Communication gateway with improved filtering, aircraft, filtering method and associated computer program

Abstract

Communication gateway with improved filtering, aircraft, associated filtering method and computer program This electronic avionics communication gateway comprises: - a module for acquiring at least one data message; each message being according to a communication protocol and comprising a header and a useful part including a plurality of successive fields; - a module for filtering each acquired message, by validating said message if it meets a set of filtering criteria and by blocking it otherwise; and - a module for transmitting, to a corresponding recipient, each validated message.The filtering module comprises a unit for generating a main table for each message, representing a tree of fields of the useful part of said message according to a set of levels associated with the communication protocol; and a unit for calculating, for each message, a dictionary table and at least one auxiliary table from among first, second and third auxiliary tables, the filtering module using the at least one auxiliary table for filtering said message.The dictionary table comprises, for each of the levels, a list of fixed value(s) contained in said message; the first auxiliary table comprises, for each of the levels and each fixed value of the dictionary table, an identifier of each field containing said fixed value; the second auxiliary table comprises, for each branch of the tree, a list of fixed values ​​contained in the fields of said branch; and the third auxiliary table comprises, for each of the levels, a list of value(s) representative of variable value(s) contained in said message.

Description

Title of the invention: Communication gateway with improved filtering, associated aircraft, filtering method and computer program

[0001] The present invention relates to an electronic communications gateway intended to be installed on board an aircraft.

[0002] The invention also relates to an aircraft comprising such a communications gateway.

[0003] The present invention also relates to a method for filtering data message(s) within an avionics communication installation intended to be carried on board an aircraft, the filtering method being implemented by such a communication gateway.

[0004] The invention also relates to a computer program comprising software instructions which, when executed by a computer, implement such a filtering method.

[0005] The invention relates more particularly to an airplane, while being applicable to any type of aircraft, such as a helicopter or a drone.

[0006] The invention relates in particular to the field of cyber security in an avionics context.

[0007] An aircraft conventionally comprises avionics systems to assist in piloting the aircraft, such as a flight management system, or FMS (from the English Flight Management System); a guidance system, or FG (from the English Flight Guidance); a flight control system, or FCS (from the English Flight Control System); etc. These avionics systems exchange information with each other using a communications network of the aircraft, which are part of a communications installation within the aircraft, generally including systems other than the avionics systems. The communications installation notably comprises systems implementing functions relating to the airline operating the aircraft, such as a maintenance system, or CMS (from the English Centralized Maintenance System); or a passenger cabin management system.

[0008] The avionics systems are grouped in a domain, called the avionics domain, to which corresponds a required security level (from the English "security level") that is the highest for the aircraft's communication installation in order to guarantee that the operation of the functions implemented by the avionics systems does not risk being disturbed by communications with equipment outside the avionics domain. The security level required for the other equipment is lower. than the level of security required for the avionics domain.

[0009] The communication installation is for example compliant with the ARINC 811 standard which defines different domains having different security levels in an aircraft communication installation, in particular: an ACD domain (from the English Aircraft Control Domain) corresponding to the aforementioned avionics domain; an AISD domain (from the English Airline Information Services Domain) comprising equipment implementing the functions relating to the airline (maintenance, cabin management, etc.); and a PIESD domain (from the English Passenger Information and Entertainment Services Domain) relating to passenger entertainment and information.

[0010] In accordance with the ARINC 811 standard, the safety level of the ACD domain corresponds to the highest safety level of the aircraft communication installation because the functions implemented by the equipment in the ACD domain may be essential for the control of the flight of the aircraft. The safety level of the AISD domain is lower than that of the ACD domain, the functions implemented in the AISD domain being less essential, at least in the short term, for the control of the flight of the aircraft. The safety level of the PIESD domain is lower than the safety level of the AISD domain.

[0011] The invention then relates to the provision of information in the certified avionics domain, such as the ACD domain, from the non-certified open domain, in particular from the AISD domain.

[0012] The exchange of information from a domain having a lower security level to a domain having a higher security level is very strongly restricted so as not to compromise the security of the domain having the highest security level. In particular, the transfer of information from a domain, called an open domain and corresponding to the outside of the ACD domain, to the ACD domain is strongly restricted so as not to compromise the security of the ACD domain.

[0013] To meet this need for a security gateway between the open domain and the avionics domain with a higher security level, document EP 3 585 030 A1 describes a communication gateway comprising a barrier of a first type for filtering information from the open domain so as to allow said information to enter a communication domain only if it corresponds to an authenticated communication, a barrier of a second type for filtering information transmitted from the communication domain to the avionics domain by performing at least one syntactic filtering of said information. The communication gateway is also configured to then perform a semantic filtering of said information.

[0014] However, such a security gateway is not optimal, particularly in terms of the processing time required to carry out the filtering.

[0015] The aim of the invention is then to propose an electronic communication gateway intended to be installed on board an aircraft, making it possible to reduce the processing time necessary for carrying out the filtering, in particular to be more effective with regard to a risk of cyberattack aimed at causing a malfunction of the avionics systems.

[0016] To this end, the invention relates to an electronic communications gateway intended to be installed on board an aircraft, the gateway comprising:

[0017] - an acquisition module configured to acquire at least one data message; each message being according to a communication protocol and comprising a header and a useful part including a plurality of successive fields;

[0018] - a filtering module connected to the output of the acquisition module and configured to filter each respective acquired message, validating said message if it meets a set of filtering criteria and blocking it as soon as a filtering criterion of said set is not met;

[0019] - a transmission module connected to the output of the filtering module and configured to transmit, to a corresponding recipient, each message validated by the filtering module;

[0020] the filtering module comprising:

[0021] - a generation unit configured to generate a main table for each acquired message; the main table representing a tree of fields of the useful part of said message according to a set of levels associated with the communication protocol, the tree comprising one or more branches;

[0022] - a calculation unit configured to calculate, for each acquired message, a table dictionary and at least one auxiliary table among a first auxiliary table, a second auxiliary table and a third auxiliary table;

[0023] the dictionary table comprising, for each of the levels, a list of fixed value(s) contained in said message, each fixed value belonging to a set of predefined values ​​associated with the communication protocol;

[0024] the first auxiliary table comprising, for each of the levels and each fixed value of the dictionary table, an identifier of each of the fields containing said fixed value;

[0025] the second auxiliary table comprising, for each branch of the message, a list of the fixed values ​​contained in the fields of said branch; and

[0026] the third auxiliary table comprising, for each of the levels, a list of value(s) representative of variable value(s) contained in said message, each variable value being distinct from the set of predefined values ​​associated with the communication protocol; and

[0027] the filtering module is configured to use the at least one auxiliary table for the implementation of filtering criterion(s).

