Airport security system

A method, apparatus, and system for managing network security at an airport. A threat level for the airport is identified. A number of policies for a network data processing system is identified at the airport based on the threat level identified for the airport in response to identifying the threat level for the airport. Enforcement of the number of policies is initiated in the network data processing system.

BACKGROUND INFORMATION

The present disclosure relates generally to security and, in particular, to security at airports. Still more particularly, the present disclosure relates to a method and apparatus for managing cyber security at network-enabled airports.

Airports are locations at which travelers board and exit aircraft. Airport security involves techniques and methods used to protect airports and aircraft from undesired actions that may disrupt or reduce the safety of travelers at airports. Airport security has been focused on preventing persons from bringing undesired materials into an airport or onto an aircraft. Currently, airport security has been focused on physical materials.

As new technologies are introduced into aircraft and airports, maintaining a desired level of security becomes more challenging. For example, with e-enabled aircraft, airports may be built or upgraded to include networks to facilitate communication with these types of aircraft. These networks allow the airport, airline, and other entities to exchange information with an aircraft at the airport.

These types of communications allow for improvements in scheduling, aircraft maintenance, operational efficiencies, passenger amenities, and other features.

The use of networks and communications with aircraft involve cyber security concerns for airports and airport users. For example, the ease of accessibility to wireless communications may allow for unauthorized remote access to the networks. Wireless communications may provide a way for undesired persons to manipulate, copy, delete, or otherwise access data in an undesired manner in aircraft and on different systems at an airport.

Therefore, it would be advantageous to have a method and apparatus that takes into account at least some of the issues discussed above, as well as other possible issues.

SUMMARY

In one advantageous embodiment, an apparatus comprises a network data processing system, a policy manager, and a number of agents. The network data processing system is configured for use at an airport. The policy manager is configured to manage a number of policies based on a threat level for the airport. The number of agents is configured to run on the network data processing system and to implement the number of policies on the network data processing system.

In another advantageous embodiment, an aircraft communications system comprises a network data processing system at an airport, a policy manager, and a number of agents. The policy manager is configured to manage a number of policies for communicating with a number of data processing systems on an aircraft at the airport. The number of agents is configured to run on the network data processing system and to implement the number of policies for communicating with the number of data processing systems.

In yet another advantageous embodiment, a method is present for managing network security at an airport. A number of policies for a network data processing system is identified at the airport based on the threat level identified for the airport in response to identifying the threat level for the airport. Enforcement of the number of policies is initiated in the network data processing system.

DETAILED DESCRIPTION

The different advantageous embodiments recognize and take into account a number of different considerations. For example, the different advantageous embodiments recognize and take into account that current security systems and regulations for airports only take into account physical security issues. For example, the different advantageous embodiments recognize and take into account that the Transportation Security Administration (TSA) and the Federal Aviation Administration (FAA) currently have rules and regulations that apply at airports for the operation of aircraft and for operations performed in and around airports.

The different advantageous embodiments recognize and take into account that current regulations do not anticipate or take into account security issues relating to networks used in an airport environment. Further, the different advantageous embodiments recognize and take into account that currently used security systems for network data processing systems do not take into account issues relating to these types of environments. For example, the different advantageous embodiments recognize and take into account that currently used security systems do not take into account changes in threat levels and how those changes may affect the use of networks at airports.

Thus, the different advantageous embodiments provide an apparatus for managing network security at an airport. In one advantageous embodiment, an apparatus comprises a network data processing system, a policy manager, and a number of agents. The network data processing system is configured for use at the airport. The policy manager is configured to manage a group of policies based on a threat level for the airport. The number of agents is configured to run on the network data processing system and to implement the group of policies on the network data processing system.

With reference now toFIG. 1, an illustration of an airport environment is depicted in accordance with an advantageous embodiment. Airport environment100is an example of an environment in which different advantageous embodiments may be implemented. In this illustrative example, airport environment100includes airport102. In these examples, aircraft104may park, taxi, take off, and land at airport102during operation of aircraft104.

In these illustrative examples, airport environment100includes network data processing system106. Network data processing system106comprises network108and data processing systems110. Data processing systems110are connected to network108. Data processing systems110are hardware devices that have processor units or other hardware that are configured to process data. Data processing systems110include at least one of a computer, a laptop computer, a personal digital assistant, a tablet computer, a mobile phone, and other suitable types of data processing systems.

