• 专利附录
  • 专利说明
  • 权利要求
  • 类似技术
  • 同族专利
  • 引用文献
  • 法律状态
  • 优先权
    • 专利摘要:
    This method makes it possible to validate a file for updating at least one set of computer data of avionic equipment of an aircraft. The processing method is implemented within a processing system comprising an independent mobile terminal (10) of the aircraft, an update unit (11) integrated with the aircraft, and a database ( 12) remote from the aircraft and the mobile terminal (10) and comprises: obtaining (21) a calculated condensate, the calculated condensate resulting from the application, by the update unit (11) , from a cryptographic hash function to the update file, - obtaining (22) a reference condensate, the reference condensate being acquired by the mobile terminal (10) by secure access to a database including the reference condensate, - the processing of the update file according to a comparison of the calculated condensate with the reference condensate.
    公开号:FR3050555A1
    申请号:FR1600665
    申请日:2016-04-21
    公开日:2017-10-27
    发明作者:Christian Cantaloube
    申请人:Thales SA；
    IPC主号:
    专利说明:

    Method for processing an aircraft avionics update file, computer program product, electronic processing device and associated processing system
    The present invention relates to a method of processing a file for updating at least one set of computer data of an avionic equipment of an aircraft, the processing method being implemented within a system of processing comprising an independent mobile terminal of the aircraft, an update unit integrated with the aircraft, and a remote database of the aircraft and the mobile terminal. The invention also relates to a computer program product comprising software instructions which, when implemented by an integrated information processing unit within a processing system of the aforementioned type, implements such a method of processing. . The invention also relates to an electronic device for processing a file for updating at least one set of computer data of an avionic equipment of an aircraft, the electronic processing device being configured to be integrated into a system. processing of an update file, the processing system comprising an independent mobile terminal of the aircraft, an update unit integrated into the aircraft, and a remote database of the aircraft and the terminal mobile. The invention also relates to a system for processing a file for updating at least one set of computer data of an avionic equipment of an aircraft, the processing system comprising at least: a mobile terminal independent of the aircraft, an update unit integrated with the aircraft, a remote database of the aircraft and the mobile terminal. The invention applies to the field of avionics, and more particularly to that of software component update systems and avionics equipment databases of an aircraft, such as an airplane or a helicopter, or a drone.
    Conventionally, such an update is made either by transfer of files (ie set of data) stored on mobile storage devices such as hard disks, USB keys (Universal Serial Bus), laptops, either by data transmission over communication links, such as radio communication links. The integrity of such an update operation of the data on board avionics equipment is critical with regard to the safety of the flight and the smooth running of navigation operations. To ensure such integrity, solutions based on the application of a cryptographic hash function, update files whose result is called condensate, or hash value, or fingerprint are implemented.
    An example of this type of solution is described in particular in document US 2013/036103 A1.
    According to this document, a comparison between a calculated condensate and a reference condensate previously stored in an integrity module of the aircraft is implemented to validate the update.
    However, this solution implemented within the aircraft proves ineffective when a malicious third party manages to get into the aircraft update system. Moreover, this solution requires a prior and recurrent update of the reference condensates stored in the integrity module of the aircraft, these reference condensates themselves being data files whose integrity must be protected at the same time. within the aircraft.
    To remedy this, solutions based on an electronic signature combining the aforementioned condensate technique and an asymmetric key exchange encryption have been proposed. Nevertheless, these solutions are complex to implement from a logistical point of view because the encryption assumes a distribution of public keys to the aircraft on the one hand and of private keys to the equipment suppliers delivering the updates on the other hand. day to install, as well as a management over time of the validity of these keys and associated certificates (for example in case of revocation).
    An object of the invention is therefore to propose a method of processing an update file, making it possible to improve security when updating at least one set of computer data of a avionics equipment. an aircraft, while facilitating the realization of the update. For this purpose, the subject of the invention is a method for processing an update file of the aforementioned type, the processing method comprising the following steps: obtaining a calculated condensate associated with the update file; day, the calculated condensate resulting from the application, by the update unit, of a cryptographic hash function to the update file, obtaining a reference condensate associated with the update file. day, the reference condensate being acquired by the mobile terminal by secure access to a database comprising the reference condensate, the processing of the update file according to a comparison of the calculated condensate with the reference condensate.
    By "update file" is meant a software or a dataset.
    "Computer data set of avionics equipment" means a software part or a database of the avionics equipment on which the update file is applied.
    By "obtaining" is meant the "direct" or "indirect" obtaining of an object. For example, according to a first processing system architecture, obtaining the calculated condensate is "direct" when the determination is made by the updating unit, and, according to a second architecture, "indirect", when the mobile terminal obtains the calculated condensate previously determined by the update unit.
    According to other advantageous aspects of the invention, the treatment method comprises one or more of the following characteristics, taken separately or in any technically possible combination: the comparison of the calculated condensate with the reference condensate comprises obtaining an indicator comparison method comprising: acquisition of the comparison indicator entered by an operator, or automatic implementation of the comparison of the calculated condensate with the reference condensate, the method further comprises storing the comparison indicator, when the method is implemented by the mobile terminal, obtaining the calculated condensate comprises; the reception of the calculated condensate emitted by the updating unit, or the reception of the calculated condensate entered by an operator, or an acquisition, based on an optical recognition of the calculated condensate, on a display screen of the aircraft, when the method is implemented by the updating unit, obtaining the reference condensate comprises: receiving the reference condensate emitted by the mobile terminal, or receiving the reference condensate entered by an operator, or a acquisition, based on an optical recognition of the reference condensate, on a display screen of the mobile terminal, the processing of the update file according to a comparison of the condensate calculated with the reference condensate comprises: the validation of the file of updating when the calculated condensate is identical to the reference condensate, or the deletion of the update file when the condensate calcu it is different from the reference condensate.
