In-Flight Aircraft Smart Space Security using Multi-Entity Trust Evaluations

Smart spaces and smart cities allow humans to become more networked in physical spaces such as coffee shops, libraries, and shopping malls to enhance interactions such as custom advertising, navigation and other services. The air travel industry is also evolving through innovative projects like NextGen to become more connected. It is only a matter of time before airports and aircraft advance and become smart spaces to remain competitive. This will result in an increase of diverse passenger-provided computing platforms connecting to in-flight networks, facilitating seamless connectivity but also increasing the risk for cyber attack for all connected systems. Traditional cyber incident response often begins post-compromise, sometimes days or weeks after an attack has occurred. Given the volume and ubiquity of air travel, dedicated per-aircraft defenders are cost and computationally prohibitive, potentially extending this post-compromise detection and response delay. In the air travel use case, such a delay may result in life threatening consequences. Aviation Security Authorities (ASA) must be enabled to respond to new types of threats by deploying preventive risk-based computer network defense (CND) in these emerging smart spaces. We propose a hybrid of distributed and centralized multi-trust models specific to aircraft and in-flight use cases that evolves while the aircraft is in flight, fed by trust data from airline entities, flight crew observations, government records, network defender observations and other passengers. While each of these individual data sources by themselves lacks sufficient contextual information to detect cyber attacks, combining them into an air travel entity trust model to evaluate the risk of particular aircraft, passengers, airports, etc. can supply air travel security services with preliminary information needed to observe and respond to suspicious activity, and enable defenders to more efficiently target defensive resources and active preventative measures to the in-flight networks that most need them. If an untrusted passenger loses access to aircraft WiFi networks, or is not allowed to connect to on-board servers or the Internet due to untrustworthy activity, they may be denied the connectivity required to conduct their attack. Similarly, if expensive tools and human defenders can be engaged only when needed and on a per-passenger or per-aircraft basis, such efficiency gains may overcome prohibitive computation, bandwidth, and personnel costs enabling detection of network threats that appear while an aircraft is in flight.