An adaptive MILS Architecture for Resilient Remote Tower Communication Services

Airports are equipped with manned towers to provide Air Traffic Control services (ATC), including technical and organizational provisions and resources to control aircraft during their arrival, departure, and ground movements at the airport. Lately, Air Navigation Service Providers (ANSPs) have started to rethink the status quo and to explore new technology driven concepts, such as Remotely operated Towers (RT), which concentrate ATC services for multiple airports at a single central location. Safety and security requirements intrinsic to RT deployments present ideal environments for an adaptive Multiple Independent Levels of Security/Safety (MILS) architecture due to the need to - securely and timely - share information between separate domains across networks. This paper introduces a MILS based architecture to implement a Remote Tower reference system. Basically, this requires an air picture (Radar) and optical sensors (cameras), providing a high-quality real-time image of the runway, the airport ramp and the very nearby airspace (data domain). Beside the live video feed from the airport, air traffic management information (data domain) and voice communication systems (voice domain) are necessary to operate a tower remotely. To be resilient, an RT system must be adaptable such that it can be dynamically reconfigured at runtime without compromising the robustness and integrity of the system. This paper focuses on an adaptive MILS architecture that extends MILS with adaptation mechanisms and a framework within which those mechanisms may be safely and securely employed for reconfiguration within the constraints of a configuration policy. We explain how an integrated RT controller working position implements a MILS console to interact with different isolated domains for operation purposes and, in addition, shares specific platform interfaces for system adaption and monitoring. Finally, the paper introduces the complete work flow starting with the initial SLIMIAADL model, system configuration, operation and adaptation. Suggestions to evaluate overall performance and a discussion of the technical challenges arising from the use of an adaptive MILS approach in a safety-critical environment concludes the contribution.