Orange

France Telecom

Christian Jacquenet

Mohamed Boucadair

David Binet

Gilles Bourdon

A method for managing communications in accordance with a given transport protocol. The method is implemented by a first device and includes, following detection of a cyber attack, activating, in the first device, collaboration with at least one entity of the network in order to mitigate the cyber attack, this collaboration including execution, by the first device, of at least one determined action, called collaboration action, during at least one the communication of the first device in accordance with the given transport protocol, via the network.

Communication management method and associated devices

A method for verifying validity of an IP resource associated with a client domain, implemented in an access control server. The method includes: receiving a list of at least one IP resource associated with the client domain, transmitted from a client node of the client domain to the access control server; selecting at least one IP resource to be validated from the list; and verifying the validity of the at least one selected IP resource.

Methods for verifying the validity of an IP resource, and associated access control server, validation server, client node, relay node and computer program

A method for configuring a user apparatus and implemented by the user apparatus. The method including: deactivating, for at least one encrypted communication of the user apparatus with a remote device via a network, at least one encryption procedure selected by the user apparatus and implemented with a first entity of the network involved in routing data exchanged between the user apparatus and the remote device during the encrypted communication, the data being subject to at least one other encryption procedure separate from the at least one deactivated encryption procedure.

Methods for configuring a user apparatus, negotiating with a network entity, and managing a connection, and associated devices

A method for managing communication between a first terminal and a second terminal in a communication network is disclosed. The method includes, at the first terminal: discovering at least one proxy node between the first terminal and the second terminal, the proxy node being capable of providing at least one service for the communication, and if the first terminal accepts the service, sending to the second terminal, in an establishment phase or during the communication, an encrypted proxy information message containing data identifying the at least one proxy node and a token intended to be provided to the second terminal by the at least one proxy node.

Method for managing communication between terminals in a communication network, and devices for implementing the method

A method for allocating an identifier to a first client node of a client domain, the first client node managing traffic associated with the client domain to protect it against a computing attack. The method includes: receiving a request for allocating a client node identifier from the first client node, the request including information identifying the client node; obtaining a list of client node identifiers already allocated to the client nodes active at least in the client domain; allocating to the first client node a client node identifier not belonging to the list obtained; recording in a local memory an association between the allocated identifier and the information; sending a response to the first client node, including the allocated identifier; and sending a request for recording the identifier allocated to the first client node in the domain to a traffic management server associated with the domain.

Method for allocating an identifier to a client node, method for recording an identifier, corresponding device, client node, server and computer programs

A method for sending an information item allows reputation management of IP resources in a set of networks including at least a first network and a second network. The method is implemented by a device of the first network, called an 'emitter device', an includes a step in which the emitter device sends to a device of the second network, called a “receiver device”, an information item representative of a prefix size of an IP address assigned to an equipment item connected to the first network.

Method for sending an information item and for receiving an information item for the reputation management of an IP resource

Managing assistance to a communication network capable of routing traffic characteristic of a computer attack is disclosed. A method includes upon detecting a computer attack, identifying at least a first node of the network, requiring a mitigation intervention, and identifying a traffic routing policy in the network; controlling a movement of at least one mobile object comprising at least one communication interface, so as to connect the mobile object to at least a second node of the network determined relative to the first node according to the traffic routing policy; and controlling at least part of the traffic routed by the network, so as to redirect the part of the traffic to the mobile object via at least the second node of the network.

Mitigating computer attacks

A method for coordinating mitigation of a cyber attack, an associated device and system. The coordination method is implemented by a device managing resources in a computing domain, wherein the resources are protected by a plurality of services protecting against cyber attacks. The method includes: producing mitigation plans implemented by protection services from the plurality of protection services in response to a cyber attack targeting at least one of the resources in the computing domain; and following a detection of at least one incompatibility between the mitigation plans produced, coordinating an adjustment to all or some of the incompatible mitigation plans, among the protection services that have implemented the incompatible mitigation plans, so as to eliminate the incompatibility.

