lowRISC leads project for more cyber security on CHERI chips

(CONNECT) lowRISC CIC, the Cambridge-based parent company of Technopark Zurich-based lowRISC GmbH, has announced the launch of the COSMIC project. Together with Capabilities Limited, it has set itself the goal of developing the world's first marketable open source design of a CHERI-capable 64-bit application-class secure enclave. The project is supported by the UK Department for Science, Innovation and Technology and InnovateUK, the country's innovation agency. The project is managed by lowRISC. The project runs until March 2028. Its first phase is scheduled for completion in March 2026.

The project is about setting up isolated subsystems on CHERI (Capability Hardware Enhanced Instructions) semiconductors that are designed to execute code and store data in a highly secure environment. They protect sensitive information such as passwords or biometric data even if the main operating system or other parts of the system-on-chip design are compromised.

Such secure subsystems are called Secure Enclaves. These are used, for example, in cell phones, Internet of Things (IoT) edge nodes and data centers. The CVA6-CHERI open source design from Capabilities Limited was selected for COSMIC's Secure Enclave.

The cutting-edge and young CHERI technology is a response to a cyber security vulnerability, 70 percent of which is caused by memory errors, according to a study by Microsoft and Google cited by the British government. This loophole was exploited in the WannaCry attack in 2017 and the CrowdStrike attack in 2024, for example, both of which caused billions in damage. As a result, the equivalent of over 85 million Swiss francs from the British government and a further 215 million Swiss francs from the private sector were invested in the development of CHERI.

"At lowRISC, we firmly believe in our goal of realising commercial open source silicon chips and in security through openness, not concealment," said Javier Orensanz Martinez, CEO of lowRISC. "It's fantastic that this is being supported not only by commercial partners such as Google and Rivos, but also by funding from the UK government." ce/mm