Method for securing an aircraft video link from a first domain to a second domain, implemented with controlled spatial and temporal parameters, associated system and aircraft

Abstract

Method for securing an aircraft video link from a first domain to a second domain, implemented with controlled spatial and temporal parameters, associated system and aircraft. This method comprises the following steps: - reception, from a first domain (12, 14), of an input video data stream (24) following an input control plan including a spatial and temporal input parameterization of the input video data stream (24); - transmission to the second domain (16) of an output video stream (22) obtained from the input video data stream (24), following an output control plan including a spatial and temporal output parameterization; - provision, by the security system (18), of input control plan parameters imposed on the first domain (12, 14), the imposed input control plan parameters including a spatial and temporal input parameterization defined by the security system (18). Figure for the summary: Figure 1

Description

Title of the invention: Method for securing an aircraft video link from a first domain to a second domain, implemented with controlled spatial and temporal parameters, associated system and aircraft

[0001] The present invention relates to a method for securing an aircraft video link from a first domain having lower security requirements to a second domain having higher security requirements, and comprising the following steps:

[0002] - reception, from the first domain, of an input video data stream following an input control plane including spatial and temporal input parameterization of the input video data stream;

[0003] - transmission to the second domain of an output video stream obtained from the input video data stream, following an output control plane including spatial and temporal output parameterization.

[0004] the process being implemented by a security system.

[0005] Such a method is intended to be implemented in an aircraft, for example in an aircraft cockpit, to ensure a video link from a system generating a video stream in an open domain, such as an operator service domain or a passenger service domain, to a more secure domain, such as an aircraft control domain including an aircraft avionics unit.

[0006] Securing the aircraft's control domain is essential to prevent a takeover or a malicious attack against vital aircraft functions such as flight controls.

[0007] In this respect, the aircraft's control domain is segregated from other more open areas of the aircraft.

[0008] However, the transmission of video streams from certain computer systems in the operator service domain or the passenger service domain, such as an Electronic Flight Bag (EFB) or a Modular Maintenance System (MMS), may be desirable. This would, in particular, allow these video streams to be displayed on avionics screens in the cockpit and would enable the crew to remotely access the displays of these systems.

[0009] Such video stream transmission is generally avoided at present, although some systems, such as the one described in US2020 / 0326205, are considering it. However, this transmission raises cybersecurity risks.

[0010] Thus, video transmission protocols are susceptible to attack by malicious third parties, in particular to impact the integrity of avionics or other critical aircraft systems, or more simply, to temporarily or permanently disrupt the availability of avionics or other aircraft systems.

[0011] This can be done, for example, by sending malformed data (particularly in terms of message size and illegal characters) using legitimate commands within, for example, an unmonitored control channel. Other malicious actions would consist of attempting to encapsulate malicious messages from an unmonitored protocol within a regular protocol and / or sending aberrant control plane parameters to systems in the critical domain.

[0012] An object of the invention is to obtain a method enabling cyber security ensuring control of an aircraft video stream transmitted from a domain with lower security requirements to a domain with higher security requirements, in particular to the aircraft control domain.

[0013] To this end, the invention relates to a method of the aforementioned type, characterized by the following step:

[0014] - provision, by the security system, of control plan parameters input imposed on the first domain, the input control plan parameters imposed including a spatial and temporal input parameterization defined by the security system.

