Aircraft having a security system at the interface between a first domain and a second domain

Abstract

Aircraft having a security system at the interface between a first domain and a second domain. The aircraft (10) comprises a first domain (12, 14) having lower security requirements, including at least one system (42, 44) for generating an input video stream (20), and a second domain (16) having higher security requirements, including at least one system for processing and / or displaying an output video stream (22) obtained from the first domain (12, 14). It includes a video stream security system (18) forming a video interface between the first domain (12, 14) and the second domain (16), the security system (18) being configured to receive the input video stream (20) according to the first video transmission protocol and to generate the output video stream (22) from the input video stream (20), according to a second video transmission protocol. Figure for the abbreviation: Figure 1

Description

Title of the invention: Aircraft having a security system at the interface between a first domain and a second domain

[0001] The present invention relates to an aircraft comprising: - a first domain with lower security requirements, comprising at least one system for generating an input video stream using a first video transmission protocol, - a second domain with higher security requirements, including at least one system for processing and / or displaying an output video stream obtained from the first domain.

[0002] Such an aircraft is configured to allow the establishment of a video link from a system generating a video stream in an open domain, such as an operator service domain or a passenger service domain, to a more secure domain, such as an aircraft control domain, including an aircraft avionics unit.

[0003] Securing the aircraft's control domain is essential to prevent a takeover or malicious attack against vital aircraft functions such as flight controls.

[0004] In this respect, the aircraft's control domain is segregated from other more open aircraft domains.

[0005] However, the transmission of video streams from certain computer systems in the operator service domain or the passenger service domain, such as an Electronic Flight Bag (EFB) or a Modular Maintenance System (MMS), may be desirable. This would, in particular, allow these video streams to be displayed on avionics screens in the cockpit and would enable the crew to remotely access the displays of these systems.

[0006] Such video stream transmission is generally avoided at present, although some systems, such as the one described in US2020 / 0326205, are considering it. However, this transmission raises cybersecurity risks.

[0007] Thus, video transmission protocols are susceptible to attack by malicious third parties, in particular to impact the integrity of avionics or other critical aircraft systems, or more simply, to temporarily or permanently disrupt the availability of avionics or other aircraft systems.

[0008] This can be done, for example, by sending malformed data (particularly in terms of message size and illegal characters) using commands legitimate actions could occur within, for example, an unmonitored control channel. Other malicious actions would involve attempting to encapsulate malicious messages from an unmonitored protocol within a regular protocol and / or sending aberrant control plane parameters to systems in the critical domain.

[0009] An object of the invention is to obtain an aircraft having a cyber-secure architecture in which an aircraft video stream can be securely transmitted from a domain with lower security requirements to a domain with higher security requirements, in particular to the aircraft control domain.

[0010] To this end, the invention relates to an aircraft of the aforementioned type, characterized by: - a video stream security system forming a video interface between the first domain and the second domain, the security system being configured to receive the input video stream according to the first video transmission protocol and to generate the output video stream from the input video stream, according to a second video transmission protocol.

[0011] The aircraft according to the invention may include one or more of the following features, taken individually or in any technically possible combination: - the first video transmission protocol is different from the second video transmission protocol or the first video transmission protocol is identical to the second video transmission protocol; - the security system includes a programmable logic component or a dedicated logic circuit configured to receive the input video stream according to the first video transmission protocol and to generate the output video stream from the input video stream, according to the second video transmission protocol; - the security system includes at least one input video stream reception input, configured to receive the input video stream from the input video stream generation system; - the or each input video stream reception input is configured to receive a video stream following a Digital Video Interface protocol, a DisplayPort protocol, a High Definition Multimedia Interface (HDMI) protocol, or a Serial Digital Interface (SDI) protocol, including 3G-SDI; - each input / output of input video stream forms a first transmission channel of an input video data stream from the first domain, the security system having at least one input / output of control plane parameters forming a second transmission channel of control plane parameters to the first domain; - the security system includes a memory containing predetermined values ​​of a spatial and temporal input parameter of the control plane, the memory being connected to the or to each input / output of control plane parameters to allow the transmission of the predetermined values ​​of the spatial and temporal input parameter of the control plane to the first domain through the second transmission channel; - the security system includes at least one output for transmitting the output video stream connected to the second domain; - the output video stream transmission output is configured to output a video stream under an ARINC 818 protocol, a Digital Video Interface (DVI) protocol, a DisplayPort (DP) protocol, a High Definition Multimedia Interface (HDMI) protocol, or a Serial Digital Interface (SDI) protocol, including 3G-SDI; - the security system includes a module for decapsulating an input video data stream received according to the first video transmission protocol to extract image data and a module for re-encapsulating the image data according to a second video transmission protocol to generate the output video stream; - the second domain is an aircraft control domain including at least one avionics unit; - the first domain is an aircraft passenger service domain configured to include at least one passenger service system, and / or is an aircraft operator service domain configured to include at least one operator service system; - the system for processing and / or displaying an output video stream includes at least one display area for the output video stream or for a video stream produced using the output video stream; - it includes a selection and / or control system configured to allow interaction by a user on the display area, the aircraft including a unidirectional return link from the selection and / or control system to the first domain without going through the security system; - the unidirectional return link operates according to a user datagram protocol, an RS232 protocol, an RS422 protocol, an ARINC 429 protocol or an ARINC 729 protocol.

