FR3071946B1 - ELECTRONIC DEVICE AND METHOD OF MONITORING DATA STORED IN AN AVIONIC APPARATUS, COMPUTER PROGRAM - Google Patents

Abstract

This electronic device (18) for monitoring data stored in an avionic device (14) comprises: a module (30) for sending, to the avionics apparatus, a request (C) in calculation a cryptographic quantity from the data to be monitored and a random number, the request comprising the hazard and an identifier of the data to be monitored, - a module (32) for calculating the cryptographic quantity from the data to be monitored and of the hazard, the data to be monitored within the avionics device being known, - a module (34) for receiving, from the avionics apparatus, a response (R) containing the cryptographic quantity calculated by the avionics apparatus from the data to be monitored and the hazard, and - a module (36) for comparing the cryptographic quantity calculated by the calculation module with the cryptographic quantity received by the reception module.

Description

Had electronic and monitoring method of data stored within an avionics device, associated computer program

The present invention relates to an electronic device for monitoring data stored in an avionics device, the avionics device being on board an aircraft. The invention also relates to a method of monitoring data stored in an avionics apparatus, the avionics apparatus being onboard an aircraft, the method being implemented by an electronic monitoring device. The invention also relates to a computer program comprising software instructions which, when executed by a computer, implement such a monitoring method. The invention relates to the field of computer security, in particular cybersecurity, avionics devices on board an aircraft.

Currently, avionics architecture is more designed to withstand the consequences of natural hardware failures than the consequences of malware.

To protect themselves from malice, efforts have been made on perimeter defense. Dedicated protection equipment has been interfaced with all communications between the avionics to be protected and the outside world to the aircraft. For data stored in avionics devices, such as software, configuration data, mapping data, databases, etc., their integrity is verified at the time of loading into the avionics device for ensure that they have not been corrupted by a download chain failure, and then cyclically if necessary, to ensure that they have not been corrupted by a hardware failure of the corresponding avionics device.

However, such protection of avionics devices is not optimal.

The object of the invention is then to propose an electronic device and a method for monitoring data stored in an avionics device on board an aircraft, which make it possible to improve the protection of the avionics apparatus, in particular against a malicious attack. For this purpose, the subject of the invention is an electronic device for monitoring data stored in an avionics apparatus, the avionics apparatus being on board an aircraft, the electronic device comprising: a transmission module configured to transmit, to the avionics apparatus, a request for calculating a cryptographic quantity via a predefined cryptographic algorithm and from the data to be monitored and a random number, the request comprising the hazard and a data identifier to monitor, the predefined cryptographic algorithm including a hash function, - a calculation module configured to calculate, via the predefined cryptographic algorithm, the cryptographic quantity from the data to be monitored and the random, the data to be monitored at within the avionics apparatus being known to the monitoring device, - a reception module configured to receive, from the part of the avionics apparatus, a response to the transmitted request, the response containing the cryptographic quantity calculated by the avionics apparatus from the data to be monitored and the hazard, and applying the predefined cryptographic algorithm, and a comparison module configured to compare the cryptographic quantity calculated by the calculation module with the cryptographic quantity received by the reception module.

The monitoring device according to the invention then makes it possible, by issuing the request, and then comparing the calculated cryptographic quantity with the cryptographic quantity received in the response to the request, to detect various forms of malicious intrusions within of the avionics device, which would not have been blocked by a perimeter protection or peripheral barrier, such as a firewall.

The malicious intrusions thus detected by the monitoring device are, for example, a corruption of software embedded in the avionics apparatus, a corruption of critical data embedded in the avionics apparatus, a corruption of critical configuration parameters embedded in the aircraft. avionics apparatus, or an injection of malicious executable code into the avionics apparatus.

The monitoring device according to the invention also does not need to manage a secret, or a secret key, data monitoring being performed in the absence of secret or secret key.