[0028] With the communication gateway according to the invention, the use of at least one auxiliary table for the implementation of filtering criterion(s) then makes it possible to determine much more quickly where the field or the value to which the filtering criterion is to be applied is located. Indeed, each filtering criterion is implemented by accessing this field or this value directly via the at least one auxiliary table, rather than having to fully browse the message being filtered each time.

[0029] Those skilled in the art will then understand that the gain in processing time is all the greater the longer the message, i.e. the greater the quantity of data in its useful part. For example, in the avionics field, a flight plan forming a single message can typically have a size of up to 64 kilobytes.

[0030] The gain in processing time also increases with the number of filtering criteria to be applied to the same message.

[0031] The first auxiliary table makes it possible to detect more efficiently the presence or absence of a given predefined value in the message, and if such a value is present first in addition the number of occurrences of this value.

[0032] The second auxiliary table allows a filter to be applied more efficiently to a particular pattern of fields in the message.

[0033] The third auxiliary table allows for more efficient filtering of variable values ​​in the message.

[0034] According to other advantageous aspects of the invention, the communication gateway comprises one or more of the following characteristics, taken in isolation or in all technically possible combinations:

[0035] - the filtering module is configured to use at least two auxiliary tables distinct among the first auxiliary table, the second auxiliary table and the third auxiliary table for the implementation of filtering criterion(s);

[0036] the filtering module preferably being configured to use each of the auxiliary tables among the first auxiliary table, the second auxiliary table and the third auxiliary table for the implementation of filtering criterion(s);

[0037] - the calculation unit is further configured to order in a monotonic order the lists of fixed values ​​from the second auxiliary table, starting by comparing the first fixed value from each of the lists, then moving successively to the following values ​​from said lists;

[0038] - the dictionary table includes, for each fixed value, an identifier of said fixed value; and in the second auxiliary table, for each branch of the message, the list of fixed values ​​is stored in the form of a list of the identifiers of said fixed values;

[0039] - the calculation unit is further configured to calculate each representative value of variable value by applying an EXCLUSIVE-OR operation to said variable value;

[0040] - the third auxiliary table further comprises, for each representative value of variable value(s), the identifier of each of the field(s) containing a variable value represented by said representative value;

[0041] - the aircraft comprises a communication installation compartmentalized in a avionics domain and an open domain external to the avionics domain, the communication installation comprising several avionics systems belonging to the avionics domain, one or more electronic devices belonging to the open domain, the gateway being capable of being connected between the electronic device(s) and the avionics systems,

[0042] the avionics domain is a domain corresponding to the highest level of safety on board the aircraft;

[0043] the avionics domain preferably being the ACD domain according to the ARINC 811 standard of December 20, 2005.

[0044] The invention also relates to an aircraft comprising a communication installation compartmentalized into an avionics domain and an open domain external to the avionics domain; the communication installation comprising several avionics systems belonging to the avionics domain, one or more electronic devices belonging to the open domain, and an electronic communication gateway connected between the electronic device(s) and the avionics systems, the communication gateway being as defined above.

[0045] The invention also relates to a method for filtering data message(s) within an avionics communication installation intended to be carried on board an aircraft, the filtering method being implemented by an electronic communication gateway and comprising the following steps:

[0046] - acquisition of at least one data message; each message being according to a communication protocol and comprising a header and a useful part including a plurality of successive fields;

[0047] - filtering each respective acquired message, validating said message if it complies a set of filtering criteria and blocking it as soon as a filtering criterion of said set is not respected;

[0048] - transmission, to a corresponding recipient, of each validated message;

[0049] the filtering step comprising the following sub-steps:

[0050] - generation of a main table for each acquired message; the main table representing a tree of fields of the useful part of said message according to a set of levels associated with the communication protocol, the tree comprising one or more branches;

[0051] - calculation, for each acquired message, of a dictionary table and at least one auxiliary table among a first auxiliary table, a second auxiliary table and a third auxiliary table;

[0052] the dictionary table comprising, for each of the levels, a list of fixed value(s) contained in said message, each fixed value belonging to a set of predefined values ​​associated with the communication protocol;

[0053] the first auxiliary table comprising, for each of the levels and each fixed value of the dictionary table, the identifier of each of the fields containing said fixed value;

[0054] the second auxiliary table comprising, for each branch of the message, a list of the fixed values ​​contained in the fields of said branch; and

[0055] the third auxiliary table comprising, for each of the levels, a list of value(s) representative of variable value(s) contained in said message, each variable value being distinct from the set of predefined values ​​associated with the communication protocol; and

[0056] at least one auxiliary table is used for the implementation of filtering criterion(s).

[0057] The invention also relates to a computer program comprising software instructions which, when executed by a computer, implement a filtering method as defined above.

[0058] These characteristics and advantages of the invention will appear more clearly on reading the description which follows, given solely by way of non-limiting example, and made with reference to the appended drawings, in which:

[0059] [Fig-1] [Fig.l] is a schematic representation of an aircraft according to the invention comprising a communication installation compartmentalized into an avionics domain and an open domain external to the avionics domain; the communication installation comprising several avionics systems belonging to the avionics domain, one or more electronic devices belonging to the open domain, and an electronic communication gateway connected between the electronic device(s) and the avionics systems;

[0060] [Fig.2] [Fig.2] is a schematic representation of a tree of the fields of the useful part of a message acquired by the gateway and of a main table generated by the gateway and representing said tree; and

[0061] [Fig.3] [Fig.3] is a flowchart of a method, according to the invention, for filtering data message(s) within the avionics communication installation of [Fig.l], the method being implemented by the electronic communication gateway.

[0062] The expressions “substantially equal to” and “of the order of” define a relationship of equality to plus or minus 20%, preferably to plus or minus 10%, and more preferably to plus or minus 5%.

[0063] In [Fig.l], an aircraft 5 comprises a communication installation 10 compartmentalized into an avionics domain 15 and an open domain 18, external to the avionics domain 15.

