  We address the challenging problem of efficient trust establishment in
constrained networks, i.e., networks that are composed of a large and dynamic
set of (possibly heterogeneous) devices with limited bandwidth, connectivity,
storage, and computational capabilities. Constrained networks are an integral
part of many emerging application domains, from IoT meshes to satellite
networks. A particularly difficult challenge is how to enforce timely
revocation of compromised or faulty devices. Unfortunately, current solutions
and techniques cannot cope with idiosyncrasies of constrained networks, since
they mandate frequent real-time communication with centralized entities,
storage and maintenance of large amounts of revocation information, and incur
considerable bandwidth overhead.
  To address the shortcomings of existing solutions, we design V'CER, a secure
and efficient scheme for certificate validation that augments and benefits a
PKI for constrained networks. V'CER utilizes unique features of Sparse Merkle
Trees (SMTs) to perform lightweight revocation checks, while enabling
collaborative operations among devices to keep them up-to-date when
connectivity to external authorities is limited. V'CER can complement any PKI
scheme to increase its flexibility and applicability, while ensuring fast
dissemination of validation information independent of the network routing or
topology. V'CER requires under 3KB storage per node covering 106 certificates.
We developed and deployed a prototype of V'CER on an in-orbit satellite and our
large-scale simulations demonstrate that V'CER decreases the number of requests
for updates from external authorities by over 93%, when nodes are
intermittently connected.