According to other advantageous aspects of the invention, the monitoring device comprises one or more of the following characteristics, taken individually or in any technically possible combination: the transmission module is configured to regularly send a new request for calculation of a cryptographic quantity intended for the avionics apparatus, the hazard being distinct from one request to the other; the electronic device is an avionic device on board the aircraft, the transmission module preferably being configured to transmit each request according to a protocol according to part 7 of the ARINC 664 standard and the receiving module preferably being Configured to receive each response according to a protocol compliant with Part 7 of ARINC 664; the electronic device is an electronic device external to the aircraft, such as a device installed on the ground, and is connected to the avionics device via a communication gateway on board the aircraft; a predefined maximum duration is associated with the calculation by the avionics apparatus of the cryptographic quantity, and the comparison module is configured to further verify that the duration of the calculation of the cryptographic quantity carried out by the avionic apparatus is less than or equal to said maximum duration; - randomness is a random or pseudo-random number; the transmission module is configured to transmit each request to the avionics device via a transmission channel, and the reception module is configured to receive each response from the avionics device via a reception channel distinct from the emission channel; and the predefined cryptographic algorithm comprises a hash function, the predefined cryptographic algorithm preferably being selected from the group consisting of: an SHA algorithm, such as one of the SHA-256, SHA-384, SHA-512 algorithms , SHA-512/256 and SHA-512/246, KECCAK algorithm, SHA-1 algorithm, SHA-3 algorithm and MD5 algorithm.

When the randomness included in the request is a random or pseudo-random number, it is not possible for an attacker to impersonate the avionics device by answering old requests.

When a predefined maximum duration is associated with the computation by the avionics apparatus of the cryptographic quantity, and the comparison module verifies that the duration of the computation of the cryptographic quantity carried out by the avionic apparatus is lower than or equal to said maximum duration predefined, a diversion of the flow between the monitoring device and the avionic apparatus will then be detected, such diversion causing an overshoot of this constrained duration between the request and the response.

When the reception channel is distinct from the transmission channel, and uses, for example, a protocol different from that used by the transmission channel, such as a protocol compliant with Part 7 of the ARINC 664 standard for the channel of transmission. emission and a protocol compliant with the CAN standard or ARINC 429 for the receiving channel, a malicious attacker must then take control of the two communication channels and know moreover the data to be monitored in order to possibly respond fraudulently to a request. query of the monitoring device. The subject of the invention is also a method for monitoring data stored in an avionics apparatus, the avionics apparatus being on board an aircraft, the method being implemented by an electronic monitoring device and comprising: the transmission, to the avionics apparatus, of a request for calculating a cryptographic quantity via a predefined cryptographic algorithm from the data to be monitored and a random number, the request comprising the random number and an identifier data to be monitored, the predefined cryptographic algorithm including a hash function, - the calculation, via the predefined cryptographic algorithm, of the cryptographic quantity from the data to be monitored and the random, the data to be monitored within the avionics device being known to the monitoring device; receiving, on the part of the avionics apparatus, a response to the req. emitted, the response containing the cryptographic quantity calculated by the avionics apparatus from the data to be monitored and the hazard, and applying the predefined cryptographic algorithm, and - the comparison of the cryptographic quantity calculated by the monitoring device with the cryptographic amount received from the avionics. The invention also relates to a computer program comprising software instructions which, when executed by a computer, implement a monitoring method as defined above.

These features and advantages of the invention will emerge more clearly on reading the following description, given solely by way of non-limiting example, and with reference to the appended drawings, in which: FIG. 1 is a diagrammatic representation; an aircraft equipped with avionic devices interconnected by a communication network and an electronic device according to the invention for monitoring data stored in an avionics apparatus; and FIG. 2 is a flowchart of a method according to the invention for monitoring data stored in an avionic apparatus of FIG. 1.

In FIG. 1, an aircraft 10 comprises a communication system 12 comprising at least two avionic devices 14 interconnected by a communication network 16. An electronic monitoring device 18 is configured to monitor data stored within at least An avionics apparatus 14. The aircraft 10 is preferably an aircraft. In a variant, the aircraft 10 is a helicopter, or a drone piloted remotely by a pilot.

The communication system 12 comprises several electronic devices, such as avionic devices 14 as in the example of FIG. 1, where the communication system 12 is on board the aircraft 10.

In the example of FIG. 1, each avionics apparatus 14 is preferably configured, on the one hand, to transmit data to other avionic apparatus (s) 14, and on the other hand , to receive data from other avionics (s) 14.

Each avionic apparatus 14 is preferably in accordance with part 7 of the ARINC 664 standard, and is then configured to transmit and / or receive data to and / or from other avionics (s) 14 according to a protocol in accordance with Part 7 of ARINC 664.

