UKRI Digital Security by Design

A new architecture faces a coordination problem. Hardware suppliers need software and customers before investing in processors. Software teams need stable platforms before investing in ports. Product teams need evidence, skills, and supply routes before committing to adoption.

The UK’s Digital Security by Design, or DSbD, programme addressed that whole-system challenge. Launched in 2019 through UK Research and Innovation, the programme combined public funding with substantial industry investment to develop and evaluate secure-by-design computing based around CHERI.

More than a processor project

Arm’s Morello programme was the most visible technical platform. It produced a prototype CHERI-enabled application processor, system-on-chip, development board, architecture, and software environment. Boards were distributed to academic and industrial users so that CHERI could be tested with real workloads.

DSbD also supported the layers and activities needed around that platform:

• compilers, operating systems, libraries, and development tools
• demonstrator projects in multiple sectors
• software porting and security evaluation
• technical training and remote access to hardware
• economic, social, policy, and adoption research
• industry engagement and ecosystem development

This breadth mattered because processor features create value only when developers can use them and organisations can justify deploying them.

Demonstrating practical use

Collaborative demonstrator projects explored CHERI in contexts including e-commerce, communications, trusted execution, data protection, and critical systems. Their role was not to prove that one architecture solved every security problem. They tested compatibility, performance, engineering effort, security boundaries, and business relevance.

The programme’s Technology Access Programme helped organisations gain practical experience with Morello through training, technical support, and scoped projects. Remote-lab facilities reduced the need for every developer to hold a physical board.

Building skills and evidence

DSbD funded work across universities, companies, open-source projects, and government. This broadened the group of people able to compile, port, test, evaluate, and explain CHERI systems.

It also supported evidence beyond technical benchmarks. Adoption depends on procurement, regulation, organisational incentives, workforce skills, liability, and the cost of changing established supply chains. Social-science and economic work helped describe those barriers alongside the technical opportunity.

Programme outcomes

The programme accelerated development of the Morello hardware-software stack and expanded the UK CHERI ecosystem. Its final impact evaluation reported increased research and development capability, substantial co-investment, demonstrator activity, and progress towards commercially available CHERI products.

The programme also helped create conditions for follow-on work. These include CHERI-RISC-V commercialisation, open-source software engineering, remote development infrastructure, skills programmes, the CHERI Research Centre, and the CHERI Alliance.

The place of DSbD in CHERI history

DARPA-backed work established and developed the architecture over many years. DSbD then tested how a wider industrial and public ecosystem could adopt that technology around a shared, application-class platform.

Morello itself is a prototype rather than the only future path for CHERI. Its historical importance lies in providing real silicon and a broad software environment on which organisations could test claims, identify migration costs, and build expertise.

The current UKRI Digital Security by Design page provides programme outcomes, project links, and the final impact evaluation.