DOT/FAA/AR-08/31 Networked Local Area Networks Air Traffic Organization Operations Planning in Aircraft: Safety, Security, and Office of Aviation Research and Development Certification Issues, and Washington, DC 20591 Initial Acceptance Criteria (Phases 1 and 2) November 2008 Final Report This document is available to the U.S. public through the National Technical Information Service (NTIS), Springfield, Virginia 22161. U.S. Department of Transportation Federal Aviation Administration NOTICE This document is disseminated under the sponsorship of the U.S. Department of Transportation in the interest of information exchange. The United States Government assumes no liability for the contents or use thereof. The United States Government does not endorse products or manufacturers. Trade or manufacturer's names appear herein solely because they are considered essential to the objective of this report. This document does not constitute FAA certification policy. Consult your local FAA aircraft certification office as to its use. This report is available at the Federal Aviation Administration William J. Hughes Technical Center’s Full-Text Technical Reports page: actlibrary.tc.faa.gov in Adobe Acrobat portable document format (PDF). Technical Report Documentation Page 1. Report No. 2. Government Accession No. 3. Recipient's Catalog No. DOT/FAA/AR-08/31 4. Title and Subtitle 5. Report Date NETWORKED LOCAL AREA NETWORKS IN AIRCRAFT: SAFETY, November 2008 SECURITY, AND CERTIFICATION ISSUES AND INITIAL ACCEPTANCE CRITERIA (PHASES 1 AND 2) 6. Performing Organization Code 7. Author(s) 8. Performing Organization Report No. Eric Fleischman, Randall E. Smith, and Nick Multari 9. Performing Organization Name and Address 10. Work Unit No. (TRAIS) The Boeing Company P.O. Box 3707, MC 7L-49 Seattle, WA 98124-2207 11. Contract or Grant No. DTFACT-05-C-00003 12. Sponsoring Agency Name and Address 13. Type of Report and Period Covered U.S. Department of Transportation Final Report Federal Aviation Administration Air Traffic Organization Operations Planning December 2004-December 2006 Office of Aviation Research and Development Washington, DC 20591 14. Sponsoring Agency Code AIR-120 15. Supplementary Notes The Federal Aviation Administration Airport and Aircraft Safety R&D Division Technical Monitor was Charles Kilgore. 16. Abstract This report presents the results of the Federal Aviation Administration (FAA) local area network (LAN) research effort addressing potential safety impacts introduced by LANs in aircraft. Interconnecting previously isolated components on aircraft increases the complexity of unintended interactions between components and provides potential new access points that could be exploited to cause harm. This report addresses the potential security vulnerabilities introduced by networking LANs, the safety affects of security failures, and a process for designing and certifying LANs on aircraft to ensure the safety of these new aircraft systems. This report extends the current FAA safety assurance processes into airborne networked environments by leveraging the Biba Integrity Model. It builds upon existing FAA studies that articulate mechanisms to integrate RTCA/DO-178B and common criteria processes for the National Airspace System. This approach creates a safety-oriented airborne networked architecture that is built upon existing DO-178B and Aerospace Recommended Practice 4754 safety mechanisms. This produces results that are a direct analog to existing U.S. Department of Defense policies and processes. 17. Key Words 18. Distribution Statement Local area network, Network, Aircraft safety, Aircraft security This document is available to the U.S. public through the National Technical Information Service (NTIS), Springfield, Virginia 22161. 19. Security Classif. (of this report) 20. Security Classif. (of this page) 21. No. of Pages 22. Price Unclassified Unclassified 204 Form DOT F 1700.7 (8-72) Reproduction of completed page authorized TABLE OF CONTENTS Page EXECUTIVE SUMMARY xiii 1. INTRODUCTION 1 2. OBJECTIVES AND APPROACH 7 2.1 Notional Networked Aircraft Architecture 9 2.2 Why Both Target Alternatives Have Similar Security Postures 13 3. EXTENDING THE CURRENT FAA CERTIFICATION ENVIRONMENT 15 4. NETWORK RISKS 19 4.1 Different Universes: Stand-Alone Versus Networked 21 4.2 Internal, External, and Client-Side Attacks 24 4.3 Commerical Off-the-Shelf Vulnerabilities in a Networked Environment 26 4.4 Mixing Embedded Systems and Generic Operating Systems 31 4.5 Internet Protocol Family Security 35 4.6 Network Management—Network Security Concern 43 4.6.1 The SNMP has no Provisions for Two-Factored Authentication 44 4.6.2 The SNMP Symmetric Keys may be Assembled From Passwords 44 4.6.3 The SNMP Key Updates do not Provide for