The communication network 16 comprises at least one network switch 20 and at least one bidirectional link 22, each network switch 20 being connected to one or more avionic devices 14 via respective bidirectional links 22. The communication network 16 preferably comprises a plurality of network switches 20, as in the example of FIG. 1, where the communication network 16 comprises two network switches 20 interconnected by a bidirectional link 22.

The communication network 16 is for example an Ethernet communication network. Those skilled in the art will understand that, when the communication network 16 is an Ethernet communication network, for example of the "full-duplex" (simultaneous bidirectional) Ethernet type, each network switch 20 is an Ethernet network switch, for example Ethernet type "full-duplex" switched, and each bidirectional link 22 is a bidirectional Ethernet link, for example type Ethernet "full-duplex" switched.

The communication network 16 is preferably in accordance with part 7 of the ARINC standard 664, and each network switch 20 is then also in conformity with part 7 of the ARINC 664 standard. The communication network 16 is, for example, a network. AFDX (English Avionics Full DupleX Switched Ethernet) with one or more network switch (s) compliant with part 7 of the ARINC 664 standard.

The communication network 16 has a deterministic time of transmission of data between the sender and the recipient. In other words, a transmission duration of a set of data on the communication network 16, in particular a maximum transmission time, is calculable in a predetermined manner and typically depends on the size of the data set and the path to be traveled by this set of data on the communication network 16 between the sender and the recipient.

In the example of FIG. 1, the electronic monitoring device 18 is an avionic device on board the aircraft 10, and is connected to each avionic apparatus 14, for example via the communication network 16 while being connected to an aircraft. corresponding network switch 20. Those skilled in the art will understand that the electronic monitoring device 18 is also able to be directly connected to the avionics device (s) 14 via respective bidirectional links 22, without going through a network switch.

As a variant not shown, the electronic monitoring device 18 is an electronic device external to the aircraft 10, such as an electronic device installed on the ground. The electronic monitoring device 18 is then connected to the avionics apparatus 14 via a communication bridge, not shown, on board the aircraft 10. The communication gateway is connected to each avionic apparatus 14, for example via the network communication 16 being connected to a corresponding network switch 20.

The electronic monitoring device 18 comprises a transmission module 30 configured to transmit, to the avionic apparatus 14, a request C (of the English Challenge) in computing a cryptographic quantity via a predefined cryptographic algorithm and to from the data to be monitored and from a hazard. The request C comprises the hazard and an identifier of the data to be monitored.

The electronic monitoring device 18 comprises a calculation module 32 configured to calculate, via the predefined cryptographic algorithm, the cryptographic quantity from the data to be monitored and the hazard, the data to be monitored within the avionics apparatus 14 being known to the monitoring device 18.

The electronic monitoring device 18 comprises a reception module 34 configured to receive, from the avionics apparatus 14, a response R to the transmitted request C. The response R contains the cryptographic quantity calculated by the avionics apparatus 14. from the data to be monitored and the hazard, and by applying the predefined cryptographic algorithm. Those skilled in the art will then understand that each avionic apparatus 14 capable of being monitored by the monitoring device 18 is configured to calculate the response R by applying the predefined cryptographic algorithm to the hazard and the data to be monitored, these being identified by the identifier included in the request C received, the hazard being also included in said request C. Each avionic apparatus 14 able to be monitored by the monitoring device 18 is further configured to transmit, in return, the response R calculated for the surveillance device 18.

The electronic monitoring device 18 comprises a comparison module 36 configured to compare the cryptographic quantity calculated by the calculation module 32 with the cryptographic quantity received by the reception module 34.

In the example of FIG. 1, the electronic monitoring device 18 comprises an information processing unit 40 formed for example of a memory 42 associated with a processor 44.

In the example of FIG. 1, the transmission module 30, the calculation module 32, the reception module 34 and the comparison module 36 are each produced in the form of software executable by the processor 44. 42 is then able to store a transmission software configured to issue the request C to the monitored avionics apparatus 14. The memory 42 is also able to store a calculation software configured to calculate, via the predefined cryptographic algorithm, the cryptographic quantity from the data to be monitored and the hazard, the data to be monitored within the avionic apparatus 14 being known from the monitoring device 18. The memory 42 is also able to store a reception software configured to receive, from the avionics apparatus 14, the response R to the transmitted request C, the response R containing the cryptographic quantity calculated by the avionics apparatus 14 by applying the predefined cryptographic algorithm to the data to be monitored and to the hazard. The memory 42 is also able to store a comparison software configured to compare the cryptographic quantity calculated by the calculation software, on the one hand, with the cryptographic quantity received by the receiving software, on the other hand. The processor 44 of the information processing unit 40 is then able to execute the transmission software, the calculation software, the receiving software and the comparison software.