[0012] The invention will be better understood upon reading the following description, given solely by way of example and made with reference to the accompanying drawings, in which:

[0013] [Fig.1] [Fig.1] is a schematic view of an aircraft according to the invention comprising several domains having lower safety requirements and one domain having higher safety requirements, a flow securing system according to the invention being interposed between the domains having lower safety requirements and the domain having higher safety requirements.

[0014] [Fig.2] [Fig.2] is a security flowchart illustrating the implementation of a first security method according to the invention.

[0015] [Fig.3] [Fig.1] is a flowchart illustrating the implementation of a second security method according to the invention.

[0016] The relevant parts of a first aircraft 10 according to the invention are illustrated schematically in [Fig. 1].

[0017] The aircraft 10 thus includes an on-board computer infrastructure comprising at least a first computer domain 12, 14 having lower security requirements, the first domain 12, 14 comprising at least one system capable of generating and / or transmitting at least one video stream.

[0018] The IT infrastructure includes at least one second IT domain 16 having higher security requirements, including at least one system capable of receiving the video stream or streams, for processing and / or displaying them.

[0019] The aircraft 10 further comprises, according to the invention, a system for securing a video link between the first domain or each of the first domains 12, 14 and the second domain 16, to allow the second domain to securely receive the video stream generated by the first domain 12, 14.

[0020] The video stream comprises an input video stream 20 generated in the first domain 12, 14 and transmitted to the security system 18 and an output video stream 22 generated by the security system 18 from the input video stream 20.

[0021] The input video stream 20 is generated according to a first video transmission protocol, for example a Digital Video Interface (DVI) protocol, a Display Port (DP) protocol, a high-definition multimedia interface (HDMI) protocol, or a serial digital interface protocol, for example (3G)-SDI.

[0022] It comprises, along a first transmission channel, an input video data stream 24 including successive image data 26 configured to be projected in succession and complementary data 28.

[0023] The input video stream 20 further includes in this example, following a second transmission channel, a bidirectional stream of input control plane parameters 30 exchanged between the security system 18 and the first domain or domains 12, 14 to control the spatial and temporal input parameterization of the input video data stream 24.

[0024] The spatial and temporal input parameterization of the successive image data contained in the input video data stream 24 includes, for example, at least one frame definition, a synchronization, including a clock frequency and image refresh rate and a predefined resolution for the successive images, which are transmitted to the first domain 12, 14 by the security system 18 in the input control plane parameter stream 30.

[0025] The additional data 28 present in the input video data stream 24 includes metadata associated with the frames and / or images including, for example, a date, an order, a source identifier, enrichment data such as subtitles, and / or control plane data, including a cyclic redundancy check to verify that the frames, the synchronization and the resolution of the image data correspond to those defined by the security system 18. In some video protocols, the additional data 28 also includes network or bus routing information such as addresses of recipients of the video stream, for example.

[0026] The output video stream 22 is generated by the security system 18 according to a second video transmission protocol, following an output control plane having a predefined spatial and temporal output parameter. The second video transmission protocol is, for example, an ARINC 818 protocol, a Digital Video Interface (DVI) protocol, a DisplayPort (DP) protocol, a High Definition Multimedia Interface (HDMI) protocol, or a Serial Digital Interface (SDI) protocol, in particular 3G-SDI.

[0027] The output video stream 22 includes in particular output image data 32 from the input video data stream 24 and verification data 33 of conformity to the predefined output control plan, for example in the form of a cyclic redundancy check established from the definition of frames, synchronization and resolution used to generate the output image data 32.

