Avionics computer comprising a multi-core processor, with a filtering core between open and avionics domains

Abstract

Avionics computer comprising a multi-core processor, with a filtering core between open and avionics domains This avionics computer (15) is intended to be on board an aircraft (5), and comprises a multi-core processor (30) configured to execute avionics software applications (A1, A2, A3). The processor (30) comprises at least one primary core (40) for communicating with at least one avionics equipment (20) separate from the computer (15), each avionics equipment (20) being on board the aircraft (5) and belonging to an avionics domain (26); at least one secondary core (42) for communicating with at least one electronic device (22) external to the avionics domain (26); and a tertiary core (44) for carrying out at least one filtering of a data message(s) received from a respective device (22) external to the avionics domain (26) to a respective avionics equipment (20) of the avionics domain (26).Each avionics software application is executable by the at least one primary core (40) or the at least one secondary core (42). Figure for abstract: Figure 1.

Description

Title of the invention: Avionics computer comprising a multi-core processor, with a filtering core between open and avionics domains

[0001] The present invention relates to an avionics computer intended to be installed on board an aircraft.

[0002] The invention relates more particularly to an airplane, while being applicable to any type of aircraft, such as a helicopter or a drone.

[0003] The invention relates in particular to the field of cyber security in an avionics context.

[0004] An aircraft conventionally comprises avionics equipment to assist in piloting the aircraft, such as a flight management system, or FMS (from the English Flight Management System); a guidance system, or FG (from the English Flight Guidance); a flight control system, or FCS (from the English Flight Control System); etc. These avionics equipment exchange information with each other using a communication network of the aircraft, which are part of a communication system within the aircraft, generally including equipment other than the avionics equipment. The communication system notably comprises equipment implementing functions relating to the airline operating the aircraft, such as a maintenance system, or CMS (from the English Centralized Maintenance System); or a passenger cabin management system.

[0005] The avionics equipment is grouped in a domain, called the avionics domain, to which corresponds a required highest security level of the aircraft communication system in order to guarantee that the operation of the functions implemented by the avionics equipment does not risk being disturbed by communications with equipment outside the avionics domain. The security level required for the other equipment is lower than the security level required for the avionics domain.

[0006] The communication system is for example compliant with the ARINC 811 standard which defines different domains having different security levels in an aircraft communication system, in particular: an ACD domain (from the English Aircraft Control Domain) corresponding to the aforementioned avionics domain; an AISD domain (from the English Airline Information Services Domain) comprising equipment implementing the functions relating to the airline (maintenance, cabin management, etc.); and a PIESD domain (from the English Passenger Information and Entertainment Services Domain) relating to passenger entertainment and information.

[0007] In accordance with the ARINC 811 standard, the security level of the ACD domain corresponds to the highest security level of the aircraft communication system because the functions implemented by the equipment in the ACD domain may be essential for the control of the flight of the aircraft. The security level of the AISD domain is lower than that of the ACD domain, the functions implemented in the AISD domain being less essential, at least in the short term, for the control of the flight of the aircraft. The security level of the PIESD domain is lower than the security level of the AISD domain.

[0008] The exchange of information from a domain having a lower security level to a domain having a higher security level is very strongly restricted so as not to compromise the security of the domain having the highest security level. In particular, the transfer of information from a domain, called an open domain and corresponding to the outside of the ACD domain, to the ACD domain is strongly restricted so as not to compromise the security of the ACD domain.

[0009] To meet this need for a security gateway between the open domain and the higher security level avionics domain, it is known from document FR 3 079 609 B1 to implement this security gateway via a dedicated computer offering a unidirectional outgoing data solution.

[0010] However, such a security gateway is not optimal.

[0011] The aim of the invention is then to propose an avionics computer making it possible to respond more effectively to this need for a security gateway between the open domain and the avionics domain.

