Local Area Networks (LANs) in Aircraft - FTP Directory Listing - FAA

11.2 TOPICS NEEDING FURTHER STUDY.
This report identifies the following topics as needing further study:
• Pertaining to the last recommendation noted above, what is the trust model between civil
aviation regions? Will the trust model for the regions’ Level A software network
partitions (enclaves) be the same as for their Level C software network enclaves? What
is the trust model between aircraft and ground entities? If air-to-air communications
occur, what is the trust model between aircraft belonging to different airlines? Will the
Level A VPN components of the NAS completely trust European Level A VPN
components and vice versa, or will they establish distinct policies and SLA mappings
between their components? What security protections (e.g., firewalls) will be inserted to
protect the rest of the VPN elements at that safety level from a contamination that
occurred within a specific region? How will aircraft that travel between regions maintain
their connectivity in a seamless, safe, and secure manner? If air-to-air applications and
systems are created, what mechanisms (e.g., firewalls) will protect the VPN at a given
safety level in one airplane from (perhaps undiagnosed) misbehaviors occurring in the
VPN at that same safety level in a different airplane? What policy systems will govern
the interrelationship between aircraft and ground entities? Will SLAs be required?
• The worldwide civil aviation community needs to identify common solutions for identity
(see section 4.8), IP addressing (see sections 5.3 and 5.4), naming, routing (see section
5.5), protocol security (see section 4.5), and authentication (see section 4.9) subsystems.
• Because network management issues for airborne networks are directly related to airline,
manufacturer, and FAA concept of operations, this study has not provided a welldeveloped
network management recommendation. Nevertheless, these issues need to be
competently addressed and a viable network management system needs be designed if
airborne LAN systems are to be safely networked. Therefore, network management
designs and architectures need to be established for airborne networks.
• Carol Taylor, Jim Alves-Foss, and Bob Rinker of the University of Idaho have studied
the issue of dual software certification [93] for CC and DO-178B. Their study suggested
that security functionality certified at EAL 5 can be directly compared with DO-178B
Level A. This report recommends that their conclusion should be verified by further
evaluation and study for the specific issue of establishing assurance equivalencies
between CC-certified security controls and safety assurance levels.
• Are there better mechanisms to address the problem of how best to remove latent
software bugs that can be attacked from software items in networked environments?
While testing probably provides part of the solution, it is obvious that testing alone
cannot warranty the absence of bugs for elements unexamined by the test suite. Because
of the vast array of possible software bugs that can exist, it is improbable that a complete
testing corpus can be created. Therefore, best current practice is to continue to enforce
line-by-line code inspection within the certification process for the highest assurance
147