Abstract:
Data-processing apparatus ( 30; 320 ) receives (step  160 ) data from a data server ( 20 ) in a single shot. The apparatus ( 30; 320 ) performs a management check (steps  170, 180, 190 ) on the data, in which the data is checked for compliance with at least one pre-defined criterion. The data and the results of the management check are recorded (step  200 ). At least one recipient for the data is identified (step  210 ). The data is processed to conform it to at least one requirement of each identified recipient (step  220 ). The processed data is delivered to the recipient (step  230 ).

Description:
FIELD OF THE INVENTION 
       [0001]    This invention relates to an apparatus for, and a method of, processing data provided by a data server, and in particular to an apparatus for, and a method of, processing data provided by a data server in a single shot. 
       BACKGROUND OF THE INVENTION 
       [0002]    Some modern vehicles, for example modern military aircraft, are complex entities. The complexity and cost of the vehicles leads vehicle designers to incorporate many sensors into the vehicle, to monitor the vehicle&#39;s operation, condition, performance, to assist with training, and the like. Information produced by that monitoring can be processed in real-time as it is generated or it can be recorded as it is generated, with processing done later on the recorded data. 
         [0003]    For example, the F-35 Lightning II aircraft generates sensor data that is transmitted, as the data is generated, to a ground-based data server. Each data server typically receives data from a plurality of aircraft, and is referred to as a Squadron Operating Unit (SOU). When the data is to be processed, it is supplied from the SOU to data-processing apparatus. The data is supplied to the data-processing apparatus on a queued basis, i.e. data is in effect cached in the SOU until a communications path is available, and when a communications path is available, data is sent down it in a “single shot”, with no resending possible and no acknowledgement of successful transfer being supplied. 
         [0004]    Many stakeholders, for example in the military, in national government departments and in industrial companies, are involved in the operation and manufacture of a complex entity such as the F-35 Lightning II. It is advantageous, for many of those stakeholders, to receive portions of the data recorded in the SOU that relate to their specific interest in the aircraft, e.g. relating to the part or parts that they manufacture or maintain, relating to operational issues, relating to training, or relating to refitting. The data is processed in a processing unit, housed with the SOU, in order to provide stakeholders with data in a form predetermined by the SOU. To achieve maximum operational capability in future operations, interoperability of the F-35 within operational environments is critical. Therefore, an effective and interoperable F-35 information environment is key to sustaining F-35 Lightning II operational effectiveness. 
         [0005]    The single-shot nature of the delivery of data from the SOU to the processing apparatus raises particular difficulties. In particular, as it is not possible to obtain the data for a second time, it is difficult to identify errors arising from processing of the data. 
         [0006]    Accordingly, it would be advantageous to provide an apparatus for, and a method of, processing data provided by a data server in a single shot, in which one or more of the aforementioned disadvantages is eliminated or at least reduced. 
       DISCLOSURE OF THE INVENTION 
       [0007]    A first aspect of the invention provides a method of handling data received in a single shot from a data server, the method comprising a data-processing apparatus:
       i. receiving the data from the data server in a single shot;   ii. performing a management check on the data, in which the data is checked for compliance with at least one pre-defined criterion;   iii. recording the data;   iv. recording the results of the management check;   v. identifying at least one recipient for the data;   vi. processing the data to conform it to at least one requirement of each identified recipient; and   vii. delivering the processed data to the recipient.       
 
         [0015]    As described above, “single shot” transfer of data means that data is supplied to the data-processing apparatus on a queued basis, the data being cached until a communications path is available, and when a communications path is available, the data being sent, with no resending possible and no acknowledgement of successful transfer being supplied. It will be understood that, for security reasons, the data will usually not be broadcast from the data server. For example, the data may be sent from the data server to the data processing apparatus by a direct one-to-one communications link. It may be that in step iii the data is recorded in the same format as it is received in step i. Preferably, the data is kept in the same format throughout all of the steps of the method. For example, it may be that no data is added, removed or otherwise re-formatted. That is advantageous because the processed data delivered to the recipient is in the same format as the data originally received from the data server. That eliminates the risk of errors being introduced into the data as a result of conversion of the data from one format into another. It is important to reduce the risk of error in the data, especially if the data is to be used to make decisions or, for example, for forensic investigation after an incident. For example, the data may be in XML format. 