[0064] The communication installation 10 comprises several avionics systems 20 belonging to the avionics domain 15; as well as one or more electronic devices 25, external to the avionics domain 15 and belonging to the open domain 18; and an electronic communication gateway 30 connected between the electronic device(s) 25 and the avionics systems 20. In the example of [Fig.l], the communication installation 10 comprises several electronic devices 25, each belonging to the open domain 18.

[0065] In addition, the communication installation 10 further comprises a communication server 35 communicating via a communication link 38 with at least one electronic equipment 40, external to the aircraft 5.

[0066] The avionics domain 15 is a domain corresponding to a highest level of security on board the aircraft 5, in particular the highest required level of security of the communication installation 10 of the aircraft 5.

[0067] The avionics domain 15 is then a domain for limiting a risk of disruption - by at least one communication with an electronic device or apparatus external to the avionics domain 15 - of function(s) implemented by the at least one avionics system 25 of the avionics domain 15. The avionics domain 15 includes the avionics system(s) 25.

[0068] The avionics domain 15 is typically the ACD domain according to the ARINC 811 standard of December 20, 2005.

[0069] The open domain 18 is a domain to which corresponds a lower security level than the security level of the avionics domain 15. The open domain 18 includes the electronic device(s) 25.

[0070] Each avionics system 20 is on board the aircraft 5 and belongs to the avionics domain 15. Each avionics system 20 is known per se, also called an avionics computer, and is configured to implement one or more respective avionics functions.

[0071] Each avionics system 20 is for example chosen from the group consisting of: a flight management system, also called FMS (from the English Flight Management System); a guidance system, or FG (from the English Flight Guidance); a flight control system, or FCS (from the English Flight Control System); a GNSS (from the English Global Navigation Satellite System) satellite positioning system, such as a GPS (from the English Global Positioning System); an inertial reference system, also known as a 1RS (from the English Inertial Reference System); an ILS (from the English Instrument Landing System) landing aid system or an MLS (from the English Microwave Landing System) landing aid system; an active runway excursion prevention system, also known as a ROPS (from the English Runway Overrun Prevention System); and a radio altimeter, also known as a RA (from the English RadioAltimeter).

[0072] Each electronic device 25 belonging to the open domain 18 does not implement a respective avionics function, and therefore generally does not require specific certification.

[0073] The electronic communication gateway 30, hereinafter called the communication gateway 30 or gateway 30, is an interface between the open domain 18 and the avionics domain 15. A data message transmitted between the open domain 18 and the avionics domain 15, i.e. from the open domain 18 to the avionics domain 15, or conversely from the avionics domain 15 to the open domain 18, then necessarily passes through the communication gateway 30.

[0074] The communication gateway 30 is also called a security gateway, and is configured to perform at least one filtering of a data message intended for a respective avionics system 20.

[0075] The communication gateway 30 comprises a module 42 for acquiring at least one data message; a module 44 for filtering each respective acquired message, validating said message if it complies with a set of filtering criteria and blocking it as soon as a filtering criterion of said set is not complied with, the filtering module 44 being connected to the output of the acquisition module 42; and a module 45 for transmitting, to a corresponding recipient, each message validated by the filtering module 44, the transmission module 45 being connected to the output of the filtering module 44. Those skilled in the art will understand that a set of filtering criteria is understood as a group of filtering criteria, or a batch of filtering criteria, i.e. a set of one or more filtering criteria.The filtering module 44 comprises a unit 46 for generating a main table for each acquired message and a unit 48 for calculating, for each acquired message, a dictionary table TD and at least one auxiliary table TAL, TML, TAV from among a first auxiliary table TAL, a second auxiliary table TML and a third auxiliary table TAV.

[0076] As an optional addition, communication gateway 30 comprises a module (not shown) for obtaining a set of filtering parameter(s) associated with the set of filtering criteria. Those skilled in the art will understand that a set of filtering parameter(s) is understood as a group of filtering parameter(s), or even a batch of filtering parameter(s), i.e. a set of one or more filtering parameters.

[0077] The communication gateway 30 comprises for example an information processing unit 50 typically formed of a memory 52 and a processor 54 associated with the memory 52.

[0078] According to this example, the acquisition module 42, the filtering module 44 and the transmission module 45, as well as, as an optional addition, the obtaining module, are each produced in the form of software, or a software brick, executable by the processor 54. The memory 52 of the communication gateway 30 is then capable of storing software for acquiring at least one data message; software for filtering each respective acquired message; and software for transmitting, to a corresponding recipient, each message validated by the filtering software. As an optional addition, the memory 52 of the communication gateway 30 is capable of storing software for obtaining the set of filtering parameters associated with the set of filtering criteria.The processor 54 of the communication gateway 30 is then able to execute each of the software programs among the acquisition software, the filtering software and the transmission software, as well as, as an optional addition, the obtaining software.

[0079] In a variant not shown, the acquisition module 42, the filtering module 44 and the transmission module 45, as well as the optional addition of the obtaining module, are each produced in the form of a programmable logic component, such as an FPGA (Field Programmable Gate Array) or an integrated circuit, such as an ASIC (Application Specific Integrated Circuit).

[0080] When the communication gateway 30 is produced in the form of one or more software programs, that is to say in the form of a computer program, also called a computer program product, it is furthermore capable of being recorded on a medium, not shown, readable by a computer. The computer-readable medium is for example a medium capable of storing electronic instructions and of being coupled to a bus of a computer system. By way of example, the readable medium is an optical disk, a magneto-optical disk, a ROM memory, a RAM memory, any type of non-volatile memory (for example EPROM, EEPROM, FLASH, NVRAM), a magnetic card or an optical card. A computer program comprising software instructions is then stored on the readable medium.

[0081] The communication server 35 is configured to communicate via the link of communication 38 with the at least one external electronic device 40, said at least one external electronic device 40 being for example a ground station, or even cloud computing equipment. The communication server 35 is preferably connected to the communication gateway 30. The communication server 35 typically belongs to the open domain 18.

[0082] The communication server 35 is known per se, and notably comprises a transceiver, not shown, compatible with the communication link 38. The communication link 38 is typically a radio link, i.e. a radio wave link, such as a satellite link. The transceiver is then a radio transceiver.

[0083] The external electronic equipment 40 is typically connected to a computer infrastructure of an operational control center, also called OCC (from the English Operational Control Center). The external electronic equipment 40 is then advantageously configured to transmit data, such as for example a flight plan of the aircraft 5 and information relating to the aircraft 5, such as its mass, its configuration, its balancing, or even its identifier.

