Communication gateway with configurable filtering between open domains and avionics, aircraft, filtering process and associated computer program

Abstract

Communication gateway with configurable filtering between open and avionics domains, aircraft, filtering process and associated computer program. This communication gateway (30), installed on board an aircraft (5) and connected between electronic devices (25) of an open domain (18) and avionics systems (20) of an avionics domain (15), comprises: - an acquisition module (42) from an electronic device (25) of at least one data message destined for an avionics system (20); - a filtering module (44) for each respective acquired message, according to a set of filtering criteria which is selected, from a set of filtering criteria, according to a type of said message; and - a transmission module (46) for each validated message destined for the corresponding avionics system (20).At least one filtering criterion of said game is parameterized via a respective filtering parameter, and at least one filtering parameter depends on the recipient avionics system (20), being variable from one avionics system (20) to another. Figure for the abbreviation: Figure 1.

Description

Title of the invention: Communication gateway with configurable filtering between open domains and avionics, aircraft, filtering method and associated computer program

[0001] The present invention relates to an electronic communication gateway intended to be installed on board an aircraft, the aircraft comprising a communication system divided into an avionics domain and an open domain external to the avionics domain, the communication system comprising several avionics systems belonging to the avionics domain and one or more electronic devices belonging to the open domain, the communication gateway being capable of being connected between the electronic device(s) and the avionics systems. The gateway then interfaces between the open domain and the avionics domain.

[0002] The invention also relates to an aircraft comprising such a communication gateway.

[0003] The present invention also relates to a method of filtering data message(s) within an avionics communication installation intended to be carried on board an aircraft, the filtering method being implemented by such a communication gateway.

[0004] The invention also relates to a computer program comprising software instructions which, when executed by a computer, implement such a filtering process.

[0005] The invention relates more particularly to an airplane, while being applicable to any type of aircraft, such as a helicopter or a drone.

[0006] The invention relates in particular to the field of cybersecurity in an avionics context.

[0007] An aircraft typically includes avionics systems to assist in piloting the aircraft, such as a Flight Management System (FMS); a Flight Guidance System (FG); a Flight Control System (FCS); etc. These avionics systems exchange information with each other via an aircraft communication network, which is part of an onboard communication system that generally includes systems other than the avionics systems. The communication system notably includes systems implementing functions related to the airline operating the aircraft, such as a Centralized Maintenance System (CMS); or a passenger cabin management system.

[0008] Avionics systems are grouped into a domain, called the avionics domain, which corresponds to the highest required security level for the aircraft's communication system. This level is designed to ensure that the operation of the functions implemented by the avionics systems is not likely to be disrupted by communications with equipment outside the avionics domain. The security level required for other equipment is lower than the security level required for the avionics domain.

[0009] The communication installation is for example compliant with the ARINC 811 standard which defines different domains having different levels of security in an aircraft communication installation, including: an ACD (Aircraft Control Domain) corresponding to the aforementioned avionics domain; an AISD (Airline Information Services Domain) comprising equipment implementing functions relating to the airline (maintenance, cabin management, etc.); and a PIESD (Passenger Information and Entertainment Services Domain) relating to passenger entertainment and information.

[0010] In accordance with ARINC 811, the safety level of the ACD domain corresponds to the highest safety level of the aircraft communication system because the functions implemented by the equipment in the ACD domain may be essential for flight control of the aircraft. The safety level of the AISD domain is lower than that of the ACD domain, as the functions implemented in the AISD domain are less essential, at least in the short term, for flight control of the aircraft. The safety level of the PIESD domain is lower than the safety level of the AISD domain.

[0011] The invention then relates to the input of information into the certified avionics domain, such as the ACD domain, from the open non-certified domain, in particular from the AISD domain.

[0012] The exchange of information from a domain with a lower security level (outside the ACD domain) to a domain with a higher security level (ACD domain) is very strongly restricted in order not to compromise the security of the domain with the highest security level.

[0013] To meet this need for a security gateway between the open domain and the higher-security avionics domain, document EP 3 585 030 A1 describes a communication gateway comprising a first-type barrier for filtering information from the open domain so as to allow said information to enter a communication domain only if it corresponds to an authenticated communication, and a second-type barrier for filtering information from the open domain. The information transmitted from the communication domain to the avionics domain undergoes at least one syntactic filtering. The communication gateway is also configured to subsequently perform semantic filtering of this information.

[0014] However, such a security gateway is not optimal.

[0015] The aim of the invention is then to propose an electronic communication gateway intended to be carried on board an aircraft, allowing to further improve the filtering of messages from the open domain destined for the avionics domain, in particular to reduce a risk of cyberattack aimed at causing a malfunction of avionics systems.

