Security, Internet connectivity and aircraft data networks

Internet connectivity which was in experimental stages only a few years ago is a reality today. Current implementations allow passengers to access Internet for pleasure and in some cases secure VPN access is provided to corporate networks. Several researchers are looking at the possibility of the existence of a total of three networks: passenger network (PN); crew network (CRN); and the control network (CON). Researchers envision an architecture where these three networks will co-exist in an airplane. The available Internet connectivity can be utilized for transporting flight critical information like cockpit flight data recorder (CFDR) data, digital flight data recorder (DFDR) data, cockpit voice recorder (CVR) data, and controller pilot data link communication. In addition, the Internet connectivity could also be used for other safety mechanisms like video surveillance and remote control of the flight. Security is one of the major concerns that affect the successful deployment of aircraft data networks (ADN) and other safety features. Several studies have been carried out to secure the network using firewalls and intrusion detection system but so far no study has focused on securing the communication channel (between the aircraft and the ground station) and its impact on the ADN. The scope of this research is to determine the viability and need of a security mechanism. The research also focuses on the performance of different security architectures and determine their usability in the framework of an ADN.     

面向互联飞机的空天地网络一体化融合研

随着数字化技术的发展，民用飞机会在飞行各阶段产生大量数据，这些数据的利用及处理将提升飞机运营的经济性、安全性与舒适性。为了适应未来互联飞机对海量数据交换与传输的迫切需求，满足民用飞机对无线通信服务质量(QoS)的要求，有必要充分利用并合理分配多种现有和未来的空天地无线通信链路资源。分析了互联飞机的概念、生态系统及其对空天地网络的网络需求，研究了地面异构移动互联网采用的紧耦合和松耦合两种融合方法，采用了网络体系融合、IP网络和非IP网络融合及终端融合等多种融合手段，提出了适应于多种通信链路与网络体系特点的一体化空天地无线通信链路的融合架构，并对网络协议栈、网络安全以及集成验证提出了初步考虑。     

基于身份的空间网络安全研究

空间网络安全的研究是天地一体化网络研究的重要组成部分,日益受到研究人员的重视。本文根据空间网络面临的安全威胁,分析需要采用的安全机制,构建了空间网络的安全体系结构。深入分析基于身份的密码体制（IBC）,在空间网络中应用IBC提供安全服务框架,以此为基础,提出了一种密钥交换协议,并详细描述了安全通信的建立过程。分析表明,同传统的基于公钥基础设施（PKI）体制的安全解决方案相比,IBC具有较低的存储、通信和计算开销,是适合空间网络的有效安全方案。     

针对TCP/IP漏洞的航天测控通信网安全防护

航天测控通信网自建成以来,整体运行较为稳定,但在网络安全方面也暴露出了一些问题,为研究和解决目前航天测控通信网中存在的网络安全问题, 在分析TCP/IP (Transmission ControlProtocol/Internet Protocol,传输控制协议/互联网协议)分层协议基本原理的基础上,研究了IP网数据链路层、网络层和传输层的协议漏洞及常见攻击方法,详细介绍了当前航天测控通信网的网络安全部署情况,根据网络现状分别对航天测控通信网上数据链路层、网络层和传输层存在的安全问题进行了纵向分析,针对分析出的各类安全问题,进一步给出了有效的防御措施和防护方法。最后,探讨提出了一套航天测控通信网配置维护管理系统的设计方案,通过建立设备配置信息库、检查信息记录库及网络故障库等,实现了对航天测控通信网安全稳定运行的有效管理。     

高校局域网中ARP攻击防御策略的分析与实施

随着计算机网络和信息技术的快速发展,校园网早已覆盖了整个高校,然而网络攻击威胁信息安全并严重影响校园网的正常运行,其中来自局域网的ARP攻击因其危害大和定位难等特点日益突出.为了确保校园网安全稳定,通过研究ARP协议的工作原理及其存在的漏洞,分析ARP攻击危害和原理,结合高校局域网的实际情况和网管的实战经验,提出了采用改变用户上网习惯、静态绑定IP/MAC地址、安装ARP防火墙、PPPOE拨号计费方式、VIAN划分和交换机端口隔离这几种办法结合起来,使我校的ARP攻击取得了良好的防御效果,确保校园网的安全运行.     

