur réception d’une requête ayant comme adresse de destination ledit identifiant d’adressage et relative à au moins une première donnée dudit équipement, transmission d’une valeur de ladite au moins une première donnée, préalablement obtenue via ladite communication unidirectionnelle, à un émetteur de ladite requête.

This application also relates to a second electronic device in a communication network partitioned into a plurality of portions comprising at least a first portion, including equipment to be protected, and at least a second portion interconnected with said first portion via a first electronic device and said second electronic device in unidirectional communication, so as to permit only communications from the first device to the second device, said second device comprising at least one processor configured to:

• an assignment to said second device, as an addressing identifier on said second portion of said network, of at least one addressing identifier, on said first portion of said communication network; of at least one piece of equipment on said first portion;

• upon receipt of a request having as its destination address said addressing identifier and relating to at least one first piece of data of said equipment, transmission of a value of said at least one first piece of data, previously obtained via said unidirectional communication, to a sender of said request.

• ledit au moins un premier dispositif dudit ensemble électronique comportant au moins un premier processeur configuré pour:

• une transmission audit second dispositif d’un identifiant d’adressage dudit équipement sur ladite première portion dudit réseau de communication ;
• lors d’une connexion (ou d’une communication) entre ledit équipement à protéger et ledit premier dispositif, une obtention de la valeur courante d‘au moins une donnée dudit équipement;
• une transmission audit second dispositif, via ladite communication unidirectionnelle, de la valeur courante obtenue.

• Et ledit au moins un second dispositif électronique comprenant un moins un second processeur configuré pour :

• une affectation audit second dispositif, comme identifiant d’adressage sur ladite seconde portion dudit réseau, d’au moins un identifiant d’adressage, sur ladite première portion dudit réseau de communication, d’au moins un équipement sur ladite première portion ;
• sur réception d’une requête ayant comme adresse de destination ledit identifiant d’adressage et relative à au moins une première donnée dudit équipement, une transmission d’une valeur de ladite au moins une première donnée, préalablement obtenue via ladite communication unidirectionnelle, à un émetteur de ladite requête.

According to another aspect, the present application also relates to an electronic assembly of a communication network partitioned into a plurality of portions comprising at least a first portion, comprising equipment to be protected, and at least a second portion interconnected with said first portion via a first device of said electronic assembly and a second device of said electronic assembly in unidirectional communication, via unidirectional communication means of said electronic assembly, so as to permit only communications from the first device of said electronic assembly to the second device of said electronic assembly,

• said at least one first device of said electronic assembly comprising at least one first processor configured for:

• a transmission to said second device of an addressing identifier for said equipment on said first portion of said communication network;
• during a connection (or communication) between said equipment to be protected and said first device, obtaining the current value of at least one data point of said equipment;
• a transmission to said second device, via said unidirectional communication, of the current value obtained.

• And said at least one second electronic device comprising at least one second processor configured to:

• an assignment to said second device, as an addressing identifier on said second portion of said network, of at least one addressing identifier, on said first portion of said communication network, of at least one piece of equipment on said first portion;
• upon receipt of a request having as its destination address said addressing identifier and relating to at least one first piece of data of said equipment, a transmission of a value of said at least one first piece of data, previously obtained via said unidirectional communication, to a sender of said request.

• ledit au moins un premier dispositif dudit ensemble électronique de protection comportant au moins un premier processeur configuré pour :

• une transmission audit second dispositif d’un identifiant d’adressage dudit équipement sur ladite première portion dudit réseau de communication ;
• lors d’une connexion (ou d’une communication) entre ledit équipement à protéger et ledit premier dispositif, une obtention de la valeur courante d‘au moins une donnée dudit équipement;
• une transmission audit second dispositif, via ladite communication unidirectionnelle, de la valeur courante obtenue.

• Et ledit au moins un second dispositif électronique comprenant un moins un second processeur configuré pour :

• une affectation audit second dispositif, comme identifiant d’adressage sur ladite seconde portion dudit réseau, d’au moins un identifiant d’adressage, sur ladite première portion dudit réseau de communication ; d’au moins un équipement sur ladite première portion ;
• sur réception d’une requête ayant comme adresse de destination ledit identifiant d’adressage et relative à au moins une première donnée dudit équipement, une transmission d’une valeur de ladite au moins une première donnée, préalablement obtenue via ladite communication unidirectionnelle, à un émetteur de ladite requête.

According to another aspect, the present application also relates to a system comprising at least one piece of equipment to be protected and at least one electronic protection assembly, in a communication network partitioned into a plurality of portions comprising at least a first portion, comprising said equipment to be protected, and at least a second portion interconnected with said first portion via a first device of said electronic protection assembly and a second device of said electronic protection assembly in unidirectional communication with the first device of said electronic protection assembly, via unidirectional communication means of said electronic protection assembly so as to permit only communications from the first device of said electronic protection assembly to the second device of said electronic protection assembly,

• said at least one first device of said electronic protection assembly comprising at least one first processor configured for:

• a transmission to said second device of an addressing identifier for said equipment on said first portion of said communication network;
• during a connection (or communication) between said equipment to be protected and said first device, obtaining the current value of at least one data point of said equipment;
• a transmission to said second device, via said unidirectional communication, of the current value obtained.

• And said at least one second electronic device comprising at least one second processor configured to:

• an assignment to said second device, as an addressing identifier on said second portion of said network, of at least one addressing identifier, on said first portion of said communication network; of at least one piece of equipment on said first portion;
• upon receipt of a request having as its destination address said addressing identifier and relating to at least one first piece of data of said equipment, a transmission of a value of said at least one first piece of data, previously obtained via said unidirectional communication, to a sender of said request.

This application also relates to a computer program comprising instructions for implementing the various embodiments of at least one of the above methods, when said program is executed by a processor, and an information carrier readable by an electronic device and on which the computer program is recorded.

• une transmission audit second dispositif d’un identifiant d’adressage dudit équipement sur ladite première portion dudit réseau de communication ;
• lors d’une connexion (ou d’une communication) entre ledit équipement à protéger et ledit premier dispositif, une obtention de la valeur courante d‘au moins une donnée dudit équipement;
• une transmission audit second dispositif, via ladite communication unidirectionnelle, de la valeur courante obtenue.

This application therefore relates to a computer program comprising instructions for implementing, when the program is executed by a processor of a first electronic device, a method for protecting equipment in a communication network partitioned into a plurality of portions comprising at least a first portion, including said equipment, and at least a second portion interconnected with said first portion via the first device and a second device in unidirectional communication with the first device, so as to permit only communications from the first device to the second device, said method comprising:

• a transmission to said second device of an addressing identifier for said equipment on said first portion of said communication network;
• during a connection (or communication) between said equipment to be protected and said first device, obtaining the current value of at least one data point of said equipment;
• a transmission to said second device, via said unidirectional communication, of the current value obtained.