         [0016]    The method may also comprise the prior step of receiving the data from a vehicle and storing said data on the data server. It may be that the vehicle is an aircraft. It may be that the vehicle is a military vehicle, for example a military aircraft. It may be that the vehicle is an F-35 Lightning II aircraft. It may be that the received data is mission data and/or maintenance data. It may be that the received data is relevant to training, maintenance, health management, operations or supply chain management relating to the vehicle. 
         [0017]    It may be that transfer of the data to the data server, from the data server and/or to the recipient is according to the Simple Object Access Protocol (SOAP), Message Orientated Middleware (MOM) (e.g. Java Message Service JMS), Representational State Transfer (REST), or another publicly available data transfer protocol. 
         [0018]    It may be that the data server is a secure data server. A secure data server is a data server designed or configured to be more secure than a typical commercial data server. The data server may be a virtual server. The data server may be a server forming part of a network of computers. It may be that the data server is a military data server. It may be that the data server is an isolated server, i.e. it may be that there is no direct communications link by which data can be removed from the data server (i.e. all data, including data to be served to other computers, is removed over an “air gap”). It may be that the data server forms part of an isolated network of computers. It may be that data may only be removed using removable media, for example a writable CD or DVD, a memory drive, a removable hard-drive, and/or using a portable computer (e.g. a laptop) that is connected to the data server. 
         [0019]    It may be that steps i to vii of the method are carried out in the sequence set out above. 
         [0020]    The management check is a check that the data complies with one or more pre-determined rules concerning the structure or content of the data. The data is interrogated by the data processing apparatus to carry out the management check. 
         [0021]    It may be that the management check comprises a check that the data is in a valid format. For example, the management check may comprise a check that the data is structured in a predetermined format. It may be that the management check comprises checking the content of the data. For example, the management check may comprise a check that the data does not contain a virus or other malware and/or a check that the data does or does not contain particular predetermined words. 
         [0022]    It may be that the method further comprises the step of adding information to the data to demonstrate that the integrity of the data has not been compromised. For example, the method may comprise addition of a digital signature and/or a calculated checksum, for future checking. Provision of information for an integrity check enables, for example, checking for data corruption occurring during transfer of the data and checking that no additional, unwanted data has been inadvertently or deliberately injected into the data. 
         [0023]    It may be that the data is recorded in an archive. 
         [0024]    It may be, for example, that the at least one recipient for the data is identified by the data-processing apparatus locating in a database the identity of at least one person to whom the received data is to be delivered. It may be that the database also contains the at least one requirement of each identified recipient. 
         [0025]    It may be that, in step vi, the data is processed to conform it to a requirement as to what the processed data delivered to that recipient must contain. It may be that, in step vi, the data is processed to conform it to a requirement as to how the processed data delivered to that recipient must be presented. The data requirement may be that the data is formatted in a predetermined format. For example, the requirement may be that the data is delivered in html format. For example, the requirement may be that the data is colour-coded according to a value in the data. 
         [0026]    It may be that a plurality of recipients for the data is identified, and that at least two of the recipients have different requirements to which the data must be processed to conform. 
         [0027]    It may be that the processed data is delivered to the recipient over a telecommunications link. It may be that the telecommunications link is a secure telecommunications link. Alternatively, it may be that the processed data is delivered to the recipient using removable media, for example a writable CD or DVD, a memory drive, a removable hard-drive, and/or using a portable computer (e.g. a laptop) that is connected to the data server. 
         [0028]    A second aspect of the invention provides a computer program product configured to cause a computer to carry out the method of the first aspect of the invention. 
         [0029]    A third aspect of the invention provides a data-processing apparatus for handling data received in a single shot from a data server, the apparatus being configured to:
       i. receive the data from the data server in a single shot;   ii. perform a management check on the data, in which the data is checked for compliance with at least one pre-defined criterion;   iii. record the data;   iv. record the results of the management check;   v. identify at least one recipient for the data;   vi. process the data to conform it to at least one requirement of each identified recipient; and   vii. deliver the processed data to the recipient.       
 
         [0037]    It may be that the data-processing apparatus is connected to the data server over a wired connection, e.g. a network cable. 
         [0038]    In some applications, particularly in military applications, it is important to control the flow of data between computer systems. International patent application no. PCT/GB2008/050914, published as WO2009/047556A1, describes “data diodes”, which allow data to flow in one direction (for example from a lower security classification system to a higher security classification system) but not in the other direction (which could for example compromise the security of the higher security classification system). It may be that the data-processing apparatus includes a data diode. It may be that the processed data is delivered to the recipient via the data diode. Thus, it may be that the processed data can flow through the data diode to the recipient, but no data can flow in the other direction. It may be that the data diode is a network data diode; that is, a data diode having a first network port and a second network port and a signal transmit path between the first network port but no signal return path between the first network port and the second network port. 