Secure wireless collection and distribution of commercial airplane health data

The introduction of wireless communication capabilities supporting transfer of sensor data and information on-board commercial airplanes as well as between airplanes and supporting ground systems has the potential to significantly improve the safety and efficiency of air travel. The benefits, however, come at the cost of information security vulnerabilities introduced by data networks. Regulatory institutions, including the FAA, are aware that security requirements for network-enabled airplanes must be fully identified. Therefore, this focuses on wireless airplane health monitoring and management, and contributes a security framework to identify threats and system requirements to mitigate these threats. We also present challenges and open problems in enabling secure use of wireless sensor networks for health monitoring and control of commercial airplanes.     

全球卫星导航星座网络协议体系与运行模式

针对全球卫星导航星座网络建设初期或论证阶段所涉及的网络体系结构、协议体系及相关组网等技术问题,开展了基于导航星座星间链路构建空间信息网络的技术研究,分别提出了由子网、接入网、骨干网等节点及其相互之间星间、星地无线链路构成的分层网络系统结构,设计了兼容遥控、遥测、测量与网络交互支持等业务的基于IP over CCSDS(基于空间数据系统咨询委员会标准的空间链路承载互联网协议业务)的协议体系,给出了全系统基本通信业务运行模式等。与传统高轨卫星通信系统相比,该星座网络具有高覆盖、低时延、随遇接入等优点,可实现星座导航性能与中低轨及地面用户通信性能的全方位提升,相关结果对我国全球卫星导航星座网络技术研究具有一定的参考意义。     

A Novel Onboard-gateway-based Mechanism to Improve TCP Performance in Aeronautical Satellite Networks

The IP-based networks on aircraft serve to support Internet services via satellites. However, in aeronautical satellite hybrid net- works,the TCP protocol performance often deteriorates due to improper decreases and slow recovery of the congestion window. This paper proposes a window size determination and notification mechanism, onboard-gateway-based mechanism (OGBM), which is based on the onboard gateway in the networks on aircraft. A cross-layer approach is adopted by the onboard gateway to obtain the satellite link bandwidth information. And then, by the gateway, through changing the receiver’s advertised window field in ACK packets, TCP sources are notified of the window size of each TCP source calculated on the ground of bandwidth delay product and flow numbers. The mechanism is able to avoid improper changes of TCP window and serve multiple users. Simulation results show that the mechanism with the fairness index close to 1 improves TCP performance in aeronautical satellite networks.     

Intelligent modeling and identification of aircraft nonlinear flight

In this paper, a new approach has been proposed to identify and model the dynamics of a highly maneuverable fighter aircraft through artificial neural networks（ANNs）. In general, aircraft flight dynamics is considered as a nonlinear and coupled system whose modeling through ANNs, unlike classical approaches, does not require any aerodynamic or propulsion information and a few flight test data seem sufficient. In this study, for identification and modeling of the aircraft dynamics, two known structures of internal and external recurrent neural networks（RNNs） and a proposed structure called hybrid combined recurrent neural network have been used and compared.In order to improve the training process, an appropriate evolutionary method has been applied to simultaneously train and optimize the parameters of ANNs. In this research, it has been shown that six ANNs each with three inputs and one output, trained by flight test data, can model the dynamic behavior of the highly maneuverable aircraft with acceptable accuracy and without any priori knowledge about the system.     

TP-Satellite: A New Transport Protocol for Satellite IP Networks

As a result of the exponential growth of the worldwide Internet, satellite systems are used to support broadband Internet access. Existing TCP protocols perform very well for Internet access on wired networks. However, in the case of satellite channels, due to the effects of high bandwidth asymmetry, long propagation delay, high sporadic bit error rate (BER) and burst errors, TCP performance degrades significantly. In this paper, a new end-to-end transport protocol, TP-Satellite, is proposed for satellite IP networks. TP-Satellite replaces the traditional slow start algorithm with a novel super start algorithm. In order to distinguish congestion events from link errors, a new scheme is introduced, which is based on alternate transmission of different class priority packets. Bandwidth asymmetry problems are addressed by the adoption of a modified negative acknowledgement (M-NACK) strategy, which periodically sends M-NACK packets. Simulation results show that TP-Satellite enhances the throughput performance on the forward path, reduces the bandwidth used in the reverse path, and offers a fair share of network resources.     