• une affectation audit second dispositif, comme identifiant d’adressage sur ladite seconde portion dudit réseau, d’au moins un identifiant d’adressage, sur ladite première portion dudit réseau de communication ; d’au moins un équipement sur ladite première portion ;
• sur réception d’une requête ayant comme adresse de destination ledit identifiant d’adressage et relative à au moins une première donnée dudit équipement, une transmission d’une valeur de ladite au moins une première donnée, préalablement obtenue via ladite communication unidirectionnelle, à un émetteur de ladite requête.

Furthermore, the present application relates to a computer program comprising instructions for implementing, when the program is executed by a processor of a second electronic device, a method for supplying data from at least one piece of equipment in a communication network partitioned into a plurality of portions comprising at least a first portion, and at least a second portion interconnected with said first portion via a first electronic device and the second electronic device in unidirectional communication, so as to permit only communications from the first device to the second device, said method comprising:

• an assignment to said second device, as an addressing identifier on said second portion of said network, of at least one addressing identifier, on said first portion of said communication network; of at least one piece of equipment on said first portion;
• upon receipt of a request having as its destination address said addressing identifier and relating to at least one first piece of data of said equipment, a transmission of a value of said at least one first piece of data, previously obtained via said unidirectional communication, to a sender of said request.

• une transmission audit second dispositif d’un identifiant d’adressage dudit équipement sur ladite première portion dudit réseau de communication ;
• lors d’une connexion (ou d’une communication) entre ledit équipement à protéger et ledit premier dispositif, une obtention de la valeur courante d‘au moins une donnée dudit équipement ;
• une transmission audit second dispositif, via ladite communication unidirectionnelle, de la valeur courante obtenue.

This application also relates to a processor-readable information carrier of a first electronic device on which is stored a computer program comprising instructions for implementing, when the program is executed by the processor, a method for protecting equipment in a communication network partitioned into a plurality of portions comprising at least a first portion, comprising said equipment, and at least a second portion interconnected with said first portion via the first device and a second device in unidirectional communication with the first device, so as to permit only communications from the first device to the second device, said method comprising:

• a transmission to said second device of an addressing identifier for said equipment on said first portion of said communication network;
• during a connection (or communication) between said equipment to be protected and said first device, obtaining the current value of at least one data point of said equipment;
• a transmission to said second device, via said unidirectional communication, of the current value obtained.

• une affectation audit second dispositif, comme identifiant d’adressage sur ladite seconde portion dudit réseau, d’au moins un identifiant d’adressage, sur ladite première portion dudit réseau de communication ; d’au moins un équipement sur ladite première portion ;
• sur réception d’une requête ayant comme adresse de destination ledit identifiant d’adressage et relative à au moins une première donnée dudit équipement, une transmission d’une valeur de ladite au moins une première donnée, préalablement obtenue via ladite communication unidirectionnelle, à un émetteur de ladite requête.

This application also relates to a data carrier readable by a processor of a second electronic device and on which is recorded a computer program comprising instructions for the implementation, when the program is executed by the processor, of a method for supplying data from at least one piece of equipment in a communication network partitioned into a plurality of portions comprising at least a first portion, and at least a second portion interconnected with said first portion via a first electronic device and the second electronic device in unidirectional communication, so as to permit only communications from the first device to the second device, said method comprising:

• an assignment to said second device, as an addressing identifier on said second portion of said network, of at least one addressing identifier, on said first portion of said communication network; of at least one piece of equipment on said first portion;
• upon receipt of a request having as its destination address said addressing identifier and relating to at least one first piece of data of said equipment, a transmission of a value of said at least one first piece of data, previously obtained via said unidirectional communication, to a sender of said request.

The programs mentioned above can use any programming language, and be in the form of source code, object code, or code intermediate between source code and object code, such as in a partially compiled form, or in any other desirable form.

The information (or recording) media referred to in this application may be any entity or device capable of storing the program. For example, an information medium may include a storage means, such as a ROM, for example a CD-ROM or a microelectronic circuit ROM, or a magnetic recording means.

Such a storage device could be, for example, a hard drive, a flash memory, etc.

On the other hand, an information carrier can be a transmissible information medium such as an electrical or optical signal, which can be transmitted via an electrical or optical cable, by radio, or by other means. A program according to the invention can, in particular, be downloaded onto a network such as the Internet.

Alternatively, an information carrier may be an integrated circuit in which a program is incorporated, the circuit being adapted to execute or to be used in the execution of any of the embodiments of at least one of the methods that are the subject of this patent application.

In general, obtaining an element means in this application, for example, receiving that element from a communication network, acquiring that element (via, for example, user interface elements, sensors, etc.), creating that element by various processing means such as copying, encoding, decoding, transformation, etc., and/or accessing that element from a local or remote storage medium accessible to at least one device (such as the first and/or second device) implementing, at least partially, that obtaining.

3. Brief description of the drawings

Other features and advantages of the invention will become clearer upon reading the following description of particular embodiments, given by way of simple illustrative and non-limiting examples, and the accompanying drawings, among which:

There FIG. 1 presents a simplified view of a system, cited as an example, in which at least some embodiments of the processes of this application can be implemented,

There FIG. 2 presents a simplified view of a device adapted to implement at least certain embodiments of at least one of the processes in this application,

There FIG. 3 presents an overview of the process for protecting this application, in some of its embodiments

There FIG. 4 presents an overview of the data provision process for this application, in some of its implementations

There FIG. 5 presents a simplified view of a 500 system, cited as an example, in which at least some embodiments of the process of the present application can be implemented

5. Description of the implementation methods

This application aims to provide a simple and effective solution for protecting one or more devices on a communication network against cyberattacks, particularly those originating from outside the network, while also enabling secure retrieval (for example, on demand), including from outside the network, of data from these devices. To achieve this, the application proposes equipping the communication network with at least two devices, partitioning the network into at least two segments.

By partition, we mean here a division of the communication network into a plurality of portions each comprising at least one electronic device, separated in pairs (except for certain interconnection elements between the at least two devices as specified below) and whose reunion reconstitutes the communication network.

At least one of these portions is a portion (called "protected") inaccessible from an electronic device located outside of this first portion, this first portion including at least one piece of equipment to be protected. At least one second portion, called "exposed," is accessible, directly or via interconnection equipment, to devices outside the first portion (such as devices located in a different "first" protected portion than the first "protected" portion where the equipment is located, and/or devices in the second portion, and/or devices outside the communication network).

The communication network may be, in particular, a private or local network. The equipment to be protected may, for example, be industrial machines. According to this application, a first device belonging to a protected portion accesses, in read mode, data from equipment to be protected located in that protected portion, and transmits it to a second device, located in an exposed portion (i.e., outside that protected portion), where this data is accessible to a third-party device (such as a device not belonging to the communication network, or belonging to the exposed portion of the communication network) and/or may be provided (systematically, by subscription, and/or on demand) to a third-party device. At least partial duplication of the readable data from the equipment to be protected is thus implemented on the second device. The first and second devices communicate only via unidirectional means of communication, so that only communications originating from the first device (from the protected portion) to the second device (in the exposed portion) are possible.

Thus, according to this application, it is possible to receive (at the level of the second device) requests from a third-party device wishing to obtain data from the equipment to be protected, and to provide it in return with this data (previously obtained via the first device), in complete security for the equipment to be protected.