Additionally, aircraft104may take the form of e-enabled aircraft112. When aircraft104takes the form of e-enabled aircraft112, aircraft104is configured to communicate with network data processing system106at airport102in these illustrative examples. E-enabled aircraft112has network data processing system114. Network data processing system114comprises network116and number of data processing systems118. As used herein, “a number of”, when used with reference to items, means one or more items. For example, number of data processing systems118may be one or more data processing systems.

Number of data processing systems118may include at least one of a computer, a line replaceable unit, or some other hardware devices. When more than one computer is present in number of data processing systems118, these data processing systems are in communication with each other through connections to network116.

The connections of data processing systems110to network108and number of data processing systems118to network116may be made using different types of communications links117. Communications links117include at least one of a wired communications link, an optical communications link, a wireless communications link, a selected access point, and/or other suitable types of communications links.

In the different illustrative examples, policy management system120is configured to manage policies122at airport102. Policy management system120comprises hardware, software, or a combination of the two. Policy management system120may be implemented in one or more of data processing systems110. The management of policies122may include at least one of distributing policies122, creating policies122, and enforcing policies122. Policies122may be configured to provide security for computers and other types of data processing systems in at least one of airport102and aircraft104.

In these illustrative examples, policy management system120may take the form of cyber-security system121. Cyber-security system121provides security for network data processing system106at airport102, as well as network data processing system114on e-enabled aircraft112. Cyber-security system121is a system configured to provide security for electronic devices and their communications. These electronic devices for which security is provided may include, for example, without limitation, a computer, a mobile phone, a tablet computer, a router, a wireless interface, a personal digital assistant, a laptop computer, and/or other suitable components for which security and secure communications may be desired.

Policy management system120may perform other operations in addition to providing security for network108and network116. For example, policy management system120may also manage policies for safety and businesses.

As depicted, policy management system120includes policy specifier123, policy manager124, and number of agents126. These different components are located in network data processing system106in this illustrative example. Additionally, one or more of number of agents126may be located in network data processing system114in aircraft104.

As depicted, policy specifier123is located in network data processing system106. Policy specifier123receives input128. Input128may include, for example, without limitation, system goals, requirements, risk assessments, rules, regulations, recommendations, business constraints, and/or other suitable types of information that may be used to generate policies122. Input128may be received or retrieved from any of a number of sources including, without limitation, an airline, a safety organization, a business, a database, and/or other suitable sources.

Policy specifier123uses input128to generate policies122. Additionally, in some illustrative examples, policy specifier123may identify information127for use in identifying threat level129for airport102. Information127may include, for example, without limitation, rules, criteria, and/or other suitable information for use in identifying threat level129for airport102. Further, policy specifier123may indicate the particular policies in policies122to be enforced based on threat level129for airport102.

In these illustrative examples, threat level129for airport102may be a cyber-security threat level. In other words, threat level129may be an indication of the level of risk to the security of network data processing system106and/or network data processing system114.

For example, threat level129provides an indication of the risk of theft, corruption, and/or undesired access to network108, network116, data processing systems110connected to network108, and/or number of data processing systems118connected to network116. Of course, in other illustrative examples, threat level129may also be a physical threat level indicating physical risk to airport102, aircraft104, and/or other physical components in airport environment100. In this manner, threat level129may indicate physical and/or cyber-security risk.

Policy specifier123generates policies122having format131for use by policy manager124. Format131may be a language in which policies122are written, such as, for example, without limitation, extensible markup language (XML) or some other suitable type of language that can be processed by policy manager124.

In these illustrative examples, policy manager124receives policies122generated by policy specifier123in format131. Policy manager124may also receive information127for identifying threat level129from policy specifier123. Policy manager124includes policy database130, policy analyzer132, policy decision maker134, policy enforcer136, and policy updater138. Policy manager124stores policies122in policy database130.

Policy analyzer132analyzes policies122to validate policies122. In particular, policy analyzer132verifies that policies122are consistent and complete with respect to network data processing system106at airport102and/or network data processing system114in aircraft104. In these illustrative examples, policy analyzer132uses information127, rules, criteria, models, tables, and/or other suitable information to model network data processing system106at airport102and/or network data processing system114in aircraft104.

Policy analyzer132uses, for example, without limitation, simulation testing techniques, model checking techniques, mathematical modeling methods, and/or other methods to validate policies122with respect to the models generated for network data processing system106at airport102and/or network data processing system114in aircraft104. Validation of policies122includes, for example, without limitation, verifying that policies122do not violate system constraints and/or rules for network data processing system106and/or network data processing system114. Further, validation of policies122also includes verifying that compliance with policies122does not make network data processing system106and/or network data processing system114behave in an undesired manner or cause undesired effects. Further, validation of policies122may include verifying policy consistency for all known scenarios of the system.

