Secure transmitting method, a system, a firewall, and a router using the method

1. A method of transmitting data packets from an external network to a secure network, the method comprising: interconnecting the secure network and the external network via a firewall, providing said firewall with a first interface with the external network and with a second interface with the secure network, providing, by said firewall, over said second interface, a plurality of virtual interfaces, storing, in said firewall, associations between items of specific information of the firewall and said virtual interfaces, storing in said secure network, associations between items of specific information of the firewall and said virtual interfaces, connecting the second interface of the firewall to a router of the secure network, and:

a) determining, by the firewall, whether to authorize the transmission of a packet received from the external network to the secure network on the basis of predefined security criteria, the received packet comprising source and destination IP addresses and source and destination ports;

b) if the received packet is authorized, selecting, by the firewall, an item of specific information to be communicated to the secure network by way of the unmodified contents of the authorized packet, wherein an association between the selected item of specific information and a virtual interface is stored in the firewall and in the secure network;

c) determining, by the firewall, said virtual interface from said plurality of virtual interfaces, as a function of the item of specific information selected on the basis of said association;

d) transmitting, by the firewall, the unmodified authorized packet via the determined virtual interface;

e) on reception of the unmodified authorized packet in the secure network, deducing, by said router of the secure network, said item of specific information from the virtual interface through which the unmodified authorized packet is received, on the basis of said association; and

f) routing by said router, the unmodified authorized packet as a function notably of the item of specific information deduced in step e).

2. A method according to claim 1 , wherein the secure network provides different types of service each associated with one or more units of the secure network and wherein each item of specific information corresponds to one of said different types of service.

3. A method according to claim 1 , wherein a virtual physical address is associated with each virtual interface and wherein, in step d), the authorized data packet is transmitted via a protocol layer indicating the virtual physical address associated with the virtual interface determined in step c).

4. A method according to claim 1 , wherein step b) is executed on the basis of data relating to said packet and predefined parameters.

5. A method according to claim 1 , wherein the secure network is an avionic network based on an ARINC protocol and/or an AFDX protocol.

6. A computer program product for execution in a processing unit of a firewall and/or router comprising instructions for executing the method according to claim 1 when executed in said processing unit.

7. A system for transmitting data packets from an external network to a secure network,

the secure network and the external network being interconnected via a firewall comprising a first interface with the external network and a second interface with a router of the secure network,

said firewall further comprising:

a first interface unit with the external network comprising means for determining whether to authorize the transmission of a packet received from the external network to the secure network on the basis of predefined security criteria, said received packet comprising source and destination IP address and source and destination port;

a second interface unit with the secure network, providing a plurality of virtual interfaces and adapted to transmit an unmodified authorized packet to the secure network;

a memory adapted to store items of specific information and associations between said items of specific information and said virtual interfaces;

a selection unit adapted to select an item of specific information to be communicated to the secure network by way of the unmodified contents of the authorized packet, wherein an association between the selected item of specific information and a virtual interface is stored in the firewall and in the secure network; and

a determination unit for determining said virtual interface from said plurality of virtual interfaces as a function of the item of specific information selected on the basis of said association; and

said router comprising:

a memory for storing said association between the items of specific information and the virtual interfaces; and

an interface unit with the firewall adapted to receive unmodified authorized packets, to deduce an item of specific information from the virtual interface through which the unmodified authorized packet is received, on the basis of said association, and to perform routing as a function of said item of specific information.

8. A system according to claim 7 , wherein the secure network provides different types of service each associated with one or more units of the secure network and wherein each item of specific information corresponds to one of said different types of service.

9. A system according to claim 7 , wherein a virtual physical address is associated with each virtual interface and wherein the firewall transmits the authorized packet via a protocol layer indicating the virtual physical address associated with the determined virtual interface.

10. A system according to claim 7 , wherein the firewall selects an item of specific information on the basis of data relating to said packet and predefined parameters.

11. A system according to claim 7 , wherein the secure network is an avionic network based on an ARINC protocol and/or an AFDX protocol.

12. A firewall as defined in claim 7 .

13. A router as defined in claim 7 .