Introduction

The Digital Security by Design (DSbD) Technology Access Programme (TAP) is designed to give UK-based companies access to lowRISC’s Sonata board, Arm’s Morello board, the CHERI stack, and technical support to trial these technologies within their systems, products, and applications.

Through the DSbD Technology Access Programme, companies will be able to experiment with and validate the prototype cyber security technology and feedback their findings to influence its future development before it enters commercialisation.

Watch this introduction video to learn more

Programme brief

Through the DSbD Technology Access Programme (TAP), qualifying UK-based companies will have access to lowRISC’s Sonata and Arm Morello evaluation board, with its cutting-edge CPU architecture. 

A Sonata board is a secure-by-design, embedded micro-controller,  developed by lowRISC to implement CHERIoT-Ibex, which is itself based on Capability Hardware Enhanced RISC Instructions (CHERI). CHERI is a protection model, like virtual memory that can be integrated into different ISAs, including Arm Morello, CHERI RISC-V, and CHERIoT. This model is a project from the University of Cambridge and SRI International. Both technologies serve to prevent and mitigate common memory-safety issues in C/C++ via their use of capabilities. Participants are encouraged to experiment with these technologies to uncover security vulnerabilities in their own products, using a combination of (1) spatial and temporal safety mechanisms, and (2) novel compartmentalisation models for shared libraries or coprocesses.

In addition to receiving a lowRISC Sonata board or Morello evaluation board, participating companies will get access to the CHERI software stack, technical guides, and expert support to get started and trial these new technologies within their systems. The duration of the Technology Access Programme is 5 months. After successful completion of the programme, participating companies will be permitted to keep the Sonata or Morello evaluation board.

The TAP is a tiered programme; qualifying companies will receive a £15,000 grant during the experimentation period. The programme is administered by Digital Catapult on behalf of UK Research and Innovation (UKRI).

Programme benefits

Companies will have exclusive access to cutting-edge cyber security technology, capable – if implemented correctly – of preventing around two thirds of hacks, cyber attacks and data breaches. This technology, when fully mature and market-ready, has the potential to open up whole new markets for cyber secure by design products, providing competitive advantage to companies who are already familiar with it.

These technologies can mitigate spatial and temporal memory-safety vulnerabilities in C/C++, and participants will be able to identify such issues in their own product code. CHERI has C/C++ language variants (CHERI C/C++) that require minimal change to an existing code base, approximately <0.5% LOC. CHERI also enables a second feature, a set of compartmentalisation models, to enrich the security guarantees provided by the architecture’s memory capabilities.

Further, individuals involved with the programme will become part of a vibrant community of like-minded professionals where they’ll be able to share ideas, forge new relationships and collaborations, as well as growing their knowledge and influence product development.

Companies sharing their programme related work will benefit from media exposure through DSbD as well as Digital Catapult communication channels.

Key benefits:

• Experiment with prototype, cutting-edge technology and be ahead of the game
• Build unique knowledge within your company and stay competitive
• Improve your product by identifying cyber security vulnerabilities in your systems/software
• Become part of a vibrant community of cyber security pioneers
• Receive a £15,000 grant (Tier 1 companies only) 
• Get access to experts at lowRISC, Arm, University of Cambridge, and Digital Catapult
• Become part of the TAP Alumni upon successful completion of the experimentation period

Watch this video to understand the benefits, timelines and commitment required

Who is it for?

The programme is open to UK-based companies that have a company culture of exploring, experimenting and inventing with new technologies. Companies with an R&D department and a strong focus on cyber security are encouraged to apply. Applicants must be registered on Companies House and also have a business bank account.

Companies within the following industries should apply:

• Information Technology and services
• Computer software
• Industrial automation
• Computer hardware
• CPU semiconductors
• Energy
• Automotive
• Telecoms
• Manufacturers of connected consumer / industrial electronics (IoT & IIoT)

Your company would ideally operate within or supply to the following sectors: utilities, healthcare, transportation, telecommunications, automotive, energy & mining, and all other sectors serving the Critical National Infrastructure.

Programme tiers and requirements

TAP is a tiered programme. Tier 1 is for UK-based companies with under 250 employees while Tier 2 is for UK-based companies with more than 250 employees.

Tier 1

• Receive £15,000 in funding during the course of the 5 month programme.
• Gain access to a Sonata board (and Morello board if required), with possibility to keep the hardware following successful completion of the programme
• Participate in one-to-one check-in sessions, group learning sessions, practical demonstrations and focused activities for the experimentation programme.
• Receive technical guidance and support from the Digital Security by Design programme team and experts at lowRISC, Arm and University of Cambridge.

Tier 2

• Gain access to a Sonata board (and Morello board if required), with possibility to keep the hardware following successful completion of the programme
• Receive technical guidance and support from the Digital Security by Design programme team and experts at lowRISC, Arm and University of Cambridge.
• Participate in one-to-one check-in sessions, group learning sessions, practical demonstrations and focused activities for the experimentation programme (optional).

Programme requirements

Over the five month period, successful applicants will be expected to:

• Participate in one onboarding day at the start of the programme [Tier 1 & 2] 
• Write two technical reports –a short interim report based on progress and findings, and a final report based on your experience within the programme [Tier 1 & 2]
• Participate in monthly online peer-to-peer knowledge sharing sessions [Tier 1]
• Attend monthly online one-to-one progress-update and technical support sessions with the Digital Security by Design team [Tier 1]
• Participate in the end-of-programme Showcase event and provide a demonstration or presentation on their experimental outcomes or learnings [Tier 1 & 2]

Technical Details

Please be aware of the following:

• CHERIoT could involve C/C++, MicroPython, Verilog and RUST.
• CHERIoT RTOS is recommended, but businesses are free to repurpose the FPGA is required.
• CHERIoT LLVM toolchains are currently available. Additional operating system enablement is currently being addressed by a joint development between Arm, University of Cambridge, Microsoft and Google.
• Several Morello emulators are available: Arm’s Fixed Virtual Platform, the Morello Integrated Environment, and the CHERI-QEMU fork maintained by the University of Cambridge and SRI International. There is also a Verilator-based simulator for CHERIoT: cheriot-safe.
• This technology it’s not secure ‘out of the box’, there’s work to do in order to turn on security features. It’s not enough to just put your code on the board, because security is implemented by following a series of steps. Familiarity with FPGAs is invaluable.

Watch this video to learn more about CHERIoT and Sonata