Local Area Networks (LANs) in Aircraft - FTP Directory Listing - FAA

This framework is realized within military communications by creating networks, each operating
at a specific classification level. These networks may operate as multiple single levels of
security (MSLS) systems. Alternatively, they can operate as System High networks supporting
all classifications at a given classification level or below. Networks operating at different
classification levels are orthogonal to each other. For example, they are addressed, by definition,
from address and naming spaces that are distinct (i.e., totally unrelated) to the address and
naming spaces used by networks at all different classification levels.
In general, networks operating at one classification level have no idea of the existence of
networks operating at a different classification level. There are two exceptions to this rule:
1. HAGs provide a controlled mechanism for some select communications to cross between
networks operating at different classification levels (information downgrading and
information upgrading). This includes appropriately mapping addresses between the
dissimilar address spaces of the two networks. HAGs can “translate” between networks
operating at different classification levels.
2. Military COMSEC provides a mechanism to encapsulate and encrypt data packets so that
they can be conveyed over networks operating at a different classification level (see
figure 17).
Workstation
100.1.1.1
RIPHRIPP
Destination 100.1.4.1
Source 100.1.1.1
EH
RIPH RIPP
EH
Red IP Header & Payload
ESP Header & Trailer
Black IP Header
RIPH RIPP
EH
RIPH RIPP
EH
Workstation
100.1.4.1
100.1.1.2
Red IP
(Secret)
100.1.2.1
COMSEC
RIPH RIPP
Destination 200.1.4.1
Source 200.1.1.1
BIPH
ESP
RIPH
RIPP
ESP
RIPH RIPP
Destination 100.1.4.1
Source 100.1.1.1
BIPH
ESP
RIPH
RIPP
ESP
100.1.4.2
Red IP
(Secret)
100.1.3.1
COMSEC
200.1.1.1
200.1.4.1
Black IP
BIPH
ESP
RIPH
RIPP
ESP
BIPH
ESP
RIPH
RIPP
ESP
Black IP
200.1.2.1 200.1.3.1
Mobile Data Data Link Link
EH*
BIPH
ESP
RIPH RIPP
ESP EH*
EH*
BIPH
ESP
RIPH RIPP
ESP EH*
Mobile Data Data Link Link
Black Mobile Intranet 1
Black Network
Figure 17. The DoD COMSEC End-to-End Packet Flow (IPV4 Example)
Current DoD COMSEC leverages the IETF’s IPsec standard, whose architecture is defined by
RFC 4301. Specifically, it is based upon IPsec’s encapsulating security payload (ESP) (i.e.,
RFC 4303) operating in tunnel mode. Tunnel mode refers to a packet from one network being
56