Method for detecting and reporting the compromise of a vehicle's electronic system, device and associated system

Abstract

Method for detecting and reporting the compromise of a vehicle's electronic system, associated device and system. One aspect of the invention relates to a method for detecting and reporting the compromise of a vehicle's electronic system, the electronic system comprising one or more control systems, a display means, a simplified signaling means, the control systems and the display means being susceptible to compromise, the method being implemented by a compromise detection device present on the vehicle and configured to communicate with the control systems, the display means and the simplified signaling means, the method comprising: a step of receiving or capturing, by the compromise detection device, operating data from the control systems and the display means;a step of analysis, by the compromise detection equipment, of the data received in order to detect the compromise of one or more control systems and / or the display means; when a compromise of the display means is detected, a step of actuation, on instruction from the compromise detection equipment, of the simplified signaling means; when a compromise of at least one control system is detected and the display means is not compromised, a step of actuation of the display means, on instruction from the compromise detection equipment, in order to display a message including an alert on the detected compromise and preferably an associated action plan.

Description

Title of the invention: Method for detecting and reporting the compromise of an electronic system of a vehicle, device and associated system TECHNICAL FIELD OF THE INVENTION

[0001] The technical field of the invention is that of detecting the compromise of an electronic system.

[0002] The present invention relates to a method for detecting and reporting the compromise of an electronic system of a vehicle and in particular a method taking into account the risk of compromise of the display means. The invention also relates to a device and a system configured to implement such a method. TECHNOLOGICAL BACKGROUND OF THE INVENTION

[0003] Modern vehicles, such as aircraft, drones, cars, etc., generally comprise an electronic system comprising a large number of electronic components, these components being likely to be compromised, for example by a computer virus. In the context of security supervision, the components of the electronic system can be configured to periodically send to a detection device data relating to their operation or a capture by the detection device of relevant information on the information buses. The device will then analyze this data in order to detect a possible anomaly relating to the compromise of one or more components. If such an anomaly is detected, an error message is displayed on a display means of the electronic system.

[0004] However, the display means is also an electronic device and is therefore also susceptible to compromise. However, when the compromised electronic device is the display means, an attacker is then able to create, destroy or modify an error message displayed by this display means. In fact, in this case, the crew, unaware of the compromise, is not able to take the appropriate actions, putting the integrity of the vehicle, or even the safety of its occupants, at risk.

[0005] There is therefore a need for a method for detecting signaling of compromise in an electronic system taking into account the risk of compromise of the display means. Summary of the invention

[0006] The invention provides a solution to the problems mentioned above, by having use of a simplified signaling means, for example an indicator light, an LCD display or an audible signal, which is unlikely to be compromised.

[0007] A first aspect of the invention relates to a method for detecting and signaling the compromise of an electronic system of a vehicle, the electronic system comprising at least one control system or computer, a display means, a simplified signaling means, the control systems and the display means being likely to be compromised, the method being implemented by compromise detection equipment present on the vehicle and configured to communicate with the control system, the display means and the simplified signaling means, and comprising: • A step of reception, by the compromise detection equipment, of operating data from the control systems and the display means; • An analysis step, by the equipment for detecting the compromise of the data received so as to detect the compromise of one or more control systems and / or the display means; • When a compromise of the display means is detected, a step of actuation, on instruction from the compromise detection equipment, of the simplified signaling means; • When a compromise of at least one control system is detected and the display means is not compromised, a step of actuating the display means, on instruction from the compromise detection equipment, so as to display a message comprising an alert on the detected compromise.

[0008] Thanks to the invention, it is possible to signal the compromise of an element of the electronic system to the vehicle crew, even when the display means itself is compromised.

[0009] In addition to the characteristics which have just been mentioned in the preceding paragraph, the method according to a first aspect of the invention may have one or more complementary characteristics among the following, considered individually or according to all technically possible combinations.

[0010] In one embodiment, the means of communication between the compromise detection equipment and the simplified signaling means is independent of the other means of communication.

[0011] In one embodiment, when a compromise of the display means is detected and a compromise of the control system is detected, an actuation of the simplified signaling means is carried out, said actuation being different from the actuation of the simplified signaling means when a compromise is detected. promise of the display medium is detected and no compromise of the control system is detected.

[0012] In one embodiment, the displayed message further includes an action plan associated with the detected compromise.

[0013] In one embodiment, the simplified signaling means is a light-emitting diode, an LCD display or an audible indicator.

