EP3150460B1

EP3150460B1 - Railway vehicle with unidirectional security gateway for secure diagnosis data transmission

Info

Publication number: EP3150460B1
Application number: EP15306545.3A
Authority: EP
Inventors: Reiner FELLER; Jörg Vetter; Michael Timme
Original assignee: Alstom Transport Technologies SAS
Current assignee: Alstom Transport Technologies SAS
Priority date: 2015-09-30
Filing date: 2015-09-30
Publication date: 2019-11-13
Anticipated expiration: 2035-09-30
Also published as: EP3150460A1

Description

The present invention concerns railway vehicles that are equipped with one or more data buses for exchanging data between numerous components of the railway vehicle.
The article " Informations- und Steuerungstechnik auf Schienenfahrzeugen - Bussysteme im Zug" by Barbara Schmitz, published in the journal "elektronik industrie ", 8/9 2008, InnoTrans Special: Bahnelektronik, describes various known bus system architectures for railway vehicles.
These known bus systems are inter alia used to transmit status and diagnosis data from the railway vehicle's subcomponents, such as traction or braking units, to a central diagnosis system, which is located for example in the driver's cab. The driver of the railway vehicle can then visualise the diagnosis data in his cab via a corresponding display unit. For further details, reference is made to the book "Schienenfahrzeugtechnik" by J. Janicki et al., 2nd edition, Bahn Fachverlag, p. 375.
Document WO 2014/129107 A1 discloses an information processing device provided in a railway car comprising an unidirectional security gateway relying a control secure bus and an information Ethernet bus.
Lately, train operators have requested train manufacturers to develop a communication system for transmitting said diagnosis data from the railway vehicle to a remote back office. By transmitting the diagnosis data out of the railway vehicle to a back office, the train operator is aware of the railway vehicle's current condition in real time. Hence, the train operator can anticipate necessary repairs and already prepare in advance the maintenance workflow for the railway vehicle's next maintenance stop, thus saving time and increasing efficiency.
However, by providing a communication system for transmitting diagnosis data from the railway vehicle to a remote back office, one creates a point of access for an outsider to the railway vehicle's safety relevant components, such as the traction motors or brakes. As a consequence, the railway vehicle becomes vulnerable to a potential attack from a hacker trying to take over the control of the railway vehicle. This is a serious security risk.
It is therefore an object of the present invention to provide a railway vehicle with tamper proof capabilities for the remote transmission of diagnosis data.
According to the present invention, this object is achieved with a railway vehicle according to claim 1.
By having a unidirectional security gateway between the safety relevant data network and the information data network, it is impossible for a hacker to remotely send control signals to the railway vehicle's safety relevant components and thus to take over control of the railway vehicle. Thanks to the unidirectional security gateway, malicious control signals cannot cross from the information data network to the safety relevant data network.
According to the invention the inventive railway vehicle comprises the following features:

said unidirectional security gateway includes a Field-Programmable Gate Array or FPGA that is programmed to allow only unidirectional data communication from the safety relevant data network to the information data network;
the unidirectional security gateway further includes a dedicated physical FPGA access port, which is the only way to reprogram the FPGA;
a receiving device; and
a diagnosis data requests relaying device interconnecting the receiving device and the safety relevant data network; said diagnosis data requests relaying device being adapted to relay a request for diagnosis data received by the receiving device from the back office to the processing and diagnosing device via the safety relevant data network;
the diagnosis data requests relaying device is only able to send predefined and fixed messages, of which there only is a limited number of different ones, to the processing and diagnosing device via the safety relevant data network;
the diagnosis data requests relaying device includes a dedicated physical programming access port, which is the only way to reprogram the diagnosis data requests relaying device;
the safety relevant data network includes a Multifunction Vehicle Bus or MVB and the information data network is an Ethernet network.

According to preferred embodiments:

the transmitting device and/or the receiving device are adapted to communicate wirelessly with the back office, in particular via radio waves using e.g. the GSM standard;
the railway vehicle is an electric multiple unit, preferably for passenger transport.

