4 ms·
There should actually be three distinct "air-gaped" networks (or at least classifications of network). Secure: The network that connects and controls the airpl
by mjevans 7y ago
There should actually be three distinct "air-gaped" networks (or at least classifications of network).
Secure: The network that connects and controls the airplane. Absolutely only essential things allowed on, and if possible isolated using mathematically proven secure vlan/isolation techniques.
"Employee": pilots, crew, etc. This is more just a distinct network for corporate operations security.
"Customer": Still try to keep this one secure so that virus and just don't spread, but this is the 'DMZ' area.
Communication from the secure network should be outbound only, and might best be done over a fixed rate serial data connection of some sort.
The modern version might be to configure a point to point network link on a CDMA based system and just disconnect the secure side's RX path entirely. Then you just export the data blind via UDP with like 10X redundancy.
- stefan_ 7y agoMost Boeing planes (though not the 787 discussed here) don't use fly-by-wire, so you could argue that the most essential control plane is perfectly isolated by virtue of not having any sort of network at all, just hydraulics into the cabin.
- blunte 7y agoBut wasn't the 737-max issue that a software system was forcing an elevator change to pitch the nose down? That sounds pretty fly-by-wire (even if hydraulics are involved).
- p_l 7y agoYou could say that the problem was lack of fly-by-wire - if 737-MAX had FBW, the necessary corrections would be bundled as part of flight envelope protection, and that tends to work pretty well and the required checks on FBW systems would catch stuff like "only one AoA sensor used". Instead we got MCAS which was messing with autotrim signals and escaped scrutiny.