A dive into world of Aircraft PKI

A Dive into the World of Aircraft PKI

Speakers: Matt Gaffney, Principal Engineer, United Airlines

Conference: DEF CON 32

YouTube: https://www.youtube.com/watch?v=sjd5LrzHus0

Overview

Matt Gaffney, a Principal Engineer at United Airlines and a lead at the Aerospace Village, delivered a compelling presentation at DEF CON 32, offering a "shallow dive" into the complex and critical domain of Aircraft Public Key Infrastructure (PKI). This talk illuminated the fundamental role PKI plays in ensuring the authenticity and integrity of Field Loadable Software (FLS), operational data, and ground-to-air communications for modern commercial aircraft. Recognizing the immense complexity of the subject, Gaffney provided a high-level yet insightful overview, focusing on the practical applications and regulatory mandates that shape aviation cybersecurity.

The importance of this topic cannot be overstated in an era where aircraft are increasingly connected and software-defined. As aircraft evolve from purely mechanical marvels to sophisticated flying computer networks, the security of the software and data they rely upon becomes paramount. Gaffney's presentation serves as a crucial primer for understanding the underlying cryptographic mechanisms that safeguard aviation operations, highlighting both established practices and emerging challenges in an industry where safety and reliability are non-negotiable.

This article delves into the core aspects of Gaffney's talk, exploring the motivations behind robust aircraft PKI, the various methods employed for software signing and verification, and the defensive strategies necessary to protect these vital systems. While acknowledging the proprietary and sensitive nature of some industry specifics, Gaffney aimed to bring "light and not heat" to the discussion, emphasizing collaborative efforts within the aerospace community to enhance cyber resilience.

Background

▶ Watch: Introduction to aircraft PKI and talk agenda (0:00)

Modern commercial aircraft are highly sophisticated machines, heavily reliant on software for nearly every function. This dependence has led to the widespread adoption of Field Loadable Software (FLS), which encompasses everything from inflight entertainment systems to critical flight control surfaces, communication systems, navigation databases, and sensors that generate maintenance logs. Unlike legacy aircraft where firmware updates to Line Replaceable Units (LRUs) often necessitated physically swapping out components, next-generation aircraft allow for FLS to be pushed digitally, enabling new features or bug fixes with greater efficiency. For instance, a Boeing 787 alone can have approximately 1400 different software parts, two of which are dedicated to controlling the bathrooms, illustrating the pervasive nature of software across the aircraft.

Aircraft operators receive FLS from a multitude of sources, including manufacturers, Original Equipment Manufacturers (OEMs), suppliers, and even internal teams who generate User Modifiable Information (UMI). UMI, a subtype of FLS, includes critical configuration loads for the Aircraft Information Systems Domain (AISD), defining network connectivity, and enabling or disabling specific aircraft features. A cornerstone of aviation safety and regulatory compliance is the mandate to rigorously verify the authenticity and integrity of all FLS before it is loaded onto an aircraft. This verification process ensures that the software originates from a trusted source and has not been tampered with. Manufacturers provide operators with specialized software configured with verified supplier trust chains to facilitate this process.

Beyond FLS, aircraft generate a staggering amount of data – hundreds of megabytes, often several gigabytes, per flight leg. This data, primarily from engines and structural stress sensors, is crucial for maintenance, predictive analytics, and operational insights. Upon touchdown, the aircraft's avionics detect the "weight on wheel" signal and immediately attempt to establish ground connectivity via 4G and Wi-Fi. Many airports provide a dedicated common-use network for aircraft traffic called Gatelink, through which operators often implement Virtual Private Networks (VPNs) to secure their network boundaries. Each aircraft's VPN connection can require between one and three digital certificates. Crucially, all this operational data and generated logs are digitally signed and verified before being ingested by operator tools or shared with third parties for analysis, underscoring the pervasive need for robust PKI across all aspects of aircraft operation.

Recent regulatory developments, particularly new rules surrounding ARINC 645-1 Portable Data Loaders (PDLs), further emphasize the criticality of PKI. These rules enforce mandatory signature checking of FLS prior to loading onto the aircraft, meaning a mechanic or technician cannot physically install software if its digital signature fails verification. This technical enforcement removes human error from a crucial security checkpoint, marking a significant step forward in securing the aviation software supply chain.

