CHERI Research Centre

CHERI is a new processor security technology, developed by the University of Cambridge and SRI International starting in 2010, that mitigates a majority of critical software security vulnerabilities through fine-grained memory safety and scalable software compartmentalisation for systems software Trusted Computing Bases (TCBs). Supported by the UK’s £118M Digital Security by Design programme, Arm’s Morello processor and a growing number of both open-source and proprietary CHERI-extended RISC-V processor designs are spearheading early commercial adoption. Multiple independent efforts during DSbD have assessed highly effective and deterministic software vulnerability mitigation – often in excess of two thirds of memory-safety vulnerabilities – raising the potential for a dramatic effect on practical software security, in systems spanning industrial control systems, consumer IoT devices, mobile phones and tablets, and high-end data-centre servers hosting cloud services. However, as CHERI is a cross-layer solution, spanning hardware and software layers, transition is fraught with cyclic dependencies, such as the interdependence of demand from software developers and hardware availability, and the availability of essential open-source software ecosystems aligned with the delivery of hardware platforms. We propose a one-year CHERI Research Centre at the University of Cambridge that will play a central role in supporting that adoption by: (1) Maintaining a centre of expertise to directly support industrial CHERI adopters through a variety of activities including developing open-source reference designs, validation suites, and guidance on best practice in CHERI-enabled hardware and software design; (2) Leading development of standards, open-source software infrastructure, formal modeling and proof, and other enablement activities such as supporting a DSbD Remote Lab and CHERI open-source CI; and (3) Driving new adoption through public speaking and promotional activities, developing full-stack demonstrations, contributing to public policy relating to memory safety, and performing ongoing evidence collection and validation on CHERI effectiveness. Throughout we will focus on activities that blend research and development, directly supporting both hardware- and software-facing CHERI adopters in industry. Wherever possible we will release material – from documentation through to hardware and software implementations – as open source to maximise industrial reuse. We will build on over 14 years of experience in developing CHERI as well as close collaborations with industrial partners such as Arm, Google, Codasip, lowRISC, CHERI Alliance, and others to enable widespread adoption, reaping the benefits of CHERI security in a growing hardware-software ecosystem.