    The "processing of the update file" therefore broadly comprises the processing operations that enable the validation (for example, by generating a validation associated with the update file, or by acquiring a validation associated with the update file). update file entered by an operator) or the deletion of the update file. The invention also relates to a computer program product comprising software instructions which, when implemented by an integrated information processing unit within a processing system of the aforementioned type, implements a method of treatment as defined above. The subject of the invention is also an electronic processing device of the aforementioned type, in which the electronic processing device comprises: a module for obtaining a calculated condensate, associated with the update file, the calculated condensate resulting from the application, by the update unit, of a cryptographic hash function to the update file, a module for obtaining a reference condensate, associated with the update file, the reference condensate being acquired by the mobile terminal by secure access to a database comprising the reference condensate, an update file processing module according to a comparison of the calculated condensate with the reference condensate. The subject of the invention is also a system for processing an update file of the aforementioned type in which: the mobile terminal comprises at least one module for obtaining a reference condensate, associated with the update file , the reference condensate being acquired by the mobile terminal by secure access to a database comprising the reference condensate, the updating unit comprises at least one module for obtaining a condensate calculated, associated with the file of updating, the calculated condensate resulting from the application, by the update unit, of a cryptographic hash function to the update file, and the mobile terminal, or the updating unit, comprises a module for processing the update file according to a comparison of the calculated condensate with the reference condensate.
    According to another advantageous aspect of the invention, the processing system is such that the update unit is an electronic unit integrated in the avionic equipment, or a separate electronic unit of the avionics equipment or aircraft.
    These features and advantages of the invention will appear on reading the description which follows, given solely by way of nonlimiting example, and with reference to the appended drawings, in which: FIG. 1 is a diagrammatic view of an exemplary system architecture for processing an update file according to the invention comprising a mobile terminal, an update unit connected to an avionic equipment of an aircraft, and a remote database of the FIG. 2 is a flowchart of a method for processing an update file according to the invention; FIGS. 3 to 5 illustrate three embodiments of the step of obtaining a calculated condensate of the treatment process illustrated in FIG. 2; and FIGS. 6 and 7 illustrate two embodiments of the step of obtaining a reference condensate of the treatment process. 2, FIGS. 8 and 9 illustrate two embodiments of the step of obtaining a comparison indicator of the processing method illustrated in FIG. 2; FIG. 10 is a flowchart of the steps taken. FIG. implemented reciprocally by the update unit when the method according to the invention is implemented by an electronic processing device integrated in the mobile terminal, according to a first architecture of the processing system as illustrated in FIG. 1.
    In FIG. 1, a system for processing an update file according to the invention comprises at least one mobile terminal 10 capable of being worn by a maintenance operator 14, the latter being responsible for installing an update. a set of computer data of avionics equipment of an aircraft (not shown). The mobile terminal 10 is therefore able to be moved and located outside or inside the aircraft.
    The system for processing an update file also comprises at least one unit 11 for updating the computer data set of avionic equipment of the aircraft.
    Such an update unit 11 is integrable into the aircraft and usable, for the maintenance of a plurality of separate avionics equipment, or dedicated to a particular avionics equipment.
    In other words, according to a first variant, the update unit 11 is dedicated to a particular avionics equipment and is physically part of this avionic equipment (ie the update unit is a subset of a avionics equipment).
    According to a second variant, the update unit 11 is an aircraft avionics device as such of the aircraft (ie physically independent from other avionics equipment) and is used to update one or more other separate avionics equipment .
    Moreover, the system for processing an update file includes a database 12 remote from the aircraft, and also remote from the mobile terminal 10.
    Such a database 12 corresponds, for example, to a ground-based computer system housed in an aircraft manufacturer's certified avionics equipment manufacturer, at the manufacturer of the aircraft or at the operating company of the aircraft, and integrates a module strong authentication by signatures / certificates (since for example the original producer).
    In addition, the update system also includes a rendering screen 13 located on the aircraft, for example one of the cockpit screens.
    According to a first variant, the system for processing an update file comprises a tool 17 for loading the update file (s), independent of the update unit 11, and of which it is complex to guarantee the integrity in a sustainable way.
    According to a first example, such a loading tool 17 is a medium: i.e. a removable storage medium such as a USB key, a memory card, a data disk (CD / DVD). In this case, the update unit 11 comprises, or is connected via a wireless or wired link to, a media player (not shown) compatible with the media 17 used.
    In a second example, the loading tool 17 is a portable computer comprising a memory (i.e. hard disk) in which the update file is stored, and a media player. In this case the laptop is also connected to the update unit (11) via a wired link or a wireless link.
    According to another variant, the update file (s) is (are) transmitted by the database 12 to the update unit 11 by means of a data link 15 of the public network (no shown), such as a data radio link, or a wired link, for example, when passing to the maintenance workshop of the aircraft.
    The mobile terminal 10 and the database 12 communicate via a secure communication network, for example by means of a VPN link 16 (Virtual Private Network English).
    The mobile terminal 10, independent of the aircraft, comprises a first information unit 1000 formed for example of a first processor 100, and a first memory 102 associated with the first processor 100.
    The mobile terminal 10 is, for example, a smartphone (English smartphone) managed by an operating system, such as the Android operating system of the Google® company, or according to another example, a touch pad, and further comprises a radio antenna and a radio transceiver (not shown), the transceiver is connected to the information processing unit 1000. Furthermore, such a mobile terminal 10 comprises a keyboard, a screen , and, for example, a digital camera.