Method for coordinating the mitigation of a cyber attack, associated device and system

A method of automatic setup by a first device of a session complying with a dynamic routing protocol with a second device. The setup method includes, subsequent to detection by the first device of existence of a connectivity with the second device, the first device being associated with a first autonomous system number and not knowing any autonomous system number associated with the second device: an exchange with the second device including announcement to the second device of the first autonomous system number, and discovery of a second autonomous system number with which the second device is associated; or allocation to the second device of a third autonomous system number and announcement to the second device of the third autonomous system number which has been allocated to it; and setup with the second device of a session according to the routing protocol by using the autonomous system numbers exchanged.

Method of automatic setup by a first device of a session complying with a dynamic routing protocol with a second device

A method for protecting a client domain, for example against a computing attack, implemented in a client node of the client domain. The method includes: discovering at least one other client node of the client domain, called a discovered node; detecting a conflict between at least two management rules for the traffic associated with the client domain; and resolving the detected conflict, including: if one of the rules was installed by a the discovered node, modifying the rule or a state associated with the discovered node; and otherwise, obtaining, from a the discovered node, an item of information for identifying at least one node of the client domain that installed one of the rules; and detecting and/or resolving the conflict using information obtained during the discovery of the at least one other node of the client domain.

Methods for protecting a client domain, corresponding client node, server and computer programs

A method of collaboration between protecting services associated with one or more domains. Such a method includes: getting a first agent used by a first protecting service to identify an attack on at least one resource managed by a domain protected by the first protecting service; and transmitting, to at least one second agent used by a second protecting service having taken out a subscription to at least one information-sharing service offered by the first protecting service, at least one piece of information relating to the attack identified by the first agent.

Method of collaboration and for requesting collaboration between protecting services associated with at least one domain, corresponding agents and computer program

A method for managing a communication according to a transport protocol of a terminal equipment in a communication network. The method includes: detecting presence, on a path allowing the terminal equipment to be reached on a second IP address of the terminal equipment, of a status function which maintains a status associated with a communication on the path, including transmitting a first message from a first IP resource of the terminal equipment, including a first IP address and a first port number, to a second IP resource of the terminal equipment, including the second IP address and a second port number, and deciding on presence of a status function on the path according to data received by the second IP resource in response the first message; and managing a communication of the terminal equipment on the path allowing the terminal equipment to be reached on the second IP address.

Method for managing at least one communication of an item of terminal equipment in a communication network, methods for processing a communication established with an item of terminal equipment in a communication network, corresponding devices, item of terminal equipment, item of proxy equipment and computer programs

A method for configuring a first network node using a first autonomous system (AS) number in at least one session established with another node according to a dynamic routing protocol is described. The method is implemented by the first node and includes receiving a configuration message comprising at least one piece of information that is representative of a second AS number intended to be used by the first node as a replacement for the first number, configuring the first node with the second AS number, identifying at least one second node having at least one session according to the dynamic routing protocol, active with the first node, in which the first node is associated with the first AS number, and sending a control message to the at least one second node requesting the replacement of the first AS number with the second AS number by the at least one second node, such that, after the replacement, the first node is associated with the second AS number in the at least one active session.

Method for configuring a network node

A configuration method includes: receiving, by a first device of a network, a first control message having configuration elements for activating a dynamic routing protocol in the network; configuring by the first device setup parameters for establishing sessions according to the protocol used by the first device on the basis of configuration elements included in the first message; if the configuration elements in the message include a management instruction for handling sessions according to the protocol in the network, executing by the first device the at least one management instruction; and if the configuration elements in the message include a setting for directing propagation of the configuration elements in the network, dispatching by the first device in accordance with the propagation setting at least one second control message to at least one second device of the network, which includes all or some of the configuration elements.

Configuration method for implementation in a network using a dynamic routing protocol

A method for managing traffic associated with a client domain, implemented in a server. The method includes: detecting a communication problem between the server and at least one first client node of the client domain, called failed node, identifying at least one second client node belonging to the client domain, verifying if a session between the server and the at least one second client node is active, and if no session is active: triggering a mitigation procedure on at least one IP resource associated with the client domain if at least one session is active: the use of the second client node associated with the at least one active session, called active node, to initiate an action managing the traffic associated with the client domain.

Growing community of inventors

Pont-Pean, France

Christian Jacquenet