[0015] The method according to the invention may comprise one or more of the following features, taken individually or in any technically feasible combination: - the spatial and temporal input parameterization defined by the security system includes predetermined values ​​of spatial and temporal parameters of the input video data stream; - the predetermined values ​​are stored in a memory of the security system, in particular in a read-only memory of the security system; - the spatial and temporal input parameterization includes a frame definition, a synchronization including a clock frequency and image refresh rate and / or a resolution of the input video data stream; - it includes, before the transmission of the output video stream to the second domain, a test step to verify the conformity of the spatial and temporal parameters of the input video data stream received from the first domain with respect to the defined spatial and temporal input parameters provided to the first domain by the security system; - the verification step includes, in the case of non-compliance of the spatial and temporal parameterization of the input video data stream received from the first domain with respect to the defined spatial and temporal input parameter provided to the first domain, the generation of an alert in an alert log, the verification step optionally including the deletion of the input video data stream after generation of the alert and / or after storage of the alert in the storage log, without transmission of the input video data stream to the second domain; - it includes a step of checking the conformity of the output video stream with respect to the second video transmission protocol, before transmission to the second domain, the step of checking conformity including optionally, in the case of non-conformity of the output video stream, the generation of a security alert and / or the storage of the alert in an alert log, the verification step including optionally the deletion of the output video stream in the case of non-conformity of the output video stream after generation of the alert and / or storage of the alert in the alert log; - the transmission to the second domain of the output video stream is carried out using an ARINC 818 protocol, a Digital Video Interface (DVI) protocol, a Display Port (DP) protocol, a high-definition multimedia interface (HDMI) protocol, or a serial digital interface (SDI) protocol, including 3G-SDI; - the provision to the first domain of the spatial and temporal input parameterization is carried out via an input control plane parameter stream using a dedicated transmission channel, separate from a transmission channel of the input video data stream, preferably following a Display Data Channel (DDC) protocol and / or following an Inter-Integrated Circuit (I2C) protocol; - the second domain is an aircraft control domain including at least one avionics unit; - the first domain is an aircraft passenger service domain configured to include at least one passenger service system, and / or is an aircraft operator service domain configured to include at least one operator service system; - The input video data stream is received using a first video transmission protocol encapsulating image data and complementary data, the process comprising the following steps:

[0016] * decapsulation of the input video data stream to extract the data image processing and filtering of at least some of the additional data,

[0017] * reencapsulation of image data using a second protocol of video transmission to generate an output video stream,

[0018] * transmission to the second domain of the output video stream using the second transmission protocol; - the first video transmission protocol is different from the second video transmission protocol; - the first video transmission protocol is identical to the second video transmission protocol; - it includes a step of adding, to the output video stream before its transmission to the second domain, an indicator of the conformity of the spatial and temporal parameterization of the output video stream with reference to a defined spatial and temporal output parameterization; - The conformity indicator includes a cyclic redundancy check corresponding to the defined spatial and temporal output parameterization.

[0019] The invention also relates to a system for securing an aircraft video link from a first domain with lower security requirements to a second domain with higher security requirements, the security system comprising:

[0020] - a module for receiving, from the first domain, a video data stream input following an input control plan including spatial and temporal input parameterization of the input video data stream;

[0021] - a transmission module to the second domain of an output video stream obtained at starting from the input video data stream, following an output control plan including spatial and temporal output parameterization, characterized by a module for providing input control plan parameters imposed on the first domain, the imposed input control plan parameters including spatial and temporal input parameterization defined by the security system.

[0022] The system according to the invention may include a programmable logic component or a dedicated logic circuit implementing the receiving module, the transmitting module, and the input control plane data supply module, the security system preferably including a memory storing predetermined values ​​of spatial and temporal input parameters of the input video data stream.

[0023] The invention also relates to an aircraft comprising:

[0024] - a first domain having lower security requirements comprising at less a system for generating an input video data stream according to an input control plane including spatial and temporal input parameterization of the input video data stream,

[0025] - a security system as defined above, configured to generate a output video stream following an output control plane including spatial and temporal output parameterization, from the input video data stream,

[0026] - a second domain having higher security requirements comprising at less a system for processing and / or displaying the output video stream connected to the security system.

[0027] The invention will be better understood upon reading the following description, given solely by way of example and made with reference to the accompanying drawings, in which:

[0028] [Fig-1] [Fig.1] is a schematic view of an aircraft according to the invention comprising several domains having lower security requirements and one domain having higher security requirements, a flow security system according to the invention being interposed between the domains having lower security requirements and the domain having higher security requirements.

[0029] [Fig.2] [Fig.2] is a security flowchart illustrating the implementation of a first security method according to the invention.

[0030] [Fig.3] [Fig.1] is a flowchart illustrating the implementation of a second security method according to the invention.

[0031] The relevant parts of a first aircraft 10 according to the invention are illustrated schematically in [Fig. 1].

[0032] The aircraft 10 thus includes an on-board computer infrastructure comprising at least a first computer domain 12, 14 having lower security requirements, the first domain 12, 14 comprising at least one system capable of generating and / or transmitting at least one video stream.