[0012] To this end, the invention relates to an avionics computer intended to be installed on board an aircraft, the computer comprising a multi-core processor configured to execute one or more avionics software applications, the processor comprising:

[0013] - at least one primary core configured to communicate with at least one avionics equipment separate from the computer, the or each avionics equipment being on board the aircraft and belonging to an avionics domain,

[0014] - at least one secondary core configured to communicate with at least one electronic device external to the avionics domain, the at least one secondary core being distinct from the at least one primary core, and

[0015] - a tertiary core configured to perform at least one filtering of a message of data received from a respective device external to the avionics domain to a respective avionics equipment of the avionics domain, the tertiary core being distinct from the at least one primary core and the at least one secondary core;

[0016] each avionics software application being executable by a respective core chosen from at least one primary core and at least one secondary core.

[0017] With the avionics computer according to the invention, the at least one primary core is adapted to communicate with the avionics domain, the secondary core is adapted to communicate with the open domain, and the tertiary core then forms, by virtue of the at least one filtering carried out, a security barrier between the open domain and the avionics domain.

[0018] From a cyber security point of view, the secondary core and the tertiary core then belong to a zone exposed to the open domain, in particular for the secondary core in communication with this open domain; the at least one primary core belongs to a trusted zone protected by the security barrier formed by the tertiary core.

[0019] In addition to this security gateway functionality, the avionics computer is configured to execute one or more software applications, and then fulfills a dual functionality.

[0020] Those skilled in the art will also observe that the computer according to the invention then offers spatial segregation between the processing operations associated with the avionics domain carried out, i.e. executed, by the at least one primary core; the processing operations associated with the open domain carried out by the secondary core distinct from the at least one primary core; and finally the processing operations associated with the at least one filtering to form the security barrier between the open domain and the avionics domain, carried out by the tertiary core distinct from both the secondary core and the at least one primary core.

[0021] Preferably, the computer according to the invention also offers temporal segregation between the processing operations associated with the at least one filtering and the other processing operations, the processing operations associated with the at least one filtering being carried out during at least one time zone dedicated to the tertiary core, and the other processing operations being carried out during one or more other time zones, distinct from said at least one dedicated time zone.

[0022] Those skilled in the art will understand that the terminologies primary core, secondary core and tertiary core are intended only to distinguish these cores from each other within the multi-core processor, with regard to the distinct roles, or functionalities, associated with these different cores. Those skilled in the art will nevertheless observe that these terminologies do not induce any relationship of order, importance or even priority between these cores. Possible alternative terminologies for these cores would be first core, second core and third core, while appearing less appropriate, given that the multi-core processor is likely to comprise several primary cores, i.e. several first cores.

[0023] According to other advantageous aspects of the invention, the avionics computer comprises one or more of the following characteristics, taken in isolation or in all technically possible combinations:

[0024] - each filtering is chosen from syntactic filtering and semantic filtering;

[0025] syntactic filtering preferably comprising the verification of at least one syntactic criterion chosen from the group consisting of: the membership of the sender of the message in a list of authorized senders, the membership of the recipient of the message in a list of authorized recipients, and the conformity of the message to one of the authorized predefined formats;

[0026] semantic filtering preferably comprising the verification of at least one semantic criterion chosen from the group consisting of: the membership of one or more data of the message to a range of authorized values, the consistency of at least one data of the message with respect to a predefined reference, and the consistency between at least two data of the message;

[0027] - the tertiary core is further configured to, after the realization of the at least one filtering, transmitting the message to the respective avionics equipment with a communication protocol different from that associated with the message received from the respective external device;

[0028] - the processor is configured to execute one or more software processes at during a predefined time period, the predefined time period being repeated periodically, the predefined time period comprising several distinct and successive time zones, and at least one of said time zones is reserved for the execution of software processing(s) by the tertiary core;

[0029] the execution of software processing(s) by the at least one primary core and / or the at least one secondary core being preferably prohibited during the at least one time zone reserved for the execution of software processing(s) by the tertiary core;

[0030] - each communication with a respective avionics equipment is carried out by the corresponding primary core according to a respective avionics communication protocol and via a respective primary communication port of the computer;

[0031] the avionics communication protocol preferably being selected from the group consisting of: a protocol compliant with the ARINC 664 standard, such as the ARINC 664 Part 3 standard or the ARINC 664 Part 7 standard; a protocol compliant with the ARINC 429 standard; a protocol compliant with the ISO 11898 standard, known as the CAN bus standard, such as the ISO 11898-2 standard or the ISO 11898-3 standard; and a protocol compliant with the MIL-STD-1553 standard, such as the MIL-STD-1553A standard or the MIL-STD-1553B standard;