The logical assembly comprising at least one first and second devices and the unidirectional communication means is also referred to in this application as an "electronic assembly," "electronic protection assembly," or "smart diode." Depending on the embodiment, it may be a virtual assembly, virtually encapsulating the first and second devices and their unidirectional communication means, or a physical assembly (such as a hardware component), for example, having a housing in which at least one first and second device and their unidirectional communication means are installed. This assembly may comprise, depending on the embodiment and the network topology (for example, the number of devices to be protected), a variable number of "first" and "second" devices.

Such an electronic system offers the advantage of easy installation within a communication network, for example, as an "intermediary" between a specific piece of equipment to be protected and the rest of the communication network, or to restrict access to that equipment to only those accessed by the first device, or simply to limit access to the equipment to devices located within a protected portion of the communication network to which that equipment belongs. Such a system can also help provide a "turnkey" solution for a communication network administrator.

Such an electronic assembly can thus help, at least in certain embodiments, to secure equipment to be protected, without requiring modification and/or replacement of that equipment.

For clarity, the term "electronic equipment," or "equipment," is used in this application to refer to equipment that may be protected by the electronic assembly. The term "electronic device," or "device," will be used to refer to the first or second electronic device of the electronic assembly 160 introduced above. The term "electronic device" or "device" refers to any electronic device (this may sometimes be equipment to be protected or a device within the electronic assembly).

We now describe, in connection with the FIG. 1 , in more detail the present request.

There FIG. 1 represents a system 100 in which certain embodiments of the invention can be implemented. The system 100 comprises one or more electronic devices, at least some of which can communicate with each other via one or more communication networks 110, 120, 130, possibly partitioned and/or interconnected. In the illustrated example, the system thus comprises a private network partitioned into two portions 110, 120. One of the portions 120 is further interconnected with another network 130 (such as a wide area network and/or public network), thus enabling communication between electronic devices 150, 164, 170 of this portion 120 and electronic devices 180 not belonging to the private network.

The private network can, for example, be a private business or home network, such as a local area network (LAN). The other network (130) can be another local network, or a wide area network with significant geographical coverage, such as a metropolitan area network (MAN) or a network whose geographical area covers at least one region of a country, or even a country (WAN). Examples include internet-based WANs, cellular networks (GSM - Global System for Mobile Communications, UMTS - Universal Mobile Telecommunications System, Wi-Fi - Wireless, etc.).

As illustrated in FIG. 1 , the system 100 may also include several electronic devices 140 in a non-interconnected portion 110 of the private network, such as a terminal (such as a laptop, smartphone, tablet or connected object), a connected object (such as a robot, an automatically guided and/or remotely controlled mobile device, an energy meter, a machine tool in the case of an industrial private network, and/or a household appliance in the case of a home network), a server, for example an application server, and/or a storage device.

The system comprises at least one electronic assembly 160, as described above, designed to protect at least some electronic equipment 140 of the private network 110. The first device 162 of the electronic assembly 160 is located in a portion 110, referred to as the "protected" portion, of the private network containing the equipment 140 to be protected. The first device 162 communicates with the second device 164 (located in the interconnected portion 120) via unidirectional communication means 168, which do not allow communication in the opposite direction. Such unidirectional communication means may vary depending on the embodiment (and in particular on the hardware capabilities of the first and/or second device). In some embodiments, the unidirectional communication means may include at least one optocoupler, and/or bidirectional communication means limited to a single direction of transmission, such as an Ethernet cable, a serial link and/or an optical fiber and/or at least one digital isolator (Digital isolator according to English terminology) with galvanic, capacitive, inductive and/or optical isolation.

The presence of optocoupler(s) allows the two devices to be physically separated (no electrical current is exchanged, only light), thus enhancing the security of the exchanges. Electrical isolation of the devices from each other can help, for example, to prevent attacks by injecting current or electrical signals into the second part of the network.

The system may also include network management and/or interconnection elements (164, 170). In particular (and even though not illustrated in FIG. 1 In some embodiments, the electronic assembly 160 may include an interconnection gateway with another network. In some embodiments, this gateway may, for example, be connected to the second device of the electronic assembly (and thus allow interconnection between the "exposed" portion of the private network and the other network). In other embodiments, the second device may itself act as an interconnection gateway between the "exposed" portion of the private network and the other network.

The private network can, for example, use wired connections such as at least one serial and/or Ethernet connection, or wireless communication methods. The network can implement a communication protocol such as Modbus Serial, or CAN ( Controller Area Network ) in the case of a serial connection, or such as Modbus TCP, OPC-UA, MQTT (Message Queuing Telemetry), or Siemens S7 in the case of an Ethernet connection.

There FIG. 2 illustrates a simplified structure of an electronic device 200 of the system 100, for example the first device 162, the first device 162, and/or the equipment to be protected 140 of the FIG. 1 Depending on the implementation, it may be a server, and/or a terminal, or even a microcomputer with a simple human-machine interface such as a Raspberry Pi ©, an Orange Pi © or a Nano Pi NEO.

Device 200 includes, in particular, at least one memory M 210. Device 200 may include, in particular, a buffer memory, volatile memory (e.g., RAM, for "Random Access Memory"), and/or non-volatile memory (e.g., ROM, for "Read Only Memory"). Device 200 may also include a processing unit UT 220, equipped, for example, with at least one processor P 222, and driven by a computer program PG 212 stored in memory M 210. At initialization, the code instructions of the computer program PG are, for example, loaded into RAM before being executed by the processor P. In the case where the device is the first device 162 and/or the second device 164 of the electronic assembly, said at least one processor P 222 of the processing unit UT 220 may, in particular, implement, individually or collectively, any one of the embodiments of at least one of the processes of this application (described in particular in relation to Figures 3 and 4), according to the instructions of the PG computer program.

The device may also include, or be coupled to, at least one I/O input/output module 230. The device's at least one I/O input/output module 230 may, in certain embodiments, include at least one user interface module for the device (also referred to more simply in this application as a "user interface"). The device user interface is understood to mean, for example, an interface integrated into the device 200, or a part of a third-party device with which it is coupled by wired or wireless communication means. For example, it could be a secondary display of the device.

A user interface can be, in particular, an "output" user interface adapted for rendering (or controlling the rendering) of an output element of a computer application used by the device 200, for example, an application running at least partially on the device 200 or an "online" application running at least partially remotely, for example, on a server. Examples of device output user interfaces include one or more screens, including at least one graphical display (such as a touchscreen), one or more speakers, and a connected device.

By rendering, we mean here a display (or "output" according to English terminology) on at least one user interface, in any form, for example including text, audio and/or video components, or a combination of such components.

Furthermore, a user interface can be an "input" user interface adapted for receiving a command from a user of device 200. This could include an action to be performed in relation to a returned item, and/or a command to be sent to a computer application used by device 200, for example, an application running at least partially on device 200 or an "online" application running at least partially remotely, for example, on a server. Examples of device input user interfaces may also include, or be coupled to, at least one I/O module 230, 200, such as a sensor, an audio and/or video acquisition device (microphone, camera (webcam), for example), a keyboard, and a mouse.

