WO2006082296A2

WO2006082296A2 - Method and device for detecting address spoofing in a computer network

Info

Publication number: WO2006082296A2
Application number: PCT/FR2006/000160
Authority: WO
Inventors: Laurent Butti; Roland Duffau; Franck Veysset
Original assignee: France Telecom
Priority date: 2005-02-02
Filing date: 2006-01-24
Publication date: 2006-08-10
Also published as: WO2006082296A3; FR2881592A1

Abstract

The invention concerns a method for detecting address spoofing in a computer network to allow through or not data to addressed to a network (1, 8). Upon receiving data emitted by a device (5) connected to an access medium (2) to said network, a filter (7) performs the following steps: a) emitting a stimulus addressed to the device, to obtain a response based on the stimulus and on the operating characteristics of the device; b) receiving a response from the device (5) and analyzing same to form an identification fingerprint of the device including a network address of said device and a signature representing the operating characteristics of the device; c) comparing the fingerprint formed with a valid identification fingerprint of the device; d) if the formed fingerprint includes an address corresponding to the valid identification fingerprint of the device but with a signature different from that of the valid identification fingerprint, detecting a network address spoofing of the device.

Description

METHOD AND DEVICE FOR DETECTING ADDRESS USURPATIONS IN A COMPUTER NETWORK

The invention relates to computer networks and in particular to access to a computer network when it has a wireless or wireless connection which is accessible to an unsorted public. More particularly, the invention is concerned with detecting network address spoofing to access the network.

To access a computer network, it is known to identify persons or devices wishing to connect to the network to use certain resources. A client authentication can determine if the client is. authorized to connect and allows him to assign the privileges associated with him to move in the network and access the data that are authorized. Once a client has been authenticated, the use of its IP address (in English "Internet Protocol"), possibly accompanied by a MAC address (of the English "Medium Access Control"), allow to identify the client and give him / her the privileges assigned to him / her.

An intrusion technique in a secure network involves usurping the IP address and possibly the MAC address of an authenticated client. This type of identity theft is easier to achieve with wireless networks in public places. Indeed, it is then possible to intercept by radio the MAC address and also the IP address of a client connected to a network and to use his IP address and his MAC address to connect at the same time as him to same network and enjoy the same privileges as the legitimate customer. In order to prevent illegitimate customers from taking undue advantage of the network, it is necessary to control access to it. First, it must be ensured that only clients authorized by the network manager can use it. This first step is performed when authenticating the client trying to connect to the network. Then, it is necessary to maintain an authentication relationship with the client, that is to say to ensure that the authorized client who uses the network is the same as the one who has authenticated to avoid that an unauthorized customer impersonates the authorized customer. To maintain control over an authorized and connected client, there are several techniques to control access. A first technique is a physical technique. The network connection sockets can only be accessible to people who can enter a closed room. Thus, only authorized persons can connect from a machine whose IP address will be recognized as a secure address. For completely open networks, especially across the Internet, there are cryptographic-based techniques for exchanging data between a user and a server. This exchange of data is conditioned by the possession of a secret allowing to implement the cryptographic techniques.

Currently, there are access points accessible to all public, for example in railway stations or airports but also in companies, where wireless links are available to avoid the connection and disconnection of computers by people brought to move frequently. Also in business, it is possible that a customer wants to connect through the network of the company visited to his own company via the Internet. In this wireless link framework all communications are easily interceptable without necessarily controlling the physical link to the network. Moreover, the use of cryptography is not well applied to this type of link because the cryptographic means of the network that receives the connection and the user who wishes to connect to it must be adapted to the other. other, which can cause problems with the networks where the user connects. In addition, the use of cryptography adds processing time and information redundancy which reduces the communication speed.

