FR3017508A1 - SYSTEM AND METHOD FOR DATA EXCHANGE - Google Patents

Abstract

This system (1) for exchanging data between a first secure network (3) and a second network (5) of a lower or unknown security level comprises a first chain (7) for transmitting data from said first network (3) to said second network (5), and a second chain (9) for transmitting data from said second network (5) to said first network (3). Said second channel (9) comprises data filtering means (31, 37) transmitted from said second network (5) to said first secure network (3), comprising a coherence check module (37), suitable for checking if said data are consistent with data expected by said first secure network (3), to allow transmission to said first secure network (3) if said data are consistent and prohibit their transmission if said data are not consistent.

Description

System and method for data exchange The invention relates to a system for exchanging data between a first secure network and a second network with a lower security level than the first secure network or a security level. unknown, said system comprising a first chain of data transmission from said first secure network to said second network, and a second chain of data transmission from said second network to said first secure network, said second channel comprising filtering means data transmitted from said second network to said first secure network. It applies in particular to the exchange of data in an onboard system on a platform such as a land, water or air vehicle, between a secure network and a network that is at a lower security level than the first network. secure (that is to say that all or part of the second network has a lower security level than the first network) is of unknown security level (that is to say that all or part of the second network present an unknown security level). The secure network is called a platform segment. This network is said to be secure because it consists of hardware and software specifically developed or adapted to be integrated into the platform and qualified and / or certified for their use on this platform. For example, if the platform is a civilian aircraft, the platform segment corresponds to the avionics domain, and includes avionics computers dedicated to flight controls. In the case of a combat aircraft, the platform segment also includes weapons systems.

The security level network is weaker or unknown, called open segment, includes non-specific hardware and software, industrial or even mainstream. The open segment offers in particular a quick and easy adaptation flexibility to specific needs of the operating context, in particular for the display of maps, weather information, for communication with the outside of the platform or even for the amusement of the passengers of a civil transport aircraft. Due to issues of certification and qualification of the embedded system, the connection of the open segment to the platform segment for information exchange purposes must preserve the platform's achievements in terms of dependability, capabilities functional and security information systems (SSI). In particular, it is desirable to control the exchange of data between the platform segment and the open segment in order to guarantee the integrity and availability of platform segment functions, in particular to protect the platform segment from possible malicious attacks. , and to guarantee the confidentiality of the data that require it.

In order to protect the platform segment from possible malicious attacks, it is known to limit the exchange of data between the platform segment and the open segment to only the transmission of data from the platform segment to the open segment. no data is allowed to pass from the open segment to the platform segment.

However, a bidirectional exchange of data between the platform segment and the open segment is desirable in order to extend the functionality of the system as a whole, for example to load databases in the platform segment from the open segment, enter all or part of a navigation plan or other mission data, and in the other direction to retrieve data from the platform segment, for example data relating to navigation, traffic information, data weather or camera images. The term "data transmission" means the one-way transfer of data, that is to say either from the platform segment to the open segment or from the open segment to the platform segment.

The term "data exchange" refers to the transfer of data from the platform segment to the open segment on the one hand and from the open segment to the platform segment on the other hand. To solve this problem, document FR 2 917 206-A1 discloses a system comprising a security device for the transmission of data from the open segment to the avionics domain. Furthermore, this document also describes a one-way data transmission link from the avionics domain to the open segment. Nevertheless, this system does not fully prevent the risks of malicious attacks from the avionics domain by the open segment. In particular, this system is not able to deal with the risk associated with the functional exploitation by the avionics domain of data whose value is erroneous, maliciously or because of a lower operational safety of the open segment. In addition, this system only protects the transmission of data from the open domain to the avionics domain, the transmission of data in the other direction remaining free of any security constraint. This system therefore does not guarantee the confidentiality of the information emitted by the avionics domain, and does not make it possible to prevent the sending of sensitive data to the open segment, which may allow a malicious user to deduce attack scenarios from the avionics domain. Furthermore, the security device according to document FR 2 917 206-A1 comprises a centralized control module controlling the entire device. This control module can therefore constitute a data flow from the open segment to the avionics domain, parallel to the desired secure path. Moreover this positioning makes the control module potentially vulnerable to attacks from the open segment, while its role is the control of the entire security device. The invention therefore aims to propose a data transmission system between a first secure network and a second network of a lower security level or an unknown security level, which effectively ensures the security of the first one. secure network and the confidentiality of the data that requires it. For this purpose, the subject of the invention is a data exchange system of the aforementioned type, characterized in that said filtering means comprise a coherence control module, able to check whether said data are consistent with data expected by said first secure network, and to allow the transmission of said data to said first secure network if said data are consistent and to prohibit the transmission of said data to said first secure network if said data are not consistent.