[0084] The acquisition module 42 is configured to acquire at least one data message. The acquisition module 42 is for example configured to acquire, from an electronic device 25 belonging to the open domain 18, at least one data message intended for a respective avionics system 20, belonging to the avionics domain 15. The electronic device 25, from which the message is acquired, is typically the communication server 35, if the message is sent from the external electronic equipment 40.

[0085] The acquisition module 42 is for example configured to acquire each message according to a respective avionics communication protocol.

[0086] The avionics communication protocol is for example chosen from the group consisting of: a protocol conforming to the ARINC 702 standard; a protocol conforming to the ARINC 739 standard; a protocol conforming to the ARINC 619 standard; a protocol conforming to the ARINC 429 standard; and a protocol conforming to the FANS (Future Air Navigation System) A standard associated with EUROCAE ED-100.

[0087] Each acquired data message comprises a header and a useful part, also called a payload, containing the useful data of the message, i.e. the data to be transmitted to the corresponding recipient, such as a corresponding avionics system 20.

[0088] The header typically comprises a preamble used for synchronizing the message, and further comprising, for example, a delimiter to signal the start of the message information; an indication relating to the destination, such as an address destination, i.e. an address or identifier of the avionics system 20 receiving the message; an indication relating to the source, such as a source address, i.e. an address or identifier of the sender of the message; and a control code, such as a cyclic redundancy check code or CRC (from the English Cyclic Redundancy Check).

[0089] The useful part of the message comprises a plurality of successive fields, the useful part being divided, i.e. broken down into several successive portions, each portion of the useful part forming a respective field.

[0090] The filtering module 44 is configured to filter each respective acquired message, by validating said message if it meets a set of filtering criteria and by blocking it as soon as a filtering criterion of said set is not met.

[0091] By validating the message, we mean accepting the message, that is to say authorizing the message for transmission to the avionics domain 15. By filtering the messages via the filtering module 44, the communication gateway 30 fulfills a cyber security functionality. In other words, the communication gateway 30 then forms a security barrier between the open domain 18 and the avionics domain 15. In other words, the entry of message(s) inside the avionics domain 15 is secured via the filtering carried out by the communication gateway 30, in particular by the filtering module 44.

[0092] The generation unit 46 is configured to generate the main table TP for each acquired message.

[0093] The main table TP represents an AM tree of the fields of the useful part of said message according to a set of levels NI, N2, N3, N4, N5 associated with the communication protocol.

[0094] The set of levels NI, N2, N3, N4, N5 comprises for example a maximum level NI, a minimum level N5 and one or more intermediate levels N2, N3, N4 between the minimum level N5 and the maximum level NI. The useful part typically includes a root field of maximum level NI, one or more leaf fields of minimum level N5, and several intermediate fields of a respective intermediate level N2, N3, N4, each intermediate field having a single higher level parent field and one or more lower level child fields. The useful part preferably includes a single maximum level root field NI.

[0095] The set of levels NI, N2, N3, N4, N5 is typically a set of levels associated with the communication protocol, and the levels NI, N2, N3, N4, N5 are then also called protocol levels.

[0096] In the example of [Fig.2], the set of levels comprises five levels, namely a first level N1 corresponding to the maximum level, second N2, third N3 and fourth N4 levels corresponding to several intermediate levels respective, and a fifth level N5 corresponding to the minimum level.

[0097] The AM tree comprises one or more branches, each for example from the root field to a respective leaf field. The AM tree makes it possible to represent a chaining of the fields in the useful part. By chaining, we mean a set of one or more chains, each chain corresponding to a branch. Each branch represents a respective chain of fields, for example from the root field to the respective leaf field.

[0098] The generation unit 46 is typically configured to associate a respective identifier with each of the fields, then to determine the identifiers of the child field(s) of the root field, the identifiers of the parent field and of the child field(s) of each of the intermediate fields, and the identifier of the parent field of each leaf field, and to store the determined identifiers in the main table TP. The association of a respective identifier with each of the fields is for example carried out via a numbering of the fields in monotonic order, that is to say in ascending or descending order, and preferably in ascending order.

[0099] The calculation unit 48 is configured to calculate, for each acquired message, the dictionary table TD and at least one auxiliary table TAL, TML, TAV among the first auxiliary table TAL, the second auxiliary table TML and the third auxiliary table TAV.

[0100] According to the invention, the filtering module 44 is then configured to use the at least one auxiliary table TAL, TML, TAV for the implementation of filtering criterion(s), i.e. the implementation of at least one filtering criterion.

[0101] Advantageously, the filtering module 44 is configured to use at least two distinct auxiliary tables TAL, TML, TAV among the first auxiliary table TAL, the second auxiliary table TML and the third auxiliary table TAV for the implementation of filtering criterion(s). The filtering module 44 is preferably configured to use the first auxiliary table TAL, the second auxiliary table TML and the third auxiliary table TAV for the implementation of filtering criterion(s).

[0102] The dictionary table TD, also called lexical table, comprises, for each of the levels NI, N2, N3, N4, N5, a list of fixed value(s) contained in said message, each fixed value belonging to a set of predefined values ​​associated with the communication protocol. The dictionary table TD comprises, for example, for each fixed value, an identifier of said fixed value.

[0103] In other words, the dictionary table TD contains for each level of the AM tree an encoding associated with the values ​​that can be found in the message corresponding to this AM tree.

[0104] The first auxiliary table TAL includes, for each of the levels NI, N2, N3, N4, N5 and each fixed value of the dictionary table TD, an identifier of each of the or fields containing said fixed value.

[0105] The first auxiliary table TAL, also called lexical access table, then offers, for each level, for each value of the dictionary table TD, direct access to the field(s) of the main table TP containing this value of the dictionary table TD, thus allowing rapid and direct access to the elements of the message having this value of the dictionary table TD. This access is typically materialized by a pointer to the field of the main table TP. When for a respective fixed value of the dictionary table TD, the message does not contain a field with this value, the value 'EMPTY' is entered in the first auxiliary table TAL for said fixed value of the dictionary table TD.

[0106] The second TML auxiliary table comprises, for each branch of the message, a list of fixed values ​​contained in the fields of said branch. Said list of fixed values ​​is for example ordered from the root field to the respective leaf field. In the second TML auxiliary table, for each branch of the message, the list of fixed values ​​is stored for example in the form of a list of the identifiers of said fixed values.