    According to an optional aspect, the mobile terminal 10 is also configured to exchange, with the update unit 11, using a data link 18, such as a radio data link or a wired link. .
    According to one particular aspect, the mobile terminal 10 is configured to implement a security solution Teopad® from Thales®.
    The mobile terminal 10 is carried by the maintenance operator 14 and is therefore independent of the database 12 as the aircraft comprising the avionics equipment to which the update unit 11 is connected. same mobile terminal 10 is for example usable by the operator 14 to update the same set of computer data of the same avionics equipment of several aircraft.
    Several architectures of systems for processing an update file according to the invention are implementable.
    A first architecture corresponds to the system for processing an update file as represented in FIG. 1. According to this first architectural example, the mobile terminal 10 comprises an electronic device 1001 for update processing.
    Such an electronic device for processing an update file 1001 comprises, firstly, a first module 104 for obtaining, via the data link 18, a calculated condensate associated with the update file, the calculated condensate resulting from the application, by the update unit 11 of a cryptographic hash function, to the update file.
    According to a first variant embodiment, this first obtaining module 104 comprises a radio transceiver (not shown) which receives directly via the data link 18 the calculated condensate emitted by the update unit 11.
    According to this first variant, it is therefore possible for the carrier maintenance operator 14 of the mobile terminal 10 to be remote from the aircraft, provided that the radio transmitter and receiver of the mobile terminal remains in the transmission range area. of the update unit 11.
    In addition, the data link 18 used by the radio transceiver is designed to prevent the introduction of a lure by a malicious third party during the communication between the update unit 11 and the mobile terminal 10.
    According to a second variant embodiment, this first obtaining module 104 comprises a condensate receiving module calculated by the operator 14. Such a receiving module (not shown) corresponds for example to the keyboard of the mobile terminal 10.
    According to a third variant embodiment, this first obtaining module 104 comprises an acquisition module (not shown) configured to read the calculated condensate, or an image representative of the calculated condensate, on the display screen 13 of the aircraft . Such an acquisition module (not shown) corresponds in this case to a digital camera of the mobile terminal 10, or advantageously comprises an optical object recognition module (not shown) such as an image (for example a reader of QR code (Quick Response) or a string of characters.
    The electronic device for processing an update file 1001 also comprises a second module 103 for obtaining, via secure access using the secure link 16, a reference condensate associated with the update file, certified and stored in the remote database 12 of the aircraft and the mobile terminal 10.
    According to a particular aspect, the activation of this second obtaining module 103 is synchronized with the first obtaining module 104 by means of a synchronization module (not represented), so that once the calculated condensate is received, the second obtaining module 103 is activated to access in real time the database 12.
    In another aspect, the activation of this second obtaining module 103 is prior to obtaining the calculated condensate. In this case, the second obtaining module 103 is connected to the first memory 102 of the terminal so as to be configured to store therein the reference condensate obtained before the calculated condensate.
    The electronic device for processing an update file 1001 also optionally includes a module for obtaining a comparison indicator 105 of the condensate calculated with the reference condensate. This module for obtaining a comparison indicator 105 is connected to the first and second modules for obtaining the reference condensate and the calculated condensate respectively, as described above.
    According to a first variant, this module for obtaining a comparison indicator 105 comprises a man-machine interface 1050 allowing an interaction with the operator 14.
    Such a man-machine interface 1050 includes, for example, a playback screen, a speaker, and an input module (not shown) such as a keyboard (touch or not) or voice recognition software.
    This human-machine interface 1050 is configured to allow the operator 14 to support the comparison of the calculated condensate with the reference condensate and mentally obtain the result of the comparison, then to enter this comparison result.
    According to a second variant, this module for obtaining a comparison indicator 105 is configured to implement automatically (i.e. without intervention of an operator) the comparison of the reference condensate and the calculated condensate.
    Furthermore, the electronic device for processing an update file 1001 of the mobile terminal 10 comprises, according to the example of the first processing system architecture of an update file as represented in FIG. an update file processing module comprising a module 106 for generating a validation of the update file, especially when the module for obtaining a comparison indicator 105 is configured to implement automatically (ie without intervention of an operator) the comparison. Such a generation module 106 of a validation of the update file is connected to the module for obtaining a comparison indicator 105 described above.
    This generation module 106 is configured to automatically deliver (ie without the intervention of an operator) a validation V when the module for obtaining a comparison indicator 105 automatically delivers a positive result representative of an identity between the reference condensate. and the calculated condensate. For example, if the condensais are images, a positive result is a reference image and an image associated with the same update file. If the condensates are of the SHA-1 type, i.e. 160-bit words, the reference condensate is equal, i.e. identical to the calculated condensate, and the reference condensate and calculated condensate bits are identical in pairs.
    According to the example of the first processing system architecture illustrated in FIG. 1, the processing module of the update file of the electronic processing device 1001 integrated in the mobile terminal 10 also comprises a transmission module 107 of the validation V to update unit 11.
    According to the exemplary processing system architecture illustrated in FIG. 1, the update unit 11 also comprises a second information unit 1100 formed for example of a second processor 110, and a second memory 112 associated with the second processor 110.
    Moreover, the update unit 11 comprises a loading module 113 in a temporary zone of the memory 112 of the update unit 11 with the update file.