         [0039]    A fourth aspect of the invention provides a data-processing apparatus for handling data received in a single shot from a data server, the data-processing apparatus being configured to:
       a. connect to the data server over a communication link, the communication link being able to pass data from the server to the computer, but not being able to pass data from the computer to the server;   b. receive the data from the data server in a single shot;   c. perform a management check on the data, in which the data is checked for compliance with at least one pre-defined criterion;   d. record the data; and   e. record the results of the management check.       
 
         [0045]    It may be that the data-processing apparatus is connected to the data server over a wired connection, e.g. a network cable. 
         [0046]    As indicated above, in some applications, particularly in military applications, it is important to control the flow of data between computer systems. International patent application no. PCT/GB2008/050914, published as WO2009/047556A1, describes “data diodes”, which allow data to flow in one direction (for example from a lower security classification system to a higher security classification system) but not in the other direction (which could for example compromise the security of the higher security classification system). It may be that the data-processing apparatus includes a data diode. It may be that the connection to the data server is made via the data diode, thus providing the communication link able to pass data from the server to the computer, but not able to pass data from the computer to the server. It may be that the data diode is a data diode having the structure and function of a data diode described in WO2009/047556A1. The features of the structure and function of data diodes set out in WO2009/047556A1 are hereby incorporated by reference into the present specification. 
         [0047]    For example, it may be that the data diode is a serial data diode, for example for universal asynchronous receiver transmitter (UART) serial ports operating for example in the RS232 voltage signaling standard. Alternatively, it may be that the data diode comprises a USB data port; for example, it may be that the data diode comprises: a USB data input port; a first serial data port comprising a positive signal transmit pin and a negative signal transmit pin; USB to UART signal conversion means communicatively coupled between the USB data input port and the first serial data port and operable to convert an input USB data signal into a serial data signal in a desired serial data standard; and a second serial data port comprising a positive signal receive pin and a negative signal receive pin, the positive signal transmit pin being coupled to the positive signal receive pin and the negative signal transmit pin being coupled to the negative signal receive pin, such that there is no return signal path from the second serial data port to the first serial data port. The serial data port pins may be electrically coupled or may be optically coupled. The USB data diode may further comprise a data diode housing in which the USB data input port, the first and second serial data ports, and the USB to UART signal conversion means are provided, the first and second serial data ports being provided within the housing in a locally spaced relationship. Alternatively, the USB data diode may further comprise a data diode input housing and a data diode output housing, the USB data input port, USB to UART conversion means and first serial data port being provided within the input housing and the second serial data port being provided within the output housing. The USB data diode preferably further comprises a coupling cable extending between the input housing and the output housing and adapted to couple the serial data port pins. The USB data diode preferably further comprises a USB data output port and second USB to UART signal conversion means communicatively coupled between the second serial data port and the USB data output port and operable to convert an input serial data signal into a USB data signal. The USB data output port and the second USB to UART signal conversion means are preferably provided in the data diode housing or the data diode output housing. The USB data diode may alternatively further comprise a peripheral component interconnect serial computer bus integrated circuit communicatively coupled to the second serial data port. The or each USB to UART signal conversion means preferably comprises a USB to UART converter integrated circuit. The or each USB to UART signal conversion means preferably further comprises programmable memory means, most preferably an electrically erasable programmable read only memory device. The or each USB to UART signal conversion means preferably comprises USB to RS422 or RS485 signal conversion means. 
         [0048]    It may be that the data-processing apparatus is or includes a laptop, tablet or other portable computer. 
         [0049]    It will of course be appreciated that features described in relation to one aspect of the present invention may be incorporated into other aspects of the present invention. For example, the data-processing apparatuses of the invention may incorporate any of the features described with reference to the method of the invention and vice versa. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0050]    Example embodiments of the invention will now be described by way of example only and with reference to the accompanying drawings, of which: 
           [0051]      FIG. 1  is a schematic illustration of apparatus of an example embodiment of the invention; 
           [0052]      FIG. 2  is a block diagram of steps in a method of an example embodiment of the invention; 
           [0053]      FIG. 3  is a schematic illustration of apparatus of a first alternative example embodiment of the invention; 
           [0054]      FIG. 4  is a schematic illustration of apparatus of a second alternative example embodiment of the invention; 
           [0055]      FIG. 5  is a schematic illustration of apparatus of a third alternative example embodiment of the invention; and 
           [0056]      FIG. 6  is a schematic illustration of apparatus of a fourth alternative example embodiment of the invention. 