[0016] To this end, the invention relates to an electronic communication gateway intended to be installed on board an aircraft, the aircraft comprising a communication installation compartmentalized into an avionics domain and an open domain, external to the avionics domain, the communication installation comprising several avionics systems belonging to the avionics domain and one or more electronic devices belonging to the open domain,

[0017] The communication gateway being capable of being connected between the electronic device(s) and the avionics systems, the communication gateway comprising:

[0018] - an acquisition module configured to acquire, from an electrical device tronics belonging to the open domain, at least one data message destined for an avionics system belonging to the avionics domain;

[0019] - a filtering module connected to the output of the acquisition module and configured for filter each respective acquired message, by validating said message if it meets a set of filtering criteria and by blocking it as soon as a filtering criterion of said set is not met; the set of filtering criteria being selected, from a set of filtering criteria, according to a type of said message;

[0020] - a transmission module connected to the output of the filtering module and configured to transmit, to the corresponding avionics system, each message validated by the filtering module;

[0021] at least one filtering criterion of said game being parameterized via a respective filtering parameter, and at least one filtering parameter dependent on the recipient avionics system, being variable from one avionics system to another.

[0022] Setting at least one filtering criterion for said game via a respective filtering parameter allows for configurable filtering for the communication gateway. Furthermore, the fact that at least one filtering parameter depends on the receiving avionics system, being variable from one avionics system to another, allows for filtering adapted to each receiving avionics system. The filtering performed by the communication gateway is then optimized according to each recipient avionics system.

[0023] According to other advantageous aspects of the invention, the communication gateway comprises one or more of the following features, taken individually or in all technically possible combinations:

[0024] - the gateway further includes a retrieval module configured to obtain, from an electronic device external to the gateway, a set of filtering parameter(s) associated with the set of filtering criteria,

[0025] the filtering module being then configured to filter each message according to the set of filtering criteria parameterized via the set obtained of filtering parameter(s);

[0026] - each acquired data message comprises several fields of different types, and the set of filtering criteria includes at least one filtering criterion dependent on a single type of field, called a single-field criterion;

[0027] each single-field criterion being chosen from the group consisting of: a criterion based on the number of occurrences of a given type of field in the message; a criterion based on the number of occurrences of a given character in a given field of the message; and a criterion based on the membership of a value of a given field of the message in a predefined range of values;

[0028] - each acquired data message comprises several fields of different types, and the set of filtering criteria includes at least one filtering criterion that depends on several types of fields at once, called a multi-field criterion;

[0029] at least one multi-field criterion preferably being based on the combination of a value of a primary field type of the message and a number of occurrences of a secondary field type of said message;

[0030] - each acquired data message comprises several fields of different types, and the set of filtering criteria includes at least one field condition criterion in the message;

[0031] each condition criterion being chosen from the group consisting of: a prohibition of a given type of field in the message; an obligation of a given type of field in the message; an exclusion of a first type of field with respect to a second type of field in the message; and a verification of a given ordering of certain fields in the message;

[0032] - the set of filtering criteria includes at least two distinct types of criteria among the group of criterion types consisting of: single-field criterion, multi-field criterion, and condition criterion;

[0033] the set of filtering criteria preferably including at least one single-field criterion, at least one multi-field criterion, and at least one condition criterion;

[0034] - the avionics domain is a domain corresponding to the highest level of safety raised on board the aircraft;

[0035] the avionics domain being preferably the ACD domain according to the ARINC 811 standard of December 20, 2005; and

[0036] - the set of filtering criteria includes a set of syntactic and / or criteria a set of semantic criterion(a);

[0037] each syntactic criterion being preferably chosen from the group consisting of: the message sender's membership in a list of authorized senders, the message recipient's membership in a list of authorized recipients, and the message's conformity to one of the authorized predefined formats;

[0038] each semantic criterion being preferably chosen from the group consisting of: the belonging of one or more data of the message to a range of allowed values, the consistency of at least one data of the message with respect to a predefined reference, and the consistency between at least two data of the message.

[0039] The invention also relates to an aircraft comprising a communication installation compartmentalized into an avionics domain and an open domain external to the avionics domain; the communication installation comprising several avionics systems belonging to the avionics domain, one or more electronic devices belonging to the open domain, and an electronic communication gateway connected between the electronic device(s) and the avionics systems, the communication gateway being as defined above.

