Local Area Networks (LANs) in Aircraft - FTP Directory Listing - FAA

integrity is not permitted to observe (read) an object at a lower level of integrity (no read down).
The Biba * (star) Integrity axiom requires that an object at one level of integrity is not permitted
to modify (write to) an object of a higher level of integrity (no write up), thereby preserving the
higher level of integrity. As with the Bell-LaPadula Confidentiality Model, a subject at one level
of integrity cannot invoke a subject at a higher level of integrity.
Also similar to the Bell-LaPadula Confidentiality Model, the Biba Integrity Model has
provisions for HAGs, which enable highly controlled functions to occur that would have
otherwise been prohibited by the model. HAGs are trusted subjects that operate in a highly
controlled and highly localized manner. However, in the Biba case, the HAG is concerned with
integrity issues that permit a highly trusted integrity environment to safely receive
communication from a less trusted one in a highly controlled way. For example, a HAG might
be inserted into the network to support a Level C software system that needs to communicate
with a Level A software system.
6.3 COMPARING CIVILIAN AIRCRAFT SAFETY AND FEDERAL GOVERNMENT
SECURITY LEVELS.
6.3.1 Civil Aircraft Software Levels.
The civilian aircraft industry’s DO-178B software levels are:
“based upon the contribution of software to potential failure conditions as
determined by the system safety assessment process. The software level
implies that the level of effort required to show compliance with certification
requirements varies with the failure condition category.” (Quoted from
Section 2.2.2 of reference 5.)
DO-178B defines the following specific failure condition categories.
“The categories are:
a. Catastrophic: Failure conditions which would prevent continued safe flight
and landing.
b. Hazardous/Severe-Major: Failure conditions which would reduce the
capability of the aircraft of the ability of the crew to cope with adverse
operating conditions to the extent that there would be:
(1) a large reduction in safety margins or functional capabilities,
(2) physical distress or higher workload such that the flight crew could not be
relied on to perform their tasks accurately or completely, or
(3) adverse effects on occupants including serious or potentially fatal injuries
to a small number of those occupants.
83