[0033] The IT infrastructure includes at least one second IT domain 16 having higher security requirements, including at least one system capable of receiving the video stream or streams, for processing and / or displaying them.

[0034] The aircraft 10 further comprises, according to the invention, a system for securing a video link between the first domain or each of the first domains 12, 14 and the second domain 16, to allow the second domain to securely receive the video stream generated by the first domain 12, 14.

[0035] The video stream comprises an input video stream 20 generated in the first domain 12, 14 and transmitted to the security system 18 and an output video stream 22 generated by the security system 18 from the input video stream 20.

[0036] The input video stream 20 is generated according to a first video transmission protocol, for example a Digital Video Interface (DVI) protocol, a Display Port (DP) protocol, a high-definition multimedia interface (HDMI) protocol, or a serial digital interface protocol, for example (3G)-SDI.

[0037] It comprises, along a first transmission channel, an input video data stream 24 including successive image data 26 configured to be projected in succession and complementary data 28.

[0038] The input video stream 20 further includes in this example, following a second transmission channel, a bidirectional stream of input control plane parameters 30 exchanged between the security system 18 and the first domain or domains 12, 14 to control the spatial and temporal input parameterization of the input video data stream 24.

[0039] The spatial and temporal input parameterization of the successive image data contained in the input video data stream 24 includes, for example, at least one frame definition, a synchronization, including a clock frequency and image refresh rate and a predefined resolution for the successive images, which are transmitted to the first domain 12, 14 by the security system 18 in the input control plane parameter stream 30.

[0040] The additional data 28 present in the input video data stream 24 includes metadata associated with the frames and / or images including, for example, a date, an order, a source identifier, enrichment data such as subtitles, and / or control plane data, including a cyclic redundancy check to verify that the frames, the synchronization and the resolution of the image data correspond to those defined by the security system 18. In some video protocols, the additional data 28 also includes network or bus routing information such as addresses of recipients of the video stream, for example.

[0041] The output video stream 22 is generated by the security system 18 according to a second video transmission protocol, following an output control plane having a predefined spatial and temporal output parameter. The second video transmission protocol is, for example, an ARINC 818 protocol, a Digital Video Interface (DVI) protocol, a DisplayPort (DP) protocol, a High Definition Multimedia Interface (HDMI) protocol, or a Serial Digital Interface (SDI) protocol, in particular 3G-SDI.

[0042] The output video stream 22 includes in particular output image data 32 from the input video data stream 24 and verification data 33 of conformity to the predefined output control plan, for example in the form of a cyclic redundancy check established from the definition of frames, synchronization and resolution used to generate the output image data 32.

[0043] In the example shown in [Fig.1], the aircraft 10 comprises several first domains 12, 14 having lesser safety requirements, including an operator service domain 12 and a passenger service domain 14.

[0044] Each first domain 12, 14 comprises at least one system 42, 44, in particular at least one computer, configured to be permanently connected or disconnectable to the security system 18. The system or each system 42, 44 is configured to generate the input video stream 20 intended to be received by the security system 18.

[0045] The system or each system 42, 44 is for example an on-board computer, a computer that can be disconnected from the aircraft 10 or a portable terminal, such as a laptop, a tablet or a mobile phone.

[0046] Operator service domain 12 relates in particular to aircraft maintenance and crew support during the various phases of the mission. This includes, in particular, access to various technical and aviation documentation resources available on board, or on one or more removable devices.

[0047] The system 42 generating the input video stream is, for example, an Electronic Flight Bag (EFB) or a Modular Maintenance System (MMS)

[0048] The passenger service domain 14 includes, for example, the control of material resources specific to passenger comfort, passenger entertainment, interactive mobile maps, functions dedicated to the cabin crew, and interface resources with terminals and devices specific to the aircraft occupants.

[0049] The system 44 generating the input video stream 20 is for example a video camera system intended to film the interior or exterior of the aircraft (for example a tail fin camera) or an internet navigation software hosted on a computer, in particular one of low trust in terms of cybersecurity.

[0050] The aircraft control domain 16 includes, in particular, engine control applications, flight controls, and aircraft systems control. It includes at least one avionics central unit 34 and at least one display device 36.

[0051] The avionics central unit 34 includes at least one computer and a memory configured to receive data from the various aircraft systems and to process them, possibly to control aircraft systems and execute flight commands.