[0040] The invention also relates to a method for filtering data message(s) within an avionics communication system intended to be installed on board an aircraft, the communication system being compartmentalized into an avionics domain and an open domain, external to the avionics domain, and comprising several avionics systems belonging to the avionics domain and one or more electronic devices belonging to the open domain, the filtering method being implemented by an electronic communication gateway and comprising the following steps:

[0041] - acquire, from an electronic device belonging to the open domain, at minus a data message destined for an avionics system belonging to the avionics domain;

[0042] - filter each respective acquired message, validating said message if it complies with a set of filtering criteria and blocking it as soon as a filtering criterion of said set is not met; the set of filtering criteria being selected, from a set of filtering criteria, according to a type of said message;

[0043] - transmit each validated message to the cor avionics system respondent;

[0044] at least one filtering criterion of said game being parameterized via a respective filtering parameter, and at least one filtering parameter dependent on the avionics system of the- recipient, being variable from one avionics system to another.

[0045] The invention also relates to a computer program comprising software instructions which, when executed by a computer, implement a filtering process as defined above.

[0046] These features and advantages of the invention will become clearer upon reading the following description, given solely by way of non-limiting example, and made with reference to the accompanying drawings, in which:

[0047] [Fig-1] [Fig.1] is a schematic representation of an aircraft according to the invention comprising a communication installation divided into an avionics domain and an open domain external to the avionics domain; the communication installation comprising several avionics systems belonging to the avionics domain, one or more electronic devices belonging to the open domain, and an electronic communication gateway connected between the electronic device(s) and the avionics systems; and

[0048] [Fig.2] [Fig.2] is a flowchart of a method, according to the invention, for filtering data message(s) within the avionics communication installation of [Fig.1], the process being implemented by the electronic communication gateway.

[0049] The expressions "approximately equal to" and "of the order of" define a relationship of equality to plus or minus 20%, preferably to plus or minus 10%, and preferably still to plus or minus 5%.

[0050] In [Fig.1], an aircraft 5 includes a communication installation 10 compartmentalized into an avionics domain 15 and an open domain 18, external to the avionics domain 15.

[0051] The communication installation 10 comprises several avionics systems 20 belonging to the avionics domain 15; as well as one or more electronic devices 25, external to the avionics domain 15 and belonging to the open domain 18; and an electronic communication gateway 30 connected between the electronic device(s) 25 and the avionics systems 20. In the example of [Fig. 1], the communication installation 10 comprises several electronic devices 25, each belonging to the open domain 18.

[0052] In addition, the communication installation 10 further includes a communication server 35 communicating via a communication link 38 with at least one electronic device 40, external to the aircraft 5.

[0053] The avionics domain 15 is a domain corresponding to the highest level of safety on board the aircraft 5, in particular the highest required level of safety of the communication installation 10 of the aircraft 5.

[0054] Avionics domain 15 is then a domain to limit a risk of disturbance - by at least one communication with an external electronic device or apparatus in the avionics domain 15 - of function(s) implemented by at least one avionics system 20 in the avionics domain 15. The avionics domain 15 includes the avionics system(s) 20.

[0055] Avionics domain 15 is typically the ACD domain according to ARINC 811 standard of December 20, 2005.

[0056] The open domain 18 is a domain which corresponds to a lower level of security than the level of security of the avionics domain 15. The open domain 18 includes the electronic device(s) 25.

[0057] Each avionics system 20 is on board the aircraft 5 and belongs to the avionics domain 15. Each avionics system 20 is known in itself, also called an avionics computer, and is configured to implement one or more respective avionics functions.

[0058] Each avionics system 20 is for example chosen from the group consisting of: a flight management system, also called FMS (Flight Management System); a guidance system, or FG (Flight Guidance); a flight control system, or FCS (Flight Control System); a GNSS (Global Navigation Satellite System) satellite positioning system, such as a GPS (Global Positioning System); an inertial reference system, also called 1RS (Inertial Reference System); an ILS (Instrument Landing System) or MLS (Microwave Landing System); an active runway overrun prevention system, also called ROPS (Runway Overrun Prevention System); and a radio altimeter, also denoted RA (Radio Altimeter).

[0059] Each electronic device 25 belonging to the open domain 18 does not implement a respective avionics function, and therefore generally does not require specific certification.

[0060] The electronic communication gateway 30, hereafter referred to as communication gateway 30 or gateway 30, is an interface between the open domain 18 and the avionics domain 15. A data message transmitted between the open domain 18 and the avionics domain 15, that is, from the open domain 18 to the avionics domain 15, or vice versa from the avionics domain 15 to the open domain 18, necessarily passes through the communication gateway 30.

[0061] The communication gateway 30 is also called the security gateway, and is configured to perform at least one filtering of a data message intended for a respective avionics system 20.