    This charging module 113 is for example a USB port, a Bluetooth® port, (ie a port compliant with the IEEE 802.15 standard) or an NFC (Near Field Communication) port, configured to communicate according to a first variant With the loading tool 17. According to a second variant, the loading module 113 corresponds to a radio receiver, an Ethernet port or a Wi-Fi receiver (in accordance with the IEEE 802.11 standard) configured to receive the update file. day, transmitted directly from the database 12 via a data link 15 of the public communication network. The updating unit 11 also comprises a module 114 for determining a calculated condensate. This determination module 114 is configured to apply to the update file a cryptographic hash function whose result is called condensate, or hash value, or digital footprint.
    In other words, a condensate corresponds to a "fingerprint" representative of the update file to characterize it distinctly (in principle, a file can not be changed without its condensate changes).
    The determination module 114 is a calculator using a similar condensate calculation program, (in terms of formula / algorithm) to that or those implemented in the database 12, because it is suitable for applying the same cryptographic hash function as that implemented by the database 12. The update unit 11 also includes a transmission module 115, condensate calculated from the received update file. According to a particular aspect, as illustrated by FIG. 1, such a transmission module 115 is a transmission-reception module configured to transmit but also to receive data.
    This transmission module 115 is connected, on the one hand, to the aforementioned determination module 114 and, on the other hand, according to a first variant to the mobile terminal 10 via a data link 18, or according to a second variant on the rendering screen. 13 via a link 19, wired or not.
    According to an optional aspect of the invention, the transmission link 18 or 19 used between the transmission module 115 and the destination entity, namely the mobile terminal 10 or the display screen 13 of the aircraft, is secured or segregated so as to avoid any possibility of decoy by replacing the condensate calculated by a valid condensate. The update unit 11 further comprises a module 116 for updating the computer data set of the avionics equipment of the aircraft.
    Such an update module 116 is, according to the example of the first architecture illustrated in FIG. 1 activated in the presence of a validation of the update file received from the mobile terminal. To do this, this update module 116 is connected to the transmission-reception module 115 of the update unit 11, the transmission-reception module 115 being configured to receive data from the mobile terminal 10 via a link 18 of the public communication network. Such an update module 116 is configured to permanently load the update file from its memory 112 to the avionics equipment whose set of computer data is affected by the update file. The update unit 11 also optionally includes a module 117 for deleting the update file of the temporary zone of the second memory 112. Such a deletion module 117 is activated in the absence of a validation received from the mobile terminal 10 by the above-mentioned reception module. In other words, such a deletion module 117 is configured to block the use of the update file.
    According to an optional variant, the update unit 11 also comprises a counter (not shown) connected to the aforementioned transmission module 115, to the reception module and to the suppression module 117 described above. Such a counter is configured to measure the time that elapses from the transmission, by the update unit 11, of the calculated condensate, and to activate the suppression module 117 in the absence of validation received from the terminal mobile beyond a predetermined period.
    According to a second exemplary architecture (not shown) of the system for processing an update file, the electronic device for processing an update file 1001 is integrated within the updating unit. 11 instead of being integrated in the mobile terminal 10.
    According to this second architecture of the processing system, the mobile terminal 10 always comprises the second module 103 obtaining, via secure access to the database 12 using the secure link 16, a reference condensate associated with the file of update.
    In addition, according to this second architecture of the processing system, according to a first option (not shown), the mobile terminal 10 comprises a transmission module of the reference condensate to the updating unit 11.
    According to a second option, the screen of the mobile terminal 10 is configured to render automatically, or on request, the reference condensate.
    According to this second architecture of the processing system where the update unit 11 comprises the electronic processing device 1001, the updating unit also comprises a module for obtaining (ie "indirect" obtaining) a reference condensate integrated with the electronic processing device 1001.
    According to a first option, the module for obtaining the reference condensate of the processing device integrated in the update unit 11 comprises a reception module configured to receive the reference condensate emitted by the transmission module of the mobile terminal. .
    According to a second option, the module for obtaining the reference condensate of the processing device integrated in the update unit 11 comprises a reception module configured to receive the reference condensate input by the operator 14.
    According to a third option, the module for obtaining the reference condensate of the processing device integrated in the update unit 11 comprises an acquisition module configured to implement an optical recognition of the reference condensate on a display screen. restitution of the mobile terminal.
    According to this second architecture, the module for obtaining a calculated condensate associated with the update file is the determination module 114 for a calculated condensate, described above in relation to the first architecture represented by FIG. 1.
    In a manner similar to the first processing system architecture described above, according to the second architecture where the electronic processing device is integrated in the update unit, the electronic processing device 1001 optionally comprises a obtaining module 105. a condensate comparison indicator calculated with the reference condensate. This obtaining module 105 comprises, according to a first variant, a man-machine interface 1050 allowing an interaction with the operator 14. According to a second variant, this obtaining module 105 is configured to implement automatically (ie without intervention of an operator) the comparison of the reference condensate and the calculated condensate.
    According to this second processing system architecture where the electronic processing device 1001 is integrated in the update unit 11, the validation transmission module 107 as described with respect to the first architecture, where the electronic processing device is integrated in the mobile terminal 10, is not necessary.
    Thus, according to this second architecture, the update file processing module comprises, especially when the module for obtaining a comparison indicator 105 is configured to implement automatically (ie without operator intervention) the comparison. , the generation module 106 of a validation V of the update file, the update module 116 and the deletion module 117 as described relative to the first architecture.
    According to a third example of an architecture of the system for processing an update file (not shown), the electronic device for processing an update file 1001 is "split" between the mobile terminal 10 and the update unit 11.
