Method for securing an aircraft video link implementing a protocol break, system and associated aircraft

Abstract

Method for securing an aircraft video link implementing a protocol break, system and associated aircraft. The method comprises the following steps: reception, from a first domain (12, 14), of an input video data stream (24) using a first video transmission protocol encapsulating image data (26) and complementary data (28); decapsulation of the input video data stream (24) to extract the image data (26) and filtering of at least a portion of the complementary data (28); reencapsulation of the image data (26) using a second video transmission protocol to generate an output video stream (22); transmission to the second domain (16) of the output video stream (22) via the second transmission protocol. Figure 1

Description

Title of the invention: Method for securing an aircraft video link implementing a protocol break, system and associated aircraft

[0001] The present invention relates to a method of securing an aircraft video link from a first domain having lower security requirements to a second domain having higher security requirements, the method being implemented by a security system.

[0002] Such a method is intended to be implemented in an aircraft, for example in an aircraft cockpit, to ensure a video link from a system generating a video stream in an open domain, such as an operator service domain or a passenger service domain, to a more secure domain, such as an aircraft control domain including an aircraft avionics unit.

[0003] Securing the aircraft's control domain is essential to prevent a takeover or malicious attack against vital aircraft functions such as flight controls.

[0004] In this respect, the aircraft's control domain is segregated from other more open aircraft domains.

[0005] However, the transmission of video streams from certain computer systems in the operator service domain or the passenger service domain, such as an Electronic Flight Bag (EFB) or a Modular Maintenance System (MMS), may be desirable. This would, in particular, allow these video streams to be displayed on avionics screens in the cockpit and would enable the crew to remotely access the displays of these systems.

[0006] Such video stream transmission is generally avoided at present, although some systems, such as the one described in US2020 / 0326205, are considering it. However, this transmission raises cybersecurity risks.

[0007] Thus, video transmission protocols are susceptible to attack by malicious third parties, in particular to impact the integrity of avionics or other critical aircraft systems, or more simply, to temporarily or permanently disrupt the availability of avionics or other aircraft systems.

[0008] This can be done, for example, by sending malformed data (particularly in terms of message size and illegal characters) using legitimate commands within, for example, an unmonitored control channel. Other malicious actions would consist of attempting to encapsulate malicious messages within a uncontrolled protocol in a regular protocol and / or sending aberrant control plane parameters to systems in the critical domain.

[0009] An object of the invention is to obtain a method enabling reliable cyber security of an aircraft video stream transmitted from a domain with lower security requirements to a domain with higher security requirements, in particular to the aircraft control domain.

[0010] To this end, the invention relates to a method of the aforementioned type, characterized by the following steps: - reception, from the first domain, of an input video data stream using a first video transmission protocol encapsulating image data and complementary data, - Decapsulation of the input video data stream to extract image data and filtering of at least some of the additional data, - Re-encapsulation of image data using a second video transmission protocol to generate an output video stream, - transmission to the second domain of the output video stream via the second transmission protocol.

