Is the End of Many Security Software Bugs Coming?
Michael Spencer
A.I. Writer, researcher and curator - full-time Newsletter publication manager.
What is ARM Morello Project?
If you enjoy this article, subscribe to Data Science Learning where we cover programming, Datascience and technology topics like this one here. I cannot continue to write without extensive community support.
https://datasciencelearningcenter.substack.com/subscribe
NVIDIA is unlikely to go through with its purchase of ARM for $40 Billion in the end. Nvidia is reportedly backing out of the deal due to regulatory obstacles. That’s totally understandable given how dominant Nvidia has become since that acquisition attempt back in 2020.
ARM however has some pretty interesting projects. Zdnet reports that Chip designer Arm has released a prototype of its Morello development board for researchers at Google, Microsoft and industry to test its goal for a CPU design that wipes out a chunk of memory-related security flaws in code.
Morello has a transformative goal to radically update the security foundations of the digital computing infrastructure that underpins the entire global economy. The main anticipated output of DSbD is a technology platform prototype, designed and produced by Arm: The Morello evaluation board. Read more about it from ARM?here.
Could Software Bugs That Impact Security Have a Magical Fix?
Let’s be honest, when it comes to cybersecurity that’s bleeding edge, Microsoft is often involved.
The?Morello board?is the product of a collaboration between Arm, Cambridge University, Microsoft and others based on the Capability Hardware Enhanced RISC Instructions (CHERI) architecture.
What is CHERI?
CHERI stands for (Capability Hardware Enhanced RISC Instructions) protection model.
Microsoft says the board and system on chip (SoC) is the first high-performance implementation of CHERI, which provides "fine-grained spatial memory safety at a hardware level". If it proves successful after testing with legacy software, it could pave the way for future CPU designs.
Morello focuses on new ways of designing CPU architecture that can make processors more robust and deter certain key security breaches.
As part of an additional 5-year research program funded by UK Research and Innovation (UKRI), Morello will be used to produce and test a prototype technology that, if successful, could be implemented in future hardware.
Bleeding Edge Security Fix
CHERI was developed by the University of Cambridge and SRI International after it received funding from DARPA's Clean-slate design of Resilient, Adaptive, Secure Hosts (CRASH) program.
The shear amount of collaboration here is astounding. The Morello architecture is based on CHERI. Arm kicked off work on hardware for the Morello program in 2019 with backing from the UK government's Digital Security by Design (DSbD) program and UK Research and Innovation (UKRI). Got that?
There has never been a silicon implementation of this hardware capability technology in a high-performance CPU," said Arm.
Technical Specs
The Morello demonstrator board is a tweaked Arm Neoverse N1, a 2.5GHz quad-core server core CPU with support for Armv8.2a 64-bit architecture that has extra features to enable CHERI-based "compartmentalization" to counter exploits against memory-related security flaws.?
领英推荐
Significant Advances in Security in Software
The CHERI and Morello architectures may be one way of tackling memory-related security flaws that stem from code written in programming languages like C and C++. Microsoft and?Google say?the?majority of security bugs?are memory safety issues and they're?often due to coding issues written in these languages.?
Cybersecurity for Software
The volume of these bugs and patches they require has prompted major software firms like Microsoft, Google and Amazon to explore 'type safe' languages like Rust for systems programming. However, Rust is generally used to write new components because vast, existing code bases written in C or C++ are left in place,?as Google is doing for Android's code base.???
Using this new technology, Arm has designed a prototype system-on-chip (SoC) and a development board, called the Morello board. This will enable industry and academic partners to test the new prototype architecture in real-world use cases.
Over 2022, hundreds of Morello boards will be shipped to companies, universities, and government labs for experimentation and evaluation. The remainder of the project time will be available for testing and feedback by the industry ecosystem.
Additional Notes
As detailed in a?paper about CHERI by Google researcher Ben Laurie and peers, various CHERI modes can be more effective and efficient than mitigations in conventional memory management unit (MMU) hardware, which are used to translate virtual memory addresses to physical addresses.?
Security is the greatest challenge computing needs to address to reach its full potential. Even security vulnerabilities in software itself need to be addressed.
Challenge of Security in the Smart Device, IoT and 5G Era
From smartwatches to smart speakers, smartphones to laptops, we rely on these devices to store and share personal information, be they photographs or medical records. We perform financial transactions and make purchases.
Even third-party software make Teslas vulnerable to attacks, not to mention devices in the smart home.
Research by Microsoft?and Google has shown that 70 percent of vulnerabilities addressed through a security update each year continue to be memory safety issues.
The Morello Project of ARM, made possible by DARPA, Microsoft and Cambridge University demonstrates key ways that software bugs and device vulnerabilities can be mitigated at scale.
If you enjoyed this article, you might enjoy my Newsletter on A.I. called AiSupremacy.
If you enjoy this article, subscribe to Data Science Learning where we cover programming, Datascience and technology topics like this one here. I cannot continue to write without extensive community support.
https://datasciencelearningcenter.substack.com/subscribe
Thanks for reading!
Retired at County of Los Angeles
2 年Always informative Michael Spencer.
A.I. Writer, researcher and curator - full-time Newsletter publication manager.
2 年Microsoft always seems involved in the bleeding edge of security. An acquisition as big as ARM shouldn't be allowed to go through. Considering how dominant NVIDIA has become. I was impressed by the shear scope of the collaboration for ARM's Morello program. Cybersecurity is a global problem, and just like theft in Web3, it's a very serious problem that scan scale out of control.
Administrative Assistant at Cisco
2 年Neurospinal quantum computing