Policy analyzer132identifies any changes that may need to be made to policies122to validate policies122. Any changes that may need to be made to policies122identified by policy analyzer132may be made to policies122by policy updater138.

Policy decision maker134is configured to identify threat level129for airport102. Policy decision maker134selects group of policies135from policies122for enforcement based on threat level129identified for airport102. In particular, policy decision maker134selects group of policies135for enforcement in network data processing system106and/or network data processing system114in response to identifying threat level129for airport102. In some illustrative examples, policy decision maker134may identify at least a portion of number of agents126for enforcing group of policies135. “At least a portion” of number of agents126is one or more of number of agents126.

In these illustrative examples, policy enforcer136initiates enforcement of group of policies135. For example, policy enforcer136may send out group of policies135and/or instructions for enforcing group of policies135to the portion of number of agents126selected by policy decision maker134. Policy enforcer136is configured to send out group of policies135and/or instructions in a format that can be processed by number of agents126. In this manner, policy decision maker134and policy enforcer136uses number of agents126running in network data processing system106and/or network data processing system114to enforce policies122.

In these depicted examples, agent139is an example of one of number of agents126. Agent139is a software agent configured to run on a computer in these illustrative examples. As one illustrative example, agent139is configured to enforce policies122on the particular data processing system in network data processing system106or network data processing system114on which agent139is located and runs.

Number of agents126provides the network and/or host configurations and other information for their corresponding data processing systems to policy manager124. Based on the information provided by number of agents126and/or other suitable information, policy enforcer136determines whether number of undesired events140has occurred or is occurring.

Number of undesired events140may include any event in which a policy in group of policies135that is currently being enforced has not been met in a desired manner. In other words, the event may be a violation of or noncompliance with a policy in group of policies135by an agent in number of agents126and/or a component in network data processing system106and/or network data processing system114.

In these illustrative examples, policy decision maker134determines whether threat level129needs to be changed based on number of undesired events140. In these illustrative examples, policy decision maker134identifies number of actions142to be performed based on number of undesired events140and any changes to threat level129. Number of actions142may include, for example, without limitation, changing a configuration of network108and/or network116, sending out new instructions to one or more of number of agents126, performing operations within network data processing system106and/or network data processing system114, and/or other suitable actions.

Further, one or more of number of actions142may be performed by a human operator. These operations may include, for example, without limitation, maintenance personnel downloading a new database for aircraft104, airline personnel using higher security systems for communicating with an airline back-office, aircraft mechanisms performing additional visual and manual inspections of onboard electronic devices, and/or other suitable actions.

Policy decision maker134and/or policy enforcer136may send out instructions and/or information to number of agents126for performing number of actions142. In some illustrative examples, policy decision maker134and/or policy enforcer136sends out alerts for display to a human operator.

In these depicted examples, policy updater138and/or policy analyzer132may be configured to update policies122based on the information provided by number of agents126and number of undesired events140identified by policy enforcer136, changes to threat level129identified by policy decision maker134, and/or changes to information127. As one illustrative example, policy updater138makes changes to policies122. These changes may include, for example, without limitation, adding a rule to a policy, removing a rule from a policy, changing a rule in a policy, and/or other suitable changes. Policy analyzer132analyzes the changes made to policies122by policy updater138to verify that the changes are correct and complete.

In the different illustrative examples, some decision-making and enforcement capabilities may be assigned to number of agents126. For example, policy enforcer136may send policies122to number of agents126with an identification of threat level129. Each of number of agents126may then determine which policies within policies122to enforce at the data processing system on which the agent is located.

For example, number of agents126may be configured to implement policies122on at least one of network data processing system106and network data processing system114. As one illustrative example, number of agents126may be configured to manage communications with a data processing system in number of data processing systems118on aircraft104.

For example, number of agents126may be configured to specify at least one of a type of communications link in communications links117, a particular data processing system in network data processing system106used to communicate with the data processing system on aircraft104, a wireless access point, and a time during which the communications between the particular data processing system in network data processing system106and the data processing system on aircraft104is permitted.

In this manner, policy management system120manages policies122at airport102based on threat level129. Further, policy management system120provides a system for managing security at airport102. Additionally, policy management system120provides a system for sending information to data processing systems110and/or number of data processing systems118to manage security of these data processing systems and update policies122being enforced at these data processing systems.