In a variant that is not shown, the transmission module 30, the calculation module 32, the reception module 34 and the comparison module 36 are each made in the form of a programmable logic component, such as an FPGA (of the English Field Programmable Gate Array), or in the form of a dedicated integrated circuit, such as an ASIC (English Application Specifies Integrated Circuit). The predefined cryptographic algorithm has a hash function. The predefined cryptographic algorithm is, for example, selected from the group consisting of: an SHA algorithm, such as one of the SHA-256, SHA-384, SHA-512, SHA-512/256 and SHA-512 / algorithms 246, the KECCAK algorithm, the SHA-1 algorithm, the SHA-3 algorithm and the MD5 algorithm. The hazard is a random or pseudo-random number. The identifier of the data to be monitored comprises, for example, a start or end address of a memory area to be monitored by the avionics apparatus 14 and a size of said memory zone, said memory zone containing the data to be monitored.

The transmission module 30 is configured to regularly send a new request C by calculating a cryptographic quantity to the monitored avionic apparatus 14, the hazard being distinct from one request C to the other.

The transmission module 30 is preferably configured to transmit each request according to a protocol compliant with Part 7 of the ARINC 664 standard.

In addition optional, the transmission module 30 is configured to transmit each request to the avionics apparatus 14 via a transmission channel, and the reception module 34 is configured to receive each response from the device. avionics 14 via a reception channel separate from the transmission channel.

The calculation module 32 is configured to calculate the cryptographic quantity from the data to be monitored and the hazard, with a view to its subsequent comparison with the cryptographic quantity contained in the response R received from the avionics apparatus 14 monitored, following the request C which has been sent to it, knowing that the data to be monitored within the avionics apparatus 14 are known to the monitoring device 18. In other words, the calculation module 32 is configured to apply the predefined cryptographic algorithm to these data to monitor and random, to deduce the cryptographic amount.

For this application of the cryptographic algorithm, the hazard is for example concatenated with the data to be monitored, and the cryptographic algorithm is then applied to said concatenation of the hazard and the data to be monitored.

The receiving module 34 is preferably configured to receive each response according to a protocol according to Part 7 of the ARINC 664 standard.

The comparison module 36 is configured to compare the cryptographic quantity calculated by the calculation module 32, on the one hand, with the cryptographic quantity included in the response R received by the reception module 34, following the request C previously issued by the transmission module 30.

In optional addition, when the comparison module 36 detects a difference between the cryptographic quantities, following this comparison of the cryptographic quantity calculated by the calculation module 32, with the cryptographic quantity received by the reception module 34, the comparison module 36 is further configured to generate an alert. This alert is intended to signal an inconsistency of the data to be monitored contained within the avionics apparatus 14, and then to detect a possible malicious attack against this avionics apparatus 14.

As a further optional supplement, a predefined maximum duration is associated with the calculation by the avionics apparatus 14 of the cryptographic quantity, and the comparison module 36 is configured to further verify that the duration of the calculation of the cryptographic quantity carried out by the apparatus avionics 14 is less than or equal to said maximum duration.

According to this optional add-on, the comparison module 36 is further configured to generate an alert also in the event of detecting an exceeding of said predefined maximum duration. Those skilled in the art will understand that the predefined maximum duration is calculable in a predetermined manner. Indeed, on the one hand, the communication network 16 has a deterministic time of data transmission between a respective transmitter and a recipient, and on the other hand, a maximum duration necessary for calculating the cryptographic quantity by the avionics apparatus 14 is computable. Those skilled in the art will then understand that the predefined maximum duration depends on the communication network 16, a computing power of the monitored avionics apparatus 14, the size of the data to be monitored, as well as the predefined cryptographic algorithm chosen .

The maximum predefined time is generally between a few milliseconds and a few seconds. The maximum predefined duration is typically equal to a few hundred milliseconds, for example equal to 300 ms.

The operation of the monitoring device 18 according to the invention will now be explained with reference to FIG. 2 representing a flowchart of a method according to the invention for monitoring data stored in a corresponding avionic apparatus 14.

