Local Area Networks (LANs) in Aircraft - FTP Directory Listing - FAA

appendix A. This parallelism means that ground systems would also need to address the same
network management issues (see section 8.4).
The exemplar network architecture recommended by this study, therefore, presumes that if
airborne VPN enclaves are connected to other airborne VPN enclaves or to ground VPN
enclaves at the same software (safety) level, then those linked VPN enclaves form a common
distributed VPN network enclave together that jointly operates at that specific safety level. The
specific VPN technology identified by this study was chosen because it is expected to be able to
scale to whatever VPN network size is required to support a worldwide deployment. It is
important to recognize that this connectivity means that the worldwide aeronautical network
consists of both the nonenclave worldwide aeronautical network as well as the various
worldwide VPN network enclaves, with each of the latter operating at a specific safety level. It
therefore comprises partitioned network enclaves located within a larger civil aviation network
whole.
This relationship creates explicit policy issues that the worldwide civil aviation community will
need to address in a coherent way. Specifically, what is the trust model between civil aviation
regions? Will the trust model for the regions’ Level A software networks be the same as for
their Level C software networks? What is the trust model between aircraft and ground entities?
If air-to-air communications occur, what is the trust model between aircraft belonging to
different airlines? Will the Level A VPN components of the NAS completely trust European
Level A VPN components and vice versa, or will they establish distinct policies and service level
agreement (SLA) mappings between their components? What security protections (e.g.,
firewalls) will be inserted to protect the rest of the VPN elements at that safety level from a
contamination that occurred within a specific region? How will aircraft that travel between
regions maintain their connectivity in a seamless, safe, and secure manner? If air-to-air
applications and systems are created, what mechanisms (e.g., firewalls) will protect the VPN at a
given safety level in one airplane from (perhaps undiagnosed) misbehaviors occurring in the
VPN at that same safety level in a different airplane? What policy systems will govern the
interrelationship between aircraft and ground entities? Will SLAs be required?
For any airborne network architecture to be viable in real-life deployments, common worldwide
design choices need to be agreed upon to decide how identity, IP addressing, naming, routing,
and authentication will be handled systemwide. These common definitions and their associated
infrastructure should be shared by both air and ground systems within the worldwide civil
aviation network deployment if the resulting airborne network is to operate seamlessly between
regions.
8.3.2 Physical Security.
Specific physical security requirements are embedded within the figure 30 design. Those
requirements are that aircraft control and the cockpit (pilot) networks or their devices must not
be physically accessible by aircraft passengers. If there is any possibility of passengers
physically accessing the cockpit (pilot) network, then the high-assurance LAN within the cockpit
must be connected to the aircraft control network via the packet filter. Otherwise, the highassurance
LAN in the cockpit can use the same physical high-assurance LAN as aircraft control.
114