A captive portal mechanism has been developed to provide a solution that replaces the previously mentioned security solutions. The principle of the captive portal implements a filtering device, also called firewall to filter the IP addresses and also the MAC addresses when they are used. During a connection, if the IP address and possibly the MAC address are not registered in the filtering device, no electronic message or packet of data from these addresses can pass the filter. During the first presentation of an unauthorized IP address, the customer is invited to open his Internet browser and is automatically redirected to an authentication portal of a network manager, hence the captive portal name. This portal allows the client to authenticate securely, for example by using the SSL (Secure Sockets Layer) protocol. All other unauthenticated client requests will be blocked by the filtering device until the authentication succeeds. In the case of successful authentication, and in the case where the authenticated client is authorized to access a network, an update of the filtering rules of the filtering device is performed to pass data packets from the address IP possibly accompanied by the MAC address corresponding to the identified client. Since the access control by MAC address and IP address is relatively low in the case of an open network, the captive portal can use an additional access control by tokens exchanged at the application level. The captive portal keeps a secure communication channel open with the client, always using the SSL protocol. Periodically, the client must present an authentication token through this channel. The lack of presentation of this token causes the modification of the filtering device and puts it in a blocking state for the IP address. Thus, an unauthorized client and usurping the IP address and possibly the MAC address of an authorized client will not be able to present this token and will see its connection completed. The token can also be presented on request if the user tries to access sensitive resources.

The captive portal is particularly well adapted for use in the context of wireless networks, for example using the IEEE802.il technology but also in the case of a wire network whose part of the network would be made available to the visitor by a company . This is all the more true as currently wireless networks using the standard IEEE802.i l do not have a planned security mechanism against intrusion. Similarly, a network type Ethernet (IEEE802.3) relying on the physical impossibility to connect to it, nor does it have any means of securing in case of provision of a connection socket.

As mentioned above, the filtering by IP address and possibly by MAC address is a weak protection. Indeed, these protections are very easy to circumvent because it is enough to impersonate the IP address and MAC address of an authorized client when said client is connected. The use of the authentication token is relatively efficient but has some limitations. Indeed, for the token to be exchanged, it is imperative that the client device and the authentication server of the network are able to talk continuously to be able to exchange the token. However, an application heavily used by customers on wireless type of access, for example in airports, is to build a tunnel between their computer and their company. The tunnel is a sort of virtual private network used for security reasons in order to be sure that, on an open network, for example of the Internet type, it is not possible for an intruder to intervene. Precisely for security reasons, most virtual private network applications prohibit any communication to or from the customer other than that which passes inside the tunnel thus created. This virtual network operates in blocking mode. It is not possible in this case to maintain an exchange of authentication tokens between the client device and an authentication server specific to the connection point of the client device. Moreover, the use of the token solves only partially the problem of impersonation because it is always possible for an attacker to establish a connection through the captive portal by using the IP address and possibly MAC of a legitimate client during a time window corresponding to the last presentation of the token by the legitimate client device. The legitimate client device may further return tokens as many times as possible in place of the illegitimate device, thereby maintaining the passage through the filtering device.

. The purpose of the invention is to enhance access to a network in the case of attacks that attempt to impersonate the network address of a legitimate customer. For this purpose, the invention provides for sending a stimulus to the client terminal and analyzing a response dependent on its operating characteristics and the stimulus to form an identification fingerprint of the terminal. In addition to filtering based on the network address of the terminal, additional filtering based on this fingerprint is performed. As this fingerprint takes into account the dynamic behavior of the terminal, it is particularly representative of its operating characteristics. More specifically, the invention relates to an address spoofing detection method using a data filter able to pass or not data to a network based on filtering criteria, in which when receiving data transmitted by a device connected to an access medium to said network, the following steps are performed:

-a) transmitting a stimulus to said device, for obtaining the device a response dependent on the stimulus and operating characteristics of the device;

-b) receiving a response from the device to the stimulus and analyzing it to form an identification fingerprint of the device comprising at least one network address of said device and a signature representative of the operating characteristics of the device;

-c) comparing the formed fingerprint with a valid identification fingerprint of the device; d) if the imprint formed comprises an address corresponding to the valid identification fingerprint of the device but with a signature different from that of the valid identification fingerprint of the device, detecting a spoofing of the network address of said device; device.