The exchange system according to the invention also comprises the following characteristics, taken separately or in combination: the coherence control module is able to identify the data to be the subject of an additional validation by an operator to be considered; as coherent, to transmit this data to the operator for validation, and to allow the transmission of said data to said first secure network if said data are validated by the operator and to prohibit the transmission of said data to said first secure network if said data are not validated by the operator; said coherence check module is capable of checking whether the value of said data belongs to a predetermined set of expected values for said data and / or whether the dynamic behavior of the value of said data belongs to a predetermined set of expected dynamic behaviors for said data; said first and second chains form a monodirectional ring for the exchange of data between said first secure network and said second network and for the exchange of internal data; said coherence control module is interposed on said second channel between said first secure network and said second network, so that any data transmitted from said second network to said first secure network passes through said coherence control module; ; said filtering means comprise a data filtering module capable of analyzing said data to determine whether said data are authorized to be transmitted to said first secure network, to transmit said data to said first secure network if said data are authorized to be transmitted. to said first secure network and to prohibit transmission of said data to said first secure network if said data is not allowed to be transmitted to said first secure network; said data filtering module is interposed on said second string between said second network and said coherence control module, and said second channel comprises a switch able to prohibit the transmission of said data from said data filtering module to said module; consistency check as long as said data has not been judged by said data filtering module as allowed to be transmitted to said first secure network; the system comprises means for identifying and authenticating said second network and an operator operating from said second network, said identification and authentication means being able to prohibit any data exchange between said exchange system and said second network if said operator and / or said second network are judged by said identification and authentication means as not authorized to exchange data with said first secure network; said first channel comprises data protection means transmitted from said first secure network to said second network; said protection means comprise a data filtering module capable of analyzing said data to determine whether said data are authorized to be transmitted to said second network, and to authorizing the transmission of said data to said second network if said data are authorized and to prohibiting transmission of said data to said second network if said data is not allowed; said protection means comprise a cryptographic protection module able to apply cryptographic protection to data transmitted from said first secure network to said second network; said data filtering module is capable of analyzing the authorized data in order to determine, according to said predetermined second security policy, whether said data must be protected before being transmitted to said second network, and to refer said data to said cryptographic protection module only if said data must be protected before being transmitted to said second network; said first secure network is a platform segment of an aircraft, and said second network is an open segment of said aircraft. The invention also relates to an aircraft comprising a platform segment and an open segment, characterized in that it comprises a data exchange system according to the invention embedded in said aircraft for the exchange of any data between said platform segment and said open segment. The invention also relates to a method for exchanging data between a first secure network and a second network of a lower security level than the first secure network or an unknown security level, characterized in that it comprises the following steps: - supply of a system as defined above, - during a transmission of data from said second network to said first secure network through said second data transmission chain, a filtering of said data said filtering comprising a coherence check phase of said data, in which said coherence module checks whether said data are coherent with data expected by said first secure network, and authorizes the transmission of said data to said first secure network if said data are coherent or prohibits the transmission of said data to said first network u secure if said data is not consistent. The invention will be further understood with reference to embodiments of the invention which will now be described with reference to the appended figures among which: FIG. 1 is a diagram of a data exchange system according to a first embodiment of the invention; FIG. 2 is a block diagram illustrating steps of the method according to one embodiment of the invention, implemented by the data exchange system of FIG. 1; FIG. 3 is a diagram of a data exchange system according to a second embodiment of the invention, and FIG. 4 is a diagram of a data exchange system according to a third embodiment. of the invention.

FIG. 1 illustrates a data exchange system 1 according to one embodiment of the invention for exchanging data between a first network 3 and a second network 5, the second network 5 being of a level security is lower than the first network 3 is unknown.

The first secure network 3 and the second network 5 are for example two networks of a system embedded on a platform such as a land vehicle, nautical or air. The first network 3, hereafter referred to as a platform segment, is a secure network.

The second network 5, subsequently called an open segment, is either of a lower security level than the first network (ie all or part of the second network 5 has a lower security level than the first one). network 3) is of unknown security level (that is to say that all or part of the second network 5 has an unknown security level). In particular, the open segment 5 may be accessible to any operator, and may include consumer components and be implemented according to non-specific or non-platform platform specific standards. For example, the platform considered is an aircraft, the platform segment 3 corresponds to the avionics of this aircraft, and the open segment 5 is a computer with an Ethernet local network embedded in the aircraft, able to communicate, especially via a direct radio or satellite link, with a ground information system. The exchange system 1 is cut between the platform segment 3 and the open segment 5, so that all the data exchanged between the platform segment 3 and the open segment 5 necessarily pass through the system 1 of data exchange.

The data exchange system 1 comprises data transmission means from the platform segment 3 to the open segment 5 on the one hand and the data transmission means from the open segment 5 to the platform segment 3. data exchange system 1 thus comprises a first unidirectional data transmission chain 7 from the platform segment 3 to the open segment 5, and a second unidirectional data transmission chain 9 from the open segment 5 to the platform segment 3 The first channel 7 comprises data protection means transmitted from the platform segment 3 to the open segment 5.

In particular, the first channel 7 is able to filter the data in order to restrict the sending of the data of the platform segment 3 to the authorized data, and to protect the data that require it, in accordance with a predefined security policy. The first channel 7 also comprises means enabling the data to circulate exclusively only in the outgoing direction, that is to say towards the open segment 5. The second channel 9 comprises means for the secure transmission of data from the open segment 5 to the platform segment 3. On the second channel 9, the data flows exclusively in the incoming direction, that is to say towards the platform segment 3.

In particular, the second channel 9 comprises means for filtering data transmitted from the open segment 5 to the platform segment 3, as well as means 38 for controlling / validating data by the operator and means 33 for permanent isolation of the segments 3 and 5. These filtering means are adapted to control, by identification and authentication mechanisms, access to the platform segment 3, and to prohibit the transmission of data by an operator or by an unauthorized open segment. These filtering means are moreover adapted to allow only authorized data to pass, to check whether these data are consistent with data expected by the platform segment 3, and to authorize the transmission of data to the platform segment 3 if the data is consistent and prohibit the transmission of data to platform segment 3 if the data is inconsistent. These filtering means are also suitable for allowing a data control by the operator, so that he can manually validate by the means 38 these data to allow their transmission to the platform segment, or that he can invalidate them and prohibit their transmission to the platform segment. For this purpose, the first 7 and second 9 chains comprise a first coupling module 13 of the platform segment 3 to the data exchange system 1, and a second coupling module 15 of the open segment 5 to the data exchange system. data 1. Each of the first 13 and second 15 coupling modules is common to the first and second chains 7 and 9. The first channel 7 further comprises a data filtering module 21, hereinafter referred to as the first filter module 21, a cryptographic protection module 23, and a monodirectional diode 25. The first filter module 21, the cryptographic protection module 23 and the diode 25 are connected in series between the first coupling module 13 and the second coupling module 15.