[0062] The communication gateway 30 comprises a module 42 for acquiring at least one data message destined for an avionics system 20; a module 44 for filtering each respective acquired message, validating said message if it meets a set of filtering criteria and blocking it as soon as a filtering criterion of said set is not met, the filtering module 44 being connected to the output of the acquisition module 42; and a transmission module 46 for transmitting, to the corresponding avionics system 20, each message validated by the filtering module 44, the transmission module 46 being connected to the output of the filtering module 44. Those skilled in the art will understand that a set of filtering criteria is understood as a group of filtering criteria, or a set of filtering criteria, that is to say, a set of one or more filtering criteria.

[0063] As an optional addition, gateway 30 further includes a module 48 for obtaining a set of filtering parameters associated with the set of filtering criteria. Those skilled in the art will understand that a set of filtering parameters is understood as a group of filtering parameters, or a batch of filtering parameters, that is to say, a set of one or more filtering parameters.

[0064] The communication gateway 30 includes, for example, an information processing unit 50 typically formed of a memory 52 and a processor 54 associated with the memory 52.

[0065] According to this example, the acquisition module 42, the filtering module 44, and the transmission module 46, as well as, optionally, the data acquisition module 48, are each implemented as software, or a software component, executable by the processor 54. The memory 52 of the communication gateway 30 is then capable of storing software for acquiring at least one data message destined for an avionics system 20; software for filtering each respective acquired message; and software for transmitting, to the corresponding avionics system 20, each message validated by the filtering software. Optionally, the memory 52 of the communication gateway 30 is also capable of storing software for obtaining the set of filtering parameters associated with the set of filtering criteria.The processor 54 of the communication gateway 30 is then capable of executing each of the software programs among the acquisition software, the filtering software and the transmission software, as well as, optionally, the output software.

[0066] In an alternative not shown, the acquisition module 42, the filtering module 44 and the transmission module 46, as well as the optionally supplementary obtaining module 48, are each made in the form of a programmable logic component, such as an FPGA (Field Programmable Gate Array) or an integrated circuit, such as an ASIC (Application Specified Integrated Circuit).

[0067] When the communication gateway 30 is implemented in the form of one or more Software, that is, in the form of a computer program, also called a computer program product, is also capable of being stored on a computer-readable medium. A computer-readable medium is, for example, a medium capable of storing electronic instructions and being connected to a bus of a computer system. Examples of such a readable medium include an optical disc, a magneto-optical disc, ROM, RAM, any type of non-volatile memory (e.g., EPROM, EEPROM, FLASH, NVRAM), a magnetic card, or an optical card. A computer program containing software instructions is then stored on this readable medium.

[0068] The communication server 35 is configured to communicate via the communication link 38 with at least one external electronic device 40, said at least one external electronic device 40 being, for example, a ground station or a cloud computing device. The communication server 35 is preferably connected to the communication gateway 30. The communication server 35 typically belongs to the open domain 18.

[0069] The communication server 35 is known per se, and includes in particular a transceiver, not shown, compatible with the communication link 38. The communication link 38 is typically a radio link, that is to say a link by radio waves, such as a satellite link. The transceiver is then a radio transceiver.

[0070] The external electronic equipment 40 is typically connected to the computer infrastructure of an operational control center, also known as an OCC. The external electronic equipment 40 is then advantageously configured to transmit data, such as a flight plan for the aircraft 5 and information relating to the aircraft 5, such as its mass, configuration, balance, or identifier.

[0071] The acquisition module 42 is configured to acquire, from an electronic device 25 belonging to the open domain 18, at least one data message destined for a respective avionics system 20, belonging to the avionics domain 15. The electronic device 25, from which the message is acquired, is typically the communication server 35, if the message is sent from the external electronic equipment 40.

[0072] The acquisition module 42 is configured, for example, to acquire each message according to a respective avionics communication protocol.

[0073] The avionics communication protocol is, for example, chosen from the group consisting of: a protocol conforming to the ARINC 702 standard; a protocol conforming to the ARINC 739 standard; a protocol conforming to the ARINC 619 standard; a protocol compliant with the ARINC 429 standard; and a protocol compliant with the FANS (Future Air Navigation System) N standard associated with EUROCAE ED-100.

[0074] Each acquired data message includes a header and a useful part, also called a payload, containing the useful data of the message, i.e. the data to be transmitted to the corresponding avionics system 20.

[0075] The header typically includes a preamble used for message synchronization, and including, for example, a delimiter to signal the start of the message information; an indication relating to the destination, such as a destination address, i.e. an address or identifier of the avionics system 20 receiving the message; an indication relating to the source, such as a source address, i.e. an address or identifier of the message sender; and a control code, such as a cyclic redundancy check code or CRC.