The fraudster can not anticipate the stimuli and the generated fingerprint is thus particularly reliable.

According to a variant, said signature comprises information selected from the following group: the delay of retransmission of data in case of non-acknowledgment by the recipient after a predetermined time, the type of services performed on said device or an identifier of the operating system of said device.

These types of information are particularly representative of the operation of the device and are in practice difficult to circumvent by a fraudster.

According to another variant, following an address spoofing detection, a Filtering criterion is changed to prohibit the passage of all data from the network address.

The detection of address spoofing thus makes it possible to block data sent by a fraudster.

According to another variant, following detection of address spoofing, at least one of the following steps is executed:

-block the data received in the data filter,

emitting an alarm; -modification of the filtering criteria to prohibit the passage of data from the spoofed address.

An appropriate reaction is thus adopted during an address spoofing detection.

According to yet another variant, the method comprises an authentication phase of said device including the formation of the valid identification fingerprint of the device by steps a) and b) mentioned above.

The valid imprint formed thus corresponds well to the authenticated device.

It can also be provided that the network address includes an IP address and / or MAC. The data can be sent according to the TCP and / or IP protocol.

The invention also relates to an address spoofing detection device using a filtering means able to let or not pass data to a network according to filtering criteria, comprising:

an identification means able to identify the network address of a device connected to a network access medium;

means for transmitting a stimulus for generating a stimulus-dependent response and operating characteristics of the device; detection means capable of identifying parameters of the response to the stimuli representative of the operation of the device, and adapted to form an identification fingerprint of the device comprising its network address and a signature representative of the operating characteristics of the device;

a comparison means able to compare the formed fingerprint with a valid identification fingerprint of the device;

a decision means capable of detecting an address spoofing if the imprint formed comprises an address corresponding to a valid imprint but with a signature different from that of the valid imprint.

Such a device makes it possible to generate stimuli that a fraudster can not anticipate and to decide on an address spoofing on the basis of a particularly reliable generated fingerprint.

According to a variant, the device forms said identification fingerprint by including in said signature information selected from the following group: the data retransmission delay in case of non-acknowledgment by the recipient after a predetermined time, the type of services performed on said device or an identifier of the operating system of said device.

According to another variant, the device comprises at least one of the following means:

an update means adapted to modify a filtering criterion to prohibit the passage of data corresponding to the network address for which an address spoofing is detected;

an alarm means capable of emitting an alarm when an address spoofing is detected.

An appropriate reaction is thus adopted during an address spoofing detection. The invention also relates to a computer system comprising a plurality of resources connected to the same communication medium comprising an address spoof detection device as described above and connecting the communication medium to an access medium. .

According to one variant, said access medium comprises at least one radio access point or a connection socket to enable the connection of a device with or without a wire.

The invention further relates to a computer program recorded on a computer readable medium, which program comprises portions of software code for performing the steps of a method as described above when said program is executed. by a computer.

The invention will be better understood and other features and advantages will appear on reading the description which follows, the description referring to the appended drawings among which:

FIG. 1 represents a network having access accessible to the public according to the invention; FIG. 2 represents an algorithm implemented by the filtering device on the data packets passing through it.

Figure 1 shows an enterprise network implementing the invention. The corporate network consists of an Intranet-type network 1 which has a certain number of resources, most of which are not represented, all these resources being linked to a medium of communication. This intranet network also has a portion of network 2 accessible to the public via an access medium, such as an access point 3 or a connection socket 4 for terminals 5 and 6 to connect to the intranet network 1. A filtering device 7 interposes between this access medium of the network part 2 and the communication medium of the intranet network 1. The intranet network 1 is also connected to the Internet network 8 by via a second filtering device 9. In order to manage the connection of the terminals 5 and 6 to the network part 2 for the connection to Intranet 1, a detection device 10, an authentication server 11, a device 12, a decision device 13 and a stimulation device 14 are also connected to the intranet network 1.