[0028] In the example shown in [Fig.1], the aircraft 10 comprises several first domains 12, 14 having lesser safety requirements, including an operator service domain 12 and a passenger service domain 14.

[0029] Each first domain 12, 14 comprises at least one system 42, 44, in particular at least one computer, configured to be permanently connected or disconnectable to the security system 18. The system or each system 42, 44 is configured to generate the input video stream 20 intended to be received by the security system 18.

[0030] The system or each system 42, 44 is for example an on-board computer, a computer that can be disconnected from the aircraft 10 or a portable terminal, such as a laptop, a tablet or a mobile phone.

[0031] Operator service domain 12 relates in particular to aircraft maintenance and crew support during the various phases of the mission. This includes, in particular, access to various technical and aviation documentation resources available on board, or on one or more removable devices.

[0032] The system 42 generating the input video stream is, for example, an Electronic Flight Bag (EFB) or a Modular Maintenance System (MMS)

[0033] The passenger service domain 14 includes, for example, the control of material resources specific to passenger comfort, passenger entertainment, interactive mobile maps, functions dedicated to the cabin crew, and interface resources with terminals and devices specific to the aircraft occupants.

[0034] The system 44 generating the input video stream 20 is for example a video camera system intended to film the interior or exterior of the aircraft (for example a tail fin camera) or an internet navigation software hosted on a computer, in particular one of low trust in terms of cybersecurity.

[0035] The aircraft control domain 16 includes, in particular, engine control applications, flight controls, and aircraft systems control. It includes at least one avionics central unit 34 and at least one display device 36.

[0036] The avionics central unit 34 includes at least one computer and a memory configured to receive data from the various aircraft systems and to process them, possibly to control aircraft systems and execute flight commands.

[0037] The display device 36 includes at least one display area, for example located in the cockpit of the aircraft 10.

[0038] In the example shown in [Fig.1], the display device 36 comprises at least one first dedicated display area 37A, intended to be placed opposite a first crew member, in front of a first cockpit seat, at least one second dedicated display area 37B, intended to be placed opposite a second crew member, in front of a second cockpit seat, and at least one display area visible to both crew members 37C, 37D placed between the first display area 37A and the second display area 37B.

[0039] The display device 36 may include a first dedicated head-up display area, intended to be placed opposite the first seat and a second dedicated head-up display area, intended to be placed opposite the second seat.

[0040] The display device 36 further includes a display management unit 38 dedicated to controlling the display on the different display areas 37A to 37D by offering including the display of the output video stream 22 received from the security system 18 or a video stream produced using the output video stream 22. The display management unit 38 includes physical and / or software components configured to generate and control the display

[0041] The first dedicated display area 37A and the second dedicated display area 37B are generally defined by primary display screens, located opposite the seat of each respective crew member. They are intended to display, for example, at least one flight parameter window.

[0042] The upper display area 37C visible to both crew members and the lower display area 37D visible to both crew members are defined respectively on a multifunctional navigation screen intended to display at least one navigation window and on an aircraft systems control and / or monitoring screen to display at least one aircraft system monitoring and / or control window.

[0043] Alternatively, the display areas 37A to 37D are located on the same common screen, for example in the shape of a T.

[0044] In the example of [Fig.1], the display device 36 is further configured to process and / or display the successive images contained in the output video stream 22, for example on a display area 37A to 37D, in particular on areas 37B and 37D.

[0045] The security system 18 is arranged at an interface between the first domain or each of the first domains 12, 14 and the second domain 16.

[0046] In this example, the security system 18 consists of at least one computer which is an electronic circuit designed to manipulate and / or transform data represented by electronic or physical quantities in registers of the computer and / or memories into other similar data corresponding to physical data in register memories or other types of display devices, transmission devices or storage devices.

[0047] Preferably, the security system 18 is implemented as a programmable logic component, such as an FPGA (Field Programmable Gate Array), or as a dedicated integrated circuit, such as an ASIC (Application-Specific Integrated Circuit). These components define functional modules of the security system 18.

[0048] Alternatively, the security system 18 is implemented in the form of at least one processor and at least one memory containing software modules configured to be executed by the processor.

[0049] With reference to [Fig. 1], the security system 18 comprises at least one input 50A, 50B for receiving the input video data stream 24, at least one input / output 52A, 52B for transmitting / receiving input control plane parameter stream 30.

