Hacker News Reader

Comment by sleavey | Hacker News Reader

It seems to me as someone with no experience of designing aircraft control software, avionics or anything to do with planes, that the entertainment system should be on a physically separate network to anything safety critical. Like, different everything: power supplies, switches, cables, control panels, the works. There should be no entryway into the flight control network except from the cockpit.

View on HN

There are three separate networks, with data diodes used for cases where information flows between them.

HW separation was enforced by FAA back when 787 was in prototype stage.

Where can one read about the 787 data diodes?

You can read about the fact that there are NO data diodes on the FAA website

> The proposed architecture of the 787 allows connection to and access from external sources (the public Internet) and airline operator networks to the previously isolated Aircraft Control Domain and Airline Information Services Domain.

> Capability is proposed for providing electronic transmission of field-loadable software applications and databases to the aircraft. These would subsequently be loaded into systems within the Aircraft Control Domain and Airline Information Services Domain.

[1] http://rgl.faa.gov/Regulatory_and_Guidance_Library%5CrgSC.ns...

That's a request for comments from before 787 got its type certificate - I'd like to see the result, as I do recall there being a request to redesign the networks due to "not enough separation". Even HN talked about it.

I can't find the "work-in-progress" reports for type certification regarding the network, but the special conditions involve:

> The applicant shall ensure system security protection for > the Aircraft Control Domain and Airline Information > Domain from access by unauthorized sources external to > the airplane, including those possibly caused by > maintenance activity. The applicant shall ensure that > security threats are identified and assessed, and that > risk mitigation strategies are implemented to protect the > airplane from all adverse impacts on safety, > functionality, and continued airworthiness.

If Boeing decides to cut costs by using a single network for their entertainment, communications and flight control, who is there gonna be to tell them no? You would assume there is some oversight by independent security researchers who review these planes security, but this assumption seems unsubstantiated.

In reality, how is this separation of critical networks looking like exactly? MAC address filters? Are they air-gapped? I would venture to guess, nobody that isn't bound by an NDA knows.

Boeing actually attempted that on 787,with some VLAN trickery.

FAA caught it and forced them to redesign the setup.

As for actual AFDX networks - they have hardcoded forwarding tables and no MAC learning, and separation between networks tends to use data diodes

tends?

As a network engineer it is terrifying that they would try this. Also, even if you have no MAC learning its trivial to sniff the MAC on an endpoint and then spoof it. You would really need pubkey based encryption where the key is stored in secure chips on every endpoint to know for sure what each device is connected to.

Companies do these things all the time and in other industries they get away with it. It would be nice if other industries would have similar strict audits and requirements.

the difference is that AFDX is a "closed" network. If you attached anything to it directly, you're already past the security boundary, as timing and reliability is more important than verifying identities in it.

The issue is that for every kilogram you need to get into the air, is another kilogram of fuel that you need to carry onboard. Airlines, and by association, Boeing are very conscious of weight over something like airgapping.

The rule of thumb is:

You burn one lb (unit) of fuel for every three lbs (units) of fuel you carry.

Me: FAA licensed dispatcher

(Also, you'll see a 1:1 rule would imply adding fuel does not increase range, which is absurd.)

Reply on news.ycombinator.com