[0032] - the calculator further comprises a primary communication peripheral for each respective avionics communication protocol, each primary communication device being connected between the at least one primary core and the respective primary communication port;

[0033] each primary communication device preferably being controllable via a respective primary device driver, and each primary device driver is executable in user mode or kernel mode;

[0034] - each communication with a respective external electronic device is carried out by the corresponding secondary core according to an external communication protocol and via a respective secondary communication port of the computer;

[0035] the external communication protocol preferably being chosen from a protocol conforming to the Ethernet standard and a protocol conforming to the ARINC 429 standard;

[0036] - the calculator further comprises a secondary communication peripheral for each respective external communication protocol, each secondary communication device being connected between the at least one secondary core and the respective secondary communication port;

[0037] each secondary communication device preferably being controllable via a respective secondary device driver, and each secondary device driver being executable only in user mode;

[0038] - the calculator further comprises a primary communication bus connecting the at least one primary core to each respective primary communication device, and a secondary communication bus connecting the at least one secondary core to each respective secondary communication device, each secondary bus being distinct from each primary bus;

[0039] - each secondary communication port is distinct from each primary port of communication; and

[0040] - the avionics domain is a domain corresponding to a level of security as high as raised on board the aircraft;

[0041] the avionics domain preferably being the ACD domain according to the ARINC 811 standard of December 20, 2005.

[0042] These characteristics and advantages of the invention will appear more clearly on reading the description which follows, given solely by way of non-limiting example, and made with reference to the appended drawings, in which:

[0043] [Fig.l] [Fig.l] is a schematic representation of a communication system within an aircraft, the communication system comprising an avionics computer according to a first exemplary embodiment of the invention, at least one piece of avionics equipment belonging to an avionics domain and at least one electronic device external to the avionics domain, the avionics computer being connected between the at least one piece of avionics equipment and the at least one external electronic device and forming a communication gateway between them; and

[0044] [Fig.2] [Fig.2] is a view similar to that of [Fig.l], according to a second exemplary embodiment of the invention.

[0045] In [Fig.l], an aircraft 5 comprises a communication system 10 comprising an avionics computer 15, at least one avionics equipment 20 and at least one device 22 external to an avionics domain 26.

[0046] The aircraft 5 is for example an airplane. Alternatively, the aircraft 5 is a helicopter, or even a drone that can be piloted remotely by a pilot.

[0047] The communication system 10 typically comprises several avionics equipment 20 and / or several external devices 22.

[0048] The communication system 10 comprises the avionics domain 26 and an open domain 28, as shown in [Fig.l].

[0049] The avionics domain 26 is a domain corresponding to the highest security level on board the aircraft 5, in particular the highest required security level of the communication system 10 of the aircraft 5.

[0050] The avionics domain 26 is then a domain for limiting a risk of disruption - by at least one communication with the at least one electronic device 22 external to the avionics domain 26 - of function(s) implemented by the at least one avionics equipment 20 of the avionics domain 26. The avionics domain 26 includes the avionics equipment(s) 20.

[0051] The avionics domain 26 is typically the ACD domain according to the ARINC 811 standard of December 20, 2005.

[0052] The open domain 28 is a domain to which corresponds a lower security level than the security level of the avionics domain 26. The open domain 28 includes the external device(s) 22.

[0053] The avionics computer 15 is connected to each avionics equipment 20 and to each external device 22 of the communication system 10, and then forms a communication gateway between each avionics equipment 20 and each external device 22.

[0054] In the examples of figures 1 and 2, the avionics computer 15 is on board the aircraft 5, and comprises a multi-core processor 30 configured to execute one or more avionics software applications A1, A2, A3.

[0055] The avionics computer 15 is configured to communicate with each avionics equipment 20 according to a respective avionics communication protocol.

[0056] The avionics communication protocol is for example chosen from the group consisting of: a protocol compliant with the ARINC 664 standard, such as the ARINC 664 Part 3 standard or the ARINC 664 Part 7 standard; a protocol compliant with the ARINC 429 standard; a protocol compliant with the ISO 11898 standard, known as the CAN bus standard, such as the ISO 11898-2 standard or the ISO 11898-3 standard; and a protocol compliant with the MIL-STD-1553 standard, such as the MIL-STD-1553A standard or the MIL-STD-1553B standard.