In particular, the first coupling module 13 comprises a first input 13a, connected to the platform segment 3, a second input 13b, a first output 13c connected to the platform segment 3, and a second output 13d. The first filter module 21 comprises an input 21a, connected to the second output 13d of the first coupling module 13, a first output 21b and a second 21c output. The cryptographic protection module 23 comprises an input 23a, connected to the first output 21b of the first filtering module 21, and an output 23b. The diode 25 comprises two inputs 25a, 25b respectively connected to the output 23b of the cryptographic protection module 23 and the second output 21c of the first filter module 21, and an output 25c. The second coupling module 15 comprises a first input 15a, connected to the output 25c of the diode 25, a second input 15b connected to the open segment 5, a first output 15c connected to the open segment 5 and a second output 15d. The second channel 9 comprises, in addition to the first and second coupling modules 13 and 15, a data filtering module 31, hereinafter called second filtering module 31, a switch 33, a first data storage buffer module 35, a coherence control module 37 and a second data storage buffer module 39. The second filter module 31, the switch 33, the coherence control module 37 and the second data storage buffer module 39 are connected in series between the second coupling module 15 and the first coupling module 13. In particular, the second filtering module 31 comprises an input 31a, connected to the second output 15d of the second coupling module 15, and an output 31b. The switch 33 comprises an input 33a, connected to the output 31b of the second filtering module 31, an output 33b, and an input / output 33c. The coherence control module 37 comprises an input 37a connected to the output 33b of the switch 33 and an output 37b. The second buffer module 39 comprises an input 39a connected to the output 37b of the coherence control module 37 and an output 39b connected to the second input 13b of the first filter module 21. The first data storage buffer module 35 is connected to the input / output 33c of the switch 33.

Thus, the first and second chains 7 and 9 form a monodirectional ring for the exchange of data between the platform segment 3 and the open segment 5. In particular, the first channel 7 contains no central module that would be connected to the all the other modules of the first channel 7. Likewise, the second channel 9 contains no central module that would be connected to all the other modules of the second channel 9. The exchange system 1 does not include any other central module that would drive the first and second chains 7 and 9. Thus, the system 1 does not include any unwanted exchanges path (ie no short circuit or "bypass") between the platform segment 3 and the open segment 5 These first and second chains 7 and 9 also form a monodirectional ring for sending operating data to the system modules 1. This data for a module of the system 1 comes from oit another module of the system 1 is segments 3 and 5 and are subject to the same processing as other data. Subsequently, this data will be called "internal data" and is intended for a module that is internal to the system (for example, states or information of events exchanged between modules). Thus, the data circulating on the channel 7 are destined either for the open segment 5 or for an internal module and the data that travels on the channel 9 are intended either for the platform segment 3 or for a module internal. The first coupling module 13 couples the platform segment 3 to the data exchange system 1. In particular, the first coupling module 13 is adapted to set up and control a protocol for connection and exchange of information with the platform segment 3. The first coupling module 13 is able to receive data from the buffer module 39 (for example internal data) or data from the platform segment 3 and to transmit this data to the first filter module 21. Moreover, when these data are in the form of analog signals, the first module of FIG. coupling 13 is suitable for converting these analog signals into transmissible data streams through the system 1, according to a predefined protocol, before their transmission to the first filtering module 21. Moreover, the first coupling module 13 is also able to receive data. data from the second buffer module 39, and to transmit this data from the second buffer module 39 to the platform segment 3 when it is data destined for This first filter module 21 is adapted to receive data from the first coupling module 13, and to analyze this data to determine, according to the predefined security policy, whether the data are authorized to be transmitted. to the open segment 5 or if they are part of the internal data allowed to circulate within the system 1. The first filtering module 21 is also able to determine, according to the predefined security policy, whether the data authorized to be transmitted to the Open segment 5 must be protected before this transmission. The system 1 is set in coherence with a predefined security policy, for example via the maintenance module 40 described below. Thus, the first filtering module 21 comprises setting means for defining which data are allowed to be transmitted from the platform segment 3 to the open segment 5, which data require cryptographic protection before transmission to the open segment 5, and which data can be transmitted in clear, ie without cryptographic protection, to the open segment 5. The first filtering module 21 is able to prohibit the transmission of data that has not been authorized to the open segment 5 or to one of the System 1 modules if they are internal data. The first filter module 21 is also able to direct the authorized data to the cryptographic protection module 23, for their protection before transmission to the open segment 5, if these authorized data must be protected before being transmitted to the segment open 5, and transmit the authorized data to the diode 25 if it is not considered necessary to protect these data. The first filtering module 21 thus transmits the authorized data to either the cryptographic protection module 23, or directly to the diode 25, but does not transmit any data at once to the cryptographic protection module 23 and to the diode 25, this in order to avoid compromising the characteristics of the protection applied by the cryptographic protection module 23, for example a key or an encryption algorithm used by the cryptographic protection module 23. Thus, the first filtering module 21 is able to prevent transmission to the cryptographic protection module 23. the open segment 5 of sensitive data, which would be likely to provide information allowing a malicious user to infer attacks platform segment 3.

The first filter module 21 is also able to prevent the transmission to the open segment 5 of operational data deemed confidential. The cryptographic protection module 23 is able to receive data from the first filtering module 21.

