{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,5]],"date-time":"2026-05-05T04:18:52Z","timestamp":1777954732435,"version":"3.51.4"},"reference-count":77,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/legalcode"}],"funder":[{"name":"JST SPRING, Japan,","award":["JPMJSP2123"],"award-info":[{"award-number":["JPMJSP2123"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Access"],"published-print":{"date-parts":[[2026]]},"DOI":"10.1109\/access.2026.3687522","type":"journal-article","created":{"date-parts":[[2026,4,27]],"date-time":"2026-04-27T19:50:43Z","timestamp":1777319443000},"page":"64535-64551","source":"Crossref","is-referenced-by-count":0,"title":["XenFlow: An XDP\/eBPF-Based Multi-Tenant NFV Framework Considering System Security and High-Performance"],"prefix":"10.1109","volume":"14","author":[{"ORCID":"https:\/\/orcid.org\/0009-0005-3005-1487","authenticated-orcid":false,"given":"Soki","family":"Koizumi","sequence":"first","affiliation":[{"name":"raduate School of Science and Technology, Keio University, Yokohama, Kanagawa, Japan"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Daisuke","family":"Settai","sequence":"additional","affiliation":[{"name":"raduate School of Science and Technology, Keio University, Yokohama, Kanagawa, Japan"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8839-3344","authenticated-orcid":false,"given":"Fumio","family":"Teraoka","sequence":"additional","affiliation":[{"name":"Faculty of Science and Technology, Keio University, Yokohama, Kanagawa, Japan"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3572-9304","authenticated-orcid":false,"given":"Takao","family":"Kondo","sequence":"additional","affiliation":[{"name":"Information Initiative Center, Hokkaido University, Sapporo, Hokkaido, Japan"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"key":"ref1","first-page":"445","article-title":"NetVM: High performance and flexible networking using virtualization on commodity platforms","volume-title":"Proc. 11th USENIX Symp. Netw. Syst. Design Implement. (NSDI)","author":"Hwang"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1145\/2940147.2940155"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1145\/2999572.2999602"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1145\/3098822.3098828"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1145\/3230543.3230563"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1145\/3098822.3098826"},{"key":"ref7","first-page":"143","article-title":"L25GC: A low latency 5G core network based on high-performance NFV platforms","volume-title":"Proc. ACM SIGCOMM Conf.","author":"Jain"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1145\/3167132.3167240"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1145\/3542929.3563471"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1109\/ISPA63168.2024.00252"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1109\/TNSM.2023.3256891"},{"key":"ref12","first-page":"171","article-title":"Metron: NFV service chains at the true speed of the underlying hardware","volume-title":"Proc. 15th USENIX Symp. Netw. Syst. Design Implement. (NSDI)","author":"Katsikas"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1109\/TPDS.2023.3263272"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/TNET.2023.3282562"},{"key":"ref15","first-page":"203","article-title":"NetBricks: Taking the V out of NFV","volume-title":"Proc. 12th USENIX Symp. Oper. Syst. Design Implement. (OSDI)","author":"Panda"},{"key":"ref16","first-page":"201","article-title":"SafeBricks: Shielding network functions in the cloud","volume-title":"Proc. 15th USENIX Symp. Netw. Syst. Design Implement. (NSDI)","author":"Poddar"},{"key":"ref17","first-page":"1451","article-title":"LemonNFV: Consolidating heterogeneous network functions at line speed","volume-title":"Proc. 20th USENIX Symp. Netw. Syst. Design Implement. (NSDI)","author":"Li"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1145\/3185467.3185493"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1145\/3281411.3281443"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1109\/TNSM.2021.3055676"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1109\/TNSM.2020.3000255"},{"key":"ref22","volume-title":"Data Plane Development Kit","year":"2025"},{"key":"ref23","first-page":"101","article-title":"Netmap: A novel framework for fast packet I\/O","volume-title":"Proc. USENIX Annu. Tech. Conf. (USENIX ATC)","author":"Rizzo"},{"key":"ref24","volume-title":"EBPF","year":"2025"},{"key":"ref25","volume-title":"AFXDP","year":"2025"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1145\/168619.168635"},{"key":"ref27","first-page":"49","article-title":"Light-weight contexts: An OS abstraction for safety and performance","volume-title":"Proc. 12th USENIX Symp. Oper. Syst. Design Implement. (OSDI)","author":"Litton"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978327"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2016.12"},{"key":"ref30","first-page":"309","article-title":"Wedge: Splitting applications into reduced-privilege compartments","volume-title":"Proc. USENIX Symp. Netw. Syst. Design Implement. (NSDI)","author":"Bittau"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1145\/2694344.2694386"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2022.3192524"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2022.3168089"},{"key":"ref34","first-page":"1221","article-title":"ERIM: Secure, efficient in-process isolation with protection keys (MPK)","volume-title":"Proc. 28th USENIX Secur. Symp. (USENIX Secur.)","author":"Vahldiek-Oberwagner"},{"key":"ref35","first-page":"335","article-title":"Dune: Safe user-level access to privileged CPU features","volume-title":"Proc. 10th USENIX Symp. Oper. Syst. Design Implement. (OSDI)","author":"Belay"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1145\/2810103.2813690"},{"key":"ref37","first-page":"241","article-title":"libmpk: Software abstraction for Intel memory protection keys (Intel MPK)","volume-title":"Proc. USENIX Annu. Tech. Conf. (USENIX ATC)","author":"Park"},{"key":"ref38","first-page":"489","article-title":"Hodor: Intra-process isolation for high-throughput data plane libraries","volume-title":"Proc. USENIX Annu. Tech. Conf. (USENIX ATC)","author":"Hedayati"},{"key":"ref39","first-page":"936","article-title":"Jenny: Securing syscalls for PKU-based memory isolation systems","volume-title":"Proc. 31st USENIX Secur. Symp. (USENIX Secur.)","author":"Schrammel"},{"key":"ref40","first-page":"145","article-title":"Endokernel: A thread safe monitor for lightweight subprocess isolation","volume-title":"Proc. 33rd USENIX Secur. Symp. (USENIX Secur.)","author":"Yang"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1145\/3548606.3559344"},{"key":"ref42","volume-title":"Intel 64 and IA-32 Architectures Software Developer Manuals","year":"2025"},{"key":"ref43","volume-title":"SECure COMPuting With Filters","year":"2025"},{"key":"ref44","first-page":"209","article-title":"Evaluating SFI for a CISC architecture","volume-title":"Proc. USENIX Secur. Symp. (USENIX Secur.)","author":"McCamant"},{"key":"ref45","first-page":"1","article-title":"Adapting software fault isolation to contemporary CPU architectures","volume-title":"Proc. USENIX Secur. Symp. (USENIX Secur.)","author":"Sehr"},{"key":"ref46","volume-title":"WEBASSEMBLY","year":"2025"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1145\/3669940.3707249"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1145\/3498688"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1145\/3582016.3582023"},{"key":"ref50","first-page":"459","article-title":"ClickOS and the Art of Network Function Virtualization","volume-title":"Proc. 11th USENIX Symp. Netw. Syst. Design Implement. (NSDI)","author":"Martins"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1109\/MCOM.2017.1601039"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1109\/CloudNet.2014.6969010"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1145\/3106989.3106990"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1145\/3627703.3650071"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1109\/TSC.2022.3162701"},{"key":"ref56","first-page":"309","article-title":"AddressSanitizer: A fast address sanity checker","volume-title":"Proc. USENIX Annu. Tech. Conf. (USENIX ATC)","author":"Serebryany"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1145\/2810103.2813646"},{"key":"ref58","volume-title":"Linux Containers-LXC-Security","year":"2025"},{"key":"ref59","volume-title":"Unix(7)\u2014Linux Manual Page","year":"2025"},{"key":"ref60","volume-title":"Secure Supply Chain Consumption Framework (S2C2F) Project","year":"2025"},{"key":"ref61","volume-title":"OpenSSF Scorecard","year":"2025"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1145\/3607199.3607219"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00076"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1145\/3556977"},{"key":"ref65","volume-title":"Linux Intel Quilt","year":"2021"},{"key":"ref66","volume-title":"BPF Compiler Collection (BCC)","year":"2025"},{"key":"ref67","volume-title":"LIBBPF Overview","year":"2025"},{"key":"ref68","volume-title":"Snort Community Rulesets","year":"2025"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1145\/360825.360855"},{"key":"ref70","volume-title":"NDPI","year":"2025"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1145\/2815675.2815692"},{"key":"ref72","volume-title":"OpenNetVM","year":"2025"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1145\/3620665.3640408"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.1109\/CSF.2014.10"},{"key":"ref75","volume-title":"AMD64 Architecture Programmer\u2019s Manual, Volumes 1-5","year":"2024"},{"key":"ref76","volume-title":"Arm Architecture Reference Manual for A-Profile Architecture","year":"2025"},{"key":"ref77","first-page":"75","article-title":"XFI: Software guards for system address spaces","volume-title":"Proc. 7th USENIX Symp. Oper. Syst. Design Implement. (OSDI)","author":"Erlingsson"}],"container-title":["IEEE Access"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/6287639\/11323511\/11495098.pdf?arnumber=11495098","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,5,4]],"date-time":"2026-05-04T19:37:37Z","timestamp":1777923457000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11495098\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026]]},"references-count":77,"URL":"https:\/\/doi.org\/10.1109\/access.2026.3687522","relation":{},"ISSN":["2169-3536"],"issn-type":[{"value":"2169-3536","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026]]}}}