Local Area Networks (LANs) in Aircraft - FTP Directory Listing - FAA

the bottom network system. However, figure 27 can also be interpreted as showing a network
having the same ubiquitous physical media subdivided into logically different network elements.
In the latter case, the top left, top right, and bottom all use the same physical media. In this case,
different logical network systems, each having effective network security and isolation through
protocol encapsulation, have been created from the same physical system. This latter
observation is directly applicable to aircraft systems sharing a common LAN system. That is,
COMSEC and VPN techniques permit the creation of partitioned network systems even when
sharing a common physical network.
This study recommends using the Biba Integrity Model to extend current FAA policies into
arbitrarily complex networked environments because it is a formal model on the par with the
DoD’s Bell-LaPadula Confidentiality Model and also because it creates structures that are the
direct analog of the Bell-LaPadula Confidentiality Model. Other security models are also
available, including other integrity models (e.g., the Clark-Wilson Integrity Model). Similarly,
the FAA could invent a security model of its own, including performing the necessary
mathematical proofs. Any of these are valid alternatives for the FAA to consider. What is not a
valid alternative is to attempt to extend ARP 4754 into networked environments without using a
viable formal mathematical model (e.g., a security model) of some sort. Any such extension
would necessarily be ad hoc and produce results that cannot be trusted to be safe.
6.5 RELATING SAFETY CLASSIFICATION LEVELS TO THE CC.
The exemplar network architecture described in section 8.3 relies upon security controls (e.g.,
firewall, packet filter, ASBR, VPN encapsulation gateways, and HAGs) to provide security
protections for the networked system so that the resulting system is assured to operate at a
specific safety level. Section 6.4 explained that airborne networks operate at specific safety
levels as defined by FAA policy (e.g., DO-178B and ARP 4574) and enforced by the Biba
Integrity Model. Therefore, for certification purposes, the integrity of these security controls
must be mapped to the appropriate DO-178B safety level. This implies that these security
controls can be evaluated in terms of specific DO-178B safety level assurances for the Biba
Integrity Model provisions to be viable. This section discusses this issue.
The FAA has sponsored a growing body of work evaluating common security and safety
processes and systems [41 and 72, 73, and 76]. This issue directly impacts aircraft that need to
be dual certified by both the FAA (for safety) and DoD (e.g., the U.S. Air Force; for security).
However, this issue is also of a more generic interest. For example, the DoD, in addition to
defining their information systems in accordance with security (i.e., confidentiality in particular)
constructs, is also concerned with safety issues, which are defined in terms of MIL-STD-882D
[90]. MIL-STD-882D shares many similarities with existing civil aviation concepts including a
similar safety five-level classification system.
Although safety and security are very distinct concepts, they share some common attributes that
permit them to be compared (and equated) in several different ways. For example, the FAA and
the DoD have created comparable certification environments having similar concepts of
assurance. Both safety and security also have similar integrity attributes that may be leveraged
90