Local Area Networks (LANs) in Aircraft - FTP Directory Listing - FAA

design decisions that need to be determined if encapsulation gateways are to effectively support
VPN network management.
This study has stated that high-assurance devices cannot be misconfigured. For this reason,
devices in Levels A and B VPNs may have comparatively diminished management requirements
than other airborne devices. The stakeholders need to determine what that actually means. Does
it mean that the primary management requirement of these devices will be to report their current
status, explicitly including the results of the current (Tripwire-like) software integrity reports?
Will different variants of encapsulation gateways be defined, with some variants supporting
extensive configuration and management functions (e.g., for lower-software assurance VPNs)
and others primarily supporting status reports (for higher-assurance VPNs)? Will the
encapsulating gateways solely function to forward (pass through) traditional SNMP management
communications between network managers and management agents that reside on the devices
within the VPNs? Alternatively, will the management agent actually be located within the
encapsulating gateway itself such that the agent within the gateway translates SNMP
communications to and from standard network managers into actual management tasks
performed upon the devices located within the VPN that it supports? Many other management
approaches are possible, but it is desirable to find a consistent approach that is supported by the
aeronautical community in which the interfaces and management schemas supported by the VPN
encapsulation gateways are common and consistent worldwide.
From a security perspective, it is important that the encapsulation gateway be configured to drop
all packets addressed to itself that do not use IPsec’s ESP in transport mode. Thus, the network
manager will send management queries (or commands) to a specific encapsulation gateway and
the encapsulation gateway will eventually report back to the network manager, with all
communications occurring via ESP in transport mode. Both the encapsulation gateway and the
network manager must authenticate each others’ communications. Approaches to authorize
network managers also need to be carefully considered, with separation of duties with least
privilege being recommended by this study. The encapsulation gateways will need to be
certified as high-assurance security items (i.e., EAL 5 or higher).
Because network managers located on unencapsulated networks natively do not know about
VPN entities, it is possible to preconfigure a network manager with information associating VPN
devices with a specific encapsulation gateway. Alternatively, the encapsulation gateway could
be queried—or pass through such queries directly to the VPN devices—concerning entities
within that VPN, possibly providing information about their software identity, current software
version, current status, and configuration (if appropriate).
Network management also contains software development implications. If software items are to
be managed, then the management schemas by which the software is managed need to be
devised in accordance with the network management system used on that aircraft. This requires
coordination and advanced knowledge of the specific management protocol that will be used, the
mechanisms by which that protocol will be secured, the desired format for the management
schema, and a common approach for schema definition.
121