Security Analysis of IMA Primary Processing System Based on DFTA

Transcription

1 Internatonal Conference on Mechatroncs, Electronc, Industral and Control Engneerng (MEIC 2014) Analyss of IMA Based on DFTA Ygang Sun Hao L haol0508@163.com Zhen Zhao zhenzhao0523@gmal.com Zhyong Fan Avoncs Engneerng Faculty, Cvl Avaton, Chna Abstract In order to realze the archtectural benefts (ncreased system scalablty, decreased workload, and etc.), the securty of the IMA archtecture should be put on the frst poston. IMA archtectures utlze shared, confgurable computng, communcaton, and I/O resources. These archtectures do lots of benefts to the avoncs system ntegrators. By learnng from GENIS (a new style of synthess computng platform that comprses IMA and other computng platform, and provdes computng, communcaton and I/O resources for the tme-embedded system known as Hosted ), ths paper focuses on the composton, functon, structure and prncple of the prmary processng system of IMA platform, and enumerates one model about ts characters n component number, communcaton ways, and placed locatons. From the perspectve of ntegrty and avalablty, the securty of IMA archtecture s analyzed usng the Dynamc Fault Tree Analyss n ths paper. The analyss results provde gudance for mplementaton of Hosted n IMA prmary Keywords-; Archtecture; DFTA; processng system; IMA I. INTRODUCTION Integrated Modular Avoncs (IMA) archtectures are based upon a set of modular systems that share computng, communcaton, I/O resources, and etc. In order to conserve computng resources, power resources, and module for the collectve set of avoncs onboard, IMA archtectures ncreased levels of avoncs ntegraton. Thus, the use of ntersystem resources can be a new way n the world of systems ntegraton. An open systems archtecture known as GENIS (Generc Networked Element for Synthess of Integrated ) was mplemented on the Boeng 787 as the Common Core (CCS) [1]. The 787 CCS s one of the frst examples of an open system IMA archtecture that was put nto practce, ths IMA platform can ntally host about 70 applcatons for ndependent supplers, but s capable of hostng over 100 applcatons [2]. Snce a lot of avoncs functons are ntegrated together usng the shared platform resources, the use of ntersystem resources would be a new paradgm n the world of systems ntegraton. Then the complexty of the ntegraton process s ncreased due to the sharng of ntersystem resources. So the securty of IMA platform appears partcularly mportant. Prevous work has addressed modular certfcaton arguments [3], mechansms for compostonal reasonng and modular systems [4], besdes, automated selecton, szng, and mappng of IMA modules had dscussed n [5]. Ths paper has a detal descrpton about the composton and ntegraton of IMA prmary By analyzng the ntegrty and avalablty of IMA prmary processng system, ths paper provdes gudance for mplementaton of Hosted n IMA prmary II. PRIMARY PROCSING SYSTEM OF IMA PLATFORM A. Prncples of IMA IMA archtectures are dfferent from tradtonal federated archtectures for whch each system contans ts own dedcated processor, communcaton channels, and I/O resources. IMA archtectures provde a more effcent soluton by sharng resources and mnmzng resource waste. Multple systems can be archtected and overlad on the parttoned platform resources to form a hghly ntegrated system wth the unque characterstcs of full solaton and ndependence of each ndvdual system. Hosted s s referred to that avoncs systems hosted on an IMA platform. The shared resources must be allocated among the Hosted s wthn the IMA archtecture. For Hosted s, they can own unque sensors,, devces and non-platform LRUs that become part of the functonal system archtecture. Multple Hosted s share the platform resources wthn a logcal system envronment enforced by parttonng mechansms that are mplemented as part of the platform desgn. The logcal system parttonng envronment guarantees that Hosted functons are solated from each other. Fg 1 depcts a type of IMA system archtecture [6]. To mtgate the error propagaton, hgh The authors - Publshed by Atlants Press 534

