Defence & Aerospace
CHERI can reinforce least authority and component isolation in complex mission systems that combine long lifetimes with demanding assurance needs.
Mission systems often integrate software from different eras, suppliers, and assurance levels. They may face deliberate attack, intermittent connectivity, strict timing, and long periods between hardware refreshes.
Where capabilities can contribute
CHERI can enforce memory bounds and permissions in native code and restrict what each compartment can access. Relevant candidates include communications stacks, file and message parsers, drivers, mission applications, platform services, and code integrated from a supplier.
This supports two complementary goals:
- prevent invalid access: stop an out-of-bounds or unauthorised operation at the processor;
- limit compromise: give a component only the memory, devices, and callable services required for its role.
Build an assurance argument
Evidence must be tied to a defined implementation. Document the processor and architecture version, compiler, execution mode, operating environment, compartment mechanism, configuration, and verified software version. Trace each claimed property to tests, analysis, or implementation evidence.
CHERI does not replace system safety, cryptography, cross-domain controls, emissions security, secure boot, supply-chain assurance, or operational procedures. Export-control and information-handling obligations also depend on the product, information, organisations, and jurisdictions involved.
Practical adoption path
Start with a component that is both exposed and replaceable. Define the mission assets it must not reach. Port it on a representative platform, then test memory faults, hostile input, denial-of-service behaviour, recovery, and attempts to cross its authority boundary.
Measure worst-case timing, memory and power, deterministic behaviour, diagnostic coverage, update support, and integration with existing evidence processes. Include maintainers and assurance specialists in the pilot so the result covers the whole lifecycle, not only compilation.
The strongest outcome is an explicit claim such as, “This parser cannot access mission state outside these buffers and services,” backed by a reproducible configuration and tests. A broad label such as “CHERI-secure” does not describe which protection is active or what has been tested.