    In other words, on the one hand, the mobile terminal 10 always includes the second module 103 for obtaining, via the secure access to the database 12 using the secure link 16, a reference condensate associated with the update file. In addition, according to this third architecture, the screen of the mobile terminal 10 is configured to restore the operator 14 the reference condensate. On the other hand, the update unit 11 comprises the module for obtaining a calculated condensate, associated with the update file, the calculated condensate resulting from the application, by the update unit. 11, from a cryptographic hash function to the update file, this module for obtaining a calculated condensate being the determination module 114 of a calculated condensate previously described in relation to the first architecture represented by FIG. 1 In addition, according to this third architecture, the screen of the aircraft 13 is configured to restore to the operator 14 the calculated condensate.
    According to this third architecture, the processing module of the update file, based on a comparison of the calculated condensate with the reference condensate, comprises a man-machine interface 1050 enabling the acquisition of a validation (or a request to delete the update file) entered by the operator 14 which has itself made the comparison between the calculated condensate and the reference condensate reciprocally restored by the screen 13 of the aircraft and the screen of the mobile terminal 10.
    Such a processing module is integrated either at the mobile terminal 10 or at the update unit 11.
    When the processing module is integrated in the mobile terminal 10, it optionally comprises the transmission means 107 of the validation to the update unit 11.
    When the processing module is integrated in the update unit 11, the updating module 116, previously described relative to the first architecture, is activated in the presence of the validation input by the operator 14.
    The processing of an update file, as implemented within the first architecture of the processing system illustrated in FIG. 1, will now be described with reference to FIGS. 2 to 10 respectively.
    According to this first architecture, the validation of an update as such is implemented by the mobile terminal 10 previously described and assumes an interaction, as described below, with on the one hand the setting unit 11, which loads the update data and implements the update if necessary, and on the other hand the database 12 which serves as a reference for the validation. Those skilled in the art will understand that the method of processing an update file described hereinafter is one of a number of exemplary embodiments making it possible to validate an update file by a validation system according to the invention. . Such a method described in connection with the first validation system architecture is easily transferable to the other two validation system architectures described above.
    First of all, according to the validation method implemented in the validation system, a first architecture of which is illustrated in FIG. 1, the updating unit 11 implements a step 61 of loading the update data. in a temporary zone of its memory 112. According to a first variant, such a loading step 61 is operated from the loading tool 17 connected to the loading module 113 of the update unit 11. According to a second alternatively, such a loading step 61 corresponds to the reception by the loading module 113 of the update file transmitted by a data link 15 of the public network by the database 12.
    Once the step of loading 61 of these data is performed, the update unit 11 implements a step 62 of determination of the condensate associated with them by applying a cryptographic hash function, certified and identical to that implemented by the database 12.
    For example, such a cryptographic hash function is of SHA-1, SHA-2, SHA-224, SHA-256, SHA-3 etc. type. According to the invention, any type of hash function is implemented so as to deliver a condensate, or "imprint" representing at least one update file whose integrity must be verified before the effective implementation of the update.
    When the update requires a plurality of update files, the hash function is: • according to a first example, applied to all of the plurality so as to deliver a condensate for all of the plurality, or According to a second example, applied to a group of update files of the plurality, or according to a third example, applied to each file of the plurality so as to deliver as many condenses as there are files in the plurality, etc.
    Once the determination step 62 has been performed, the update unit 11 implements a step 63 for transmitting this calculated condensate, ie, according to a first variant illustrated in FIG. 3, directly to the mobile terminal 10 of the operator 14, via a link, radio or wired, dedicated or secure, or, according to a second variant illustrated in Figure 4, the restitution screen 13 of the aircraft.
    This transmission step 63 optionally includes additional identification information of the update file, such as an identifier, a version number, the origin or the author of this update file. Such additional identification information makes it possible in particular to facilitate the management and traceability of the update files. Conversely, the mobile terminal 10 implements a first step 21 to obtain the calculated condensate. According to the first variant described above and illustrated in FIG. 3, the mobile terminal 10 implements a step 210 for receiving the calculated condensate, transmitted by the update unit 11, via a link, radio or wired, dedicated or secure.
    According to the second variant illustrated in FIG. 4, such a first step of obtaining 21 by the mobile terminal 10 comprises a step 212 of acquisition, for example by reading, of the display screen 13 of the aircraft to which the update unit 11 has transmitted the calculated condensate.
    Such an acquisition step 212 is for example based on an optical recognition of the calculated condensate.
    According to a third variant illustrated in FIG. 5, such a first step of obtaining 21 by the mobile terminal 10 comprises a step 211 for receiving the calculated condensate entered by the operator 14, once the operator 14 has read the condensate calculated by the rendering screen 13.
    The mobile terminal 10 also implements a second step 22 for obtaining a reference condensate also associated with the set of computer data of the avionics equipment to be updated.
    According to a first variant illustrated in FIG. 6, the mobile terminal 10 implements a second step 221 for obtaining this reference condensate independently of the instant of implementation of the first step 21 for obtaining the calculated condensate.
    Indeed, according to this variant, the mobile terminal 10 implements a step 220 for transmitting a request to obtain condensate (s) for the reference database 12 prior to a maintenance operation implemented by the operator 14 carrying the mobile terminal 10.
    Once the reference condensate obtained according to the second obtaining step 221, the mobile terminal 10 implements a step 222 for storing the reference condensate on an area of the first memory 102 and waits for the realization of the first step of obtaining the calculated condensate to carry out the subsequent steps of the update validation process as described below.
