• 专利附录
  • 专利说明
  • 权利要求
  • 类似技术
  • 同族专利
  • 引用文献
  • 法律状态
  • 优先权
    • 专利摘要:
    This architecture (10) for transmitting critical data in avionic systems between production means (12) and data consumption means (14) interconnected by a physical path (16), each critical data being transmitted by means of least two data, one of a first type and the other of a second independent type, which must not interfere, each data of the first type or the second type being transmitted in the form of a transmission unit (30). data comprising a portion of an application message and a message, is characterized: - in that the additional message of each transmission unit (30) comprises a control sequence; and in that each data item of the first type and the second type is transmitted by the same physical path (16), and is generated by dissimilar generation means (42; 43).
    公开号:FR3014622A1
    申请号:FR1302884
    申请日:2013-12-10
    公开日:2015-06-12
    发明作者:Patrice Georges Paul Toillon；David Jose Faura；Vincent Christophe Cedric Sollier；Champeaux Paul Marie Boivin
    申请人:Thales SA；
    IPC主号:
    专利说明:

    [0001] The present invention relates to an architecture for transmitting critical data in avionic systems. More particularly, the invention relates to such an architecture for transmitting critical data in avionic systems between production means and data consumption means connected to each other by at least one physical path implemented by intermediate equipment. communication, each critical data being transmitted by at least two data, one of a first type and the other of a second independent type, which must not interfere with each other and which also make it possible to check the integrity of this critical data item . Each data item of the first type or of the second type being transmitted in the form of a data transmission unit comprising: at least one portion of an application message; and an additional message containing identification and control information associated with this application message. Different architectures for critical data transmission in avionics systems exist in the state of the art. In general, these transmission architectures are based on the ARINC 664 aeronautical standard.
    [0002] These architectures as well as the corresponding transmission systems rely on intermediate equipment (in English "Intermediate System" or "IS") communication type switches and on end interfaces (in English "End System" or "ES"). Located in each of the subscriber equipment. All such intermediate equipment forms a physical path of critical data transmission in avionics systems. There are also critical avionics data that must be absolutely intact relative to each other. The transmission of such critical data can not be performed via the same physical paths. For example, critical avionics data associated with "Catastrophic" or "Hazardous" type systems are generally issued as control data and one or more surveillance type data. Upon receipt of such data, the integrity of the initial critical data can be controlled by comparing the or each monitoring type data with the control type data.
    [0003] The control type data and the or each surveillance type data must thus be independent of each other in order to minimize the risks of similar disturbances. In particular, similar disturbances could cause the same types of errors in all surveillance and control type data which would make it impossible to detect transmission errors. To date, the answer to this problem is to use separate physical transmission paths and separate transmission resources. This means, for example, that the data of different types (control, monitoring) must not cross the same switches or the same cables or physical ports connecting different nodes of an avionics communication computer network for example. But this complexity is no longer compatible in particular with objectives of weight reduction, overall cost reduction of modern avionics systems, etc. Moreover, this complexity makes it difficult to analyze such systems insofar as each use of a physical path by critical data must be associated with the analysis of its exclusion with respect to other critical data. The purpose of the present invention is to propose a system for transmitting avionic application data frames that can detect the non-integrity of an application message at a level compatible with aeronautical requirements and disregarding the type of transmission means of the computer network. avionics. To this end, the subject of the invention is an architecture for transmitting critical data in avionic systems, of the aforementioned type and in which: the additional message of each transmission unit comprises a control sequence intended to control the integrity of the application message; and each datum of the first type and the second type corresponding to this critical datum is transmitted by the same physical path implemented by the same intermediate communication equipment, and is generated by different and dissimilar generation means. According to particular embodiments of the invention, the critical data transmission architecture comprises one or more of the following characteristics: the dissimilarity of the generation means consists of physical locations, and / or identifications of source partitions and / or message identifications, and / or communication logical channel identifications, and / or identifications of the means of production, and / or identifications of the recipient or group of recipients, and / or types of network or separate protocol, and / or physical media types of these generation means; the dissimilarity of the generation means furthermore consists of different and / or complementary predetermined production laws of at least a part of the corresponding data; - the rule of selection of the production law depends on the sources and / or criteria of dissimilarities and criteria of parameterization of this rule of selection, the criteria of parameterization of the law of selection consisting of: + a level of criticality of the transmitter equipment and / or source partition; + a security level of the sending equipment and / or the source partition; + quality criteria assigned to one message over another; each transmission unit further comprises an identification sequence comprising a static part making it possible to identify the application message corresponding to this transmission unit and a variable part making it possible to distinguish the message in a unique and certain manner; the control sequence corresponding to said transmission unit is based on a main sequence representing a cyclic redundancy check code of the concatenation of at least a portion of the application message corresponding to said transmission unit, with the identification sequence ; the control sequence and the identification sequence corresponding to the same transmission unit are distinct; the control sequence is the result of the application of the XOR operator between: + a sequence resulting from an encoding of at least part of the identification sequence with a key represented by a field of the variable part the identification sequence; and + the main sequence; the control sequence is the result of the application of the XOR operator between: + a sequence resulting from an encoding of at least a part of the identification sequence with a key represented by a variable sequence in time and known by the means of production and consumption at every moment; and + the main sequence; the control sequence is the result of the application of the XOR operator between: + a sequence resulting from an encoding of at least a part of the identification sequence with a first key represented by a coding of a field of the variable part of the identification sequence with a second key represented by a sequence known by the means of production and consumption; and + the main sequence; the control sequence is the result of the application of the XOR operator between: + a sequence resulting from an encoding of at least a part of the identification sequence with a first key represented by the result of the application of the XOR operator between: a field of the variable part of the identification sequence; and a sequence known by the means of production and consumption; and + the main sequence; the control sequence is the result of the application of the XOR operator between: + a sequence resulting from an encoding of at least a part of the identification sequence and at least a portion of the application message with a key represented by a field of the variable part of