Alcatel Lucent

Alcatel

Sagem Defense Securite

Laurent Clevy

Olivier Marce

Antony Martin

Yacine El Mghazli

Bruno Mongazon-Cazavet

Damien Galand

Guillaume Ivaldi

Samuel Dubus

Jeremy Briffaut

Anula Sinnaya

Thierry Legras

Benjamin Venelle

Carlo Drago

Gwenael Bras

Christian Toinard

Claude Muller

Laurent Cosson

Jérémy Briffaut

A method and system for authenticating a user to provide access to a secure application configured on a mobile device are disclosed. The method includes receiving an input from the user. The input is associated with a plurality of parameters. The method includes extracting a biometric pattern based on the input. The biometric pattern may be generated from the plurality of parameters associated with the input. The method may include comparing the biometric pattern with a plurality of reference patterns. The plurality of reference patterns are pre-defined by an owner of the mobile device. Furthermore, the method may include authenticating the user when the biometric pattern matches a reference pattern associated with the secure application from the plurality of reference patterns. Moreover, the method includes allowing the user to access the secure application, based on the authentication.

Mandatory protection control in virtual machines

An exemplary technique is provided for detecting a hijacking of computer resources, located in an internal network implementing security criteria and confidentiality criteria specific to the internal network, connected to an external network with no security criteria and confidentiality criteria, through a connection managed by a service provider. The technique includes storing, at the internal network, a connection parameter implemented by the computer resources to communicate with the external network; processing, at the internal network, the stored connection parameter based on an irreversible function to generate a unique code that corresponds to the stored connection parameter but which does not allow the identification of the stored connection parameter from the corresponding generated unique code; and sending, at the internal network, the generated unique code to a server located on the external network so that the server can analyze an activity of the computer resources from the unique code and detect any hijacking of the computer resources.

Method for detecting the hijacking of computer resources

A technique is provided for detecting unauthorized use or abnormal activities of a targeted system of a network. The technique includes a comparison of captured data that relates to a targeted system with attack signatures to generate a security alert when the captured data and an attack signature match, a comparison of assurance metrics data from a monitored targeted perimeter with assurance references to generate assurance information when the assurance metrics data and an assurance reference match, a generation of a verified security alarm when the security alert and associated preconditions match a corresponding assurance information, a filtering of the security alert when no match has been found between the associated retrieved preconditions and the corresponding assurance information, and an emitting of a non verified security alert when no preconditions have been retrieved for the security alert and/or no assurance reference corresponding to the preconditions has been defined.

Intrusion detection method and system

A method for reserving resources in a packet communication network, preferably an IP protocol network. The method includes sending an active packet containing a request for reservation of resources for an active data flow, receiving the packet by an active node in the network, and reserving resources of the node according to the request. In this method, an active packet communication network node, in particular an IP active router, reserves resources for processing data of an active data flow according to a resource reservation request for this active data flow contained in this active packet received by the node.

Active medium for reserving resources in a communication network

A device (D) is dedicated to controlling the transfer of units of connection time for a communication network (N) having accounting and/or billing equipment (ABE). This device (D) includes processing means (PM) that, when they receive a request to transfer a chosen quantity of units of connection time to a beneficiary account associated with the communication identifier of a first communication terminal (BT) connected to a communication network (N), responsible for accessing a first set of accounting and/or billing equipment (ABE) managing the account of a donor associated with the communication identifier of a second communication terminal (DT) connected to the communication network (R), to verify whether the quantity of units of connection time that the donor's terminal (DT) has is at least equal to the chosen quantity, and if so, to order the first set of equipment (ABE), which also manages the beneficiary's account, to transfer in real time a quantity of units of connection time at most equal to the quantity chosen from the donor's account to the beneficiary's account.

Control device to transfer units of connection time between donor and beneficiary terminals of communication network(S)

A security-procuring method for making an item of communications equipment (E) secure, said item of communications equipment comprising an operating system core (K) and a set of software applications (A), said core including at least one IPv6 protocol stack (PS) making it possible to transmit incoming data packets from an input port (P) to an application (A) and to transmit outgoing data packets from an application (A) to an output port (P), said protocol stacks including a set of interfaces (H, H, H, H) organized to enable external modules connected to them to access said data packets transmitted by said at least one protocol stack at determined points associated with said interfaces. Said method is characterized in that an input module (M) and an output module (M) are connected respectively to an input interface (H) and to an output interface (H) of said core (K), and in that said modules select, analyze, and, if necessary, modify the data packets of the Network Discovery Protocol (NDP), in compliance with the Secure Neighbor Discovery (SEND) mechanism.

Secure communications equipment for processing data packets according to the send mechanism

We describe an active node, which receives an active message containing an active application identifier, transmits the active application identifier to an active applications server. receives associated code from the active applications server, and executes the associated code. The active node also may transmit to the active applications server information relating to its own environment, and information relating to whether it is an edge node or core node in the network, enabling the active applications server to determine the associated code to return to the active node.

Taking account of information relating to the environment of active nodes when determining the code associated with an active application

Example embodiments disclose a prefix assignment device for use in network equipments of an Internet Protocol communication network, the device including a processing module. The processing module of the prefix assignment device may determine a node Nj associated with an unassigned prefix Pj of length L(Pj) equal to L(Rk)&#x2212;m. The processing module may also assign prefix Pj to the network equipment Rk if m is equal to 0 and/or perform successive m loops if m is greater than 0. The module may select one of the two prefixes with lengths equal to L(Rk) for assignment to the network equipment Rk.

Growing community of inventors

Chartres, France

Laurent Clevy