[0076] The useful part of the message comprises several fields, the useful part being segmented, i.e., decomposed into several successive portions, each portion of the useful part forming a respective field. The useful part of the message generally comprises several fields of different types, and these types typically depend on the avionics communication protocol.

[0077] By field type, we mean a type of quantity represented by the field, that is, the type of quantity whose value is contained within said field. For each field, each avionics communication protocol defines the field type, generally with a name for said type, and a range of values ​​associated with that type. For example, in the ARINC 702 standard defining the content of messages typically containing flight plans, the different field types correspond to different types of quantities associated with waypoints in the flight plan, such as a way to pass a waypoint, a latitude of the waypoint, a longitude of the waypoint, a way to reach the waypoint, etc.

[0078] For example, according to the ARINC 702 standard, field types are defined by identifiers (from the English TAG) in the message, or by their positioning in the message according to an order defined in the standard.

[0079] Examples of field types for the protocol conforming to the ARINC 702 standard are then the following: a latitude of the waypoint, a longitude of the waypoint, a way of passing a waypoint, a way of reaching the waypoint, a departure airport, an arrival airport.

[0080] By way of example, according to the ARINC 739 standard, each type specifies an encoding of the bit values ​​of an ARINC 429 label from among several possible distinct encodings of said bit values.

[0081] Examples of field types for the protocol conforming to the ARINC 739 standard are then the following: colour (from the English COLOR); line number (from the English LINE NUMBER); function (from the English FUNCTION); and initial character position (from the English INITIAL CHARACTER POSITION).

[0082] For example, according to the ARINC 619 standard, field types are defined by their position relative to other fields in the message.

[0083] Examples of field types for the protocol conforming to the ARINC 619 standard are then the following: departure station (from the English Departure Station); scheduled flight time (from the English Scheduled date of flight).

[0084] For example, according to the ARINC 429 standard, field types are defined by their position in the message, typically 32 bits. The allocation of bits and fields changes depending on the value of the "Label" field associated with the first 8 bits of the 32-bit word, and potentially on the value of another field specifying how the rest of the bits in the 32-bit word should be interpreted.

[0085] Examples of field types for the protocol conforming to the ARINC 429 standard are then the following: an aircraft position (from the English SV Position X); a reference air speed (from the English Reference Air speed).

[0086] The filtering module 44 is configured to filter each acquired message, validating the message if it meets a set of filtering criteria and blocking it as soon as a filtering criterion from that set is not met. The set of filtering criteria is selected from a set of criteria based on the type of the message.

[0087] Validating the message means accepting the message, that is, authorizing the message for transmission to the avionics domain 15. Through message filtering via the filtering module 44, the communication gateway 30 fulfills a cybersecurity function. In other words, the communication gateway 30 forms a security barrier between the open domain 18 and the avionics domain 15. Put another way, the entry of message(s) into the avionics domain 15 is secured through the filtering performed by the communication gateway 30, specifically by the filtering module 44.

[0088] By blocking the message, we mean rejecting the message, that is, preventing its transmission to the avionics domain 15. The filtering module 44 is then typically configured to block a message that does not meet a filtering criterion of said game, by deleting said message. As an optional addition, the filtering module 44 is also configured to keep a log of each blocked message before deleting said message.

[0089] According to the invention, at least one filtering criterion of said game is parameterized via a The respective filtering parameter, and at least one filtering parameter, depends on the receiving avionics system 20, being variable from one avionics system 20 to another. The filtering module 44 is then configured to determine the avionics system 20 that is the recipient of the message to be filtered, for example from the destination indication contained in the message header; and then to use the filtering parameter(s) associated with said receiving avionics system 20.

[0090] The set of filtering criteria typically includes at least one filtering criterion dependent on a single type of field, called a single-field criterion.

[0091] Each single-field criterion is for example chosen from the group of criteria consisting of: a criterion based on a number of occurrences of a given type of field in the message; a criterion based on a number of occurrences of a given character in a given field of the message; and a criterion based on the membership of a value of a given field of the message in a predefined range of values.

[0092] When the filtering criterion is based on the number of occurrences of a given type of field in the message, the filtering parameter associated with this criterion is typically a value or range of values ​​of said number of occurrences, or a value of the given type of field, i.e. a parameter defining the given type of field.

[0093] The criterion based on the number of occurrences of a given type of field corresponds for example to the number of waypoints in a flight plan message, the filtering module 44 then being configured to check that the number of waypoints contained in the flight plan message is less than a predefined or parameterized maximum value, and / or is greater than a predefined or parameterized minimum value.

[0094] When the filtering criterion is based on the number of occurrences of a given character in a given field of the message, the filtering parameter associated with this criterion is typically a value or range of values ​​of said number of occurrences, or a value of the given character, i.e. a parameter defining said given character.