A preferred embodiment of the present invention will now be described in detail with reference to the only drawing, which is a block diagram of a communication network according to the invention, including a railway vehicle's wired communication network, a wireless network and a plurality of remote back offices.
The figure represents a communication network 1 comprising a wired communication network 3, a wireless network 5 and an array 7 of remote back offices 9, 10.
The wireless network 5 may for example be a radio network using e.g. the GSM standard.
The remote back offices are preferably implemented in the form of remote servers 9, 10. Each remote server 9, 10 communicates bi-directionally with the wired communication network 3 via the wireless network 5, as indicated by the arrows A. Each remote server 9, 10 has a different function. One remote server 9 may for example manage the seat reservation in the railway vehicle and exchange reservation data with the wired communication network 3. The remote servers 10 (top and bottom of the figure) are diagnosis servers that receive or request diagnosis data from the wired communication network 3.
The reference sign U designates a common wireless interface with a single antenna and modem that is shared by four of the five remote servers 9, 10.
The wired communication network 3 is located in a railway vehicle. The boundaries of the railway vehicle are represented by the dashed line 11. The railway vehicle may for example be an electric multiple unit, preferably for passenger transport.
The wired communication network 3 includes a safety relevant data network 13 (identified by the solid line) and an information data network 15 (identified by the chain-dotted line).
The safety relevant data network 13 has a safety relevant data bus 17. The safety relevant data bus 17 is a Multifunction Vehicle Bus or MVB.
Several safety relevant components 19 for safely operating the railway vehicle, such as a traction or braking unit, are connected to the MVB 17. At least some of the safety relevant components 19 are adapted to provide status data about their operation. This status data is sent over the MVB 17.
A processing and diagnosing device 21 for controlling said safety relevant components 19, for receiving and processing said status data and for generating diagnosis data about the condition of the railway vehicle is also connected to the MVB 17. The processing and diagnosing device 21 includes a main processing unit or MPU 21.1 and a driver display unit or DDU 21.2. Both the MPU 21.1 and the DDU 21.2 are connected to the MVB 17 via an MVB card 23.
The information data network 15 is used to distribute information data, such as traffic or seat reservation data, inside the railway vehicle. It preferably has a star topology with a central switch 25. The information data network 15 is implemented in the form of an Ethernet network. The switch 25 is a central hub managing the communication between the various elements of the information data network 15. These elements are all connected to the switch 25, as indicated by the arrows F. Some of these elements are terminal information equipment 27, such as a dynamic passenger information unit or a video camera.
The information data network 15 also includes a transmitting device 29 that is connected to the switch 25. Preferably, the transmitting device 29 is a transceiver with a modem 31. The transceiver 29 is connected to a radio antenna 33 so that it can communicate wirelessly with one of the remote diagnosis servers 10.
The information data network 15 also includes a receiving device 35 that is connected to the switch 25. Preferably, the receiving device 35 is a Passenger Information System controller or PIS controller. The PIS controller 35 is configured for bidirectional radio communication with one of the remote diagnosis servers 10 and the remote servers 9. For this purpose, the PIS controller 35 has a modem 37 and is connected to a radio antenna 39.
A diagnosis data requests relaying device 41, such as a specially modified MVB card, interconnects the PIS controller 35 and the safety relevant data network 13. The MVB card 41 is adapted to relay a request for diagnosis data received by the PIS controller 35 from the remote diagnosis server 10 to the MPU 21.1 via the safety relevant data network 13, as indicated by the arrows P.
The MVB card 41 has a special design such that it is only able to send predefined and fixed messages, of which there only is a limited number of different ones, to the MPU 21.1 via the safety relevant data network 13.
In order to prevent any remote hacking of the MVB card 41, the same includes a dedicated physical programming access port, which is the only way to reprogram the MVB card 41.
A unidirectional security gateway 43 interconnects the DDU 21.2 and the Ethernet network 15. As indicated by the arrows K, the unidirectional security gateway 43 allows data communication from the DDU 21.2 to the information Ethernet network 15 but prevents any data communication from the information Ethernet network 15 to the DDU 21.2.
The function of the unidirectional security gateway 43 is to relay railway vehicle diagnosis data from said DDU 21.2 to the information Ethernet network 15. Said unidirectional security gateway 43 includes a Field-Programmable Gate Array or FPGA that is programmed to allow only unidirectional data communication from the DDU 21.2 to the information Ethernet network 15.
In order to prevent any remote hacking of the unidirectional security gateway 43, the same has a dedicated physical FPGA access port, which is the only way to reprogram the FPGA.
Thanks to the unidirectional security gateway 43, the communication network 1 is clearly split up into a first secure sub-network corresponding to the MVB network 13, and a second unsecure sub-network (indicated by the polygon 45 in solid lines) corresponding to the Ethernet network 15 and the wireless network 5.

Claims

A railway vehicle (11) comprising:
- a safety relevant component (19) for safely operating the railway vehicle, such as a traction or a braking unit, said safety relevant component (19) being adapted to provide status data about its operation;

- a processing and diagnosing device (21) for controlling said safety relevant component (19), for receiving and processing said status data and for generating diagnosis data about the condition of the railway vehicle (11);

- a safety relevant data network (13) including a Multifunction Vehicle Bus or MVB (17) interconnecting the safety relevant component (19) and the processing and diagnosing device (21);

- an information Ethernet data network (15), different from the safety relevant data network (13), for distributing information data, such as traffic or seat reservation data, inside the railway vehicle (11), said information Ethernet data network (15) also including a receiving device (35) configured for bidirectional radio communication with a remote back office (10);

- a diagnosis data requests relaying device (41) arranged to interconnect the receiving device (35) and the safety relevant data network (13), wherein the diagnosis data requests relaying device (41) is a MVB card adapted to relay a request for diagnosis data received by the receiving device (35) from the remote back office (10) to the processing and diagnosing device (21) via the safety relevant data network (13), the MVB card (41) being only able to send predefined and fixed messages, of which only is a limited number of different ones, to the processing and diagnosing device (21) via the safety relevant data network (13) and including a dedicated physical programming access port which is the only way to reprogram the MVB card (41);

- a transmitting device (29) for sending data from the railway vehicle (11) to said remote back office (10), said transmitting device (29) being part of the information data network (15); and

- a gateway (43) interconnecting the safety relevant data network (13) and the information data network (15),
wherein said gateway (43) is a unidirectional security gateway, which allows data communication from the safety relevant data network (13) to the information data network (15) and prevents any data communication from the information data network (15) to the safety relevant data network (13), said gateway (43) being a Field-Programmable Gate Array or FPGA having a dedicated physical FPGA access port which is the only way to reprogram the FPGA,
wherein said unidirectional security gateway (43) is adapted to relay said diagnosis data from said processing and diagnosing device (21) to the information data network (15), and
wherein said transmitting device (29) is adapted to send the relayed diagnosis data from the railway vehicle (11) to the remote back office (10).
The railway vehicle (11) of any one of the previous claims, wherein the transmitting device (29) and/or the receiving device (35) are adapted to communicate wirelessly with the back office (10), in particular via radio waves using e.g. the GSM standard.
The railway vehicle (11) of any one of the previous claims, wherein the railway vehicle is an electric multiple unit, preferably for passenger transport.