the identification sequence; and + the main sequence; the control sequence is the result of the application of the XOR operator between: + a sequence resulting from an encoding of at least a part of the identification sequence and at least a portion of the application message with a key represented by a variable sequence in time and known by the means of production and consumption at each moment; and + the main sequence; the control sequence is the result of the application of the XOR operator between: + a sequence resulting from an encoding of at least a part of the identification sequence and at least a portion of the application message with a first key represented by a coding of a field of the variable part of the identification sequence with a second key represented by a sequence known by the means of production and consumption; and + the main sequence; the control sequence is the result of the application of the XOR operator between: + a sequence resulting from an encoding of at least a part of the identification sequence and at least a portion of the application message with a first key represented by the result of the application of the XOR operator between: a field of the variable part of the identification sequence; and a sequence known by the means of production and consumption; and + the main sequence; - The or each key is known only by the means of production and consumption to further ensure the confidentiality of messages; for an application message formed of a plurality of ordered portions, the control sequence of the transmission unit associated with the first portion is the result of the application of the XOR operator between: + a sequence resulting from a coding a sequence represented by the result of the application of the XOR operator between: at least a part of the identification sequence corresponding to this portion; and - a predetermined initial value; and + the main sequence corresponding to this portion; and the control sequence of the transmission unit associated with each subsequent portion is the result of the application of the XOR operator between: + an auxiliary sequence resulting from a coding of a sequence represented by the result of the applying the XOR operator between: at least part of the identification sequence corresponding to this portion; and an auxiliary sequence corresponding to the preceding portion; and + the main sequence corresponding to this portion; for an application message formed of a plurality of ordered portions, the control sequence of the transmission unit associated with the first portion is the result of the application of the XOR operator between: + a sequence resulting from a encoding a sequence represented by the result of the application of the XOR operator between: - at least a part of the identification sequence and at least a portion of the application message; and - a predetermined initial value; and + the main sequence corresponding to this portion; and the control sequence of the transmission unit associated with each subsequent portion is the result of the application of the XOR operator between: + an auxiliary sequence resulting from a coding of a sequence represented by the result of the applying the XOR operator between: at least part of the identification sequence and at least a portion of the application message; and an auxiliary sequence corresponding to the preceding portion; and + the main sequence corresponding to this portion; - The control sequence is distributed in the identification sequence according to a distribution law known by the means of production and consumption; - the law of distribution is constant in time; - the distribution law is variable in time; - the law is known only by means of production and consumption to further ensure the confidentiality of messages; the identification sequence comprises information selected from the group further comprising: + identification information of the means of production of the corresponding application message, + identification information of the corresponding application message, + order information; elaboration of the corresponding application message, + production sequence number information of the corresponding application message, + date of development of the corresponding application message; the additional message is associated with the application message in whole or portion thereof per portion.
    [0004] The invention will be better understood on reading the description which follows, given solely by way of example and with reference to the appended drawings, in which: FIG. 1 is a schematic view illustrating a data transmission architecture; critical avionics according to the invention; FIG. 2 is a schematic view illustrating a transmission unit to be transmitted by the architecture of FIG. 1; FIG. 3 is a diagram illustrating a division of an application message to be transmitted by the architecture of FIG. 1 into a plurality of portions; FIG. 4 is a schematic view of an additional message without distribution forming part of the transmission unit of FIG. 2; FIG. 5 is a flowchart illustrating a fifth embodiment of the invention; and FIG. 6 is a schematic view of an additional message with a distribution forming part of the transmission unit of FIG. 2. FIG. 1 shows an example of a critical data transmission architecture. designated by the general reference 10 in this figure 1. This transmission architecture 10 can be used in avionics systems.
    [0005] Such a transmission architecture 10 comprises, for example, critical avionics data generating means and means for consuming these critical avionics data, designated respectively by the general references 12 and 14 in this FIG. 1. The production means 12 are represented by any means capable of producing critical avionics data for the consumption means 14. Such a means comprises, for example, equipment, part of equipment, sensor, partition, application, software and / or hardware. Similarly, the consumption means 14 are represented by any means capable of consuming critical avionics data transmitted by the production means. Such means includes, for example, equipment, part of equipment, actuator, partition, application, software and / or hardware. The production means 12 and consumption 14 are for example embedded on board an aircraft. The production and consumption means are interconnected by an avionic communication computer network designated by the general reference 16 in FIG.
    [0006] This network 16 comprises a plurality of hardware resources, such as cables physically connecting the means of production and consumption between them and for example switches ensuring the transfer between these means, digital data.
    [0007] This network 16 also comprises a plurality of intangible resources ensuring such transfer to the software level. These resources include, for example, processing resources, storage resources or communication resources. The network 16 also comprises, for example, intermediate devices designated by the general references 22 and 24 in FIG. 1 which can be connected by a set of means forming a sub-network designated by the reference 25 in this FIG. 1 and thus constituting a physical path transmission circuit between the production means 12 and the data consumption means 14. The computer network 16 conforms, for example, to the communication standard ARINC 664. The architecture of the network 16 is able to support, for example, the concept of integrated modular avionics (IMA for "Integrated Modular Avionics"). The production means 12 are capable of transmitting critical data to the consumption means 14 by using the same physical path or network 16. The critical avionics data comprise, for example, instructions for piloting the aircraft. Depending on their specific tasks, these instructions may be redundant and / or meet a certain level of robustness. Alternatively, the critical avionics data are data associated with "Catastrophic" or "Hazardous" production and / or consumption means. Each critical data is transmitted by at least two data, one of a first type and the other of a second type, independent. Thus, for example, a datum of the first type is a datum of the DC control type, and a datum of the second type is a datum of DS surveillance type making it possible to check the integrity of the datum of the DC control type. As a variant, each critical avionics data is transmitted by data of the DC control type and several data of the DS surveillance type. More generally, the invention can be applied to all types of data streams that should not interfere with each other.
