Local Area Networks (LANs) in Aircraft - FTP Directory Listing - FAA

• Requirement 8: Biba Integrity Model HAGs may be strategically positioned, on an asneeded
only basis, to safely join together entities classified at different software levels.
The HAG is specifically designed to address the issues that otherwise would hinder a less
trusted integrity entity to safely communicate with a more highly trusted one in
accordance with Biba Integrity Model precepts. The HAG device is a middlebox that is
inserted between the communicating entities or networks to provide the controls (e.g.,
availability and integrity) necessary to ensure safety between the communicating entities.
The HAG is a highly trusted device. It, therefore, needs to be certified at both the highest
software level of the specific entities it is connecting (for safety) and also at EAL 5 or
above (for security).
These requirements require that a system or software entity be classified at a specific software
level and only communicate with entities classified at that same level via a VPN network also
certified at the same level, in general.
Step 3 of the SSE process is to determine a security engineering plan. The security engineering
plan used for networked airborne systems shall comply with the extended DO-178B and ARP
4754 concepts explained in section 7.
The next steps (steps 4 and 5) of the SSE process are specific to a given deployment. These
steps need to be followed to extend the generic architecture identified by this study into a
specific deployment environment. In step 6, a risk analysis for that deployment is performed.
Section 6.1 presented the result of a risk analysis for generic networked airborne environment.
With the previous steps as background, the SSE process in step 7 then creates a security
architecture. This architecture applies best current IA practice (i.e., IATF) to the resulting
generic system. The resulting security architecture for a generic airborne network environment
is presented in section 8.3.
8.3 EXEMPLAR AIRBORNE NETWORK ARCHITECTURE SOLUTION.
Figure 30 shows a high-level view of a generic network design that this study recommends for
airborne networked environments. This design was constructed by following the SSE processes
(see section 8.2) for the extended DO-1789B and ARP 4754 processes described in section 7.
Specifically, this section provides the generic airborne security architecture defined by SSE
step 7.
105