Reduction of the attack surface in a communications system

A method for routing data packets from or to at least one electronic control unit, referred to as outgoing packets, respectively incoming packets, said at least one electronic control unit being connected to a communications system via a first interface, said communications system being connected via a second interface to a modem configured to transfer said outgoing packets and said incoming packets to, respectively from, at least one telecommunications network via a plurality of access points, each access point being secure or non-secure, and being associated with an electronic control unit, the method being executed by the communications system and comprising:

• incoming processing;
• and/or
• outgoing processing,
• in which the incoming processing comprises:
• first receiving, via the second interface, an incoming packet and an identifier of an access point via which said incoming packet has been received by the modem from said telecommunications network, referred to as reception access point;
• first determining a type for the reception access point;
• when said reception access point is of the non-secure type,
• first identifying an electronic control unit corresponding to the reception access point, referred to as recipient unit;
• and
• first transferring said incoming packet to the recipient unit at a data link layer of a TCP/IP protocol stack, via the first interface, without involving a TCP/IP layer;
• and
• when said reception access point is of the secure type,
• first processing of said incoming packet by a TCP/IP telecommunications protocol stack executed by the communications system;
• and
• in which the outgoing processing comprises:
• second receiving, via the first interface, an outgoing packet from an electronic control unit, referred to as source unit;
• second identifying an access point corresponding to the electronic source unit, referred to as transmission access point;
• second determining a type for the transmission access point;
• when said transmission access point is of the non-secure type, second transferring said outgoing packet and an identifier of said transmission access point at a data link layer of a TCP/IP protocol stack, to the modem, via the second interface, without involving the TCP/IP layer of said stack;
• and
• when said transmission access point is of the secure type, second processing of said outgoing packet by a TCP/IP telecommunications protocol stack executed by the communications system.