    [0008] For its part, each piece of data of the DC or DS type monitoring type or more generally each type of data stream, is transmitted in the form of a data transmission unit via the computer network 16. An example of such transmission unit is shown schematically in Figure 2 where this transmission unit is designated by the general reference 30. The transmission unit 30 includes an application message M representing a DC control type data or DS monitoring type data. In addition, the transmission unit 30 comprises an additional message MA comprising, for example, identification and control information associated with the application message M. As a variant, the transmission unit is formed by a portion P of the application message M and an additional message MA associated with this portion. Thus, the message M is divided into a plurality of portions P and each portion P is transmitted via the network 16 by a transmission unit.
    [0009] Each portion P therefore represents a portion of a data of the DC control type or of a data of the DS monitoring type. Thus, the term "data transmission unit" used in the present description means the association of an application message M or a portion P of this application message M, and an additional message MA in the direction defined herein. -above.
    [0010] FIG. 3 shows a message M divided into four portions P1, P2, P3 and P4. These portions are transmitted via the network 16 by independent transmission units designated respectively by general references 31, 32, 33 and 34 in this FIG. 3. Each transmission unit 31, 32, 33 and 34 is formed by a portion P1, P2, P3 and P4 corresponding and an additional message MA ,, MA2, MA3 and MA4 comprising for example identification and control information associated with this portion. Such a division makes it possible to optimize the coverage of the integrity mechanism by adapting the length of the portion to the intrinsic performance of the control used of the network 16.
    [0011] This division also makes it possible to optimize the operation of the network 16 by adapting the length of the portion to the processing speed of this portion by the production means 12 and by the consumption means 14. The production means 12 comprise means generation of transmission units corresponding to the data of the DC control type and means of generation of transmission units corresponding to the data of the DS surveillance type.
    [0012] These means are designated respectively by the general references 42 and 43 in FIG. 1. Thus, the generation means 42 or 43 are able to receive critical avionics data from the production means 12.
    [0013] For each critical avionics data item, the means 42 are capable of generating a DC control type data item corresponding to this critical avionic data item and the means 43 are capable of generating a DS surveillance data item corresponding to this critical avionic data item or to this data item. type DC control and more generally to all types of data streams that should not interfere respectively.
    [0014] The means 42 and 43 are furthermore capable of forming a transmission unit 30 for each application message M representing a DC control type data item or a DS monitoring data item, by adding an additional message MA associated with this application message M. The means 42 and 43 are also able to generate a transmission unit 30 for each portion P associated with an application message M. Finally, the means 42 and 43 are able to transmit the transmission units 30 generated in the network 16. The generation means 42 and the generation means 43 are distinct. In particular, these generation means 42 and 43 have, for example, at distinct physical locations. As a variant or in addition, the generation means 42 and 43 use different and / or complementary predetermined production laws of at least part of the corresponding data. These different and / or complementary predetermined production laws are detailed later in the description.
    [0015] Alternatively or additionally, the generation means 42 and 43 are differentiated into other sources and / or criteria. For example we can mention: the identification of the partition or source application; the identification of the message; the identification of the logical communication channel; the identification of the means of production (processor host, processor element); identification of the recipient or group of recipients; the type of network or protocol; the type of physical medium.
    [0016] These sources and / or criteria which differentiate the generation means 42 and 43 imply the dissimilarity of these means. In addition, the rule of selection of the production law (among the predetermined encoding laws of the transmission unit) within the generation means 42 and 43 depends on the sources and / or criteria of dissimilarity as well as the criteria for setting of this selection rule. The criteria for setting the selection law consist, for example, of: the criticality level of the transmitting equipment and / or the source partition; - the security level of the sending equipment and / or the source partition; - and more generally the quality criteria assigned to one message compared to another. Likewise, the consumption means comprise transmission unit reading means corresponding to the DC control type data and the transmission unit reading means corresponding to the DS surveillance type data.
    [0017] These means are designated respectively by the general references 44 and 45 in Figure 1. The reading means 44 and 45 are distinct and dissimilar in the sense of the term defined above. Thus, the reading means 44 are able to receive transmission units 30 corresponding to the data of the DC control type and the reading means 45 are able to receive transmission units 30 corresponding to the monitoring data DS. The means 44 and 45 are furthermore able to extract from each received transmission unit, the application message M or the portion P of the application message M corresponding to this transmission unit.
    [0018] Such a message M then represents a datum of the DC control type or a datum of the DS surveillance type. Likewise, such a portion P represents a portion of a data of the DC control type or of a data of the DS monitoring type. The means 44 and 45 are also able to read the additional message MA 30 corresponding to each portion P or to each received message M (e). This additional message MA allows the reading means 44 and 45 to verify the integrity of the message M received or the portion P received. The reading means 44 and 45 are also able to reconstitute an application message M from the portions P received from this message. Consequently, these means are able to reconstitute each data of the DC control or DS monitoring type from the portions received from these data.
    [0019] Finally, the reading means 44 and 45 are able to transmit each data of the DC control type and the DS type data corresponding to this data of the DC control type to verification means designated by the general reference 46 in FIG.
    [0020] These verification means 46 are able to analyze the DC control type data and the DS type data corresponding to this DC type control data to form the corresponding critical avionics data. In the remainder of this description, an application message M and a portion P of an application message M will no longer be distinguished. The term "application message M" will mean an application message M or a portion P of an application message M in the meaning defined above. FIG. 4 schematically illustrates an example of a structure of an additional message MA without a distribution associated with an application message M. Such a message M represents a datum of the DC control type or a datum of the DS surveillance type.