       
    
    
     DETAILED DESCRIPTION 
       [0057]    An example embodiment of the invention ( FIG. 1 ) includes data extraction apparatus  10  and end-user apparatus  50 . The data extraction apparatus  10  includes a data server in the form of a Squadron Operating Unit SOU  20 . The SOU  20  has a network port  27 . The data extraction apparatus  10  also includes a first Information Data Exchange (IDE) unit  30 , having a first network port  33  and a second network port  38 , and a USB port  35  for receiving a USB data store  40 . The first network port  33  of the first IDE unit  30  is connected via a network cable  22  to the network port  27  of the SOU  20 . 
         [0058]    Data (in this example mission data and maintenance data) is received from an aircraft (not shown). The data is stored on the SOU  20 . The data is received from the SOU  20 , via cable  22 , by the first IDE unit  30  as a SOAP message in XML format. (The first IDE unit  30  is also capable of receiving data on USB data store  40 .) Within the first IDE unit  30 , the data is processed according to the method described further below. The data processing results in one or more messages for one or more end-users. In this example, each message includes at least a portion of the processed data (different end users may receive different portions). Each of the one or more messages is transmitted to the relevant end-user via a telecommunications link, in this example, a second network cable  22 ′, or a USB data store  40 . 
         [0059]    The end-user system  50  comprises a computer  60 . The computer  60  is connected to the first IDE unit  30  by the second network cable  22 ′. 
         [0060]    The method carried out in the first IDE unit  30  is shown in  FIG. 2 . The method is carried out by an application  100  which uses a database  110 , an application server  120 , and a message queue  130 . The database  110 , application server  120  and message queue  130  run within an operating system  140  operating on a hardware platform  150  (in this example, the hardware platform  150  is the first IDE unit  30 ). 
         [0061]    The data is received from the SOU  20  by the application  100  (receive step  160 ). The application  100  performs a validation check on the format of the stored data (validate step  170 ), checking for example that the data has the correct fields (e.g. that it is a .csv file having the expected number of columns). The application  100  then checks the data for specific content (content check step  180 ), performing, in this example a virus check, a check that the data does not include file types that may contain malware (e.g. password-protected files, files containing macros) and a check that the data does not include particular blacklisted words (e.g. words indicating that the data has security classification higher than the SOU  20  is permitted to handle). The application  100  then adds integrity data to the data, to guard against compromise of the data during subsequent transmission (integrity step  190 ). In this example, a digital signature is added to the data, and a checksum is also calculated and added to the data. The application  100  then records that the data has been received and records the results of the validate step  170 , content check step  180 , and integrity check  190  (record step  200 ). If the data fails any of the checks then it is quarantined for examination by a user. If correction or manual approval is possible, the data is then fed back into the chain of steps  160 - 230 . 
         [0062]    The application  100  next identifies the end users who are to receive the data and creates a message, including the data, and adds it to the message queue  130  (distribute step  210 ). The application then processes the data according to the needs of each of the identified end users (process step  220 ). For example, a US-based end user may require quantities to be stated in gallons, whereas a European-based end user may require the same quantities to be stated in litres; such adjustments are made in the processing step  220 . Finally, the application  100  delivers the data from the message queue  130  by onward transmission to the end users (step  230 ) over the second network cable  22 ′. In this example, the data is transmitted on to the end user as a SOAP message. 
         [0063]    Note that, throughout the steps  160 - 220  of the method, the data remains in XML format. The data stored in the record step  200  also remains in that format. By storing the data in the raw format in which it was received, the risks of corruption during format conversion, or due to a change of schema, is eliminated. 
         [0064]    In this example, if the message is delivered to the end-user system  50  on a USB store  40 , the USB store  40  is plugged directly into the computer  60 . 
         [0065]    In data extraction apparatus  10 ′ of a first alternative example embodiment ( FIG. 3 ), a portable configuration is provided. The first IDE unit  30  receives and processes messages from the SOU  20 , as described above. However, rather than transmitting the messages over a telecommunications link, the first IDE unit is physically relocated to the end-user&#39;s network, where it is incorporated into the end-user apparatus  50 ′ by connection to computer  60  via the second network cable  22 ′. 