[0107] The second auxiliary table TML then represents a description of each branch of the AM tree, this description being done using the fixed values ​​of the dictionary table TD.

[0108] As an optional addition, the calculation unit 48 is further configured to order the lists of fixed values ​​of the second auxiliary table TML in a monotonic order, starting by comparing the first fixed value of each of the lists, then moving successively to the following values ​​of said lists. This makes it possible to facilitate searches required by one or more filtering criteria.

[0109] According to this optional addition, the second auxiliary table TML is preferably sorted in ascending order of the identifiers of the fixed values, as illustrated for example with table 3 below.

[0110] The third auxiliary table TAV comprises, for each of the levels NI, N2, N3, N4, N5, a list of value(s) representative of variable value(s) contained in said message. Each variable value is distinct from the set of predefined values ​​associated with the communication protocol. In other words, each variable value does not belong to the set of predefined values ​​associated with the corresponding communication protocol. In other words, each variable value is a value which is not fixed by the corresponding communication protocol, but must nevertheless generally respect a certain syntax. This is for example the case of the name of an airport in a flight plan according to the ARINC 702 protocol.

[0111] In the example of [Fig.2], the fields with variable value correspond to the light boxes, and the fields with fixed value (provided by the communication protocol) nication) correspond to the dark boxes.

[0112] The third auxiliary table TAV further comprises, for example, for each value representative of variable value(s), the identifier of each of the field(s) containing a variable value represented by said representative value.

[0113] The third auxiliary table TAV, also called variable access table, then allows access to the variable values ​​of the main table TP.

[0114] As an optional addition, the representative value of the variable value is not the variable value itself, but a value calculated to represent said variable value, this calculated value also being called a fingerprint. This thus makes it possible, when implementing one or more filtering criteria, to facilitate the search for the variable value in a set of variable values ​​of various sizes by limiting oneself to searching for its representative value, or fingerprint. This search is further improved by having fingerprints of fixed and sorted sizes, which makes it possible, for example, to carry out searches by dichotomy.

[0115] Alternatively, the value representative of the variable value is the variable value itself.

[0116] According to an optional addition, the calculation unit 48 is for example configured to calculate each value representative of a variable value by applying an EXCLUSIVE-OR operation, also noted XOR, to said variable value.

[0117] According to this optional addition, the XOR operation is for example applied to 32-bit words to construct a fingerprint called XORrec. This XORrec fingerprint is made up of the XORs of the successive parts of 32-bit words of the variable value. Even if several variable values ​​can have the same XORrec fingerprint, two distinct variable values ​​generally rarely have the same XORrec fingerprint.

[0118] According to this optional addition, as an example, the XORec fingerprint for the variable value LFPO, denoted XORec(LFPO), is then this variable value LFPO since its size is less than or equal to 32 bits. The XORec fingerprint for the variable value AMB010-CDN170, denoted XORec(AMB010-CDN170), is obtained by applying the XOR operations in the following manner: AMB0 XOR 10-C XOR DN17 XOR 0.

[0119] Preferably, the third auxiliary table TAV is sorted in monotonic order, and preferably in ascending order, of the calculated representative values.

[0120] Those skilled in the art will observe that, given that several variable values ​​can have the same representative value, the filtering module 44 is configured to, after identification of the field corresponding to the representative value of a searched variable value, access the field identified in the main table TP in order to verify that the identified field does indeed correspond to the searched variable value, and therefore that the representative value did indeed represent this searched variable value.

[0121] By way of example, a person skilled in the art will understand that, to search for the variable values ​​of the fourth level N4 having the value “LMG4B”, the filtering module 44 searches for the representative value XORec(LM4GB) in the fourth level N4 of the third auxiliary table TAV.

[0122] The transmission module 45 is configured to transmit, to the corresponding recipient, such as the corresponding avionics system 20, each message validated by the filtering module 44.

[0123] The transmission module 45 is typically configured to transmit each validated message to the corresponding recipient, according to the respective avionics communication protocol, i.e. the avionics communication protocol corresponding to that according to which the message was previously acquired by the acquisition module 42.

[0124] As an optional addition, the obtaining module is configured to obtain the set of filtering parameter(s) associated with the set of filtering criteria.

[0125] According to this optional addition, the filtering module 44 is then configured to filter each message according to the set of filtering criteria configured via the set of filtering parameters which was obtained by the obtaining module.

[0126] According to this optional addition, the obtaining module is for example configured to obtain said set of filtering parameter(s) from an electronic device 60 external to the gateway 30. Advantageously, the obtaining module is configured to verify an authentication certificate and / or an integrity certificate for each set of filtering parameter(s), and to then validate a respective set of filtering parameter(s) only if its authentication certificate and / or its integrity certificate are valid.

[0127] The authentication certificate makes it possible to verify that the respective set of filtering parameter(s) is an authentic set issued from a recognized source, and not a malicious set issued from an attacking source. The authentication certificate is for example of the 4096-bit RSA type.

[0128] The integrity certificate makes it possible to verify that the respective set of filtering parameter(s) is an intact set which has not been corrupted during its transmission from the electronic device 60. The integrity certificate is for example of the SHA-2 type (from the English Secure Hash Algorithm).

[0129] The electronic device 60 is connected to the communication gateway 30. The electronic device 60 is typically included in the open domain 18, and easily accessible by a user, to be able to store in a memory (not shown) of said device 60 new sets of filtering parameter(s) and / or modify one or more sets of filtering parameter(s) already stored in this memory. The user is typically a member of the crew of the aircraft 5, such as than the pilot of the aircraft 5, or an operator configuring the aircraft 5 prior to flight.

[0130] Examples of fixed values ​​likely to be contained in the dictionary table TD and according to the levels considered are presented below for the ARINC 702, SNMP and ARINC 739 protocols.

[0131] An ARINC 702 message consists of the following fields:

[0132] - an embedded message identifier or IMI (from the English ImbeddedMessage Identifier ): This is a three-character alphanumeric string used to identify the relative content of the message, with values ​​such as FPN, PER, LDI, POS, etc. The embedded message identifier is placed at the beginning of the ARINC 702 message and is immediately followed by the slash separator (“ / ”);

[0133] - one or more embedded element identifiers or IEIs (from the English Imbedded Element Identifier): Each IEI is a two-character alphanumeric string used to identify a group of one or more elements, with values ​​such as FN, RP, RW, RI, RA, etc. Each IEI is immediately followed by the data relating to the IEI type, which can be a single parameter or a group of parameters. At the end of each group of elements, if an IEI follows, the slash separator (" / ") is inserted between ; and

[0134] - a four-character end-to-end cyclic redundancy check (CRC).

