Introduction

The Digital Security by Design (DSbD) Technology Access Programme (TAP) is designed to give UK-based companies access to the Arm designed Morello board, CHERI stack, and technical support to trial these technologies within their systems, products, and applications.

Through the DSbD Technology Access Programme, companies will be able to experiment with and validate the prototype cyber security technology and feedback their findings to influence its future development before it enters commercialisation.

The DSbD project and its aims are detailed in this brochure.

Programme brief

Through the DSbD Technology Access Programme (TAP), qualifying UK-based companies will have exclusive access to an Arm Morello evaluation board, with its cutting-edge CPU architecture. 

A Morello board is a real-world test platform developed by Arm for the Morello prototype architecture based on the CHERI protection model, a novel instruction-set architecture developed by the University of Cambridge and SRI International. These technologies can defend against most known memory safety issues in C and C++ and participants will be able to use these technologies to uncover security vulnerabilities in their own systems.

In addition to receiving a Morello evaluation board, participating companies will get access to the CHERI software stack, technical guides, and expert support to get started and trial these new technologies within their systems. The duration of the Technology Access Programme is 6 months. At the end of the trial period, participating companies will be offered to keep the Morello evaluation board.

The TAP is a tiered programme; qualifying companies will receive a £15,000 grant during the experimentation period. The programme is administered by Digital Catapult on behalf of UKRI.
Register your interest via the button below or sign up to the Newsletter to be the first to know when applications open again.

Promotional video

Watch this short video to understand the overall aim of the Technology Access Programme.

Programme benefits

Companies will have exclusive access to cutting-edge cyber security technology, capable – if implemented correctly – of preventing around two thirds of hacks, cyber attacks and data breaches*. This technology, when fully mature and market-ready, has the potential to open up whole new markets for cyber secure by design products, providing competitive advantage to companies who are already familiar with it.

These technologies can mitigate against most memory safety issues in C and C++ and participants will be able to uncover security vulnerabilities in their own systems. CHERI technology can be applied to legacy C or C++ with minimal changes to an existing code base.

Further, individuals involved with the programme will become part of a vibrant community of like-minded professionals where they’ll be able to share ideas, forge new relationships and collaborations, as well as growing their knowledge and influence product development.

Companies sharing their programme related work will benefit from media exposure through DSbD as well as Digital Catapult communication channels.

Key benefits:

• Experiment with prototype, cutting-edge technology and be ahead of the game
• Build unique knowledge within your company and stay competitive
• Improve your product by identifying cyber security vulnerabilities in your systems/software
• Become part of a vibrant community of cyber security pioneers
• Receive a £15,000 grant (Tier 1 companies only) 
• Get access to experts at Arm, University of Cambridge, and Digital Catapult
• Become part of the TAP Alumni upon successful completion of the experimentation period

Check out the case studies from companies already involved in the programme.

Explore the learnings and findings presented by TAP companies at the Demo Day event.

*Source: Microsoft, 2020

Who is it for?

The programme is open to UK-based companies that have a company culture of exploring, experimenting and inventing with new technologies, with a view of finding commercial applications. Companies with an R&D department and a strong focus on cyber security are encouraged to apply. Applicants must be registered on Companies House and also have a business bank account.

Companies within the following industries should apply:

• Information Technology services
• Computer software
• Electric and electronic manufacturing
• Industrial automation
• Computer hardware
• CPU semiconductors
• Manufacturers of connected consumer / industrial electronics (IoT & IIoT)

Your company would ideally operate within or supply to the following sectors: utilities, healthcare, transportation, telecommunications, automotive, energy & mining, defence and all other sectors serving the Critical National Infrastructure.

Please also read the Technical Details section to understand if this is for you.

Programme tiers and requirements

TAP is a tiered programme. Tier 1 is for UK-based companies with under 250 employees while Tier 2 is for UK-based companies with more than 250 employees.

Tier 1

• Receive £15,000 in funding during the course of the 6 month programme.
• Gain access to a Morello evaluation board, with possibility to keep it once the project ends.
• Participate in one-to-one check-in sessions, group learning sessions, practical demonstrations and focused activities for the experimentation programme.
• Receive technical guidance and support from the Digital Security by Design programme team and experts at Arm and University of Cambridge.

Tier 2

• Gain access to a Morello evaluation board, with possibility to keep it once the project ends. 
• Receive technical guidance and support from the Digital Security by Design programme team and experts at Arm and University of Cambridge.
• Participate in one-to-one check-in sessions, group learning sessions, practical demonstrations and focused activities for the experimentation programme (optional).

Programme requirements

Over the six month period, successful applicants will be expected to:

• Participate in one onboarding day at the start of the programme [Tier 1 & 2] 
• Write two technical reports –a short interim report based on progress and findings, and a final report based on your experience within the programme [Tier 1 & 2]
• Participate in monthly online peer-to-peer knowledge sharing sessions [Tier 1]
• Attend monthly online one-to-one progress-update and support sessions with the Digital Security by Design team [Tier 1]
• Participate in the end-of-programme demo day and provide a demonstration or presentation on their experimental outcomes or learnings [Tier 1 & 2]

Technical Details

Please be aware of the following:

• CHERI (Capability Hardware Enhanced RISC Instructions) technology can be applied to legacy C or C++ 
• The architecture is currently only supported by CHERI-adapted versions of the open-source Linux/Android/FreeBSD Operating Systems distributed by Arm and the University of Cambridge.
• CHERI-enabled C/C++ (Clang/LLVM) toolchains are currently available. Additional operating system enablement is currently being addressed by a joint development between Arm, University of Cambridge, Microsoft and Google.
• The Morello Platform Model runs on Linux for testing/PoC purposes. QEMU-Morello runs on Linux and macOS. The Morello Instruction Emulator runs on Arm v8.0 Linux.
• This technology it’s not secure ‘out of the box’, there’s work to do in order to turn on security by design features. It’s not enough to just put your code on the board, because security is implemented by following a series of steps.