For example, in some advantageous embodiments, other airports, in addition to airport102, may be present in airport environment100. Also, some components may be located in another location other than network data processing system106. For example, policy specifier123may be located in a back end office or at some other location other than in network data processing system106at airport102.

With reference now toFIG. 2, an illustration of input used to generate policies is depicted in accordance with an advantageous embodiment. As depicted in this example, input128used to generate policies122inFIG. 1may include different types of input. For example, input128may include, without limitation, safety input200, security input202, business input204, and/or operational input206.

In this depicted example, safety input200includes safety regulations and rules defined by, for example, the Federal Aviation Administration (FAA), Air Traffic Management (ATM), and/or other organizations. For example, safety input200may include rules and regulations for regulating access to and operation of components within airport environment100inFIG. 1. Further, safety input200may include rules and/or other suitable information about the safety of physical and/or mobile resources and information assets in airport102and/or aircraft104inFIG. 1.

In this illustrative example, security input202includes rules, requirements, and/or other suitable information about the cyber security and physical security of, for example, airport102and aircraft104inFIG. 1. Further, security input202includes recommendations for operating and configuring network data processing system114and/or network data processing system106inFIG. 1.

Security input202may be based on security information about airport102inFIG. 1, aircraft104inFIG. 1, the airline, and/or the passengers. Further, security input202may be provided by entities, such as the airline, the Federal Aviation Administration (FAA), Air Traffic Management (ATM), and/or other organizations.

Further, business input204includes requirements, rules, and business constraints, as set by business stakeholders. Business stakeholders include the multiple business entities or persons involved in owning, managing, and operating an airport and the aircraft that fly in and out of the airport.

In this manner, business input204includes information about the methods and/or systems for safely and securely addressing the business goals of the multiple stakeholders associated with airport environment100inFIG. 1. For example, business input204takes into account the business needs and/or goals of airport102, aircraft104, the airline, the passengers, and/or other business entities associated with airport environment100.

In this depicted example, operational input206includes airport operational policies for performing airport operations. Airport operations may include, for example, without limitation, changing departure and/or arrival routes, changing the use of existing runways and/or terminals, changing emergency response policies, and/or other suitable types of operations.

In some illustrative examples, operational input206may also include aircraft operational policies for performing aircraft operations and/or information about the safety systems onboard an aircraft. Aircraft operations may include, for example, without limitation, selecting an emergency response policy for use, procedures for the different phases of flight for an aircraft, and/or other suitable types of operations. Operational input206takes into account airport102inFIG. 1, aircraft104inFIG. 1, the airline, and Air Traffic Management (ATM).

Safety input200, security input202, business input204, and operational input206are used by policy specifier123to generate policies122inFIG. 1. Policy specifier123uses these types of input to generate policies122that are enforced to safely manage airport environment100.

The illustration of input128inFIG. 2is not meant to imply physical or architectural limitations to the manner in which the different advantageous embodiments may be implemented. For example, input128may include other types of input in addition to or in place of the types of input depicted inFIG. 2.

With reference now toFIG. 3, an illustration of different types of policies is depicted in accordance with an advantageous embodiment. In this illustrative example, policies122fromFIG. 1may include at least one of security policy300, safety policy302, business policy304, airport policy306, aircraft access policy308, communications policy310, computer access policy312, physical access policy314, and network access policy316.

In this illustrative example, security policy300is a policy that may be generated based on, for example, security input202inFIG. 2. Safety policy302is a policy that may be generated based on, for example, safety input200inFIG. 2. Business policy304is a policy that may be generated based on, for example, business input204inFIG. 2. Additionally, airport policy306is a policy that may be generated based on, for example, operational input206inFIG. 2.

In this depicted example, aircraft access policy308may be generated based on rules and/or regulations for allowing access to network data processing system114in aircraft104inFIG. 1. For example, aircraft access policy308may identify rules for which users and/or programs are allowed to access number of data processing systems118through network116in network data processing system114or remotely.

Communications policy310may be generated based on the different rules, regulations, and/or parameters for using different types of communications. Communications policy310identifies the type of communications to be used within network data processing system114in aircraft104. The type of communications may be communications using, for example, a wired communications link, a wireless communications link, an optical communications link, and/or some other suitable type of communications link.

Computer access policy312identifies persons who can access a particular data processing system in network data processing system114in aircraft104and/or a particular data processing system in network data processing system106for airport102inFIG. 1. Physical access policy314identifies instructions for allowing physical access to the different areas in airport102inFIG. 1.

In this illustrative example, network access policy316identifies the persons who can access network108and/or network116in airport environment100inFIG. 1. Network access policy316may indicate, for example, whether only airport personnel or everyone, including passengers, may be allowed to access network116in aircraft104.