[0052] The display device 36 includes at least one display area, for example located in the cockpit of the aircraft 10.

[0053] In the example shown in [Fig. 1], the display device 36 comprises at least one first dedicated display area 37A, intended to be placed opposite a first crew member, in front of a first cockpit seat, and at least one second dedicated display area 37B, intended to be placed opposite a second crew member, opposite a second cockpit seat, and at least one display area visible to both crew members 37C, 37D placed between the first display area 37A and the second display area 37B.

[0054] The display device 36 may include a first dedicated head-up display area, intended to be placed opposite the first seat and a second dedicated head-up display area, intended to be placed opposite the second seat.

[0055] The display device 36 further includes a display management unit 38 dedicated to controlling the display on the various display areas 37A to 37D, notably by displaying the output video stream 22 received from the security system 18 or a video stream produced using the output video stream 22. The display management unit 38 comprises physical and / or software components configured to generate and control the display

[0056] The first dedicated display area 37A and the second dedicated display area 37B are generally defined by primary display screens, located opposite the seat of each respective crew member. They are intended to display, for example, at least one flight parameter window.

[0057] The upper display area 37C visible to both crew members and the lower display area 37D visible to both crew members are defined respectively on a multifunctional navigation screen intended to display at least one navigation window and on an aircraft systems control and / or monitoring screen to display at least one aircraft system monitoring and / or control window.

[0058] Alternatively, the display areas 37A to 37D are located on the same common screen, for example in the shape of a T.

[0059] In the example of [Fig.1], the display device 36 is further configured to process and / or display the successive images contained in the output video stream 22, for example on a display area 37A to 37D, in particular on areas 37B and 37D.

[0060] The security system 18 is arranged at an interface between the first domain or each of the first domains 12, 14 and the second domain 16.

[0061] In this example, the security system 18 consists of at least one computer which is an electronic circuit designed to manipulate and / or transform data represented by electronic or physical quantities in registers of the computer and / or memories into other similar data corresponding to physical data in register memories or other types of display devices, transmission devices or storage devices.

[0062] Preferably, the security system 18 is implemented in the form of a programmable logic component, such as an FPGA (Field Programmable Gate Array), or a dedicated integrated circuit, such as an ASIC (Application-Specific Integrated Circuit). These components define functional modules of the security system 18.

[0063] Alternatively, the security system 18 is implemented in the form of at least one processor and at least one memory containing software modules configured to be executed by the processor.

[0064] With reference to [Fig.1], the security system 18 includes at least one input 50A, 50B for receiving the video data stream from input 24, at least one input / output 52A, 52B for transmitting / receiving the control plane parameter stream from input 30.

[0065] The security system 18 also includes at least one output 53 for transmitting the output video stream 22.

[0066] It includes an input video stream processing unit 54 configured to generate the output video stream 22 and an input control plane control unit 56 for the input video stream 20.

[0067] In the example shown in [Fig.1], the security system 18 includes at least one 50A input configured to be connected directly to a system 44 of the passenger services domain 14 and at least one 50B input connected to a system 42 of an operator service domain 12.

[0068] Each input 50A, 50B is configured to receive the input video data stream 24 following the input transmission protocol respecting the input control plane parameters transmitted to the system 42, 44 via the input / output 52A, 52B.

[0069] The input video stream processing unit 54 is connected to the input or each input 50A and 50B. It includes a module 60 for receiving and conforming to the input video data stream 24, a module 62 for decapsulating the input video data stream 24 to extract the image data 26 and the additional data 28.

[0070] It also includes a filtering module 64 configured to remove at least part of the additional data 28, a module 66 for re-encapsulating the image data 26 according to a second video transmission protocol, advantageously distinct from the first video transmission protocol, to generate the output video stream 22, a module 67 for checking the conformity of the output video stream 22 according to the specifications of the second video transmission protocol and a module 68 for transmitting the output video stream 22 to the second domain 16, in particular to the display management assembly 38 of the display device 36.

[0071] The control plane mastering unit 56 includes a memory 80 storing the spatial and temporal input parameters including a frame definition, a synchronization including a clock frequency and frame refresh rate and a desired predefined resolution for the input video data stream 24.

