Aircraft airborne network security system and data transmission method

Abstract

The invention discloses an airborne network security system and a data transmission method. The airborne network security system comprises a wireless communication module, a security interface module and a file server module which are mutually crosslinked, special aviation wireless network management software is arranged in the wireless communication module, the wireless communication module is connected with a wireless data transmission antenna, the safety interface module and an airborne system data interface are mutually crosslinked, and network security software is arranged in the safety interface module. The network security software is provided with an anti-malicious code module, an intrusion detection module, a network access control module, a virtual private network module and a security audit module. The external threat possibly faced by the airborne system in the operation and data transmission process can be accurately judged, and a corresponding mechanism is provided to avoid the external threat.

Description

Technical Field

[0001] The invention belongs to the field of aviation data interaction and relates to an aircraft airborne network security system and a data transmission method. Background Art

[0002] With the increasing application of information technology in civil aircraft avionics systems, concepts such as air-ground integration and information sharing have been gradually realized in aircraft airborne systems, and aircraft will gradually become a node in the flight network. In addition to transmitting data through the original wired links, airborne systems also begin to transmit data through wireless links. Wireless data transmission can effectively reduce the construction of infrastructure and directly realize point-to-point and remote transmission of wireless data. In the industrial production and transportation industries, there are a large number of examples of using wireless data transmission. This transmission method is fast, low-cost, and has a large capacity, and has many benefits. Using wireless methods to transmit data has greatly improved production efficiency.

[0003] In the aviation field, the information system is one of the systems that can benefit from wireless data transmission. The information system is an important system responsible for recording flight information, checking aviation flight quality, and exchanging air-ground data through wireless links. In recent years, with the continuous development of aviation technology and aviation concepts, the tasks borne by the system are no longer limited to the recording of flight data and the interaction of air-ground data. Through post-flight analysis of flight quality data, the information system has a large number of applications in flight quality assurance, route file management, flight teaching and other fields. These fields require the information system to upload and analyze the flight quality data stored in it. Due to the particularity of the task, the wireless transmission of information system data requires that the aircraft should be on the ground to transmit data, but it will still face the risk of opening the aircraft platform airborne system to the society.

[0004] When the information system realizes the data recording function and air-ground data interaction, there are a lot of data hard-wired connections with other onboard systems of the aircraft. Therefore, ensuring that the information system can effectively use the wireless data transmission function on the ground and preventing outsiders from accessing and tampering with the onboard system information through related links is the key to the effective application of the information system.

[0005] However, it is not possible to simply directly control the data transmission function in the information system. This is because in order to facilitate the use of data transmission functions, the information system generally adopts intelligent control in the design of wireless transmission. When the aircraft and the ground network interact with each other on the ground, wireless data transmission has its own characteristics, and it has its own focus when designing network security.

[0006] However, the difficulty in designing this network security method is that in order to ensure the security of the wireless link, the equipment using this method must ensure data security and reliability when transmitting data on the ground, and outsiders cannot invade the onboard system through related channels. During the flight, outsiders cannot invade the onboard system of the aircraft through the existing link. The existing wireless network data transmission cannot meet the above requirements. Summary of the invention

[0007] The purpose of the present invention is to overcome the shortcomings of the above-mentioned prior art and provide an aircraft onboard network security system and data transmission method, which can accurately determine the external threats that the airborne system may face during operation and data transmission, and provide corresponding mechanisms to avoid external threats.

[0008] In order to achieve the above object, the present invention adopts the following technical solutions: An aircraft airborne network security system includes a wireless communication module, a security interface module and a file server module interconnected with each other; The wireless communication module has built-in special aviation wireless network management software, the wireless communication module is connected to a wireless data transmission antenna, the security interface module is interconnected with the airborne system data interface, the security interface module has built-in network security software, and the network security software includes an anti-malicious code module, an intrusion detection module, a network access control module, a virtual private network module and a security audit module.

[0009] Preferably, the wireless communication module, the security interface module and the file server module are all provided with platform monitoring software.