[0011] The method according to the invention may include one or more of the following features, taken individually or in any technically possible combination: - the additional data includes metadata and / or control plan data, the decapsulation includes filtering of metadata and / or control plan data; - Decapsulation includes filtering all additional data; - the first video transmission protocol is different from the second video transmission protocol or in which the first video transmission protocol is identical to the second video transmission protocol; - the first video transmission protocol is chosen from among a Digital Video Interface (DVI) protocol, a Display Port (DP) protocol, a high-definition multimedia interface (HDMI) protocol, or a serial digital interface (SDI) protocol, including 3G-SDI; - the second video transmission protocol is chosen from an ARINC 818 protocol, a Digital Video Interface (DVI) protocol, a Display Port (DP) protocol, a high-definition multimedia interface (HDMI) protocol, or a serial digital interface (SDI) protocol, including 3G-SDI; it includes at least one step to test the conformity of the input video data stream with respect to the first video transmission protocol, before the decapsulation of the input video data stream; the compliance test step includes, in the case of non-compliance of the input video data stream, the generation of a security alert and / or the storage of the alert in an alert log, the verification step optionally including the deletion of the input video data stream in the case of non-compliance of the input video data stream after generation of the alert and / or storage of the alert in the alert log; It includes a step of checking the conformity of the output video stream with respect to the second video transmission protocol, before transmission to the second domain, the step of checking conformity including optionally, in the case of non-conformity of the output video stream, the generation of a security alert and / or the storage of the alert in an alert log, the verification step including optionally the deletion of the output video stream in the case of non-conformity of the output video stream after generation of the alert and / or storage of the alert in the alert log; the second domain is an aircraft control domain including at least one avionics unit; the first domain is an aircraft passenger service domain configured to include at least one passenger service system, and / or is an aircraft operator service domain configured to include at least one operator service system; it includes the provision to the first domain, by the security system, of controlled input control plane parameters for the input video data stream, including spatial and temporal input parameterization of the input video data stream defined by the security system; It includes a conformity test of the input video data stream with respect to a predefined spatial and temporal input parameter of the input video data stream and optionally, in the event of non-conformity of the input video data stream, the generation of a security alert and / or the storage of the alert in an alert log, the test step optionally including the deletion of the input video data stream in the event of non-conformity of the input video data stream after generation of the alert and / or storage of the alert in the alert log;

[0012] - during the reencapsulation step, an indicator of conformity to values predefined spatial and temporal parameters of the output video stream with respect to the second video transmission protocol are encapsulated in the output video stream.

[0013] The invention also relates to a system for securing an aircraft video link from a first domain with lower security requirements to a second domain with higher security requirements, the security system comprising: - a receiving module, from the first domain, for an input video data stream using a first video transmission protocol encapsulating image data and complementary data, - a module for decapsulating the input video data stream to extract image data - a filtering module for at least some of the additional data, - a module for re-encapsulating image data using a second video transmission protocol to generate an output video stream, - a transmission module to the second domain of the output video stream via the second transmission protocol.

[0014] The system according to the invention may include a programmable logic component or a dedicated logic circuit implementing the receiving module, the decapsulating module, the filtering module, the recapsulating module and the transmitting module.

[0015] The invention also relates to an aircraft comprising: - a first domain with lower security requirements comprising at least one system for generating an input video stream using a first video transmission protocol, - a security system as defined above, configured to generate an output video stream from the input video stream, - a second area having higher security requirements including at least one system for processing and / or displaying the output video stream connected to the security system.

[0016] The invention will be better understood upon reading the following description, given solely by way of example and made with reference to the accompanying drawings, in which:

[0017] [Fig-1] [Fig.1] is a schematic view of an aircraft according to the invention comprising several domains having lower security requirements and one domain having higher security requirements, a flow security system according to the invention being interposed between the domains having lower security requirements and the domain having higher security requirements.

[0018] [Fig.2] [Fig.2] is a security flowchart illustrating the implementation of a first security method according to the invention.

[0019] [Fig. 3] [Fig. 1] is a flowchart illustrating the implementation of a second security method according to the invention.

[0020] The relevant parts of a first aircraft 10 according to the invention are illustrated schematically in [Fig. 1].

[0021] The aircraft 10 thus includes an on-board computer infrastructure comprising at least a first computer domain 12, 14 having lower security requirements, the first domain 12, 14 comprising at least one system capable of generating and / or transmitting at least one video stream.

[0022] The IT infrastructure includes at least one second IT domain 16 having higher security requirements, including at least one system capable of receiving the video stream or each one, for processing and / or displaying it.

[0023] The aircraft 10 further comprises, according to the invention, a system for securing a video link between the first domain or each of the first domains 12, 14 and the second domain 16, to allow the second domain to securely receive the video stream generated by the first domain 12, 14.

[0024] The video stream comprises an input video stream 20 generated in the first domain 12, 14 and transmitted to the security system 18 and an output video stream 22 generated by the security system 18 from the input video stream 20.