Any number of policies122may be selected to form group of policies135inFIG. 1for enforcement. The illustration of policies122inFIG. 3is not meant to imply physical or architectural limitations to the manner in which the different advantageous embodiments may be implemented. For example, policies122may include other types of policies in addition to or in place of the types of policies depicted inFIG. 3.

With reference now toFIG. 4, an illustration of user domains for an airport environment is depicted in accordance with an advantageous embodiment. In this illustrative example, user domains400are user domains for airport environment100inFIG. 1. Each user domain in user domains400is a domain to which components, devices, and/or persons in airport environment100belong.

For example, user domains400include aircraft402, airline404, airport406, passenger408, Air Traffic Management (ATM)410, and Transportation Security Administration (TSA)412. As one illustrative example, electronic devices within aircraft104, network data processing system114, and the flight crew for aircraft104inFIG. 1belong to the domain, aircraft402.

A network data processing system, electronic devices, and/or personnel for a particular airline belong to the domain, airline404. Similarly, network data processing system106for airport102, airport personnel, and/or other components within airport102inFIG. 1belong to the domain, airport406. In this illustrative example, the passengers either in aircraft104and/or in airport102may belong to the domain, passenger408.

In this illustrative example, all electronic devices, personnel, and/or other components associated with Air Traffic Control and Air Traffic Management (ATM) belong to the domain, Air Traffic Management (ATM)410. Further, all electronic devices, personnel, and/or other components associated with the Transportation Security Administration (TSA) belong to the domain, Transportation Security Administration (TSA)412. Although specific examples of user domains are illustrated, these examples are not meant to limit different advantageous embodiments to the examples listed. For example, other user domains may include private security companies, ground transportation companies, food and beverage companies, and other suitable users who may provide goods and/or services to airport102.

Turning now toFIG. 5, an illustration of a data processing system is depicted in accordance with an advantageous embodiment. Data processing system500is an example of one manner in which data processing systems110and number of data processing systems118inFIG. 1may be implemented. In this illustrative example, data processing system500includes communications fabric502, which provides communications between processor unit504, memory506, persistent storage508, communications unit510, input/output (I/O) unit512, and display514.

Memory506and persistent storage508are examples of storage devices516. A storage device is any piece of hardware that is capable of storing information, such as, for example, without limitation, data, program code in functional form, and/or other suitable information either on a temporary basis and/or a permanent basis. Storage devices516may also be referred to as computer readable storage devices in these examples. Memory506, in these examples, may be, for example, a random access memory or any other suitable volatile or non-volatile storage device. Persistent storage508may take various forms, depending on the particular implementation.

For example, persistent storage508may contain one or more components or devices. For example, persistent storage508may be a hard drive, a flash memory, a rewritable optical disk, a rewritable magnetic tape, or some combination of the above. The media used by persistent storage508also may be removable. For example, a removable hard drive may be used for persistent storage508.

Communications unit510, in these examples, provides for communications with other data processing systems or devices. In these examples, communications unit510is a network interface card. Communications unit510may provide communications through the use of either or both physical and wireless communications links.

Input/output unit512allows for input and output of data with other devices that may be connected to data processing system500. For example, input/output unit512may provide a connection for user input through a keyboard, a mouse, and/or some other suitable input device. Further, input/output unit512may send output to a printer. Display514provides a mechanism to display information to a user.

Instructions for the operating system, applications, and/or programs may be located in storage devices516, which are in communication with processor unit504through communications fabric502. In these illustrative examples, the instructions are in a functional form on persistent storage508. These instructions may be loaded into memory506for execution by processor unit504. The processes of the different embodiments may be performed by processor unit504using computer implemented instructions, which may be located in a memory, such as memory506.

These instructions are referred to as program code, computer usable program code, or computer readable program code that may be read and executed by a processor in processor unit504. The program code in the different embodiments may be embodied on different physical or computer readable storage media, such as memory506or persistent storage508.

Program code518is located in a functional form on computer readable media520that is selectively removable and may be loaded onto or transferred to data processing system500for execution by processor unit504. Program code518and computer readable media520form computer program product522in these examples. In one example, computer readable media520may be computer readable storage media524or computer readable signal media526. Computer readable storage media524may include, for example, an optical or magnetic disk that is inserted or placed into a drive or other device that is part of persistent storage508for transfer onto a storage device, such as a hard drive, that is part of persistent storage508.