    [0021] The additional message MA is able to be formed by the generation means 42 or 43 and to be read by the reading means 44 or 45 of FIG. 1. Thus, according to FIG. 4, the additional message MA comprises a sequence of MDA identification. This identification sequence MDA is formed by a static part ID making it possible to identify the application message M and its source in the network and a variable part VAR making it possible to distinguish the application message M in a unique and certain manner and in particular to distinguish two occurrences of the same message. For example, the static part ID has a first field and a second field.
    [0022] The first field is for example 6 bits in size and is formed for example by an identifier of the producer of the application message M. This identifier uniquely identifies the production means 12 having sent this message M in the network 16. It corresponds by example to the source identifier (in English "Partition Id Source") in the case of ARINC 653 type IMA architecture. Alternatively, this identifier corresponds to the sensor number associated with the means of production 12. As a variant again, this identifier corresponds to the position of the production means 12. The second field is for example 10 bits in size and is formed for example by an identifier of the application message M in the network 16.
    [0023] The variable portion VAR of the MDA sequence comprises for example an MSN field and a MPT field. The MSN field is for example 16 bits in size and is formed by a number corresponding to the order of development of the application message M.
    [0024] As a variant, the MSN field could also associate the order of elaboration of the application message M with the order of elaboration of the portion P for the same message order. The MPT field is, for example, 32 bits in size and comprises, for example, the date (instant) of elaboration of the application message M.
    [0025] The additional message MA further comprises an MCS control sequence intended to control the integrity of the application message M and is based on a main sequence SP. The main sequence SP is represented for example by a cyclic redundancy check code CRC of the concatenation of the application message M with the identification sequence MDA, that is to say: SP = CRC (MDA) where the symbol 0 denotes the concatenation operator. The cyclic redundancy check code CRC is obtained for example using one or more generating polynomials.
    [0026] These generating polynomials are, for example, complementary for a message M representing a datum of the DC control type and for a message M representing a datum of the surveillance type DS corresponding to this datum of the DC control type. According to a first embodiment of the invention, the control sequence is the result of the application of the XOR operator between an auxiliary sequence and the main sequence SP. In this embodiment, the auxiliary sequence is a sequence resulting from encoding at least a portion of the MDA identification sequence with a key represented by the MPT field of the MDA identification sequence. Said part of the identification sequence MDA is represented for example by all or part of the static part ID and all or part of the MSN field. Such coding is performed for example with a Hash law (or other cryptographic primitives) with a key represented by the MPT field. Thus, the key is different from one application message M to another and is variable temporally for the same producer.
    [0027] For a message M representing a datum of the DC control type and for a message M representing a datum of the surveillance type DS corresponding to this datum of the DC control type, the Hash laws used are different or complementary. Thus, the MCS control sequence can be determined using the following relation: MCS = XORLEKeyA (MSN ID); SPi where E KeyA designates the cryptographic primitive used (like the Hash law for example) and KeyA designates the key represented by the MPT field. As a variant, the coding is applied to the static part ID, to the MSN field and to the application message M. This then gives the following relation: MCS = XOR [EKeyA (ID 0 MSN 0 M); SPI. According to a second embodiment of the invention, the control sequence is the result of the application of the XOR operator between an auxiliary sequence and the main sequence SP. In this embodiment, the auxiliary sequence is a sequence resulting from encoding at least part of the MDA identification sequence with a key represented by a time-varying sequence. This sequence is known by the means of production and consumption at every moment. Said part of the identification sequence MDA is represented for example by all or part of the static part ID and all or part of the MSN field. Such coding is performed for example with a Hash law with a cyclic change key. For a message M representing a datum of the DC control type and for a message M representing a datum of the surveillance type DS corresponding to this datum of the DC control type, the Hash laws used are different or complementary. The cyclic change notably enables the production and consumption means to know the key without having communicated it explicitly via the network 16. Thus, the MCS control sequence can be determined using the following relation: MCS = XOR [EKeyA (,) (MSN ID); SPi where KeyA (t) denotes the cyclic key and variable in time.
    [0028] In a variant, the coding is applied to the static part ID, the MSN field and the application message M. This gives the following relation: MCS = XOR [EKeyA (t) (ID o MSN o M); SPI. According to a third embodiment of the invention, the control sequence is the result of the application of the XOR operator between an auxiliary sequence and the main sequence SP. In this embodiment, the auxiliary sequence is a sequence resulting from encoding at least a portion of the MDA identification sequence with a first key.
    [0029] Such coding is performed for example with a Hash law. For a message M representing a datum of the DC control type and for a message M representing a datum of the surveillance type DS corresponding to this datum of the DC control type, the Hash laws used are different or complementary.
    [0030] Said part of the identification sequence MDA is represented for example by all or part of the static part ID and all or part of the MSN field. The first key is represented by encoding the MPT field of the MDA identification sequence with a second key. Such coding is performed for example by an encoding function with a different key from one message to another and variable temporally. The second key represented by a sequence known by the means of production and consumption. This second key is known only by the means of consumption and production concerned and is stored in their respective configuration table.
    [0031] This means in particular that the key is not able to be known externally which makes it possible to ensure the authenticity of the transmitted data. Thus, the MCS control sequence can be determined using the following relation: MCS = XOR [EKeyA (MSN ID); SPI where KeyA designates the first key defined by the relation: KeyA = F KeyB (MPT) where F designates the coding function and KeyB the second key. As a variant, the first coding is applied to the static part ID, to the MSN field and to the application message M. This gives the following relation: MCS = XORIEKeyA (ID o MSN or M); SPi. According to a fourth embodiment of the invention, the control sequence is the result of the application of the XOR operator between an auxiliary sequence and the main sequence SP.
