afdx与以太网的区别

-1-Comparison between ADN (Aircraft DataNetwork) and Internet worldSui FAN Department of Electronics Engineer Beijing University of Posts and Telecommunications / Telecom ParisTECH Beijing, P. R. China 100876 Sui.fan @eurecom.frAbstractSince ARINC 664/AFDX standard has been selected for wide use in principal aircraft network in advanced airplanes. New generation Aircraft Network is currently under definition to enhance the AFDX in Aircraft Data Network with higher throughput and the support of more applications to open the door between Avionics Data Network and Internet world, which will introduce certain potential security issues. Therefore, this paper is going to introduce the difference between the two worlds.Keywords: AFDX, Internet world, OSI, Virtual Link, Security1 IntroductionFrom 1980th until recently, as the development of technique, ARINC 429,629,664 has been applied in different airplanes with different features. Especially now AFDX is popularly applied in advanced airplanes as local aircraft network communication protocol in Europe. Compared with Eureope, we are making progress recently but it’s still far than enough from catching up. The work is to study Avionics standards, including the basic AFDX tutorials and proposed security analysis draft by some AEEC working groups.Authors’ names are set in boldface, and each name is centered above the corresponding address. The lead author’s name is to be listed first (left-most), and the co-authors’ names (if different address) are set to follow. If only one co-author, list both author and co-author side by side.Please pay special attention to the instructions in section 3 regarding figures, tables, acknowledgements, and references.2 History of Avionics network standardsCurrently, the network architectures onboard avionics are important developments due mainly to increased complexity of embedded systems, in terms of growth of functions and therefore connections between these functions. These complexity problems have to be faced by taking advantage of technological developments based on the concept of architecture modular (which targets a greater share of resources for treatment and communication). Multi communications is one of the major challenges of new architectures generation. Various proposals about bus in avionics communication have been made, in particular under the ARINC which is the body architectures of civilian aircraft standards. Prior to AFDX, Aircraft Data Networks (ADN) utilized primarily the ARINC 429 standard. This standard, developed over thirty years ago and still widely used today, has proven to be highly reliable in safety critical applications. This ADN can be found on a variety of aircraft from both Boeing and-2-Airbus, including the Boeing 737, 747, 757, 767 and Airbus A330 and A340. ARINC 429 utilizes a unidirectional bus with a single transmitter and up to twenty receivers. A data word consists of 32 bits communicated over a twisted pair cable using the Bipolar Return-to-Zero Modulation. There are two speeds of transmission: high speed operates at 100 kbit/s and low speed operates at 12.5 kbit/s. ARINC 429 operates in such a way that its single transmitter communicates in a point-to-point connection, thus requiring a significant amount of wiring which amounts to added weight. Table 2-1:List of the avionics network historyTIME STANDARDs SPEEDSUPPORT FEATURE APPLIEDAIRPLANES1988 ARINC 429 12.5 ~ 100 kbit/s Unidirectional data bus standard; Single-transmitter multi-drop bus with up to 20 receivers B727,B737, B747,B757, B767, A310/A320, A330/A3401999 ARINC 629 2 Mbit/s8 Mbit/s Multi-transmitter protocolB777 2005 ARINC 664,AFDX100Mbits/s Based on ATM, Ethernet 802.3;Single-transmitter with receivers limited only by the number of ports on the switch A380, A400M, A350B787, 2008~ 2010 New Generataion study 1Gbit/s+On the study and research Advanced avion However, most of these proposals are based on media Communications which are old enough, as the ARINC 429 are reliable but with limited performance (100 kbit / s) who do not satisfy the requests from airline manufacturers today, even if they are of simplicity and reliability important.Another standard, ARINC 629, introduced by Boeing for the 777 provides increased data speeds of up to 2 Mbit/s and allowing a maximum of 120 data terminals. This improvement in avionics bus takes into account the constraints of determinism and real-time specific avionics applications directly at the level of techniques Time multiplexing proposed. This ADN operates without the use of a bus controller thereby increasing the reliability of the network architecture. The draw back of this system is that it requires hardware which can add significant cost to the aircraft. Because of this, other manufactures did not openly accept the ARINC 629 standard.The changing technology of local transmission of data (Ethernet switched, ATM, ...) has provided new answers to aircraft manufacturers and consider their use even if the nature of non-deterministic Users must be offset by strong assumptions, including trafficking the network. The solution adopted by Airbus for the new generation A380 is to reuse