An analysis of ICAO requirements and recommendations for information security of the ATN

Abstract

Development and commissioning of the Aeronautical Telecommunication Network using standards and protocols for Internet Protocol Suite accompanied by the ICAO requirements and recommendations for the protection of communications against unauthorized access. These requirements, on the one hand, are conceptual in nature determining the levels of protection in accordance with the classification of the OSI/ISO, the general methodology of protection, on the other hand, have mandatory defining specific processes and technical solutions protect information resources. The problem boils down to the integration of various technical security solutions considering their possible deviance, where permitted by the conceptual nature of the requirements, and at the same time ensuring the necessary level of protection. Procedures for the protection of information resources in the implementation of digital communication sessions "ground-to-ground" and "air-to-ground" in the network ATN/IPS, recommended by the regulations of the ICAO, should be implemented in the network, transport, and application layers of digital aeronautical communications. There is not clearly specified strict criteria for the required (guaranteed) level of protection (evaluation criteria for information security from unauthorized access) and at the same time regulates the use of measures to protect the information based on IPsec, IKEv2 and ESP. Therefore the development of threat models and the definition of the functional profile of security for automated systems (AS) of aviation applications can be based on the experience of the development of threat models and definitions of functional profiles of protection for AS of the class "2" and class "3", the operation of which is based on standard telecommunication channels using the standards and protocols of the Internet protocol Suite.