[0072] The control plane control unit 56 includes a module 82 for supplying predetermined values ​​of the spatial and temporal input parameterization to the input / output 52A, 52B and a receiving module 84 for the input video data stream 24 to verify its conformity with the input control plane 30.

[0073] The control plane control unit 56 advantageously includes an addition module 86 of a conformity indicator to the output video stream 22.

[0074] The memory 80 is preferably a non-volatile memory, for example EPROM containing predetermined values ​​of the desired spatial and temporal parameters of the image data 26. These values ​​include predetermined frame definition, synchronization and / or controlled resolution values ​​for the image data 26. They form the control plane parameters for the input video stream 24 imposed by the security system 18.

[0075] A method for securing a video link between a first domain 12, 14 having lower security requirements and a second domain 16 having higher security requirements will now be described.

[0076] With reference to [Fig.2], in step 100, a system 42, 44 of the first domain 12, 14 is connected to the receiving input 50A, 50B.

[0077] The system 42, 44 generates the input video data stream 24 which is transmitted to the security system 18 using the first transmission protocol.

[0078] At step 102, the input video data stream 24 is received in the receiving and conformance test module 60.

[0079] In this module 60, at step 104, the input video data stream 24 is tested to verify its conformity to the first video transmission protocol, with respect to the protocol specifics which are stored for example in a table of the processing unit 54.

[0080] As described below (see steps 132 and following), a conformity test of the input video data stream 24 with respect to the control plane parameters expected for the input video data stream 24 is also carried out.

[0081] At step 106, if the input video data stream 24 does not conform to the first video transmission protocol, module 60 generates an alert which, at step 108, is stored in a security log.

[0082] The input video data stream 24 that does not conform to the first video transmission protocol is then eliminated at step 110, without transmission to the second domain 16.

[0083] The conformity test allows verification in particular of the size of the data transmitted by message, the presence of illegal characters, and / or the presence of random data in the input video data stream 24.

[0084] Steps 104 to 110 thus ensure security against the sending of malformed data likely to disrupt the receiving systems in the second domain 16.

[0085] In the case where the input video data stream 24 conforms to the first video transmission protocol, it is transmitted to the decapsulation module 62.

[0086] In step 112, module 62 decapsulates the input video data stream 24 to extract, on the one hand, image data 26 and, on the other hand, complementary data 28, in particular metadata associated with frames and images and / or control plane data.

[0087] At step 114, the filtering module 64 eliminates at least partially, preferably totally, the additional data 28 which are not transmitted to the second domain 16.

[0088] In step 116, the reencapsulation module 66 receives the image data 26 from the filtering module 64 and reencapsulates them according to a second transmission protocol, advantageously distinct from the first transmission protocol, to generate the output video stream 22.

[0089] At step 118, the control module 67 checks the conformity of the output video stream 22 with the specifications of the second transmission protocol which are stored for example in a table of the processing unit 54.

[0090] If the output video data stream 22 does not conform to the second video transmission protocol, the control module 67 generates an alert which is stored in the security log.

[0091] The output video data stream 22 that does not conform to the second video transmission protocol is then eliminated, without transmission to the second domain 16.

[0092] In step 120, in the case where the output video stream 22 conforms to the specifications of the second transmission protocol, the transmission module 68 transmits the output video stream 22 to the second domain 16 via the transmission output 53.

[0093] In step 122, the output video stream 22 is for example received by the display generation assembly 38 of the display device 36. It is processed by the display generation assembly 38 to be displayed on at least one display area, in particular on at least one of the display areas 37A to 37D or to produce a modified video stream using at least part of the output video stream 22 and display the modified video stream on at least one display area.

[0094] Thanks to the protocol break carried out within the security system 18, the transmission of malicious data via covert channels within the input video data stream 24 produced according to the first transmission protocol is avoided, since only the image data 26 are kept in the output data stream 22 generated according to the second transmission protocol.

[0095] With reference to [Fig.3], at step 130, prior to or at each step 100, upon request from system 42, 44 via the input control plane data stream 30, the predefined values ​​of the spatial and temporal parameters intended to generate the input video data stream 24 are provided by the supply module 82, from the predefined values ​​stored in memory 80. The input control plane data stream 30 is generated, for example, according to a display data channel (DDC) protocol, in particular DDC-I, or according to an Inter-Integrated Circuit (I2C) protocol.

