Automotive
CHERI can help automotive platforms protect memory and isolate software components while preserving a path for established C and C++ code.
Modern vehicles combine safety functions, connectivity, third-party software, and long support lives. A memory error in a network-facing service should not become authority over a safety-relevant controller.
Where CHERI may help
Capability-enforced memory access can protect native code used in electronic control units, gateways, infotainment, and central compute platforms. Compartments can give parsers, drivers, protocol stacks, and supplier components only the memory and services they need.
Potential evaluation targets include:
- a network or media parser exposed to untrusted input;
- a gateway joining domains with different criticality;
- a driver or service supplied by a different development team;
- a legacy C or C++ component that cannot be rewritten immediately;
- a consolidated controller where separation affects both safety and security.
Fit with automotive assurance
CHERI does not certify a vehicle or establish freedom from interference on its own. An automotive safety and cybersecurity case still needs requirements, hazard and threat analysis, timing evidence, verification, secure update processes, and control of the supply chain.
Hardware-enforced bounds, permissions, and compartment boundaries can become evidence within that wider case. Teams should state exactly which processor, execution mode, software component, and property were tested.
Questions for a pilot
- Which assets should remain unreachable if the selected component is compromised?
- Can its existing code compile for a CHERI target, and what assumptions does the port expose?
- What authority crosses each interface?
- How do capability checks affect worst-case execution time, memory use, startup, and diagnostics?
- Can the toolchain and platform fit the intended qualification and support lifecycle?
- How will third-party updates retain the same boundaries?
Use representative workloads and fault injection, not only a demonstration application. Compare the CHERI design with the organisation’s current isolation and memory-safety measures. A useful outcome is a bounded architectural decision with recorded evidence, whether that leads to adoption, further work, or a different control.