Local Area Networks (LANs) in Aircraft - FTP Directory Listing - FAA

exemplar airborne network architecture (see section 8.3) to only be a minimal airborne network
architectural subset that needs to be built upon to satisfy the actual safety and security
requirements of specific NAS and airborne deployments.
The initial steps of the SSE process will be discussed in this section to examine the safety
requirements of a generic networked airborne system environment. As previously observed,
networked environments have both safety and security requirements. Although the SSE
processes were originally intended to address security needs only, this section extends them to
existing FAA (i.e., DO-178B and ARP 4754) safety policies applied within a Biba Integrity
Model context. As explained in section 7, this policy foundation also leverages best current IA
practices as articulated by the IATF, most notably, its defense-in-depth (see section 5.1)
provisions.
The first step in the SSE process is to determine the security policies of a deployment. The
security policies are the current DO-178B and ARP 4754 safety processes mapped in terms of
the Biba Integrity Model framework.
The second step in the SSE process is to determine the security requirements that are derived
from the security policies. Because this study uses existing FAA safety processes mapped to the
Biba Integrity Model framework (i.e., step 1 of the SSE process), the result of this step produces
the following set of safety requirements:
• Requirement 1: Networked entities that are classified at a software level that has
potential safety repercussions to aircraft operation (i.e., Level A through Level D) shall
be partitioned from the larger network environment and combined into a network enclave
that functions at that specific software safety level with other entities classified at the
same safety level (see figures 11 and 14). Networks or items at a different safety level
from each other shall not be able to communicate together (see Requirements 6 and 8 for
two specific exceptions to this general requirement). For example, Level B systems or
software shall not be combined into the same partitioned network enclave with Level C
systems or software.
• Requirement 2: Because Level E software systems have no safety repercussions to the
aircraft, they do not need be partitioned (i.e., formed into common network enclaves).
(Note: the FAA may want to study whether Level D software should be treated as a
Requirement 1 or a Requirement 2 entity. Because this study did not know the most
appropriate way to treat Level D entities, it is tentatively classifying them as Requirement
1 systems.)
• Requirement 3: Physical network media and devices that operate at the physical or data
link layer of the OSI Reference Model (i.e., data link layer and below), deployed within
aircraft, must be assured at the same software (safety) level as the highest software level
entity that they support. For example, if entities operating at software Level A are
conveyed within a physical airborne network, then the media, switches, and bridges that
create that physical network system that transport Level A packets must also be assured
at software Level A.
103