[0025] The input video stream 20 is generated according to a first video transmission protocol, for example a Digital Video Interface (DVI) protocol, a Display Port (DP) protocol, a high-definition multimedia interface (HDMI) protocol, or a serial digital interface protocol, for example (3G)-SDI.

[0026] It comprises, along a first transmission channel, an input video data stream 24 including successive image data 26 configured to be projected in succession and complementary data 28.

[0027] The input video stream 20 further includes in this example, following a second transmission channel, a bidirectional stream of input control plane parameters 30 exchanged between the security system 18 and the first domain or domains 12, 14 to control the spatial and temporal input parameterization of the input video data stream 24.

[0028] The spatial and temporal input parameterization of the successive image data contained in the input video data stream 24 includes, for example, at least one frame definition, a synchronization, including a clock frequency and image refresh rate, and a predefined resolution for the successive images, which are transmitted to the first domain 12, 14 by the security system 18 in the input control plane parameter flow 30.

[0029] The additional data 28 present in the input video data stream 24 includes metadata associated with the frames and / or images including, for example, a date, an order, a source identifier, enrichment data such as subtitles, and / or control plane data, including a cyclic redundancy check to verify that the frames, the synchronization and the resolution of the image data correspond to those defined by the security system 18. In some video protocols, the additional data 28 also includes network or bus routing information such as addresses of recipients of the video stream, for example.

[0030] The output video stream 22 is generated by the security system 18 according to a second video transmission protocol, following an output control plane having a predefined spatial and temporal output parameter. The second video transmission protocol is, for example, an ARINC 818 protocol, a Digital Video Interface (DVI) protocol, a DisplayPort (DP) protocol, a High Definition Multimedia Interface (HDMI) protocol, or a Serial Digital Interface (SDI) protocol, in particular 3G-SDI.

[0031] The output video stream 22 includes in particular output image data 32 from the input video data stream 24 and verification data 33 of conformity to the predefined output control plan, for example in the form of a cyclic redundancy check established from the definition of frames, synchronization and resolution used to generate the output image data 32.

[0032] In the example shown in [Fig.1], the aircraft 10 comprises several first domains 12, 14 having lesser safety requirements, including an operator service domain 12 and a passenger service domain 14.

[0033] Each first domain 12, 14 comprises at least one system 42, 44, in particular at least one computer, configured to be permanently connected or disconnectable to the security system 18. The system or each system 42, 44 is configured to generate the input video stream 20 intended to be received by the security system 18.

[0034] The system or each system 42, 44 is for example an on-board computer, a computer that can be disconnected from the aircraft 10 or a portable terminal, such as a laptop, a tablet or a mobile phone.

[0035] The operator service domain 12 relates in particular to aircraft maintenance and crew support during the various phases of the mission. This notably includes access to various technical and aviation documentation resources available on board, or on one or more removable equipment.

[0036] The system 42 generating the input video stream is, for example, an Electronic Flight Bag (EFB) or a Modular Maintenance System (MMS)

[0037] The passenger service domain 14 includes, for example, the control of material resources specific to passenger comfort, passenger entertainment, interactive mobile maps, functions dedicated to the cabin crew, and interface resources with terminals and devices specific to the aircraft occupants.

[0038] The system 44 generating the input video stream 20 is for example a video camera system intended to film the interior or exterior of the aircraft (for example a tail fin camera) or an internet navigation software hosted on a computer, in particular one of low trust in terms of cybersecurity.

[0039] The aircraft control domain 16 includes, in particular, engine control applications, flight controls, and aircraft systems control. It includes at least one avionics central unit 34 and at least one display device 36.

[0040] The avionics central unit 34 includes at least one computer and a memory configured to receive data from the various aircraft systems and to process them, possibly to control aircraft systems and execute flight commands.

[0041] The display device 36 includes at least one display area, for example located in the cockpit of the aircraft 10.

[0042] In the example shown in [Fig.1], the display device 36 comprises at least one first dedicated display area 37A, intended to be placed opposite a first crew member, in front of a first cockpit seat, at least one second dedicated display area 37B, intended to be placed opposite a second crew member, in front of a second cockpit seat, and at least one display area visible to both crew members 37C, 37D placed between the first display area 37A and the second display area 37B.