[0057] In addition, the avionics computer 15 further comprises a peripheral primary communication bus 32 for each respective avionics communication protocol. According to this addition, the avionics computer 15 typically comprises a primary communication bus 34 connecting the processor 30 to each respective primary communication peripheral 32.

[0058] The avionics computer 15 is configured to communicate with each external electronic device 22 according to a respective external communication protocol.

[0059] The external communication protocol is for example a protocol conforming to the Ethernet standard or a protocol conforming to the ARINC 429 standard.

[0060] In addition, the avionics computer 15 further comprises a secondary communication peripheral 36 for each respective external communication protocol. According to this addition, the avionics computer 15 typically comprises a secondary communication bus 38 connecting the processor 30 to each respective secondary communication peripheral 36, each secondary bus 38 being distinct from each primary bus 34.

[0061] Each avionics equipment 20 is on board the aircraft 5 and belongs to the avionics domain 26. Each avionics equipment 20 is known per se, and is configured to implement one or more respective avionics functions.

[0062] Each avionics equipment 20 is for example chosen from the group consisting of: an aircraft flight management system, also called FMS (Flight Management System); a guidance system, or FG (Flight Guidance); a flight control system, or FCS (Flight Control System); a satellite positioning system, such as a GPS (Global Positioning System); an inertial reference system, also called 1RS (Inertial Reference System); an ILS (Instrument Landing System) landing aid system or an MLS (Microwave Landing System) landing aid system; an active runway excursion prevention system, also called ROPS (Runway Overrun Prevention System); and a radio altimeter, also noted RA (RadioAltimeter).

[0063] Each external device 22 belongs to the open domain 28, and is on board the aircraft 5, or installed on the ground. For example, the external device 22 is a device implementing functions relating to the airline operating the aircraft, such as a maintenance system, or CMS (Centralized Maintenance System); or a passenger cabin management system. For further example, the external device 22 is an electronic device with a flight management functionality, for example a non-avionics onboard tablet, i.e. a non-certified onboard tablet, such as an EFB (Electronic Flight Bag).

[0064] The processor 30 comprises at least one primary core 40 configured to communicate with at least one avionics equipment 20 distinct from the computer 15; at least one secondary core 42 configured to communicate with at least one electronic device 22 external to the avionics domain 26; and a tertiary core 44 configured to carry out at least one filtering of a data message received from a respective device 22 external to the avionics domain 26 to a respective avionics equipment 20 of the avionics domain 26. The at least one secondary core 42 is distinct from the at least one primary core 40, and the tertiary core 44 is distinct from the at least one primary core 40 and from the at least one secondary core 42.

[0065] In the example of [Fig.2], the processor 30 further comprises a complementary core 46.

[0066] In the examples of Figures 1 and 2, the processor 30 comprises four cores. More specifically, in the example of [Fig. 1], the processor 30 comprises two primary cores 40, a secondary core 42 and a tertiary core 44. In the example of [Fig. 2], the processor 30 comprises a primary core 40, a secondary core 42, a tertiary core 44 and a complementary core 46.

[0067] Alternatively, the processor 30 comprises more than four cores, and then typically comprises several complementary cores 46 and / or several primary cores 40 and / or secondary cores 42.

[0068] The processor 30 advantageously comprises a single tertiary core 44.

[0069] Communication between the cores 40, 42, 44, 46 of the processor 30 is typically carried out via internal ports 48, included in the processor 30.

[0070] Advantageously, each primary core 40 is in relation with the avionics domain 26, and communicates only with the tertiary core 44 via a respective internal port 48.

[0071] The tertiary core 44 forms a filter between the open domain 28 and the avionics domain 26, and then communicates with each primary core 40 on the one hand, and with at least one secondary core 42 and / or one complementary core 46 on the other hand, these communications between cores being carried out via respective internal ports 48.

[0072] As an optional addition, at least one secondary core 42 is configured to implement a firewall, in order to carry out preliminary filtering of the messages received from each external device 22.