The device may also include, or be coupled with, at least one I/O module 230, such as a communication module, enabling the device 200 to communicate with at least one other device in the system 100, via wired or wireless communication interfaces. For example, this could be at least one Ethernet interface, and/or a Wi-Fi or Bluetooth interface.

In the case where the device is the first device 162 or the second device 164 of the electronic assembly, the means of communication include a unidirectional communication interface 1622, 1642 between the two devices, such as an Ethernet type interface, or a serial interface with an optocoupler 166 of the electronic assembly 160.

In the example of the FIG. 1 The optocoupler can be connected directly to the serial interface. For example, the transmit port of the first device (protected portion) can be connected to one pin of the optocoupler, and the receive port of the second device (exposed portion) can be connected to another pin of the optocoupler. Each side of the optocoupler can be supplied with voltage by the first and second devices respectively (for example, with a voltage of 3.3V).

• une transmission au second dispositif d’un identifiant d’adressage de l’équipement sur la première portion du réseau de communication ;
• lors d’une connexion (ou d’une communication) entre ledit équipement à protéger et le premier dispositif, une obtention de la valeur courante d‘au moins une donnée dudit équipement ;
• une transmission audit second dispositif, via ladite communication unidirectionnelle, de la valeur courante obtenue.

In certain embodiments, when device 200 belongs to a first protected segment, the device's communication means (except possibly for the unidirectional communication means mentioned above when the device is one of the first and second devices) may be solely wired, so as to physically limit the possibilities of access (directly or via this device) to equipment to be protected located in the same protected segment of the network (and therefore the possibilities of third-party attacks). Thus, at least one of the first and second devices 162, 164 may be a "NanoPi NEO" © type microcomputer, equipped only with an Ethernet port (and no WiFi). Said at least one microprocessor of the first device 162 may, in particular, be adapted to:

• a transmission to the second device of an addressing identifier of the equipment on the first portion of the communication network;
• during a connection (or communication) between said equipment to be protected and the first device, obtaining the current value of at least one data point of said equipment;
• a transmission to said second device, via said unidirectional communication, of the current value obtained.

• une affectation audit second dispositif, comme identifiant d’adressage sur ladite seconde portion dudit réseau, d’au moins un identifiant d’adressage, sur ladite première portion dudit réseau de communication ; d’au moins un équipement sur ladite première portion ;
• sur réception d’une requête ayant comme adresse de destination ledit identifiant d’adressage et relative à au moins une première donnée dudit équipement, une transmission d’une valeur de ladite au moins une première donnée, préalablement obtenue via ladite communication unidirectionnelle, à un émetteur de ladite requête.

Said at least one microprocessor of the second device 164 can in particular be adapted for:

• an assignment to said second device, as an addressing identifier on said second portion of said network, of at least one addressing identifier, on said first portion of said communication network; of at least one piece of equipment on said first portion;
• upon receipt of a request having as its destination address said addressing identifier and relating to at least one first piece of data of said equipment, a transmission of a value of said at least one first piece of data, previously obtained via said unidirectional communication, to a sender of said request.

Some of the above input/output modules are optional and may therefore be absent from the equipment to be protected, the first device and/or the second device in some embodiments.

The electronic assembly described above may, in certain embodiments, include a physical enclosure housing the first and second devices and the unidirectional communication means from the first device to the second device. The enclosure may, for example, restrict or prevent physical access to the first and second devices and their unidirectional communication means. It may, in particular, be an enclosure secured by a tamper-evident seal, or a sealed enclosure, designed to make any opening of the enclosure visible due to damage to the seal or the tamper-evident seal, or to make it difficult to open. The enclosure may, for example, allow physical access to at least some of the communication interfaces of the first and/or second device (other than the unidirectional communication means between these two devices, for example) and/or include communication interfaces connected to at least some of the communication interface(s) of the first and second device.

In some embodiments, the enclosure may only provide access to certain wired communication interface(s) of the first device. For example, this may involve "forcing" the use of certain communication interfaces between the equipment and the first device, offering advantages in terms of security (for example, due to the protocol used by such interfaces) or prioritizing the use of wired interfaces. In other embodiments, the enclosure may allow access to several communication interfaces of the first and second devices, so as to offer a configuration suitable for different network environments.

In some embodiments, for example when the electronic assembly introduced above does not prevent access to certain interfaces of the first device, some of these interfaces can be disabled by software (for example, by not providing any service), so that a third-party device cannot access by reading and/or writing (via an SHH connection in the case of an Ethernet link for example) the description of the first device and data of the equipment stored by the first device.

The terms "module," "component," or "element" of the device refer to a hardware element, particularly a wired one, a software element, or a combination of at least one hardware element and at least one software element. The method according to the invention can therefore be implemented in various ways, including in wired and/or software form.

There FIG. 3 illustrates some embodiments of the protection method 300 of this application. The method 300 can, for example, be implemented by a first device located in a protected portion of a communication network, such as the first device 162 of the electronic assembly 160 of the system 100.

Depending on the embodiment, the process can be implemented automatically at the startup of the first device (via a script executed at device startup ("boot") or later, for example following the manual or automatic launch (via a background task, for example) of an executable implementing at least one embodiment of the process. The process may include, in particular, as illustrated in FIG. 3 An initialization phase (310) occurs (for example, when the device starts up or later, upon receipt of a user command). This initialization phase (310) includes obtaining (312) a description of at least one piece of equipment (to be protected) located in the same "first" portion as the first device. The description can take the form of one or more files, for example, in YAML, XML, or JSON format. The description may include information necessary to identify the equipment, and/or information necessary to establish communication between the first device and the equipment, and/or information describing the data (location, size, type, structure, etc.) that the first device must access on the equipment or that the equipment is likely to provide to the first device. Depending on the embodiments, and depending on the unidirectional communication means implemented between the first and second devices, the description may also include information necessary for establishing unidirectional communication between the first and second devices (such as an address of the second device on the communication network, a protocol to be used, etc.).

• un libellé textuel ;
• une adresse (ou identifiant d’adressage) de l’équipement sur la première portion (par exemple selon les protocoles une adresse IP, une adresse MAC d’au moins un point d’accès de l’équipement, une URL (pour Uniform Resource Allocator selon la terminologie anglaise), etc.) ;
• une référence constructeur de l’équipement ;
• un numéro de série de l’équipement ;
• une combinaison d’au moins deux des informations d’identification ci-dessus.

The information required to identify equipment to be protected may include at least one of the following identifying pieces of information:

• a textual label;
• an address (or addressing identifier) of the equipment on the first portion (for example, depending on the protocols, an IP address, a MAC address of at least one access point of the equipment, a URL (for Uniform Resource Allocator according to English terminology), etc.);
• a manufacturer's reference for the equipment;
• a serial number of the equipment;
• a combination of at least two of the above identifying information.

