A D-MILS console subsystem for advanced ATM communication services

Air Traffic Management (ATM) in the FAA's NEXTGEN as well as the European SESAR has embraced the concept of System Wide Information Management (SWIM) as the means to improve data exchange between various applications in different domains such as flight data management, weather and aeronautical information management. Enabling SWIM is a challenging change for ATM. Although many building blocks are already available, a full SWIM deployment has yet to emerge. Current SWIM functionality is based on historical grown technical restrictions. A performance-based and efficient approach will require new paradigms to organize the commonly shared information and develop and deploy the associated changes in the different user systems and applications as ATM services are developing towards a global and seamless airspace. The continuously increasing bandwidth in wide area networks has allowed new technologies to emerge such as Cloud Computing and Web based integrated user interfaces. The safety critical nature of ATM requires secure and timely sharing of information between separate platforms and diverse user groups. ATM data producers, consumers as well as the information elements themselves reside in multiple domains and will require seamless integration at the user interface level. This paper introduces a concept for Multiple Independent Layers of a Security (MILS) Console Subsystem (MCS) for a dependable information and communication infrastructure for ATM voice and data services. Safety and security requirements intrinsic to ATM networks present an ideal application for Distributed MILS architectures. This paper focuses on the console subsystem that manages the interactions between a human user and one or more separation kernel (SK) partitions. The MCS, itself, runs on a separation kernel. Its clients are partitions on the same SK nodes in an enclave that are capable of communicating with the MCS in a trustworthy fashion. The MCS communicates with its clients (client application back-end) via SK information channels (e.g. IP communication configured on a single node). The human interface provided by the MCS consists of input/output devices exemplified by a display screen, keyboard, mouse, microphone and speaker that can be shared among partitions for voice and data applications at the same time. MCS use cases are derived from Communication Services representing a unique class of communications equipment serving special purposes in safety-of-life-critical and security sensitive areas. Distributed MILS methodologies are used to achieve the required system availability. Distributed MILS (D-MILS) allows selected information elements to reside in all instantiated structures while completely prohibiting the propagation of faults from one side to the other and as such providing for a valid business continuity design. In the case of separated user domains the solution must not only ensure separation but also the integrity of voice and data streams on an end-to-end basis. Hardware virtualization techniques provide a new way of designing business continuity solutions for ATM solutions. They reduce cost and simplify system designs through the separation of data and information elements from the underlying hardware. The hardware degrades to a commodity exchangeable and replaceable in size, and scales separated from the hosted applications via an abstraction layer. Typical virtualization characteristics include partitioning, isolation, immediate multi-instantiation, and hardware independence. A discussion of the technical challenges arising from the use of an MCS based on a distributed MILS approach in a safety-critical environment concludes this contribution.