Submitted by Rachel Gardner on Tue, 12/11/2024 - 12:39
A new alliance launches today to take forward a pioneering cybersecurity technology co-developed by researchers here.
The CHERI Alliance has the backing of the UK government and an international group of members ranging from start-ups to global technology company Google, all working to tackle cybersecurity threats at the hardware level.
Uniting hardware security leaders and system developers, the Alliance aims to establish the CHERI technology that has been co-developed here as the new standard for memory safety and scalable software compartmentalisation.
CHERI first started life in 2010. Researchers in this Department, working in collaboration with SRI International, were looking for new ways to design the architecture of a computer’s brain – its central processing unit – in order to make the computer software less vulnerable to security breaches.
They focused on doing this through the use of 'capabilities' – unforgeable tokens of authority to access memory, apps or programs – and called the resulting technology CHERI (Capability Hardware Enhanced RISC Instructions). The technology fundamentally revises the architectural interface between hardware and software, with hardware support for capabilities.
CHERI has already been the subject of very significant industrial and government collaboration. The semiconductor giant Arm produced the first industrial prototype of the technology – the Arm Morello processor and evaluation board. Since January 2022, this has been made available to businesses to trial through the government's £200m+ Digital Security by Design programme.
And as of this year, through the Digital Security by Design programme, companies now also have access to another industrial prototype, the lowRISC Sonata board. This is a secure-by-design, embedded micro-controller, developed by lowRISC to implement CHERIoT-Ibex, which is based on CHERI.
Now, the CHERI Alliance has launched in a further collaborative effort to better protect computers against memory-related vulnerabilities. These vulnerabilities represent a critical security challenge as they make up approximately 70% of the vulnerabilities that criminals exploit in cyberattacks.
Since it was first founded in June, the Alliance has welcomed companies from the UK (Chevin Technology), the US (Critical Technologies, Google and Techworks), India (Parvat Infotech) and Taiwan (the Light Momentum Technology Corporation). Also members are the UK's Defence Science and Technology Laboratory and National Cyber Security Centre, along with the Universities of Birmingham and Glasgow.
They join founding members Capabilities Limited, Codasip, CyNam, the FreeBSD Foundation, lowRISC, OpenHW Group, SCI Semiconductor, Swansea University and the University of Cambridge in the Alliance.
"Expanding our membership signals growing recognition of CHERI's transformative potential," says Robert Watson (right), Professor of Systems, Security and Architecture here and Director of the CHERI Alliance.
"After more than a decade of development, it's rewarding to see the CHERI community grow as new members bring their innovation and commitment to the Alliance. We are now well-positioned to advance our mission of delivering scalable, hardware-based security solutions that address critical vulnerabilities."
The Alliance also has UK government backing. Feryal Clark, Minister for AI and Digital Government, says: "Digital and online security is a fundamental part of our duty as a government to keep the British public, our vital services, and our critical national infrastructure safe. CHERI is a fantastic example of how brilliant British ingenuity is rising to that challenge, focusing on shoring up our defences in areas which are so often a target for would-be cyber attackers.
"It's great to see our national security community and some of the leading lights in tech backing this work, ensuring a joined-up approach which will keep our digital economy and the services we rely on daily safe, secure, and alert to the growing range of online threats that we face."
- See full details on the CHERI Alliance website
