Local Area Networks (LANs) in Aircraft - FTP Directory Listing - FAA

deployed in higher software level networks (except via HAGs) for defense-in-depth reasons (see
section 8.4).
However, VPNs are distinct partitioned networks within the larger network system. The VPNs
are unaware of the existence of anything outside of their VPN. Each of the VPNs shown within
figure 30 is isolated, unaware of the existence of other entities outside of their own VPN. Other
entities cannot communicate with them and they cannot communicate with other entities—nor
can they know about each other in the general case (see section 8.4). The reason this approach
leverages reference 99 is that it provides for the VPNs themselves to internally grow to become
as arbitrarily large and complex as they need to be in a secure and scalable manner.
Figure 33 shows two additional points that have not yet been discussed. The first is that the
devices within the enclaves are shown in two different network configurations. In the Level A
network example on the left, they are shown as using a common, private physical LAN among
themselves (alternatively, a switch or hub could have been shown). Second, in the Level D
network example, which is on the right side of the figure, they are shown connected via
multihomed interfaces of the encapsulating gateway. The right-hand approach requires the
encapsulating gateway to perform relaying functions within the LAN itself. The left-hand
approach offloads that responsibility from the gateway and also enables support for devices with
real-time or latency-sensitive requirements (e.g., see Requirement 7 in section 8.2).
By performing both the PE and CE functions of figure 34, the encapsulating gateway straddles
two different worlds. Its IP interface to the enclave is addressed in accordance with the IP
addressing policy of that enclave (see figure 33). Its IP interface to the high-assurance LAN is
addressed in accordance with the IP addressing policy of that airplane. If the VPN enclave and
the airplane are addressed from the same IP address space, then that fact is not known to either
the enclave or the airplane. Specifically, the IP address space of each VPN enclave is orthogonal
to the other enclaves and to the airplane. No collision occurs if entities within two different
enclaves (or an enclave and the non-VPN parts of an airplane) have identical IP addresses. The
only requirement is that the nonenclave entities within the airplane need to be addressed from the
same IP address space as is used by the NAS and that each entity within a VPN enclave be
addressed in a manner that is consistent for that specific enclave.
Figure 30 shows that pilot and crew networks are not part of VPN encapsulated enclaves. If the
pilot or crew members need to communicate with entities within an enclave, the device accessed
by the pilot or crew for that communication should be solely attached to that enclave. 33
Alternatively, a HAG could be inserted directly between the enclave (or device) that the pilot or
crew needs to communicate with, and the pilot’s (or crew’s) computer. 34
The mechanism by which VPN partitioning physically is accomplished differs in terms of the
specific protocol layer at which the partitioning controls occur. The approach recommended by
this study does the partitioning at the network layer (layer 3). The recommended partitioning
33
34
Requirement 1 (see section 8.2) requires that enclave-attached entities must never be dual-homed between the
enclave and anything else except via the agency of a HAG (see Requirement 8).
Only encapsulation gateways and HAGs are permitted to be dual-homed between VPN enclaves and the
airplane’s network.
112