Local Area Networks (LANs) in Aircraft - FTP Directory Listing - FAA

espective system safety or security mechanism, with possible safety consequences to the
aircraft, depending on the specific consequence of that failure.
Previous studies have sought to address airborne software safety and security by correlating
DO-178B safety processes with CC security processes. This correlation produces necessary but
inadequate results. It is inadequate because it lacks mathematical rigor and therefore produces
ad hoc conclusions. The results are ad hoc because even when safety and security are correlated,
they are nevertheless distinct concepts from each other, addressing very different concerns.
This report states that the primary issue impacting network airborne system safety is how to
extend existing ARP 4574, ARP 4761, DO-178B, and DO-254 assurance guidance processes
into networked systems and environments in a mathematically viable manner. This study
recommends to extend these processes into arbitrarily vast network environments in a
mathematically viable manner by using the Biba Integrity Model framework. This report maps
current DO-178B and ARP 4754 processes into the Biba Integrity Model framework using wellestablished
system security engineering processes to define airborne safety requirements. It
applies best current information assurance techniques upon those airborne safety requirements to
create a generic airborne network architecture.
Since the Biba Integrity Model is an integrity framework, it has a natural mechanism for relating
safety and security concepts in terms of their respective integrity attributes. Nevertheless, this
study recommends that the model be implemented solely within the context of existing FAA
safety processes. This results in airborne network systems being organized into networks that
operate at specific safety integrity levels (e.g., the DO-178B software levels).
There are fortuitous secondary effects from using the Biba Integrity Model to extend current
FAA processes into networked environments, which stem from its role as the direct analog of the
Bell-LaPadula Confidentiality Model. The Bell-LaPadula Confidentiality Model forms the
framework for confidentiality within U.S. DoD information processing. Consequently, the
application of the Biba Integrity Model to airborne system assurance processes results in an
airborne network architecture that remarkably resembles the emerging DoD network
architecture, the global information grid, despite their very different underlying goals.
Consequently, the generic airborne network architecture identified by this study greatly
resembles the DoD’s GIG architecture. While military technologies could be used to implement
the airborne network architecture, this study recommends the use of civilian IPs deployed as a
virtual private network. In addition, the similarities between the Biba Integrity Model and the
Bell-LaPadula Confidentiality Model may result in increased synergies between DoD and FAA
certification processes.
Deploying airborne systems into networked environments means that the FAA system safety
assessment (ARP 4761), system development (ARP 4754), software assurance (DO-178B), and
complex electronic hardware assurance (DO-254) processes need to be extended to address and
mitigate network threats. For example, although security is primarily a systems concept
involving system issues (e.g., ARP 4754), the Biba Integrity Model relies upon the networked
items having integrity attributes that function at a known assurance level (e.g., specific DO-178B
software levels). This means that the processes for developing those items for network
138