The intranet network 1 is for example a network operating according to a wired type local network standard, for example the IEEE802.3 standard. Such a network type has at least one server for managing the different accesses to the network, and a plurality of user terminals and resources that communicate with each other via said network. The authentication server 11 serves in particular to manage access to the Intranet and serves firstly to validate the connection of users within the network but also to validate the connection of users connecting with the help of terminals 5 and 6 via the network part 2. The network part 2 is a public or semi-public part that allows users to pass through a site to connect by means of a cable on the network. socket 4, or by means of a wireless link via the access point 3. The access point 3 is for example a wireless access point in accordance with the IEEE802.11 standard.

Said first and second filtering devices 7 and 9 serve to filter message exchanges and more generally any data packet between the intranet network and, on the one hand, the network part 2 and, on the other hand, the network. Internet 8. These filtering devices 7 and 9 are also known by the name firewall (in English "firewall").

According to the invention, a detection device 10, a comparison device 12, a decision device 13 and a stimulation device 14 are connected to the intranet network 1 to control the first filtering device 7. The devices 10, 12, 13 and 14 are presented as independent devices in FIG. 1, however these can be integrated in a server which can be the same server as the authentication server 11. Possibly, this server can also include the filter 7 and will constitute a full access server having a first connection to connect to the intranet network 1 and a second connection to connect to the network part 2.

In the context of the invention, we will focus more particularly on the communications between the filter 7, the detection device 10, the authentication server 11, the comparison device 12, the decision device 13 and the stimulation device. 14. In reality, the authentication server 11 can also communicate with many other elements of the intranet network 1, and the devices 10, 12, 13 and 14 can also be shared with the filter 9. However, for to simplify the description, it will be described only the part relating to the filter 7 dedicated to the interconnection between the network part 2 and the Intranet 1 network, the interaction with the filter 9 being similar. The communications between the filtering device 7, the detection device 10, the authentication server 11, the comparison device 12, the decision device 13 and the stimulation device 14 pass through the Intranet network 1. However, certain exchanges between these devices were identified by means of arrows. It will now be explained how a terminal 5 or 6 connects to the intranet network 1 and how it will be supervised during the entire duration of its connection to the intranet network 1 with the help of Figure 2. This flow chart is set implemented jointly by the filter 7, the detection device 10, the authentication server 11, the comparison device 12, the decision device 13 and the stimulation device 14.

The flowchart of FIG. 2 begins with a start step 100 which consists in sending a data packet by a terminal to a resource of the Intranet 1 network from the network part 2. for example, it is considered that the terminal 5 wishes to connect legitimately via the access point 3 to the network part 2 to access resources of the Intranet 1 network.

It is initially considered that the data packet is a legitimate message sent by the terminal 5 before it is authenticated. Prior to sending this first data packet, the terminal 5 has established a radio communication with the access point 3. This radio connection is not detailed because it is proceeds for example according to the standard IEEE802.il. The terminal 5 connecting via the access point 3, it has an IP address, usually assigned by a DHCP server (Dynamic Host Configuration Protocol), and a MAC address which is its address in the wireless network. The data packet from the terminal 5 therefore passes through the access point 3 to be transposed on the network part 2 in electronic form and is sent to a resource located at the level of the intranet network 1. The sent data packet then traverses the filtering device 7 which checks whether the data packet comes from an authorized user or user terminal. This is done during a test step 101. Step 101 is for the filtering device 7 to check the sending address of the data packet. In the received data packet, the data packet contains the sender's network address. In this case, the network address consists of the IP address and the MAC address. The filtering device 7 having recovered this network address, it checks among its rules or filtering criteria if this address is an authorized address. If the address is authorized, it is because the terminal has been authenticated beforehand. If the address is not part of the filtering rules that allow access to the network is that the terminal has not been authenticated as a terminal authorized to access the Intranet 1.

