Abstract: PKI Certificates are fingerprinted bi-directionally, replacing traditional certificate exchange in constrained computing and networking environments during a D/TLS session initiation for faster logon to well acquainted peers. Fingerprinting PKI Certificates bi-directionally allows for certificate compression when one or both peers are unacquainted and use of OCSP stapling or OCSP trusted responders offloading validation to robust clusters. A handshake is described for certificate exchange in an OCSP stapling or OSCP with trusted responder environment, and where the network and clients are constrained, which address the deficiencies of the RFC's.

Abstract: A remote attestation system 200 is provided comprising a relying party 202, a component 213; and a plurality of verifiers 204, 206, 208 arranged to verify a target by receiving evidence from an attester of the target and producing a verification result for the target based on said evidence. The relying party is arranged to cause each of the verifiers to verify the component to produce a plurality of verification results for the component; cause one or more of the verifiers to verify one or more other verifiers so as to produce one or more verification results for each verifier; and determine an attestation result for the component based on the verification results for the component and the verifiers.

Abstract: A method of operating a public key certificate validation system for facilitating a secure communication between an aircraft and a ground entity includes: sending a public key certificate of the ground entity from the ground entity to a trusted responder; at the trusted responder, validating the public key certificate of the ground entity and storing a trust indication regarding the public key certificate of the ground entity in a pre-cached validation database; and at the trusted responder, maintaining the pre-cached validation database for providing a validation response regarding the public key certificate of the ground entity, when a validation request, associated with the secure communication between the aircraft and the ground entity, reaches the trusted responder, wherein the validation response is based on the trust indication regarding the public key certificate of the ground entity from the pre-cached validation database.

Abstract: A method for establishing a secure communication between an aircraft and a ground entity includes: sending a communication initialization message from the aircraft to the ground entity, wherein the communication initialization message is included in an IP datagram structure and wherein the IP datagram structure comprises an IP address of the aircraft; at the ground entity, obtaining a public key certificate of the aircraft via the IP address of the aircraft; and sending a public key certificate of the ground entity from the ground entity to the aircraft as part of a response message to the communication initialization message.

Abstract: A method for establishing a secure communication between an aircraft and a ground entity includes: sending a communication initialization message from the aircraft to the ground entity, wherein the communication initialization message comprises a public key certificate of the aircraft and wherein the communication initialization message comprises an indication of at least one trusted responder; at the ground entity, sending a validation request regarding a public key certificate of the ground entity to a selected one of the at least one trusted responder and receiving a validation response from the selected one of the at least one trusted responder; and sending the public key certificate of the ground entity and forwarding the validation response from the ground entity to the aircraft as part of a response message to the communication initialization message.

Abstract: PKI Certificates are fingerprinted bi-directionally, replacing traditional certificate exchange in constrained computing and networking environments during a D/TLS session initiation for faster logon to well acquainted peers. Fingerprinting PKI Certificates bi-directionally allows for certificate compression when one or both peers are unacquainted and use of OCSP stapling or OCSP trusted responders offloading validation to robust clusters. A handshake is described for certificate exchange in an OCSP stapling or OSCP with trusted responder environment, and where the network and clients are constrained, which address the deficiencies of the RFC's.