Hacker News Reader

Comment by toomuchtodo | Hacker News Reader

> it should be one-way communication (entertainment can only read FMS data, not send any), for the purpose of driving the moving map displays for passengers.

Would you agree that this logical boundary should be physically enforced? Such as an opto-isolator?

View on HN

There should actually be three distinct "air-gaped" networks (or at least classifications of network).

Secure: The network that connects and controls the airplane. Absolutely only essential things allowed on, and if possible isolated using mathematically proven secure vlan/isolation techniques.

"Employee": pilots, crew, etc. This is more just a distinct network for corporate operations security.

"Customer": Still try to keep this one secure so that virus and just don't spread, but this is the 'DMZ' area.

Communication from the secure network should be outbound only, and might best be done over a fixed rate serial data connection of some sort.

The modern version might be to configure a point to point network link on a CDMA based system and just disconnect the secure side's RX path entirely. Then you just export the data blind via UDP with like 10X redundancy.

Most Boeing planes (though not the 787 discussed here) don't use fly-by-wire, so you could argue that the most essential control plane is perfectly isolated by virtue of not having any sort of network at all, just hydraulics into the cabin.

But wasn't the 737-max issue that a software system was forcing an elevator change to pitch the nose down? That sounds pretty fly-by-wire (even if hydraulics are involved).

You could say that the problem was lack of fly-by-wire - if 737-MAX had FBW, the necessary corrections would be bundled as part of flight envelope protection, and that tends to work pretty well and the required checks on FBW systems would catch stuff like "only one AoA sensor used".

Instead we got MCAS which was messing with autotrim signals and escaped scrutiny.

This sounds like a good idea, until you realize that the head unit is typically the thing in the car with the most computing power (think AI workloads as well as a GPU and multiple ARM cores) and the thing in the car with the network connection.

A trivial use case which requires write access to the CAN bus is the navigation system informing cruise control of an upcoming hill.

Equally trivial would be the seat position memory or profiles being applied through the main touchscreen.

(I work for a company that is developing infotainment systmes)

No fancy circuitry is needed. Just use one fiber. I suspect that 100BASE-T can pull this off with one pair and some hackery. RS232 should work work only one direction connected.

> Boeing maintains that other security barriers in the 787's network architecture would make that progression impossible.

They probably do something to that effect

The longer I'm alive the more firmly I commit to never assume anything.

I have seen things. Terrible things.

Connectivity between zones is something FAA actually caught in 787 when it was still being built and forced a redesign.

"security barrier" is a vague, meaningless phrase that they don't define. There shouldn't be any connection at all between flight systems and the in-flight entertainment.

Used to be done with a literal diode.

The funny thing is that LEDs (granted, not all types of diodes) can be used to read data as well as transmit it. Videos of such interfaces can be found on YouTube. So, they are not as one-way as some folks may think.

https://youtu.be/aLP-OF4nesY

Well it can not only be a LED that is supposed to be one-way, but the whole circuitry driving it. Likewise for the receptor. With some appropriate review of the physical design, you can have a reasonable expectation that the comm will be limited to one-way, with no way for arbitrary SW to modify the direction.

Usually wasn't an LED. Just a normal diode.

Well, an optoisolator is a literal diode plus a literal transistor. I'm okay with that much hi tech.

Yes.

Reply on news.ycombinator.com