Key Findings

▶ Watch: Ubiquitous Field Loadable Software (FLS) in modern aircraft (1:00)

Matt Gaffney's talk illuminated the critical role of PKI in aviation by detailing the various methods employed for securely managing Field Loadable Software (FLS) and operational data. The primary "key findings" or contributions of the talk revolve around the practical implementation and challenges associated with three distinct approaches to FLS signing: Method A, Method B, and the conceptual mention of Method C, along with the broader implications for data integrity and network security.

A central finding is the absolute necessity, driven by regulation and operational safety, to verify the authenticity and integrity of all FLS. This is not merely a best practice but a mandated requirement before any software can be uploaded to an aircraft. The talk highlights that this verification is performed against established trust chains provided by manufacturers, ensuring that software originates from a legitimate source.

Another significant finding is the recent regulatory enforcement through ARINC 645-1 Portable Data Loaders (PDLs). This new requirement mandates technical signature checking of FLS before it can be physically loaded onto an aircraft, eliminating reliance on human checks and significantly bolstering the security posture against unauthorized or corrupted software.

Gaffney's detailed exposition of Method A and Method B for FLS signing reveals the industry's diverse approaches to PKI management. Method A emphasizes a "sign once, verify many" model, where the validity of a certificate at the time of signing is paramount, minimizing the need for real-time revocation checks on the aircraft. Method B, conversely, centralizes the signing process through a Hardware Security Module (HSM) and incorporates Certificate Revocation List (CRL) checks, offering greater control over the PKI lifecycle for operators. These methods illustrate the trade-offs between distributed trust models and centralized control, each with its own advantages and operational complexities.

Finally, the talk implicitly finds that PKI extends far beyond FLS. It is integral to securing the massive amounts of operational data generated by aircraft, ensuring the integrity of logs, and establishing secure communication channels (VPNs) between aircraft and ground systems via networks like Gatelink. The sheer volume of data and the number of certificates required per aircraft (1-3 for VPNs alone) underscore the scale and distributed nature of aviation PKI, positioning it as a foundational element of modern flight operations and cybersecurity.

Technical Deep Dive

▶ Watch: Regulatory requirements for FLS verification and PDL checks (3:00)

The core of Matt Gaffney's technical discussion revolves around the intricate methods used for signing and verifying Field Loadable Software (FLS) within the aviation ecosystem. He outlines two primary approaches, Method A and Method B, each with distinct architectures, advantages, and disadvantages. While Method C was mentioned in the agenda, the provided transcript does not elaborate on its technical specifics.

FLS Signing Method A

Method A typically applies when an operator receives software that is either unsigned or when an internal team generates User Modifiable Information (UMI). The process is as follows:

1. Software Receipt/Creation: The operator obtains the software, often in the ARINC 665 load format. This standard defines a structure akin to a zip file with specific header files, encapsulating the software part.
2. Device Sponsor Interaction: A "device sponsor" – typically an authorized individual – initiates the signing process using manufacturer-provided tools. This sponsor possesses a smart card containing their private key and associated certificate.
3. Certificate Verification: The signing software performs an Online Certificate Status Protocol (OCSP) response check to verify the validity of the device sponsor's certificate on the smart card. This real-time check ensures the certificate has not been revoked at the moment of signing.
4. Software Signing: If the certificate is deemed valid, the software uses the private key from the smart card to digitally sign the FLS.
5. Load Creation: The output is a signed load that includes the original data, the encrypted hash (signature) of the software, and the signed OCSP response.

Advantages of Method A:

• Persistent Validity: Once FLS is signed with a valid certificate, its signature remains valid indefinitely, even if the signing certificate is later revoked or expires. This is because the validity is established at the "time of signing." This significantly reduces operational overhead for long-lived software components.
• Reduced Aircraft Burden: Aircraft do not need to access Certificate Revocation Lists (CRLs) or perform real-time OCSP checks. They only need to be configured with the necessary trust chain to verify the signature.

Disadvantages of Method A:

• PKI Control: Operators typically do not control the underlying PKI infrastructure for manufacturer-provided software, meaning they must rely on and pay for the manufacturer's PKI services.
• Complex Ground System Setup: The setup for Method A can be technically challenging. A device sponsor might use a laptop to access a jump box into a highly secured zone, where the signing software resides on a virtual machine (VM). Getting the smart card reader on the laptop to interact seamlessly with the software on the VM through multiple network hops presents significant integration complexities.

