Local Area Networks (LANs) in Aircraft - FTP Directory Listing - FAA

entire airborne network environment. Network management devices will not be able to
physically view, or even to have knowledge of the physical existence of, any device within a
VPN unless the management station itself is within that same VPN. Therefore, the encapsulation
gateways may optionally support provisions to provide visibility of VPN-resident systems that
they support to network managers located outside of their VPN (e.g., on the common aircraft
LAN) so that a single aircraft network manager can potentially manage all of the devices within
that aircraft. (Note: because highly assured devices cannot be misconfigured, similarly highly
assured devices may not need to be managed either. If this is the case, then the encapsulating
gateways primarily serve to forward status and logging information to the network management
system, including reports of the ongoing software integrity checks.) If this provision is
supported, then strong authentication and authorization protections need to be in place to ensure
that only that management station can manage those devices. Specifically, the system needs to
be designed to prohibit spoofing, or man-in-the-middle vulnerabilities, between the network
manager and the encapsulation gateways by requiring authenticated communications having
strong integrity protections (i.e., required use of the IPsec’s ESP in transport mode between the
manager and encapsulating gateway).
8.3.4 Packet Filter.
The packet filter in the aircraft control must be configured such that noncockpit crew network
cannot address any encapsulation gateway. If the aircraft is using the figure 1 target architecture
(i.e., no air gap between the passenger and avionics systems), then the packet filter needs to
additionally provide the following services:
• No device within the passenger network can access the noncockpit crew network or the
cockpit pilot network. (Note: If the network is configured so that devices in the cockpit
or noncockpit crew network can access entities within the passenger network (e.g., for
network debugging and management), then the filter definitions would probably need to
combine transport layer connections originating from the passenger network with IP
addresses in the cockpit and noncockpit networks rather than solely in terms of IP
address filtering alone. If airlines restrict network management oversight to solely use
TCP transports (which is what the IETF’s ISMS update to SNMPv3 will probably
require), then the restriction could possibly be defined at the packet filter in terms of the
direction of the TCP synchronous (SYN) and require that all user datagram protocol and
other transports be blocked to those addresses.)
• No device within the passenger network can send packets to any encapsulation gateways
(located within aircraft control).
• The packet filter, or a device closely associated with the packet filter comprising a
common system (e.g., QoS middlebox), rate-limits communications from the passenger
network to ensure that passenger communications cannot exceed a certain threshold rate.
This provision attempts to ensure that passengers alone cannot cause a denial of service
attack on the aircraft control’s high-assurance LAN by consuming a disproportionate
share of its capacity.
116