• une information désignant un protocole utilisable pour dialoguer avec l’équipement ;
• un port de l’équipement utilisable pour dialoguer avec l’équipement selon ledit protocole ;
• au moins un élément de sécurisation de connexion (comme un identifiant d’accès, un mot de passe, une clé publique ou privée etc..) ;
• des paramètres complémentaires spécifiques à certain(s) protocoles(s) (comme un « topic » dans le cas du protocole MQTT ou une URL dans le cas du protocole OPC-UA) ;
• une combinaison d’au moins deux des informations de communication ci-dessus.

The information required to establish communication between the first device and the equipment (in addition to identification information) includes, in particular, at least one of the following pieces of information, known as communication information:

• information designating a protocol that can be used to communicate with the equipment;
• a port on the equipment that can be used to communicate with the equipment according to said protocol;
• at least one connection security element (such as an access ID, a password, a public or private key, etc.);
• additional parameters specific to certain protocol(s) (such as a "topic" in the case of the MQTT protocol or a URL in the case of the OPC-UA protocol);
• a combination of at least two of the above communication information.

Examples of protocols include hierarchical protocols, using standardized data structures, such as the Open Platform Communications Unified Architecture (OPC UA) Modbus protocol, or non-hierarchical protocols such as MQTT or Direct UDP.

• un libellé textuel ;
• une information dite d’adressage relative à un emplacement à au moins une de ces données (comme une ou plusieurs adresses, une plage d’adresses, une désignation d’un ou plusieurs registres, etc.) ;
• une indication d’un type d’au moins une de ces données (booléen, entier, etc.) ;
• une information relative à une taille mémoire d’au moins une de ces données ;
• une information relative à une structure d’au moins une de ces données ;
• une clé de décryptage d’au moins une de ces données ;

• un intervalle de temps entre deux accès à au moins une de ces données (par exemple une durée minimale, maximale, ou nominale entre deux accès) (par exemple de l’ordre de quelques millisecondes ou de quelques secondes comme 100 ms, 1 s, 2s, ou 5s ) ;
• une information temporelle (heure, plage temporelle etc..) limitant l’accès à un au moins une de ces données ;
• une combinaison d’au moins deux des informations descriptives de données ci-dessus.

The information describing the data (location, size, type, structure, etc.) that the first device must access on the equipment or that the equipment is likely to provide to the first device includes, in particular, for at least one protocol used, at least one of the following descriptive data pieces of information:

• a textual label;
• addressing information relating to a location with at least one of these data (such as one or more addresses, a range of addresses, a designation of one or more registers, etc.);
• an indication of the type of at least one of these data (boolean, integer, etc.);
• information relating to the memory size of at least one of these data points;
• information relating to a structure of at least one of these data;
• a decryption key for at least one of these data points;

• a time interval between two accesses to at least one of these data (for example a minimum, maximum, or nominal duration between two accesses) (for example on the order of a few milliseconds or a few seconds such as 100 ms, 1 s, 2s, or 5s);
• temporal information (time, time range etc.) limiting access to at least one of these data points;
• a combination of at least two of the above descriptive data information.

Note that the information describing data may vary depending on the protocol(s) used.

In some embodiments, the time interval between two accesses may vary depending on the data concerned, for example according to the expected frequency of variation of this data (so as to access more frequently the data likely to vary most often than other data varying less frequently), or according to the criticality of the data (so as to access more frequently the most critical data, the variation of which may reflect an alarming situation).

A time limit on equipment data access can, for example, prevent access to equipment data at times when such access could negatively impact the equipment's performance (e.g., by adding a processing load to the equipment during periods of high usage). In some embodiments, a time limit on equipment data access can also exclude access during periods (such as nighttime or weekends) when the equipment is not in use and therefore data relating to its operation would be insignificant and/or unlikely to change. Such an embodiment can help conserve the equipment's and/or the first device's CPU resources and thus limit their energy consumption. A time limit on equipment data access can also prevent access to equipment data at times when the data would be inaccessible or inconsistent (e.g., during scheduled equipment updates).

Note that the information describing data included in the description may

only concern some of the data accessible for reading from said equipment.

Such an embodiment can thus filter the data from a piece of equipment accessible to said first device. Therefore, in certain embodiments, it may be possible to choose (or filter) the data that can be obtained from a portion other than the protected portion, so as, for example, to avoid providing confidential data.

Some of this identification, communication, and/or data-describing information may be optional in certain embodiments. For example, communication information such as connection security elements may be absent when access to the equipment is not restricted within the first portion. Furthermore, some of the data-describing information may depend on the protocol(s) specified in the communication information.

An example of a description is presented below. In this example, for simplicity, the description only concerns a single piece of equipment to be protected and describes several protocols.

config_version: 1.0

config_date: 2023-05-04

modules:

"Modbus 1":

type: modbus

IP address: 192.168.0.5

port: 9400

interval: 1

registers:

- 0-105

coils:

- 0-1

"SiemensTest":

type: opcua

IP address: 192.168.0.5

endpoint: 'opc.tcp://192.168.0.5:4840/endpoint'

interval: 1

nodes:

- 'ns=1;s=UI-A@supervision|exports-4-0-4statistics-1:sigma2'

- 'ns=2;i=1234'

"Opc-UA server test":

type: opcua

IP address: 192.168.0.20

endpoint: 'opc.tcp://192.168.0.20:4840/endpoint'

auth:

username: 'admin'

password: 'admin'

nodes:

- 'ns=1;s=UI-A@supervision|exports-4-0-4statistics-1:sigma2'

- 'ns=2;i=1234'

"Siemens S7":

type: opcua

IP address: 192.168.0.10

endpoint: 'opc.tcp://192.168.0.10:4840/endpoint'

auth:

caCert: '/certs/truc.pem'

privateKey: '/certs/private.key'

interval: 1

nodes:

- 'ns=1;s=UI-A@supervision|exports-4-0-4statistics-1:sigma2'

- 'ns=2;i=1234'

"MqttBroker":

type: mqtt

IP address: 192.168.0.50

port: 1883

auth:

username: 'admin'

password: 'admin'

topics:

- '#'

In some embodiments, the description can, for example, be obtained by accessing a storage area accessible to the first device (such as a local storage area on the first device or located in the first segment of the network, or a removable storage area (such as a USB flash drive) connected to the first device or accessible via a serial connection on a micro-USB port of the first device). This could include a micro-USB port inaccessible to a third party when the casing of the electronic assembly containing the first device is closed.

In some embodiments, the description can be created, or completed, dynamically (and at least partially automatically) by the device itself.

In such an embodiment, the process may include a scan of the first portion to discover the devices present in that portion, followed by at least one attempt to connect to those devices using one or more candidate protocols (depending on the embodiment). When a connection attempt is successful, at least one protocol used by the equipment is detected. In some embodiments, the scan may use a protocol that associates the network layer protocol address (typically an IPv4 address) of a remote host with its link layer protocol address (typically a MAC address), such as the Address Resolution Protocol (ARP). For example, the scan may test all IP addresses (from 0.0.0.0 to 255.255.255.255) to discover the machines present, including those located in a subnet of the first portion.

Once the machines are identified, the process may include scanning open ports and testing connections with supported protocols.

