Local Area Networks (LANs) in Aircraft - FTP Directory Listing - FAA

Figure 31 shows how the recommended architecture addresses many of the network risks that
were previously discussed in section 4.
Securely Limits
Threat Environment:
Controls population
that can access this
Network to that VPN
population only. Other
VPNs have different
address and name
spaces. Each VPN
securely partitions
the network.
VPNs and their Items are
difficult to attack except by
inserting a “man in the middle”,
including compromising the
Encapsulation Gateways.
Encapsulating Gateway policy
together with the Firewall and
Packet Filter policies help
protect VPNs from being
vulnerable to attack.
Provides Airplane network
perimeter defense.
Virtual Private Network
Virtual Private Network
Virtual Private Network
Virtual Private Network
Aircraft Control
Firewal
Level D SW
Level B SW
Level A SW
Passenger Network
Passenger
1
Level C SW
Route
Encapsulation System
Passenger
2
Level D SW
Level C SW
Level B SW
Level A SW
High-Assurance LAN
Packet Filter
High-Assurance LAN
Passenger
N
Aircraft
Ideally needs virtual link
capability to provide
physical layer connectivity
that duplicates the VPN
Connectivity limitations
for Defense in Depth
protection.
QoS and network
assurance that
passengers cannot
address, access, or
Conduct DoS in the
aircraft LAN
Separate LAN for
passengers so
they cannot bypass
the packet filter.
Configured so that only
network management or
IDS devices can send
packets having the router as
the IP destination address.
SW = Software
Figure 31. How Design Addresses Network Risks
107