[0010] Preferably, the wireless network management software is provided with a wireless network access authentication module, a wireless network encryption module, a wireless network routing module and a wireless network link aggregation module.

[0011] Preferably, the file server module has built-in data monitoring software, maintenance software and file transfer software.

[0012] Preferably, the wireless communication module, the security interface module and the file server module are all connected to a power supply module.

[0013] A data transmission method for the aircraft airborne network security system includes the following process: If data is sent from the airborne system to the external network, the data is transmitted from the airborne system to the file server module for storage after being subjected to access control checks, intrusion detection scans, and malicious code scans by the security interface module. The data is then transmitted from the file server module to the security interface module for access control checks, intrusion detection scans, and malicious code scans, and then encrypted by VPN and sent to the wireless communication module, and then transmitted to the external network through the wireless data transmission antenna; If the data is transmitted through the external network of the wireless data transmission antenna, it will be transmitted to the security interface module through the wireless communication module for VPN decryption, and then transmitted to the file server module for storage after access control check, intrusion detection scan and malicious code scan. The data will then be transmitted from the file server module to the airborne system after access control check, intrusion detection scan and malicious code scan through the security interface module.

[0014] Preferably, the access control checking process is as follows: the network access control module matches and filters the source address, destination address, port number and protocol of the data packet according to a predefined security policy, and only allows legal data packets to pass, while illegal or unauthorized data packets are discarded.

[0015] Preferably, the intrusion detection scanning process is: using a predetermined intrusion detection rule base to check whether the data stream contains any abnormal behavior, malicious code or potential attack mode. If suspicious attack features are found, the intrusion detection module will trigger an alarm and decide to discard the data packet, isolate the threat or record relevant information for further analysis based on the preset strategy.

[0016] Preferably, the malicious code scanning process is: using a virus signature library to check whether the data contains known viruses, malware or Trojans. If a virus, malware or Trojan is detected, the anti-malicious code module intercepts and removes the corresponding threat.

[0017] Preferably, the platform monitoring software in the wireless communication module and the safety interface module reports the failures and problems of the module to the file server module, and the platform monitoring software in the file server module monitors the failures and problems of the module and reports the failures and problems detected by other modules to the aircraft-related systems.

[0018] Compared with the prior art, the present invention has the following beneficial effects: The present invention can effectively ensure the network security of the channel information system for the transmission of air-to-ground data of aircraft. When the air-to-ground data between the aircraft and the ground is interacted through the information system, the network data security of the wireless link can be effectively controlled to ensure flight safety. When data is transmitted from the external network, the network security software can be checked to effectively avoid forwarding threatening files to other airborne system applications, reduce the difficulty of data confirmation for other airborne systems, and ensure the system security of the aircraft platform. Through the use of the system described in this application, the network security system ensures that it can access the Internet for automatic data transmission after the route ends. It not only ensures flight safety, but also improves the operating efficiency of aircraft and airports, and can also reduce the workload of ground staff. It is extremely practical in the field of air transportation. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 This is a principle block diagram of the aircraft airborne network security system of the present invention. DETAILED DESCRIPTION

[0020] The embodiments of the present invention are described in detail below, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and cannot be understood as limiting the present invention.

[0021] In the description of the present invention, it should be understood that the terms "center", "longitudinal", "lateral", "length", "width", "thickness", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside", "clockwise", "counterclockwise" and the like indicate positions or positional relationships based on the positions or positional relationships shown in the accompanying drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as limiting the present invention. In addition, the terms "first" and "second" are only used for descriptive purposes, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Therefore, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features. In the description of the present invention, the meaning of "multiple" is two or more, unless otherwise clearly and specifically defined.

[0022] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by technicians in the technical field to which the present invention belongs. The terms "installed", "connected", and "connected" should be understood in a broad sense. For example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection, an electrical connection, or can communicate with each other; it can be directly connected or indirectly connected through an intermediate medium, and it can be the internal connection of two elements or the interaction relationship between two elements. The term "and / or" used in this article includes any and all combinations of one or more related listed items. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to the specific circumstances. The terms used in the specification of the present invention herein are only for the purpose of describing specific embodiments and are not intended to limit the present invention.

