CHERI Alliance Aims to Secure Hardware Memory

The consortium of private companies and academia will focus on ways to protect hardware memory from attacks.

A new chip security consortium named CHERI Alliance is focused on protecting data stored in hardware memory from cyberattackers.
The alliance backs a protection model that isolates the hardware and software to prevent hackers from injecting code into memory that would allow them to take over systems or steal data.
Memory issues represent approximately 70% of the routes taken by cyber attackers, said
CHERI Alliance in a statement
.
CHERI is an acronym for Capability Hardware Enhanced RISC Instructions. The alliance will formally launch in September.
Memory issues are usually addressed through software techniques or coarse-grained hardware memory protection, says alliance spokesperson Tora Fridholm.
These methods either leave holes or are not very practical, Fridholm says. What is unique about CHERI is that the technology adds fine-grained memory protection, with the ability to prevent these issues completely without adding a major overhead.
The alliance focuses on securing memory in ARM, MIPS, and RISC-V architectures, which dominate edge devices.
The backing entities include University of Cambridge, the FreeBSD Foundation, Capabilities Limited, lowRISC, and SCI Semiconductor. While ARM dominates the microcontroller and mobile markets, the company is currently not part of the consortium.
ARM has been victim to many memory-bound vulnerabilities, including one earlier this month that
allows hackers to access GPU memory
. ARM-based processors also had vulnerabilities related to
Meltdown
and variants of
Spectre
, which allowed hackers to take over memory.
The CHERI program originally started off in 2010 as
a research program between the University of Cambridge and SRI International;
and was funded by
DARPAs CRASH.
As part of the program, researchers developed CHERI-based hardware with memory protection features. ARMs prototype Morello board with
CHERI extensions was reviewed
by the Microsoft Security Response Center, which provided recommendations to improve the design.
CHERI was described in a research paper
published earlier this year as a hardware-software capability-based system that extends the ISA, toolchain, programming languages, operating systems, and applications in order to provide complete pointer and memory safety.
CHERI researchers also provide toolkits so C and C++ programmers can add memory protection to code. C++ doesnt have automatic memory protection mechanisms, unlike newer development tools, such as Rust, which leaves space for coders to inject malicious code. Coders need to add specific code to protect memory.

Last News
▸ Travel agency fined £150,000 for breaking Data Protection Act. ◂ Discovered: 23/12/2024 Category: security	▸ 7 arrested, 3 more charged in StubHub cyber fraud ring. ◂ Discovered: 23/12/2024 Category: security	▸ Nigerian scammers now turning into mediocre malware pushers. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
CHERI Alliance Aims to Secure Hardware Memory