the basics of switched Ethernet. This technology allows a reuse of development tools and hardware components, which is to have a good confidence equipment reliability and ease of maintenance.ARINC 664 is defined as the next-generation aircraft data network (ADN). It is based upon IEEE 802.3 Ethernet and utilizes commercial off-the-shelf (COTS) hardware thereby reducing costs and development time.AFDX (Avionics Full Duplex switched Ethernet) is formally defined in Part 7 of the ARINC 664 specification. It has since been accepted by Boeing and is used on the Boeing 787 Dreamliner. AFDX bridges the gap on reliability of guaranteed bandwidth from the original ARINC 664 standard. It utilizes a star topology network of up to 24 end systems that are tied to a switch, where each switch can be bridged together to other switches on the network. By utilizing this form of network structure,-3-AFDX is able to significantly reduce wire runs thus reducing overall aircraft weight. Additionally, AFDX provides dual link redundancy and Quality of Service (QoS).However, switches prescribed by the standard ARINC664 conform to the IEEE 802.1D, is possible to lose frames. The problem comes from the level of switches, where different flows will compete for the use of the switch. Indeed, the confluences of traffic are potentially sources of non-determinism of latency through the network and can cause congestion of ports output switches. To address this problem of non-determinism in the AFDX network, several methods for analyzing temporal properties of communication media (latency, throughput, jitter, ...) were used.Besides, security exposure since it adopts the same Internet protocol nowadays while previously the security issues doesn’t exit because those old ADN standards are not compatible with the "Internet open world".3 Illustration of AFDX3.1 A FDX Pr otoco lThe new generations of aircraft boarded more avionics systems, increasing both safety and passenger comfort. These new functions result in a sharp increase in exchanges of data, which requires more flow and opportunities interconnection. The conventional buses communications avionics cannot answer this new demand, which has pushed manufacturers (Airbus and Boeing) to install a network board communication using switched Ethernet technology, also bring the era of AFDX.A vionics F ull D uple X Switched Ethernet (AFDX) is a standard that defines the electrical and protocol specifications (IEEE 802.3 and ARINC 664, Part 7) for the exchange of data between Avionics subsystems, to enable interconnection of system throughout the aircraft. It has three components :Avionics Subsystems, AFDX End System, AFDX Interconnect.Figure 3-1 AFDX Components in Avionics3.1.1 P ra ct ica l n et w o rk s t ru c tu r eOur proposed security mechanism should work for different kinds of environment, not only in A380, but to have an intuitive idea. Let’s have a look at the network structure embedded in current real Avionics first.Figure 3-2 Network structure embedded in AvionicsFigure 3-3 Practical AFDX Topology in A380 (Airbus)-4--5-In this real network structure, we could find all the transmitters or receivers (also called End System) connected with Switches, simply and almost symmetrical, using Star Topology. For every End System connected with Switch, there are two in case of redundancy (red and blue colour).The network consists of a hundred End System (123 End Systems), and 2x9 switches. These switches use FIFO policy.As a network-Full Duplex, of course each End System is linked to a single switch. Traffic on the Industrial AIRBUS is made up of 984 multicast streams, with between 1 and 15 recipients. Generally, hundreds of bytes in a frame can be more efficient than small bytes or large bytes.Note that in the structure, there are two Models called “SCI”, Security Control Interface, which are used to run some software filter function when connecting with Open World.3.2 C omp ar is o n Be tw ee n ADN an d I nt e rn et3.2.1 Mo de l C om p ar is on Be t w een ADN an d Int e rn e tDifference between AFDX and worldwide Internet in the Layer model lies mainly in the Data LinkLayer.Figure 3-4 AFDX under OSIFigure 3-5 End System Protocol Layers-6-As we see from the figures, AFDX transmitted UDP packets in transport layer. It has the application of TFTP as well as those services defined in ARINC 653.3.2.2 Co mm u n icat i on p roc es s of AFDXFigure 3-6.1 Transmission Figure 3-6.2 Receive3.2.3 Co mm u n i c at i on p or t s an d S A P po r t s i n AD N In previous ARINC 653, only communication ports are defined for Sampling or Queuing modes. It’s necessary to understand the conception of Queuing and Sampling in Avionics.•Sampling, when a new value of the data is received, it overwrites the old one. This mode is particularly appropriate for applications that need to receive data periodically. • Queuing mode, values are not erased; contrary, they are stored and presented in order of receipt,until the application had time to read them. This mode is most appropriate for aperiodic data transfers, for which it is necessary that all data being read.SAP (Service Access Point) Port, for TFTP service brought in AFDX, is used for TFTP transfers and communication with compliant networks.AFDX opens the door to a new avionics systemic approach and brings the introduction of Open world, that is why it makes sense in relation to the safety of flight.