    [0032] In this embodiment, the auxiliary sequence is a sequence resulting from encoding at least a portion of the MDA identification sequence with a first key. Such coding is performed for example with a Hash law. For a message M representing a datum of the DC control type and for a message M representing a datum of the surveillance type DS corresponding to this datum of the DC control type, the Hash laws used are different or complementary. Said part of the identification sequence MDA is represented for example by the static part ID and by the field MSN.
    [0033] The first key is represented by the result of the application of the XOR operator between the MPT field of the identification sequence MDA and a sequence known by the production and consumption means. This sequence is known only by the means of consumption and production concerned and is stored in their respective configuration table.
    [0034] This means in particular that the key is not able to be known externally which makes it possible to ensure the authenticity of the transmitted data. The first key is different from one application message M to the other and is variable temporally. Thus, the MCS control sequence can be determined using the following relation: MCS = XORLE'KeyA (ID 0 MSN); SP] where KeyA denotes the first key defined by the relation: KeyA = XOR [KeyB; MPT] where KeyB denotes the sequence known by the means of production and consumption. As a variant, the first coding is applied to the static part ID, to the MSN field and to the application message M. This gives the following relation: MCS = XORLEKeyA (ID o MSN o M); SPI. In the four embodiments described above, when an application message M refers to a portion P of an application message M, that is to say when the application message M is divided into a plurality of portions P , the creation of the MCS part of the additional message MA associated with a portion P is independent of the other portions P of the same application message. Thus, in the four embodiments described above, the method for checking the integrity of an application message M is said to be "without chaining". In the following, we denote Seq the input sequence of the cryptographic primitive EKeyA, represented for example by the law of Hash, according to one of the four preceding embodiments. According to a fifth embodiment, the input sequence of the cryptographic primitive E KeyA of the first portion P of an application message M is the result of the application of the operator XOR between the sequence Seq, corresponding to the first portion P and an initial value IV (of the "Initial Value") predetermined, that is to say: MCS, = XOR [EKeyA (X0R [Seq,; / V]); SP].
    [0035] The input sequence of the coding of the following portions P of the same application message M is the result of the application of the XOR operator between the sequence Seq, and an auxiliary sequence calculated for the preceding portion: MCSt = XORIEKeyA (X0R [Seq, b, spj, where i denotes the number of the portion P in the application message M, denotes the auxiliary sequence calculated for the portion P having the number i -1, that is: SA; E KeyA (X0R [Seq,; 4_11) and SA, = KeyA E (XOR [Seq,; / V b Thus, this embodiment is recursive and is said "with chaining".
    [0036] This embodiment is furthermore explained by the flowchart of FIG. 5. In this FIG. 5, an application message M is divided into three portions designated by the general references P1, P2 and P3. Each portion of this message is able to be transmitted by a transmission unit. Thus, as illustrated in this FIG. 5, the MCS control sequence, corresponding to the first portion P1, is obtained from the above formulas using a first auxiliary sequence SA ,. This first auxiliary sequence SA1 is moreover obtained by using the corresponding sequence Seq and the initial value IV. The MCS2 control sequence corresponding to the second portion P2 is obtained from the above formulas using a second auxiliary sequence SA2. This second auxiliary sequence SA2 is moreover obtained by using the corresponding Seq sequence and the first auxiliary sequence SA ,. The control sequence MCS3 corresponding to the third portion P3 is obtained analogously.
    [0037] In the five embodiments described above, the MDA and MCS sequences are distinct as shown in FIG. 4. Thus, in these embodiments, the additional message MA is said to be "without distribution". According to a sixth embodiment, the MCS control sequence is distributed in the MDA identification sequence according to a distribution law.
    [0038] Thus, in this embodiment, the additional message MA is called "with distribution". FIG. 6 schematically illustrates an example of a structure of an additional message MA with distribution associated with an application message M. This distribution law is known by the means of production and consumption. For example, it defines the same fixed positions of the portions of the MCS sequence in the MDA sequence for all the M application messages. In a variant, this law defines, for example, variable positions of the portions of the MCS sequence in the MDA sequence for different messages. M based application for example the occurrence of an application message M on the other. In the latter case, the distribution law is therefore variable in time. For a message M representing a datum of the DC control type and for a message M representing a datum of the surveillance type DS corresponding to this datum of the DC control type, the distribution laws used are different or complementary. The generation means 42 and 43 make it possible to form an additional message MA comprising the MCS control sequence distributed in the identification sequence MDA according to this law. Similarly, the reading means 44 and 45 are able to extract the MCS control sequence from the MDA identification sequence by using this law. In this embodiment, the MCS control sequence is equal, for example, to the main sequence, that is to say: MCS = SP. In other words, this MCS control sequence is created without any coding.
    [0039] In a variant, the MCS control sequence is created according to one of the five techniques corresponding to the first five embodiments of the invention.
    [0040] Of course, many other combinations of the embodiments are also possible. The operation of the architecture 10 according to the invention will be described now. An instruction produced by the production means 12 for the consumption means 14 is first transformed into a critical avionics data item. This critical avionics data is then processed by the transmission unit generation means 42 and 43. Thus, the generation means 42 generate a data of the DC control type and the generation means 43 generate a data of the DS monitoring type corresponding to this datum of the DC control type or the initial critical avionics datum. Each piece of data of the DC or DS type of monitoring is then represented by an application message M. In the means 42 or 43, the application message M is divided into a plurality of portions P. Such a division is carried out, for example, according to This division makes it possible in particular to optimize the operation of different components of the network 16 as a function of the speed of data processing. In some cases, the message M is not divided. Then, the generation means 42 or 43 associate with this application message M 20 or a portion P corresponding to this message M an additional message MA. The additional message MA contains identification and control information associated with this application message M. The production laws of an additional message corresponding to a data of the DC control type and a data of the corresponding DS monitoring type are dissimilar. or / and complementary. Thus, the means 42 or 43 first construct an MDA identification sequence. This sequence may be associated with the entire application message M or with its portion P. The means 42 or 43 then construct a MCS control sequence using one of the construction techniques described above. For the sixth embodiment, the means for generating transmission units 42 or 43 additionally distribute the MCS control sequence in the MDA identification sequence according to a distribution law. Thus, the application message M or the portion P and the associated additional message MA 35 form a transmission unit which is then transmitted in the network 16.