Computer readable storage media524also may take the form of a persistent storage, such as a hard drive, a thumb drive, or a flash memory, that is connected to data processing system500. In some instances, computer readable storage media524may not be removable from data processing system500. In these examples, computer readable storage media524is a physical or tangible storage device used to store program code518, rather than a medium that propagates or transmits program code518. Computer readable storage media524is also referred to as a computer readable tangible storage device or a computer readable physical storage device. In other words, computer readable storage media524is a media that can be touched by a person.

Alternatively, program code518may be transferred to data processing system500using computer readable signal media526. Computer readable signal media526may be, for example, a propagated data signal containing program code518. For example, computer readable signal media526may be an electromagnetic signal, an optical signal, and/or any other suitable type of signal. These signals may be transmitted over communications links, such as wireless communications links, optical fiber cable, coaxial cable, a wire, and/or any other suitable type of communications link. In other words, the communications link and/or the connection may be physical or wireless in the illustrative examples.

In some advantageous embodiments, program code518may be downloaded over a network to persistent storage508from another device or data processing system through computer readable signal media526for use within data processing system500. For instance, program code stored in a computer readable storage medium in a server data processing system may be downloaded over a network from the server to data processing system500. The data processing system providing program code518may be a server computer, a client computer, or some other device capable of storing and transmitting program code518.

The different components illustrated for data processing system500are not meant to provide architectural limitations to the manner in which different embodiments may be implemented. The different advantageous embodiments may be implemented in a data processing system including components in addition to or in place of those illustrated for data processing system500.

Other components shown inFIG. 5can be varied from the illustrative examples shown. The different embodiments may be implemented using any hardware device or system capable of running program code. As one example, the data processing system may include organic components integrated with inorganic components and/or may be comprised entirely of organic components excluding a human being. For example, a storage device may be comprised of an organic semiconductor.

In still another illustrative example, processor unit504may be implemented using a combination of processors found in computers and hardware units. Processor unit504may have a number of hardware units and a number of processors that are configured to run program code518. With this depicted example, some of the processes may be implemented in the number of hardware units, while other processes may be implemented in the number of processors.

Additionally, a communications unit may include a number of devices that transmit data, receive data, or transmit and receive data. A communications unit may be, for example, a modem or a network adapter, two network adapters, or some combination thereof. Further, a memory may be, for example, memory506, or a cache, such as found in an interface and memory controller hub that may be present in communications fabric502.

With reference now toFIG. 6, an illustration of a table identifying different threat levels is depicted in accordance with an advantageous embodiment. In this illustrative example, table600identifies threat levels602. Threat level129inFIG. 1may be identified as any one of threat levels602.

Threat levels602include green604, blue606, yellow608, orange610, and red612. A threat level for an airport, such as threat level129for airport102inFIG. 1, may be identified as one of threat levels602based on the types of undesired events that are identified.

For example, an undesired event may be identified by policy enforcer136in policy manager124inFIG. 1as being one of safety event614, security event616, business event618, and operational event620. Safety event614, security event616, business event618, and operational event620are undesired events, such as violations of and/or noncompliance with policies.

Safety event614may be any undesired event that violates or is noncompliant with, for example, safety policy302inFIG. 3based on safety input200inFIG. 2. Security event616may be any undesired event that violates or is noncompliant with, for example, security policy300inFIG. 3based on security input202inFIG. 2.

Similarly, business event618is any undesired event that violates or is noncompliant with, for example, business policy304inFIG. 3based on business input204inFIG. 2. Further, operational event620is any undesired event that violates or is noncompliant with, for example, airport policy306inFIG. 3based on operational input206inFIG. 2.

Of course, in other illustrative examples, safety event614, security event616, business event618, and operational event620may be violations of or noncompliance with any type of safety rule or requirement, security rule or requirement, business rule or requirement, and operational rule or requirement, respectively.

In this illustrative example, entries622indicate the number of user domains in which at least one undesired event has been detected. The user domains may be, for example, user domains400inFIG. 4. For example, entry624indicates that at least one undesired security event has occurred in two user domains.

As illustrated, a threat level of green604is identified when at most one undesired business event occurs in at most one user domain and/or at most one undesired operational event occurs in at most one user domain. For example, a threat level of green604may be identified when one undesired business event occurs in one user domain, when no undesired business events occur in any user domain, when one undesired operational event occurs in one user domain, and/or when no undesired operational events occur in any user domain.

A threat level of blue606is identified when at least one undesired security event occurs in one user domain, at least one undesired business event occurs in two user domains, and/or at least one undesired operational event occurs in two user domains.

