Local Area Networks (LANs) in Aircraft - FTP Directory Listing - FAA

transport mode and come from a network management station or IDS device that is local to that
airplane.
8.3.7 High-Assurance LAN.
The high-assurance LAN should consider the restrictions and provisions specified by the “Safety
and Certification Approaches for Ethernet-Based Aviation Databuses” document [9]. The virtual
link capability that is available within avionics full-duplex switched (AFDX) [102-104]
deterministic Ethernet makes that technology an attractive alternative to serve as the highassurance
LAN. The high-assurance LAN should be configured, if possible, to provide physical
layer connectivity that duplicates the VPN enclave configurations as a defense-in-depth
provision. This means that enclaves would be defined and protected by two complementary
controls: the physical (OSI physical layer) connectivity restrictions by the high-assurance LAN
and the protocol restrictions at the IP Layer enforced by VPN encapsulation and encryption.
The SWAP footprint of the airborne LAN system could be theoretically reduced by logically
creating the multiple instances of high-assurance LANs shown in figure 30. Specifically, the
many high-assurance LAN entities within figure 30 may actually be two physical LANs, with the
remainder logically created by means of AFDX virtual links. However, the entire LAN system
should not be limited to a single physical LAN because the passenger network needs to be a
distinct physical LAN entity from all other LANs on the airplane. This latter requirement exists
so that there could be no possibility to misconfigure the network and bypass the packet filter
controls that need to be applied to passenger services in figure 1 deployments.
8.3.8 Quality of Service.
It is desirable for the virtual links to support QoS rate control semantics. This may be
accomplished at the physical layer through explicit rate controls or, more probably, at the
network layer (i.e., IP Layer) through deploying differentiated service QoS (see RFC 2474).
However it is accomplished, the communications within the safety enclaves must be ensured to
have the capacity that they need to perform their function. If the total actual network use across
the aircraft control’s high-assurance LAN exceeds the physical capacity of that LAN, then the
difference needs to come from dropping the passengers’ packets to ensure that aircraft systems
have adequate network capacity. The rate controls associated with the packet filter cannot
ensure that this happens alone because of the possibility of denial of service attacks originating
from other sources (e.g., ground, other aircraft). While the firewall will drop packets targeted
inappropriately, it will permit packets targeted to passengers to pass through. Thus, an internal
QoS system is also needed to rate-limit external traffic going to passengers in aircraft that may
be deployed (see figure 1).
8.3.9 Air-to-Ground and Air-to-Air Communications.
Air-to-ground COMSEC should ensure that the signals in space used for wireless
communication are encrypted at the OSI reference model’s physical layer. This would provide
protection from eavesdropping by nonauthorized entities and discourage attacks that inject false
communications into the data stream. However, these links will remain potentially vulnerable to
availability attacks caused by hostile jamming, unless mitigation techniques such as antijamming
118