@dch @cheri_alliance

A combination of three things:

• They are connected to a network.
• They have long installed lifespans.
• They are critical infrastructure.

The connected bit means that they are always part of an attack surface. Security can't be an afterthought. The networking is also often expensive (mobile Internet across a fleet of tens of millions of devices): software updates cost money to deploy, so avoiding needing updates.

The long installed life means that need to be easy for software maintenance. #CHERIoT's compartmentalisation model makes this easy because it encourages well-defined interfaces and allows some things to be auditably removed from the attack surface (this component deals only with trusted data, we don't need to patch vulnerabilities in it). CHERIoT's retrospective analysis of FreeRTOS+TCP in our compartmentalised networks stack shows that none of the CVEs in the 12 or so years since the project was created would have required an urgent patch (in the worst case, they can do intermittent denial of service). That's the kind of guarantee you need for this. There was testimonial in the US congressional hearings about smart meters a few years ago with companies claiming that they needed a 20-25 year operational life for smart meters to make them economically feasible. CHERI is about the only game in town for that if you want security and don't want a 30x (minimum) increase in your costs from formal verification.

And the national infrastructure bit (if you can compromise all smart meters in a country, there's a lot of damage that you can do even if all that you can do is manipulate price data to make smart devices increase demand when the grid is at capacity), which is why the government is encouraging this.