[0073] In the example of [Fig.l], the two primary cores 40 are in communication with only the tertiary core 44, and not with the secondary core 42. Conversely, the secondary core 42 communicates only with the tertiary core 44, and not with the primary cores 40.

[0074] In the example of [Fig.2], the primary core 40 communicates only with the tertiary core 44, and the tertiary core 44 communicates with the secondary core 42 indi directly via the complementary core 46. According to this example, the complementary core 46 is then, in terms of communication, arranged between the tertiary core 44 and the secondary core 42.

[0075] Each communication of the avionics computer 15 with a respective avionics equipment 20 is carried out by the corresponding primary core 40 according to a respective avionics communication protocol and via a respective primary communication port 50 of the computer 15.

[0076] Each communication of the avionics computer 15 with a respective external electronic device 22 is carried out by the corresponding secondary core 42 according to an external communication protocol and via a respective secondary communication port 52 of the computer 15. Each secondary communication port 52 is advantageously distinct from each primary communication port 50.

[0077] Those skilled in the art will then understand that on the one hand, the avionics domain 26 including each avionics equipment 20, each primary peripheral 32, each primary bus 34, each primary core 40 and each primary port 50 belong to a trusted zone 60; and on the other hand, the open domain 28 including each external device 22, each secondary peripheral 36, each secondary bus 38, each secondary core 42, the tertiary core 44, and where appropriate each complementary core 46, as well as each secondary port 52, belong to an exposed zone 62; a boundary 64 between the trusted zone 60 and the exposed zone 62 then corresponding to the communication interface between the primary core(s) 40 on the one hand and the tertiary core 44 on the other hand, as shown in FIGS. 1 and 2.

[0078] Each avionics software application A1, A2, A3 is executable by a respective core chosen from at least one primary core 40 and at least one secondary core 42.

[0079] In the example of [Fig.l], the avionics software applications A1, A2, A3 are executed by the at least one primary core 40.

[0080] In the example of [Fig.2], the avionics software applications A1, A2, A3 are executed by the secondary core 42.

[0081] As a variant, not shown, certain avionics software application(s) A1, A2 are executed by the at least one primary core 40, while other avionics software application(s) A3 are executed by the at least one secondary core 42.

[0082] The distribution, between the at least one primary core 40 and the at least one secondary core 42, of the execution of the avionics software applications A1, A2, A3 is advantageously carried out by type of software application. By way of example, the or each primary core 40 is configured to execute communication applications, such as applications for communication with a ground station or ACARS (Aircraft Communication Addressing and Reporting System), for example, communication applications for air traffic or ATC (Air Traffic Control), communication applications for air operational control or AOC (Air Operational Control), and communication applications for airline administrative control or AAC (Airline Administrative Control). As another example, the or each secondary core 42 is configured to execute computer equipment management applications, such as a printer management application, an application for managing certain functions of an external communication server.

[0083] As an optional addition, the processor 30 is configured to execute one or more software processes during a predefined time period, the predefined time period being repeated periodically.

[0084] The predefined time period advantageously comprises several distinct and successive time zones, and at least one of said time zones is reserved for the execution of software processing by the tertiary core 44. The fact that at least one of said time zones is dedicated to the tertiary core 44 makes it possible to improve the performance of the avionics computer 15.

[0085] In addition, the execution of software processing by the at least one primary core 40 and / or the at least one secondary core 42 is preferentially prohibited during the at least one time zone reserved for the execution of software processing by the tertiary core 44.

[0086] Each respective message filtering, performed by the tertiary core 44, is typically a syntactic filtering or a semantic filtering.

[0087] The syntactic filtering advantageously comprises the verification of at least one syntactic criterion chosen from the group consisting of: the membership of the sender of the message in a list of authorized senders, the membership of the recipient of the message in a list of authorized recipients, and the conformity of the message to one of the authorized predefined formats.

[0088] Semantic filtering advantageously comprises the verification of at least one semantic criterion chosen from the group consisting of: the membership of one or more data items of the message to a range of authorized values, the consistency of at least one data item of the message with respect to a predefined reference, and the consistency between at least two data items of the message.

[0089] By this filtering of messages, the tertiary core 44 fulfills a cyber security functionality, and is also called a cyber processing core.