[0050] The security system 18 also includes at least one output 53 for transmitting the output video stream 22.

[0051] It includes an input video stream processing unit 54 configured to generate the output video stream 22 and an input control plane control unit 56 for the input video stream 20.

[0052] In the example shown in [Fig.1], the security system 18 includes at least one input 50A configured to be connected directly to a system 44 of the passenger services domain 14 and at least one input 50B connected to a system 42 of an operator service domain 12.

[0053] Each input 50A, 50B is configured to receive the input video data stream 24 following the input transmission protocol respecting the input control plane parameters transmitted to the system 42, 44 via the input / output 52A, 52B.

[0054] The input video stream processing unit 54 is connected to the input or each input 50A and 50B. It includes a module 60 for receiving and testing the conformity of the input video data stream 24, a module 62 for decapsulating the input video data stream 24 to extract the image data 26 and the additional data 28.

[0055] It also includes a filtering module 64 configured to remove at least part of the additional data 28, a module 66 for re-encapsulating the image data 26 according to a second video transmission protocol, advantageously distinct from the first video transmission protocol, to generate the output video stream 22, a module 67 for checking the conformity of the output video stream 22 according to the specifications of the second video transmission protocol and a module 68 for transmitting the output video stream 22 to the second domain 16, in particular to the display management assembly 38 of the display device 36.

[0056] The control plane mastering unit 56 includes a memory 80 storing the spatial and temporal input parameterization including a frame definition, a synchronization including a clock frequency and image refresh rate and a desired predefined resolution for the input video data stream 24.

[0057] The control plane control unit 56 includes a module 82 for supplying predetermined values ​​of the spatial and temporal input parameterization to the input / output 52A, 52B and a receiving module 84 for the input video data stream 24 to verify its conformity with the input control plane 30.

[0058] The control plane control unit 56 advantageously includes an addition module 86 of a conformity indicator to the output video stream 22.

[0059] The memory 80 is preferably a non-volatile memory, for example EPROM containing predetermined values ​​of the desired spatial and temporal parameters of the image data 26. These values ​​include predetermined frame definition, synchronization and / or controlled resolution values ​​for the image data 26. They form the control plane parameters for the input video stream 24 imposed by the security system 18.

[0060] A method for securing a video link between a first domain 12, 14 having lower security requirements and a second domain 16 having higher security requirements will now be described.

[0061] With reference to [Fig.2], in step 100, a system 42, 44 of the first domain 12, 14 is connected to the receiving input 50A, 50B.

[0062] The system 42, 44 generates the input video data stream 24 which is transmitted to the security system 18 using the first transmission protocol.

[0063] At step 102, the input video data stream 24 is received in the receiving and conformance test module 60.

[0064] In this module 60, at step 104, the input video data stream 24 is tested to verify its conformity to the first video transmission protocol, with respect to the protocol specifics which are stored for example in a table of the processing unit 54.

[0065] As described below (see steps 132 and following), a conformity test of the input video data stream 24 with respect to the control plane parameters expected for the input video data stream 24 is also carried out.

[0066] At step 106, if the input video data stream 24 does not conform to the first video transmission protocol, module 60 generates an alert which, at step 108, is stored in a security log.

[0067] The input video data stream 24 that does not conform to the first video transmission protocol is then eliminated at step 110, without transmission to the second domain 16.

[0068] The conformity test allows verification in particular of the size of the data transmitted by message, the presence of illegal characters, and / or the presence of random data in the input video data stream 24.

[0069] Steps 104 to 110 thus ensure security against the sending of malformed data likely to disrupt the receiving systems in the second domain 16.

[0070] In the case where the input video data stream 24 conforms to the first video transmission protocol, it is transmitted to the decapsulation module 62.

[0071] In step 112, module 62 decapsulates the input video data stream 24 to extract, on the one hand, image data 26 and, on the other hand, data additional 28, in particular metadata associated with frames and images and / or control plane data.

[0072] At step 114, the filtering module 64 eliminates at least partially, preferably totally, the additional data 28 which are not transmitted to the second domain 16.

[0073] In step 116, the reencapsulation module 66 receives the image data 26 from the filtering module 64 and reencapsulates them according to a second transmission protocol, advantageously distinct from the first transmission protocol, to generate the output video stream 22.

[0074] At step 118, the control module 67 checks the conformity of the output video stream 22 with the specifications of the second transmission protocol which are stored for example in a table of the processing unit 54.

