Local Area Networks (LANs) in Aircraft - FTP Directory Listing - FAA

20. The packet filter in the aircraft control must be configured such that noncockpit crew
network cannot address any encapsulation gateway. If the aircraft is using figure 1 target
architecture (i.e., no air gap between the passenger and avionics systems), then the packet
filter needs to additionally provide the following services:
• No device within the passenger network can access the noncockpit crew network
or the cockpit-pilot network.
• No device within the passenger network can send packets to any encapsulation
gateways (located within aircraft control).
• The packet filter, or a device closely associated with the packet filter comprising a
common system with it (e.g., QoS middlebox), rate limits communications from
the passenger network to ensure that passenger communications cannot exceed a
certain threshold rate. This provision attempts to ensure that passengers alone
cannot cause a DoS attack on the aircraft control’s high-assurance LAN by
consuming a disproportionate share of its capacity.
21. The firewall needs to be configured to be as exclusive as possible. Because of the
presence of passengers in the network in the figure 1 target, the HTTP overt channel
vulnerability (see section 4.1 and appendix A.1), unfortunately, cannot be fully plugged,
unlike the figure 3 target alternative. However, if aircraft design restricts pilot and crew
communications such that they never use HTTP, then the firewall can be configured so
that HTTP traffic (i.e., both Port 80 and Port 443) is filtered out by the firewall whenever
the packet’s destination address is a nonpassenger device. Such a rule would provide
pilot and crew devices helpful protection in figure 1 environments. Even if the pilot and
crew were permitted to use secure HTTP only (i.e., Port 443), then at least the more
dangerous Port 80 transmissions could be filtered. In any case, the firewall needs to be
configured so that:
• All fingerprinting attempts (see appendix A, section A.1) originating from outside
of the aircraft to any entity within the aircraft will fail (except for those that
remain through the HTTP hole).
• All communications to encapsulation gateways from outside of an airplane are
blocked by the firewall unless they use IPsec’s ESP. (Note: both the firewall and
the gateways themselves need to redundantly enforce this same rule for defensein-depth
reasons.)
• The firewall should also be configured to drop all packets originating from
outside of the aircraft to IP destination addresses that are not deployed within the
aircraft LAN. Please recall that the firewall only has visibility into VPNs since it
only sees their encapsulating packet headers, which are solely addressed to
encapsulation gateways.
144