[0096] The transmission of predefined values ​​of spatial parameters (such as image resolution, for example) and temporal parameters (such as image refresh rate, for example) from predefined values ​​contained in a memory 80 of the security system 18 prevents the control plane parameterization from being unlawfully modified on the path to the second domain 16 by avoiding the creation of a hidden control plane parameterization channel, since the parameterization is imposed by the values ​​present in the memory 80.

[0097] In addition, in step 132, the control plane data receiving module 84 tests the conformity of the input video data stream 24 received by the module 60 with respect to the control plane parameterization, in particular with respect to the predefined values ​​of the input parameterization contained in memory 80.

[0098] For example, in step 133, the receiving module 84 compares the values ​​of the spatial and temporal parameters of the input video data stream 24 and determines whether they are equal to the predefined values ​​of the spatial and temporal parameters contained in memory.

[0099] If the values ​​are not equal, the spatial and temporal input parameterization of the input video data stream 24 is non-compliant. In step 134, an alert is generated by module 84 and stored in an alert log in step 136. In step 138, module 84 then eliminates the input video data stream 24 that is not transmitted to the second domain 16.

[0100] This prevents the transmission of illegitimate commands in an uncontrolled data path.

[0101] Furthermore, if the spatial and temporal input parameterization of the input video data stream 24 is deemed compliant, the output video stream 22 is generated as described previously in steps 112 to 118.

[0102] The spatial and temporal output parameterization of the output video stream 22 can also be imposed by predetermined values ​​contained in memory 80.

[0103] The addition module 86 then possibly generates at step 140 a conformity indicator from the predefined values ​​of the spatial and temporal parameters in the form, for example, of a cyclic redundancy check.

[0104] The conformance indicator is for example encapsulated with the input image data at step 116 by the reencapsulation module 66 to be integrated into the second transmission protocol and transmitted to the second domain 16.

[0105] At step 142, during the decapsulation of the output video stream 22, a conformity check of the spatial and temporal output parameterization of the output video stream 22 can then be carried out by the generation assembly 38.

[0106] Thus, the spatial and temporal output parameterization of the output video stream 22 is also controlled within the security system 18, and can be tested by the encapsulated compliance indicator.

[0107] The transmission of the video stream through the security system 18 is therefore particularly secure. This makes it possible, in particular, to use video streams from less secure systems 42, 44 within a cockpit display device 36 without compromising aircraft safety.

[0108] This is achieved by means of a particularly simple architecture, by a simple component placed at the interface between the first domains 12, 14 having lower security requirements and the second domain 16 having higher security requirements.

[0109] In one variant, a unidirectional return link 200 is for example established between the second domain 16 and the first domain 12, 14 without going through the security system 18, to ensure in particular a return of selection of a user on a display area of ​​the output video stream 22, implemented using a selection and / or control system such as a touch screen, a keyboard, or a mouse.

[0110] This return link 200 is established for example in the form of a user datagram protocol (“User Datagram Protocol” or “UDP” in English) or by other digital data transmission protocols such as an RS232 protocol, an RS422 protocol, an ARINC 429 protocol or an ARINC 729 protocol.

Claims

Demands

1. Method of securing an aircraft video link (10) from a first domain (12, 14) having lower security requirements to a second domain (16) having higher security requirements, the method being implemented by a security system (18) and comprising the following steps: - reception, from the first domain (12, 14), of an input video data stream (24) according to an input control plan including a spatial and temporal input parameterization of the input video data stream (24);- transmission to the second domain (16) of an output video stream (22) obtained from the input video data stream (24), following an output control plan including a spatial and temporal output parameterization, characterized by the following step: - provision, by the security system (18), of input control plan parameters imposed on the first domain (12, 14), the imposed input control plan parameters including a spatial and temporal input parameterization defined by the security system (18).

2. A method according to claim 1, wherein the spatial and temporal input parameterization defined by the security system (18) includes predetermined values ​​of spatial and temporal parameters of the input video data stream (24).

3. Method according to claim 2, wherein the predetermined values ​​are stored in a memory (80) of the security system (18), in particular in a read-only memory of the security system (18).

4. A method according to any one of the preceding claims, wherein the spatial and temporal input parameterization includes a frame definition, a synchronization including a clock frequency and frame refresh rate and / or a resolution of the input video data stream (24).