Furthermore, the cryptographic protection module 23 is able to apply a cryptographic protection to this data, for example an encryption, for transmission to the open segment 5. The cryptographic protection module 23 is able to transmit the protected data to the diode 25.

The diode 25 is capable of ensuring a one-way transmission of the data on the first channel 7 between either the platform segment 3 or one of the modules of the system 1 if it is internal data, and either the open segment 5 or one of the modules of the system 1 if they are internal data. The diode 25 is thus able to authorize exclusively these transmissions, by prohibiting any transmission of data on the first channel 7 in the opposite direction either from the open segment 5 or from one of the modules of the system 1 if they are internal data, to the segment platform 3. The diode 25 is advantageously a physical diode. A physical diode indeed has a high level of security.

The second coupling module 15 couples the exchange system 1 to the open segment 5. In particular, the second coupling module 15 is able to set up and control a protocol for connection and exchange of information with the open segment 5.

Furthermore, the second coupling module 15 is adapted to receive data from the platform segment 3 or internal data via the diode 25, and to transmit these data either to the open segment 5 or to the module 31 (for example: this is internal data). The second coupling module 15 is also adapted to receive data from the open segment 5 intended for either the platform segment 3 or an internal module, and to transmit these data to the second filter module 31. Moreover, when the data is in the form of analog signals, the second coupling module 15 is adapted to convert these analog signals into data streams transmissible through the system 1, according to a predefined protocol, before their transmission to the second filtering module 31.

Furthermore, the second coupling module 15 is able to allow the identification and authentication of the operator of the system 1 (for example via an identifier and a password or via an identification key) and to control the system. access to the platform segment 3 via the system 1, to allow access to the platform segment 3 via the exchange system 1 to an authorized operator. The second coupling module 15 is also able to connect to the open segment 5 following a connection protocol to the predefined open segment. In particular, the second coupling module 15 is able to identify and authenticate the open segment from which the connection is initiated, and to allow the initialization of this connection only if the open segment 5 is actually authorized. In addition, the second coupling module 15 is able to verify that the identities of the operator initiating the connection to the data exchange system 1 and the operator connected to the open segment 5 correspond.

The second coupling module 15 is thus able to prohibit a connection of an operator or of an unauthorized open segment 5 to the data exchange system 1, and to prohibit a connection of an operator initiating a connection to the system 1 if the identity of this operator differs from the identity of the operator connected to the open segment 5.

In addition, the second coupling module 15 is able to check the version and the integrity of the connection driver installed on the open segment 5, and to prohibit a connection of the open segment 5 to the system 1 if a version or a problem exists. integrity of this connection driver is detected. The second filtering module 31 is adapted to receive data transmitted by the second coupling module 15, and to analyze these data to determine if these data are authorized to be transmitted to the platform segment 3 or if they are part of the data. internal rules allowed to circulate within the system 1. In particular, the second filtering module is able to determine the format of the data, this format being contained in the message which contains the data, in order to determine whether these data are authorized to be transmitted to the platform segment 3. The second filtering module 31 transmits only the data that is allowed to be transmitted from the open segment 5 to the platform segment 3 and the internal data allowed to flow.

In addition, the second filtering module 31 is able to verify the integrity of the data. For example, if the data is transmitted in the form of frames including error detection codes, verification of the integrity of the data by the second filter module 31 is performed by checking these error detection codes. The second filtering module 31 is thus able to prevent the transmission to the platform segment 3 of unauthorized or corrupted data. The switch 33 is able to isolate the second filtering module 31 from the coherence control module 37, so that the second filtering module 31 is never directly connected to the coherence control module 37, and thus to be permanently isolated. segments 3 and 5 on the chain 9.

The switch 33 is advantageously a physical switch, capable of physically isolating the second filter module 31 of the coherence control module 37. The switch 33 is able to switch between a storage position and a transmission position. The storage position is capable of isolating the modules of the system 1 from the data transmitted by the open segment as close as possible to their reception by the coupler 15 and of their filtering by the module 31, thus avoiding their propagation in the system 1. It corresponds to the security position of the switch. In the storage position, the switch 33 connects the second filter module 31 to the first buffer module 35, and thus allows the transmission of data from the second filtering module 31 to the first buffer module 35. In this storage position, the module 37 is connected neither to the second filter module 31 nor to the first buffer module 35. In the transmission position, the switch 33 connects the first buffer module 35 to the coherence control module 37, and allows the transmission data stored in the first buffer module 35 to the coherence control module 37. In the transmission position, the second filtering module 31 is connected neither to the first buffer module 35 nor to the coherence control module 37. first buffer module 35 comprises a data storage area adapted to receive data transmitted by the second filter module 31 through the switch 33 lo when the switch 33 is in the storage position, and storing this data. The first buffer module 35 is further adapted to transmit the stored data to the coherence control module 37 through the switch 33 when the switch 33 is in the transmission position.

The first buffer module 35 is able to securely erase any data stored in its data storage area. The coherence control module 37 is adapted to receive data transmitted by the first buffer module 35 when the switch 33 is in the position. of transmission. The coherence control module 37 is furthermore able to verify whether the data are consistent with data expected by the platform segment 3, and to allow the transmission of data to the platform segment 3 if the data are coherent, and to prohibit the transmission of data to platform segment 3 if the data is not consistent. In particular, the coherence control module 37 is able to analyze the data to determine what data it is, then to check that the value of these data belongs to a predetermined set of expected values for these data or that the behavior The dynamics of the value of said data does indeed belong to a predetermined set of expected dynamic behaviors for said data.