[0090] The tertiary core 44 is further configured to, after carrying out the at least one filtering, transmit the message to the respective avionics equipment 20 with a communication protocol different from that associated with the message received from the device. external 22 respective.

[0091] Each primary communication peripheral 32 is connected between the at least one primary core 40 and the respective primary communication port 50. Each primary communication peripheral 32 is advantageously controllable via a respective primary device driver, and each primary device driver is executable in user mode or in kernel mode.

[0092] Each primary communication bus 34 connects the at least one primary core 40 to at least one respective primary communication peripheral 32.

[0093] In the examples of figures 1 and 2, the avionics computer 15 comprises two primary peripherals 32, one being compliant with the ARINC 664 standard, noted A664, such as the ARINC 664 Part 3 standard, noted A664p3, or the ARINC 664 Part 7 standard, noted A664p7; the other being compliant with the ARINC 429 standard, noted A429.

[0094] Each secondary communication peripheral 36 is connected between the at least one secondary core 42 and the respective secondary communication port 52. Each secondary communication peripheral 36 is advantageously controllable via a respective secondary device driver, and each secondary device driver is executable only in user mode, or “user” mode.

[0095] Each secondary communication bus 38 connects the at least one secondary core 42 to at least one respective secondary communication peripheral 36.

[0096] In the examples of figures 1 and 2, the avionics computer 15 comprises two secondary peripherals 36, one being compliant with the ARINC 429 standard, noted A429; the other being compliant with the Ethernet standard.

[0097] Thus, the avionics computer 15 according to the invention makes it possible to accommodate in a modular manner a cyber security function via the tertiary core 44 and another function for executing the avionics software applications A1, A2, A3 via the at least one respective core chosen from the at least one primary core 40 and the at least one secondary core 42. In a context of modularity, also called IMA (from the English In-tegrated Module Avionics), the avionics computer 15 according to the invention then makes it possible to use the same hardware for another function or on a new aircraft while guaranteeing, with constraints of realization of the applications, the independence and the non-disturbance of the applications between them.In addition, the IMA architecture and system allows for incremental certification, which means that an evolution of an application, in accordance with the implementation requirements, does not call into question the certification of the entire computer / applications.

[0098] The avionics computer 15 according to the invention then makes it possible to accommodate one or more functions of the avionics domain 26, such as one or more functions of the ACD domain, and a cyber function by means of syntactic and / or semantic filtering. providing protection against open domain attacks 28.

[0099] Only the or each secondary core 42 is in direct relation with the open domain 28 (domain from which the attacks can come) and has access to the secondary peripheral(s) 36 exposed to the open domain 28. Each secondary core 42 is then also called an exposed core.

[0100] Each secondary device driver 36 is preferably executed in user mode to limit the impact of a driver vulnerability and not impact the core of the avionics computer 15.

[0101] The tertiary core 44, called “cyber processing”, has no direct access to one of the secondary peripherals 36 receiving data from the open domain 28, and also no direct access to primary peripherals 32 of the avionics domain 26, this to avoid a short-circuit of the cyber processing between the open domain 28 and the avionics domain 26. The filtering function implemented by the tertiary core 44 aims to ensure that each flow transmitted to the avionics domain 26 conforms to an uncompromised aeronautical flow.

[0102] Thus, before passing into the trusted zone 60 including the avionics domain 26, a flow from the open domain 28 must pass through these two cores, namely the secondary core 42 called the exposed core, then the tertiary core 44 called the cyber processing core.

[0103] The performance of the avionics computer 15 is ensured by secondary 42 and tertiary 44 cores allocated statically and with dedicated time zones during each predefined time period. The other cores, in particular the primary core(s) 40, are advantageously dedicated to the application applications in an IMA system.

[0104] Starting from an aeronautical function previously hosted in an IMA computer or not, the avionics computer 15 according to the invention with its multi-core processor 30, where two cores 42, 44 are associated with cyber security and the other cores can be used to host the initial aeronautical function, therefore makes it possible to add a cyber security function to the initial aeronautical function, without adding a computer or electronic card.

[0105] It is thus understood that the avionics computer 15 according to the invention makes it possible to respond more effectively to the need for a security gateway between the open domain 28 and the avionics domain 26.