[0135] For Flight Plan Initia-lization messages, the RP / RI / RA IEIs also contain Flight Plan Element Identifiers (FPEIs) which are special markers identifying the different types of Flight Plan Elements (FPEs), with values ​​such as CR, DA, F, WS, etc. Each FPEI is immediately followed by the colon separator (":") and then the flight plan element data. The colon separator is also placed at the end of the flight plan element data if another FPEI follows.

[0136] For the ARINC 702 protocol, the first level NI is then the level corresponding to the IMI, the second level N2 is that corresponding to the IEI, and the third level N3 is that corresponding to the FPEI. The fixed values ​​likely to be contained in the dictionary table TD are then in particular “FPN”, “PER”, “LDI”, “POS” for the first level NI; “FN”, “RP”, “RW” for the second level N2; and “CR”, “DA”, “F”, “WS” for the third level N3.

[0137] By analogy, for the SNMP protocol, the fixed values ​​likely to be contained in the dictionary table TD are then notably “Version”, “Community”, “Request” for the first level NI; “Private”, “PDU_Type”, “ID”, “Error” “Object List” for the second level N2; and “GetReq”, “Object_ID”, “Value” for the third level N3.

[0138] By analogy again, for the ARINC 739 protocol, the fixed values ​​likely to be contained in the dictionary table TD are then notably “Line text”, for the first level NI; “Initial_charac_pos”, “Line_number”, “Function”, “Color” “Charac” for the second level N2; and “Underscore”, “Reverse”, “Flashing”, “Black”, “0”, “Cyan”, “Yellow”, “Green”, “Magenta”, “Amber”, “White” for the third level N3.

[0139] In the example of [Fig.2], the AM tree represented corresponds to the following message, which is a message according to the ARINC 702 protocol: “FPN / RP:CR:TLSCDG:DA:LFBO:AA:LFPG:R:14R:D:LMG4B.AMB:F:LMG,N43230E0012 89..AMB..AMB010-CDN170 / RA:CR:CDGORY:DA:LFPG:AA:LFPO / MWLFBO,LFPG,PHO »

[0140] where FPN specifies that it is a flight plan

[0141] RP identifies the 'Active Route'

[0142] :CR: identifies the 'Company Route'

[0143] TLSCDG: is a variable value

[0144] DA: identifies the destination airport

[0145] FBO: is a variable value

[0146] .. : identifies 'Direct to Waypoint', and

[0147] AMB: is a variable value.

[0148] From this example of [Fig.2], the calculation unit 48 then calculates the dictionary table TD corresponding to the following table 1, where the fixed values ​​associated with each level NI, N2, N3 and N4 are listed vertically by level.

[0149] [Tables 1] NI N2 N3 N4 1 FPN 1 MW 1:AA: 1 . 2 RA 2 :CR: 3 RP 3 :D: 4 :DA: 5 :F: 6 :R: 7 .. 8 :W:

[0150] Still using this example of [Fig.2], the calculation unit 48 then calculates the first auxiliary table TAL corresponding to the following table 2, where the field identifiers are indicated in parentheses and listed vertically by level.

[0151] [Tables2] NI N2 N3 N4 1(0) 1(27) 1 (6) (25) 1(12) 2(20) 2(2)(21) 3(1) 3(10) 4 (4) (23) 5(14) 6(8) 7(16)(18) 8 EMPTY

[0152] As an example, the person skilled in the art will then observe that, for the third level N3, the value 4 of the dictionary table TD, which is associated with the fixed value “:DA:” according to table 1 above, points to fields 4 and 23 of the main table TP, corresponding to the two circled fields of the tree AM of [Fig.2]. As another example, for the second level N2, the value 2 of the dictionary table TD, which is associated with the fixed value “RA” according to table 1 above, points to field 20 of the main table TP.

[0153] In the representation of the AM tree in [Fig.2], the field identifiers are indicated to the left of the fields, and the values ​​indicated to the right of certain fields represent the address of a memory cell containing a respective field, each value indicated to the right forming in other words a pointer to the memory cell containing the respective field.

[0154] From this example of [Fig.2], the calculation unit 48 then calculates the second auxiliary table TML corresponding to the following table 3, where the sequences corresponding to the different branches of the AM tree are listed one after the other.

[0156]

[0157]

[0155] As an example, a person skilled in the art will understand that the sequence “1 2 4” represents the branch “FPN RA :DA:” of the AM tree of [Fig.2]. Indeed, in this sequence, the number 1 being in the first position in the sequence, corresponds to the first level NI. This number 1 then represents the identifier value 1 of the first level NI of the dictionary table TD, i.e. the fixed value “FPN” according to table 1 above. Then, the number 2, in the second position in this sequence, corresponds to the second level N2, and therefore represents the identifier value 2 of the second level N2 of the dictionary table TD, i.e. the fixed value “RA” according to table 1. Finally, the number 4, in the third position in the sequence, corresponds to the third level N3, and consequently represents the identifier value 4 of the third level N3 of the dictionary table TD, i.e. the fixed value “:DA:” according to table 1. Still using this example of [Fig.2], the calculation unit 48 finally calculates the third auxiliary table TAV corresponding to the following table 4, where the values ​​representing variable values ​​are listed vertically by level, and the field identifier(s) associated with each representative value are indicated in parentheses and opposite the associated representative value.

[0158] [Tables4] NI N2 N3 N4 N5 1 EMPTY 1 EMPTY 1 LFPO (28) 1 14R (9) 1 AMB (13) 2LFPG (29) 2 XORrec(AMB010-CDN170) (19) 3 PI 10 (30) 3 LFPO (5) (26) 6 LFPG (7) (24) 7 XORrec(LMG4B) (11) (15) 8 XORrec(CDGORY) (22)

[0159] As an example, the person skilled in the art will then observe that the representative value LFPO which represents the variable value LFPO (of size less than or equal to 32 bits) points to field 28 of the main table TP for the third level N3, and to fields 5 and 26 of the main table TP for the fourth level N4. As another example, the representative value XORrec(LMG4B), equal to LMG4 XOR B and which represents the variable value LMG4B (of size greater than 32 bits), points to fields 11 and 15 of the main table TP for the fourth level N4.