[0095] The criterion based on the number of occurrences of a given character in a given field corresponds, for example, to the calculation of the number of "." characters in a query associated with SNMP (Simple Network Management Protocol) requesting information on an object identifier or OID (Object Identifier). The filtering module 44 is then configured to verify that the number of "." characters contained in the OID is less than a predefined or parameterized maximum value, and / or is greater than a predefined or parameterized minimum value. The OID encoded in the form "1.3.6.1.4.1.2680.1.2.7.3.2.1" contains, for example, 12 "." characters, and the number of occurrences of the "." character is therefore equal to 12.

[0096] When the filtering criterion is the criterion based on the membership of a value of a Given a field in the message with a predefined range of values, the filtering parameter associated with this criterion is typically a parameter defining the given type of field, or the range of values ​​to which membership is tested.

[0097] The criterion based on the membership of a value of a given field in a predefined range of values ​​corresponds for example to received frequencies compatible with the capabilities of the receiving avionics system 20, the filtering module 44 then being configured to check that said received frequencies belong to the predefined range of frequency values.

[0098] In addition or alternatively, the set of filtering criteria typically includes at least one filtering criterion that depends on several types of field at once, called a multi-field criterion.

[0099] At least one multi-field criterion is for example based on the combination of a value of a primary field type of the message and a number of occurrences of a secondary field type of said message, the secondary type being distinct from the primary type.

[0100] The multi-field criterion allows, for example, verification that a text to be displayed is compatible with the display capacity of a screen of the receiving avionics system 20. The multi-field criterion then takes into account the starting position of the display, corresponding to the primary type, and the number of characters to be displayed, the character to be displayed corresponding to the secondary type. The filtering module 44 is then configured to verify that the combination of these two quantities is compatible with said display capacity.

[0101] In the aforementioned examples, the predefined value ranges are preferably determined according to a predefined usage domain for the recipient avionics system 20, i.e. according to predefined capabilities for the recipient avionics system 20.

[0102] In addition or alternatively, the set of filtering criteria includes at least one field condition criterion in the message.

[0103] Each condition criterion is, for example, chosen from the group consisting of: a prohibition of a given type of field in the message; a requirement of a given type of field in the message; an exclusion of a first type of field with respect to a second type of field in the message; and a verification of a given ordering of certain fields in the message. In other words, each condition criterion corresponds, for example, to a condition chosen from the group consisting of: a presence condition, an absence condition, a mutual exclusion condition, and an ordering condition.

[0104] The condition criterion corresponds, for example, to the simultaneous non-presence of the RP and RI fields in a message conforming to the ARINC 702 standard, the RP field being ending an active route, and the RI field defining an inactive route.

[0105] In addition, the set of filtering criteria includes at least two distinct types of criteria from the group of criterion types consisting of: single-field criterion, multi-field criterion, and condition criterion.

[0106] According to this supplement, the set of filtering criteria preferably includes at least one single-field criterion, at least one multi-field criterion, and at least one condition criterion; that is to say, at least one criterion of each of the aforementioned types.

[0107] In addition to the filtering that is dependent on the receiving avionics system 20 and varies from one avionics system 20 to another, the filtering module 44 is configured to implement variable filtering based on a use case. For example, the filtering module 44 is configured to implement this use case-dependent variability by varying the set of filtering criteria according to a use case, typically via a number of filtering criteria that increases with the severity of the use case, i.e., with increased safety for the use case. Alternatively or in addition, the filtering module 44 is configured to implement this use case-dependent variability by varying the set of filtering parameters according to a use case, typically via more restrictive ranges of filtering parameter values ​​when the use case is more severe or more safety-conscious.

[0108] The use cases are, for example, the following, ranked in ascending order of filtering level:

[0109] - development case, also called design case, with filtering minimal;

[0110] - maintenance case, with reduced filtering;

[0111] - nominal operating case, with nominal filtering;

[0112] - operational security use case, for example in the presence of a cyberattack alert or cyber intrusion, with maximum filtering, or even a temporary ban on any message coming from the open domain 18.

[0113] The transmission module 46 is configured to transmit, to the corresponding avionics system 20, each message validated by the filtering module 44.

[0114] The transmission module 46 is typically configured to transmit each validated message to the corresponding avionics system 20, according to the respective avionics communication protocol, i.e. the avionics communication protocol corresponding to that according to which the message was previously acquired by the acquisition module 42.

[0115] As an optional complement, the retrieval module 48 is configured to obtain the set of filtering parameters associated with the set of filtering criteria.

[0116] According to this optional add-on, the filtering module 44 is then configured to filter each message according to the set of filtering criteria configured via the set of filtering parameters which was obtained by the acquisition module 48.