Claims

Claims

1. Avionics computer (15) intended to be on board an aircraft (5), the computer (15) comprising a multi-core processor (30) configured to execute one or more avionics software applications (A1, A2, A3), the processor (30) comprising: - at least one primary core (40) configured to communicate with at least one avionics equipment (20) distinct from the computer (15), the or each avionics equipment (20) being on board the aircraft (5) and belonging to an avionics domain (26), - at least one secondary core (42) configured to communicate with at least one electronic device (22) external to the avionics domain (26), the at least one secondary core (42) being distinct from the at least one primary core (40),and - a tertiary core (44) configured to carry out at least one filtering of a data message(s) received from a respective device (22) external to the avionics domain (26) intended for a respective avionics equipment (20) of the avionics domain (26), the tertiary core (44) being distinct from the at least one primary core (40) and from the at least one secondary core (42); each avionics software application (A1, A2, A3) being executable by a respective core chosen from the at least one primary core (40) and the at least one secondary core (42).,

2. Calculator (15) according to claim 1, in which each filtering is chosen from syntactic filtering and semantic filtering; the syntactic filtering preferably comprising the verification of at least one syntactic criterion chosen from the group consisting of: the membership of the sender of the message in a list of authorized senders, the membership of the recipient of the message in a list of authorized recipients, and the conformity of the message to one of the authorized predefined formats; the semantic filtering preferably comprising the verification of at least one semantic criterion chosen from the group consisting of: the membership of one or more data of the message in a range of authorized values, the consistency of at least one data of the message with respect to a predefined reference, and the consistency between at least two data of the message.

3. A calculator (15) according to claim 1 or 2, wherein the core tertiary (44) is further configured to, after performing the at least one filtering, transmit the message to the respective avionics equipment (20) with a communication protocol different from that associated with the message received from the respective external device (22).

4. A computer (15) according to any one of the preceding claims, wherein the processor (30) is configured to execute one or more software processes during a predefined time period, the predefined time period being repeated periodically, the predefined time period comprising several distinct and successive time zones, and at least one of said time zones is reserved for the execution of software process(es) by the tertiary core (44); the execution of software process(es) by the at least one primary core (40) and / or the at least one secondary core (42) being preferably prohibited during the at least one time zone reserved for the execution of software process(es) by the tertiary core (44).

5. A computer (15) according to any preceding claim, wherein each communication with a respective avionics equipment (20) is performed by the corresponding primary core (40) according to a respective avionics communication protocol and via a respective primary communication port (50) of the computer (15).

6. The computer (15) of claim 5, wherein the computer (15) further comprises a primary communication device (32) for each respective avionics communication protocol, each primary communication device (32) being connected between the at least one primary core (40) and the respective primary communication port (50); each primary communication device (32) preferably being controllable via a respective primary device driver, and each primary device driver is executable in user mode or kernel mode.

7. A computer (15) according to any preceding claim, wherein each communication with a respective external electronic device (22) is performed by the corresponding secondary core (42) according to an external communication protocol and via a respective secondary communication port (52) of the computer (15).

8. A computer (15) according to claim 7, wherein the computer (15) further comprises a secondary communication peripheral (36) for each respective external communication protocol, each secondary communication device (36) being connected between the at least one secondary core (42) and the respective secondary communication port (52); each secondary communication device (36) preferably being controllable via a respective secondary device driver, and each secondary device driver is executable only in user mode.

9. A computer (15) according to claims 6 and 8, wherein the computer (15) further comprises a primary communication bus (34) connecting the at least one primary core (40) to each respective primary communication peripheral (32), and a secondary communication bus (38) connecting the at least one secondary core (42) to each respective secondary communication peripheral (36), each secondary bus (38) being distinct from each primary bus (34).

10. A computer (15) according to claims 6 and 8 or according to claim 9, wherein each secondary communication port (52) is distinct from each primary communication port (50).

11. Computer (15) according to any one of the preceding claims, in which the avionics domain (26) is a domain corresponding to a highest level of security on board the aircraft (5); the avionics domain (26) preferably being the ACD domain according to the ARINC 811 standard of December 20, 2005.

Images