Avionics Network Security: Vulnerabilities and Gateway Solutions

Introduction

The recent revelations that hackers and cyber terrorists can easily gain access to the avionics of commercial and military aircraft have made it necessary for avionics designers to rethink better ways of securing avionics networks against attacks that may compromise data confidentiality, integrity, and availability. Prominent examples include the hack attack on U.S. drones by Iraqi insurgents, who managed to intercept live video feeds from pilotless spy planes (Heussner and Martinez, 2009), as well as the discovery of a vulnerability in the Boeing 787 Dreamliner's avionics that could allow a hacker to gain access to the plane's computer system and commandeer the aircraft (Harwood, 2008).

As noted by the FAA (2008), the proposed architecture of the Boeing 787 Dreamliner allowed a new kind of passenger connectivity that differed from previously isolated data networks. This new passenger connectivity was found to be capable of creating security vulnerabilities arising from the intentional corruption of data and systems critical to the plane's safety. This paper explores the forms of network vulnerabilities to which avionics are exposed and proposes improved designs to help secure avionics from unauthorized access. The main solution is the use of an integrated security gateway coupled with an appropriate air gap to isolate the passenger-centric network from the plane's critical avionics infrastructure.

The aim of this paper is to explore the forms of network vulnerabilities that avionics are exposed to, as well as to propose improved designs that can help in securing avionics from unauthorized access.

Aims, Methodology, and Data Sources

The methodology used in this paper is a critical review of extant literature in order to identify the knowledge gaps that exist pertaining to network infrastructure and avionic network security technologies. The identified gaps are then used in the formulation of suitable solutions for addressing possible points of vulnerability.

Integrated Security Gateway

The information used in this paper is drawn from various online libraries such as IEEE, the ACM Digital Library, and the FAA. Online newspapers, magazines, and technical blogs are also used in completing this work.

A review of literature has indicated that while the reliance on Internet Protocol (IP)-based networks in the aviation industry has enabled several cutting-edge technologies and unparalleled benefits, it also exposes systems to significant security risks and network attacks (Mostafa, El Kalam and Fraboul, 2010, p. 1). Several security mechanisms and solutions have been continuously developed in an attempt to mitigate the ever-rising number of network attack incidents. Some solutions have been effective in addressing certain problems, but security holes have persisted. The process of securing an open and yet extremely complex system such as airplane avionics has become a daunting task for security engineers. This challenge is worsened by a false sense of security propagated by overdependence on conventional security mechanisms, which can leave openings for hackers and attackers.

In order to ensure that networks are secured, it is important for all existing mechanisms to operate together in harmony. This multilayered approach, suggested by Mostafa, El Kalam and Fraboul (2010), can be coupled with air gap techniques to build a ubiquitous, secured, and scalable avionic system capable of detecting and deterring intrusion while operating seamlessly to provide pilots and passengers safety and convenience throughout the flight. The proposed solution partly involves implementing an architecture that accounts for Quality of Service (QoS) requirements — specifically, a QoS-capable security gateway combined with an air gap for data traffic isolation.

The Most Probable Points of Attack

A review of literature indicates that several services within plane avionics are susceptible to hacker and cyber terrorist attacks. Current commercial airline carrier data networks are based on IP systems (Thantry, Ali and Pendse, 2006), enabling passengers to access the internet and enjoy other connectivity benefits. E-enabled networks have made it possible for applications such as the Electronic Flight Bag (EFB), video surveillance, In-Flight Entertainment (IFE), and VoIP to become part of the contemporary aircraft avionics experience. However, the adoption of TCP/IP, UDP, TFTP, and SNMP protocols into aircraft networks has exposed these sensitive systems to entirely new forms of attack (Reinhart et al., 2004). Several security mechanisms and solutions have been presented to address the growing list of attacks against aircraft avionic systems, yet conventional approaches have been noted to leave significant security holes (Zuccato, 2004).

Most of these security holes go unnoticed and unsealed when existing solutions are combined ineffectively. Beyond that, overdependence on traditional security mechanisms such as firewalls is insufficient for providing a properly secured network. The situation is worsened by the fact that hackers have developed sophisticated methods of attack that can easily compromise traditional security systems. In light of these facts, this paper proposes an integrated security architecture that uses an integrated security gateway and air gap technologies to ensure that the avionics communication system is not compromised. The proposed solution should ensure that performance requirements are met and that system availability is maintained at the levels required for critical traffic.

Conclusion

The main solution proposed in this paper is the use of an integrated security gateway coupled with an appropriate air gap to isolate the passenger-centric network from the plane's critical avionics infrastructure. As demonstrated by the survey of existing security mechanisms — including various firewall types, NAT, VPN protocols such as IPSec and TLS/SSL, and NIDS — no single conventional security tool is sufficient to protect the complex and evolving threat landscape facing modern aircraft avionics. A harmonic, multilayered approach that combines these tools within a QoS-aware security gateway, reinforced by air gap isolation, offers the most robust path toward ensuring data confidentiality, integrity, and availability for both passengers and flight-critical systems.