3 ms·

It seems to me as someone with no experience of designing aircraft control software, avionics or anything to do with planes, that the entertainment system shoul

It seems to me as someone with no experience of designing aircraft control software, avionics or anything to do with planes, that the entertainment system should be on a physically separate network to anything safety critical. Like, different everything: power supplies, switches, cables, control panels, the works. There should be no entryway into the flight control network except from the cockpit.

selectodude 7y ago
The issue is that for every kilogram you need to get into the air, is another kilogram of fuel that you need to carry onboard. Airlines, and by association, Boeing are very conscious of weight over something like airgapping.
- AceyMan 7y ago
  The rule of thumb is: You burn one lb (unit) of fuel for every three lbs (units) of fuel you carry. Me: FAA licensed dispatcher (Also, you'll see a 1:1 rule would imply adding fuel does not increase range, which is absurd.)
p_l 7y ago
There are three separate networks, with data diodes used for cases where information flows between them. HW separation was enforced by FAA back when 787 was in prototype stage.
- jakeogh 7y ago
  Where can one read about the 787 data diodes?
  - Hunisgung 7y ago
    You can read about the fact that there are NO data diodes on the FAA website > The proposed architecture of the 787 allows connection to and access from external sources (the public Internet) and airline operator networks to the previously isolated Aircraft Control Domain and Airline Information Services Domain. > Capability is proposed for providing electronic transmission of field-loadable software applications and databases to the aircraft. These would subsequently be loaded into systems within the Aircraft Control Domain and Airline Information Services Domain. [1] http://rgl.faa.gov/Regulatory_and_Guidance_Library%5CrgSC.nsf/0/2FF392BE50BE5821862572C0004AEB68?OpenDocument http://rgl.faa.gov/Regulatory_and_Guidance_Library%5CrgSC.ns...
    - p_l 7y ago
      That's a request for comments from before 787 got its type certificate - I'd like to see the result, as I do recall there being a request to redesign the networks due to "not enough separation". Even HN talked about it. I can't find the "work-in-progress" reports for type certification regarding the network, but the special conditions involve: > The applicant shall ensure system security protection for > the Aircraft Control Domain and Airline Information > Domain from access by unauthorized sources external to > the airplane, including those possibly caused by > maintenance activity. The applicant shall ensure that > security threats are identified and assessed, and that > risk mitigation strategies are implemented to protect the > airplane from all adverse impacts on safety, > functionality, and continued airworthiness.
ru999gol 7y ago
If Boeing decides to cut costs by using a single network for their entertainment, communications and flight control, who is there gonna be to tell them no? You would assume there is some oversight by independent security researchers who review these planes security, but this assumption seems unsubstantiated. In reality, how is this separation of critical networks looking like exactly? MAC address filters? Are they air-gapped? I would venture to guess, nobody that isn't bound by an NDA knows.
- p_l 7y ago
  Boeing actually attempted that on 787,with some VLAN trickery. FAA caught it and forced them to redesign the setup. As for actual AFDX networks - they have hardcoded forwarding tables and no MAC learning, and separation between networks tends to use data diodes
  - jakeogh 7y ago
    tends?
  - solotronics 7y ago
    As a network engineer it is terrifying that they would try this. Also, even if you have no MAC learning its trivial to sniff the MAC on an endpoint and then spoof it. You would really need pubkey based encryption where the key is stored in secure chips on every endpoint to know for sure what each device is connected to.
    - kerng 7y ago
      Companies do these things all the time and in other industries they get away with it. It would be nice if other industries would have similar strict audits and requirements.
    - p_l 7y ago
      the difference is that AFDX is a "closed" network. If you attached anything to it directly, you're already past the security boundary, as timing and reliability is more important than verifying identities in it.

selectodude 7y ago

The issue is that for every kilogram you need to get into the air, is another kilogram of fuel that you need to carry onboard. Airlines, and by association, Boeing are very conscious of weight over something like airgapping.

AceyMan 7y ago
The rule of thumb is: You burn one lb (unit) of fuel for every three lbs (units) of fuel you carry. Me: FAA licensed dispatcher (Also, you'll see a 1:1 rule would imply adding fuel does not increase range, which is absurd.)

p_l 7y ago

There are three separate networks, with data diodes used for cases where information flows between them. HW separation was enforced by FAA back when 787 was in prototype stage.

jakeogh 7y ago
Where can one read about the 787 data diodes?
- Hunisgung 7y ago
  You can read about the fact that there are NO data diodes on the FAA website > The proposed architecture of the 787 allows connection to and access from external sources (the public Internet) and airline operator networks to the previously isolated Aircraft Control Domain and Airline Information Services Domain. > Capability is proposed for providing electronic transmission of field-loadable software applications and databases to the aircraft. These would subsequently be loaded into systems within the Aircraft Control Domain and Airline Information Services Domain. [1] http://rgl.faa.gov/Regulatory_and_Guidance_Library%5CrgSC.nsf/0/2FF392BE50BE5821862572C0004AEB68?OpenDocument http://rgl.faa.gov/Regulatory_and_Guidance_Library%5CrgSC.ns...
  - p_l 7y ago
    That's a request for comments from before 787 got its type certificate - I'd like to see the result, as I do recall there being a request to redesign the networks due to "not enough separation". Even HN talked about it. I can't find the "work-in-progress" reports for type certification regarding the network, but the special conditions involve: > The applicant shall ensure system security protection for > the Aircraft Control Domain and Airline Information > Domain from access by unauthorized sources external to > the airplane, including those possibly caused by > maintenance activity. The applicant shall ensure that > security threats are identified and assessed, and that > risk mitigation strategies are implemented to protect the > airplane from all adverse impacts on safety, > functionality, and continued airworthiness.

ru999gol 7y ago

If Boeing decides to cut costs by using a single network for their entertainment, communications and flight control, who is there gonna be to tell them no? You would assume there is some oversight by independent security researchers who review these planes security, but this assumption seems unsubstantiated. In reality, how is this separation of critical networks looking like exactly? MAC address filters? Are they air-gapped? I would venture to guess, nobody that isn't bound by an NDA knows.

p_l 7y ago
Boeing actually attempted that on 787,with some VLAN trickery. FAA caught it and forced them to redesign the setup. As for actual AFDX networks - they have hardcoded forwarding tables and no MAC learning, and separation between networks tends to use data diodes
- jakeogh 7y ago
  tends?
- solotronics 7y ago
  As a network engineer it is terrifying that they would try this. Also, even if you have no MAC learning its trivial to sniff the MAC on an endpoint and then spoof it. You would really need pubkey based encryption where the key is stored in secure chips on every endpoint to know for sure what each device is connected to.
  - kerng 7y ago
    Companies do these things all the time and in other industries they get away with it. It would be nice if other industries would have similar strict audits and requirements.
  - p_l 7y ago
    the difference is that AFDX is a "closed" network. If you attached anything to it directly, you're already past the security boundary, as timing and reliability is more important than verifying identities in it.