[0023] The disclosure below provides many different embodiments or examples to realize different structures of the present invention. In order to simplify the disclosure of the present invention, the parts and settings of specific examples are described below. Of course, they are only examples, and the purpose is not to limit the present invention. In addition, the present invention can repeat reference numbers and / or reference letters in different examples, and this repetition is for the purpose of simplicity and clarity, which itself does not indicate the relationship between the various embodiments and / or settings discussed. In addition, the present invention provides various specific examples of processes and materials, but those of ordinary skill in the art can be aware of the application of other processes and / or the use of other materials.

[0024] like Figure 1 As shown, the aircraft airborne network security system of the present invention comprises a wireless communication module, a power module, a security interface module, a file server module, etc., wherein the power module supplies power to other modules to ensure that the relevant modules work normally. The wireless communication module, the security interface module, and the file server module are interconnected to realize the network security responsibilities of the airborne system.

[0025] The wireless communication module has built-in dedicated aviation wireless network management software and platform monitoring software. The dedicated aviation wireless network management software is equipped with a wireless network access authentication module, a wireless network encryption module, a wireless network routing module and a wireless network link aggregation module to realize functions such as authorization, authentication, access authentication, transmission, and wireless link data monitoring of the dedicated aviation wireless network. The platform monitoring software has a data transmission monitoring and alarm function to realize the reporting of faults and problems of this module to the file server module.

[0026] The security interface module is interactively connected to the airborne system data interface through the aviation data bus, thereby connecting with the aircraft's airborne system data. The security interface module has built-in network security software and platform monitoring software. The network security software is equipped with an anti-malicious code module, an intrusion detection module, a network access control module, a virtual private network module and a security audit module to achieve access control (firewall), virtual private network (VPN), intrusion prevention, malicious code protection, log recording and other functions; the platform monitoring software implements the module's fault and problem reporting file server module.

[0027] The file server module has built-in platform monitoring software, maintenance software, file transfer software, and data monitoring software. The platform monitoring software monitors faults and problems in this module, and reports faults and problems detected by other modules to aircraft-related systems; the maintenance software collects and diagnoses equipment faults; the file transfer software implements file-based data exchange between information management equipment and ground receiving equipment; the data monitoring software monitors the data generated by the information system to record and store data integrity protection and inspection functions.

[0028] 1) The network security system has a wireless communication module, a power module, a security interface module, and a file server module. The control software built into each module meets the wireless network security requirements of the airborne system.

[0029] 2) If an external threat source attempts to log into the information system through the wireless network, the aviation wireless network management software of the wireless communication module will detect and report it immediately.

[0030] 3) If an external threat source successfully enters the information system through the wireless network and attacks the system, the security interface module will assume the defense responsibility and send the discovered illegal operations, virus attacks and other threats to the file server module for logging to ensure system security.

[0031] 4) When the uploaded file carries a virus that can attack the airborne system platform, the security interface module protects and detects the file virus attack and sends the log information to the file server module.

[0032] In practice, the external threat source refers to the illegal acquisition of stored or transmitted data, such as flight plans, flight information, flight data or other information being illegally stolen. The integrity of stored or transmitted data is destroyed. The stored data on the airborne device is destroyed or tampered with through backdoors or covert channels, or the data is tampered with during transmission between the aircraft and the ground network or portable maintenance equipment, resulting in the destruction of data integrity. For example, information such as the electronic checklist database, navigation database, enhanced map database, and electronic charts is destroyed. The availability of the airborne data network is destroyed. Network denial of service attacks may interrupt the network service of the information management system to affect data communications between airborne systems such as the avionics system, cabin system, electronic flight bag, and engine health monitoring system.