Connection attempts may optionally use additional elements (such as at least one port value (to discover at least one open port on the device in question) and/or additional parameters consistent with the candidate protocol(s)). Examples of candidate protocols include MQTT, UPC-UA, Modbus, UDP, etc. For example, the process might involve, for each device discovered in the first phase, a connection attempt using a set of candidate protocols defined by the device's configuration (manual or automatic).

When at least one connection attempt has been successfully made for at least one discovered device, the process may include recording the address of the discovered device in association with the protocols that enabled the connection, and any additional elements in said description.

Such an embodiment can not only create a description, but also automatically update an existing description, by adding information relating to newly discovered equipment or by modifying information in the description relating to equipment, for example to add information relating to a new protocol accepted by this equipment (following a software update of the equipment for example), or to remove the designation of a port which has become inaccessible (defective for example).

In some embodiments, the process may also include an (optional) update of the resulting description, either automatically by the first device (for example, by applying parameter rules) or by an operator via a user interface of the first device. This might involve, for example, deleting information describing certain protocols (deemed insecure, for example) or certain data (deemed too critical to allow access in certain implementations) from a description automatically created by the first device. It might also involve manually completing a description file automatically created by the first device.

As illustrated in FIG. 3 , the process may include a transmission 316 of at least a portion of the description obtained 312 to the second device.

In such embodiments, the process may include an initialization of this unidirectional communication, prior to this transmission, possibly taking into account local or remote parameter data accessible to the first device.

Transmission 316 may include the transmission of at least one piece of equipment identification information, such as an equipment address on the first portion (for example, depending on the protocol, an IP address, a MAC address, etc.). (also referred to as the addressing identifier on the first portion in this application).

It may also include at least some communication information (for example, information relating to a communication protocol and/or port) and/or some descriptive data information.

In particular, in certain embodiments, the portion of the description transmitted may include information from the description that may help the second device to "pass itself off" as the equipment, vis-à-vis devices of the second portion or external to the communication network.

In some embodiments, for example when unidirectional communication between the first and second device is implemented via at least one optocoupler, the method may include a serialization 314 of the information to be transmitted from the description before its transmission via the optocoupler.

The transmission format may differ depending on the implementation. For example, it may be in XML or JSON format. The pseudocode below illustrates, as an example, the serial transmission of the description in the case of the JSON protocol:

• mannonce le type des données transmises (ici annonce de données correspondant à un descriptif)
• descriptionest un libellé textuel annonçant la transmission d’un descriptif{JSON description}en format JSON.

{'m' : 'description', {JSON description}} where in this example

• m announces the type of data transmitted (here, an announcement of data corresponding to a description)
• description is a text label announcing the transmission of a {JSON description} description in JSON format.

As illustrated in FIG. 3 , the process may include obtaining 320 at least one of the data from said equipment, designated by the data descriptive information from said equipment, and transmitting 340 at least one of the data obtained to the second device (via unidirectional means).

The way in which equipment data is obtained may vary depending on the embodiment and in particular depending on the description obtained 312.

For example, the first device can connect to the equipment to be protected via at least one protocol described in the specification (OPC-UA, Modbus, MQTT, Ethernet, etc.) and read at least one of the data points (such as a node (for OPC-UA), a coil, or a register (for Modbus)) described in the specification. For example, during device initialization, all the equipment data described in the specification can be retrieved and transmitted to the second device.

Obtaining 320 and transmitting 350 at least one piece of data can be done several times.

This transmission 350 of at least one piece of data may be optional in certain embodiments. In such embodiments, the process may include storing 360 the data obtained (at least during the first data acquisition) and, after a further data acquisition following this first acquisition, comparing 330 the "new" value of at least one piece of data obtained with the currently stored value (i.e., with the last value previously obtained for that data). The transmission 350 and/or the storage 360 of the "new" value may then be performed conditionally, for example, only when the new value is different from the previous value.

The 350 transmission and/or 360 memorization can be performed in any order.

The transmission 350, and possibly the memorization 360, can be carried out according to the embodiments either in real time or after obtaining all the data.

Depending on the embodiment, obtaining the value of a data can be done via a query of the equipment (for example, a request to read the contents of at least one register or a storage area for such data on the equipment), and/or by receiving the value on a communication interface of the first device, at the initiative of the equipment itself (for example, via a registration (or subscription) mechanism of the first device with the equipment to receive the value of the data).

For example, in some embodiments, querying the equipment to obtain at least one data item can be done taking into account information from the description, such as a time interval required between two accesses to at least one data item and/or possible temporal information limiting access to at least one of these data items.

It should be noted that the process may, in certain embodiments (for example, when unidirectional communication between the first and second devices is implemented via at least one optocoupler), include serialization of the data to be transmitted before its transmission via the optocoupler. Such serialization can help improve the security of the process, since the data, once serialized, no longer reveals its structure and can therefore be more difficult to interpret by a malicious third party who might intercept it and not be aware of the protocol (proprietary, for example, or standard) to be used for interpretation.

The transmission format may differ depending on the implementation. For example, it may be in XML or JSON format.

For example, the following serialized data can be transmitted by the first device in a format including in the header an announcement of the type of data transmitted (protocol used or announcement of data corresponding to a description, etc.), a label identifying this type of data, as well as possible text labels or numeric code announcing the meaning of the elements that follow them.

By way of non-limiting example, the following serialized data can be transmitted by the first device in the case of the OPC-UA protocol when a connection between the first device and the equipment has been established for the first time (during or after initialization, for example):

• mannonce le type des données transmises (le protocole employé ici)
• opcuaest un libellé textuel désignant l’utilisation du protocole OPC-UA
• nsannonce la transmission des « namespaces » à créer par le second dispositif
• [ListNamespaces]désigne la liste des « namespaces » de l’équipement en format JSON

{'m': 'opcua', 'ns' : [ListNamespaces] where

• m indicates the type of data transmitted (the protocol used here)
• opcua is a textual label designating the use of the OPC-UA protocol
• ns announces the transmission of the "namespaces" to be created by the second device
• [ListNamespaces] refers to the list of equipment namespaces in JSON format.

• xannonce la transmission de nœuds à créer par le second dispositif

• [ListNodes]désigne la liste des nœuds OPC-UA, de leurs attributs et de leur valeur en format JSON

{'m': 'opcua', 'x': [ListNodes]} where

• x announces the transmission of nodes to be created by the second device

• [ListNodes] refers to the list of OPC-UA nodes, their attributes, and their values in JSON format.