[0075] If the output video data stream 22 does not conform to the second video transmission protocol, the control module 67 generates an alert which is stored in the security log.

[0076] The output video data stream 22 that does not conform to the second video transmission protocol is then eliminated, without transmission to the second domain 16.

[0077] In step 120, in the case where the output video stream 22 conforms to the specifications of the second transmission protocol, the transmission module 68 transmits the output video stream 22 to the second domain 16 via the transmission output 53.

[0078] In step 122, the output video stream 22 is for example received by the display generation assembly 38 of the display device 36. It is processed by the display generation assembly 38 to be displayed on at least one display area, in particular on at least one of the display areas 37A to 37D or to produce a modified video stream using at least part of the output video stream 22 and display the modified video stream on at least one display area.

[0079] Thanks to the protocol break carried out within the security system 18, the transmission of malicious data via covert channels within the input video data stream 24 produced according to the first transmission protocol is avoided, since only the image data 26 are kept in the output data stream 22 generated according to the second transmission protocol.

[0080] With reference to [Fig. 3], at step 130, prior to or at each step 100, upon request from system 42, 44 via the input control plane data stream 30, the predefined values ​​of the spatial and temporal parameters intended to generate the input video data stream 24 are provided by the supply module 82, from the predefined values ​​stored in memory 80. The control plane data stream input control 30 is for example generated according to a display data channel (DDC) protocol, in particular DDC-I, or according to an Inter-Integrated Circuit (I2C) protocol.

[0081] The transmission of predefined values ​​of spatial parameters (such as image resolution, for example) and temporal parameters (such as image refresh rate, for example) from predefined values ​​contained in a memory 80 of the security system 18 prevents the control plane parameterization from being unlawfully modified on the path to the second domain 16 by avoiding the creation of a hidden control plane parameterization channel, since the parameterization is imposed by the values ​​present in the memory 80.

[0082] In addition, at step 132, the control plane data receiving module 84 tests the conformity of the input video data stream 24 received by the module 60 with respect to the control plane parameterization, in particular with respect to the predefined values ​​of the input parameterization contained in memory 80.

[0083] For example, in step 133, the receiving module 84 compares the values ​​of the spatial and temporal parameters of the input video data stream 24 and determines whether they are equal to the predefined values ​​of the spatial and temporal parameters contained in memory.

[0084] If the values ​​are not equal, the spatial and temporal input parameterization of the input video data stream 24 is non-compliant. In step 134, an alert is generated by module 84 and stored in an alert log in step 136. In step 138, module 84 then eliminates the input video data stream 24 that is not transmitted to the second domain 16.

[0085] This prevents the transmission of illegitimate commands in an uncontrolled data path.

[0086] Furthermore, if the spatial and temporal input parameterization of the input video data stream 24 is deemed compliant, the output video stream 22 is generated as described previously in steps 112 to 118.

[0087] The spatial and temporal output parameterization of the output video stream 22 can also be imposed by predetermined values ​​contained in memory 80.

[0088] The addition module 86 then possibly generates at step 140 a conformity indicator from the predefined values ​​of the spatial and temporal parameters in the form, for example, of a cyclic redundancy check.

[0089] The conformance indicator is for example encapsulated with the input image data at step 116 by the reencapsulation module 66 to be integrated into the second transmission protocol and transmitted to the second domain 16.

[0090] At step 142, during the decapsulation of the output video stream 22, a conformity check of the spatial and temporal output parameterization of the output video stream 22 can then be carried out by the generation assembly 38.

[0091] Thus, the spatial and temporal output parameterization of the output video stream 22 is also controlled within the security system 18, and can be tested by the encapsulated conformance indicator.

[0092] The transmission of the video stream through the security system 18 is therefore particularly secure. This makes it possible, in particular, to use video streams from less secure systems 42, 44 within a cockpit display device 36 without compromising aircraft safety.

[0093] This is achieved by means of a particularly simple architecture, by a simple component placed at the interface between the first domains 12, 14 having lower security requirements and the second domain 16 having higher security requirements.

[0094] In one variant, a unidirectional return link 200 is for example established between the second domain 16 and the first domain 12, 14 without going through the security system 18, to ensure in particular a return of selection of a user on a display area of ​​the output video stream 22, implemented using a selection and / or control system such as a touch screen, a keyboard, or a mouse.