    [0041] After reception of the transmission unit by the consumption means 14, the entire application message M or its portion P corresponding to a control type data DC is checked by the reading means 44. The entire message application M or its portion P corresponding to a data type DS monitoring is verified by the reading means 45. Thus, the reading means 44 or 45 first extract the application message M or its portion P of the unit of transmission received. For the sixth embodiment, the reading means 44 or 45 additionally extract the MCS control sequence from the MDA identification sequence according to the distribution law. The reading means 44 or 45 then construct a control sequence MCS 'using the received message M or its received portion P and the received MDA sequence. This construction is based on the same production technique used by the transmission unit generating means 42 or 43.
    [0042] Then, the reading means 44 or 45 compare the received MCS control sequence with the reconstructed MCS control sequence. If the two sequences are identical, the transmission of the message M or its portion P has been carried out without error. If the two sequences are not identical, the transmission of the message M or its portion P has been made with errors. After the reception of all the portions P corresponding to the same application message M, the reading means 44 or 45 reconstitute this message M and then transmit it to the consumption means 14. For a message M representing a datum of the DC control type, the reading means 44 transmit this data to the verification unit 46. For a message M representing a data of the DS monitoring type, the reading means 45 transmit this data to the verification means 46. Finally, the verification means 46 control the data. integrity of the DC control type data using the corresponding DS monitoring type data.
    [0043] The architecture 10 thus makes it possible to reliably transmit these data of different types (control, monitoring) using the same physical path which represents a particular advantage of the present invention. Of course other embodiments can still be envisaged. In addition, this architect can apply for data other than the control type data and surveillance type as described above and apply generally to all data not to interfere.
    权利要求:
    Claims (23)
    [0001]
    CLAIMS- Architecture (10) for transmitting critical data in avionic systems between means (12) for production and means (14) for consuming data connected to each other by at least one physical path (16) implemented by intermediate communication equipment, each critical data item being transmitted by at least two data items, one of a first type and the other of a second independent type, which must not interfere with each other and which also make it possible to check the integrity this critical data item, each data item of the first type or the second type being transmitted in the form of a data transmission unit (30) comprising: at least one portion (P) of an application message (M); and an additional message (MA) containing identification and control information associated with this application message (M); characterized in that the additional message (MA) of each transmission unit (30) comprises a control sequence (MCS) for controlling the integrity of the application message (M); and in that each datum of the first type and the second type corresponding to this critical datum is transmitted by the same physical path (16) implemented by the same intermediate communication equipment, and is generated by means (42; 43) of different and dissimilar generations.
    [0002]
    2. Architecture (10) according to claim 1, characterized in that the dissimilarity of the generation means (22; 24) consists of physical locations, and / or source partition identifications, and / or message identifications, and / or communication logical channel identifications, and / or identifications of the means of production, and / or identifications of the recipient or group of recipients, and / or types of network or protocol, and / or types of physical support, distinct from these means of generation.
    [0003]
    3. Architecture (10) according to claim 1 or 2, characterized in that the dissimilarity of the generation means (22; 24) further comprises predetermined and different production laws and / or complementary to at least a part of corresponding data.
    [0004]
    4.- Architecture (10) according to claim 3, characterized in that the rule of selection of the production law depends on the sources and / or dissimilarity criteria and setting criteria of this selection rule, the parameterization criteria of the law of selection consisting of: - a criticality level of the transmitting equipment and / or the source partition; a level of security of the sending equipment and / or the source partition; - quality criteria assigned to one message over another.
    [0005]
    5. Architecture (10) according to any one of the preceding claims, characterized in that each transmission unit (30) further comprises an identification sequence (MDA) comprising a static part (ID) enabling identifying the application message (M) corresponding to this transmission unit and a variable part (VAR) making it possible to distinguish the message (M) in a unique and certain manner; and in that the control sequence (MCS) corresponding to said transmission unit (30) is based on a main sequence (SP) representing a cyclic redundancy check (CRC) code of the concatenation of at least one portion (P) the application message (M) corresponding to said transmission unit, with the identification sequence (MDA).
    [0006]
    6. Architecture (10) according to claim 5, characterized in that the control sequence (MCS) and the identification sequence (MDA) corresponding to the same transmission unit are distinct.
    [0007]
    7. Architecture (10) according to claim 6, characterized in that the control sequence (MCS) is the result of the application of the XOR operator between: a sequence resulting from a coding of at least one part of the identification sequence (MDA) with a key (KeyA) represented by a field (MPT) of the variable part (VAR) of the identification sequence (MDA); and - the main sequence (SP).
    [0008]
    8. Architecture according to claim 6, characterized in that the control sequence (MCS) is the result of the application of the XOR operator between: a sequence resulting from a coding of at least a part of the identification sequence (MDA) with a key (KeyA (t)) represented by a variable sequence in time and known by the means of production (12) and consumption (14) at each moment; and - the main sequence (SP).
    [0009]
    9. Architecture (10) according to claim 6, characterized in that the control sequence (MCS) is the result of the application of the XOR operator between: a sequence resulting from a coding of at least one part of the identification sequence (MDA) with a first key (KeyA) represented by a coding of a field (MPT) of the variable part (VAR) of the identification sequence (MDA) with a second key (KeyB) represented by a sequence known by the means of production (12) and consumption (13); and - the main sequence (SP).
    [0010]
    10.- Architecture (10) according to claim 6, characterized in that the control sequence (MCS) is the result of the application of the XOR operator between: - a sequence resulting from a coding of at least one part of the identification sequence (MDA) with a first key (KeyA) represented by the result of the application of the XOR operator between: - a field (MPT) of the variable part (VAR) of the sequence of identification (MDA); and a sequence (KeyB) known by the means of production (12) and of consumption (14); and - the main sequence (SP).
    [0011]
    11. Architecture (10) according to claim 6, characterized in that the control sequence (MCS) is the result of the application of the XOR operator between: a sequence resulting from a coding of at least one part of the identification sequence (MDA) and at least one portion (P) of the application message (M) with a key (KeyA) represented by a field (MPT) of the variable part (VAR) of the sequence d identification (MDA); and - the main sequence (SP).
    [0012]
    12. Architecture (10) according to claim 6, characterized in that the control sequence (MCS) is the result of the application of the XOR operator between: a sequence resulting from a coding of at least one part of the identification sequence (MDA) and at least one portion (P) of the application message (M) with a key (KeyA (t)) represented by a variable sequence in time and known by the production means (12) and consumption (14) at every moment; and - the main sequence (SP).
    [0013]
    13. Architecture (10) according to claim 6, characterized in that the control sequence (MCS) is the result of the application of the XOR operator between: a sequence resulting from an encoding of at least one part of the identification sequence (MDA) and at least one portion (P) of the application message (M) with a first key (KeyA) represented by a field coding (MPT) of the variable part (VAR) ) of the identification sequence (MDA) with a second key (KeyB) represented by a sequence known by the means of production (12) and consumption (14); and- the main sequence (SP).
    [0014]
    14.- Architecture (10) according to claim 6, characterized in that the control sequence (MCS) is the result of the application of the XOR operator between: - a sequence resulting from an encoding of at least one part of the identification sequence (MDA) and at least one portion (P) of the application message (M) with a first key (KeyA) represented by the result of the application of the XOR operator between: - a field (MPT) of the variable part (VAR) of the identification sequence (MDA); and a sequence (KeyB) known by the means of production (12) and of consumption (14); and - the main sequence (SP).
    [0015]
    15.- Architecture (10) according to any one of claims 6 to 14, characterized in that the or each key (KeyA, KeyB) is known only by the means of production (12) and consumption (14) to further ensure the confidentiality of messages (M).
    [0016]
    16.- Architecture (10) according to any one of claims 7 to 15, characterized in that, for an application message (M) formed of a plurality of ordered portions (P), the control sequence (MCS) of the transmission unit (20) associated with the first portion (P) is the result of the application of the XOR operator between: a sequence resulting from a coding of a sequence represented by the result of the application the XOR operator enters: at least part of the identification sequence (MDA) corresponding to this portion (P); and - a predetermined initial value (IV); and the main sequence (SP) corresponding to this portion; and the control sequence (MCS) of the transmission unit (20) associated with each subsequent portion (P) is the result of the application of the XOR operator between: - an auxiliary sequence (SA) resulting from a encoding a sequence represented by the result of the application of the XOR operator between: - at least a part of the identification sequence (MDA) corresponding to this portion (P); and an auxiliary sequence (SA) corresponding to the preceding portion (P) and the main sequence (SP) corresponding to this portion.
    [0017]
    17.- Architecture (10) according to any one of claims 7 to 15, characterized in that, for an application message (M) formed of a plurality of ordered portions (P), the control sequence (MCS) of the transmission unit (20) associated with the first portion (P) is the result of the application of the XOR operator between: a sequence resulting from a coding of a sequence represented by the result of the application the XOR operator enters: - at least part of the identification sequence (MDA) and at least one portion (P) of the application message (M); and - a predetermined initial value (IV); and the main sequence (SP) corresponding to this portion; and the control sequence (MCS) of the transmission unit (20) associated with each subsequent portion (P) is the result of the application of the XOR operator between: - an auxiliary sequence (SA) resulting from a encoding a sequence represented by the result of the application of the XOR operator between: - at least part of the identification sequence (MDA) and at least one portion (P) of the application message (M) ; and an auxiliary sequence (SA) corresponding to the preceding portion (P); and the main sequence (SP) corresponding to this portion.
    [0018]
    18.- Architecture (10) according to any one of claims 7 to 17 characterized in that the control sequence (MCS) is distributed in the identification sequence (MDA) according to a distribution law known by the means of production (12) and consumption (14).
    [0019]
    19.- Architecture (10) according to claim 18, characterized in that the distribution law is constant in time.
    [0020]
    20.- Architecture (10) according to claim 19, characterized in that the distribution law is variable in time.
    [0021]
    21.- Architecture (10) according to any one of claims 18 to 20, characterized in that the law is known only by the means of production (12) and consumption (14) to further enable to ensure the confidentiality of messages (M).
    [0022]
    22.- Architecture (10) according to any one of the preceding claims, characterized in that the identification sequence (MDA) comprises information selected from the group further comprising: - identification information of the production means of the corresponding application message (M); identification information of the corresponding application message (M); corresponding application-related message development information (M); message sequence number information; application (M) corresponding, - date of development of the corresponding application message (M).
    [0023]
    23.- Architecture (10) according to any one of the preceding claims, characterized in that the additional message (M) is associated with the application message in whole or portion (P) thereof per portion (P).