According to another example, the following serialized data can be transmitted by the first device in the case of the OPC-UA protocol following a description update:

• nannonce une désignation de nœuds ajoutés ou supprimés
• ‘del’ :annonce un booléen[true/false]précisant s’il s’agit d’un nœud ajouté ou supprimé

{''m': 'opcua', 'n': [ListNodes], 'del': [true/false]} where:

• n announces a designation of added or deleted nodes
• 'del': announces a boolean [true/false] specifying whether it is an added or deleted node

According to another example, the following serialized data can be transmitted by the first device in the case of the OPC-UA protocol following an update of at least one node:

{‘m’: ‘opcua’, ‘u’: {‘node’: [Id-Node], ‘value’: [NewValue]}}

• u announces an update of at least one node
• node announces a node identifier ( [Id-Node]) and value announces the value [NewValue] of that node

In another example, the following serialized data can be transmitted by the first device after a query of the equipment in the case of the ModBus protocol:

• modbusest un libellé textuel désignant l’utilisation du protocole ModBus
• rannonce la transmission des valeurs de « registres »
• [RegisterKey],désigne la liste des registres de l’équipement et de leurs valeurs en format JSON
• rannonce la transmission des valeurs de « coils »
• [CoilKey]désigne la liste des coils de l’équipement et de leurs valeurs en format JSON

{''m' : 'modbus', 'r' : [RegisterKey], 'c' : [CoilKey]} where:

• Modbus is a textual label designating the use of the Modbus protocol.
• r announces the transmission of "register" values
• [RegisterKey] refers to the list of equipment registers and their values in JSON format.
• r announces the transmission of the "coil" values
• [CoilKey] refers to the list of coils in the equipment and their values in JSON format.

In another example, the following serialized data can be transmitted by the first device after receiving an event from the equipment in the case of the MQTT protocol related to a topic to which the first device has subscribed.

• mqttest un libellé textuel désignant l’utilisation du protocole MQTT
• tannonce une transmission relative au topic[Topic]et
• plannonce une transmission du contenu[payload]du message reçu

{'m': 'mqtt', 't': [Topic], 'pl': [payload]} where:

• MQTT is a textual label designating the use of the MQTT protocol.
• t announces a transmission related to the topic [Topic] and
• pl announces a transmission of the content [payload] of the received message

According to another example, the following serialized data can be transmitted by the first device after receiving a UDP packet from the equipment:

{‘m’: ‘direct’, ‘p’: [packet]}

• direct is a text label designating the use of the UDP protocol
• p announces the transmission of a network packet [packet] in Base64 format.

Serializing the data before transmission may be optional in some embodiments. For example, when communication between the equipment and the first device, such as unidirectional communication, uses an Ethernet link (without selecting a specific protocol), the data from the equipment can simply be retrieved and transmitted as network packets. In other words, it can be a simple data transfer from the protected equipment to the second device.

There FIG. 4 illustrates some embodiments of the data supply method 400 of this application. The method 400 can, for example, be implemented by a second device located in a portion of a communication network that is completely separate from a protected portion of that network, such as the second device 164 of the electronic assembly 160 of the system 100.

Similar to what was described above for process 300 implemented with the first device, process 400 can be implemented, according to the embodiments, during the start-up of the second device, or later, and can include, as illustrated in FIG. 4 , a so-called initialization phase 410 (during a device start-up for example or later, upon receipt of a user command for example).

This initialization phase 410 includes obtaining 416 a description of data that the second device will receive. This data will originate from equipment located in a "first" protected portion of the network, inaccessible to the second device. It will be received via unidirectional communication established with a first device, and via this first device

In some embodiments, the description can be obtained 416 by reception, via unidirectional communication between the first and second devices. In such embodiments, the process may include initialization 412 (and/or establishment) of this unidirectional communication prior to this reception, possibly taking into account local or remote parameter data accessible to the second device. The process may also include deserialization 414 of the received data (if this data was serialized before its transmission to the second device).

In some embodiments, the resulting description 416 may be identical to the description described in connection with the process 300 implemented in the first device. For example, both descriptions may be obtained 312, 416 by copying the same removable storage medium, or the second device may receive from the first device the entire description that the first device itself previously obtained 312. In such embodiments, the description of the second device may then contain certain information not useful to the second device (such as a password, or a public or private key necessary for connecting to the equipment from which the data originates). Such an embodiment can offer advantages in terms of ease of processing (on the side of the first device) and/or ease of configuration, and therefore time savings, on the side of the second device, since it is not necessary to provide a specific "description" for the second device.

In other embodiments, the description of the second device may differ from that previously obtained for the first device. In particular, certain information contained in the description previously provided by the first device may be omitted from the description of the second device.

The description obtained 416 by the second device may include information identifying the equipment from which the data originates, and in particular the address of the equipment on the first portion of the network.

The description obtained 416 may include information describing the data (location, size, type, structure, etc.) that the second device is likely to receive from the first device, similar for example to those described in connection with the process implemented by the first device, some information (such as a time interval between two accesses or temporal information limiting access to at least one piece of data) may be omitted.

In certain embodiments, for example depending on the unidirectional communication means implemented between the first and second devices, the resulting description 416 may also include information necessary for establishing unidirectional communication from the first device to the second device. This information may be optional, particularly when it is otherwise accessible to the second device, for example via device configuration data (and has, for example, been previously used to initiate unidirectional communication between the two devices as mentioned above).

Optionally, the description may also include information relating to the output format of at least some of the data before it is provided to a third-party device.

In some embodiments, as explained above, the description can be received from the first device. In other embodiments, the description can be obtained by accessing a storage area accessible to the second device (such as a local storage area on the second device or accessible from the second part of the network, or a removable storage area (such as a USB key) attached to the second device).

Similar to what has been described in connection with the protection process 300, in some embodiments the supply process 400 may include an (optional) update of the description obtained 416, either automatically by the second device or via a user interface of the second device, to delete some information from the description or add new information.

As illustrated in FIG. 4 The method may include obtaining 420 the value of at least one piece of data from the protected equipment. This obtaining may include receiving 422 the value of at least one piece of data via unidirectional communication between the first device and the second device. Furthermore, when the data received 422 by the second device is serialized, the method may include deserializing 424 the data. This deserialization may, for example, use the information from the obtained description 416 (in particular, descriptive data information) to recover the structure of the data before its transmission by the first device. The method may include storing the obtained data in a manner consistent with the descriptive data information obtained. For example, in some embodiments, this may involve storing the data in the same way as it is stored on the equipment (same address(es), same size, etc.). In other embodiments, it may involve storing it in a different form (for example, compressed, so as to save memory).

The process may also include transmitting at least some of the obtained data to a third-party device (at the request of that device and/or upon the device's subscription to updates of that data, for example). This transmission may be preceded by transcoding (for example, decompression) when the data to be transmitted is stored in a form (format, structure, etc.) different from that in which it is stored on the protected device.

In some embodiments, the description obtained 416 by the second device may include, in addition to the information necessary for the second device to obtain and process the equipment data, other information. For example, the description obtained may include, in addition to the equipment address on the first segment of the network, certain other information necessary for establishing communication with the equipment, such as information designating a protocol that can be used to communicate with the equipment, a port on the equipment that can be used to communicate with the equipment according to this protocol, and additional parameters specific to certain protocol(s). Depending on the embodiment, this information may be identical to that contained in the description described in connection with method 300 of the FIG. 3 , or information deduced from at least some of the information contained in the description obtained 312 by the first device.

For example, the description may include the information necessary for the second device to receive third-party device solicitations intended for the equipment, and to respond to them as if those responses originated from the equipment.