[0043] The display device 36 may include a first dedicated head-up display area, intended to be placed opposite the first seat and a second dedicated head-up display area, intended to be placed opposite the second seat.

[0044] The display device 36 further includes a display management unit 38 dedicated to controlling the display on the various display areas 37A to 37D, notably by displaying the output video stream 22 received from the security system 18 or a video stream produced using the output video stream 22. The display management unit 38 comprises physical and / or software components configured to generate and control the display

[0045] The first dedicated display area 37A and the second dedicated display area 37B are generally defined by primary display screens, located opposite the seat of each respective crew member. They are intended to display, for example, at least one flight parameter window.

[0046] The upper display area 37C visible to both crew members and the lower display area 37D visible to both crew members are defined respectively on a multifunctional navigation screen intended to display at least one navigation window and on an aircraft systems control and / or monitoring screen to display at least one aircraft system monitoring and / or control window.

[0047] Alternatively, the display areas 37A to 37D are located on the same common screen, for example in the shape of a T.

[0048] In the example of [Fig.1], the display device 36 is further configured to process and / or display the successive images contained in the output video stream 22, for example on a display area 37A to 37D, in particular on areas 37B and 37D.

[0049] The security system 18 is arranged at an interface between the first domain or each of the first domains 12, 14 and the second domain 16.

[0050] In this example, the security system 18 consists of at least one computer which is an electronic circuit designed to manipulate and / or transform data represented by electronic or physical quantities in registers of the computer and / or memories into other similar data corresponding to physical data in register memories or other types of display devices, transmission devices or storage devices.

[0051] Preferably, the security system 18 is implemented as a programmable logic component, such as an FPGA (Field Programmable Gate Array), or a dedicated integrated circuit, such as an ASIC (Application-Specific Integrated Circuit). These components define functional modules of the security system 18.

[0052] Alternatively, the security system 18 is implemented in the form of at least one processor and at least one memory containing software modules configured to be executed by the processor.

[0053] With reference to [Fig.1], the security system 18 includes at least one input 50A, 50B for receiving the video data stream from input 24, at least one input / output 52A, 52B for transmitting / receiving the control plane parameter stream from input 30.

[0054] The security system 18 also includes at least one output 53 for transmitting the output video stream 22.

[0055] It includes an input video stream processing unit 54 configured to generate the output video stream 22 and an input control plane control unit 56 for the input video stream 20.

[0056] In the example shown in [Fig.1], the security system 18 includes at least one input 50A configured to be connected directly to a system 44 of the passenger services domain 14 and at least one input 50B connected to a system 42 of an operator service domain 12.

[0057] Each input 50A, 50B is configured to receive the input video data stream 24 following the input transmission protocol respecting the input control plane parameters transmitted to the system 42, 44 via the input / output 52A, 52B.

[0058] The input video stream processing unit 54 is connected to the input or each input 50A and 50B. It includes a module 60 for receiving and conforming to the input video data stream 24, a module 62 for decapsulating the input video data stream 24 to extract the image data 26 and the additional data 28.

[0059] It also includes a filtering module 64 configured to remove at least part of the additional data 28, a module 66 for re-encapsulating the image data 26 according to a second video transmission protocol, advantageously distinct from the first video transmission protocol, to generate the output video stream 22, a module 67 for checking the conformity of the output video stream 22 according to the specifications of the second video transmission protocol and a module 68 for transmitting the output video stream 22 to the second domain 16, in particular to the display management assembly 38 of the display device 36.

[0060] The control plane mastering unit 56 includes a memory 80 storing the spatial and temporal input parameters including a frame definition, a synchronization including a clock frequency and image refresh rate and a desired predefined resolution for the input video data stream 24.

[0061] The control plane control unit 56 includes a module 82 for supplying predetermined values ​​of the spatial and temporal input parameterization to the input / output 52A, 52B and a receiving module 84 for the input video data stream 24 to verify its conformity with the input control plane 30.

