CHERI Alliance Announces Expansion of Membership and Official Launch
CAMBRIDGE, United Kingdom – November 12, 2024 – The CHERI Alliance CIC (Community Interest Company) has officially launched and expanded its membership to include global commercial, research, and open-source organizations, as well as several UK universities and government entities.
The new founding members of the CHERI Alliance include Chevin Technology (UK), Critical Technologies (USA), the Defence Science and Technology Laboratory (DSTL, UK), Google (USA), Light Momentum Technology Corporation (Taiwan), National Cyber Security Centre (NCSC, a part of GCHQ, UK), Parvat Infotech (India), SRI International (USA), TechWorks (UK), Trusted Computer Center of Excellence (USA), the University of Birmingham (UK), and the University of Glasgow (UK).
The CHERI Alliance was founded to unite hardware security leaders and system developers and aims to establish CHERI (Capability Hardware Enhanced RISC Instructions) as the new standard for memory safety and scalable software compartmentalization.
“We are thrilled to welcome such a diverse and distinguished group as founding members of the CHERI Alliance,” said Dr. Robert N. M. Watson, Professor at the University of Cambridge, Director of the CHERI Alliance, and Director of Capabilities Limited. “Their innovation and commitment will help us achieve our goal of delivering scalable, hardware-based security solutions that address critical vulnerabilities.”
In addition to the previously announced founding members, the new additions to the CHERI Alliance reinforce the collaborative effort to protect against memory-related vulnerabilities, which constitute approximately 70% of the vulnerabilities exploited in cyberattacks.
UK Minister for AI and Digital Government Feryal Clark commented, “Digital and online security is a fundamental part of our duty as a government to keep the British public, our vital services, and our critical national infrastructure safe. CHERI is a fantastic example of how brilliant British ingenuity is rising to that challenge, focusing on shoring up our defences in areas which are so often a target for would-be cyber attackers. It’s great to see our national security community and some of the leading lights in tech backing this work – ensuring a joined-up approach which will keep our digital economy and the services we rely on daily safe, secure, and alert to the growing range of online threats that we face.”
CHERI technology, developed starting in 2010 through a collaboration between the University of Cambridge and SRI International, offers robust protection against memory safety issues such as buffer overflows and heap use-after-free vulnerabilities. The technology’s ability to enable high-performance, scalable compartmentalization significantly reduces the risk of both known and future unknown vulnerabilities.
With a broader range of companies, open-source organizations, and research institutions on board, the CHERI Alliance is poised to strengthen its efforts in standardization, technical alignment, and educational outreach to promote CHERI’s adoption as an industry-standard security measure.
Leading members of the CHERI Alliance shared their enthusiasm for joining the alliance:
Ben Laurie, Lead Security Researcher at Google, said, “Google’s interest in CHERI stems from our unwavering commitment to security and privacy. We recognize the potential of CHERI in significantly enhancing system security by mitigating common software vulnerabilities. CHERI offers fine-grained compartmentalisation, which isolates sensitive data into secure compartments, and deterministic memory safety. In security-critical systems that handle sensitive information and personal data, such as those found in generative AI applications, CHERI helps protect against breaches and ensures robust protection against malicious attacks.”
Stuart W. Card, VP & Chief Scientist, Critical Technologies, said, “Critical Technologies Inc. (CTI) designs to integrate Capability Hardware Enhanced RISC Instructions (CHERI), driven by the CHERI Alliance, into open platforms for trustworthy networked autonomy. With Syracuse University, CTI previously developed the first (and still to our knowledge only) capability based, formally verified, open source, multiboot loader for x86 processors with ‘late launch’ DRTM instructions and TPMs; we will do likewise with CHERI as needed to enable seL4® based virtualization for safe AI/ML.”
Allen Cheng, CEO of LMT, said, “LMT is excited to join the CHERI Alliance and contribute to a future of enhanced security and reliability in computing. Our commitment to providing dependable computing solutions aligns perfectly with CHERI’s vision of a safer digital landscape. We look forward to leveraging CHERI technology to develop innovative and secure IC products and services. As a CHERI ambassador in Taiwan and the APAC region, we will actively promote this cutting-edge technology to industry leaders, agencies, and associations, addressing the growing cybersecurity challenges posed by today’s geopolitical climate.”
Dr. Divya Atkins, co-founder, Director, and CEO of Parvat Infotech, said