EUROCONTROL Centralised Service 6-6 Security Certificate Service Providing trustworthy and interoperable digital security certificates
IMPROVING EUROPEAN ATM CYBER-SECURITY CS6-6/SCS is a service providing a unique source of security keys and certificates to all the users of the European ATM network. Certificates are used as part of the identification and authentication activities. Cross-certification with similar services in other ICAO regions will be established to ensure the interoperability of those certificates. All stakeholders (ANSPs, airspace users, military, airports, etc.) will benefit from CS6-6/SCS to establish secured links with the network. A trustworthy security certificates service provision CS6-6 aims to achieve these goals by becoming the European ATM Centre in charge of managing the security certificates service provision for ATM purposes.
The modernisation of the air traffic management (ATM) system is leading to an increasingly interconnected system of systems, as part of ICAO s System Wide Information Management (SWIM), requiring the aviation community to take a joint and consistent approach when addressing any security risks to ATM operations. Centralised Service 6-6 will tackle this with the setting-up of a European ATM Public Key Infrastructure (PKI) which will provide the secure means to identify and authenticate the users and providers of ATM services over SWIM and other communications means. CS6-6 will contribute to increase the level of security of ATM systems and services while, at the same time, ease the interoperability of secured exchanges of ATM data and information. Frank Brenner Director General of EUROCONTROL ICAO Global Air Navigation Plan is paving the way for worldwide evolution of the ATM system to a Data driven system largely supported by Information Management Backbone. In the same time, the increasing use of wide spread technologies and increasing threats on information systems and aviation might jeopardize future evolution of aviation. There is therefore a need to identify vulnerabilities and work collaboratively on practical mitigations. CS6-6 is addressing the Management of Common Network Resources Service/Security Certificate Service. As such, it can be part of the overall solutions that can contribute to worldwide management of the challenging issue of cyber-security. I therefore very much welcome EUROCONTROL CS6-6 initiative which is paving the way for Global and concrete approach on cyber-security challenges in ATM. Farid ZIZI President of the ICAO Air Navigation Commission Building secure foundations for information exchange is a key to rapid adoption of SWIM. We value highly our collaboration with EUROCONTROL and SESAR in this area. Natesh Manikoth FAA Chief Scientist for NAS Sys. Software 3
INTRODUCTION SCOPE OF CS6-6 Most of today s ATM systems are already using the Internet Protocol (IP) to exchange operational data and voice messages. In the near future, most of the European ATM systems will be part of the system wide information management (SWIM) net-centric architecture, as foreseen in the ICAO Global Air Navigation Plan (GANP). This architecture will be based on wide area network (WAN) and will consequently form a single cyber space (ATM network) subject to cyber-attacks. CS6-6/SCS will be part of the security infrastructure of the ATM systems, covering mainly the delivery of the Public Key Infrastructure (PKI) to perform user authentication and encryption/decryption when needed. The scope of CS6-6/SCS covers the management of a PKI as unique source of security keys and certificates to all the users of the European ATM network. SCS scope covers technical, procedural, personnel, and physical security aspects of Policy Management Authority (PMA), Certification Authorities (CAs), Registration Authorities (RAs), repositories, subscribers, relying parties and cryptographic modules, in order to ensure that the certificate generation, publication, renewal, re-key, usage, and revocation is done in a secure manner. SESAR concepts (SWIM and new applications) require more data exchanges between the stakeholders and will rely on the implementation of security mechanism to ensure data integrity, encryption and user authentication. CS6-6/SCS aims at providing the digital certificates needed to provide and use services of the various SWIM profiles (e.g. Blue (Network Manager services), Yellow (ATC-ATC services), Purple (Air-Ground services)). However, there are many other needs than SWIM requiring digital certificates such as local/national provision and use of services or inter-regional exchange of information (e.g. oceanic traffic management). 4 CS BUSINESS OPPORTUNITY Centralised Services are expected to contribute significantly to the Single European Sky performance targets and support the implementation of SESAR developments. They encourage air navigation service providers (ANSPs) and the ATM manufacturing industry to work together to develop innovative solutions and provide services beyond national boundaries, covering the airspace of the EUROCONTROL Member States and positioning themselves on the world scene. CS6-6/SCS will be run under a contract let by EUROCONTROL in its capacity as Network Manager. The service will be provided to all EUROCONTROL Member States, ANSPs, airports and airspace users.