In particular, the description may include the equipment's address on the first segment, and the method may involve assigning the second device an address on the second segment identical to that of the equipment on the first segment. Such embodiments can thus help a communication network administrator to have a "plug and play" solution. Therefore, the insertion of the electronic assembly into the network, for the purpose of protecting a piece of equipment, can be transparent to other devices already present on the network and may not require modifying the routing (or addressing) plan of the entire network or modifying the software of any of the third-party devices wishing to obtain data from the equipment.

For example, in some embodiments, the electronic assembly can be installed in an existing network containing equipment that is (newly) to be protected. When the electronic assembly is installed in such a way as to be able to communicate (for example, via a wired connection) with the equipment to be protected, thus constituting a first portion of the network (comprising at least the equipment and the first device), a network operator may not need to take any action (apart from this installation). The equipment data described in the specification can be automatically duplicated on the second device, and thus made accessible outside the first, protected portion of the network via an address on the second device identical to that of the equipment. As a result, devices and software outside the protected portion of the network can continue to access the equipment data without changing the access routine they used before the electronic assembly was installed to protect the equipment. Indeed, from the perspective of these devices and software, the connection can be identical to a direct connection with the equipment.

This application proposes an electronic assembly that, at least in some of its embodiments, provides a simple and efficient solution for securely transmitting data from an industrial machine connected to a public network such as the Internet. In particular, in at least some embodiments, the configuration of at least one of the first and second devices of the electronic assembly can be easy (especially when automated), and either device of the electronic assembly can be used with several different protocols, thus offering a solution adaptable to various industrial environments.

In some detailed embodiments related to Figures 3 and 4, the first device and a second device can be adapted to communicate according to several protocols with, respectively, at least one piece of equipment to be protected and at least one third device.

In one variant (illustrated in FIG. 5 ), the first device and the second device can communicate respectively with equipment to be protected and a third-party device with a single protocol.

In one variant, the first device can select the second device with which to communicate according to unidirectional communication based on the protocol used to communicate with equipment to be protected (system 100 for example comprising several "second devices" using different protocols respectively to communicate with third-party devices.

In another variant, several "first devices" can communicate with the same second device, the latter being able, for example, to have several different addresses, each chosen to correspond to that of a piece of equipment to be protected received from one of the first devices.

There FIG. 5 This document presents an example of an implementation of the solution described in this application for protecting three devices. In the illustrated example, each device uses a different communication protocol and is protected by an electronic assembly (smart diode) according to the invention, specific to that protocol. The data made available by a smart diode on an exposed portion of the network (interconnected with the internet) can be used (querying, subscribing, etc.) by network monitoring devices.

The solution presented in this application can find applications in numerous fields, particularly in areas that are prime targets for cyberattacks. For example, in the manufacturing industry, the solution described in this application can help protect industrial machinery (preventing corruption, for instance) by blocking access to certain sensitive data on these machines, such as data relating to the industrial processes implemented, while making other data (such as production data) available to monitoring and control applications.

Another example of implementation concerns the field of distribution. The solution that is the subject of this application can indeed be used to help protect electronic point-of-sale equipment, by limiting access to data stored on this equipment, such as sales data and/or sensitive customer information.

Yet another example of implementation concerns the field of finance (banking, financial services) and in particular the handling of sensitive financial and personal information, which the solution subject to this request can help to protect from attacks (while offering possibilities of access to other, less sensitive data for example).

The solution that is the subject of this application may also find applications in the field of health, to protect sensitive medical data of patients while allowing access to at least some of this data to health professionals.

Claims (12)

A method for protecting equipment in a communication network partitioned into a plurality of portions comprising at least a first portion, including said equipment, and at least a second portion interconnected with said first portion via a first electronic device and a second electronic device in unidirectional communication, so as to permit only communications from the first device to the second device, said method comprising:

• a transmission to said second device of an addressing identifier for said equipment on said first portion of said communication network;

• during a communication between said equipment to be protected and said first device, obtaining the current value of at least one data point of said equipment;
• a transmission to said second device, via said unidirectional communication, of the current value obtained.

A protection method according to claim 1 comprising obtaining a description relating to said equipment to be protected and comprising at least:

• said addressing identifier of said equipment to be protected on said first portion of said communication network;
• a designation of at least one communication protocol with said equipment;
• said addressing information of at least one piece of data of said equipment accessible for reading via said equipment.

A protection method according to claim 2 comprising transmitting to said second device information identifying said protocol. A protection method according to claim 2 or 3 wherein said description is obtained dynamically by said first device by scanning said first portion. A protection method according to any one of claims 1 to 4 comprising, upon updating at least one first of said at least one accessible data, a transmission to said second device, via said unidirectional communication, of said updated value. A protection method according to any one of claims 1 to 5 wherein said current value and/or update of said first data is obtained by querying said equipment. A protection method according to claims 2 and 6, wherein said interrogation of said equipment is carried out several times and wherein a time interval between two successive interrogations of said equipment takes into account a time information included in said description. A method for supplying data from at least one piece of equipment in a communication network partitioned into a plurality of portions comprising at least a first portion, and at least a second portion interconnected with said first portion via a first electronic device and a second electronic device in unidirectional communication, so as to permit only communications from the first device to the second device, said method comprising:

• an assignment to said second device, as an addressing identifier on said second portion of said network, of at least one addressing identifier, on said first portion of said communication network; of at least one piece of equipment on said first portion;

• upon receipt of a request having as its destination address said addressing identifier and relating to at least one first piece of data of said equipment, a transmission of a value of said at least one first piece of data, previously obtained via said unidirectional communication, to a sender of said request.

A method for supplying data according to claim 8, said method comprising:
obtaining a description relating to at least one piece of equipment on said first portion of said communication network, including said at least one addressing identifier for said at least one piece of equipment on said first portion of said communication network. Supply method according to claim 9 wherein said description is obtained via said one-way communication. Supply method according to claim 9 or 10, wherein said description comprises:

• a designation of at least one communication protocol with said equipment;
• a designation of at least one addressing information of at least one data item of said equipment accessible for reading via said equipment of said first portion of said network;

and where said request is received according to said protocol and relates to said addressing information. An electronic assembly of a communication network partitioned into a plurality of portions comprising at least a first portion, including equipment to be protected, and at least a second portion interconnected with said first portion via a first device of said electronic assembly and a second device of said electronic assembly in unidirectional communication with the first device of said electronic assembly, via unidirectional communication means of said electronic assembly so as to permit only communications from the first device of said electronic assembly to the second device of said electronic assembly, said at least a first device of said electronic assembly comprising at least a first processor configured to:

• a transmission to said second device of an addressing identifier for said equipment on said first portion of said communication network;
• during a connection (or communication) between said equipment to be protected and said first device, obtaining the current value of at least one data point of said equipment;
• a transmission to said second device, via said unidirectional communication, of the current value obtained.

And said at least one second electronic device comprising at least one second processor configured to:

• an assignment to said second device, as an addressing identifier on said second portion of said network, of at least one addressing identifier, on said first portion of said communication network, of at least one piece of equipment on said first portion;

• upon receipt of a request having as its destination address said addressing identifier and relating to at least one first piece of data of said equipment, a transmission of a value of said at least one first piece of data, previously obtained via said unidirectional communication, to a sender of said request.