2 ntegrty fault contanment mechansms should be mplemented and ensure that when a fault n one Hosted or platform component wll not ntate falures n all Hosted s. Redundancy mechansms are also requred to deal wth the error propagaton across multple Hosted s. Logcal Boundares Physcal Boundares Module 1 Infrastructure O/S Processor Communcatons Network I/O Module Fgure 1 parttons A B C A type of IMA system archtecture B. The prmary processng system Module 2 Infrastructure O/S Processor I/O Module As descrbed above, the prmary processng system of IMA platform can be obtaned. It s proposed to dealng wth relevant avoncs tasks and provdng servces for hosted functons. The system s comprsed of sngle or multple IMA cabnets, data transmsson networks and nterfaces. To ensurng that each system applcaton can share computng, network, I/O resources, the allocaton of these resources s predetermned. The prmary processng system of IMA platform can hold the functons of data processng, data transmsson, and data converson based on these shared resources. It s a real-tme dstrbuted computer system whch can manage a synthess processng on data, sgnal and mage. For the expectaton of beng generally used n any avoncs system, at the hardware aspect, IMA prmary processng systems should be desgned as standard modules and combned wth external non-commonly sensors frontend, and applcaton software va nterfaces, fnally mprove nteroperablty and lower the total costs of equpment lfespan[7]. In vew of the mentoned functons, the man components of the IMA prmary processng system can be concluded as GPM, AFDX and RDIU [8]. III. SYSTEM FUNCTION AND CORRPONDING COMPONENTS A. The functon of data processng and General Module (GPM) The data processng functon covers hardware as well as software requrements. It provdes resources for Hosted for the mplementaton of arcraft s Data processng functon can be realzed by resources (enough processng tme, memory and etc.) suppled for Hosted. GPM s system processng resource, whose man task s realzng the data processng It also provdes robust classfcaton for envronment and nfrastructure servces (e.g. I/O, health montorng, the storage and retreval of non-volatle fles based on the ARINC653 standard). Besdes, core software s hosted on t. The realtme operatng system based on ARINC653 s hosted on every GPM whch supples operatng control and resources management n tme-spatal dvson (workng tme dvson, space dvson) for GPM. s lke data processng, health management, data loadng, confguraton management and system recovery are hosted on GPM. The hardware used for GPM can realze fault passve protecton, there s no sngle falure can lead to an ncorrect acton, meanwhle, there s no stuaton that not detected fault leads to an ncorrect acton. GPM owes ts ndependent ntegrty and redundancy whch can meet the avalablty of Hosted. B. The functon of data transmsson and Avoncs Full Duplex Swtched Ethernet (AFDX) The system provdes resources for the data transmsson network whch makes a connecton between data processng resources and other arcraft subsystems based on the ARINC664-P7 standard. The data transmsson network s conssted of End (), Swtch () and AFDX. Each of the n the AFDX s connected wth two redundancy channels and each channel s desgned matched wth the, thus, t can mprove the avalablty of data transmsson. can manage the work status based on the transmsson and recevng of data stream n every logcal channel. Structure of the AFDX network s shown n Fg 2. AFDX network s the communcaton channel of IMA prmary Its structure s dsposed n dual star topology. As for each termnal node n topology structure there wll be a backup node, the two nodes wll connected n a pont-to-pont way wth two ndependent communcaton path (channel A and channel B). Controller Sensor Actuator Controller Sensor Actuator Subsystem Subsystem Arborne Computer Avoncs Internet AFDX Swtch Gateway Fgure 2 Structure of the AFDX network Research on optmal desgn of vrtual lnks n AFDX network was proposed n [9]. So long as the End s meet the requrement of avalablty, they could be separately connected to AFDX network va sngle swtch. Every network channel s desgned to contan all the falures probably taken placed between transmttng and recevng ports. The fault sealng property s realzed by usng complete algorthm that runnng n the End. These wll lead to hgher avalablty n redundancy channels and ensure ntegrty not affected by the network. C. The functon of data converson and Remote DataInterface Unte (RDIU) RDIU s used to complete data converson functon n IMA prmary Its man task s 535