COMPONENTS CS6-6/SCS service aims at securing transactions. 1. Access to services: The ATM stakeholder providing a service will obtain a EUROCONTROL certificate when identified and authenticated using the EUROCONTROL CS6-6/SCS Registration service. This certificate will provide assurance to the user of the service that it is accessing a service delivered by the expected provider. The subscriber (service user in this case) will also be identified and authenticated using the EUROCONTROL CS6-6/SCS Registration Authority to get a EUROCONTROL certificate. The subscriber will use this certificate to access a service. The class/type of the subscriber s certificate will be compatible with the service being accessed and with the intended use (e.g. safety critical or non-safety critical). Relying-parties (ATM stakeholders providing services) will check the validity of subscribers certificate using the EURO- CONTROL CS6-6/SCS validation service (Online Certificate Status Protocol (OCSP) and/or Certificate Revocation List (CRL)). 3. Root-signing Local Certification Authorities: EUROCONTROL Certification Authorities (CAs) will rootsign those European Local Certification Authorities that are willing to and whose Certificate Policy allows it. EUROCONTROL CA will integrate the certificates generated by any of those root-signed Local CAs under the EURO- CONTROL certificate structure/hierarchy. This will consequently allow the mutual and trustworthy recognition of Local CA certificates and EUROCONTROL certificates by any EUROCONTROL Relying-party. Root-signing Local Certification Authorities will ease the interoperability of the existing European ATM stakeholders certificates while ensuring the identity of subscribers and service providers. It will also facilitate: n service providers to extend the use of their services to new ATM stakeholders; n ATM stakeholders to consume new services; n the authenticated exchanges of data/information/ messages amongst European ATM stakeholders. 2. Transmission of data information/message: When sending data/information/message, a subscriber may protect them by encrypting them with keys provided by CS6-6/SCS. The receiver will decrypt the data/information/ message with keys provided by CS6-6/SCS. 6-65
Other CAs (e.g. FAA, ICAO in the future) Root Certification Authority PMA EUROCONTROL Root key component RA Issuing CA-1 (non-safety critical, special case) Issuing CA-2 (safety critical) Issuing CA-3 (reserve - safety critical) EUROCONTROL Contractor CS6-6 Local RA Other Applications/users/systems users/ apps/ systems Local CA EUROCONTROL Subscribers: States/ ANSPs Local applications/users/systems PMA: Policy Management Authority RA: Registration Authority 6
Classes of certificates: EUROCONTROL certificates are made of Certification Authority (CA) certificates and subscriber certificates. Certification Authority certificates are: n the EUROCONTROL Root certificate; n the EUROCONTROL Issuing CA certificates. Subscriber certificates are sub-divided into four types of certificate: 1. Safety critical (SC): certificates for safety critical services or operations such as air/ground communications; 2. Non-safety critical (NSC): certificates for most of the ATM applications/services not having a safety-critical impact; 3. Special cases (NSC): certificates for some specific applications/services which have to be segregated from others due to specific reasons; 4. Reserve (SC): in case some new needs for safety-critical certificates emerge in the future. Hierarchy of authority The hierarchy of authority is set as follows: n Root Certification Authority ( EUROCONTROL Root CA offline operated by the contractor under EUROCONTROL s control); n 3 Subordinate/Issuing Certification Authorities operated and controlled by the contractor: o EUROCONTROL Issuing CA-1 (Non Safety-critical and Special Cases certificates), o EUROCONTROL Issuing CA-2 (Safety-critical certificates); and o EUROCONTROL Issuing CA-3 (Reserve certificates). n Two main categories of entities below the Issuing CAs: o EUROCONTROL for its users/applications/systems; o States/ANSPs in charge of generating the certificates for their own local/national users/applications/ systems. Cross-certification with other ICAO regions Cross-certification with other ICAO regions will provide equivalent benefits as root-signing European Local CAs, by extending the mutual and trustworthy recognition of certificates beyond Europe. A