    According to a second variant illustrated in FIG. 7, the mobile terminal 10 waits for the first step 21 to obtain the calculated condensate to implement a step 220 for transmitting a request to obtain the corresponding reference condensate from of the database 12. According to this variant the mobile terminal 10 implements the second step of obtaining 221 in real time of the reference condensate. The instant of implementation of the second step of obtaining 221 of the reference condensate according to this second variant therefore depends directly on the time of implementation of the first step 21 for obtaining the calculated condensate by the mobile terminal.
    Once the updating condensate and the reference condensate obtained respectively according to the first and second obtaining steps 21, 22, the mobile terminal 10 implements a step 23 for obtaining a comparison indicator for these two condensates. .
    According to a first variant illustrated in FIG. 8, the comparison as such is carried out by the operator 14 by means of a man-machine interface 1050. For example, the reference condensate and the calculated condensate are restored during a step 231 of restitution on the screen of the man-machine interface 1050 or by means of a loudspeaker. The operator 14 performs the comparison itself and implements a step 232 for entering an indicator representative of the result of this comparison. Such an indicator corresponds, for example, to the input by the operator 14 of the message "OK" when the comparison result is positive and "KO" when the comparison result is negative. Such a message is for example textual and entered by means of a keyboard (tactile or not). According to another example, such a message is voice and entered by means of a voice recognition tool. According to another example, such a message is entered by pressing an "OK" key on the keyboard or a "KO" key on the keyboard.
    Any other pair of comparison indicators can be used to represent the comparison result implemented by the operator, such as the use of green and red keys or a 0 and 1 binary code, and so on.
    According to a second variant illustrated in FIG. 9, the mobile terminal 10 is configured to implement automatically the comparison step 233 of the two condensates, notably using an optical object recognition.
    Thus, according to this second variant, the implementation of the step 23 for obtaining the comparison indicator does not require any intervention by the operator 14. According to an optional step, the comparison indicator is stored (step shown), for example in the memory 102 of the mobile terminal 10, or directly in a memory of the database 12 (ie in this case the mobile terminal 10 transmits the comparison indicator to the database 12 via the secure link 16. Such a storage includes for example the creation of a traceability file (of the English Log file) of the current verification.
    Such a traceability file optionally includes additional information identifying the update file, such as an identifier, a version number, the origin or the author of this update file or information relating to at validation such as the date and time, the name of the operator 14.
    Such a storage is for example automatic and systematic or performed at the request of the operator including via a software application of the mobile terminal, the software application being accessible via the man-machine interface 1050 previously described.
    Optionally, the comparison indicator is then used by the mobile terminal 10 in a generation step 24, if necessary, of a validation V update data loaded on the update unit 11.
    More precisely, when the comparison indicator represents a positive comparison result (ie the calculated condensate and the reference condensate are identical), the validation V allowing the update file to be processed is generated during the generation step. 24, then transmitted during a transmission step to the update unit 11. On receipt of this validation V (Y in FIG. 10), the updating unit 11 implements a step 64 update of the computer data set avionics equipment.
    On the other hand, when the comparison indicator represents a negative comparison result (ie the calculated condensate and the reference condensate are different), no validation V is generated or transmitted by the mobile terminal 10 to the update unit. 11. The update unit 11 does not receive this validation (N in FIG. 10), then implements a step 65 of deletion of the update data of the temporary zone of the memory 112 of the unit update 11.
    According to an alternative embodiment, such a deletion step 65 is implemented, by the update unit 11, at the expiry of a predetermined period measured by a counter of the update unit 11.
    Thus, according to the present invention it is proposed to "externalize" the update authorization operation on a mobile terminal 10 independent of the aircraft on which the update data are loaded for the update of the update. at least one avionics equipment that constitutes it.
    Such outsourcing makes it more difficult to implement effective malicious changes. Indeed, according to the present invention to corrupt the update without this corruption is detected, it is necessary to corrupt both the update data, the update unit 11 located on the aircraft and the mobile terminal 10 of an operator adapted to be located outside the aircraft.
    In other words, the present invention proposes to distribute various steps necessary for a secure update, by distributing them between the database 12 serving as a certified reference, the update unit 11 which, for a file of given update, calculates an associated calculated condensate, and the mobile terminal 10 which verifies the condensate calculated by the update unit 11, by obtaining through a secure path to the database 12 the condensate reference number associated with the update file, the reference condensate to be compared with the calculated condensate, such a comparison being implemented by an operator or automatically as described above.
    权利要求:
    Claims (10)
    [1" id="c-fr-0001]
    A method for processing a file for updating at least one set of computer data of an avionic equipment of an aircraft, the processing method being implemented within a processing system comprising a mobile terminal (10), an update unit (11) integrated with the aircraft, and a database (12) remote from the aircraft and the mobile terminal (10), the method of processing comprising: obtaining (21) a calculated condensate, associated with the update file, the calculated condensate resulting from the application, by the updating unit (11), of a hash function cryptographic update file, obtaining (22) a reference condensate, associated with the update file, the reference condensate being acquired by the mobile terminal (10) by secure access to a database including the reference condensate, the treatment of fi update le according to a comparison of the calculated condensate with the reference condensate.
    [2" id="c-fr-0002]
    The method of claim 1, wherein the comparison of the calculated condensate with the reference condensate comprises obtaining (23) a comparison indicator comprising: acquiring (232) the comparison indicator entered by an operator (14), or the automatic implementation (233) of the comparison of the calculated condensate with the reference condensate.
    [3" id="c-fr-0003]
    The method of claim 2, wherein the method further comprises storing the comparison flag.