In order to determine which data is involved, the coherence control module 37 is able to extract from the message which contains the data the format of this data. From this information, the coherence control module 37 is specific to carry out the value consistency check using the elements available to it, for example tables of values (for example of tables of character strings), areas of possible variation (for example domains of variations of numerical values), and by performing calculations on values successively received from the same data to ensure that the dynamic behavior of the values is indeed consistent with a predetermined set of expected dynamic behaviors for said data, including using data transmitted by the segment platform to system 1 via channels 7 and 9 up to module 37 (eg location, aircraft attitudes or state of the platform segment). In particular, if the data are digital data, the coherence control module 37 is able to carry out a static control of the value of these data, that is to say to control that the value of these data corresponds to a expected value for these data. For example, if the data correspond to coordinates of a ground object, the coherence control module 37 is able to verify that the value of these data corresponds to coordinates that are on the ground. Furthermore, the coherence control module 37 is able to carry out a control of the dynamic behavior of the value of these data, that is to say to control that the evolution of the value of these data corresponds to an evolution. expected for these data. For example, if the data relates to the position of a traffic, the coherence control module 37 is able to verify that the evolution of this position is consistent with an expected evolution. If the data are not numeric, for example if they are strings, the coherence check module 37 is able to verify that the value of these data belongs to a predefined list of values. The coherence control module 37 is also able to identify those of these data to be the subject of an additional validation by an operator (for example the pilot of the aircraft) who will have to control the data himself, if these data are previously identified as requiring such control or if these data have a value previously identified as requiring such control. This data is then transmitted to the operator, for validation, if the operator considers that these data are consistent with the expected data, by pressing a validation command provided for this purpose. The coherence control module 37 thus comprises parameterization means enabling an operator to define which data and / or which data values require such validation, which can for example be carried out via the maintenance module 40. accuracy expected on digital data transmitted by the open segment (eg coordinates of a point of the ground) is more important than the accuracy of consistency check performed by the 37 module, the operator will have to check by another verification channel that these data are well coherent of the expected coordinates, for example by comparing them with the source data before they are loaded into the open segment. The consistency control module 37 thus makes it possible to verify whether the data are consistent with the functional exploitation that will be made by the platform segment 3, in order to limit the risks associated with an error on this value. Such an error may for example result from malice or malfunction of the open segment 5. The coherence control module 37 is able to transmit the data that is authorized to be transmitted to the second buffer module 39. The second buffer module 39 includes a data storage area, adapted to receive data transmitted by the coherence control module 37, to store these data, and to transmit them to the first coupling module 13. Each module of the system 1 is able to save data. information about the events noted by this module in a given period.

As previously described, the first and second chains 7 and 9 form a monodirectional ring for the exchange of data. Thus, any data destined for the open segment 5 necessarily and exclusively passes through the first chain 7, passing successively through the first coupling module 13, the first filtering module 21, the diode 25 (possibly via the cryptographic protection module 23 ), and the second coupling module 15, before being transmitted to the open segment 5. Similarly, any data intended for the platform segment 3 necessarily and exclusively passes through the second channel 9, passing successively through the second module 15, the second filter module 31, the first buffer module 35 via the switch 33, the coherence control module 37 via the switch 33, the second buffer module 39 and the first coupling module 15. The internal data perform the same path and undergo the same processing as the other data until reaching the module for which they are intended. Thus, although a module of the system 1 can not communicate directly with another module of the system 1 which is not directly connected to it, each module of the system 1 is able to communicate with any other module of the system 1, via the modules of the system 1 interposed between these modules, but only in the direction of authorized data flow, the internal data exchanged then being subjected to the processing performed by each module until reaching its destination module Maintenance and parameterization operations on each of the Exchange system 1 modules are made by means of a maintenance module 40 able to connect to the second coupling module 15. This connection is only possible if the operator is authenticated as having an authorized operator role to log in maintenance mode. It is also possible only when no connection exists between the open segment 5 and the system 1, or between the platform segment 3 and the system 1. Finally, when the maintenance mode is operational, any connection of the system 1 with the outside is prohibited, whether with the platform segment 3 or the open segment 5. This maintenance module 40 includes interface means with an operator, allowing this operator to define the security policies of the modules 21 and 37, and access information relating to the operation of the system 1.

This maintenance module 40 is able to verify the proper operation of each of the modules of the system 1 and to perform updates of the software components of these modules. This maintenance module 40 is also able to set the first filtering module 21 and the coherence control module 37 according to the predefined security policies The events related to security or a malfunction are recorded timestamped in a log, for example the connections of the operators to the system 1, whatever their roles, the connections of the open segment 5, the security or operating anomalies. The maintenance module 40 is further adapted to allow an audit of each of the modules, receiving from each module the information relating to the events observed by this module in a given period, and allowing the authorized operator to consult them.

FIG. 3 shows the steps implemented by the system 1 for the exchange of data. In order to facilitate the reading, the data exchange steps described hereinafter are only described in the case of a data exchange between the open segment 5 and the platform segment 3, but the steps are exactly the same. implementation for the exchange of internal data. In a step 100 of system start 1, the switch 33 is switched to its storage position, and the data possibly present in the storage areas of the first and second buffer modules 35 and 39 are erased. Then, in an initialization step 102, a session is established by an operator connecting to the system 1. This initialization step 102 comprises a phase 104 of identification and authentication of the operator, during which the second coupling module 15 carries out identification and authentication of the operator, and authorizes the initialization of the connection only if the operator is actually authorized by his role.