If the network address does not correspond to an already authenticated terminal, then an authentication step 102 begins. During this authentication step 102, the filtering device 7 redirects the terminal 5 to the authentication server 11. A dialogue is then established between the terminal 5 and the authentication server 11 through the filter 7. Only this connection is authorized by the filter 7 for the terminal responding to the address of the terminal 5. Authentication is generally done by presenting a pair of user ID and password using a form of protected type for example using the SSL protocol. This authentication is a well-known authentication in the Internet domain and does not require further explanation. The authentication server 11 having received the user's identifier and its password in an encrypted manner, it checks whether this authentication is successful during a test step 103. If the authentication has succeeded, then the authentication server 11 changes the rules of the filtering device 7, during a step 104, and indicates that the terminal responding to the network address of the terminal 5 is authorized to to connect to different resources present in the intranet network 1. Obviously, these resources can be limited to a small part only of the resources of the intranet network 1 according to the rights of access resulting from those allocated to the user.

After changing the rules of the filtering device, a reference fingerprint for the identification of the terminal 5, which will subsequently be considered valid, is set in step 105. In a first step, the stimulation device 14 emits a stimulus to the terminal 5. The stimulus is provided so that the response of the terminal 5 is dependent on this stimulus and the operating characteristics of this terminal. The terminal 5 transmits a response, received by the detection device 10. The detection device 10 analyzes the response and identifies elements characteristic of the operation of the terminal in response to the stimulus. By comparing, for example, these elements with the contents of a knowledge base, the detection device 10 generates a signature representative of the operating characteristics of the terminal 5, such as the nature of its operating system or the services it has. The detection device 10 forms the valid fingerprint comprising the network address (IP address and possibly MAC address) and the signature of the terminal. This valid fingerprint is stored for future spoofing detection. The imprint can be stored in any appropriate form, for example a table associating the network address and the signature of the terminal. Once step 105 is completed, the algorithm of FIG. 2 is finished waiting for a new data packet. The stimulus and the response of the terminal may consist of several data packets. The stimulus is for example a TCP, UDP or ICMP packet. The filtering device 7 checks, for example, whether a data packet sent by the terminal 5 in response to the stimulus has elements making it possible to identify the operating system (OS) of the terminal. The OS of a terminal can be determined from TCP packets that contain information elements allowing to identify the OS, such as packets that have a SYN, ACK, SYN / ACK or RST flag at 1. In addition, there is also information to identify the OS that is contained in fields of TCP / IP frame headers (layers 3 and 4 of the OSI model). By exploiting the specific characteristics of the TCP / IP stacks developed in each operating system, a signature of its own can be determined. The stimulus may also aim at obtaining information on the software or services executed on the terminal 5. The stimulus can notably determine whether the terminal 5 is protected by a firewall. The stimulus may also measure physical or network characteristics of the terminal response, including the delay of retransmission of data in case of non-acknowledgment by the recipient after a predetermined time. The response of the terminal 5 may in particular depend on several operating characteristics of the terminal. In practice, any technique of fingerprinting ("fingerprinting" in English) by stimulus emission can be adapted to the invention. Several stimuli can be emitted in order to cross-check the analyzes carried out on the answers obtained. The formed cavity is thus safer and false positives can be avoided.

If the authentication has failed, the filtering rules remain unchanged and the terminal answering the address of the terminal 5 is not allowed to access resources of the intranet network 1. The algorithm ends and the filter 7 waits for a new packet of data.

After being authenticated, if the terminal 5 returns a data packet again to access one of the resources of the intranet network 1, then this data packet restarts the flowchart from FIG. 2 to the start step 100 When the filtering device 7 performs the test of the step 101, it realizes that the address corresponding to the terminal 5 is an authenticated address that has the right to access certain resources of the intranet network 1.

