Local Area Networks (LANs) in Aircraft - FTP Directory Listing - FAA

Interface
Interface
Customer Site
Service Provider
Customer Site
Figure 20. Interfaces Between Customer and Service Provider Networks
VPNs are examples of a multilevel network system (see section 5.4.3) where hosts within the
service provider network cannot view, access, or know about hosts within the customer’s
networks, and vice versa. It is called virtual because the service provider forwards the
customer’s packets across its own network infrastructure in a manner that appears to the
customer as if the service provider’s network were the customer’s own private network. The
service provider can transparently provide VPN services to multiple different customers over
that same physical infrastructure with each VPN being securely partitioned from the other. Each
customer is provided a high degree of confidentiality and integrity protections from the VPN
service, which protect their users from other VPN users of the same physical network
infrastructure. This protection is accomplished either by data link layer protocol separations (see
first bullet below) or else via tunneling (i.e., protocol stack encapsulations, explained in the
second bullet below, which is the approach recommended by this study). 18 These inherent
confidentiality and integrity provisions can be further strengthened by using IPsec security (see
RFC 4301) in tunnel mode for network layer VPNs.
The IETF has defined two distinct types of VPNs:
• A Layer 2 Virtual Private Network (L2VPN) provides a VPN logically occurring at the
customer’s data link layer by using the service provider’s physical network infrastructure
operating at the data link layer. In L2VPN 19 , a network provider offers the customer
access to a VPN via a data link layer service interface (see figure 20). Consequently, the
18
The mechanism by which physical network partitioning is accomplished differs in terms of the specific protocol
layer at which the partitioning controls occur. The approach recommended by this study does the partitioning at
the network layer (layer 3). The specific partitioning mechanism recommended by this study relies upon the
controlled insertion (encapsulation) of a redundant IP packet header specific for the service provider network
(i.e., the non-VPN enclave parts of the aircraft's network) within the protocol stack of the customer’s (i.e.,
network enclave) packets (see figure 21) while they are conveyed across the network service provider’s network.
This encapsulation occurs at the interface point shown in figures 20 and 22. The encapsulated packets are
conveyed across the network service provider’s network by means of the encapsulated IP header (i.e., the service
provider’s IP header that was inserted into the protocol stack). The original IP packet header of the customer’s
packet, together with the entire contents of that original packet, is not visible to either the network service
provider or to other VPNs supported by that service provider because they only can see the interface-inserted IP
header. Additional assurance is provided by the fact that IP addressing of the original IP header comes from the
IP address space of the (customer) network enclave, while the IP addressing of the redundant (encapsulated) IP
header comes from the service provider’s IP address space. The approach recommended by this study also has a
third assurance mechanism: the customer’s entire original IP stack is encrypted using FIPS-compliant encryption
technology so that all network enclave packet information is in cipher text form while traversing the service
provider’s network. These provisions ensure total network partition between the various VPNs themselves as
well as from the conveying service provider network.
19 See http://www.ietf.org/html.charters/l2vpn-charter.html
67