[0117] According to this optional complement, the acquisition module 48 is for example configured to obtain said set of filtering parameter(s) from an electronic device 60 external to the gateway 30. Advantageously, the acquisition module 48 is configured to check an authentication certificate and / or an integrity certificate for each set of filtering parameter(s), and to then validate a respective set of filtering parameter(s) only if its authentication certificate and / or its integrity certificate are valid.

[0118] The authentication certificate verifies that the respective set of filtering parameters is a genuine set issued from a recognized source, and not a malicious set issued from an attacking source. The authentication certificate is, for example, a 4096-bit RSA certificate.

[0119] The integrity certificate allows verification that the respective set of filtering parameter(s) is an intact set that has not been corrupted during its transmission from the electronic device 60. The integrity certificate is for example of type SHA-2 (from the English Secure Hash Algorithm).

[0120] The electronic device 60 is connected to the communication gateway 30. The electronic device 60 is typically included in the open domain 18 and is easily accessible by a user, in order to store new sets of filtering parameters (not shown) in a memory (not shown) of said device 60 and / or modify one or more sets of filtering parameters already stored in this memory. The user is typically a member of the aircraft 5 crew, such as the aircraft 5 pilot, or an operator configuring the aircraft 5 prior to flight.

[0121] The operation of the communication gateway 30 according to the invention will now be described with reference to [Fig.2] representing a flowchart of the data message(s) filtering process within the avionics communication installation 10, said filtering process being implemented by the communication gateway 30.

[0122] During an initial step 100, the communication gateway 30 acquires, via its acquisition module 42 and from a respective electronic device 25 belonging to the open domain 18, at least one data message destined for a respective avionics system 20 belonging to the avionics domain 15.

[0123] Optionally, at the end of the acquisition step 100, or alternatively - not shown - prior to the acquisition step 100, the communication gateway 30 obtains, via its acquisition module 48 and from the electronic device 60, at least one set of filtering parameter(s) associated with the set of filtering criteria corresponding to the type of at least one message acquired.

[0124] The person skilled in the art will then understand that this optional obtaining step 110 then allows taking into account a set of filtering parameter(s) which would not be previously stored in the communication gateway 30.

[0125] The communication gateway 30 then proceeds to the filtering stage 120 during which it filters, via its filtering module 44, each respective acquired message by validating said message if it meets a set of filtering criteria and by blocking it as soon as a filtering criterion of said set is not met, the set of filtering criteria being selected according to the type of said message and from among the set of filtering criteria.

[0126] According to the invention, during the filtering step 120, at least one filtering criterion of said set is parameterized via a respective filtering parameter, and at least one filtering parameter depends on the recipient avionics system 20, preferably varying from one avionics system 20 to another.

[0127] Advantageously, each filtering criterion is a criterion of the type chosen from among the criteria described above, namely single-field criterion, multi-field criterion, and condition criterion.

[0128] At the end of the filtering step 120, the communication gateway 30 transmits, via its transmission module 46 and to the recipient avionics system 20, the message acquired during the acquisition step 100 if it has subsequently been validated during the filtering step 120, that is to say if said message complied with the set of filtering criteria selected.

[0129] This selective and variable filtering, depending on the receiving avionics system 20, allows the filtering to be adapted to each receiving avionics system 20 of a message, and in particular to verify that the message intended for a respective avionics system 20 is compatible with said avionics system 20, in particular with the capacity(s) of said avionics system 20. This filtering aims in particular to prevent the transmission of the message to the respective avionics system 20 from saturating said avionics system 20.

[0130] By way of example, if the filtering module 44 is configured to verify that the number of waypoints contained in the flight plan message is less than a maximum value, and if an avionics system 20, denoted A, supports only 200 waypoints at most, while an avionics system 20, denoted B, supports 256 waypoints, then the communication gateway 30 according to the invention makes it possible, on the one hand, to verify that the number of waypoints contained in the flight plan will not exceed the capacity of the receiving avionics system 20, and on the other hand, to have a maximum value for said number of waypoints that varies from one avionics system 20 to another, and is thus adjusted as best as possible to the capacity of each avionics system 20, with, for example, a maximum value equal to 200 for the system A, and equal to 256 for system B.

[0131] It is thus understood that the communication gateway 30 according to the invention makes it possible to further improve the filtering of messages from the open domain 18 destined for the avionics domain 15, in particular to reduce a risk of cyberattack aimed at causing a malfunction of certain avionics systems 20.

