Local Area Networks (LANs) in Aircraft - FTP Directory Listing - FAA

8.3.5 Firewall.
The firewall needs to be configured as exclusively as possible. Because of the presence of
passengers in the network in the figure 1 target, the HTTP overt channel vulnerability (see
section 4.1 and appendix A.1) unfortunately cannot be fully mitigated, unlike the figure 3 target
alternative. However, if aircraft design restricts pilot and crew communications such that they
never use HTTP, then the firewall can be configured so that HTTP traffic (i.e., both Port 80 and
Port 443) is filtered by the firewall whenever the packet’s destination address is a nonpassenger
device. Such a rule would provide aircraft devices helpful protection in figure 1 environments.
Even if the pilot and crew were only permitted to use secure HTTP (i.e., Port 443), then at least
the more dangerous Port 80 transmissions could be filtered. In any case, the firewall needs to be
configured with the following considerations.
• All fingerprinting attempts (see appendix A.1) originating from outside of the aircraft to
any entity within the aircraft will fail (except for those that occur through the HTTP overt
channel for figure 1 environments).
• All communications to encapsulation gateways from outside of an airplane are blocked
by the firewall unless they use IPsec’s ESP. (Note: both the firewall and the
encapsulation gateways themselves need to redundantly enforce this same rule for
defense-in-depth reasons.)
• The firewall should also drop all packets originating from outside of the aircraft to IP
destination addresses that are not deployed within the aircraft LAN. The firewall does
not have visibility into VPNs since it only sees their encapsulating packet headers, which
are solely addressed to encapsulation gateways.
It is desirable that an NIDS be associated with the firewall system if SWAP considerations
permit and that the NIDS be configured to recognize attack footprints and to optionally send
alerts to designated crew members or ground systems alerting them when certain types of attacks
occur.
8.3.6 The ASBR Router.
In forthcoming air-to-ground digital communications systems, such as an IP variant of the ATN,
internal aircraft routing will need to be associated with routing elements outside of the airplane
for air-to-air and air-to-ground communications to occur. The specific mechanisms by which
this will occur will be an integral part of the communication system itself. Since this network
system has not yet been defined at the time of this writing, this report will speak of this
relationship as if it were to occur between AS. In such a system, the aircraft would use an ASBR
within the aircraft to communicate to external networking elements.
The ASBR, which is not shown in figure 30, must be present on the airplane to provide BGP
connectivity with the remote air and ground networks with which the airplane is communicating.
The airplane’s ASBR should be configured such that all packets that are sent with an ASBR’s
network interface as the IP destination address should be dropped unless they use IPsec in
117