5. A method according to any one of the preceding claims, comprising, before the transmission of the output video stream (22) to second domain (16), a test step of a conformity of the spatial and temporal parameterization of the input video data stream (24) received from the first domain (12, 14) with respect to the defined spatial and temporal input parameterization provided to the first domain (12, 14) by the security system (18).

6. A method according to claim 5, wherein the verification step includes, in the event of a non-conformity of the spatial and temporal parameterization of the input video data stream (24) received from the first domain (12, 14) with respect to the defined spatial and temporal input parameterization provided to the first domain (12, 14), the generation of an alert in an alert log, the verification step optionally including the deletion of the input video data stream (24) after generation of the alert and / or after storage of the alert in the storage log, without transmission of the input video data stream (24) to the second domain (16).

7. A method according to any one of the preceding claims, comprising a step of checking the conformity of the output video stream (22) with respect to the second video transmission protocol, before transmission to the second domain (16), the step of checking conformity comprising optionally, in the event of non-conformity of the output video stream (22), the generation of a security alert and / or the storage of the alert in an alert log, the verification step comprising optionally the deletion of the output video stream (22) in the event of non-conformity of the output video stream (22) after generation of the alert and / or storage of the alert in the alert log.

8. A method according to any one of the preceding claims, wherein the transmission to the second domain (16) of the output video stream (22) is carried out according to an ARINC 818 protocol, a Digital Video Interface (DVI) protocol, a Display Port (DP) protocol, a high-definition multimedia interface (HDMI) protocol, or a serial digital interface (SDI) protocol, in particular 3G-SDI.

9. A method according to any one of the preceding claims, wherein the provision of spatial and temporal input parameters to the first domain (12, 14) is carried out via an input control plane parameter stream (30) using a dedicated transmission channel, separate from a transmission channel for the input video data stream (24), preferably following a Display Data protocol Channel (DDC) and / or following an Inter-Integrated Circuit (I2C) protocol.

10. A method according to any one of the preceding claims, wherein the second domain (16) is an aircraft control domain (10) including at least one avionics unit (34).

11. A method according to any one of the preceding claims, wherein the first domain (12, 14) is a passenger service domain (14) of the aircraft (10) configured to include at least one passenger service system (44), and / or is an operator service domain (12) of the aircraft (10) configured to include at least one operator service system (42).

12. A method according to any one of the preceding claims, wherein the input video data stream (24) is received using a first video transmission protocol encapsulating image data (26) and complementary data (28), the method comprising the following steps: - decapsulating the input video data stream (24) to extract the image data (26) and filtering out at least a portion of the complementary data (28), - re-encapsulating the image data (26) using a second video transmission protocol to generate an output video stream (22), - transmitting the output video stream (22) to the second domain (16) using the second transmission protocol.

13. A security system (18) for an aircraft video link (10) from a first domain (12, 14) having lower security requirements to a second domain (16) having higher security requirements, the security system (18) comprising: - a module (60) for receiving, from the first domain (12, 14), an input video data stream (24) according to an input control plane including spatial and temporal input parameters of the input video data stream (24); - a module (68) for transmitting to the second domain (16) an output video stream (22) obtained from the input video data stream (24), according to an output control plane including spatial and temporal output parameters, characterized by a module (82) for providing input control plane parameters imposed on the first domain (12, 14), the imposed input control plan parameters including a spatial and temporal input parameterization defined by the security system (18).

14. Security system (18) according to claim 13, comprising a programmable logic component or a dedicated logic circuit implementing the receiving module (60), the transmitting module (68), and the imposed input control plane data supply module (82), the security system (18) preferably including a memory (80) storing predetermined values ​​of spatial and temporal input parameters of the input video data stream (24).

15. Aircraft (10) comprising: - a first domain (12, 14) having lower security requirements comprising at least one system for generating an input video data stream (24) according to an input control plane including spatial and temporal input parameterization of the input video data stream (24), - a security system (18) according to any one of claims 13 or 14, configured to generate an output video stream (22) according to an output control plane including spatial and temporal output parameterization, from the input video data stream (24), - a second domain (16) having higher security requirements comprising at least one system for processing and / or displaying the output video stream (22) connected to the security system (18).

Images