[0033] In the specific implementation, the wireless communication module is connected to the wireless data transmission antenna through a radio frequency line, and the wireless data transmission is realized through the antenna. The wireless communication module is connected to the security interface module through an aviation-specific bus, and the received data is sent to the security interface module for inspection. When realizing wireless data transmission, the wireless network management software built into the wireless communication module is responsible for using a digital certificate to authenticate the access to the wireless network, and data routing is allowed only after passing the authentication. At the same time, it also supports parallel communication of multiple wireless networks, and improves the reliability of the network through link aggregation.

[0034] The security interface module receives wireless data transmitted from the wireless communication module, and sends the onboard data to the wireless communication module for wireless data transmission. It is connected to other airborne systems through the aviation data bus to realize data interaction between the information system and other airborne systems. It is connected to the file server module through the aviation data bus. The data checked by the network security software of the security interface module is sent to the file server module for storage. The main function of the security interface module is to ensure that the wireless data transmitted through the wireless communication module can be effectively checked and protected when interacting with other airborne systems to prevent unauthorized access and potential attacks. In the security interface module, the order of data processing is as follows: 1. Data is transmitted from the external network 1. VPN Decryption When the encrypted data is transmitted through the external network of the wireless data transmission antenna and transmitted to the security interface module through the wireless communication module, the security interface module will decrypt the encrypted data to ensure the security and integrity of the data content.

[0035] 2. Network access control (firewall) check The decrypted data will first pass through the network access control module (firewall) for access control check. The firewall matches and filters the source address, destination address, port number and protocol of the data packet according to the predefined security policy to ensure that only legal data packets are allowed to pass. Illegal or unauthorized data packets will be immediately discarded to prevent them from entering the onboard system.

[0036] 3. Intrusion Detection (IDS) Scanning As data passes through the firewall, the intrusion detection module performs a more in-depth inspection of the content and behavior of the data packet. The module uses a predetermined intrusion detection rule base to check whether the data stream contains any abnormal behavior, malicious code, or potential attack patterns. If suspicious attack characteristics are found, the intrusion detection module will trigger an alarm and decide whether to discard the data packet, isolate the threat, or record relevant information for further analysis based on the preset strategy.

[0037] 4. Antivirus Scan To ensure that the data does not carry malware, the Anti-Malicious Code Module of the Security Interface Module performs a comprehensive virus scan on the transmitted data. The module uses the latest virus signature library to check whether the data contains known viruses, malware or Trojans. If a virus, malware or Trojan is detected, the Anti-Malicious Code Module will immediately intercept and remove the corresponding threat to ensure that the onboard system is not infected.

[0038] 5. Data storage to file server module After VPN decryption, firewall, intrusion detection and anti-virus multi-level inspection, the data will be confirmed by the security interface module to be free of security threats and finally sent to the file server module for storage. The file server will store the data according to the security protocol to ensure that the subsequent access and reading of the data remains highly secure.

[0039] 6. The file server module sends the data to the onboard system The data undergoes secondary security checks through the security interface module and is transmitted to the onboard system after access control checks, intrusion detection scans, and malicious code scans.

[0040] 2. Data is sent from the onboard system to the external network 1. The onboard system sends data to the file server module If the data is sent from the airborne system to the external network, the data first flows out of the airborne system and passes through the security interface module for access control check, intrusion detection scanning and malicious code scanning before being transmitted to the file server module.

[0041] 2. Secondary security check The data undergoes a secondary security check through the security interface module. After access control checks, intrusion detection scans, and malicious code scans, the data will be confirmed by the security interface module to be free of security threats.

[0042] 3. VPN Encryption The security interface module will encrypt the data after the secondary security check through VPN to ensure that the data is not stolen or tampered with during transmission.

[0043] 4. Transmission to external networks The encrypted data is transmitted to the external network via a wireless data transmission antenna.

[0044] This multi-level security check ensures the security of data interaction between the information system and other onboard systems.

[0045] The wireless communication module is connected to the airborne system data interface through the aviation data bus, and the control is achieved through the information system security interface module when the information system encounters external threats from the wireless link.