[0095] This return link 200 is established for example in the form of a user datagram protocol (“User Datagram Protocol” or “UDP” in English) or by other digital data transmission protocols such as an RS232 protocol, an RS422 protocol, an ARINC 429 protocol or an ARINC 729 protocol.

Claims

Demands

1. Aircraft (10) comprising: - a first domain (12, 14) having lower security requirements, comprising at least one system (42, 44) for generating an input video stream (20) using a first video transmission protocol, - a second domain (16) having higher security requirements, comprising at least one system for processing and / or displaying an output video stream (22) obtained from the first domain (12, 14), characterized by: - ​​a video stream security system (18) forming a video interface between the first domain (12, 14) and the second domain (16), the security system (18) being configured to receive the input video stream (20) according to the first video transmission protocol and to generate the output video stream (22) from the input video stream (20), according to a second video transmission protocol.

2. Aircraft (10) according to claim 1, wherein the first video transmission protocol is different from the second video transmission protocol or wherein the first video transmission protocol is identical to the second video transmission protocol.

3. Aircraft (10) according to any one of claims 1 or 2, wherein the security system (18) comprises a programmable logic component or a dedicated logic circuit configured to receive the input video stream (20) according to the first video transmission protocol and to generate the output video stream (22) from the input video stream (20), according to the second video transmission protocol.

4. Aircraft (10) according to any one of claims 1 to 3, wherein the security system (18) comprises at least one input (50A, 50B) for receiving input video stream (20), configured to receive the input video stream (20) from the input video stream generation system (42, 44).

5. Aircraft (10) according to claim 4, wherein the input or each input (50A, 50B) for receiving video streams (20) is configured to receive a video stream following a Digital Video Interface protocol, a DisplayPort protocol, a High Definition Multimedia Interface (HDMI) protocol, or a Serial Digital Interface (SDI) protocol, in particular 3G-SDI

6. Aircraft (10) according to any one of claims 4 to 5, wherein the input or each input (50A, 50B) of input video stream (20) forms a first transmission channel of an input video data stream (24) from the first domain (12, 14), the security system (18) comprising at least one input / output (52A, 52B) of control plane parameters forming a second transmission channel of control plane parameters to the first domain (12, 14).

7. Aircraft (10) according to claim 6, wherein the security system (18) comprises a memory (80) containing predetermined values ​​of a spatial and temporal input parameterization of the control plane, the memory (80) being connected to the or to each input / output (52) of control plane parameters to permit the transmission of the predetermined values ​​of the spatial and temporal input parameterization of the control plane to the first domain (12, 14) through the second transmission channel.

8. Aircraft (10) according to any one of the preceding claims, wherein the security system (18) comprises at least one output (53) for transmitting the output video stream (22) connected to the second domain (16).

9. Aircraft (10) according to claim 8, wherein the output (22) video stream transmission output (53) is configured to output a video stream (22) under an ARINC 818 protocol, a Digital Video Interface (DVI) protocol, a DisplayPort (DP) protocol, a High Definition Multimedia Interface (HDMI) protocol, or a Serial Digital Interface (SDI) protocol, including 3G-SDI.

10. Aircraft (10) according to claim 8 or 9, wherein the security system (18) comprises a module (62) for decapsulating an input video data stream (24) received according to the first video transmission protocol to extract image data (26) and a module (66) for recapturing the image data (26) following a second video transmission protocol to generate the output video stream (22).

11. Aircraft (10) according to any one of the preceding claims, wherein the second domain (16) is a control domain of the aircraft (10) including at least one avionics unit (34).

12. Aircraft (10) according to any one of the preceding claims, wherein the first domain (12, 14) is a passenger service domain (14) of the aircraft (10) configured to include at least one passenger service system (44), and / or is an operator service domain (12) of the aircraft (10) configured to include at least one operator service system (42).

13. Aircraft (10) according to any one of the preceding claims, wherein the output video stream processing and / or display system (22) comprises at least one display area (37A to 37D) of the output video stream (22) or of a video stream produced using the output video stream (22).

14. Aircraft (10) according to claim 13, comprising a selection and / or control system configured to allow interaction by a user on the display area (37A to 37D), the aircraft (10) including a one-way return link (200) from the selection and / or control system to the first domain (12, 14) without going through the security system (18).

15. Aircraft (10) according to claim 14, wherein the one-way return link (200) operates according to a user datagram protocol, an RS232 protocol, an RS422 protocol, an ARINC 429 protocol or an ARINC 729 protocol.

Images