ATN-OSI Security Validation Activity

ACP-WGM15/WP-11 International Civil Aviation Organization 16 November 2009

WORKING PAPER

AERONAUTICAL COMMUNICATIONS PANEL (ACP)

15th MEETING OF WORKING GROUP M (Maintenance)

Montreal, QC 16-18 November 2009

Agenda Item 2: ATN/OSI Document 9880 Update Status

ATN/OSI Doc. 9880 Security Validation Activity

(Presented by Michael Olive, Honeywell International Inc., United States)

SUMMARY This working paper describes the plan and approach for validating ATN/OSI security requirements transferred from Doc. 9705 Edition 3 Sub-Volume VIII to Doc. 9880 Part IV-B, including changes recommended in WGM14/IP05. The ATN/OSI security validation activity is being performed by the Aerospace Advanced Technology organization of Honeywell International Inc. under contract to the FAA and in support of the FAA DataComm Program Office. ACTION The working group is invited to provide comments and feedback regarding the ATN/OSI Security Validation activity described in this working paper.

(3 pages) 0923e5c575e1c2c4f2f45395ca635d1a.doc 2 ACP-WGM15/WP-11

1. INTRODUCTION

1.1 During the fourteenth meeting of WG-M, the FAA presented Information Paper IP05, “Doc. 9880 Part IV-B Based on Doc. 9705.” This information paper offers a proposed approach for transferring the security provisions contained in the ratified Doc. 9705 Edition 3 Sub-Volume VIII to Doc. 9880 Part IV-B. IP05 also includes a set of updates to Doc. 9705 security provisions that are recommended for incorporation into Doc. 9880 Part IV-B.

1.2 During the fourteenth meeting of WG-M, Honeywell presented Information Paper IP07, “ACARS Message Security (AMS) as a Vehicle for Validation of ICAO Doc. 9880 Part IV-B Security Requirements.” This information paper offers a proposed approach for validating the Doc. 9880 Part IV- B ATN/OSI security requirements as proposed in WGM14/IP05.

1.3 This working paper expands upon WGM14/IP07 and describes the plan and approach for validating the Doc. 9880 Part IV-B ATN/OSI security requirements as proposed in WGM14/IP05.

1.4 The ATN/OSI security validation activity is being performed by the Aerospace Advanced Technology organization of Honeywell International Inc. under contract to the FAA and in support of the FAA DataComm Program Office.

2. DISCUSSION

2.1 The scope of the planned validation activity includes validation by inspection and analysis of the ATN/OSI security provisions contained in the following chapters of Doc. 9880 Part IV-B as proposed in WGM14/IP05:

a) Chapter 4 – ATN Public Key Infrastructure (PKI),

b) Chapter 5 – ATN Cryptographic Infrastructure,

c) Chapter 6 – ATN System Security Object.

These chapters contain the detailed ATN/OSI security provisions.

2.2 Honeywell plans to perform the validation using its Secure ACARS implementation, technical documentation, and relevant industry standards as a means to establish that the ATN/OSI security provisions have been validated in a representative environment. Secure ACARS, which is compliant with ARINC Specification 823, is based on the ATN/OSI security provisions specified in Sub- Volume VIII of ICAO Doc. 9705, Edition 3, and it includes the security enhancements recommended for incorporation into Doc. 9880 Part IV-B.

2.3 Since Doc. 9880 Part IV-B is intended to update and supersede ICAO Doc. 9705 Sub- volume VIII, Honeywell plans to use the same high-level validation objectives that were applied previously during validation of the security provisions in Doc. 9705 Sub-volume VIII. 3 ACP-WGM15/WP- 1105

2.4 The results of the validation effort will be documented in a validation report, which will be delivered to the FAA and presented to ICAO ACP WG-M. The report is expected to include the following sections:

a) Introduction – Identify the purpose and scope of the document, define terminology and acronyms, and provide references to applicable documents.

b) Validation Objectives – Identify and describe the high-level ATN security validation objectives, the scope of the ATN/OSI validation effort, and the validation means employed.

c) Validation Approach – Describe the approach for achieving the validation objectives, including assumptions and constraints.

d) Validation Results – Report the results of the validation effort, including both conformance and defects.

e) Conclusions – Provide summary conclusions and recommendations.

3. ACTION BY THE MEETING

3.1 The ACP WG-M is invited to:

1. review, discuss, and provide comments/suggestions regarding the ATN/OSI security validation activity described in this working paper.

--END--