-7-Figure 3-7 The overall architecture of the information system onboard3.2.4 Di f fe re n ces i n Fr am es S t ru c tur e Now, based on those network structure figures, let’s have a look at more differences in frames structure and address as well as some protocols between the Ethernet protocol and AFDX.What’s different in AFDX frame structure:1. One particular byte to indicate AFDX sequence number;2. Only UDP packets in the payload because AFDX doesn’t use TCP currently.3. The Destination address in the frame only uses Multicast address.Figure 3-8 Structure of an AFDX Frame-8-Figure 3-9 Ethernet Frame Format (exemple)3.2.5 S e qu e n ce Nu m be rThe sequence number is introduced because of Redundancy Management (RM) that is used to protectcommunication, which is also used in the Integrity Check process.Figure 3-10 Network redundancy conceptFigure 3-10 shows the basic concept for network redundancy. A partition using transmitting End System prepares some data and passes it to the communications protocol stack. Here a sequence number field is added to each frame, and the sequence numbers are incremented on each successive frame, to enable the receive function to reconstruct a single ordered stream of frames without duplication before delivery to the receiving partition. In default mode each frame is sent across both of two networks. Upon reception, “First Valid wins” algorithm is used in the communications stack (below IP layer), which means that the first frame to be received from either network with the next valid sequence number is accepted and passed up the stack to the receiving partition. When the second frame is received with this sequence number, it is simply discarded. RM (Redundancy Management) is placed after IC (Integrity Checking).3.2.6 Di f fe re n ces i n MAC de st i na t ion Ad d re s singFigure 3-11 Addressing-9-Actually, in each End System, there would be several partitions. Each is responsible for different services. In each partition, there’s one source IP address and one destination IP address associated with each com port. That implies one partition could have multiple IP address corresponding with multiple ports. And each com port corresponds with one UDP port. Every Virtual Link corresponds with one MAC address.A MAC destination address in the AFDX frame should be a Group and Locally Administrated address and should be compliant with the following format. Like “03 00 00 00 00 0A”.Because there are not so many hosts used in aircraft, to simplify, only 16bits are used, the others areconstant.Figure 3-12 Mac destination addressA MAC source address is unicast address that is always like 02 00 00 10 00 55.Pay attention here, since redundancy management is used in AFDX, so the Interface_ID here is used toindicate network A (001) or network B (010).Figure 3-13 Mac Source address3.2.7 Di f fe re n ces i n IP a ddr es sA IP address is the same as Ipv4 except the Total Length field should range from 21 to 1499 bytes instead of from 21 to 1500 in IPv4 due to the Sequence Number.IP source address is used to identify the transmitting partition associated with the End System, like10.192.1.10.Figure 3-14 IP Source addressThe IP destination address in the IP header of the AFDX frame should be:• Either the IP Unicast address to identify the target subscriber like 10.192.1.10• Or an IP Multicast address compliant to the format shown in FigureFigure 3-15 IP destination address-10- 3.2.8 Co nc ep t ion of VLThe network AFDX establish, in accordance with the ARINC 664, a notion channels by the allocation of bandwidth. These channels are associated with a transmitter and are distributed by multicast (broadcast) Ethernet addresses. The switches enable segregation flows through access control lists(ACL) filtering, similarly to IP firewalls.Figure 3-16 Illustration of VL(Virtual Link) and BAG(bandwidth allocation gap)Each Virtual Link is decided by two parameters: BAG (bandwidth allocation gap) and Jitter. On a per VL basis the traffic regulator (traffic shaping function) should shape the flow to send no more than one frame in each interval of BAG millisecondsIn summary, a Virtual link is therefore characterized by:• Unidirectional,• A single source equipment,• A unique identifier (number and name of VL)• One or more addresses of destination,• A fixed path to reach these destinations on the network,• A maximum and minimum size of a frame (in bits, Smax and Smin)• The BAG is given by the formula: BAG = 1 ms x 2k , with k full 0 to 7, or 1 ms, 2 ms, 4 ms, 8 ms,16 ms, 32 ms, 64 ms, and 128 ms.We see that these data make it possible to define the maximum bandwidth link:it cannot issue the maximum size of a frame up all BAG. His maximum flow is in bits per second, noted ρ.Use of VLs allows the calculation of maximum deferred transmission which are needed to achieve the objectives of the system in aeronautics.The advantage of this concept is to control all flows entering the network. A bad behavior of a stream should not interfere with other flows, so we guarantee separated flows for avionics bus .The flow formed by a virtual link is assured of not being disturbed by other flows sharing the same physical links while during his route in the network.