FLS Signing Method B

Method B presents a more operator-centric approach to FLS signing, often used for internally managed software or when an operator desires more direct control over the signing process.

1. Data Receipt/Preparation: The operator receives or prepares the FLS. If the data is already signed by an external party, the signature is verified and then stripped off, as the operator will apply their own signature.
2. Hardware Security Module (HSM) Integration: The operator's signing certificate, along with its private key, is securely stored within a Hardware Security Module (HSM). This provides a high level of cryptographic assurance and protection for the private key.
3. CRL Check: The signing software, utilizing the HSM, performs a check against a Certificate Revocation List (CRL) to ensure the signing certificate itself is still valid and has not been revoked.
4. Software Signing: The FLS is signed using the certificate and private key stored in the HSM.
5. Repository Storage: The newly signed FLS is then placed into a secure repository, from which it can be deployed to aircraft.

Advantages of Method B:

• Operator Control: Operators have direct control over their PKI and signing infrastructure, offering greater flexibility and potentially lower recurring costs compared to Method A's reliance on external PKI.
• Enhanced Key Security: The use of an HSM provides a robust, tamper-resistant environment for private keys, significantly reducing the risk of key compromise.
• Simpler Ground System: The architecture can be simpler in terms of user interaction, as direct smart card reader passthrough to VMs might not be required if the signing service is integrated with the HSM.

FLS Deployment from Repository (Applicable to both methods once signed):

Once FLS is in the repository, there are multiple ways to transfer it to the aircraft. While "over the air" (OTA) techniques exist for some aircraft, Matt Gaffney emphasized that these are not the "science fiction" scenarios often depicted. They still require a mechanic or technician to be present in the cockpit to press specific buttons, and certain conditions must be met to enable the update. This highlights the industry's cautious approach to remote software updates, prioritizing safety and human oversight.

Other Mentions

Gaffney briefly mentioned ATA Spec 42 and the concept of Post-Quantum PKI for aircraft in his initial agenda. However, the provided transcript segments do not delve into the technical specifics of these topics. ATA Spec 42 likely refers to a standard related to aviation data management and security, while post-quantum PKI signifies the industry's forward-looking efforts to prepare for a future where current cryptographic algorithms may be vulnerable to quantum computing attacks. This indicates an awareness and ongoing work within the aerospace sector to address future cryptographic challenges, even if the details were beyond the scope of this "shallow dive" presentation.

Demo / Proof of Concept

▶ Watch: Aircraft data generation, Gatelink, and secure VPN connections (4:00)

The technical article focuses on the conceptual and architectural aspects of Aircraft PKI and FLS management. The provided transcript does not describe any live demonstration or proof of concept. The speaker, Matt Gaffney, presented an overview of the mechanisms and processes involved in FLS signing and verification rather than showcasing a specific tool or attack vector.

Defensive Implications

▶ Watch: Deep dive into FLS signing Method A process (6:00)

The detailed mechanisms of Aircraft PKI and FLS management presented by Matt Gaffney offer several crucial defensive implications for aircraft operators and the broader aviation industry. The primary objective is to maintain the highest levels of safety and operational integrity by preventing the loading of unauthorized or corrupted software and ensuring the trustworthiness of critical data.

1. Rigorous FLS Verification: Defenders must ensure that all incoming Field Loadable Software (FLS), regardless of its source (OEM, supplier, or internal), undergoes strict authenticity and integrity checks. This means fully implementing and consistently enforcing the manufacturer-provided software tools that verify signatures against established trust chains. Any FLS that fails these checks must be immediately rejected and investigated.

1. Secure Signing Processes: For operators generating User Modifiable Information (UMI) or applying their own signatures (as in Method B), the signing infrastructure must be robustly secured. This involves:

• Hardware Security Modules (HSMs): Utilizing HSMs for storing private keys is paramount. HSMs provide physical and logical protection against key compromise, tampering, and unauthorized access, significantly enhancing the security of the signing process.
• Smart Card Security: For Method A's device sponsor model, smart cards must be protected with strong authentication (e.g., multi-factor authentication) and their physical security maintained. The ground system environments for signing, often involving virtual machines and jump boxes, need to be architected with zero-trust principles and strong access controls to prevent unauthorized use of signing credentials.
• Certificate Lifecycle Management: Implement robust processes for issuing, managing, and revoking certificates and smart cards. Regular auditing of certificate usage and revocation lists (CRLs) is essential to promptly address any compromised credentials.