Claims

Demands

1. Electronic communication gateway (30) intended to be carried on board an aircraft (5), the aircraft (5) comprising a communication installation (10) compartmentalized into an avionics domain (15) and an open domain (18), external to the avionics domain (15), the communication installation (10) comprising several avionics systems (20) belonging to the avionics domain (15) and one or more electronic devices (25) belonging to the open domain (18), the communication gateway (30) being capable of being connected between the electronic device(s) (25) and the avionics systems (20), the communication gateway (30) comprising: - an acquisition module (42) configured to acquire, from an electronic device (25) belonging to the open domain (18), at least one data message destined for an avionics system (20) belonging to the avionics domain (15);- a filtering module (44) connected at the output of the acquisition module (42) and configured to filter each respective acquired message, validating said message if it meets a set of filtering criteria and blocking it as soon as a filtering criterion of said set is not met; the set of filtering criteria being selected, from a set of filtering criteria, according to a type of said message; - a transmission module (46) connected at the output of the filtering module (44) and configured to transmit, to the corresponding avionics system (20), each message validated by the filtering module (44); characterized in that at least one filtering criterion of said set is parameterized via a respective filtering parameter, and at least one filtering parameter depends on the receiving avionics system (20), being variable from one avionics system (20) to another.

2. Gateway (30) according to claim 1, wherein the gateway (30) further comprises a retrieval module (48) configured to obtain, from an electronic device external to the gateway (30), a set of filtering parameter(s) associated with the set of filtering criteria, the filtering module (44) then being configured to filter each message according to the set of filtering criteria parameterized via the obtained set of filtering parameter(s).

3. Gateway (30) according to claim 1 or 2, wherein each acquired data message comprises several fields of different types, and the set of filtering criteria includes at least one filtering criterion dependent on a single type of field, called a single-field criterion; each single-field criterion being chosen from the group consisting of: a criterion based on the number of occurrences of a given type of field in the message; a criterion based on the number of occurrences of a given character in a given field of the message; and a criterion based on the membership of a value of a given field of the message in a predefined range of values.

4. Gateway (30) according to any one of the preceding claims, wherein each acquired data message comprises several fields of different types, and the set of filtering criteria includes at least one filtering criterion dependent on several field types at once, called a multi-field criterion; at least one multi-field criterion preferably being based on the combination of a value of a primary field type of the message and a number of occurrences of a secondary field type of said message.

5. Gateway (30) according to any one of the preceding claims, wherein each acquired data message has several fields of different types, and the set of filtering criteria includes at least one condition criterion for field(s) in the message; each condition criterion being chosen from the group consisting of: a prohibition of a given type of field in the message; a requirement of a given type of field in the message; an exclusion of a first type of field with respect to a second type of field in the message; and a verification of a given ordering of certain fields in the message.

6. Gateway (30) according to claims 3 to 5, wherein the set of filtering criteria includes at least two distinct types of criteria from the group of criterion types consisting of: single-field criterion, multi-field criterion, and condition criterion; the set of filtering criteria preferably including at least one single-field criterion, at least one multi-field criterion, and at least one condition criterion.

7. Gateway (30) according to any one of the preceding claims, wherein the avionics domain (15) is a domain corresponding to the highest level of safety on board the aircraft (5).

8. Aircraft (5) comprising a communication installation (10) compartmentalized into an avionics domain (15) and an open domain (18) external to the avionics domain (15); the communication installation (10) comprising several avionics systems (20) belonging to the avionics domain (15), one or more electronic devices (25) belonging to the open domain (18), and an electronic communication gateway (30) connected between the electronic device(s) (25) and the avionics systems (20), characterized in that the communication gateway (30) is according to any one of the preceding claims.

9. A method for filtering data message(s) within an avionics communication installation (10) intended to be carried on board an aircraft (5), the communication installation (10) being compartmentalized into an avionics domain (15) and an open domain (18), external to the avionics domain (15), and comprising several avionics systems (20) belonging to the avionics domain (15) and one or more electronic devices (25) belonging to the open domain (18), the filtering method being implemented by an electronic communication gateway (30) and comprising the following steps: - acquiring, from an electronic device (25) belonging to the open domain (18), at least one data message destined for an avionics system (20) belonging to the avionics domain (15);- filter each respective acquired message, validating said message if it meets a set of filtering criteria and blocking it as soon as a filtering criterion of said set is not met; the set of filtering criteria being selected, from a set of filtering criteria, according to a type of said message; - transmit each validated message to the corresponding avionics system (20); characterized in that at least one filtering criterion of said set is parameterized via a respective filtering parameter, and at least one filtering parameter depends on the receiving avionics system (20), being variable from one avionics system (20) to another.

10. A computer program comprising software instructions which, when executed by a computer, implement a method according to the preceding claim.

Images