cross-certificate is a certificate issued by a Certification Authority (CA) to another CA that contains a CA signature key used for issuing certificates. To ensure interworking with similar services from other ICAO Regions, cross-certification (e.g. with FAA) will be performed. ICAO may eventually decide to set a worldwide hierarchy of certificates under its management and authority. In such case the EUROCONTROL Certification Authority will be rootsigned by ICAO. In the meantime, cross-certification with the FAA will be initiated. Use of industry s best practices and standards The SCS will rely on a Public-Key Infrastructure using X.509 specifications based on the RFC 5280 simplified view of the architectural model. Revocation status information will be provided using the Online Certificate Status Protocol (OCSP) [RFC2560] and Certificate Revocation Lists (CRLs). The certificate generation relies on public key cryptography system using the key pairs (public and private). Help Desk EUROCONTROL will organise a central Help Desk to support all centralised services and help stakeholders. 7
ROLES AND RESPONSIBILITIES EUROCONTROL will set up a team to manage the CS6-6 services and act as CS6-6 service provider for its stakeholders. EUROCONTROL shall: n fulfil the role of Policy Management Authority (PMA): o Manage and approve CP/CPS (Certificate Policy Certification Practice Statement); o The CP/CPS version existing at the time of the Call for Tenders (Phase1) will become a contractual baseline (CBL) document. Evolutions of the CP/CPS might lead to contract amendments. n remain the RA (Registration Authority) and liaise with LRA (Local RA) (e.g. ANSPs, States); n as Root Certification Authority: Safely host the key components of the Root infrastructure and control the overall certificate management process of the Root CA (e.g. Key ceremonies to generate/renew/revoke Issuing CAs, generate Root CRLs, cross-certification, sign Certificate Trust List); n manage CS6-6 development, implementation and operations (including performance); n fulfil the Central Help Desk and Monitoring service (like for all other CSs); n lead the evolution of CS6-6; n be responsible for the overall coordination with international organisations (e.g. ICAO, FAA, NATO); n set-up and manage Service Level Agreements (SLAs) with CS6-6 subscribers, relying-parties and other entities; n organise the CS6-6 governance. The subscribers i.e. users/consumers of the services provided by the CS6-6/European SCS will be the following: n ATM Stakeholders end users/systems/applications; n EUROCONTROL users/systems/applications. Relying-parties: A aelying-party is any user/application/system that receives certificates and needs to know the status of those certificates to perform its tasks. Therefore, it accesses only the CRL and OCSP services of SCS (no need to request a certificate to perform its tasks). THE CS6-6 CONTRACTOR The contractor shall: During CS 6-6 Phase1: n set up and validate CS6-6 systems and service. During CS 6-6 Phase2: n perform the day-to-day SCS operations in compliance with performance requirements; n set up and maintain the Root CA infrastructure (HW, SW, rooms, access, procedures, personnel) for normal and contingency situations; n set up and maintain the Issuing CAs infrastructure (HW, SW, rooms, access, procedures, personnel) for normal and contingency situations; n protect the EUROCONTROL s private keys using industry standard security measures; n supervise, monitor and control SCS operations and report; n enhance the CS6-6, upon EUROCONTROL s request. THE CUSTOMERS of the services provided by the CS6-6 will be of two kinds. Subscribers: A subscriber is a user (human), an application or a system needing a security certificate supporting its positive authentication in order to perform its task or to access information or services or systems. Each subscriber will have to apply the procedure to be registered (managed by EUROCONTROL, the procedure may be application specific). 8
