Local Area Networks (LANs) in Aircraft - FTP Directory Listing - FAA

• Requirement 4: Entities that are located outside of aircraft (e.g., ground-based, spacebased
(e.g., satellite), other aircraft)) that directly or indirectly communicate with
elements within the airborne system at Level A through Level D (i.e., Requirement 1
systems) must belong to the same distributed network enclave partition as the airborne
software or system with which they are communicating (see figures 27 and 30). These
entities therefore need to either have been certified and accredited at that software level
or else be connected to that software level (VPN) network via a Biba Integrity Model
HAG (see Requirement 8).
• Requirement 5: The physical network system elements that connect the airborne network
elements with other entities located outside of that aircraft (see Requirement 4), need to
comply with the same requirements that pertain to aircraft physical network systems (i.e.,
Requirement 3).
• Requirement 6: If a software system (e.g., a combination of software entities) primarily
or exclusively communicates in a tight relationship within their select group and the
group is comprised of entities at different software levels, then that tight-knit, cross-level
community can be combined into a partitioned network enclave together (e.g., integrated
modular avionics systems). That localized enclave operates in a system-high manner.
There needs to be a special extenuating process or policy established within that enclave
to enable a system-high situation to exist, since it represents an exception to the most
direct application of the Biba Integrity Model, which naturally results in MSLS
partitioned networks (i.e., see Requirement 1). System high networks are classified at the
software level of the lowest classification level entity within that grouping and are
distinct network enclave partitions from MSLS partitioned enclaves (i.e., Requirement 1
systems).
• Requirement 7: It needs to be noted within the assurance process whenever a system or
software entity has safety-related network connectivity requirements or dependencies
with any other system or software entities. Specifically, it should be noted if entities
have real-time, latency-sensitive, or high-availability connectivity requirements with
specific other entities. If the network enclave that supports those entities cannot be
assured to satisfy those network connectivity requirements, then those elements can be
supported via a dedicated data bus (or LAN) that solely exists to meet that connectivity
requirement. 32 If a dedicated physical data bus needs to communicate with other LANs or
data buses, then the dedicated physical data bus is linked to that other physical network
via a router (i.e., a relay device operating at the network (i.e., IP) layer only).
32
The reason for the dedicated data bus (or LAN) is to ensure that the special network requirements of those
devices will be met. It is of course preferable if their requirements can be met in the normal manner (e.g., via a
common high-assurance LAN). However, this requirement exists to say that it is okay to provide special data
bus connectivity for certain devices having requirements that absolutely require dedicated physical data buses or
LANs.
104