[0160] The operation of the communication gateway 30 according to the invention will now be described with reference to [Fig. 3] representing a flowchart of the method for filtering data message(s) within the avionics communication installation 10, said filtering method being implemented by the communication gateway 30.

[0161] During an initial step 100, the communication gateway 30 acquires, via its acquisition module 42 and typically from a respective electronic device 25 belonging to the open domain 18, at least one data message intended for a recipient, such as a respective avionics system 20 belonging to the avionics domain 15.

[0162] The communication gateway 30 then moves on to the filtering step 110 during which it filters, via its filtering module 44, each respective acquired message by validating said message if it meets a set of filtering criteria and by blocking it as soon as a filtering criterion of said set is not met.

[0163] During the filtering step 110, for each acquired message, the generation unit 46 generates the main table TP, then the calculation unit 48 calculates the dictionary table TD and at least one auxiliary table TAL, TML, TAV among the first auxiliary table TAL, the second auxiliary table TML and the third auxiliary table TAV. During this filtering step 110, the calculation unit 48 preferably calculates the dictionary table TD, the first auxiliary table TAL, the second auxiliary table TML and the third auxiliary table TAV for each acquired message.

[0164] According to the invention, during the filtering step 110, the filtering module 44 then uses at least one auxiliary table TAL, TML, TAV for the implementation of at least one filtering criterion.

[0165] Advantageously, the filtering module 44 uses at least two distinct auxiliary tables TAL, TML, TAV among the first auxiliary table TAL, the second auxiliary table TML and the third auxiliary table TAV for the implementation of filtering criterion(s).

[0166] The filtering module 44 preferably uses the first auxiliary table TAL, the second auxiliary table TML and the third auxiliary table TAV for the implementation of the set of filtering criteria overall. Those skilled in the art will of course understand that the three auxiliary tables TAL, TML, TAV are not necessarily all used at the same time for each filtering criterion, and that the first auxiliary table TAL is for example used for a first filtering criterion, the second auxiliary table TML is for example used for a second filtering criterion distinct from the first, the third auxiliary table TAV being for example used for a third filtering criterion distinct from the first and second filtering criteria. Of course also, for certain filtering criterion(s), several auxiliary tables among the first auxiliary table TAL, the second auxiliary table TML and the third auxiliary table TAV may be used.

[0167] At the end of the filtering step 110, the communication gateway 30 transmits, via its transmission module 45 and to the recipient, the message acquired during the acquisition step 100 if it was subsequently validated during the filtering step 110, that is to say if said message complied with the set of filtering criteria.

[0168] Thus, the first auxiliary table TAL, the second auxiliary table TML and / or the third auxiliary table TAV make it possible to perform message filtering with a controlled execution time. Indeed, instead of scanning the message for each filtering criterion to be applied, resulting in a variable execution time depending on the size of the message and the position of the fields sought in the message, the filtering module 44 directly uses the first auxiliary table TAL, the second auxiliary table TML and / or the third auxiliary table TAV to perform the filtering criterion concerned. These auxiliary tables TAL, TML, TAV are executed in a much more deterministic time, because they are less sensitive to the size of the message or to the location of the fields in the message (whether they are at the beginning or at the end).

[0169] As an example of filtering, to be able to identify whether the number of 'Direct to Waypoint' of an ARINC 702 message does not exceed a fixed limit, the filtering module 44 the value corresponding to 'Direct to Waypoint' in the dictionary table TD, i.e. the value ".." of identifier 7 of the third level N3 in the dictionary table TD. From there, it is sufficient for the filtering module 44 to determine the number of contained fields corresponding to the identifier 7 for the third level N3 in the first auxiliary table TAL, then to check that this number is less than the fixed limit. In this example, among the three auxiliary tables TAL, TML, TAV, only the first auxiliary table TAL is used to check whether this filtering criterion is respected or not, and this verification is particularly simple since it is sufficient to count a number of elements in this first auxiliary table TAL, then to compare this number to a threshold.

[0170] The first auxiliary table TAL then makes it possible to detect more effectively the presence or absence of a given predefined value in the message, and if such a value is present first and also the number of occurrences of this value.

[0171] As another example of filtering, to know if a particular combination of fields is present in the message, it is sufficient to see if the pattern associated with this combination is present in the second TML auxiliary table. For example, to check if the sequence "FPN RA:DA:" is present or not in the message, it is sufficient for the filtering module 44 to determine if the sequence * 1 2 4 "is present in the second TML auxiliary table. In this example, among the three auxiliary tables TAL, TML, TAV, only the second TML auxiliary table is used to check if this filtering criterion is respected or not, and this verification is also simple since it is sufficient to determine if a given sequence is present or not in this second TML auxiliary table.

[0172] The second TML auxiliary table therefore makes it possible to apply a filter more efficiently to a particular pattern of fields in the message.

[0173] As yet another example of filtering, to know if the name of a particular airport is present, the third auxiliary table TAV allows rapid access to the variable values ​​of the fourth level N4 associated with the names of the airports having the same representative value XORrec. The filtering module 44 then just checks, by accessing the main table TP, to verify that the name of the airport is exactly the one sought (several names may have the same representative value XORrec). In this example, among the three auxiliary tables TAL, TML, TAV, only the third auxiliary table TAV is used to verify whether this filtering criterion is respected or not, and this verification is again simple since it is sufficient to determine whether a representative value is present or not in this third auxiliary table TAV, then to carry out an additional verification in the main table TP.

[0174] The third auxiliary table TAV therefore makes it possible to filter variable values ​​in the message more effectively.

[0175] The use of at least one auxiliary table TAL, TML, TAV for the implementation of filtering criterion(s) then makes it possible to determine much more quickly where the field or the value is located to which the filtering criterion is to be applied. Indeed, each filtering criterion is implemented by accessing this field or this value directly via the at least one auxiliary table TAL, TML, TAV, as is evident in particular from the previous examples, rather than having to fully browse the message being filtered each time.

[0176] Those skilled in the art will then understand that the gain in processing time is all the more significant as the message is long, as in the avionics field, where a single message can have a size of several kilobytes. The gain in processing time also increases with the number of filtering criteria to be applied to the same message.

[0177] It is thus understood that the communication gateway 30 according to the invention therefore makes it possible to reduce the processing time necessary for carrying out the filtering, in particular to be more effective with regard to a risk of cyberattack aimed at causing a malfunction of the avionics systems 20.

