Local Area Networks (LANs) in Aircraft - FTP Directory Listing - FAA

1. INTRODUCTION.
This is the final report of a 2-year Federal Aviation Administration (FAA)-funded study to
address security and safety issues associated with networked airborne local area networks
(LAN). This study consisted of two phases. Phase 1 investigated the methodologies for
identifying and mitigating potential security risks of onboard networks that could impact safety.
Phase 2 investigated techniques for mitigating security risks in the certification environment.
Individual systems onboard aircraft are designed to meet specific operational, functional, and
physical requirements. The safety requirements of a flight-critical avionics system differ from a
cabin management system or a passenger in-flight Internet service. If these systems become
interconnected, incompatibilities in design assumptions, administrative policies, user interaction,
and data security considerations increase their exposure to risk. Actions taken in the context of
an open passenger network (whether originating onboard an airplane or from some remote site
via a network connection) must be prevented from introducing flight-safety risks to flight-critical
systems.
Airborne systems are designed, built, and approved in accordance with airworthiness
requirements. Current FAA safety assurance processes for airborne systems are based upon
Aerospace Recommended Practice (ARP) 4754 [1], ARP 4761 [2], and Advisory Circulars (AC);
e.g., AC 23.1309-1C [3] and AC 25.1309-1A [4]. FAA software assurance is based on
compliance with RTCA/DO-178B [5] that guides software development processes. Complex
electronic hardware design assurance is based on RTCA/DO-254 [6]. The primary FAA
certification standards are the respective regulations, FAA policy, and the ACs.
This study addresses how to extend current FAA processes and certification environment to
include networked airborne LANs in a mathematically viable manner. Because of the extensive
scope of the current FAA policies and processes, this report addresses this larger issue by
specifically explaining how to extend the software assurance subset. Other aspects of FAA
policy and processes can be extended into networked environments in a parallel manner (i.e., by
leveraging a security model framework, see section 6.2).
DO-178B is one means to secure approval of airborne software. The system safety assessment
processes (ARP 4754 and ARP 4761) determine failure conditions of the system and define
safety-related requirements as input to the software life cycle processes. DO-178B identifies the
software level of a software item based on the potential contribution of the software to failure
conditions for the entity in question. Software level refers to the worst-case result of a failure of
that software upon aircraft safety in terms of one of five possible failure condition categories.
The failure condition categories range from failure conditions that would prevent the aircraft’s
continued safe flight and landing (catastrophic) to failure conditions that do not affect the
operational capability of the aircraft nor increase crew’s workload (no effect). Higher software
levels, and greater assurance protections, are provided to entities that would have higher safety
consequences should they fail. DO-178B also addresses some software design and certification
considerations for user-modifiable software, option-selectable software, commercial off-the-shelf
(COTS) software, and other software-related issues.
1