-11-On the other hand, the concept of a virtual link allows, through centralized management of the flow, that the amount of bandwidth allocated to the virtual links on a same Physical link. Indeed, each is VL logically isolated from others. These flows are logical connections between different network equipment where a source can also transmit flows to several destinations (Multicast). The VL is thusseen as a "pipe" on the network, as shown in Figure.Figure 3-17 VL as “”pipe”3.2.9 S w it ch Ta bleIn AFDX, it’s the Virtual identifier corresponding with in port and out port because each VL is unidirectional. In ordinary Internet world, the switch configuration tables always consists of the parameters of Mac address and forward ports, or as well as VLAN number (like Cisco switches); in AFDX network configuration of switch, besides the output ports, the input ports are also configured to map exact MAC destination address, which enforces the filter to ensure the right inbound frames and avoids ARP spoofing.Table 3-2 AFDX Switch table3.2.10 Di f fe re n t implement Mo de s in aircraft, controled by the PIN onboard.The most importance is that certain mode can’t return to the other mode in reverse. What’s more, the PIN who’s indicating the mode of aircraft also be indicated in binary by the certain bits in the MAC dest address.Figure 4-4 Aircraft Modes3.2.11 T h e d iff e ren c es du ri ng t h e c ommu n ic at ion As a summary, the difference of AFDX and Internet secures the avionics network to some extent, here comes to these features:1. Ethernet Full Duplex implies that the use of the algorithm CSMA / CD is no longer necessary.2. AFDX is statically defined; no default gateways.3. ARP, GMRP or Spanning tree are not necessary and should therefore be disabled.Because the configuration of the network must be static and fully known before taking off. This-12-implies The ARP tables in the hosts, the Switch tables (correspondence MAC address of destination/ port (s) of output) must be statically configured by the system integrator. 4.UDP requirements: Checksum is not used in AFDX 5.MUST send packet with TTL of 1 6.Connections are statically defined in AFDX. Therefore, keep alive packets are useless. 7.Only ICMP "echo request" and "echo reply" are allowed, which reduce certain risk of DoS attack using Dead-ping or ICMP tunneling. 8.Sequency number in frame for redundency management, in avoidance of certain repeated fragments transmission. 9. No TCP support service, which reduce certain risk of DoS attack using ACK or SYN Time outis not used for reassembly4 Future security considerationWhy we need to consider security for new generation aircraft network? Because, the aeronautic orgnization proposes targeted environment with three different points as following which implies the door between high seceured aircraft network and opne-minded Internet world has been open. 1.It has created an Internet Protocol network within the aircraft itself 2.The "Passenger Internet Service" has also connected to the "non-essential IP network" 3. The "non-essential IP network" is also connected to "Airline Ground Systems and Internet", whichimplies the aircraft will connect with world-wide InternetFigure 4-1 Proposed targeted Architecture by AEEC SECIn the future, we need to consider the safety and security issues of onboard networks in the new generation aircraft network and to standardize it between airlines and aircraft end systems suppliers. At present, there are several official documents proposed by some international organizations such as ARINC 664/P5 2005 which is about NETWORK DOMAIN CHARACTERISTICS AND INTERCONNECTION; such as A380 PKI Project (phase1 and phase 2 in 2005 that is about Digital Signature to protect software from malicious corruption between software supplier and Airframe / Aircraft Operator and the ARINC Report 811 in 2006 which took 18 months to study on “LANs in Aircraft: Safety, Security and Certification Issues, and Initial Acceptance Criteria”; such as ARINC 823 in 2007 which is about ACARS(Aircraft Communication Addressing and Report System) Data Link Message Security (Part 1) and Key Management (Part 2). On a plus side, the AEEC proposed numerous Technical Application Bulletin Security Use Cases 2008. Based on these reliable proposals, we have to take the security into consideration for our aircraft network communication, (i.e. impersonation on aircraft)especially when China wants to own independent development in the future.Ref e re nc es[1] AFDX Tutorial (May 2005), Condor Engineering, Inc[2] Hussein CHARARA, (2006) ÉVALUATION DES PERFORMANCES TEMPS REEL DE RESEAUXEMBARQUES AVIONIQUES[3] AEEC (October,2006) Working Together: Security Standards in the Aviation Industry[4].FAA (July 26, 2007) LANs in Aircraft including Safety and Security Issues and Initial AcceptanceCriteria[5] THALES GROUP, End System AFDX Functional Architecture-13-。