[0062] The control plane control unit 56 advantageously includes an addition module 86 of a conformity indicator to the output video stream 22.

[0063] The memory 80 is preferably a non-volatile memory, for example EPROM containing predetermined values ​​of the desired spatial and temporal parameters of the image data 26. These values ​​include predetermined frame definition, synchronization and / or controlled resolution values ​​for the data 26 images. They form the control plane parameters for the input video stream 24 imposed by the security system 18.

[0064] A method for securing a video link between a first domain 12, 14 having lower security requirements and a second domain 16 having higher security requirements will now be described.

[0065] With reference to [Fig.2], in step 100, a system 42, 44 of the first domain 12, 14 is connected to the receiving input 50A, 50B.

[0066] The system 42, 44 generates the input video data stream 24 which is transmitted to the security system 18 using the first transmission protocol.

[0067] At step 102, the input video data stream 24 is received in the receiving and conformance test module 60.

[0068] In this module 60, at step 104, the input video data stream 24 is tested to verify its conformity to the first video transmission protocol, with respect to the protocol specifics which are stored for example in a table of the processing unit 54.

[0069] As described below (see steps 132 and following), a conformity test of the input video data stream 24 with respect to the control plane parameters expected for the input video data stream 24 is also carried out.

[0070] At step 106, if the input video data stream 24 does not conform to the first video transmission protocol, module 60 generates an alert which, at step 108, is stored in a security log.

[0071] The input video data stream 24 that does not conform to the first video transmission protocol is then eliminated at step 110, without transmission to the second domain 16.

[0072] The conformity test allows verification in particular of the size of the data transmitted by message, the presence of illegal characters, and / or the presence of random data in the input video data stream 24.

[0073] Steps 104 to 110 thus ensure security against the sending of malformed data likely to disrupt the receiving systems in the second domain 16.

[0074] In the case where the input video data stream 24 conforms to the first video transmission protocol, it is transmitted to the decapsulation module 62.

[0075] In step 112, module 62 decapsulates the input video data stream 24 to extract, on the one hand, image data 26 and, on the other hand, complementary data 28, in particular metadata associated with frames and images and / or control plane data.

[0076] At step 114, the filtering module 64 eliminates at least partially, preferably totally, the additional data 28 which are not transmitted to the second domain 16.

[0077] In step 116, the reencapsulation module 66 receives the image data 26 from the filtering module 64 and reencapsulates them according to a second transmission protocol, advantageously distinct from the first transmission protocol, to generate the output video stream 22.

[0078] At step 118, the control module 67 checks the conformity of the output video stream 22 with the specifications of the second transmission protocol which are stored for example in a table of the processing unit 54.

[0079] If the output video data stream 22 does not conform to the second video transmission protocol, the control module 67 generates an alert which is stored in the security log.

[0080] The output video data stream 22 that does not conform to the second video transmission protocol is then eliminated, without transmission to the second domain 16.

[0081] At step 120, in the case where the output video stream 22 conforms to the specifications of the second transmission protocol, the transmission module 68 transmits the output video stream 22 to the second domain 16 via the transmission output 53.

[0082] In step 122, the output video stream 22 is for example received by the display generation assembly 38 of the display device 36. It is processed by the display generation assembly 38 to be displayed on at least one display area, in particular on at least one of the display areas 37A to 37D or to produce a modified video stream using at least part of the output video stream 22 and display the modified video stream on at least one display area.

[0083] Thanks to the protocol break carried out within the security system 18, the transmission of malicious data via covert channels within the input video data stream 24 produced according to the first transmission protocol is avoided, since only the image data 26 are kept in the output data stream 22 generated according to the second transmission protocol.

[0084] With reference to [Fig. 3], at step 130, prior to or at each step 100, upon request from system 42, 44 via the input control plane data stream 30, the predefined values ​​of the spatial and temporal parameters intended to generate the input video data stream 24 are provided by the supply module 82, from the predefined values ​​stored in memory 80. The input control plane data stream 30 is, for example, generated according to a display data protocol channel (DDC) in particular DDC-I, or following an Inter-Integrated Circuit (I2C) protocol.