    类似技术:
    公开号 | 公开日 | 专利标题
    EP0639013B1|1998-12-02|Method and device for the analysis of data structure information
    FR3014622A1|2015-06-12|ARCHITECTURE FOR CRITICAL DATA TRANSMISSION IN AVIONICS SYSTEMS
    WO1994009579A1|1994-04-28|Ring network security system
    FR3001849A1|2014-08-08|METHOD FOR ROUTING DATA, COMPUTER PROGRAM, NETWORK CONTROLLER AND ASSOCIATED NETWORKS
    EP2232765A2|2010-09-29|Method and entity for probabilistic symmetrical encryption
    FR3014273A1|2015-06-05|SYSTEM FOR TRANSMITTING AVIONIC APPLICATIVE DATA
    EP2161700A1|2010-03-10|Method,associated system and aircraft for communicating a digital signature in order to certify a transmission
    FR3045256A1|2017-06-16|ONBOARD COMMUNICATION NETWORK OF A VEHICLE AND SUBSCRIBER OF SUCH A COMMUNICATION NETWORK
    CA2725292A1|2011-06-16|Simulation or testing system and method using monitoring port data
    EP3454512B1|2020-05-13|Communication network, associated measurement system, transport means and method for constructing a communication network
    FR2797964A1|2001-03-02|SECURE DATA SWITCHING CONTROL DEVICE
    FR3071118A1|2019-03-15|ELECTRONIC DEVICE AND METHOD FOR RECEIVING DATA VIA A REBOUND COMMUNICATION NETWORK, COMMUNICATION SYSTEM AND COMPUTER PROGRAM THEREOF
    EP3454513B1|2020-05-13|Communication network, associated measurement system, transport means and method for constructing a communication network
    EP3552346A1|2019-10-16|Method of sending a message, method of reception, sending device, reception device and communication system associated therewith
    EP3637645B1|2021-06-09|Electronic device and method for receiving data via a redundant communication network, associated communication system and computer program
    FR3093831A1|2020-09-18|Device for and method of data transmission
    WO2020109733A2|2020-06-04|Data management for storing data frames in the memory of a data transmission system
    EP3675440A1|2020-07-01|Switch comprising an observation port and communication system comprising such a switch
    EP0974902B1|2003-06-04|Method of detecting errors on a serial link of an integrated circuit and device to realise this method
    FR3097092A1|2020-12-11|DIGITAL FILE STORAGE PROCESS IMPLEMENTED BY A DETERMINIST AVIONICS NETWORK WITH A PREDETERMINED ROUTING, AND ASSOCIATED AVIONICS COMMUNICATION SYSTEM
    EP3005625B1|2017-07-05|Communication management component and method
    EP3874700A1|2021-09-08|Data transmission system
    FR3089082A1|2020-05-29|Method for configuring an Ethernet switch of an on-board network of a motor vehicle
    FR3018977A1|2015-09-25|MESSAGE EXCHANGES AND GENERIC COMMUNICATIONS CONTROLLER STRUCTURE FOR REBOUNDING AVIONIC COMMUNICATION SYSTEMS
    FR3034934A1|2016-10-14|METHOD FOR TRANSMITTING ADDITIONAL INFORMATION AND AVIONIC INFORMATION TRANSMISSION NETWORK USING SUCH A METHOD
    同族专利:
    公开号 | 公开日
    FR3014622B1|2017-06-09|
    US20150161403A1|2015-06-11|
    US9684792B2|2017-06-20|
    引用文献:
    公开号 | 申请日 | 公开日 | 申请人 | 专利标题
    WO2010000965A2|2008-07-02|2010-01-07|Airbus Operations|Method and device for protecting the integrity of data transmitted over a network|
    CN102143185A|2011-03-31|2011-08-03|北京经纬恒润科技有限公司|Data transmission method and data transmission device|
    US4771458A|1987-03-12|1988-09-13|Zenith Electronics Corporation|Secure data packet transmission system and method|
    FR2705476B1|1993-05-14|1995-06-30|Alcatel Nv|Production rules filtering mechanism and inference engine for expert system including such a mechanism.|
    US7536631B1|2002-12-19|2009-05-19|Rmi Corporation|Advanced communication apparatus and method for verified communication|
    DE10318068B4|2003-04-17|2009-08-27|Phoenix Contact Gmbh & Co. Kg|Method and device for packet-oriented transmission of security-relevant data|
    US9003544B2|2011-07-26|2015-04-07|Kaspersky Lab Zao|Efficient securing of data on mobile devices|
    EP2912527B1|2012-10-25|2020-02-26|BAE Systems PLC|Control systems for unmanned vehicles|FR3010853B1|2013-09-13|2015-10-16|Thales Sa|HIERARCHICAL ARCHITECTURE DISTRIBUTED WITH MULTIPLE ACCESS TO SERVICES|
    FR3030126B1|2014-12-10|2017-01-13|Thales Sa|AVIONIC INFORMATION TRANSMISSION SYSTEM|
    US10109201B2|2015-03-20|2018-10-23|Automap, Llc|Vehicle monitoring devices, vehicle monitoring management devices, and vehicle monitoring systems|
    FR3071946B1|2017-10-03|2019-09-27|Thales|ELECTRONIC DEVICE AND METHOD OF MONITORING DATA STORED IN AN AVIONIC APPARATUS, COMPUTER PROGRAM|
    法律状态:
    2015-12-31| PLFP| Fee payment|Year of fee payment: 3 |
    2016-12-29| PLFP| Fee payment|Year of fee payment: 4 |
    2018-01-02| PLFP| Fee payment|Year of fee payment: 5 |
    2019-12-30| PLFP| Fee payment|Year of fee payment: 7 |
    2020-12-28| PLFP| Fee payment|Year of fee payment: 8 |
    2021-12-30| PLFP| Fee payment|Year of fee payment: 9 |
    优先权:
    申请号 | 申请日 | 专利标题
    FR1302884A|FR3014622B1|2013-12-10|2013-12-10|ARCHITECTURE FOR CRITICAL DATA TRANSMISSION IN AVIONICS SYSTEMS|FR1302884A| FR3014622B1|2013-12-10|2013-12-10|ARCHITECTURE FOR CRITICAL DATA TRANSMISSION IN AVIONICS SYSTEMS|
    US14/566,456| US9684792B2|2013-12-10|2014-12-10|Critical data transmission architecture in avionics systems|
    [返回顶部]