Claims

Claims

1. Electronic communication gateway (30) intended to be carried on board an aircraft (5), the gateway (30) comprising: - an acquisition module (42) configured to acquire at least one data message; each message being according to a communication protocol and comprising a header and a useful part including a plurality of successive fields; - a filtering module (44) connected to the output of the acquisition module (42) and configured to filter each respective acquired message, by validating said message if it meets a set of filtering criteria and by blocking it as soon as a filtering criterion of said set is not met; - a transmission module (45) connected to the output of the filtering module (44) and configured to transmit, to a corresponding recipient (20), each message validated by the filtering module (44); characterized in that the filtering module (44) comprises: - a generation unit (46) configured to generate a main table (TP) for each acquired message; the main table (TP) representing a tree (AM) of the fields of the useful part of said message according to a set of levels (NI, N2, N3, N4, N5) associated with the communication protocol, the tree (AM) comprising one or more branches; - a calculation unit (48) configured to calculate, for each acquired message, a dictionary table (TD) and at least one auxiliary table (TAL, TML, TAV) among a first auxiliary table (TAL), a second auxiliary table (TML) and a third auxiliary table (TAV); the dictionary table (TD) comprising, for each of the levels (NI, N2, N3, N4, N5), a list of fixed value(s) contained in said message, each fixed value belonging to a set of predefined values ​​associated with the communication protocol; the first auxiliary table (TAL) comprising, for each of the levels (NI, N2, N3, N4, N5) and each fixed value of the dictionary table (TD), an identifier of each of the fields containing said fixed value; the second auxiliary table (TML) comprising, for each branch of the message, a list of fixed values ​​contained in the fields of said branch; and the third auxiliary table (TAV) comprising, for each of the levels (NI, N2, N3, N4, N5), a list of value(s) representative of variable value(s) contained in said message, each variable value being distinct from the set of predefined values ​​associated with the communication protocol; and in that the filtering module (44) is configured to use the at least one auxiliary table (TAL, TML, TAV) for the implementation of filtering criterion(s).

2. Gateway (30) according to claim 1, wherein the filtering module (44) is configured to use at least two distinct auxiliary tables (TAL, TML, TAV) among the first auxiliary table (TAL), the second auxiliary table (TML) and the third auxiliary table (TAV) for the implementation of filtering criterion(s); the filtering module (44) preferably being configured to use each of the auxiliary tables (TAL, TML, TAV) among the first auxiliary table (TAL), the second auxiliary table (TML) and the third auxiliary table (TAV) for the implementation of filtering criterion(s).

3. Gateway (30) according to claim 1 or 2, in which the calculation unit (48) is further configured to order in a monotonic order the lists of fixed values ​​of the second auxiliary table (TML), starting by comparing the first fixed value of each of the lists, then successively moving on to the following values ​​of said lists.

4. Gateway (30) according to any one of the preceding claims, in which the dictionary table (TD) comprises, for each fixed value, an identifier of said fixed value; and in the second auxiliary table (TML), for each branch of the message, the list of fixed values ​​is stored in the form of a list of the identifiers of said fixed values.

5. A gateway (30) according to any preceding claim, wherein the calculation unit (48) is further configured to calculate each value representative of variable value by applying an EXCLUSIVE-OR (XOR) operation to said variable value.

6. Gateway (30) according to any one of the preceding claims, in which the third auxiliary table (TAV) further comprises, for each value representative of variable value(s), the identifier of each of the field(s) containing a variable value represented by said representative value.

7. Gateway (30) according to any one of the preceding claims, in which the aircraft (5) comprises a communication installation (10) compartmentalized into an avionics domain (15) and an open domain (18) external to the avionics domain (15), the communication installation (10) comprising several avionics systems (20) belonging to the avionics domain (15), one or more electronic devices (25) belonging to the open domain (18), the gateway (30) being able to be connected between the electronic device(s) (25) and the avionics systems (20), the avionics domain (15) is a domain corresponding to a highest level of security on board the aircraft (5); the avionics domain (15) preferably being the ACD domain according to the ARINC 811 standard of December 20, 2005.

8. Aircraft (5) comprising a communication installation (10) compartmentalized into an avionics domain (15) and an open domain (18) external to the avionics domain (15), the communication installation (10) comprising several avionics systems (20) belonging to the avionics domain (15), one or more electronic devices (25) belonging to the open domain (18), and an electronic communication gateway (30) connected between the electronic device(s) (25) and the avionics systems (20), characterized in that the communication gateway (30) is according to any one of the preceding claims.

9. Method for filtering data message(s) within an avionics communication installation (10) intended to be carried on board an aircraft (5), the filtering method being implemented by an electronic communication gateway (30) and comprising the following steps: - acquisition (100) of at least one data message; each message being according to a communication protocol and comprising a header and a useful part including a plurality of successive fields; - filtering (110) of each respective acquired message, by validating said message if it complies with a set of filtering criteria and by blocking it as soon as a filtering criterion of said set is not complied with; - transmission (120), to a corresponding recipient (20), of each validated message; characterized in that the filtering step (110) comprises the following sub-steps: - generation of a main table (TP) for each acquired message; the main table (TP) representing a tree (AM) of the fields of the useful part of said message according to a set of levels (NI, N2, N3, N4, N5) associated with the communication protocol, the tree (AM) comprising one or more branches; - calculation, for each acquired message, of a dictionary table (TD) and at least one auxiliary table (TAL, TML, TAV) among a first auxiliary table (TAL), a second auxiliary table (TML) and a third auxiliary table (TAV); the dictionary table (TD) comprising, for each of the levels (NI, N2, N3, N4, N5), a list of fixed value(s) contained in said message, each fixed value belonging to a set of predefined values ​​associated with the communication protocol; the first auxiliary table (TAL) comprising, for each of the levels (NI, N2, N3, N4, N5) and each fixed value of the dictionary table (TD), the identifier of each of the field(s) containing said fixed value; the second auxiliary table (TML) comprising, for each branch of the message, a list of fixed values ​​contained in the fields of said branch; and the third auxiliary table (TAV) comprising, for each of the levels (NI, N2, N3, N4, N5), a list of value(s) representative of variable value(s) contained in said message, each variable value being distinct from the set of predefined values ​​associated with the communication protocol; and in that at least one auxiliary table (TAL, TML, TAV) is used for the implementation of filtering criterion(s).

10. A computer program comprising software instructions which, when executed by a computer, implement a method according to the preceding claim.

Images