Then, during a phase 106 of connection to the open segment 5, the second coupling module 15 connects to the open segment 5 according to the predefined protocol. During this connection phase 106, the second coupling module 15 connects to the open segment 5 according to the defined protocol, it carries out an identification and an authentication of the open segment 5 and checks in particular the version and integrity of the installed driver. in the open segment 5. In addition, the second coupling module 15 verifies that the identities of the operator connected to the system 1 and the operator connected to the open segment 5 match. If the second coupling module 15 does not detect any anomaly, the second coupling module 15 implements during the phase 106 an exchange protocol with the open segment 5. The open segment 5 is then able to exchange data with the system 1. Moreover, during a phase 108 connection to the platform segment 3, the first coupling module 13 connects to the platform segment 3 according to the predefined protocol, different from the connection protocol between the second module of coupling 15 and the open segment 5, and controls the proper functioning of this protocol. The platform segment 3 is then able to exchange data with the system 1, so that the system then allows the exchange of data between the open segment 5 and the platform segment 3. In particular, the open segment 5 is able to transmit data to the platform segment 3 in a step 110 through the second channel 9, and the platform segment 3 is able to transmit data to the open segment 5 via the first channel 7 according to a step 112. If during one of the phases 104, 106 or 108 a malfunction or security is found by one of the modules, the anomaly is recorded and time stamped in a log. In addition, the module concerned transmits the anomaly information to the other modules of the system 1, in the order imposed by the direction of data flow of the chains 9 and 7, as well as to the operator, so that the measurements provided by the security policy for the anomaly observed are applied, for example that no connection can be established between the open segment 5 and the data exchange system 1 on the one hand, or between the flat segment form 3 and the system 1 of data exchange on the other hand, and that each connection possibly already engaged is then interrupted, that the data of the buffer modules 35 and 39 are erased securely, that the switching module is positioned in storage position, with or without decision and operator intervention.

In particular, if the second coupling module 15 finds that the operator or the open segment is not authorized to initiate a connection, that the identity of the operator initiating the connection differs from the identity of the connected operator in the open segment 5, or there is a version or integrity anomaly of the open segment connection driver 5, the second coupling module 15 prohibits the connection of the open segment 5 to the system 1, records this event, and informs the operator.

The step 110 of data transmission from the open segment 5 to the platform segment 3 includes a phase 114 in which the second coupling module 15 receives the data and transmits them to the second filtering module 33. If these data are in the form of analog signals, the second coupling module 15 converts these analog signals, before their transmission to the second filter module 33, into data streams transmissible through the system 1. Then, during a phase 116, the second filtering module 31 receives the data transmitted by the second coupling module 15, and analyzes these data to determine whether these data are authorized to be transmitted to the platform segment 3.

In particular, the second filtering module 31 identifies and authenticates the data and their source applications, verifies the integrity of the data, and verifies the format of these data. During the phase 116, if the second filtering module 31 finds that at least one piece of data is not expected to be transmitted to the platform segment 3, or is corrupted, the second filtering module 31 prevents transmission of the data. data to the platform segment 3. In the opposite case, the second filtering module 31 transmits the data to the first buffer module 35 via the switch 33. Then, during a phase 118, the first buffer module 35 receives the data transmitted by the second filtering module 31 and stores these data on its storage area. Moreover, during this phase 118, if the security policy so provides, the second filtering module 31 checks the absence of malicious codes on the data stored on the first buffer module 35.

Then, if no malicious code is detected by the second filtering module 31 on the data stored on the first buffer module 35, the second filtering module 31 controls in a phase 120 the switching of the switch 33 in its position of transmission. If during one of the phases 116 or 118, a malfunction or security is found by the second filtering module 31, the anomaly is recorded and timestamped in a log. Furthermore, the second filtering module 31 transmits the anomaly information to the other modules of the system 1 in the order imposed by the direction of data flow of the chains 9 and 7, as well as to the operator, so that the measures provided for by the security policy for the anomaly found are applied.

This is for example an interruption of the data transmission from the open segment 5 by the second filter module 31 itself, and / or a secure erasure of the buffer modules 35 and 39, and / or a positioning of the switching module in the storage position, and / or an interruption by the second coupling module 15 of the connection of the system 1 to the open segment 5, and / or an interruption by the first coupling module 13 of the connection of the system 1 to the platform segment 3, with or without decision and intervention of the operator. During a phase 122 of data control, the coherence control module 37 receives the data stored in the first buffer module 35, via the switch 33 which is in the transmission position. The coherence control module 37 then checks whether the data are consistent with data expected by the platform segment 3. In particular, the coherence control module 37 analyzes the data to determine which data is involved, then checks that the value of these data belongs to a predetermined set of expected values for these data. This predetermined set of values comprises, for example, continuous and / or discrete digital values, and / or a list of strings. In particular, if the data is digital data, the coherence control module 37 performs a static control of the value of these data, by checking that the value of these data corresponds to an expected value for these data. Moreover, the coherence control module 37 performs a control of the dynamic behavior of the value of these data, that is to say that the evolution of the value of these data corresponds to an expected evolution for these data. . If the data are not numeric data, for example if they are strings, the consistency check module 37 verifies that the value of these data belongs to a predefined list of values.

