Local Area Networks (LANs) in Aircraft - FTP Directory Listing - FAA

Device at
Safety level X
Device at
Safety level X
Device at
Safety level X
Device at
Safety level X
Networks
operating at
a Safety Level X
Encapsulates
& Encrypts
Encapsulates
& Encrypts
Network operating at
a Safety Level different
than X (i.e., Y)
Device at
Safety level Y
Device at
Safety level Y
Device at
Safety level Y
Figure 27. DO-178B Classifications Using Biba Integrity Model
Figure 27 shows devices operating at safety classification X (e.g., either level A, B, C, D, or E).
These devices operate within a network (e.g., a VPN) functioning at that specific safety
classification level. Network partitioning in terms of safety classifications may implicitly
involve data categorization to the extent that data is directly related to safety distinctions. Figure
27 shows that those networks operating at the same safety level may be discontinuous. For
example, the items located at the top left need to communicate with the items located at the top
right, and vice versa. These discontinuous network segments can be joined by a different
network system operating at a different safety level through encrypting the original packets and
encapsulating them into the protocol headers of the lower network system (see figure 17). The
top networks in figure 27 are the customer site networks mentioned in figure 20. It is a RED
(plain text) network. The bottom (linking) network is the service provider network mentioned in
figure 20. It is a BLACK (cipher text) network—although, as a point of fact, it almost certainly
conveys plain text packets that are operational at its own classification level. The encapsulation
and encryption is performed in accordance with IPsec’s ESP in tunnel mode, which is the
“encapsulates and encrypts” function shown within figure 27. That function is also the
“interface” described in figure 20. The stack chart of the packets from the top network system
(operating at safety level X) appears as is shown in figure 22, when they are conveyed over the
bottom network system of figure 27 (operating at safety level Y). Consequently, one can see this
approach corresponds to both DoD COMSEC and industry VPNs.
VPN encryption should use FIPS compliant encryption algorithms. Protocol encapsulation
ensures that these are logically distinct network systems that are unable to address or interwork
with different logical network systems operating at different safety levels except at the
encapsulation and encryption interface. However, since each interface is specialized to only one
VPN instance (i.e., it physically cannot support multiple RED VPN systems), confusion between
VPNs cannot occur. This is true regardless of whether or not these networks have physically
distinct media systems. Specifically, figure 27 can be interpreted as showing interconnected
networks having three distinct physical media instances (top left, top right, bottom), with the top
two physical media systems operating at the same safety level that is a different safety level than
89