Cyber Security Concerns Regarding Federated, Partly IMA and Full IMA Implementations

Abstract

Integrated Modular Avionics implementations are increasing in modern aircraft systems against the usage of federated architecture. The reduction of amount of LRU's (Line Replace Units) in the aircraft platform system gives the advantage of reduced recurring costs, reduced logistic and maintenance cost. Reduced number of equipment has also weight and size saving which is very important for avionic developments. On the other hand the IMA implementation cause to an increased complexity with higher level of integration and more abstraction of the functions. In federated architecture implementation each function is deployed on its own computer. The integration of functions on dedicated boards within one equipment, called here as partly IMA implementation, has the advantage of a very good functional segregation, but some overall concepts needs to be clarified such as equipment power reset which will be more complex than the federated architecture. It has also the advantage that on each board the RTOS can be selected indepently. On the standard IMA execution, called here as full IMA implementation each function is deployed on its own partition, but the usage of share resources have to be clarified. Due to the IMA standard time and space segregation is guaranteed from other functions of the core. Cyber attacks can target any subsystem in the aircraft which includes software and could lead to catastrophic failures. Examples of functions enabled by software include powering a system on and off, maintaining cabin pressure level, or controlling attitude. An attacker could potentially manipulate data in these systems. The cyber-attack potentials for different architectures as federated, partly and full IMA systems differs as well as the countermeasure mechanism. For federated architecture systems the manipulation of transmitted data over the data busses could lead to a malfunction in the system. To prevent such manipulation different sensor information from different sources and data busses could be used, but this will increase LRU amount and cabling weight. A denial of service attack could prevent use of information of the network data. The partly IMA concept is more robust regarding the manipulation of transmitted data. Due to the availability of selection of RTOS possible a higher number of different OS could be used, which increase the number of exploits and possible attacks. Within the full IMA concept, where third party applications are used, the injection of malware which leads to manipulation of the scheduling mechanism could effect the whole system operation. A common way to detect such an attack is to review logs of system activity looking for unusual occurrences.