If the coherence check module 37 finds that the data is previously identified as requiring control by an operator, or that the value of the data requires operator control, the coherence check module 37 transmits this data to the operator. operator for control and validation. If the coherence control module 37 or the operator finds that the value of the data belongs to the predetermined set of expected values for these data, the data are considered consistent with the intended functional exploitation for these data. If the data is coherent, possibly after additional validation by the operator, the coherence control module 37 transmits this data to the second buffer module 39. To 21 When the buffer module 35 has transmitted all the data to the coherence control module 37 , the coherence control module 37 controls, via the modules 39 13, 21, 25, 15, 31, the switching of the switch 33 which passes into its storage position, and the secure erasure of the data stored by the first buffer module 35. In the opposite case, or in the event of a malfunction, the anomaly is recorded and time stamped in a log. Furthermore, the module 37 transmits the anomaly information to the other modules of the system 1 in the order imposed by the data flow directions of the chains 9 and 7, as well as to the operator, so that the measures provided for by the security policy for the anomaly found are applied. This is for example an invalidation of the data by the module 37 itself, and / or an interruption of the data transmission from the open segment 5 by the second filtering module 31, and / or secure erasure of the buffer module 35 and 39, and / or a positioning of the switching module in the storage position, and / or an interruption by the second coupling module 15 of the connection of the system 1 to the open segment 5 and / or an interruption by the first coupling module 13 of the connection of the system 1 to the platform segment 3, with or without decision and intervention of the operator. During a phase 124, the second buffer module 39 receives the data transmitted by the coherence control module 37, and stores these data on its storage area. Then, the second buffer module 39 transmits during a phase 126 the data to the platform segment 3 via the coupling module 13. The step 112 of data transmission from the platform segment 3 to the open segment 5 comprises a phase 130 in which the first coupling module 13 receives the data and transmits them to the first filter module 31. If these data are in the form of analog signals, the first coupling module 13 converts these analog signals, before their transmission to the first filter module 31 in data streams transmissible through the system 1.

During a filtering phase 132, the first filtering module 21 receives the data from the first coupling module 13, and analyzes this data to determine whether this data is authorized to be transmitted to the open segment 5. The first filtering module 21 also determines whether the data authorized to be transmitted to the open segment 5, must be protected before this transmission.

If the first filtering module 21 judges that the data are authorized to be transmitted to the open segment 5 without the need to apply cryptographic protection to them, the first filtering module 21 transmits these data via the diode 25, to the second module 15. If the first filter module 21 judges that the data is authorized to be transmitted to the open segment 5 but that it is sensitive data, ie requiring cryptographic protection, the first filtering module 21 transmits this data. to the cryptographic protection module 23. If on the contrary the first filtering module 21 judges that the data are not authorized to be transmitted to the open segment 5, it blocks their transmission, records this event, and informs the operator.

During a protection phase 134, the cryptographic protection module 23 receives the sensitive data transmitted by the first filter module 21, and applies to these data a cryptographic protection, for example an encryption. Then the cryptographic protection module 23 transmits the protected data, via the diode 25, to the second coupling module 15.

During a phase 136, the second coupling module 15 receives the data from the platform segment 3 to the open segment 5, transmitted by the diode 25, and transmits this data to the open segment 5. The exchange system 1 of the invention thus allows a bidirectional exchange of information between the platform segment 3 and the open segment 5, while preserving the platform segment 3 in terms of integrity and availability of the functions it ensures, and in terms of the level of confidentiality of the information it hosts. In particular, the systematic control of the coherence of the data by the coherence control module 37 makes it possible to prevent the transmission to the platform segment 3 of data whose value is erroneous, and thus to significantly reduce the risk associated with the potential exploitation. of this data by the platform segment 3. Furthermore, the filtering by the first filter module 21 of the data makes it possible to preserve the confidentiality of the data of the platform segment 3, by preventing the transmission to the open segment 5 of confidential data. and protecting the sensitive data prior to their transmission to the open segment 5. In addition, the ring topology of the system 1 according to the invention makes it possible to ensure that all the data passes through the security mechanisms provided for, in the good order, in each direction of circulation. This topology also makes it possible to prevent the data from circulating on parallel paths between the platform segment 3 and the open segment 5, which are not secured, and to get away from any centralized module potentially a source of vulnerabilities. Indeed, each module can communicate with any other module of the system 1 without the need to use a centralized module. The positioning of the switch 33, between the module 15 coupling the system 1 with the open segment 5 and the data coherence control module 37, makes it possible to protect the coherence control module 37. Indeed, the switch 33 isolates and the coherence control module 37 of the open segment 5, and the data from the open segment 5 are transmitted to the coherence check module 37 after verification of their integrity. It should be noted that the diode 25 on the one hand and the switch 33 on the other hand together provide permanent isolation of the platform segment 3 vis-à-vis the data transmitted by the open segment 5. It must however be understood that the embodiments described above are not limiting. Thus, FIG. 3 illustrates a data exchange system 200 according to a second embodiment. The system 200 is cut-off between a platform segment 203 and two distinct open segments 205 and 205 ', and provides secure data exchange between the platform segment 203 and each of the open segments 205, 205'. The system 200 comprises two identical subsystems 201 and 201 ', similar to the system 1 described with reference to FIG. 1, and arranged in parallel. Each of the subsystems 201, 201 'provides secure data exchange between the platform segment 203 and an open segment 205 or 205'. The subsystems 201 and 201 'comprise a first coupling module 213 common to these two subsystems 201 and 201'.

Of course, the system according to the invention may comprise a larger number of subsystems, depending on the number of distinct open segments that one wishes to connect to the system. FIG. 4 also illustrates a data exchange system 300 according to a third embodiment.

The system 300 is cut-off between a platform segment 303, an outer open segment 305 and an inner open segment 305 '. The internal open segment 305 'is for example a segment using hardware and software constituents of industrial or even general public range, and therefore not subject to the same security constraints as the platform segment 303, and intended for the industrial development of the platform segment. 303 for example to allow the development of features already developed and integrated on hardware components and software of industrial range or even general public, by the industrialist responsible for the development and integration of the platform segment, and thus to improve the development efficiency, while controlling the process of development and industrialization.