[0085] The transmission of predefined values ​​of spatial parameters (such as image resolution, for example) and temporal parameters (such as image refresh rate, for example) from predefined values ​​contained in a memory 80 of the security system 18 prevents the control plane parameterization from being unlawfully modified on the path to the second domain 16 by avoiding the creation of a hidden control plane parameterization channel, since the parameterization is imposed by the values ​​present in the memory 80.

[0086] In addition, at step 132, the control plane data receiving module 84 tests the conformity of the input video data stream 24 received by the module 60 with respect to the control plane parameterization, in particular with respect to the predefined values ​​of the input parameterization contained in memory 80.

[0087] For example, in step 133, the receiving module 84 compares the values ​​of the spatial and temporal parameters of the input video data stream 24 and determines whether they are equal to the predefined values ​​of the spatial and temporal parameters contained in memory.

[0088] If the values ​​are not equal, the spatial and temporal input parameterization of the input video data stream 24 is non-compliant. In step 134, an alert is generated by module 84 and stored in an alert log in step 136. In step 138, module 84 then eliminates the input video data stream 24 that is not transmitted to the second domain 16.

[0089] This prevents the transmission of illegitimate commands in an uncontrolled data path.

[0090] Furthermore, if the spatial and temporal input parameterization of the input video data stream 24 is deemed compliant, the output video stream 22 is generated as described previously in steps 112 to 118.

[0091] The spatial and temporal output parameterization of the output video stream 22 can also be imposed by predetermined values ​​contained in memory 80.

[0092] The addition module 86 then possibly generates at step 140 a conformity indicator from the predefined values ​​of the spatial and temporal parameters in the form, for example, of a cyclic redundancy check.

[0093] The conformance indicator is for example encapsulated with the input image data at step 116 by the reencapsulation module 66 to be integrated into the second transmission protocol and transmitted to the second domain 16.

[0094] At step 142, during the decapsulation of the output video stream 22, a conformity check of the spatial and temporal output parameterization of the output video stream 22 can then be carried out by the generation assembly 38.

[0095] Thus, the spatial and temporal output parameterization of the output video stream 22 is also controlled within the security system 18, and can be tested by the encapsulated compliance indicator.

[0096] The transmission of the video stream through the security system 18 is therefore particularly secure. This makes it possible, in particular, to use video streams from less secure systems 42, 44 within a cockpit display device 36 without compromising aircraft safety.

[0097] This is achieved by means of a particularly simple architecture, by a simple component placed at the interface between the first domains 12, 14 having lower security requirements and the second domain 16 having higher security requirements.

[0098] In one variant, a unidirectional return link 200 is for example established between the second domain 16 and the first domain 12, 14 without going through the security system 18, to ensure in particular a return of selection of a user on a display area of ​​the output video stream 22, implemented using a selection and / or control system such as a touch screen, a keyboard, or a mouse.

[0099] This return link 200 is established for example in the form of a user datagram protocol (“User Datagram Protocol” or “UDP” in English) or by other digital data transmission protocols such as an RS232 protocol, an RS422 protocol, an ARINC 429 protocol or an ARINC 729 protocol.

Claims

Demands

1. A method for securing an aircraft video link (10) from a first domain (12, 14) having lower security requirements to a second domain (16) having higher security requirements, the method being implemented by a security system (18) and comprising the following steps: - receiving, from the first domain (12, 14), an input video data stream (24) using a first video transmission protocol encapsulating image data (26) and complementary data (28), - decapsulating the input video data stream (24) to extract the image data (26) and filtering at least a portion of the complementary data (28), - re-encapsulating the image data (26) using a second video transmission protocol to generate an output video stream (22),- transmission to the second domain (16) of the output video stream (22) via the second transmission protocol.

2. A method according to claim 1, wherein the supplementary data (28) includes metadata and / or control plane data, the decapsulation including the filtering of metadata and / or control plane data.

3. A method according to any one of claims 1 or 2, wherein the decapsulation includes filtering out all additional data (28).