3 provdng data nterfaces va AFDX data bus for seres of tradtonal sensors, and man processng resources. It works as a data-to-data gateway among AFDX network, analog devce, tradtonal ARINC 429 and lnear CAN subnet. RDIU accumulates data from data bus n every buffer area and mappng these data to specally apponted ARINC 664-P7 ports whch located n AFDX End. In order to ensure the separaton between functon sgnals of I/O and avod error propagaton between nterfaces, the parttonng method of I/O n RDIU s physcal separaton method. The structure of RDIU s conssted of two dfferent ntegrty areas, one s shared by all resources users and another s provded ndependently for dedcated users. The mportance of ths structure s to ensure that when falures exst n publc resources, the falures wll not lead to falures n dedcated resources or the functon that s usng the resources smultaneously. Output from each RDIU wll be forced n a safe state when falures or not vald commands exst n output nterface. A fault wll be marked when t s detected and data n transmttng packets n a network wll be regarded as nvald. D. composte structure For the sake of formng a specfed IMA prmary processng system and achevng mplementaton n physcal, the components can nstalled n vares of ways. These components can be assembled n the style of LRU, LRM or PCB, besdes, the LRM and PCB can be combned n the cabnet of IMA to share publc resources lke power and refrgeraton. As n Boeng 787 arcraft, ts CCS s a specfc physcal mplementaton of IMA system. Many GPM and AFDX network swtches are assembled n one cabnet. RDIU s made as RDC n CCS and other AFDX network swtches are made n the style of LRM [10]. The scale of the IMA prmary processng system s changed over the dfferent securty level of Hosted. Fg 3 descrbes one model structure of IMA prmary processng system [11]. Each resource n module can be ncreased or decreased based on the requrement of Hosted n a gven group. When the scale of these modules changed over tme, the system operaton and functon structure wll not be affected, as the resources allocaton whch lnked to functons reman unchanged and have no effect on exstng Hosted. Fgure 3 The left cabnet of IMA ACS-LA GPM-L1 ARS-1A ACS-LB Sgnal Resources (sensors) Hot Backup The rght cabnet of IMA ACS-RA ARS-1B GPM-R1 Sgnal Resources (sensors) Hot Backup ACS-RB One model structure of IMA prmary processng system In Fg 3, GPM and part of network swtches are placed separately n rght/left cabnets and components can be mutual backup f they are n same types. Network swtches are classfed nto two types: AFDX Cabnet Swtch (ACS) and AFDX Remote Swtch (ARS). AFDX s a full meshed network, every swtch connected to another. The data transmtted n channel A s the same as channel B, ntegrty testng and the elmnaton of nvald frames can operated n the then redundant frames can be elmnated by redundancy management. The resource module of IMA prmary processng system can be confgured. To make sure there wll be enough processng tme, memory capacty, I/O port and nterface resource, each Hosted acqures requred resources based on the safety level n the system. The dstrbuton of these resources modules are realzed by the specfc confguraton tables whch loaded to every system component. IV. ANALYSIS AND RULTS In order to ensure the securty of IMA prmary processng system, falure state should be put n the frst place. By usng the Hazard Assessment (FHA), falure state that caused by the potental hazard when system n falure or workng state can be dentfed whlst classfcaton on system falure state should be executed to