IoT & Embedded
CHERI brings fine-grained memory protection and compartmentalisation to embedded systems where resources, power, and update options are constrained.
Small connected devices often process hostile input, run native code, and remain deployed for years. They may lack the memory-management hardware and operating-system processes used to isolate software on larger systems.
Protection within a constrained device
CHERI capabilities can restrict a pointer to a defined region and set permissions such as read, write, or execute. A compartment model can isolate a network stack, parser, driver, or third-party library without requiring a separate address space for each component.
CHERIoT applies these ideas to 32-bit embedded systems. Its hardware and software model is designed for small, mutually distrusting compartments and controlled service calls. Other CHERI platforms may suit richer operating systems or different processor requirements.
Useful starting points
- wireless and network protocol handling;
- update verification and boot services;
- sensor or actuator drivers;
- cryptographic key services;
- third-party libraries and vendor code;
- devices that combine safety, connectivity, and long field life.
A compartment should receive only the capabilities it needs. For example, a network parser may need a bounded packet buffer and a narrow message interface, but no direct access to device keys or actuator registers.
Constraints to measure
Embedded adoption decisions are sensitive to code size, RAM, flash, power, interrupt latency, real-time behaviour, tool qualification, and component availability. Capability metadata and compartment calls have costs that must be measured on the selected platform and workload.
Secure boot, protected updates, device identity, cryptography, vulnerability handling, and physical protections remain necessary. CHERI strengthens memory access and isolation; it is not a complete device-security architecture.
A practical evaluation
Choose one exposed component and define what it must never reach. Port it, express its interfaces as explicit capabilities, and test malformed inputs and lifetime errors. Record porting changes, fault behaviour, performance, memory use, and the authority retained after a simulated compromise.
The CHERIoT getting-started guide provides a hands-on route for an embedded evaluation. Teams targeting other profiles can compare options in Choose a Platform.