软交换承载网络组网模式分析与研究

针对软交换网络中信令流、媒体流和维护流等业务流的交互需求,结合SOFTX3000软交换设备、UMG8900通用媒体网关设备和UA5000用户接入设备相关单板的工作原理,分析了采用二层组网模式的承载网络存在的弊端,提出了基于OSPF(Open Shortest Path First,开放式最短路径优先)协议的三层路由组网模式,并在某电话局软交换网络中得到应用。经分析,采用三层路由组网模式相比于二层组网模式具有更高的安全性和可靠性。     

基于融合神经网络的航空发动机剩余寿命预测

航空发动机的性能退化是影响飞机飞行安全的重要因素。准确预测发动机的退化过程,对于飞机安全飞行具有重要意义。针对航空发动机剩余寿命预测问题,本文提出了一种将卷积神经网络和长短期记忆网络相融合的数据驱动模型。与常规使用单一的神经网络不同,所提出的融合模型结合了两种神经网络的优点,利用卷积神经网络提取数据中的空间特征并采用长短期记忆网络提取时间特征。实验结果证实,在寿命预测中,所提出的数据驱动模型与已有的方法相比,评分和均方根误差分别下降了32%和6.4%,因此,所提出的数据驱动模型可对数据中所包含的信息进行充分挖掘,其对航空发动机寿命预测精度较高,并具有良好的稳定性。     

基于S3C2440的网络隔离器设计与实现

介绍了一种网络隔离器的设计与实现方法。以三星公司的ARM9芯片S3C2440为载体,以SPI（串行外设接口）数据传输为手段,结合自定义数据传输协议,实现了无操作系统的网络数据隔离器。对系统的总体结构、软硬件实现方法进行了详细说明,重点介绍隔离系统的工作原理及内部工作流程,并对数据传输协议的安全性进行了研究。基于本文设计思想研制的网络隔离器,能有效过滤内部网络与外部网络之间传输的非认证数据,确保了内部网络的安全性。     

Data communications concept for a SATS scenario

The small aircraft transportation system (SATS) concept envisions doorstop to destination transportation in a safe and timely manner. Data communications are a key component in achieving the aviation-related operational performance improvements that are sought. However, data communication doesn't start when you get into the aircraft; it starts back at the location where the flight is planned. In fact, data communications support the pilot in all phases of the flight: flight planning, pre-flight, departure, en route, transition, approach, landing, and rollout as well as for a missed approach. The Internet is being used to perform flight planning activities, and the mobile communications available today support Internet access en route to the departure airfield. On-board the aircraft, data communications provide surveillance and air traffic control (ATC) support to the pilot. The location of other aircraft is available to the pilot and ATC system through automatic dependent surveillance-broadcast (ADS-B) and traffic information service-broadcast (TIS-B) applications that transmit the location of other aircraft in the vicinity. Other aircraft locations are used to forecast potential conflicts and, thus, enhance flight safety. As the aircraft nears a SATS-equipped airfield, the pilot uses data link messages to request a landing sequence. The airport management module (AMM) provides a landing sequence assignment to the aircraft. As the pilot maneuvers the aircraft for a landing, he/she is using data-linked surveillance data to determine the location of other aircraft and maintain a safe separation distance between aircraft even in a low visibility environment.     

Reliability Analysis of Aircraft Condition Monitoring Network Using an Enhanced BDD Algorithm

The aircraft condition monitoring network is responsible for collecting the status of each component in aircraft. The reliability of this network has a significant effect on safety of the aircraft. The aircraft condition monitoring network works in a real-time manner that all the data should be transmitted within the deadline to ensure that the control center makes proper decision in time. Only the connectedness between the source node and destination cannot guarantee the data to be transmitted in time. In this paper, we take the time deadline into account and build the task-based reliability model. The binary decision diagram (BDD), which has the merit of efficiency in computing and storage space, is introduced when calculating the reliability of the network and addressing the essential variable. A case is analyzed using the algorithm proposed in this paper. The experimental results show that our method is efficient and proper for the reliability analysis of the real-time network.     

SVSS: Intelligent video surveillance system for aircraft

Safety and security are the most discussed topics in the aviation field. The latest security initiatives in the field of aviation propose [1I] the aircraft carriers to implement video surveillance within the aircraft at strategic locations. The current proposals allow the video surveillance data to be stored within the aircraft and monitored by one of the flight crew. The monitoring crew will be responsible for identifying the anomaly within the aircraft and take necessary preventive actions. With the introduction of additional technology within the aircraft, mere human perception may not be sufficient to make a decision. In this research work, the authors explore the possibility of implementing a smart video surveillance system (SVSS) within the aircraft that is tuned toward detecting the behavioral anomaly within the aircraft. The SVSS will generate security triggers when it detects an anomaly within the aircraft. These triggers could be combined with other triggers generated by different aircraft components (possible alarms from the flight crew, data traffic anomaly, or alarm generated by one of the avionics components) to provide a better understanding of the situation to the monitoring crew.     

Aircraft health management network: A user interface

Network management is one of the most discussed topics in the networking fraternity. The efficiency of the network management suit is measured by the number of parameters/components handled by the application while making decisions. In the case of internet-enabled aircrafts, along with network security, even aircraft safety needs to be considered as a factor while designing the Network Management suit. This requires the Network Management suit to monitor/analyze the aircraft-related data (avionics data, physical security parameters, etc.) while determining the proper functioning of the overall system. Herein, these authors present a framework for Network Management suit that, along with network health, monitors inputs from avionics, video surveillance system, weather monitoring system, and manual pilot alarms, and based on the situation, reconfigures the on-board networking devices to stream appropriate flight-critical data to the ground station. The proposed framework attempts to provide a comprehensive user interface for the flight health monitoring crew with all relevant data.     

民机机载系统网络安保适航政策分析

随着信息化、网络化技术的不断发展,机上互连接口的数量和种类越来越多,在带来性能提升的同时也引入了安保风险,给民机安全性带来了挑战。梳理了新一代民机内部网络域、外部网络域的接口类型,总结了国际民航组织、美国联邦航空局、欧洲航空安全局等各机构针对网络安保问题的审定政策,分析机载网络安保相关的工业标准及审定要求,给出了在实际审定中的审定要素和要求。本研究可为我国民机机载系统网络的适航审定提供理论支撑。     

PTDN技术在航天测控通信网的应用研究

针对我国航天测控通信网采用TCP/IP(Transmission Control Protocol/Internet Protocol,传输控制协议/互联网协议)导致的协议无法自主可控、服务质量难以保障以及网络资源难以精细化管理等问题,分析了国际上通信网络技术的现状及发展趋势,在介绍PTDN(Packet Telecommunication Data Network,分组通信数据网)技术的基础上,进行了PTDN技术在航天测控通信网中的适用性分析,给出了协议应用带来的效果改善以及存在的不足。随后,结合PTDN技术的未来发展情况,提出了该技术在航天测控通信网中的应用部署策略。最后,搭建实验环境对航天测控通信网采用PTDN技术的效果进行了实验测试,结果表明PTDN技术可有效支持除组播传输以外的其他业务应用。     

网络数据包还原和内容分析系统的设计与实现

设计并实现了面向内容安全的局域网监控系统。该系统包括网络数据内容还原和内容分析与过滤两大模块,采用旁听模式捕获网络数据包,利用协议分析和会话还原技术实现了应用数据还原;通过文本分析和过滤技术对还原后的应用数据进行安全性检验。该系统能够进行网络信息实时监控,有效地实现了局域网的信息内容监管。