Secure system for interconnection between two public networks

• US 8,959,612 B2
• Filed: 05/20/2011
• Issued: 02/17/2015
• Est. Priority Date: 05/21/2010
• Status: Expired due to Fees

• Current Assignee: Thales SA
• Original Assignee: Thales SA
• Inventors: DeBaille, Suzanne, Touyet, Stphane
• Primary Examiner(s): HERZOG, MADHURI R
• Application Number:
  US13/699,591
• Publication Number:
  US 20130205384A1
• Time in Patent Office: 1,369 Days
• Field of Search: 726 11- 14, 709217-237
• US Class Current: 726/13
• CPC Class Codes: H04B 7/18508 with satellite system used as relay, i.e. aeronautical mobile satellite service
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 41/0663 Performing the actions predefined by failover planning, e.g. switching to standby network elements
• CPC Class Codes: H04L 41/40 using virtualisation of network functions or resources, e.g. SDN or NFV entities
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215

Abstract

A secure interconnection system between two public networks comprises at least one first router, a first firewall, a second router, a second firewall and a blade server, and a first virtual local area network containing the data streams exchanged between a first communications facility and a second communications facility, a second virtual local area network containing the management and maintenance streams of said system which are exchanged between a supervision center and the blade server and a third virtual local area network containing the authentication streams for said first communications facility which are exchanged between the said second firewall and said blade server, said virtual local area networks being designed so as to exhibit an empty intersection.

Claims

1. A secure interconnection system between a first public communications network and a second public communications network, where a first communications facility is linked directly to the first public network communicating and a second communications facility is linked directly to the second public network, the system comprising:

a first router configured to receive at least one communication stream from the first public communications network, to which the first router is connected, the at least one communication stream destined for the second public communications network, and the at least one communication stream comprising a data stream and a signaling stream,

a first firewall directly connected to the first router and configured to separate, within the at least one communication stream, the data stream and the signaling stream,

a second router configured to receive only the data stream from the first firewall and to transmit the data stream to the second public communications network to which the second router is connected,

a second firewall configured to receive only the signaling stream from the first firewall to which the second firewall is directly connected,

a blade server configured to receive only the signaling stream from the second firewall to which the blade server is directly connected,

a first virtual local area network comprising the data stream exchanged between the first communications facility and the second communications facility,

a second virtual local area network comprising management and maintenance streams of said secure interconnection system which are exchanged between a supervision center and the blade server, and

a third virtual local area network comprising authentication streams for the first communications facility which are exchanged between the second firewall and the blade server,

wherein the first virtual local area network, the second virtual local area network, and the third virtual local area network exhibit an empty intersection,

wherein the second firewall is further configured to filter packets within the signaling stream as a function at least of a port number of the packets, and

wherein the second firewall is further configured to allow secure access to the blade server from the supervision center or a test platform.

2. The secure interconnection system according to claim 1, wherein:

the blade server further comprises at least one authentication server configured to authenticate the first communications facility and to authorize opening of a connection between the first communications facility and the second communications facility, and

the secure interconnection system further comprises;

a capture server configured to capture the signaling stream, and

a supervision server configured to monitor a state of connections and operation of the secure interconnection system in real time.

3. The secure interconnection system according to claim 2, wherein the at least one authentication server is configured to implement a RADIUS authentication protocol to centralize the authentication streams.

4. The secure interconnection system according to claim 3, wherein the supervision server is configured to analyze the state of the connections based on information regarding the authentication and openings of connections within the authentication server.

5. The secure interconnection system according to claim 4, further comprising a fourth virtual local area network configured to transmit, between the supervision server and an external platform, streams relating to the analysis of the state of the connections.

6. The secure interconnection system according to claim 1, wherein the first public communications network is a satellite network and the first communications facility is situated aboard an aircraft.

7. The secure interconnection system according to claim 1, wherein the second public network is a terrestrial network.

8. The secure interconnection system according to claim 1, wherein the first communications facility and the second communications facility are duplicated for redundancy.