Digital Security by Design

Digital Security by Design is a government backed initiative to transform technology and create a resilient, and secure foundation for a safer digital future. Through collaboration between researchers, industry and government, these new capabilities will free the way business and people use and trust technology.

The challenge is supported by a consortium of more than 30 of the world’s leading technology companies, academic institutions and researchers and UK government agencies. The focus is on new ways of designing CPU architecture that will make processors more robust in future and able to prevent the most prevalent security vulnerabilities.

The Digital Security by Design Technology Access Programme has been developed to build a pipeline and community of developers and technology companies to trial and experiment with the new DSbD technologies, to addresses the cybersecurity challenges faced by embedded product and software companies.

For a six-month period, programme participants will have access to the prototype architecture and hardware, technical guides, funding and industry and technical advisors, to support an experimentation period with the Digital Security by Design technologies within their own organisations.

These technologies include CHERI, a new architecture developed by the University of Cambridge and the Morello Board, a real-world test platform developed by Arm for Morello prototype architecture, based on the CHERI protection model.

The Technology Access Programme has been designed for all types of businesses, from early-stage startups looking to refine business propositions to mature companies seeking early access to revolutionary technology before it is fully ready for commercial deployment. This new architecture has wide appeal and is not restricted to any particular industry.

Participants will need to be experienced software developers able to extend and evaluate their C/C++ products on new architecture, in the context of performance and security. Companies with expertise in compilers/runtimes are also invited to prototype support for CHERI in languages other than C/C++.

The architecture is currently only supported by CHERI-adapted versions of the open-source Linux/Android/FreeBSD Operating Systems distributed by Arm and the University of Cambridge. CHERI-enabled C/C++ (Clang/LLVM) toolchains are currently available. Additional operating system enablement is currently being addressed by a joint development between Arm, University of Cambridge, Microsoft and Google.

The Morello Platform Model runs on Linux for testing/PoC purposes. QEMU-Morello runs on Linux and macOS. The Morello Instruction Emulator runs on Arm v8.0 Linux.

There are two levels of participation available to technology organisations:

Tier 1

Startups, scaleups and mid-size companies that are working to make their products secure from computer security threats and vulnerabilities. This route includes access to the Digital Security by Design prototype technologies, technical guidance and funding.

Tier 2

Companies, including larger organisations, that want to gain access to the Digital Security by Design technologies for experimentation and trialling, but don’t need technical support or funding.

Applications will be judged by a team of technology advisors from the Digital Security by Design programme partners, and an independent judge.

Successful applicants will be expected to participate in and deliver the following key commitments over the course of the programme:

• Participate in onboarding days
• Participate in mandatory peer-to-peer knowledge sharing sessions over a period of 6 months
• One-to-one check in sessions with Digital Security by Design experts to update on progress
• Provide a mid-way demonstration
• Programme communication support
• Technical reports –a short interim feedback report and a final report