Feature: Semiconductors
perhaps with some permissions removed to prevent modification. CHERIoT is a new microcontroller-
class instantiation of CHERI, designed specifically for deeply embedded use cases by Microsoſt, and now managed collectively in the open-source by Microsoſt, Google and SCI Semiconductor. It brings the benefits of CHERI into the world of low-power, real-time systems without the resource and performance penalties that traditionally come with secure architectures. CHERIoT is a hardware-soſtware co-design project that aimed to demonstrate how a pure- CHERI system could provide efficiency improvements over traditional systems, not just security. CHERIoT allows designers to remove
features such as memory-protection units, which have large power and area requirements, and yet still provide strong and finer-grained isolation. Co- designing the hardware and the real-time operating system, with memory safety as a foundational property, allowed building a system where the core of the system— which runs with fewer privileges than a traditional kernel—is only around 350 instructions, a similar size to the amount of unverified code in the seL4 verified microkernel. Crucially, CHERIoT demonstrates that
hardware-enforced security doesn't have to come at the expense of performance or simplicity. It offers a clean, deterministic execution model suitable for industrial control, safety-critical applications, and other constrained environments.
CHERIoT in practice As the embedded systems industry begins to embrace the principles of memory safety and hardware- enforced compartmentalisation, the demand for practical silicon platforms implementing these ideas is growing. Our company SCI Semiconductor, a UK-based innovator in secure system- on-chip (SoC) design, has responded with the ICENI platform: a next- generation SoC family engineered to bring the CHERIoT architecture to life in mission-critical environments.
Te ICENI platform is designed as a
modular SoC architecture that can scale from ultra-low-power edge devices to compute-rich embedded controllers. At its heart is a CHERIoT core, a deterministic, capability-based microcontroller that brings spatial memory safety and soſtware compartmentalisation to the deeply embedded class of devices. But ICENI goes further. A key design principle behind ICENI is
developer-accessibility. Te platform offers a full open toolchain built on the latest LLVM tool chain, and tracking upstream improvements, with CHERI extensions available in the compiler, debugger, and linker. Te CHERIoT soſtware stack provides a capability-aware Real Time OS enabling fast onboarding for embedded engineers. Tis includes a porting layer that makes it easy to bring over existing RTOS code. For example, it can run the entire TCP/IP stack from FreeRTOS, unmodified. ICENI is engineered for a range of high-
value embedded domains where failure is not an option, such as energy systems and smart grid nodes; rail and industrial control systems; water treatment and other critical infrastructure applications; and aerospace and defence systems.
Secure systems by design At the heart of CHERIoT lies its capability-based security model. Instead of using basic addresses to represent pointers, CHERIoT uses capabilities; bounded, unforgeable references that explicitly define the range and permissions of access to memory. Tese capabilities are enforced by hardware and cannot be bypassed or corrupted by conventional memory-safety exploits. Unlike MMU or MPU-based isolation, they respect the principle of intentionality: Just because a piece of code has access to two objects does not mean that it can use a pointer to one to access the other. Tis model is used throughout the soſtware stack and eliminates large categories of confused deputy attacks where a privileged component is tricked into exercising the wrong set of privileges. Tis approach yields three critical
benefits - memory safety, soſtware compartmentalisation and least privilege enforcement. CHERIoT isn’t just a theoretical or academic exercise. It’s designed with real embedded constraints in mind - deterministic execution, minimal overhead and toolchain support. Transitioning to CHERIoT-based
platforms like ICENI is realtively easy with C/C++, with just a recompile required, however, to really benefit with compartmentalsation it requires a shiſt in mindset. Security becomes a design parameter, not an aſterthought. Key practices include refactoring applications into compartments and minimising privilege scope. At the same time, these abstractions are surfaced directly to C and higher-level languages. C says memory- safety bugs are undefined behavior. ICENI says that it will assume that you didn’t mean to introduce them and let you recover when you do. If all that you want is deterministic protection against around 70 per cent of security vulnerabilities, you just need to recompile your code. If you want to have robust protection against supply-chain attacks in important libraries then you need to think a bit more about compartmentalisation. Embedded security has never been more
critical — and the tools to achieve it have never been more accessible. Platforms like ICENI and CHERIoT show that deeply embedded systems can enjoy the same robust memory protection and soſtware isolation once reserved for high-end processors. But the path forward requires proactive
engagement from developers, integrators, and system designers. Te time to rethink long-standing assumptions about microcontroller design is now.
Haydn Povey is co-founder of SCI Semiconductor. He has over 30 years’ experience in the semiconductor industry, including over10 years at ARM. He also founded the IoT security company Secure Tingz which was sold to IAR Systems Group in 2018, as well as co-founding the IoT Security Foundation, a TechWorks organisation.
www.electronicsworld.co.uk June 2025 25
Page 1 |
Page 2 |
Page 3 |
Page 4 |
Page 5 |
Page 6 |
Page 7 |
Page 8 |
Page 9 |
Page 10 |
Page 11 |
Page 12 |
Page 13 |
Page 14 |
Page 15 |
Page 16 |
Page 17 |
Page 18 |
Page 19 |
Page 20 |
Page 21 |
Page 22 |
Page 23 |
Page 24 |
Page 25 |
Page 26 |
Page 27 |
Page 28 |
Page 29 |
Page 30 |
Page 31 |
Page 32 |
Page 33 |
Page 34 |
Page 35 |
Page 36 |
Page 37 |
Page 38 |
Page 39 |
Page 40 |
Page 41 |
Page 42 |
Page 43 |
Page 44
