Member experience
Combatting the AI threat with CHERI
UM Labs describes a real port of its Unicus communications stack and gives enough numbers to frame a useful adoption conversation.
Work completed
UM Labs ported its Unicus Core and Edge software to Morello CHERI, first through Morello QEMU and then on Morello hardware running CheriBSD. The system handles real-time voice, video, surveillance and IoT communications using protocols including SIP, RTP, SRTP, RTSP and MQTT.
The work covered proprietary code and open-source packages. It therefore exposes the practical friction that arises at interfaces, build systems and dependencies—not only in a small isolated demonstration.
Reported results
The article reports 52 mostly minor source changes: 35 for the Edge software and 17 for the Core. It estimates roughly 460 hours for the port, with further effort taking the combined port-and-test figure to about 480 hours. Reported runtime testing included two weeks of voice and video calls across 100 connected phones and two weeks covering 350 hours of video streaming.
No CHERI-detectable problems were reported during those normal-data runtime tests. The next stated phase was targeted attack testing.
How to interpret the evidence
This is useful experience from a substantial existing codebase, but it is one supplier’s report on one software stack and platform. The effort cannot be transferred directly to another codebase without considering size, dependencies, operating-system assumptions, test maturity and the team’s familiarity with FreeBSD and CHERI.
- Ask which changes corrected genuine memory-safety defects and which were portability changes.
- Separate compile-time findings from faults observed during runtime.
- Retain the exact software revisions and test configuration.
- Treat normal workload tests and adversarial security tests as different evidence.