match wth the level that system expected to be. The FHA results are separately showed n Table I and Table II Table I s about the system avalablty and Table II the system ntegrty. TABLE I THE FHA RULTS ABOUT AVAILABILITY Provdng General Resources for Arcraft RELATED TO IMA SYSTEM State ablty for a crtcal crtcal crtcal Lost the ablty to restart a crtcal Hosted. functon to a hgh necessty hgh necessty hgh necessty Lost the confguraton management functon of system. ablty for a low necessty low necessty low necessty Level s lsted n Table I and Table II are matched wth the functon realzed by IMA prmary processng system, nclude data processng, data transmsson, data converson, and etc. Generally, undetected error data or acton belongs to the doman of system ntegrty whle lost ablty or resource belongs to the doman of system 536

4 avalablty. Only when the requrement of ntegrty and avalablty are fully met can system acheve the requred securty level. TABLE II THE FHA RULTS ABOUT INTEGRITY Provdng General Resources for Arcraft RELATED TO IMA SYSTEM State Undetected error transmsson n network data. nterface resource to a crtcal Undetected error data processng n a processng component. Undetected error behavor n IMA health management Undetected error behavor n data loadng Undetected fault n system confguraton management nterface resource to a hgh necessty nterface resource to a low necessty Level l The classfcaton of securty level n falure state has a drect connecton to the mportance of Hosted, for example, the securty level of falure state s catastrophc so as to the corresponded Hosted. TABLE III RELATIONSHIP BETWEEN SECURITY LEVEL AND THE MAXIMUM PROBABILITY Hazard The Maxmum allowable Class probablty( per Flght Hour) Level Ⅰ 9 Hazard Ⅱ 7 Ⅲ 5 Secondary Ⅳ 3 The correspondng relatonshp between securty level and the maxmum probablty s showed n Table III. A. Fault tree modelng Because of the dynamc characterstcs of IMA prmary processng system, dynamc logcal gates are adopted to establsh the dynamc fault tree wth the help of conventonal method. Combned wth possble falure states, the fault tree model of the ntegrty and the avalablty can be establshed. The dynamc fault tree analyss model s shown as Fg 4 and Fg 5. Fg 4 s ntegrty DFTA model, Fg 5 s avalablty DFTA model. s stand for Undetected Erroneous Data. Loss of ntegrty E1:ARS 1A G1:ARS Falure E2:ARS 1B E3:ACS LA G4:ACS L Fgure 5 E4:ACS LB E5:CCR L G3:CCR L G2:CCR E6:GPM L1 B. Analyss based on DFTA R:Loss of avalablty E7:ACS RA G5:CCR R G6:ACS R E8:ACS RB E9:CCR R avalablty DFTA model E11:RDIU- 1 E10:GPM R1 G7:RDIU Falure E12: Modularzaton s an effectve way to deal wth DFTA. By decomposng the Dynamc Fault Tree nto many ndependent modules, then, numercal combnaton or BDD can be used to analyze statc module and Markov Model used to analyze dynamc module. There the DFTA model n Fg 5 s used to show the process of analyss. Modular decomposton: accordng to the characters of DFTA, a search method based on lnear DFLM s used to modular decomposton. Conductng DFLM search n fault tree module, the result s as TABLE IV. TABLE IV DFLM RULT Event R1 G1 G2 G3 G4 G5 G6 G7 #1 #2 Last Mn Max Mod Yes Yes Yes Yes Yes Yes Yes Yes Statc/Dynamc Dynamc Dynamc Dynamc Statc Statc Statc Statc Dynamc Results can be got form TABLE IV that the statc modules nclude G3, G4, G5 and G6; dynamc modules nclude R, G1, G2 and G7. Statc modules analyss: BDD analyss method s used to analyze statc modules: G3, G4 converted G3, G4 nto BDD chart as Fg 6. E3 E4 G3 BBD E6 E5 E3 G4 BBD E4 GPM GPM OR The probablty of GPM usng one of the GPM s 0.5 GPM L1 GPM L1 GPM L2 GPM L2 Fgure 4 ntegrty DFTA model 0 1 Fgure 6 BDD chart From the BDD chart, the cut-sets of G3 can be descrbed as {E3}, {E4}, {E5} and {E6}. The probablty of top event n G3 can be calculated as: P(G 3) 1 P( E 3) P( E 4) P( E 5) P( E 6) (1)