At each connection attempt and with a certain periodicity, the filter 7 requires to establish whether the terminal 5 is still an authorized terminal, by a stimulus emission. The inspection procedure may be carried out at regular intervals during the connection of the terminal 5, the intervals may for example be defined by a clock triggering the launch of the control. The intervals can be defined by an administrator of the filtering device 7.

In step 106, as in step 105, the stimulation device 14 sends a stimulus to the terminal 5. In a similar manner to the step 105, the detection device forms a fingerprint comprising the network address (IP address and MAC address) and the signature of the terminal dependent on the stimulus and operating characteristics of the terminal 5.

In step 107, the comparison device 12 compares the fingerprint formed with the valid fingerprint having the same IP address and the same MAC address. In order for the comparison to be meaningful and not to erroneously determine spoofing, the stimuli are determined in advance and relatively stable over time, so that the valid fingerprint and the fingerprint formed by an authorized terminal do not diverge. If the imprint formed is not identical or not consistent with the valid imprint, then the filter proceeds to step 108. Step 108 corresponds to the reaction of the filter 7 following the detection of a spoofing. network address. Different operations can be performed simultaneously or optionally, depending on the level of security required. The data packet can simply be blocked at the level of the filter 7. During this step 108, it is also possible to issue an alarm either at the network level or at the terminal of an operator supervising the network to indicate that a Spoofing attack has just been detected. In the example, the filter 7 is modified to prohibit all data packets from the network address for which two different fingerprints were found. This means that if the legitimate terminal wishes to communicate again with the intranet network 1, it must necessarily go through an authentication step. The flowchart of Figure 2 is complete, and the filter 7 is waiting for a new data packet.

If on the other hand for the same network address, the formed fingerprint is coherent or identical to the valid fingerprint, then the decision device 13 performs step 109. The decision device 13 then determines whether there is another connection in progress with the same network address and the same signature.

If such a connection exists, step 111 is performed: the data packet is allowed to pass through the filtering device 7 and the filtering rules of the filter 7 are unchanged. If there is no other connection in progress with the fingerprint formed in step

106, the decision device 13 checks in step 110 whether another connection is in progress with the same network address and no imprint formed.

If this is the case, the decision device 13 determines that another terminal usurps the network address of the terminal 105. Step 108 is then performed. If no other connection is in progress with the network address of the terminal 5, step 111 is performed. The decision device 13 stores the formed fingerprint to subsequently perform the test of step 109.

The advantages of such access control compared to the state of the art are multiple. First of all, those skilled in the art will notice that this access control is usable without any impact on the client himself because this control is completely transparent to him. Such access control may be coupled to a static access control, in which all packets transmitted to the filtering device 7 by the terminal 5 are controlled. In this case, the risk of detecting a false positive

(wrong detection of a usurpation) is significantly reduced. Moreover, the only modification to be made in relation to the architecture of an Intranet type network occurs only at the level of the filtering device 7 so that it takes into account the fingerprint check in cooperation with the detection device. 10, the comparison device 12, the decision device 13 and the stimulation device 14. The implementation of the method is done by adding a computer program in the computer device providing the filtering device function , this computer program having software instructions for executing the method.

Another advantage is that this access control method is relatively complex to deceive because the attacker must already determine which packets sent by the filter contain the stimuli. Even knowing the packages containing the stimuli, the attacker can not know very precisely the behavior of the legitimate terminal in response to stimuli and will not be able to reproduce a response leading to the same footprint. In the event that the generated signature identifies the operating system of the terminal, the skilled person might think that very many computers have a similar OS, and that therefore a detection based on this signature does not allow to have a reliability important enough to get rid of an illegitimate terminal. It is true that the majority of computers wishing to connect to a network have a very similar or identical OS, but these OS are OS that do not allow complex attacks with spoofing of IP addresses and / or MAC . Indeed, to achieve this type of attack, it is necessary to have an OS allowing the user of the illegitimate terminal to substitute the addresses of a connection. These OS are less widespread, a signature identifying the OS is in practice a relatively reliable criterion.

