Local Area Networks (LANs) in Aircraft - FTP Directory Listing - FAA

orders, guidance, and processes, which govern the civil aviation community by using those
terms. However, in the parlance of the security community, laws, orders, guidance, and
processes are referred to as being policy. Consequently, ARP 4754, ARP 4761, DO-178B, DO-
252, and the ACs are referred to as being FAA safety policies. This point is mentioned because
the following quotation is taken from the security community.
“An important concept in the design and analysis of secure systems is the
security model, because it incorporates the security policy that should be enforced
in the system. A model is a symbolic representation of policy. It maps the
desires of the policy makers into a set of rules that are to be followed by a
computer system. … A security model maps the abstract goals of the policy to
information system terms by specifying explicit data structures and the techniques
necessary to enforce the security policy. A security model is usually represented
in mathematics and analytical ideas, which is then mapped to system
specifications, and then developed by programmers through programming code.
… Formal security models, such as Bell-LaPadula are used to provide high
assurance in security... A security policy outlines goals with no idea of how they
would be accomplished and a model is a framework that gives the policy form
and solves security problems for particular situations.” (Quoted from reference 83
pages 239-240.)
It is important that the civil aviation community understand the intended meaning of this
quotation (i.e., that differences in terminology not cause misunderstanding).
Therefore, using security community terminology, ARP 4574 and DO-178B reflect FAA policy
for airborne software. Other entities (e.g., the DoD) have articulated other policy systems.
Security models exist to provide a mathematical foundation by which well-defined policy
systems (such as the DoD or the FAA) can be extended into arbitrarily complex and vast
networked environments and still retain their original policy viability in a mathematically
demonstrable manner. The goal of this section is to explain the technical foundation for this
study’s recommendation for how to extend the current certification safety processes (e.g., ARP
4574 and DO-178B safety policy) into arbitrarily large networked system environments by
means of the Biba Integrity Model. 27
The Bell-LaPadula Confidentiality Model [84] was developed to formalize the U.S. DoD’s
multilevel security policy. It forms the framework for confidentiality within the Federal
government’s information processing, including the DoD’s COMSEC policy. This model
creates a multilevel security policy system by means of mandatory access controls that label data
at a specific classification level, and provide users clearances to a specific classification level.
The controls ensure that users cannot read information classified at a security level higher than
27
This quotation consistently refers to security policy. This is because the context from which this quotation was
taken was talking about security policy. The system (i.e., policy vis-à-vis security model) is not dependent upon
whether the operative policy is a security or a safety policy. Rather, the operative concept is that it is a well
defined policy within the security domain. As was previously stated, airborne safety is within the security domain
whenever it pertains to networked environments.
80