A threat level of yellow608is identified when at least one undesired safety event occurs in one user domain, at least one undesired security event occurs in two user domains, at least one undesired business event occurs in three user domains, and/or at least one undesired operational event occurs in three user domains.

A threat level of orange610is identified when at least one undesired safety event occurs in two user domains and/or at least one undesired security event occurs in three user domains. A threat level of red612is identified when at least one undesired safety event occurs in three user domains and/or at least one undesired security event occurs in four user domains. For red612and/or orange610, undesired business events and/or undesired operational events are not required to be taken into account when undesired safety events and/or undesired security events occur in so many user domains.

Turning now toFIG. 7, an illustration of an airport environment is depicted in accordance with an advantageous embodiment. In this illustrative example, airport environment700is an example of one implementation for airport environment100inFIG. 1. In this illustrative example, airport environment700includes network data processing system702and policy management system704.

In this illustrative example, network data processing system702includes plurality of data processing systems703and network705. Plurality of data processing systems703is connected to network705using communications links. These communications links may be, for example, wired communications links, wireless communications links, optical communications links, and/or other suitable types of communications links.

Plurality of data processing systems703include airport maintenance system706, gate and aircraft maintenance system708, surveillance system710, airport network monitoring server712, airport server714, airline back-office server716, aircraft data processing system718, aircraft data processing system720, and aircraft data processing system722.

In this illustrative example, airport maintenance system706, gate and aircraft maintenance system708, surveillance system710, aircraft data processing system718, aircraft data processing system720, and aircraft data processing system722are all located in the same airport. Further, airport maintenance system706, gate and aircraft maintenance system708, surveillance system710, aircraft data processing system718, aircraft data processing system720, and aircraft data processing system722are connected to network705through wireless access points724. Aircraft data processing system718, aircraft data processing system720, and aircraft data processing system722are located on aircraft at the airport.

Airport network monitoring server712, airport server714, and airline back-office server716may be at a location near or remote to the airport and are also configured to connect to network705. Airline back-office server716is connected to network705through Internet726. Airline back-office server716provides information, software, and multimedia for the aircraft located in the airport.

In this illustrative example, airport network monitoring server712monitors network705and provides data on the current configuration of data processing systems connected to network705. Agents running on plurality of data processing systems703may send data to airport network monitoring server712, which, in turn, sends data to airport server714. In this manner, airport network monitoring server712and airport server714are configured to communicate directly with each other.

In this illustrative example, policy management system704may be implemented in airport server714. Of course, in other illustrative examples, policy management system704may be implemented in some other data processing system connected to network705.

As illustrated, policy specifier728receives input730. Policy specifier728uses input730to generate policies732. In particular, policies732may be generated for user domains734. Policy specifier728sends policies732to policy manager736. Policy manager736selects a group of policies from policies732to be enforced in network data processing system702based on threat level738.

In this illustrative example, policy manager736identifies threat level738for use in selecting the group of policies from policies732. Of course, in other illustrative examples, policy manager736may receive an identification of threat level738from some other suitable source.

Policy manager736enforces the group of policies selected in network data processing system702by sending the group of policies and/or instructions for enforcing the group of policies to a number of agents running on plurality of data processing systems703through network manager740.

Policy manager736manages security for network data processing system702based on the information received by airport network monitoring server712. In response to undesired events and/or changes to threat level738, policy manager736identifies a number of actions to be performed and/or updates policies732.

With reference now toFIG. 8, an illustration of a flowchart of a process for managing network security at an airport is depicted in accordance with an advantageous embodiment. The process illustrated inFIG. 8may be implemented using policy management system120inFIG. 1.

The process begins by identifying a threat level for an airport (operation800). The threat level may be identified as, for example, without limitation, one of threat levels602inFIG. 6. In this illustrative example, operation800may be performed by, for example, policy manager124inFIG. 1.

Thereafter, the process identifies a group of policies for a network data processing system at the airport based on the threat level identified for the airport (operation802). Operation802may also be performed by policy manager124inFIG. 1. The group of policies is identified from a number of policies, such as policies122, generated by, for example, policy specifier123inFIG. 1. The network data processing system may be, for example, network data processing system106inFIG. 1. Of course, the group of policies may also be identified for a network data processing system for an aircraft when the aircraft is at or near the airport.

Next, the process initiates enforcement of the group of policies in the network data processing system at the airport (operation804), with the process terminating thereafter. In performing operation804, policy manager124sends group of policies135to number of agents126in network data processing system106inFIG. 1. In some illustrative examples, policy manager124sends instructions for enforcing group of policies135inFIG. 1. Upon receiving group of policies135and/or instructions, number of agents126enforces group of policies135in network data processing system106at airport102inFIG. 1.

