Local Area Networks (LANs) in Aircraft - FTP Directory Listing - FAA

9. ANSWERS TO THE PHASE 1 QUESTIONS.
This section discusses several aviation safety concerns identified during the original FAA
Screening Information Request for this study. These specific questions were a starting point for
the work performed in phase 1 of this effort. The exemplar architecture, which was presented in
section 8.3, describes the generic airborne network environment that identifies how these
specific questions should be answered.
9.1 CONNECTION OF MULTIPLE DOMAINS.
Flight safety domains can be compared to security classification domains (see section 6.3), in
that ratings are established based on the damage that a failure (or compromise) could cause. In
addition, the assurance ratings of those systems are commensurate with the failure risk.
This report’s architecture relies upon the Biba Integrity Model to segregate entities that have
been classified according to DO-178B Section 2.2.2 software levels. These partitions are
accomplished using the IPsec VPN variant. Virtual network enclaves are created for all
networked entities that may possibly cause aircraft failure conditions. Specifically, Level A
virtual network enclaves are created, as are Levels B, C, and D VPN enclaves. Because the
possible failure of Level E entities does not result in aircraft failure risk, Level E entities are not
similarly segregated into VPN enclaves.
These VPN enclaves materially reduce the security risks for networked devices, directly
mitigating many or most of the threats identified in section 4. Specifically, this approach
mitigates all identified threats for the higher-assurance enclaves. Nevertheless, each enclave, as
well as the total network system, must be further protected by adopting IATF [50] defense-indepth
security provisions with full control life cycle protections (see section 5.1) for the reasons
explained in section 7.
Even though each enclave shares a common underlying network infrastructure, entities in
different enclaves are not physically unable to route to entities in other enclaves, nor are any
entities within any enclave able to route to nonenclave (Level E) entities, or vice versa. This is
due to inherent routing provisions within the VPN design.
HAGs can be deployed to provide localized, highly controlled, high-assurance connections
between specific devices or specific enclave subgroups that are classified at different safety
classification levels. This is the sole provision permitted by the Biba Integrity Model for entities
in different enclaves to communicate together.
122