Upload
others
View
6
Download
0
Embed Size (px)
Citation preview
Aircraft System Security:Evolutions and PerspectivesChantier « Sécurité et Vie Privée »
Bertrand LECONTE7 June 2018
©AI
RBU
S O
pera
tions
S.A
.S. A
ll rig
hts
rese
rved
. Con
fiden
tial a
nd p
ropr
ieta
ry d
ocum
ent
June 2018 Aircraft System Security: Evolutions and Perspectives2
History
Aircraft Cyber Security
Perspectives
©AI
RBU
S O
pera
tions
S.A
.S. A
ll rig
hts
rese
rved
. Con
fiden
tial a
nd p
ropr
ieta
ry d
ocum
ent
June 2018 Aircraft System Security: Evolutions and Perspectives3
History
Aircraft Cyber Security
Perspectives
©AI
RBU
S O
pera
tions
S.A
.S. A
ll rig
hts
rese
rved
. Con
fiden
tial a
nd p
ropr
ieta
ry d
ocum
ent
Timeline
June 2018 Aircraft System Security: Evolutions and Perspectives4
1890 1900 1940
1970
2000
Clément ADER1890
WRIGHT brothers1903
KLM creation1919
Air France creation1933
ICAO – OACI1944
Airbus creation18/12/70
1933 – First knownhijacking
1970 2000
A300FF: 28/10/72EIS: 23/05/74
A320FF: 22/02/87EIS: 18/04/88
A330FF: 02/11/92EIS: 17/01/94
A380FF: 27/04/05EIS: 25/10/07
A350FF: 14/06/13EIS: 15/01/15
2010
©AI
RBU
S O
pera
tions
S.A
.S. A
ll rig
hts
rese
rved
. Con
fiden
tial a
nd p
ropr
ieta
ry d
ocum
ent
Safety vs Security
Safety– Relative to all hazard events and errors– Impacts on properties (aircraft fly ability…) and people’s health (injuries, casualties)– Accidental failure (or bug) Probabilistic approach is possible
Security– Relative to deliberate and malicious acts– Airbus stakes
– Aircraft operation safety– Operational reliability (delays…)– Commercial and business interests– Branding (Airlines or Airbus)
– Threats evolution – mostly external sources (knowledge) No probabilistic approach possible
June 2018 Aircraft System Security: Evolutions and Perspectives5
©AI
RBU
S O
pera
tions
S.A
.S. A
ll rig
hts
rese
rved
. Con
fiden
tial a
nd p
ropr
ieta
ry d
ocum
ent
A320 & A330 Avionics
Avionics: Aviation Electronics– Set of controls, sensors, computers, actuators
25+ ATA chapters Systems are mainly independent ARINC 429 bus
– Unidirectional, point to multi-point– 32bit at a time: 8bit label and 19bit data
– Single value per label: speed, altitude…– Quite low speed: 100Kbps
Simple, Proprietary, Obscure, Isolated, Closed
June 2018 Aircraft System Security: Evolutions and Perspectives6
21 Air conditioning 32 Landing gear22 Auto flight 34 Navigation23 Communications 42 Integrated Modular Avionics24 Electrical power 44 Cabin systems27 Flight controls 45 Maintenance system28 Fuel 46 Information systems
©AI
RBU
S O
pera
tions
S.A
.S. A
ll rig
hts
rese
rved
. Con
fiden
tial a
nd p
ropr
ieta
ry d
ocum
ent
A380 & A350 Avionics
Avionics Full DupleX – AFDX– Deterministic Ethernet– Based on Virtual Links
– Unidirectional, point to multi-points– Switches are enforcing Virtual Links and properties– Bi-directional communication needs two VL Integrated Modular Avionics
– ARINC 653 API– Time and Space partitioning– Incremental certification Open World
Complex, Standardized, Documented, Connected, Open
June 2018 Aircraft System Security: Evolutions and Perspectives7VL – Virtual LinksAPI – Application Programmable Interface
A320 A330 A380 A350Software parts
~30~100
~300
~450
©AI
RBU
S O
pera
tions
S.A
.S. A
ll rig
hts
rese
rved
. Con
fiden
tial a
nd p
ropr
ieta
ry d
ocum
ent
Digital transformation
Mandatory for all industries– Aircraft too
Digital continuity Integration of different Information Systems
– Airlines, maintainers, airport, authorities, passengers… Big data…
Expands surface of exposure of aircraft systems and data to cyber threats
June 2018 Aircraft System Security: Evolutions and Perspectives8
©AI
RBU
S O
pera
tions
S.A
.S. A
ll rig
hts
rese
rved
. Con
fiden
tial a
nd p
ropr
ieta
ry d
ocum
ent
ARINC 664 – Aircraft domains
Aircraft Control Domain‒ Everything that controls the aircraft‒ Highest level of Safety‒ Classic Avionics
Airline Information Service Domain‒ Service to airlines, flight support, maintenance support,
cabin support
June 2018 Aircraft System Security: Evolutions and Perspectives
Aircraft Control Domain
Control the Aircraft Operate the Aircraft
Airline Information Service Domain
CLOSED PRIVATE
Passengers Information and Entertainment Service
Domain
Passengers Owned Devices
Inform and Entertain the passenger
PUBLIC
Flight and Embedded Control Systems
Cabin Core Systems
Air / Ground Network Interface
Maintenance Support
Air / Ground Network Interface
Cabin Support
Flight Support
Administrative functions
Passenger Device Interface
Air / Ground Network Interface
On-board Web access
IFE
Passenger Internet
VHF/HF/Satcom Wireless Satcom/cellular
Sour
ce: A
RIN
C 6
64
Passengers Information and Entertainment Service Domain‒ Services oriented toward passengers‒ IFE, Internet onboard… Passenger Owned Devices‒ All devices owned by passengers and connected to the
aircraft
Security in Aeronautical Communications
9
©AI
RBU
S O
pera
tions
S.A
.S. A
ll rig
hts
rese
rved
. Con
fiden
tial a
nd p
ropr
ieta
ry d
ocum
ent
June 2018 Aircraft System Security: Evolutions and Perspectives10
History
Aircraft Cyber Security
Perspectives
©AI
RBU
S O
pera
tions
S.A
.S. A
ll rig
hts
rese
rved
. Con
fiden
tial a
nd p
ropr
ieta
ry d
ocum
ent
Regulated industry
Regulations are for all stakeholders– Aircraft manufacturers, Airlines, Airports, Maintenance & Repair organizations…– Pilots, Maintainers, Controllers… Authorities
– For aircraft certifications (EASA, FAA)– For operational approbations (National AA) Currently Data Security is not yet addressed by CS-25/Part-25
– CRI (Certification Review Item) and IP (Issue Paper)– Special Condition: the rule– Means of Compliance Regulatory framework and regulations are evolving
– International (ICAO), regional (EASA, FAA), industrial committees (RTCA, EUROCAE), national– Not only aeronautical regulations: GDPR and NIS directives– Will include product specification (CS-25) but also organizations (Implementing Rules – IR 21/M/145…)
June 2018 Aircraft System Security: Evolutions and PerspectivesCRI – Certification Review Item
IP – Issue PaperICA – Instruction for Continued Airworthiness
11
©AI
RBU
S O
pera
tions
S.A
.S. A
ll rig
hts
rese
rved
. Con
fiden
tial a
nd p
ropr
ieta
ry d
ocum
ent
Environment hostility increases over time‒ New attack techniques are found and published‒ Attackers get more knowledgeable‒ Computers used for attacks get more and more powerful
System weaknesses arise over time‒ Vulnerabilities in COTS get published‒ Knowledge about system details leak over time
Aircraft security risk level naturally increase over time
Aircraft System Security: Evolutions and Perspectives
Aircraft security level during life time
12 June 2018
Edimburgh CastleSource: geograph.org.uk
Fire control post for medium and heavy batteries. Heerenduin, Ijmuiden, The Netherlands.© Jonathan Andrew
©AI
RBU
S O
pera
tions
S.A
.S. A
ll rig
hts
rese
rved
. Con
fiden
tial a
nd p
ropr
ieta
ry d
ocum
ent
Impact
Likelihood
Very Likely
Likely
Unlikely
Very Unlikely
Extremely Unlikely
Low Med Strong Very Strong
No
Risk analysis principle
Aircraft System Security: Evolutions and Perspectives
Threat evaluation
Risk = Impact × Likelihood
SecurityObjective
RISK Discussion
Risk accepted
as needed
Functions
Securityexpertise
ArchitectureEnvironment
SecurityImpact
ThreatsScenarios
Likelihood
Securitymeasures
AssetCould damage
Defined for
13
•Preparation means•Window of Opportunity•Execution Means•Attacker profile
June 2018
©AI
RBU
S O
pera
tions
S.A
.S. A
ll rig
hts
rese
rved
. Con
fiden
tial a
nd p
ropr
ieta
ry d
ocum
ent
Environment and assumptions
Environment identifies threat source profile to be considered Trust environment has to be defined Without any trust, nothing is possible, impossible to protect from everything and
everyone
Airline people are by default trusted Flight crews Cabin crews Maintainers
Nevertheless, by default the e-tools they use are not trusted Laptops (EFB, PMAT), tablets… USB sticks, SD cards…
Communications are by default not trusted
June 2018 Aircraft System Security: Evolutions and Perspectives14
©AI
RBU
S O
pera
tions
S.A
.S. A
ll rig
hts
rese
rved
. Con
fiden
tial a
nd p
ropr
ieta
ry d
ocum
ent
Security engineering
Writing security specification is a nightmare– Plain Requirement Based Engineering is not enough
Need for other activities
June 2018 Aircraft System Security: Evolutions and Perspectives15
©AI
RBU
S O
pera
tions
S.A
.S. A
ll rig
hts
rese
rved
. Con
fiden
tial a
nd p
ropr
ieta
ry d
ocum
ent
Threats to counterFood for thought for protection What can be done with what you functionally allow
‒ If you can ask nicely to perform a bad action, why bother doing something else?
Attacks can be on infrastructure and software too‒ Buffer overflow attacks and others…
Denial of Services‒ Resource exhaustion‒ Flooding
Attacks on communication means‒ Spoofing‒ Man in the Middle‒ Jamming
Degraded & backup modes‒ They are simpler and not necessarily protected
June 2018 Aircraft System Security: Evolutions and Perspectives16
Monitoring & administration systems‒ They access all systems‒ They are a central point of attack‒ They could allow easy remote control‒ Front face plugs can be a threat too
Data loading‒ If the attacker can change the software used,
why protect…?‒ It’s a central point of attack
©AI
RBU
S O
pera
tions
S.A
.S. A
ll rig
hts
rese
rved
. Con
fiden
tial a
nd p
ropr
ieta
ry d
ocum
ent
Aircraft Protection Principles
Provide two security barriers in front of critical assets
Ensure that no common vulnerability can affect the two barriers
Provide at least one security barrier on any identified attack path
Security barrier must be fail-secure and not possible to bypass
System must be delivered free of malicious code
Security Assurance needed for all developments
Vulnerability management must be done during all product life
June 2018 Aircraft System Security: Evolutions and Perspectives17
©AI
RBU
S O
pera
tions
S.A
.S. A
ll rig
hts
rese
rved
. Con
fiden
tial a
nd p
ropr
ieta
ry d
ocum
ent
Aircraft Protection PrinciplesDigital signature of software Field Loadable Software
– Field: not in supplier’s premises, can be done on aircraft
– Loadable: can be changed or updated without specific tooling, without opening the box
– Software: Executables, configuration and customization files, databases
Need to ensure– Origin: FLS had been produced by an
authorized supplier– Integrity: FLS had not been modified since
production by the supplier
June 2018 Aircraft System Security: Evolutions and Perspectives18
Transfer (any mean)
Root certificate
AircraftSupplier
Supplier’s certificate
©AI
RBU
S O
pera
tions
S.A
.S. A
ll rig
hts
rese
rved
. Con
fiden
tial a
nd p
ropr
ieta
ry d
ocum
ent
Security evaluation principles
Provide a statement of security level and residual risks
Functional tests, organizational audits, code reviews, pen-tests…
Review of all information that give evidence of security efficiency
Verify security functions and counter-measures ‒ Correctness‒ Integrity‒ Strength‒ Appropriate implementation
Security functions and counter-measures cannot be bypassed
June 2018 Aircraft System Security: Evolutions and Perspectives19
©AI
RBU
S O
pera
tions
S.A
.S. A
ll rig
hts
rese
rved
. Con
fiden
tial a
nd p
ropr
ieta
ry d
ocum
ent
Weakest link dominates security
Attacker can use all possible attack paths
Aircraft System Security: Evolutions and Perspectives
Aircraft has to protect all pathsat the same level
June 201820
©AI
RBU
S O
pera
tions
S.A
.S. A
ll rig
hts
rese
rved
. Con
fiden
tial a
nd p
ropr
ieta
ry d
ocum
ent
Safety and Certification activities useful for Security
Regulatory environment, certification
Review of all modifications
Configuration management
June 2018 Aircraft System Security: Evolutions and Perspectives21
Safety does not imply SecurityBut some Safety related activities help to increase security level
Aircraft architecture
Paranoid programming
Assurance Level (DO178B/C)
Procedures and mitigations
©AI
RBU
S O
pera
tions
S.A
.S. A
ll rig
hts
rese
rved
. Con
fiden
tial a
nd p
ropr
ieta
ry d
ocum
ent
General IT security vs Aircraft SecurityWhere are the particular difficulties? No on-board security administrator
– Monitoring cannot be done in real time by humans
Cycles are different– Update cycles cannot be the same– Development time are longer– Configuration Management is requested by
operations and imposes additional work– Systems are designed for the lifetime of an
aircraft – 25 to 50 years Diversity & multiplicity of interconnected systems
– E.g. ATM systems are different from one country to another during the same flight
June 2018 Aircraft System Security: Evolutions and Perspectives22
Certification– Certification process is long and costly– Need to convince Authorities
Taking into account existing architectures Consequences are usually bigger
– Safety– Liability
Communications– Cost– Roaming– Intermittence
©AI
RBU
S O
pera
tions
S.A
.S. A
ll rig
hts
rese
rved
. Con
fiden
tial a
nd p
ropr
ieta
ry d
ocum
ent
June 2018 Aircraft System Security: Evolutions and Perspectives23
History
Aircraft Cyber Security
Perspectives
©AI
RBU
S O
pera
tions
S.A
.S. A
ll rig
hts
rese
rved
. Con
fiden
tial a
nd p
ropr
ieta
ry d
ocum
ent
Perspectives
June 2018 Aircraft System Security: Evolutions and Perspectives24
New functions
MobilityRemote actions
Automation
Less on-boardtreatments
Cloud computingBig data
Artificial IntelligenceSecurity solutions
FilteringUser & Device authentication
AttestationsIntrusion detection
Formal proofsRegulation evolutions
More connectivity
Connected operationsSecure communications
Key managementProtection for jamming, spoofing
Less footprintLess weight, power, volume, heatLower RC
VirtualisationSegregation
Consolidation
New methods
MBSEFaster updates
Development methodsAgile methods
Lower NRC
MBSE – Model Based System EngineeringRC – Recurrent CostNRC – Non-Recurring Cost
©AI
RBU
S O
pera
tions
S.A
.S. A
ll rig
hts
rese
rved
. Con
fiden
tial a
nd p
ropr
ieta
ry d
ocum
ent
Conclusion
Aircraft System Security: Evolutions and Perspectives25
Security is mandatoryWelcome in the 21st century!
Security to be included since the beginning life-cycleArchitectureTechnical measuresSecurity AssuranceMany processes
Ever evolving subjectNew technologies
(for attackers, for defenders, for functions)New vulnerabilities, new attack methods…
New regulationsAnticipation needed
Security involves many other actors
Airports, airlines, maintainers, air service providers, supply chain…
June 2018
Thank you
© AIRBUS Operations S.A.S. All rights reserved. Confidential and proprietary document. This document and all information contained herein is the sole property of AIRBUS Operations S.A.S. No intellectual property rights are granted by the delivery of this documentor the disclosure of its content. This document shall not be reproduced or disclosed to a third party without the express written consent of AIRBUS Operations S.A.S. This document and its content shall not be used for any purpose other than that for which it issupplied. The statements made herein do not constitute an offer. They are based on the mentioned assumptions and are expressed in good faith. Where the supporting grounds for these statements are not shown, AIRBUS Operations S.A.S will be pleased toexplain the basis thereof. AIRBUS, its logo, A300, A310, A318, A319, A320, A321, A330, A340, A350, A380, A400M are registered trademarks.