    [4" id="c-fr-0004]
    4. Processing method according to any one of claims 1 to 3, wherein, when implemented by the mobile terminal (10), obtaining (21) the calculated condensate comprises: the reception (210) of the calculated condensate emitted by the updating unit (11), or the reception (211) of the calculated condensate entered by an operator, or an acquisition (212), based on an optical recognition of the calculated condensate, on a screen of restitution (13) of the aircraft.
    [5" id="c-fr-0005]
    5. Treatment method according to any one of claims 1 to 3, wherein, when implemented by the update unit (11), obtaining (22) of the reference condensate comprises: receiving the reference condensate emitted by the mobile terminal (10), or receiving the reference condensate entered by an operator, or an acquisition, based on an optical recognition of the reference condensate, on a display screen of the mobile terminal ( 10).
    [6" id="c-fr-0006]
    The method of processing of any of the preceding claims, wherein the processing of the update file based on a comparison of the calculated condensate with the reference condensate comprises: the validation of the update file when the calculated condensate is identical to the reference condensate, or the deletion (117) of the update file when the calculated condensate is different from the reference condensate.
    [7" id="c-fr-0007]
    A computer program product comprising software instructions that when implemented by an integrated information processing unit within a processing system comprising a mobile terminal (10) independent of the aircraft, a update unit (11) integrated in the aircraft, and a database (12) remote from the aircraft and the mobile terminal (10), implement the processing method according to any one of the preceding claims .
    [8" id="c-fr-0008]
    8. An electronic device for processing (1001) a file for updating at least one set of computer data of an avionic equipment of an aircraft, the electronic processing device being configured to be integrated in a system of processing an update file, the processing system comprising an independent mobile terminal (10) of the aircraft, an updating unit (11) integrated with the aircraft, and a database (12) remote from the aircraft and the mobile terminal (10), characterized in that the electronic processing device (1001) comprises: a module (104, 114) for obtaining a calculated condensate, associated with the update file, the calculated condensate resulting from the application, by the updating unit (11), of a cryptographic hash function to the update file, a module for obtaining (103) a reference condensate, associated with the update file, the reference condensate being acquired by the mobile terminal (10) by secure access to a database comprising the reference condensate, an update file processing module according to a comparison of the calculated condensate with the condensate of reference.
    [9" id="c-fr-0009]
    9. System for processing a file for updating at least one set of computer data of an avionic equipment of an aircraft, comprising at least one mobile terminal (10) independent of the aircraft, a unit of update (11) integrated in the aircraft, a database (12) remote from the aircraft and the mobile terminal (10), characterized in that: the mobile terminal (10) comprises at least one module of obtaining (103) a reference condensate, associated with the update file, the reference condensate being acquired by the mobile terminal (10) by secure access to a database comprising the reference condensate, the unit of reference update (11) comprises at least one obtaining module (114) of a calculated condensate, associated with the update file, the calculated condensate resulting from the application, by the update unit (11). ), from a cryptographic hash function to the update file , and the mobile terminal (10), or the update unit (11), comprises an update file processing module according to a comparison of the calculated condensate with the reference condensate.
    [10" id="c-fr-0010]
    The processing system of claim 9, wherein the update unit (11) is an electronic unit integrated in the avionics equipment, or a separate electronic unit of the avionics equipment (s) of the aircraft.
    类似技术:
    公开号 | 公开日 | 专利标题
    US10594495B2|2020-03-17|Verifying authenticity of computer readable information using the blockchain
    FR3050555B1|2019-09-27|METHOD OF PROCESSING AN AIRCRAFT AVIONICS EQUIPMENT UPDATE, COMPUTER PROGRAM PRODUCT, ELECTRONIC PROCESSING DEVICE AND TREATMENT SYSTEM THEREOF
    CN108055352B|2021-03-16|System and method for keychain synchronization
    US9537918B2|2017-01-03|File sharing with client side encryption
    CA3041572A1|2017-04-27|System and method for authentication using a mobile device
    WO2017019201A2|2017-02-02|Cryptographic assurances of data integrity for data crossing trust boundaries
    EP3590223B1|2021-01-13|Integrated method and device for storing and sharing data
    FR2989799A1|2013-10-25|METHOD FOR TRANSFERRING A DEVICE TO ANOTHER RIGHTS OF ACCESS TO A SERVICE
    US9137219B1|2015-09-15|Methods and systems for securely managing multimedia data captured by mobile computing devices
    CN111669408A|2020-09-15|Identity registration and authentication method and device
    US10146916B2|2018-12-04|Tamper proof device capability store
    CN111475841A|2020-07-31|Access control method, related device, equipment, system and storage medium
    FR2956941A1|2011-09-02|BIOMETRIC AUTHENTICATION METHOD, AUTHENTICATION SYSTEM, PROGRAM AND CORRESPONDING TERMINAL.
