Cyber safety and security for reduced crew operations (RCO)

The commercial aviation industry is looking into “reduced crew operations” (RCO) that would cut today's two-person flight crews down to a single pilot with support from ground-based crews. Shared responsibility across air and ground personnel will require highly reliable and secure data communication and supporting automation, which will be safety-critical for passenger and cargo aircraft. This paper looks at the different types and degrees of authority delegation given from the air to the ground and the ramifications of each, including the safety and security hazards introduced, the mitigation mechanisms for these hazards, and other demands on an RCO system architecture. Any added RCO system would be highly invasive into (almost) all safety-critical avionics. The adjacent fields of unmanned aerial systems (UAS) and autonomous ground vehicles are investigated for problems similar to what RCO may face. Several past aviation accidents and incidents are described that are indicative of failure modes that could occur with respect to RCO. This paper explores possible data communication mechanisms to meet the stringent performance and information security (INFOSEC) requirements of RCO. Potential challenges for RCO data communication authentication, encryption and non-repudiation are identified. The approach includes a comprehensive safety-hazard analysis of the RCO system to determine top level INFOSEC requirements for RCO and proposes an option for effective RCO implementation. This paper concludes with questioning the economic viability of RCO in light of the expense of overcoming the operational safety and security hazards it would introduce.