Method for securing accesses to a network, system and associated device
A securing method in a computing or communication network, the method making it possible to isolate a station connected to a wireless communication device of the network and identified as not complying with the security requirements defined for the network. The isolation of the connected station is performed automatically by a connection to a quarantine zone of the network, excluded from a so-called trusted zone. The device identified as not complying with the security requirements can, for example, access a wide-area network, such as the internet, but cannot access a secure local network.
1. A method for securing accesses to a communication network, executed by a device for securing access comprising at least one wireless connection device of the type consisting of an access point to said network and a data-frame routing device, said network comprising a first sub-network referred to as a “trusted zone” and a second sub-network referred to as a “quarantine zone”, the routing device being configured so that a station connected to the network by association with the wireless connection device by means of a first sub-network identifier can access third-party devices connected in the trusted zone, and so that a station connected to the network by association with the wireless connection device by means of a second sub-network identifier cannot access third-party devices connected in the trusted zone and can access third-party devices connected in the quarantine zone, wherein the method comprises:
sending, by the wireless connection device, information frames comprising a network identifier common to the trusted zone and to the quarantine zone,
receiving, by the wireless connection device, a join request sent by a station, the request comprising the network identifier common to the trusted zone and to the quarantine zone,
determining, by an access controller of the device for securing access, a parameter that is: (1) representing accesses made in said network by the station sending the join request, and (2) a value representing compliance or non-compliance with security rules or security behaviour defined and satisfying a security level sought in the communication network, obtained by comparing accesses made by said station with standard accesses defined in accordance with a catalogue of accesses, the spatial or temporal distribution of which are judged to be illegal within the communication network with respect to said security rules or security behaviour defined and satisfying a security level sought in the communication network,
conditionally granting, by the access controller of the device for securing access, to the station sending the join request, an authorisation to access the trusted zone via the wireless connection device according to said parameter, and, in the case of refusal of access to the trusted zone, granting, to said station, authorisation to access the quarantine zone or to a third sub-network,
refusing authorisation to access the trusted zone and granting authorisation to access the quarantine zone to the station when the station first connects to the communication network, and
granting authorisation to access the trusted zone to the station and refusing authorisation to access the quarantine zone to the station when no access from said station to the communication network is identified as illegal after a predetermined period of time as from the station's first connection to the communication network.
2. The securing method according to claim 1 , the first and second sub-network identifiers being identifiers of a basic set of services, preferentially implemented in the form of MAC addresses.
3. The securing method according to claim 2 , wherein the access controller uses a list of identifiers of stations authorised to access the trusted zone or forbidden to access the trusted zone, according to said parameter.
4. The securing method according to claim 1 , the wireless connection device being a first wireless connection device, the network using a second wireless connection device of the type comprising an access point to said network, the first and second sub-network identifiers being respectively identifiers of the first wireless connection device and of the second wireless connection device, preferentially MAC addresses, and the authorisation to access the quarantine zone being dependent on accesses made via the second wireless access point.
5. The method according to claim 1 , comprising:
disassociating a station from the wireless connection device according to the value of said parameter.
6. The method according to claim 1 , comprising:
in the case of refusal of access to a station to the trusted zone, isolating this station by forbidding it to access the trusted zone and the quarantine zone, and authorising it to access said third sub-network identifiable by this station by means of the common network identifier.
7. A non-transitory storage medium storing a computer program product, the computer program product comprising program code instructions for executing the steps of the method according to claim 1 , when said program is executed by a processor.
8. A device for securing access to a communication network comprising at least one wireless connection device of the type consisting of an access point to said network and a data-frame routing device, the device comprising a first interface for connection to a first sub-network referred to as a “trusted zone” of said network, a second interface for connection to a second sub-network referred to as a “quarantine zone” of said network, and a routing device configured so that a station connected to the network by association with the access point by means of a first sub-network identifier can access third-party devices connected in the trusted zone, and so that a station connected to the network by association with the wireless connection device by means of a second sub-network identifier cannot access third-party devices connected in the trusted zone and can access third-party devices connected in the quarantine zone, the securing device being wherein the device comprises:
a transmitter configured for sending, by the wireless connection device, information frames comprising a network identifier common to the trusted zone and to the quarantine zone,
a receiver configured for receiving, by the wireless connection device, a join request sent by a station, the request comprising the network identifier common to the trusted zone and to the quarantine zone,
an access controller comprising a processor and configured for determining a parameter that is: (1) representing accesses made in said network by the station sending the join request, and (2) a value representing compliance or non-compliance with security rules or security behaviour defined and satisfying a security level sought in the communication network, obtained by comparing accesses made by said station with standard accesses defined in accordance with a catalogue of accesses, the spatial or temporal distribution of which are judged to be illegal within the communication network with respect to said security rules or security behaviour defined and satisfying a security level sought in the communication network, and for conditionally granting, to the station sending the join request, an authorisation to access, to the trusted zone, via the wireless connection device according to said parameter, and, in the case of refusal of access to the trusted zone, granting to this station authorisation to access the quarantine zone, the access controller being further configured for refusing authorisation to access the trusted zone to the station when the station first connects to the communication network, and for granting authorisation to access the trusted zone to the station and refusing authorisation to access the quarantine zone to the station when no access from said station to the communication network is identified as illegal after a predetermined period of time as from the station's first connection to the communication network.
9. The device according to claim 8 , configured to implement a function of gateway for access between a wide-area network and a local network consisting of said trusted zone.