Rockwell Collins, Inc.

Patrick J Morrissey

James N Potts

Luke E Ryon

Kevin J Delaney

Justin William Ehm

Matthew L Weber

Yves Lacerte

Rhishi Pratap Singh

Benjamin David Mossman

John Kolodick

Frédéric Trincal

Kesava Srinivas Vunnava

Ryan J Barnett

Charles David Graziano

Kevin E Purrington

Systems and methods of managing enrollment of digital identities (e.g., for aeronautical communication) can involve a line-replaceable unit (LRU) in an aircraft establishing a digital identity with a ground-based server by requesting a public certificate from the ground-based server. The LRU may receive a public certificate from the ground-based server. The LRU may validate the public certificate. The LRU may generate, based on validating the public certificate, an enrollment status message indicative of at least one status code from a plurality of predefined status codes associated with a plurality of corresponding actions for the ground-based server. The LRU may transmit the enrollment status message including the at least one status code to the ground-based server, to cause the ground-based server to perform a corresponding action based on the at least one status code.

Managing enrollment of digital identities for secure air-to-ground communication sessions

A system includes a first processing circuit, a second processing circuit, and a network interface device. The network interface device includes a first communications interface, a second communications interface, and a filtering engine. The first communications interface is configured to receive first data packets from the first processing circuit and communicate the first data packets for transmission to the second processing circuit via a first network pathway. The second communications interface is configured to receive second data packets from the second processing circuit and communicate the second data packets to the first processing circuit via a second network pathway physically separated from the first network pathway. The filtering engine is configured to determine whether the first data packets satisfy an inspection criteria, and transmit the first data packets to the second processing circuit responsive to determining that the first data packets satisfy the inspection criteria.

Systems and methods for secured maintenance gateway

A communication network includes a low integrity device, a high integrity device, a communication bus communicably coupling the low integrity device and the high integrity device together, and a communication guard inserted in-line along the communication bus. The communication guard includes a filter configured to store one or more rules defining at least one of a rate, a size, or a content type that is permissible for data transmissions from the low integrity device to the high integrity device; receive a respective data transmission from the low integrity device; evaluate characteristics of the respective data transmission relative to the one or more rules; and prevent the respective data transmission from passing through the communication guard to the high integrity device in response to the characteristics of the respective data transmission failing to comply with at least one of the one or more rules.

Serial in-line communication guard

The present disclosure is directed to a system and method for applying unique routing rules to encrypted data packets being transmitted via a tunneling protocol. Because encrypted data packets are unintelligible at intermediary points along a secured link or 'tunnel,' a multi-path router located between the tunnel endpoints is typically unable to apply unique routing rules. To enable unique routing, the disclosed method relies on a unique identifier that is associated with the secured link established between an initiator and a receiver (i.e., the tunnel endpoints). The unique identifier is transmitted with one or more encrypted data packets and is used at intermediary points to differentiate the encrypted data packets so that unique routing rules can be applied.

Multi-path routing control for an encrypted tunnel

A method for providing dynamic security hardening of selected aircraft functions includes: a) monitoring sequences of real-time security events for at least one aircraft function; b) accessing a database storing a plurality of sequences of attack events indicative of an attack of the at least one aircraft function; c) probabilistically inferring, by at least one processor, the location and progression of an attack represented within the database by utilizing the sequences of real-time security events; and d) activating at least one countermeasure in response to an inferred location and progression of an attack.

Dynamic security hardening of security critical functions

Growing community of inventors

Cedar Rapids, IA, United States of America

Patrick J Morrissey