With reference now toFIG. 9, an illustration of a flowchart of a process for managing network security at an airport is depicted in accordance with an advantageous embodiment. The process illustrated inFIG. 9is a more-detailed process of the steps described inFIG. 8. This process may be implemented using policy management system120inFIG. 1. In particular, this process may be implemented using policy specifier123, policy manager124, and number of agents126in policy management system120inFIG. 1.

The process begins by policy specifier123receiving input (operation900). The input includes any number of rules, regulations, criteria, guidelines, recommendations, and/or other suitable information that may be used to manage security at an airport and/or the aircraft at the airport. In particular, the security is for a network data processing system at the airport and/or any network data processing systems in e-enabled aircraft at the airport. In operation900, the input may be, for example, input128inFIG. 1andFIG. 2.

Next, policy specifier123generates policies122based on input128received (operation902). The policies generated may include, for example, without limitation, any number of the policies described in policies122inFIG. 1and/or other types of policies.

Policy analyzer132analyzes policies122to verify that policies122are correct and complete (operation906). Policy manager124then determines whether changes to the policies are needed (operation908). If changes to the policies are needed, policy updater138updates the policies (operation910), with the process then returning to operation906as described above.

Otherwise, if changes to policies122are not needed, policy decision maker134identifies threat level129for airport102(operation912). Policy decision maker134selects a group of policies from policies122to be enforced in network data processing system106at airport102and/or any network data processing systems in aircraft104at airport102(operation914).

Policy enforcer136sends the group of policies to number of agents126running on network data processing system106at airport102and/or network data processing systems in aircraft104at airport102(operation916). Number of agents126implements the group of policies at the data processing systems in the network data processing systems on which number of agents126is located (operation918).

Number of agents126sends information to policy manager124(operation920). In this illustrative example, operation920may be performed continuously or periodically, depending on the implementation.

In this illustrative example, the information provided by the number of agents in operation920may include network configuration settings, information about the status of the data processing systems on which the number of agents is located, and/or other suitable information. This information may be used to detect whether undesired events have occurred or are occurring in the network data processing system at the airport and/or network data processing systems on the aircraft at the airport.

Policy enforcer136monitors for undesired events using the information provided by number of agents126(operation922). Policy enforcer136determines whether a number of undesired events is detected using the information provided by number of agents126(operation924). If a number of undesired events is not detected, the process returns to operation922as described above.

Otherwise, if a number of undesired events is detected, policy decision maker134identifies a number of actions to be taken based on the number of undesired events (operation926). The number of actions may be actions to be performed by programs running on the network data processing system at the airport and/or the network data processing systems on the aircraft at the airport and/or human operators.

Policy enforcer136sends out notifications for performing the number of actions (operation928). These notifications may be sent to number of agents126and/or other data processing systems for display to human operators who can perform the number of actions. For example, the notifications may include information or instructions for the number of actions to be performed, alerts indicating the number of actions to be performed, and/or other suitable information.

Further, policy decision maker134determines whether a change to the threat level for the airport has occurred based on the number of undesired events (operation930). If a change to the threat level has occurred, policy analyzer132identifies changes to policies122based on number of undesired events140and the change to threat level129(operation932). Thereafter, policy updater138updates policies122with the changes identified (operation934).

Next, the process returns to operation906as described above with policy analyzer132validating the consistency and completeness of the updated policies. In this manner, policy decision maker134uses the updated and validated policies to select the group of policies for enforcement in operation914.

With reference again to operation930, if a change to the threat level has not occurred, the process returns to operation922as described above.

In some illustrative examples, additional input may be received during one or more of the steps in the process described inFIG. 9. This additional input may be, for example, user input requesting that the process described inFIG. 9be stopped and restarted using new input that may be included with the request. The new input may then be used to generate new policies in operation902that replace the previously generated policies. Of course, in other illustrative examples, other types of input may be received during the process.

The flowcharts and block diagrams in the different depicted embodiments illustrate the architecture, functionality, and operation of some possible implementations of apparatus and methods in different advantageous embodiments. In this regard, each block in the flowcharts or block diagrams may represent a module, segment, function, and/or a portion of an operation or step.

In some alternative implementations, the function or functions noted in the block may occur out of the order noted in the figures. For example, in some cases, two blocks shown in succession may be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. Also, other blocks may be added in addition to the illustrated blocks in a flowchart or block diagram.