The system 300 comprises a first subsystem 301 ensuring a secure exchange of data between the platform segment 303 and the external open segment 305. The first subsystem 301 is for example similar to the system 1 described with reference to FIG. The system 300 includes a second subsystem 301 'providing secure data exchange between the platform segment 303 and the inner open segment 305'. The second subsystem 301 'differs from the system 1 described with reference to FIG. 1 in that its first branch 307', ensuring the transmission of data in the direction of the platform segment 303 to the internal open segment 305 ', does not include no cryptographic protection module.

Thus, all the data transmitted from the platform segment 303 to the internal open segment 305 'are transmitted in clear. Furthermore, the subsystems 301 and 301 'comprise a first coupling module 313 common to these two subsystems 301 and 301'.

Claims (15)

CLAIMS1.- System (1) for exchanging data between a first secure network (3) and a second network (5) of a lower security level than the first secure network (3) or a security level unknown, said system comprising: a first channel (7) for transmitting data from said first secure network (3) to said second network (5), and a second channel (9) for transmitting data from said second network (5). ) to said first secure network (3), said second channel (9) comprising means for filtering (31, 37) data transmitted from said second network (5) to said first secure network (3), said system ( 1) being characterized in that said filtering means (31, 37) comprise a coherence control module (37), able to verify if said data are coherent with data expected by said first network. curise (3), and allowing transmission of said data to said first secure network (3) if said data are consistent and to prohibit the transmission of said data to said first secure network (3) if said data are not consistent. 2. System (1) according to claim 1, characterized in that the coherence control module (37) is able to identify the data to be subject to additional validation by an operator to be considered as consistent, transmitting said data to the operator for validation, and authorizing the transmission of said data to said first secure network (3) if said data are validated by the operator and prohibiting the transmission of said data to said first secure network (3) if said data are not validated by the operator. 3.- System (1) according to any one of claims 1 or 2, characterized in that said coherence control module (37) is adapted to verify if the value of said data belongs to a predetermined set of expected values for said data and / or if the dynamic behavior of the value of said data belongs to a predetermined set of expected dynamic behaviors for said data. 4. System (1) according to any one of claims 1 to 3, characterized in that said first (7) and second (9) chains form a monodirectional ring for the exchange of data between said first secure network (3). ) and said second network (5) and for the exchange of internal data. 5. System (1) according to claim 4, characterized in that said coherence control module (37) is interposed on said second chain (9) between said first secure network (3) and said second network (5). ), so that any data transmitted from said second network (5) to said first secure network (3) passes through said coherence control module (37). 6. System (1) according to any one of claims 1 to 5, characterized in that said filtering means (31, 37) comprise a data filtering module (31), able to analyze said data to determine if said data is authorized to be transmitted to said first secure network (3), to transmit said data to said first secure network (3) if said data are authorized to be transmitted to said first secure network (3) and to prohibit the transmission of said data to said first secure network (3) if said data are not allowed to be transmitted to the first secure network audit (3). 7. System (1) according to claims 5 and 6, characterized in that said data filtering module (31) is interposed on said second chain (9) between said second network (5) and said coherence control module (37), and in that said second chain (9) comprises a switch (33) adapted to prohibit the transmission of said data from said data filtering module (31) to said coherence control module (37) as long as said data have not been judged by said data filtering module (31) as allowed to be transmitted to said first secure network (3). 8. System according to any one of claims 1 to 7, characterized in that it comprises means for identification and authentication (15) of said second network (5) and an operator operating from said second network (5), said identification and authentication means (15) being able to prohibit any exchange of data between said exchange system (1) and said second network (5) if said operator and / or said second network ( 5) are judged by said identification and authentication means (15) as not allowed to exchange data with said first secure network (3). 9. System (1) according to any one of claims 1 to 8, characterized in that said first chain (7) comprises means (21, 23) for protecting data transmitted from said first secure network (3) to destination of said second network (5). 10.- System (1) according to claim 9, characterized in that said means (21, 23) of protection comprise a data filtering module (21), able to analyze said data to determine if said data are authorized to betransmises to said second network (5), and to allow transmission of said data to said second network (5) if said data is allowed and to prohibit the transmission of said data to said second network (5) if said data is not allowed. 11. System (1) according to any one of claims 9 or 10, characterized in that said means (21, 23) for protection comprise a cryptographic protection module (23), able to apply cryptographic protection to data transmitted from said first secure network (3) to said second network (5). 12. System (1) according to claims 10 and 11, characterized in that said data filtering module (21) is able to analyze the authorized data to determine, according to said second predetermined security policy, if said data must be protected before being transmitted to said second network (5), and to direct said data to said cryptographic protection module (23) only if said data must be protected before being transmitted to said second network (5). 13.- System (1) according to any one of claims 1 to 12, characterized in that said first secure network (3) is a platform segment of an aircraft, and in that said second network (5) is an open segment of said aircraft. 14. Aircraft comprising a platform segment (3) and an open segment (5), characterized in that it comprises a data exchange system (1) according to claim 13 embedded in said aircraft for the exchange any data between said platform segment (3) and said open segment (5). 15. A method for exchanging data between a first secure network (3) and a second network (5) of a lower security level than the first secure network or an unknown security level, characterized in that it comprises the following steps: - supply of a system (1) according to any one of claims 1 to 13, - during a transmission of data from said second network (5) to said first secure network through said second data transmission chain, a filtering of said data, said filtering comprising a control phase (122) for coherence of said data, in which said coherence module (37) checks whether said data are consistent with data expected by said first secure network (3), and authorizes the transmission of said data to said first secure network (3) if said data are coherent or prohibits the transmission of said data v said first secure network (3) if said data are not coherent.