Critical Infrastructure
CHERI can help critical systems resist memory attacks and contain faults while operators retain the layered controls needed for resilience.
Energy, water, communications, transport, and industrial systems must keep essential functions available even when individual components fail or are attacked. Many combine old and new native code, specialist devices, remote access, and long replacement cycles.
Prevention and containment
CHERI-capable processors can stop memory accesses that exceed a capability’s bounds or permissions. Compartments can limit the authority of protocol handlers, drivers, vendor modules, and management services. These controls can reduce the chance that one defect becomes control over the wider system.
Candidate areas include:
- gateways between operational and enterprise networks;
- remote-management and update services;
- protocol conversion and message parsing;
- controllers that combine software from several suppliers;
- monitoring appliances and network functions;
- edge devices that cannot support heavyweight isolation.
Resilience remains a system property
Capability protection does not replace network segmentation, strong identity, secure configuration, monitoring, backups, manual fallback, incident response, or recovery exercises. It also does not make an unsafe physical action acceptable. The design must fail in a way that preserves essential functions and supports diagnosis.
Evaluate in context
Begin with a threat and consequence model. Identify a component exposed to untrusted data, then define which assets and functions must remain protected if it is compromised. Test both invalid memory access and attempted movement across the intended compartment boundary.
Operational evidence should include:
- availability and timing under normal load and fault conditions;
- recovery and logging when a capability fault occurs;
- integration with secure boot, updates, and monitoring;
- support for legacy protocols and hardware interfaces;
- supplier and maintenance arrangements across the asset lifetime;
- a safe fallback if the protected service becomes unavailable.
Adoption can begin at a refresh boundary, a new gateway, or an isolated subsystem. A staged route avoids making essential service continuity depend on an unproven whole-estate migration.