[0046] In actual use, this method has been proven to be effective and reliable, enabling the information system to stably upload and download data through the wireless network after the flight, and also ensuring flight safety.

[0047] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0048] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0049] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0050] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0051] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

[0052] It should be understood that the above description is for illustration and not for limitation. Many embodiments and many applications beyond the examples provided will be apparent to those skilled in the art upon reading the above description. Therefore, the scope of this patent should not be determined with reference to the above description, but rather with reference to the preceding claims and the full scope of equivalents to which such claims are entitled. For the purpose of comprehensiveness, all articles and references, including disclosures of patent applications and publications, are incorporated herein by reference. The omission of any aspect of the subject matter disclosed herein in the preceding claims is not intended to be a waiver of such subject matter, nor should it be considered that the applicant has not considered such subject matter to be part of the disclosed inventive subject matter.

Claims

1. An aircraft airborne network security system, characterized in that: It includes a wireless communication module, a security interface module and a file server module interconnected with each other; The wireless communication module has built-in special aviation wireless network management software, the wireless communication module is connected to a wireless data transmission antenna, the security interface module is interconnected with the airborne system data interface, the security interface module has built-in network security software, and the network security software includes an anti-malicious code module, an intrusion detection module, a network access control module, a virtual private network module and a security audit module.

2. The aircraft airborne network security system according to claim 1, characterized in that: The wireless communication module, the security interface module and the file server module are all provided with platform monitoring software.

3. The aircraft airborne network security system according to claim 1, characterized in that: The wireless network management software is provided with a wireless network access authentication module, a wireless network encryption module, a wireless network routing module and a wireless network link aggregation module.

4. The aircraft airborne network security system according to claim 1, characterized in that: The file server module has built-in data monitoring software, maintenance software and file transfer software.

5. The aircraft airborne network security system according to claim 1, characterized in that: The wireless communication module, the security interface module and the file server module are all connected to a power module.

6. A data transmission method based on the aircraft airborne network security system according to any one of claims 1 to 5, characterized in that: The process includes: If data is sent from the airborne system to the external network, the data is transmitted from the airborne system to the file server module for storage after being subjected to access control checks, intrusion detection scans, and malicious code scans by the security interface module. The data is then transmitted from the file server module to the security interface module for access control checks, intrusion detection scans, and malicious code scans, and then encrypted by VPN and sent to the wireless communication module, and then transmitted to the external network through the wireless data transmission antenna; If the data is transmitted through the external network of the wireless data transmission antenna, it will be transmitted to the security interface module through the wireless communication module for VPN decryption, and then transmitted to the file server module for storage after access control check, intrusion detection scan and malicious code scan. The data will then be transmitted from the file server module to the airborne system after access control check, intrusion detection scan and malicious code scan through the security interface module.

7. The data transmission method according to claim 6, characterized in that: The access control check process is as follows: the network access control module matches and filters the source address, destination address, port number and protocol of the data packet according to the predefined security policy, allowing only legal data packets to pass, and illegal or unauthorized data packets are discarded.

8. The data transmission method according to claim 6, characterized in that: The intrusion detection scanning process is: using the predetermined intrusion detection rule base to check whether the data stream contains any abnormal behavior, malicious code or potential attack mode. If suspicious attack characteristics are found, the intrusion detection module will trigger an alarm and decide to discard the data packet, isolate the threat or record relevant information for further analysis based on the preset strategy.

9. The data transmission method according to claim 6, characterized in that: The malicious code scanning process is: using the virus signature library to check whether the data contains known viruses, malware or Trojans. If a virus, malware or Trojan is detected, the anti-malicious code module intercepts and removes the corresponding threat.

10. The data transmission method according to claim 6, characterized in that: The platform monitoring software in the wireless communication module and the safety interface module reports the faults and problems of this module to the file server module. The platform monitoring software in the file server module monitors the faults and problems of this module and reports the faults and problems detected by other modules to the aircraft related systems.

Images