5 P( G 4) 1 P( E 3) P( E 4) (2) Dynamc Modules Analyss: Markov state-transton method s used to analyze dynamc modules. G1, G2 and G7 contan logc gate n ther structures and the number of backup s one, the corresponded Markov statetranston fgure s as Fg t 1 t 1 t t t Fgure 7 Markov state-transton dagram The prmary component n logc gate has the same falure rate as backup n and the probablty of dynamc module s: PG e e 2 t t (t) 1 2 (3) : the falure rate of the module under the logc gate. Comprehensve Analyss: R can be regarded as an ndependent sub-tree whch takes ndependent sub-tree G1, G2 and G7 as bottom events. Then R can be treated as statc module and converted used BDD method. Then the probablty of R s: P(R) P(G 1) P(G 2) P(G 7) (4) Calculaton: wth the probablty of bottom events provde as TABLE V. TABLE V PROBABILITY OF BOTTOM EVENTS Bottom event Probablty(per hour) Undetected error data n GPM 10 Undetected error data n the of GPM 10 Undetected error data n RDIU 6 Undetected error data n the of RDIU 6 ACS falure Cabnet falure 7 GPM falure ARS falure RDIU falure 5 The probablty of losng ntegrty and avalablty can be ganed as TABLE VI shows. TABLE VI CALCULATION RULTS Loss ntegrty Loss avalablty Level Sut to the degree of Hosted Low necessty Compared the results n TABLE VI wth the securty levels n TABLE III, t s clear that whch structure s sut to the securty level of Hosted and ths wll do benefts to the mplementaton of Hosted n IMA prmary For example, the structure showed n ths paper reaches the prmary securty level and t s appled to low necessty Hosted. V. CONCLUSION Ths paper has a deep study n IMA archtecture especally the prmary processng system of t. A clear structure and composton s showed. From the perspectve of ntegrty and avalablty analyzed by DFTA, ths paper analyses the securty of IMA prmary processng system, the results can be beneft to the mplementaton of Hosted n IMA prmary However, there are stll lots of work should be done to expand the deeper study n the securty of IMA archtecture. One typcal model of IMA prmary processng system was enumerated n ths paper, but t s not necessarly sutable for all avoncs systems. The model should be changed wth the system structure and the revsed system should be re-analyzed. In addton, because of the restorablty of system components and the software securty level were dscounted, the securty analyss s lmted n IMA prmary ACKNOWLEDGMENT Ths work was supported by the project 973 (Grant No. 2014CB744904), the Natonal Scence Foundaton of Chna (Grant No ), the Cvl Avaton Unversty of Chna (CAUC) Research Enablng Foundaton (Grant No. 2012QD22X). REFERENC [1] Chrstopher B Watkns, Smths Aerospace LLC, Grand Rapds. Integrated modular avoncs: Managng the allocaton of shared ntersystem resources [J]. 25 th Dgtal Avoncs Conference, October 15, [2] Jensen, Davd, 1 November 2005, B787 Cockpt: Boeng s Bold Move, Avaton Today. [3] Rushby, John, December 2002, Modular Certfcaton, NASA Contractor Report, CR , NASA Langley Research Center. [4] Namjosh, Kedar S., Rchard J. Trefler, July2000, On the Completeness of Compostonal Reasonng, Computer-Aded Verfcaton, CAV 2000 Vol of Lecture Notes n Computer Scence, Chcago, IL, Sprnger-Verlag, pp [5] Björn Annghöfer, Ernst Kleemann, Frank Thelecke. Automated Selecton,Szng,and Mappng of Integrated Modular Avoncs Modules [J]. 32nd Dgtal Avoncs s Conference October 6-10, 2013, pages 2E2-1 2E2-14. [6] Chrstopher B Watkns, Smths Aerospace LLC, Grand Rapds. Modular Verfcaton: Testng a Subset of Integrated Modular Avoncs n Isolaton [J]. 25 th Dgtal Avoncs Conference, October 15, [7] Zhengqu Xe, Mngwang Wu. Analyss of Arborne Equpment and Its Key Technologes on Large Arcraft [J]. Aeronautcal Manufacturng Technology, 2009(2): [8] Cary R.Sptzer. Dgtal Avoncs Handbook: Avoncs Development and Implementaton [M].Bejng: Avaton Industry Press, [9] Al Shekh, Ahmad, Olver Brun, Maxme Chéramy, and Perre- Emmanuel Hladk, Optmal Desgn of Vrtual Lnks n AFDX networks. Real-Tme s, pages [10] Xaozhe Sun, Song Han, Zongj Chen. Research on avoncs system of and vrtual prototype technology of cvl arcraft [C]. Shangha: Chnese Socety of Aeronautcs and Astronautcs, [11] Hongyan Zheng. Dynamc Fault Tree Analyss for the IMA Core of Cvl Arcraft [D].Nanjng: Nanjng Unversty of Aeronautcs and Astronautcs, 2013: