335
1.3 Application Groups
Analysis of the cases in MarCom resulted in finding
six common application groups as shown in the fig-
ure below (Figure 1).
Figure 7. MARINTEK/ MarCom Delivery 3.1
1.3.1 Technical Maintenance
These applications deal with reporting condition
of the ship or platform, and (remotely) updating data
and software. This group of applications includes:
− State monitoring and analysis: This is technical
monitoring system, detection tools, information
system, remote control system for monitoring of
oil, gas, water tanks and sewerage system. This
updates of FDV systems
− Online SW updates and maintenance, such as
new SW versions on applications monitoring e.g.
the propulsion machinery
− Online data updates, such as online updates of
ENC’s (both for ECDIS/other chart systems
onboard and for pilot laptops), online updates of
meteorological and hydrological data, technical
drawings, sea maps/3D seabed topology, updates
of documents and regulations following a vessel
1.3.2 Reporting
These applications are related to the (onshore)
management’s need for tracking and status reports
from their ships. This can include operational and
technical information about the ship and its cargo,
but also navigational reports and data needed by
government regulations fit within this group.
1.3.3 Bandwidth and Quality of Service
The bandwidth and integrity (quality of service
and uplink time) requirements are summarised in the
following figure.
1.3.4 Security requirements
The security requirements on the communication
channel differ from application to application. The
main threats on the communication channel level are
denial of service and traffic analysis attacks. Hence,
protection of important user data can be implement-
ed on higher layers (the network, transport or appli-
cation layer).
Seen from a user point of view, a division in low,
medium and high security requirements have been
provided for each group of applications. Low means
that losing some of the data to unauthorised persons
is not crucial.
Medium means that losing some of the data to
unauthorised persons is not desirable, but still not
crucial.
High means that losing data to unauthorised per-
sons is crucial and one should secure the communi-
cation channels.
In addition to Tripple –A data-security in the ap-
plications (ref. Cisco IOS Security Configura-
tion Guide, Release 12.2), which is especially criti-
cal in safety and special purpose applications, we
will also demonstrate how to meet standards and
safety requirements in equipment, especially for ex-
plosion safety demands in different shipzones (0-2
where 0 indicates the highest demands)
___________________________________________________
Application Security Comments
group requirement
___________________________________________________
Technical Low Losing status data and images of
maintenance machinery to unauthorised persons
is not crucial.
Reporting Medium Losing reports to unauthorised
persons could be very undesirable
if the reports contain sensitive
information. Still, it is not crucial.
Safety & High Losing images and pictures of e.g.
passengers monitoring to
unauthorised persons due to e.g.
laws and regulations from the Data
Inspectorate is crucial and should
by all means be avoided.
Training & Low Losing training instructions and
qualification certificates to unauthorised persons
is not considered very crucial.
Infotainment Low Losing TV-signals and e-mails
Medium, might be undesirable and
High, unpleasant however this is not
crucial. However, eavesdroppng of
personal information like social
security number or credit card
information will be highly
undesirable
Special High The requirements here will vary
Purporse depending on data transmitted and
business policy of the company.
However it is likely that the data
transmitted will be important for
business purposes and should be
shielded against unauthorized
access
___________________________________________________
1.4 Protocols and message formats
The messages and protocols used in the applications
should be based on open standards as much as pos-
sible. The exact protocols and formats to be used
have to be decided when more work is done in
MarCom, later parts of project. Some examples of
possible standards are: