The DOI matches its Crossref record; 22 of the 22 references it cites were found in a registry or an index.
Eliminating the hypervisor attack surface for a more secure cloud
Abstract
Cloud computing is quickly becoming the platform of choice for many web services. Virtualization is the key underlying technology enabling cloud providers to host services for a large number of customers. Unfortunately, virtualization software is large, complex, and has a considerable attack surface. As such, it is prone to bugs and vulnerabilities that a malicious virtual machine (VM) can exploit to attack or obstruct other VMs -- a major concern for organizations wishing to move to the cloud. In contrast to previous work on hardening or minimizing the virtualization software, we eliminate the hypervisor attack surface by enabling the guest VMs to run natively on the underlying hardware while maintaining the ability to run multiple VMs concurrently. Our NoHype system embodies four key ideas: (i) pre-allocation of processor cores and memory resources, (ii) use of virtualized I/O devices, (iii) minor modifications to the guest OS to perform all system discovery during bootup, and (iv) avoiding indirection by bringing the guest virtual machine in more direct contact with the underlying hardware. Hence, no hypervisor is needed to allocate resources dynamically, emulate I/O devices, support system discovery after bootup, or map interrupts and other identifiers. NoHype capitalizes on the unique use model in cloud computing, where customers specify resource requirements ahead of time and providers offer a suite of guest OS kernels. Our system supports multiple tenants and capabilities commonly found in hosted cloud infrastructures. Our prototype utilizes Xen 4.0 to prepare the environment for guest VMs, and a slightly modified version of Linux 2.6 for the guest OS. Our evaluation with both SPEC and Apache benchmarks shows a roughly 1% performance gain when running applications on NoHype compared to running them on top of Xen 4.0. Our security analysis shows that, while there are some minor limitations with cur- rent commodity hardware, NoHype is a significant advance in the security of cloud computing.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
Live migration of virtual machines
Clark, C. J., Fraser, K. A., Hand, S., Hansen, J. G., Jul, E., Limpach, C., Pratt, I., & Warfield, A. (2005) · doi:10.5555/1251203.1251223 · Cited by 2,562
Hey, you, get off of my cloud: exploring information leakage in third-party compute clouds
Ristenpart, T., Tromer, E., Shacham, H., & Savage, S. (2009) · Proceedings of the 16th ACM conference on Computer and communications security · doi:10.1145/1653662.1653687 · Cited by 2,053
SPEC CPU2006 benchmark descriptions
Henning, J. L. (2006) · ACM SIGARCH Computer Architecture News · doi:10.1145/1186736.1186737 · Cited by 1,970
Klein, G., Elphinstone, K., Heiser, G., Andronick, J., Cock, D., Derrin, P., Elkaduwe, D., Engelhardt, K., Kolanski, R., Norrish, M., et al. (2009) · Proceedings of the ACM SIGOPS 22nd symposium on Operating systems principles · doi:10.1145/1629575.1629596 · Cited by 1,633
Exokernel: an operating system architecture for application-level resource management
Engler, D. R., Kaashoek, M. F., & O'Toole, J. (1995) · Proceedings of the fifteenth ACM symposium on Operating systems principles - SOSP '95 · doi:10.1145/224056.224076 · Cited by 1,118
SecVisor: a tiny hypervisor to provide lifetime kernel code integrity for commodity OSes
Seshadri, A., Luk, M., Qu, N., & Perrig, A. (2007) · Proceedings of twenty-first ACM SIGOPS symposium on Operating systems principles · doi:10.1145/1294261.1294294 · Cited by 629
Architectural support for copy and tamper resistant software
Thekkath, D. L. C., Mitchell, M., Lincoln, P., Boneh, D., Mitchell, J., & Horowitz, M. (2000) · ACM SIGARCH Computer Architecture News · doi:10.1145/378995.379237 · Cited by 597
TrustVisor: Efficient TCB Reduction and Attestation
McCune, J. M., Li, Y., Qu, N., Zhou, Z., Datta, A., Gligor, V., & Perrig, A. (2010) · 2010 IEEE Symposium on Security and Privacy · doi:10.1109/sp.2010.17 · Cited by 541
HyperSafe: A Lightweight Approach to Provide Lifetime Hypervisor Control-Flow Integrity
Wang, Z., & Jiang, X. (2010) · 2010 IEEE Symposium on Security and Privacy · doi:10.1109/sp.2010.30 · Cited by 403
The design and implementation of an operating system to support distributed multimedia applications
Leslie, I., McAuley, D., Black, R. T., Roscoe, T., Barham, P., Evers, D., Fairbairns, R., & Hyden, E. (1996) · IEEE Journal on Selected Areas in Communications · doi:10.1109/49.536480 · Cited by 376
Cited by
Security in cloud computing: Opportunities and challenges
Ali, M., Khan, S. U., & Vasilakos, A. V. (2015) · Information Sciences · doi:10.1016/j.ins.2015.01.025 · Cited by 829
Data Center Network Virtualization: A Survey
Bari, M. F., Boutaba, R., Esteves, R., Granville, L. Z., Podlesny, M., Rabbani, M. G., Zhang, Q., & Zhani, M. F. (2013) · IEEE Communications Surveys & Tutorials · doi:10.1109/surv.2012.090512.00043 · Cited by 677
Security issues in cloud environments: a survey
Fernandes, D. A. B., Soares, L. F. B., Gomes, J. V., Freire, M. M., & Inácio, P. R. M. (2014) · International Journal of Information Security · doi:10.1007/s10207-013-0208-7 · Cited by 494
Cloud security issues and challenges: A survey
Singh, A., & Chatterjee, K. (2017) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2016.11.027 · Cited by 494
Wahab, O. A., Bentahar, J., Otrok, H., & Mourad, A. (2016) · 2016 IEEE International Conference on Services Computing (SCC) · doi:10.1109/scc.2016.48 · Cited by 19
Metadata
- Authors
- Szefer, J., Keller, E., Lee, R. B., & Rexford, J.
- Venue
- Proceedings of the 18th ACM conference on Computer and communications security
- Publisher
- ACM
- Published
- 2011-10-17
- Pages
- 401-412
- ISSN
- 1543-7221 (ISSN-L)
- OpenAlex
- W2135359801
- Cited by
- 286
- References
- 22
- FWCI
- 25.38
- Type
- conference paper
- Language
- en
- Open access
- closed
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
How to cite
Cite CoChat for the checks on this page, and the paper for its own findings.
- This page
- CoChat. (2026). Citation check: Eliminating the hypervisor attack surface for a more secure cloud. https://app.cochat.ai/papers/10.1145/2046707.2046754
- The paper
- Szefer, J., Keller, E., Lee, R. B., & Rexford, J. (2011). Eliminating the hypervisor attack surface for a more secure cloud. Proceedings of the 18th ACM conference on Computer and communications security. https://doi.org/10.1145/2046707.2046754
Data sources
Bibliographic data: Semantic Scholar, OpenAlex, Crossref.
Contains information from the Semantic Scholar Academic Graph Datasets, made available under the ODC Attribution License (ODC-BY 1.0).
Semantic Scholar’s data is described in: Kinney, R., et al. (2023). The Semantic Scholar Open Data Platform. arXiv:2301.10140.