    FR3048530B1|2019-09-06|OPEN AND SECURE SYSTEM OF ELECTRONIC SIGNATURE AND ASSOCIATED METHOD
    US20200084050A1|2020-03-12|Factory data storage and recovery
    US10404697B1|2019-09-03|Systems and methods for using vehicles as information sources for knowledge-based authentication
    US20200111067A1|2020-04-09|Ledger processing system and method
    EP3241137B1|2020-01-01|Method carried out in an identity document and corresponding identity document
    CN110011807B|2021-12-24|Key information maintenance method and system
    US11283791B2|2022-03-22|Method for re-provisioning a digital security certificate and a system and a non-transitory computer program product thereof
    EP3866428B1|2021-12-29|A method for re-provisioning a digital security certificate and a system and a non-transitory computer program product thereof
    KR20210014084A|2021-02-08|Method for providing electoric data using block-chain and system thereof
    FR3038414A1|2017-01-06|METHOD AND SYSTEM FOR CONTROLLING ACCESS TO A SERVICE VIA A MOBILE MEDIA
    FR3073111A1|2019-05-03|METHOD AND DEVICE FOR STORING AND SHARING INTEGRATED DATA
    CN112181975A|2021-01-05|Method and apparatus for creating a database in a data warehouse
    同族专利:
    公开号 | 公开日
    US10452382B2|2019-10-22|
    US20170308371A1|2017-10-26|
    CN107066898A|2017-08-18|
    FR3050555B1|2019-09-27|
    引用文献:
    公开号 | 申请日 | 公开日 | 申请人 | 专利标题
    US20100031050A1|2008-08-04|2010-02-04|Airbus Operations Gmbh|Permanent display and authentication of status information of a technical device|
    EP2557522A2|2011-08-04|2013-02-13|The Boeing Company|Software part validation using hash values|
    US20130227540A1|2012-02-28|2013-08-29|Seagate Technology Llc|Updating peripheral device firmware via a portable device|
    FR3022418A1|2014-06-12|2015-12-18|Airbus|METHOD FOR COMMUNICATING INFORMATION OF AN AVIONIC SYSTEM|
    IES20010666A2|2001-07-17|2002-11-13|Aircraft Man Technologies Ltd|An electronic operations and maintenance log and system for an aircraft|
    US7263521B2|2002-12-10|2007-08-28|Caringo, Inc.|Navigation of the content space of a document set|
    US7774596B2|2005-02-02|2010-08-10|Insyde Software Corporation|System and method for updating firmware in a secure manner|
    CN101636740A|2007-03-19|2010-01-27|富士通株式会社|Service control system, service control method, and service control program|
    US8490074B2|2007-11-27|2013-07-16|The Boeing Company|Aircraft software part library|
    US20100138298A1|2008-04-02|2010-06-03|William Fitzgerald|System for advertising integration with auxiliary interface|
    US8452475B1|2009-10-02|2013-05-28|Rockwell Collins, Inc.|Systems and methods for dynamic aircraft maintenance scheduling|
    US20110145919A1|2009-10-13|2011-06-16|Dafca, Inc.|Method and apparatus for ensuring consistent system configuration in secure applications|
    US8270962B1|2009-10-20|2012-09-18|Sprint Communications Company L.P.|Emergency calls on a wireless communication device during a device reboot|
    US8811616B2|2010-04-12|2014-08-19|Flight Focus Pte. Ltd.|Secure aircraft data channel communication for aircraft operations|
    WO2012030383A1|2010-08-31|2012-03-08|Falconstor, Inc.|Data deduplication|
    US9426652B2|2010-09-09|2016-08-23|Joseph Nutaro|High assurance authorization device|
    JP5949732B2|2013-11-27|2016-07-13|株式会社オートネットワーク技術研究所|Program update system and program update method|
    US9542558B2|2014-03-12|2017-01-10|Apple Inc.|Secure factory data generation and restoration|
    US9311481B1|2014-09-15|2016-04-12|Symantec Corporation|Systems and methods for classifying package files as trojans|
    US20190149322A1|2015-06-12|2019-05-16|Airspace Systems, Inc.|Verifying identity identifier transmitted by an aerial vehicle|
    US9965270B2|2015-07-01|2018-05-08|Quanta Computer Inc.|Updating computer firmware|
    US20170090909A1|2015-09-25|2017-03-30|Qualcomm Incorporated|Secure patch updates for programmable memories|US10846076B2|2016-10-11|2020-11-24|Barfield, Inc.|Remote application update of measurement device field firmware|
    EP3716115A1|2019-03-29|2020-09-30|General Electric Company|Reporting and configuration enhancements of on-board certified software|
    EP3716114A1|2019-03-29|2020-09-30|General Electric Company|Method and system for remote load of on-board certified software|
    CN111970238A|2020-07-09|2020-11-20|北京航空航天大学|Reliable method for controlling safe transmission of near space airship load instruction|
    法律状态:
    2017-04-28| PLFP| Fee payment|Year of fee payment: 2 |
    2017-10-27| PLSC| Publication of the preliminary search report|Effective date: 20171027 |
    2018-04-26| PLFP| Fee payment|Year of fee payment: 3 |
    2019-04-29| PLFP| Fee payment|Year of fee payment: 4 |
    2020-04-30| PLFP| Fee payment|Year of fee payment: 5 |
    2021-04-29| PLFP| Fee payment|Year of fee payment: 6 |
    优先权:
    申请号 | 申请日 | 专利标题
    FR1600665|2016-04-21|
    FR1600665A|FR3050555B1|2016-04-21|2016-04-21|METHOD OF PROCESSING AN AIRCRAFT AVIONICS EQUIPMENT UPDATE, COMPUTER PROGRAM PRODUCT, ELECTRONIC PROCESSING DEVICE AND TREATMENT SYSTEM THEREOF|FR1600665A| FR3050555B1|2016-04-21|2016-04-21|METHOD OF PROCESSING AN AIRCRAFT AVIONICS EQUIPMENT UPDATE, COMPUTER PROGRAM PRODUCT, ELECTRONIC PROCESSING DEVICE AND TREATMENT SYSTEM THEREOF|
    US15/491,621| US10452382B2|2016-04-21|2017-04-19|Method for processing an update file of an avionic equipment of an aircraft, a computer program product, related processing electronic device and processing system|
    CN201710265527.0A| CN107066898A|2016-04-21|2017-04-21|For method, computer program product, related electronic device and the system of the avionic device more new file for handling aircraft|
    [返回顶部]