  Avionics networks rely on a set of stringent reliability and safety
requirements. In existing deployments, these networks are based on a wired
technology, which supports these requirements. Furthermore, this technology
simplifies the security management of the network since certain assumptions can
be safely made, including the inability of an attacker to access the network,
and the fact that it is almost impossible for an attacker to introduce a node
into the network. The proposal for Avionics Wireless Networks (AWNs), currently
under development by multiple aerospace working groups, promises a reduction in
the complexity of electrical wiring harness design and fabrication, a reduction
in the total weight of wires, increased customization possibilities, and the
capacity to monitor otherwise inaccessible moving or rotating aircraft parts
such as landing gear and some sections of the aircraft engines. While providing
these benefits, the AWN must ensure that it provides levels of safety that are
at minimum equivalent to those offered by the wired equivalent. In this paper,
we propose a secure and trusted channel protocol that satisfies the stated
security and operational requirements for an AWN protocol. There are three main
objectives for this protocol. First, the protocol has to provide the assurance
that all communicating entities can trust each other, and can trust their
internal (secure) software and hardware states. Second, the protocol has to
establish a fair key exchange between all communicating entities so as to
provide a secure channel. Finally, the third objective is to be efficient for
both the initial start-up of the network and when resuming a session after a
cold and/or warm restart of a node. The proposed protocol is implemented and
performance measurements are presented based on this implementation. In
addition, we formally verify our proposed protocol using CasperFDR.