[0014] In one embodiment, the vehicle is an aircraft.

[0015] A second aspect of the invention relates to equipment for detecting the compromise of an electronic system of a vehicle, the electronic system comprising at least one control system or computer, a display means, a simplified signaling means, the control system and the display means being likely to be compromised, the compromise detection equipment being configured to communicate with the control system, the display means and the simplified signaling means, and to: • receive operating data from control systems and display means; • analyze the data received in order to detect the compromise of one or more control systems and / or the display means; • When a compromise of the display means is detected, activate the simplified signaling means; • When a compromise of at least one control system is detected and the display means is not compromised, actuate the display means so as to display, on the display means, a message including an alert on the detected compromise.

[0016] In addition to the characteristics which have just been mentioned in the preceding paragraph, in an embodiment of the equipment according to a second aspect of the invention, the message displayed on the display means further comprises an action plan associated with the detected compromise.

[0017] A third aspect of the invention relates to an electronic system of a vehicle comprising at least one control system or computer, a display means, a simplified signaling means, the control system and the display means being likely to be compromised, the electronic system further comprising compromise detection equipment according to a second aspect of the invention and one or more means of communication between the compromise detection equipment, the display means, the control system and the simplified signaling means.

[0018] In addition to the characteristics which have just been mentioned in the preceding paragraph, the electronic system according to a third aspect of the invention may have one or several complementary characteristics among the following, considered individually or in all technically possible combinations.

[0019] In one embodiment, the means of communication between the compromise detection equipment and the simplified signaling means is independent of the other means of communication.

[0020] In one embodiment, the simplified signaling means is a light-emitting diode, an LCD display, or an audible indicator.

[0021] A fourth aspect of the invention relates to a computer program comprising instructions which, when the program is executed by a computer, cause the latter to implement a method according to a first aspect of the invention.

[0022] A fifth aspect of the invention relates to a computer-readable data carrier, on which the computer program according to a fourth aspect of the invention is recorded.

[0023] The invention and its various applications will be better understood by reading the following description and examining the accompanying figures. BRIEF DESCRIPTION OF THE FIGURES

[0024] The figures are presented for information purposes only and in no way limit the invention.

[0025] [Fig.l] illustrates an electronic device in which the method according to the invention can be implemented.

[0026] [Fig. 2] shows a flowchart of a method according to the invention. DETAILED DESCRIPTION

[0027] Unless otherwise specified, the same element appearing in different figures presents a unique reference.

[0028] A first aspect of the invention illustrated in [Fig.l] and [Fig.2] relates to a method 100 for detecting and signaling the compromise of an electronic system of a vehicle, the electronic system SE comprising one or more control systems SC, a display means MA, a simplified signaling means MS, the control systems SC and the display means MA being likely to be compromised. In the present application, a device or equipment is “compromised” when its operating state deviates from a normal operating state due to the intrusion, by an attacker, into the electronic and / or computer system of the vehicle. For example, a compromised display means MA may display erroneous data or may allow an attacker to display the data he wishes. In one embodiment, the vehicle is an aircraft and, preferably, the display means MA is a human-machine interface of the aircraft.In one embodiment, the simplified signaling means (SM) is a light-emitting diode, an LCD display or an audible indicator, such signaling means. MS lization not being likely to be compromised.

[0029] In addition, the method 100 is implemented by a compromise detection device ED present on the vehicle. This compromise detection device is known to the person skilled in the art and will therefore not be described here for the sake of brevity. In the present invention, this device is configured to communicate with the control system(s) SC, but also the display means MA and the simplified signaling means MS. In a non-exhaustive manner, this communication can be done via an Ethernet network, a wireless network or even via an avionics bus when, for example, the vehicle is an aircraft, an industrial bus or an automobile bus, for example when the vehicle is an automobile, the same electronic system SE being able to comprise communication means of different types.

[0030] The method 100 according to the invention comprises a step E1 of receiving, by the compromise detection equipment ED, operating data from the control systems SC and the display means MA. Otherwise, during their operation, the control systems SC and / or the display means MA are configured to send data relating to their operation, these data being received by the detection equipment ED for analysis. The detection equipment ED may also be configured to capture these data relating to the operation of the control systems SC and / or the display means MA, the capture comprising active listening on communication means, for example on buses. These operating data may be stored in a memory of the detection equipment ED, for example in a database.The ED compromise detection equipment can be updated to modify the detection logic without compromising the operation of the SE electronic system.

[0031] For this, the method 100 according to the invention also comprises a step E2 of analysis, by the compromise detection equipment ED, of the received data so as to detect the compromise of one or more control systems SC and / or of the display means MA. Indeed, it is possible, from the operating data transmitted by a control system SC or by the display means MA, to detect whether one of them is compromised or not. Such detection is for example described in application WO2003090046A2 entitled “Intrusion detection System”.

[0032] In addition, the method 100 according to the invention comprises, when a compromise is detected (the detection of a compromise is represented by the reference C in [Fig.2]), a verification CA of compromise of the display means MA making it possible to establish whether the display means MA is compromised or not. The detection of a compromise promise C and the verification CA of compromise of the display means MA can be confused, that is to say carried by the same rule of the compromise detection equipment ED. When a compromise of the display means MA is detected, the method 100 comprises a step E3 of actuation, on instruction from the compromise detection equipment ED, of the simplified signaling means MS. Thus, the crew of the vehicle is warned that the display means MA is compromised and that the messages that the latter may display should therefore not be taken into account.

[0033] Furthermore, the method 100 according to the invention comprises, when a compromise of at least one control system SC is detected and the display means MA is not compromised, a step E4 of actuating the display means MA, on instruction from the compromise detection equipment ED, so as to display a message comprising an alert on the detected compromise and an associated action plan. The action plan associated with the compromise is a succession of steps to be implemented by a crew of the vehicle to act in reaction to the detected compromise. This action plan comprises for example checks to be carried out on components of the vehicle and an action to be carried out depending on the result of the check. This action plan is preferably stored in the memory of the system SE, for example in the form of a file, and transmitted to the display means MA at the initiative of the compromise detection equipment ED.When, on the contrary, the display means MA is compromised, the simplified signaling means MS has already been actuated during the previous step E3 and no additional action is to be implemented. In a variant, when a compromise of the display means MA and a compromise of one or more control systems SC are detected concomitantly, the signaling carried out by the simplified signaling means MS is different from the signaling when a compromise of the display means MA is detected alone.For example, when the simplified signaling means MS is a light-emitting diode, the signaling may comprise the fixed lighting of the light-emitting diode for the entire duration of the detected compromise when only the display means MA is compromised, while the signaling may comprise the intermittent lighting, i.e. flashing, of the light-emitting diode for the entire duration of the detected compromise when the display means MA and one or more control systems SC are compromised.

[0034] In order to implement a method 100 according to the invention, a second aspect of the invention relates to equipment for detecting the compromise ED of an electronic system SE of a vehicle, the electronic system SE comprising one or more control systems SC, a display means MA, a simplified signaling means MS, the control systems SC and the display means MA being likely to be compromised, the compromise detection equipment ED being configured to communicate with the control systems SC, the display means MA and the simplified signaling means MS. The equipment ED comprises one or more communication means, for example, an Ethernet card, an avionics / vehicle bus card or a WiFi card, capable of communicating with the various components SC, MA of the electronic system SE. It also comprises a calculation means, for example a processor or an ASIC card, associated with a memory, for example a RAM memory and / or a hard disk, configured to store the instructions and data necessary for implementing a method 100 according to a first aspect of the invention. More particularly, the compromise detection equipment ED comprises means configured to: • receive operating data from the control systems SC and the display means MA; • analyze the received data so as to detect the compromise of one or more SC control systems and / or the MA display means; • receive updates to detection mechanisms (rules, algorithms, etc.) and analysis, • When a compromise of the MA display means is detected, activate the simplified MS signaling means; • When a compromise of at least one control system SC is detected and the display means MA is not compromised, actuate the display means so as to display, on the display means MA, a message comprising an alert on the detected compromise and preferably an action plan associated with the detected compromise.

[0035] Of course, such equipment ED can be installed within an electrical system of a vehicle. For this, a third aspect of the invention relates to an electronic system SE of a vehicle, for example an aircraft, comprising one or more control systems SC, a display means MA, a simplified signaling means MS, the control systems SC and the display means MA being likely to be compromised, the electronic system further comprising compromise detection equipment ED according to a second aspect of the invention and one or more means of communication between the compromise detection equipment ED, the display means MA, the control systems MC and the simplified signaling means MS.Thus, as already detailed, the display means MA and the control systems MC can send data to the compromise detection equipment ED, and the latter can actuate the display means or the simplified signaling means MS when the display means is compromised. As already mentioned, in a pre-embodiment. differential, the means of communication between the compromise detection equipment ED and the simplified signaling means MS is independent of the other means of communication. Similarly, in one embodiment, the simplified signaling means MS is a light-emitting diode, an LCD display or an audible indicator. In a preferred embodiment, the simplified signaling means MS is a light-emitting diode, such a signaling means being less likely to be compromised than the other simplified signaling means MS. Indeed, a light-emitting diode is only controlled by sending a simple electrical signal.“Independent” means that the compromise detection equipment ED and the simplified signaling means MS communicate via a detection means dedicated to the compromise detection equipment ED and the simplified signaling means MS and different from other means of communication, for example different from the means of communication between the compromise detection equipment ED and the display means MA.

