Shield · Runtime application protection
Shield adds runtime encryption to WebAssembly applications running in Brawl. Protect proprietary algorithms, business rules and local processing on IoT devices that may be physically accessible, with application protection connected to the wider device lifecycle.
Application intellectual property
Shield is RIoT Secure’s runtime firmware protection layer for WebAssembly applications. Integrated with Brawl, it adds encryption to the application logic and protected memory regions on the device, helping safeguard proprietary algorithms, business rules and local processing.
Its focus is the software held and used by the device itself. This extends the platform’s protection beyond data in transit and application isolation to address reverse engineering, memory inspection and unauthorised modification when device hardware is physically accessible.
The device-side threat
Devices in the field can be handled, opened or removed from their intended environment. The application inside them may contain years of development work, even when the surrounding connection and backend are well protected.
Where device memory and debugging interfaces are accessible, an attacker may be able to extract a firmware image, inspect stored data or analyse application behaviour. Familiar native instruction sets and development tools can make that extracted code a useful starting point for reverse engineering.
Shield addresses this exposure inside the application execution environment, adding protection around the WebAssembly logic that gives the device its value.
How Shield works
Shield integrates encryption into Brawl’s execution model. Application firmware is delivered in encrypted form and decrypted for use within the controlled context of the runtime. The protection covers application logic and protected memory regions during operation.
Each device receives its own encrypted firmware instance. This reduces the value of a copied image for analysis or reuse on another device and makes protection part of application execution, rather than only the transport used to deliver it.
The purpose is to make extraction, inspection and unauthorised modification of application IP harder throughout the software lifecycle.
A software-based protection layer
Shield brings its protection mechanism into the WebAssembly execution environment. The architecture combines encrypted application code, protected memory and device-specific encryption with Brawl’s runtime and host interfaces.
Hardware-specific IP protection can tie a product to particular memory features, components or vendor toolchains. Shield provides a software-based approach within supported Brawl configurations, without requiring a specialised protection chip or a hardware redesign solely for this layer.
For product teams, this offers a way to carry application protection across compatible hardware while keeping it connected to software development, deployment and maintenance. Target runtime support and the required host interfaces remain part of the integration.
Integrated with the platform
Brawl supplies the WebAssembly execution layer and defined host interfaces. Shield adds runtime encryption for the application logic and protected memory regions. Oasis manages the software lifecycle, while µTLS supplies encrypted device communication and delivery.
These components protect different parts of the same application journey. Transport encryption covers communication; Fusion’s dedicated microcontroller separates application resources from communication and security workloads; Shield focuses on the application IP within the Brawl execution environment.
Application protection can therefore remain part of the managed software lifecycle as new versions are delivered over the air.
Business value at the edge
Proprietary algorithms, business rules and data-processing workflows can be the most valuable part of an IoT product. Shield is designed to help protect that investment as application logic is deployed on devices outside the organisation’s direct control.
The same applies to AI-related application logic running through Brawl: the goal is to deploy useful intelligence at the edge while making the underlying software harder to extract, reverse engineer or clone.
As applications change, runtime protection stays connected to their deployment and update lifecycle, helping teams maintain a consistent approach to IP protection across compatible devices and software versions.
Your application. Your intellectual property.
Discuss the logic your devices hold, the hardware they use and how applications will be delivered and updated. Shape runtime protection around the IP that matters to your product.