Craton Shield

Embedded intrusion detection and prevention runtime for safety-critical systems.

#![no_std] | zero-heap | ~280 KiB flash | 3,200+ tests | 122K lines of Rust

Craton Shield is a modular, multi-domain cybersecurity runtime for resource-constrained embedded devices. It provides real-time intrusion detection, network firewalling, cryptographic integrity, secure boot, and OTA validation -- all without dynamic memory allocation.

Domains

Architecture

Layer 3  INTEGRATION     vs-runtime, vs-ids-engine, vs-ffi
Layer 2  SUBSYSTEMS      vs-crypto, vs-netfw, vs-policy-engine, vs-anomaly, ...
Layer 1  HAL             vs-hal (traits), vs-hal-linux (Linux impl)
Layer 0  TYPES           vs-types (shared enums, structs, errors)

Dependencies flow strictly downward. Domain layers (auto, embedded, industrial) extend the core stack with protocol-specific monitors and runtimes.

Full architecture documentation: core/docs/architecture.md

Performance

All operations fit within a 10 us CAN gateway budget (x86_64, release profile):

See core/docs/performance-results.md for full benchmarks.

Quick Start

# Requirements: Rust 1.82+
rustup update stable

# Build the entire workspace
cargo build --workspace

# Run all tests
cargo test --workspace

# Check no_std compatibility (Cortex-M)
rustup target add thumbv7em-none-eabihf
cargo check --target thumbv7em-none-eabihf -p vs-types -p vs-crypto -p vs-runtime

# Run local CI (mirrors GitHub Actions)
./scripts/local-ci.sh --fast

Workspace

Core (21 crates)

Automotive (7 crates)

Embedded IoT (8 crates)

Industrial (11 crates)

Standards Alignment

Design Principles

• No heap allocation -- all data structures are stack-allocated with fixed capacities
• No unsafe code -- unsafe_code = "deny" enforced workspace-wide (except FFI boundary)
• No std -- every crate compiles for thumbv7em-none-eabihf (Cortex-M4F)
• Default-deny -- firewall, policy engine, and diagnostic gateway deny by default
• Constant-time comparison -- integrity checks use subtle::ConstantTimeEq
• HMAC-chained logging -- tamper-evident audit trail with cryptographic chain

Documentation

Getting Started

• Installation Guide
• Architecture Overview
• Core Architecture (detailed)
• Deployment Guide
• Porting Guide
• Hardware Compatibility

Domain Guides

• Automotive Deployment
• Embedded IoT Deployment
• Industrial OT/ICS Deployment

Reference

• Feature Flags
• API Stability
• Safety Manual
• Threat Model
• Known Limitations
• Performance Results
• Integration Examples
• Migration Guide (0.5→0.6)
• Migration Guide (0.6→0.7)
• FAQ

Project

• Roadmap
• Changelog
• Security Policy
• Support Guide
• Code of Conduct

Enterprise Edition

Craton Shield Enterprise adds hardware-backed cryptography (PKCS#11, TPM 2.0), QNX RTOS support, and fleet telemetry under a Business Source License.

Contributing

See CONTRIBUTING.md for development setup, coding standards, and pull request guidelines. All contributions require a Developer Certificate of Origin sign-off (git commit -s).

See also: Governance | Maintainers | Acknowledgments | Installation | Architecture

License

Licensed under the Apache License, Version 2.0.

Copyright 2026 Craton Software Company
SPDX-License-Identifier: Apache-2.0