1. Enforcement of ARINC 645-1 PDL Standards: The new rules for Portable Data Loaders (PDLs) that enforce signature checking prior to FLS loading are a critical defensive control. Operators must ensure their PDLs are compliant and that these technical checks are not bypassable. This eliminates a significant human-factor risk by preventing mechanics or technicians from inadvertently loading unverified software.

1. Secure Ground-to-Air Connectivity: The reliance on 4G, Wi-Fi, and Gatelink for data transfer necessitates strong network security.

• VPN Implementation: Operators should continue to implement and strengthen Virtual Private Networks (VPNs) through Gatelink to create secure tunnels to their network boundaries. This protects sensitive aircraft data during transit.
• Certificate Management for VPNs: Given that each aircraft's VPN can require multiple certificates, effective PKI management for these connections is vital. This includes secure issuance, distribution, and timely renewal or revocation of VPN certificates.
• Network Segmentation: Implementing network segmentation within ground systems and at the airport gate access points can limit the blast radius in case of a breach, preventing unauthorized access from impacting critical aircraft systems.

1. Digital Signing and Verification of Operational Data: The practice of digitally signing and verifying operational logs and data generated by aircraft (e.g., engine data, stress data) before ingestion or transfer to third parties is a fundamental defensive measure. This ensures the integrity and non-repudiation of critical operational data, which is essential for maintenance, incident analysis, and regulatory compliance. Any anomaly in data signatures should trigger immediate alerts and investigations.

1. Proactive PKI Planning for Future Threats: While not detailed in the talk, the mention of Post-Quantum PKI highlights the need for forward-looking defensive strategies. Security teams should monitor advancements in quantum computing and cryptographic research, begin evaluating quantum-resistant algorithms, and plan for future migrations to ensure the long-term security of aviation PKI against emerging threats.

In summary, aviation cybersecurity defense requires a multi-layered approach, deeply rooted in robust PKI. It spans from the secure creation and distribution of software, through secure data transmission, to the integrity of operational data, all underpinned by stringent regulatory compliance and continuous vigilance against evolving threats.

Key Takeaways

• PKI is Foundational for Aviation Security: Public Key Infrastructure is not merely a component but a critical, ubiquitous layer of security across modern commercial aircraft, essential for the authenticity and integrity of software, data, and communications.
• FLS Verification is Mandated and Critical: Regulatory requirements mandate strict verification of Field Loadable Software (FLS) authenticity and integrity, a process that is technically enforced by new ARINC 645-1 Portable Data Loaders (PDLs), preventing unverified software from being loaded.
• Diverse FLS Signing Methods Exist: The industry employs various methods (e.g., Method A and Method B) for FLS signing, each with trade-offs regarding PKI control, certificate revocation management (OCSP vs. CRL), and operational complexity.
• Secure Hardware is Paramount for Signing: Utilizing Hardware Security Modules (HSMs) for private key storage and securely managing smart cards for "device sponsors" are crucial for protecting the integrity of the FLS signing process.
• Data Integrity and Connectivity Rely on PKI: Beyond FLS, PKI secures vast amounts of operational data generated by aircraft through digital signatures and enables secure ground-to-air communications via VPNs over networks like Gatelink, requiring multiple certificates per aircraft.
• Future-Proofing PKI is an Ongoing Challenge: While not detailed in this talk, the mention of Post-Quantum PKI signifies the industry's awareness and preparation for future cryptographic challenges posed by advancements like quantum computing.

About the Speaker(s)

Matt Gaffney, also known as Gaffers, is a Principal Engineer at United Airlines, bringing extensive industry experience to the critical domain of aviation cybersecurity. His role at a major airline provides him with direct insights into the operational challenges and security requirements of modern aircraft systems. Beyond his corporate responsibilities, Gaffney is also a Village Lead at the Aerospace Village, an initiative dedicated to fostering collaboration and education on cybersecurity within the aerospace sector. Through his work with the Aerospace Village and presentations like this one, he champions the ethos of bringing "light and not heat" to discussions surrounding cyber risks in aviation, promoting informed dialogue and collective solutions within the community.