During an initial step 100, the electronic monitoring device 18 sends, via its transmission module 30 and to the monitored avionic apparatus 14, the request C, by which the monitoring device 18 requests the device avionics 14 monitored to calculate a cryptographic quantity, this by application of I predefined cryptographic algorithm to the data to be monitored and the random.

The monitoring device 18 then calculates, during the next step 110 and via its calculation module 32, the cryptographic quantity from the data to be monitored and the hazard, the data to be monitored within the avionic apparatus 14 being known to the monitoring device 18. The calculation module 32 then applies the predefined cryptographic algorithm to these data to be monitored and to the random, to calculate said cryptographic quantity.

In parallel, the monitored avionic apparatus 14 calculates the response R by applying the predefined cryptographic algorithm to the hazard and the data to be monitored, taking into account the request C received. Indeed, the data to be monitored are identified by the identifier included in the request C received, and the hazard is also included in said request C. The monitored avionic apparatus 14 then transmits the response R thus calculated to the device of surveillance 18.

In the next step 120, the monitoring device 18 then receives, from the monitored avionic apparatus 14 and via its reception module 34, the response R generated by the avionics apparatus 14 monitored, following the request. C emitted during step 100 to his attention, this response R containing the cryptographic quantity calculated by the avionics apparatus 14 monitored.

Finally, during step 130, the monitoring device 18 compares, via its comparison module 36, the cryptographic quantity previously calculated in step 110 by the calculation module 32 with the cryptographic quantity included in the response R received from the avionic apparatus 14 monitored during step 120 and by the reception module 34.

This then allows, in case of discrepancy between said cryptographic quantities, to detect a possible malicious attack.

In optional addition, when the comparison module 36 detects, in the step 130, a difference between the cryptographic quantities described above, the comparison module 36 also generates an alert to signal an inconsistency in the data to be monitored at the time. within the avionics apparatus 14.

As a further optional supplement, when a predefined maximum duration is associated with the calculation by the avionics apparatus 14 of the cryptographic quantity, the comparison module 36 furthermore verifies that the duration of the calculation of the cryptographic quantity carried out by the avionic apparatus 14 is less than or equal to said maximum duration.

According to this optional add-on, the comparison module 36 generates an alert also in case of detection of an exceeding of said maximum duration predefined by the avionics apparatus 14 monitored.

Thus, the monitoring device 18 according to the invention makes it possible to provide deep protection for the monitored avionic apparatus 14, and makes it possible to detect attacks such as embedded software corruption, embedded critical data corruption. , a corruption of embedded critical configuration parameters and / or an injection of malicious code in the monitored avionic apparatus 14.

In addition, this monitoring is characterized by the absence of secrecy, which avoids any need to manage a secret, protection and revocation of such secrecy.

The monitoring device 18 according to the invention makes it possible to offer protection against various types of cyberattacks, such as replay, stream diversion.

The request C comprising a hazard, and the calculated cryptographic quantity depending on this hazard, it is not possible for an attacker to pretend to be the avionics apparatus 14 monitored by answering with old R responses that he intercepted .

When the comparison module 36 furthermore verifies that the duration of the calculation of the cryptographic quantity carried out by the avionic apparatus 14 is less than or equal to the said maximum duration, this makes it possible to detect a possible diversion of flows.

Moreover, given the lack of secrecy, the attacker can know the predefined cryptographic algorithm, without compromising the monitoring mechanism.

In addition, in the case of optional use of several communication channels, the transmission module 30 transmitting each request to the avionics apparatus 14 via a transmission channel, and the reception module 32 receiving each response of the part of the avionics apparatus 14 via a reception channel separate from the transmission channel, a possible malicious attack is even more complicated to implement for the attacker, because to respond to the position of the avionics apparatus 14 monitored, he must not only know the data to be monitored, but also take control of these two separate communication channels.

In the context of an avionics apparatus 14 capable of accommodating various applications developed by third parties, it is advantageously not necessary to ask these third parties to add protection software, and it is sufficient to know the image of the application concerned. to watch it.

In addition, the monitoring device 18 according to the invention is able to implement an authentication, while not requiring secrecy, unlike other authentication mechanisms. For this, the monitoring device 18 having knowledge of the memory area where software is recorded, sends a request C on all or a sensitive part of said memory area, to verify that the correct software or the good version is registered in said zone, and therefore embedded in the avionics apparatus 14 corresponding. This authentication mechanism is based on what the software is, that is to say on its characteristics, and not on a possible secret that it would know. Those skilled in the art may further understand that this monitoring device 18 according to the invention is simple to implement.

It is thus conceivable that the electronic monitoring device 18 and the monitoring method according to the invention make it possible to improve the protection of the monitored avionic apparatus 14, in particular against the malicious attacks described above.

Claims (10)

An electronic data monitoring device (18) stored in an avionics apparatus (14), the avionics apparatus (14) being on board an aircraft (10), the electronic device (18) comprising: a transmission module (30) configured to transmit, to the avionic apparatus (14), a request (C) in computing a cryptographic quantity via a predefined cryptographic algorithm and from the data to be monitored and a hazard, the request (C) comprising the hazard and an identifier of the data to be monitored, the predefined cryptographic algorithm comprising a hash function, - a calculation module (32) configured to calculate, via the predefined cryptographic algorithm , the cryptographic quantity from the data to be monitored and the hazard, the data to be monitored within the avionic apparatus (14) being known to the monitoring device (18), - a receiving module (34) config urged to receive, from the avionic apparatus (14), a response (R) to the transmitted request (C), the response (R) containing the cryptographic quantity calculated by the avionics apparatus (14) from the data to be monitored and random, and applying the predefined cryptographic algorithm, and - a comparison module (36) configured to compare the cryptographic quantity calculated by the calculation module (32) with the cryptographic quantity received by the module receiving (34). 2. Device (18) according to claim 1, wherein the transmitting module (30) is configured to regularly send a new request (C) in calculating a cryptographic quantity to the avionics apparatus (14), the hazard being distinct from one request (C) to the other. 3. Device (18) according to claim 1 or 2, wherein the electronic device (18) is an avionics device on board the aircraft (10), the transmission module (30) being preferably configured to transmit each request according to a protocol according to part 7 of the ARINC standard 664 and the reception module (34) being preferably configured to receive each response according to a protocol compliant with part 7 of the ARINC 664 standard. 4. Device (18) according to claim 1 or 2, wherein the electronic device (18) is an electronic device external to the aircraft (10), such as a device installed on the ground, and is connected to the device avionics (14) via an on-board communication gateway on board the aircraft (10). A device (18) according to any one of the preceding claims, wherein a predefined maximum duration is associated with the avionic apparatus (14) calculating the cryptographic quantity, and the comparing module (36) is configured to check in addition that the duration of the calculation of the cryptographic quantity carried out by the avionic apparatus (14) is less than or equal to said maximum duration. 6. Device (18) according to any one of the preceding claims, wherein the random is a random or pseudo-random number. The device (18) according to any one of the preceding claims, wherein the transmitting module (30) is configured to transmit each request to the avionics apparatus (14) via a transmission channel, and the receiving module (32) is configured to receive each response from the avionics apparatus (14) via a reception channel separate from the transmission channel. Apparatus (18) according to any one of the preceding claims, wherein the predefined cryptographic algorithm includes a hash function, the predefined cryptographic algorithm preferably being selected from the group consisting of: a SHA algorithm, such as one of the SHA-256, SHA-384, SHA-512, SHA-512/256 and SHA-512/246 algorithms, the KECCAK algorithm, the SHA-1 algorithm, the SHA-3 algorithm and the algorithm MD5. 9. A method for monitoring data stored in an avionic apparatus (14), the avionic apparatus (14) being on board an aircraft (10), the method being implemented by an electronic monitoring device (18) and comprising: - sending (100), to the avionic apparatus (14), a request (C) in computing a cryptographic quantity via a predefined cryptographic algorithm from the data to be monitored and a hazard, the request (C) comprising the hazard and an identifier of the data to be monitored, the predefined cryptographic algorithm comprising a hash function, - the calculation (110), via the predefined cryptographic algorithm, of the cryptographic quantity from the data to be monitored and the hazard, the data to be monitored within the avionic apparatus (14) being known to the monitoring device (18), - the reception (120), from the avionics apparatus, a response (R) to the transmitted request (C), the response (R) containing the cryptographic quantity calculated by the avionics apparatus (14) from the data to be monitored and the hazard, and applying the cryptographic algorithm predefined, and - the comparison (130) of the cryptographic quantity calculated by the monitoring device (18) with the cryptographic quantity received from the avionics apparatus (14). 10. Computer program comprising software instructions which, when executed by a computer, implement a method according to the preceding claim.