         [0066]    In data extraction apparatus  10 ″ of a second alternative example embodiment ( FIG. 4 ), the first IDE unit  30  is connected to the SOU  20  as described with regard to the preceding embodiments. However, the end user apparatus  50 ″ includes a second IDE unit  30 ′, which is connected, from its second network port  38 ′. to the computer  60  by the second network cable  22 ′. The first IDE unit  30  is connected to the second IDE unit  30 ′ via telecommunications link  39  between the second network port  38  of the first IDE unit  30  and the first network port  33 ′ of the second IDE unit  30 ′. 
         [0067]    In this example, the example method discussed above with regard to  FIG. 2  is carried out in the first IDE unit  30 . However, some of the steps of the method are carried out again in the second IDE unit  30 ′. In particular, the receive step  160 , validate step  170 , content check step  180  and record step  200  are repeated. In the integrity step  190 , the digital signature and checksum applied by the first IDE  30  are checked. The checks are carried out in the second IDE unit  30 ′ to guard against the possibility that the data has been corrupted or interfered with during its transmission over the telecommunications link. 
         [0068]    The second IDE unit  30 ′ receives the message and passes it, via the network cable  22 ′, to the computer  60 , where it is processed further according to the needs of the end user. 
         [0069]    In the case in which the message from the first IDE unit  30  is transmitted via a USB store  40 , the USB store  40  carrying the message is plugged directly into the computer  60 . In other example embodiments, there may be less confidence that the USB store  40  has been transported from the SOU in a secure manner, or the security requirements of the end-user system  50 ″ may be higher, and so then messages delivered by transfer of a USB store  40  will also be subject to a second application of at least some of the checks. 
         [0070]    In a third alternative example embodiment of the invention ( FIG. 5 ), the arrangement is identical to that of  FIG. 4  save that telecommunications link  39  passes through a network data diode  70 . The data diode is configured to allow data to pass from the data extraction apparatus  10 ′″ to the end-user apparatus  50 ′″ but to make it impossible for data to travel in the opposite direction. Use of the network data diode  70  protects the data extraction apparatus  10 ′″, which is a higher-security system, from possible compromise from the end-user apparatus  50 ′″, which is a lower-security system. Network data diode  70  is connected to the second network port  38  of the first IDE unit  30  by first cable portion  39 ′ and to the first network port  33 ′ of the second IDE unit  30 ′ by second cable portion  39 ″. 
         [0071]    In data extraction apparatus  310  of a fourth alternative example embodiment ( FIG. 6 ), the data is extracted from the SOU  20  using a laptop  320 . The laptop  320  has a USB port  333  that is connected via a USB cable  330  to a USB data diode  338 . The USB data diode  338  is, in turn, connected via a USB cable  322  to a USB port  327  of the SOU  20 . 
         [0072]    The USB data diode is configured to allow data to be transferred in only one direction, from the SOU  20  to the laptop  320 . Transfer of data in the other direction, from the laptop  320  to the SOU  20  is not possible. 
         [0073]    The laptop  320  runs an application that receives data from the data server  20  in a single shot. The application then performs validate checks, content checks and integrity checks on the received data, as in the embodiment, described above. The application then records the data and the results of the management check. 
         [0074]    Unlike in the embodiment described above, in this example the distribute step  210 , process step  220  and deliver step  230  are not carried out at this stage. Rather, the laptop  320  is disconnected from the SOU  20  and removed to a remote site, where it is connected to remote apparatus  450 . The SOU  20  is controlled by the operators of the aircraft from which the data originates, whereas the remote site is controlled in this example by a supplier of a system incorporated in the aircraft. At the remote site, the laptop  320  is connected, via its USB port  333  and a USB cable  322 ′ to a USB port  360  of a computer  400  of the supplier. The data is transferred from the laptop  320  to the computer  400 . On the computer  400 , a second application processes the data to conform to the needs of the supplier, and makes the processed data available for display or printing. 
         [0075]    Whilst the present invention has been described and illustrated with reference to particular embodiments, it will be appreciated by those of ordinary skill in the art that the invention lends itself to many different variations not specifically illustrated herein. 
         [0076]    Where in the foregoing description, integers or elements are mentioned which have known, obvious or foreseeable equivalents, then such equivalents are herein incorporated as if individually set forth. Reference should be made to the claims for determining the true scope of the present invention, which should be construed so as to encompass any such equivalents. It will also be appreciated by the reader that integers or features of the invention that are described as preferable, advantageous, convenient or the like are optional and do not limit the scope of the independent claims. Moreover, it is to be understood that such optional integers or features, whilst of possible benefit in some embodiments of the invention, may be absent in other embodiments.