LINKING CS6-6 TO OTHER CSs CS6-6 TIMELINE SCS will ensure the delivery of a Public Key Infrastructure (PKI) to perform subscriber authentication and encryption/ decryption when needed. Each CS will operate in (a) given site(s) using an infrastructure composed of network components (switches and routers), firewalls, servers and different applications. For each CS, a Security Risk Assessment (SecRA) will be conducted that will identify security risks and propose adequate security controls. Each CS SecRA will therefore identify the need for the use of PKI/digital security certificates for its relevant applications/systems/users. For ATM Messaging Handling System (AMHS), the distribution of keys and certificates will be done over the European Messaging Directory Service (CS6-4). EUROCONTROL was entrusted by its Member States with developing a Demonstrator for CS6-6 in 2014 Following a Call for Interest (CFI) in March 2014 EUROCONTROL expects to select the consortium to develop the Demonstrator Mid-2017 The Calls for Tenders were launched in December 2015 to those organisations that were accepted as a result of the CFI The contractor will develop a Demonstrator over a period of 12 months GO/NO-GO for service The contractor will provide the service during phase 2 (6 years) 9
Governance The objective is to ensure the participation of the CS6-6 users in the governance process. In the tradition of the EUROCONTROL organisation, transparency is key. An established user steering group will be listened to in order to ensure that the voice of the customers is heard. Built on research and development (SESAR) As a founding partner of SESAR, EUROCONTROL is participating actively in R&D activities in Europe. Concept developments and validation exercises mould and develop the knowledge of requirements. In line with the work on SESAR and the SES, the CS in general and CS6-6 in particular will allow further evolution of SWIM (System Wide Information System). CS6-6 will also be involved in SESAR2020 Very Large Scale Demonstrations (VLD). TRAINING ON CENTRALISED SERVICES A training course on Centralised Services is offered by the Institute of Air Navigation Services (IANS), in Luxembourg. The course describes the overall concept of Centralised Services, its business model, governance and management. This course is designed for anyone who is looking to gain a deep understanding of the Centralised Services approach. More info on the Discover Centralised Services course is available in the EUROCONTROL training zone: http://trainingzone.eurocontrol.int CS6-6 supports the Network Strategy Plan 2015-2019 and the Pilot Common Project Implementation Regulation (PCP IR) No 716/2014. CS6-6 is compliant with the SES regulations and in line with the SESAR ATM Master Plan directions and objectives. It is a pan-european central service related to the PCP ATM Functionality AF#5 iswim. 10
GLOSSARY AF AMHS ANS ANSP ATM ATS B2B CA CFI CFT CP CPS CRL CS CTL EASA EMDS ENISA EU FAA GANP IANS IATA ICAO IP IR KPI LRA NM OCSP PCP PKI PMA R&D RA RFC SCS SecRA SES SESAR SLA SWIM WAN ATM Functionality ATS Message Handling System Air Navigation Service Air Navigation Service Provider Air Traffic Management Air Traffic Services Business to Business Certification Authority Call For Interest Call For Tenders Certificate Policy Certification Practices Statement Certificate Revocation List Centralised Services Certificate Trust List European Aviation Safety Agency European Messaging Directory Service European Network and Information Security Agency European Union Federal Aviation Administration Global Air Navigation Plan Institute of Air Navigation Services International Air Transport Association International Civil Aviation Organisation Internet Protocol Implementing Rule Key Performance Indicator Local Registration Authority Network Manager On-line Certificate Status Protocol Pilot Common Project Public Key Infrastructure Policy Management Authority Research and Development Registration Authority Request For Comments Security Certificate Service Security Risk Assessment Single European Sky Single European Sky Air Traffic Management Research Service Level Agreement System-Wide Information Management Wide Area Network
For more information on CS6-6, please contact: CS6-6@eurocontrol.int EUROCONTROL EUROCONTROL February 2017 EUROCONTROL is a pan-european, civil-military, intergovernmental organisation for the airspace of its Member States Albania, Armenia, Austria, Belgium, Bosnia and Herzegovina, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Georgia, Germany, Greece, Hungary, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Moldova, Monaco, Montenegro, Netherlands, Norway, Poland, Portugal, Romania, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland, the former Yugoslav Republic of Macedonia, Turkey, Ukraine, the United Kingdom of Great Britain and Northern Ireland.