Moreover, although the example presented describes the formation of the valid fingerprint following the authentication step, it is also possible in the context of the invention to form the valid fingerprint during the redirection of the terminal to the captive portal, ie before the authentication process. It is preferable to form the valid fingerprint following the authentication step, which avoids a potential denial of service during a saturation of the access control system due to massive requests for authentication with authentication requests. different network addresses.

Claims

1. Method for detecting address spoofing using a data filter able to pass or not data to a network based on filtering criteria, characterized in that, upon receipt of data transmitted by a device connected to a medium of access to said network, the following steps are performed:

-a) transmitting a stimulus (106) to said device for obtaining a stimulus-dependent response and operating characteristics of the device from the device; -b) receiving a response from the device to the stimulus and analyzing it to form (106) an identification fingerprint of the device comprising at least one network address of said device and a signature representative of the operating characteristics of the device; -c) comparing (107) the imprint formed with a valid identification fingerprint of the device;

d) if the imprint formed comprises an address corresponding to the valid identification fingerprint of the device but with a signature different from that of the valid identification fingerprint of the device, detecting a spoofing of the network address of said device; device.

The address spoofing detection method according to claim 1, wherein said signature comprises information selected from the following group: the delay of retransmission of data in case of non-acknowledgment by the recipient after a predetermined time, the type of services performed on said device or an identifier of the operating system of said device.

3. An address spoofing detection method according to claim 1 or 2, wherein, following an address spoofing detection, a criterion of filtering is modified (108) to prohibit the passage of all data from the network address.

An address spoofing detection method according to claim 1 or 2, wherein, following address spoofing detection, at least one of the following steps is executed:

- blocking the data received in the data filter, - issuing an alarm;

-modification of the filtering criteria (108) to prohibit the passage of data from the spoofed address.

An address spoofing detection method according to any one of the preceding claims, comprising an authentication phase (102) of said device including the formation (105) of the valid identification fingerprint of the device by the steps a) and b) of claim 1.

An address spoof detection method according to any one of the preceding claims, wherein the network address includes an IP address and / or MAC.

The address spoof detection method according to any one of the preceding claims, wherein the data is sent according to the TCP and / or IP protocol.

8. Address usuipation detection device using a filtering means (7, 9) capable of passing or not passing data to a network according to filtering criteria, comprising:

an identification means able to identify the network address of a device connected to a network access medium; characterized in that it further comprises: means for transmitting (14) a stimulus for generating a stimulus-dependent response and operating characteristics of the device;

detection means (10) capable of identifying stimulus response parameters representative of the operation of the device, and capable of forming an identification fingerprint of the device comprising its network address and a signature representative of the operating characteristics of the device ;

a comparison means (12) capable of comparing the fingerprint formed with a valid identification fingerprint of the device;

a decision means (13) capable of detecting an address spoofing if the imprint formed comprises an address corresponding to a valid imprint but with a signature different from that of the valid imprint.

9. Address spoof detection device according to claim 8 or 9, foπnant said identification fingerprint including in said signature information selected from the following group: the data retransmission delay in case of non-payment of the from the recipient after a predetermined time, the type of services performed on said device or an identifier of the operating system of said device.

10. The address spoofing detection device according to claim 8 or 9, comprising at least one of the following means: an updating means able to modify a filtering criterion to prohibit the passage of the data corresponding to the network address for which an address spoofing is detected; an alarm means capable of emitting an alarm when an address spoofing is detected.

11. A computer system comprising a plurality of resources related to a same communication medium (2) characterized in that it comprises an address spoof detection device according to any one of claims 8 to 10 connecting the communication medium to an access medium.

The computer system of claim 11, wherein said access medium comprises at least one radio access point (3) or a connection socket (4).

A computer program recorded on a computer readable medium, said program comprising portions of software code for performing the steps of the method according to any one of claims 1 to 7 when said program is executed by a computer.