4. A method according to any one of the preceding claims, wherein the first video transmission protocol is different from the second video transmission protocol or wherein the first video transmission protocol is identical to the second video transmission protocol.

5. A method according to claim 4, wherein the first video transmission protocol is selected from a Digital Video Interface (DVI) protocol, a DisplayPort (DP) protocol, a High Definition Multimedia Interface (HDMI) protocol, or a Serial Digital Interface (SDI) protocol, in particular 3G-SDI, the second video transmission protocol being selected from an ARINC 818 protocol, a Digital Video Interface (DVI) protocol, a DisplayPort (DP) protocol, a high-definition multimedia interface (HDMI) protocol, or a serial digital interface (SDI) protocol, including 3G-SDI.

6. A method according to any one of the preceding claims, comprising at least one step of testing the conformity of the input video data stream (24) with respect to the first video transmission protocol, before decapsulating the input video data stream (24).

7. A method according to claim 6, wherein the conformity test step includes, in the event of non-conformity of the input video data stream (24), the generation of a security alert and / or the storage of the alert in an alert log, the verification step optionally including the deletion of the input video data stream (24) in the event of non-conformity of the input video data stream (24) after generation of the alert and / or storage of the alert in the alert log.

8. A method according to any one of the preceding claims, comprising a step of checking the conformity of the output video stream (22) with respect to the second video transmission protocol, before transmission to the second domain (16), the step of checking conformity comprising optionally, in the event of non-conformity of the output video stream (22), the generation of a security alert and / or the storage of the alert in an alert log, the verification step comprising optionally the deletion of the output video stream (22) in the event of non-conformity of the output video stream (22) after generation of the alert and / or storage of the alert in the alert log.

9. A method according to any one of the preceding claims, wherein the second domain (16) is an aircraft control domain (10) including at least one avionics unit (34).

10. A method according to any one of the preceding claims, wherein the first domain (12, 14) is a passenger service domain (14) of the aircraft (10) configured to include at least one passenger service system (44), and / or is an operator service domain (12) of the aircraft (10) configured to include at least one operator service system (42).

11. A method according to any one of the preceding claims, comprising supplying the first domain (12, 14) by the system security (18), controlled input control plane parameters for the input video data stream (24), including spatial and temporal input parameterization of the input video data stream (24) defined by the security system (18).

12. A method according to any one of the preceding claims, comprising a conformity test of the input video data stream (24) with respect to a predefined spatial and temporal input parameterization of the input video data stream (24) and optionally, in the event of non-conformity of the input video data stream (24), the generation of a security alert and / or the storage of the alert in an alert log, the test step optionally comprising the deletion of the input video data stream (24) in the event of non-conformity of the input video data stream (24) after generation of the alert and / or storage of the alert in the alert log.

13. Security system (18) for securing an aircraft video link (10) from a first domain (12, 14) having lower security requirements to a second domain (16) having higher security requirements, the security system (18) comprising: - a module (60) for receiving, from the first domain (12, 14), an input video data stream (24) using a first video transmission protocol encapsulating image data (26) and complementary data (28), - a module (62) for decapsulating the input video data stream (24) to extract the image data (26), - a module (64) for filtering at least a portion of the complementary data (28), - a module (66) for re-encapsulating the image data (26) using a second video transmission protocol to generate an output video stream (22),- a transmission module (68) to the second domain (16) of the output video stream (22) via the second transmission protocol.

14. System according to claim 13, comprising a programmable logic component or a dedicated logic circuit implementing the receiving module (60), the decapsulating module (62), the filtering module (64), the recapsulating module (66) and the transmitting module (68).

15. Aircraft (10) comprising: - a first domain (12, 14) having lower security requirements comprising at least one system (42, 44) for generating an input video stream (20) using a first video transmission protocol, - a security system (18) according to any one of claims 13 or 14, configured to generate an output video stream (22) from the input video stream (20), - a second domain (16) having higher security requirements comprising at least one system for processing and / or displaying the output video stream (22) connected to the security system (18).

Images