Claims

Claims

1. Method (100) for detecting and signaling the compromise of an electronic system of a vehicle, the electronic system (SE) comprising one or more control systems (SC), a display means (MA), a simplified signaling means (MS), the control systems (SC) and the display means (MA) being likely to be compromised, the method (100) being implemented by compromise detection equipment (ED) present on the vehicle and configured to communicate with the control systems (SC), the display means (MA) and the simplified signaling means (MS), the method (100) comprising: - A step (El) of reception, by the compromise detection equipment (ED), of operating data from the control systems (SC) and the display means (MA); - A step (E2) of analysis, by the compromise detection equipment (ED), of the data received so as to detect the compromise of one or more control systems (SC) and / or the display means (MA); - When a compromise of the display means (MA) is detected, a step (E3) of actuation, on instruction from the compromise detection equipment (ED), of the simplified signaling means (MS) to carry out a signaling - When a compromise of at least one control system (SC) is detected and the display means (MA) is not compromised, a step (E4) of actuating the display means (MA), on instruction from the compromise detection equipment (ED), so as to display a message comprising an alert on the detected compromise, - when a compromise of the display means (MA) is detected and a compromise of the control system (SC) is detected, the signaling carried out by the simplified signaling means (MS) is different from the signaling carried out by the simplified signaling means (MS) when a compromise of the display means (MA) is detected and no compromise of the control system (SC) is not detected.

2. Method (100) according to the preceding claim in which the message displayed on the display means (MA) further comprises an action plan associated with the detected compromise.

3. Method (100) according to one of the preceding claims in which the vehicle is an aircraft.

4. Equipment for detecting the compromise (ED) of an electronic system (SE) of a vehicle, the electronic system (SE) comprising one or more control systems (SC), a display means (MA), a simplified signaling means (MS), the control systems (SC) and the display means (MA) being likely to be compromised, the compromise detection equipment (ED) being configured to communicate with the control systems (SC), the display means (MA) and the simplified signaling means (MS), and to: - receive operating data from the control systems (SC) and the display means (MA); - analyze the received data so as to detect the compromise of one or more control systems (SC) and / or the display means (MA); - When a compromise of the display means (MA) is detected, carry out a signaling by the simplified signaling means (MS);- When a compromise of at least one control system (SC) is detected and the display means (MA) is not compromised, actuate the display means so as to display, on the display means (MA), a message comprising an alert on the detected compromise, - when a compromise of the display means (MA) is detected and a compromise of the control system (SC) is detected, the signaling carried out by the simplified signaling means (MS) is different from the signaling carried out by the simplified signaling means (MS) when a compromise of the display means (MA) is detected and no compromise of the control system (SC) is detected.;

5. Compromise detection equipment (ED) according to claim 4 wherein the message displayed on the display means (MA) further comprises an action plan associated with the detected compromise.

6. Electronic system (SE) of a vehicle comprising one or more control systems (SC), a display means (MA), a simplified signaling means (MS), the control systems (SC) and the display means (MA) being capable of being compromised, the electronic system further comprising compromise detection equipment (ED) according to one of claims 4 or 5 and one or more means of communication between the compromise detection equipment (ED), the display means (MA), the control systems (SC) and the simplified signaling means (MS).

7. Electronic system (SE) according to the preceding claim in which the means of communication between the compromise detection equipment (ED) and the simplified signaling means (MS) is independent of the other means of communication.

8. Electronic system (SE) according to one of the two preceding claims in which the simplified signaling means (MS) is a light-emitting diode, an LCD display or an audible indicator.

9. A computer program comprising instructions which, when the program is executed by a computer, cause the latter to implement a method (100) according to one of claims 1 to 3.

10. Computer-readable data carrier, on which the computer program according to claim 9 is recorded.

Images