A Concept Enabling Cybersecurity for a Self-Adaptive Avionics Platform With Respect to RTCA DO-326 And RTCA DO-356

The aircraft development process ensures safe and secure flight. Due to more frequent advances in technology as well as the need to be economically efficient aircraft manufacturer strive to make aircraft and aircraft systems more customizable as well as reusable. Aircraft concepts of the future will be even more autonomous, customizable, use more Commercial off-the-shelf (COTS) components, and will have more open networks. Focus of our research is the idea of using a self-adaptive avionics platform to address some of those goals. An exemplary implementation of future concepts are the so-called Plug&Fly Avionics (PAFA), which are developed at the University of Stuttgart. PAFA are capable of discovering connected devices, autonomously configure redundancies to meet the safety requirements and confirm its compliance to the safety requirements by an autonomous safety assessment. However, the methods for the topology discovery, self-configuration as well as the communication throughout the platform are not implemented cyber-secure. Cybersecurity assessment for aircraft systems is suggested by the RTCA DO-326 and RTCA DO-356. Consequently, the question arises how to make self-adaptive avionics platforms cyber-secure and how the standards apply to them. Therefore, this paper will determine what needs to be addressed to make a self-adaptive avionics platform, like the PAFA, cyber-secure. An examination on cybersecurity fundamentals and current methods and architectures is conducted. From that a concept enabling cybersecurity for self-adaptive avionics is derived. The concept is based on communication policies to evaluate network traffic. Those policies are derived from the PAFA knowledge about the topology, failure conditions and cybersecurity specific properties. Based on those policies a rule-based software-solution the so-called First Contact Engine (FCE) ensures that the network traffic complies to the policies. The concept is assessed with respect to the current aviation cybersecurity standards RTCA DO-326 and RTCA DO-356.