Perfect Forward Secrecy 45 4.6.4 The SNMP Symmetric Key Distribution Problems 45 4.6.5 The SNMP Currently Lacks Demonstrably Viable Session Keys 46 4.7 Mixing Different Communication Protocol Systems 46 4.7.1 Significant Semantic Differences to Allegedly Similar Concepts 48 4.7.2 Integrating Dissimilar Protocol Families 48 4.8 Identity Problem 50 4.9 Integrated or Cooperating System of Systems 51 5. NETWORK SECURITY DEFENSES 52 5.1 Defense-in-Depth 52 5.2 Department of Defense Networking 55 5.3 Internet Protocol Topology Hierarchy and Policy Systems 58 5.4 Mechanisms to Connect Aircraft to Networks 59 5.4.1 Aircraft and Network Mobility 60 iii 5.4.2 Aircraft as a Node (MIP and MANET) 60 5.4.3 Multilevel Network Systems (RED-BLACK, VPN) 61 5.5 Airplane Routing and Autonomous Systems 62 5.6 Virtual Private Networks Enable Network Partitioning 66 5.7 Security Zones and Policy-Based Networking 69 6. RELATING SAFETY AND SECURITY FOR CERTIFICATION 73 6.1 Security Requirements of Airborne Networked Environments 74 6.1.1 Integrity 75 6.1.2 Availability 77 6.1.3 Authentication 78 6.1.4 Confidentiality 79 6.1.5 Nonrepudiation 79 6.2 Extending FAA Orders, Guidance, and Processes Into Vast Network Systems 79 6.3 Comparing Civilian Aircraft Safety and Federal Government Security Levels 83 6.3.1 Civil Aircraft Software Levels 83 6.3.2 Federal Government Security Classifications 85 6.3.3 Comparison of the Two Policy Systems 86 6.4 Biba Integrity Model and Bell-LaPadula Confidentiality Model are Direct Analogs 87 6.5 Relating Safety Classification Levels to the CC 90 7. EXTENDING FAA CERTIFICATION TO AIRBORNE NETWORKS 93 7.1 Extending ARP 4754 Into Networked Environments 94 7.2 Extending DO-178B Into Networked Environments 96 8. CANDIDATE SAFETY AND SECURITY NETWORK SOLUTION 98 8.1 System Security Engineering Methodology 99 8.2 Applying the SSE Methodologies to Airborne Networks 102 8.3 Exemplar Airborne Network Architecture Solution 105 8.3.1 The VPN Encapsulation Method 108 8.3.2 Physical Security 114 8.3.3 Encapsulation Gateways 115 8.3.4 Packet Filter 116 8.3.5 Firewall 117 8.3.6 The ASBR Router 117 iv 8.3.7 High-Assurance LAN 118 8.3.8 Quality of Service 118 8.3.9 Air-to-Ground and Air-to-Air Communications 118 8.4 Network Management Extensions 119 9. ANSWERS TO THE PHASE 1 QUESTIONS 122 9.1 Connection of Multiple Domains 122 9.2 Integrated Modular Avionics Implementation 123 9.3 Using Public IPs 125 9.4 Electronic Flight Bags 125 9.5 Updating Security Protection Software 127 9.6 Responding to Security Breaches 128 9.7 Access to Aircraft Data 129 9.8 Adequacy of Existing Regulations 129 9.9 Ground-to-Air Communication 130 9.10 What is the Efficacy of Cyclic Redundancy Checks With Respect to Security? 130 10. ANSWERS TO THE PHASE 2 QUESTIONS 131 10.1 Are Current Regulations Adequate to Address Security Concern? 131 10.2 How Does Security Assurance Fit Into Overall Certification Process? 132 10.3 What Should Network Security Assurance Process Contain to Meet XX.1309? 132 10.4 How Will Continued Airworthiness and Maintenance be Addressed? 134 10.5 How Can it be Ensured That Networked Systems Cannot Impact Safety? 135 10.6 What Should the Process be for Updating Security Protection Software? 135 10.7 How can Security Breaches be Handled? 136 11. SUMMARY 137 v 11.1 Findings and Recommendations 139 11.2 Topics Needing Further Study 147 12. REFERENCES 148 13. RELATED DOCUMENTATION 156 14. GLOSSARY 157 APPENDICES A—Historic Attack Mechanisms and Tools B—FAA LAN Survey Results vi LIST OF FIGURES Figure Page 1 Notional Networked Aircraft Architecture 10 2 Generic Future Communication System Physical Architecture 11 3 Alternative Notional Aircraft Architecture 11 4 Both Target Architectures Have Similar Security Profiles 14 5 Three Different Software Certification Environments 16 6 The FAA Five Layers of System Protection 19 7 Network Threat Mission and Operational Impact 21 8 Airborne Network Threat Targets 21 9 Threat Agents in a Networked Environment 26 10 A Sample Deployment 30 11 Comparison Between the OSI and TCP/IP Protocol Stacks 46 12 Transforming Islands of Communication Into a Single Logical Network Infrastructure 49 13 Internet Protocol Stack to Convey Legacy Protocols 50 14 Overlapping Defense-in-Depth IA Systems 53 15 Sample Defense-in-Depth Technologies 54 16 Control Life Cycle 55 17 The DoD COMSEC End-to-End Packet Flow (IPV4 Example) 56 18 Representation of how Aircraft may Function Within the GIG 57 19 Internet Protocol Topology Hierarchy 59 20 Interfaces Between Customer and Service Provider Networks 67 21 Example of VPN Encapsulation Using IPsec 68 vii 22 Customer’s L3VPN Protocol Stack Shown Within the Network 69 Service Provider’s Network 23 Historic PBN Framework 70 24 Code- and Document-Signing Process 76 25 Code-