{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,9]],"date-time":"2026-06-09T07:05:07Z","timestamp":1780988707479,"version":"3.54.1"},"reference-count":34,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"2","license":[{"start":{"date-parts":[[2026,4,1]],"date-time":"2026-04-01T00:00:00Z","timestamp":1775001600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2026,4,1]],"date-time":"2026-04-01T00:00:00Z","timestamp":1775001600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,4,1]],"date-time":"2026-04-01T00:00:00Z","timestamp":1775001600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["72595830\/72595835"],"award-info":[{"award-number":["72595830\/72595835"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"name":"National Key Research and Development Program of China","award":["2022YFB4500704"],"award-info":[{"award-number":["2022YFB4500704"]}]},{"DOI":"10.13039\/501100001809","name":"National Science Foundation of China","doi-asserted-by":"crossref","award":["62032008"],"award-info":[{"award-number":["62032008"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"crossref"}]},{"name":"Interdisciplinary Disciplines Breakthrough Plan of the Ministry of Education of China","award":["JYB2025XDXM103"],"award-info":[{"award-number":["JYB2025XDXM103"]}]},{"name":"Science and Technology Plan Project of Hubei Province","award":["2025CSA056"],"award-info":[{"award-number":["2025CSA056"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Cloud Comput."],"published-print":{"date-parts":[[2026,4]]},"DOI":"10.1109\/tcc.2026.3681842","type":"journal-article","created":{"date-parts":[[2026,4,8]],"date-time":"2026-04-08T20:07:10Z","timestamp":1775678830000},"page":"1127-1140","source":"Crossref","is-referenced-by-count":0,"title":["KPT-Fork: Enhancing User Data Isolation via Kernel Page Table Fork"],"prefix":"10.1109","volume":"14","author":[{"ORCID":"https:\/\/orcid.org\/0009-0009-9958-4889","authenticated-orcid":false,"given":"Zixuan","family":"Wang","sequence":"first","affiliation":[{"name":"Services Computing Technology and System Lab, Cluster and Grid Computing Lab, National Engineering Research Center for Big Data Technology and System, School of Computer Science and Technology, Huazhong University of Science and Technology, Wuhan, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Lisong","family":"Pan","sequence":"additional","affiliation":[{"name":"Services Computing Technology and System Lab, Cluster and Grid Computing Lab, National Engineering Research Center for Big Data Technology and System, School of Computer Science and Technology, Huazhong University of Science and Technology, Wuhan, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2133-4363","authenticated-orcid":false,"given":"Jia","family":"Rao","sequence":"additional","affiliation":[{"name":"Department of Computer Science, The University of Texas at Arlington, Arlington, TX, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6741-0448","authenticated-orcid":false,"given":"Hao","family":"Fan","sequence":"additional","affiliation":[{"name":"Services Computing Technology and System Lab, Cluster and Grid Computing Lab, National Engineering Research Center for Big Data Technology and System, School of Computer Science and Technology, Huazhong University of Science and Technology, Wuhan, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6094-0166","authenticated-orcid":false,"given":"Zhuo","family":"Huang","sequence":"additional","affiliation":[{"name":"Services Computing Technology and System Lab, Cluster and Grid Computing Lab, National Engineering Research Center for Big Data Technology and System, School of Computer Science and Technology, Huazhong University of Science and Technology, Wuhan, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Qi","family":"Wu","sequence":"additional","affiliation":[{"name":"Services Computing Technology and System Lab, Cluster and Grid Computing Lab, National Engineering Research Center for Big Data Technology and System, School of Computer Science and Technology, Huazhong University of Science and Technology, Wuhan, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8690-127X","authenticated-orcid":false,"given":"Song","family":"Wu","sequence":"additional","affiliation":[{"name":"Services Computing Technology and System Lab, Cluster and Grid Computing Lab, National Engineering Research Center for Big Data Technology and System, School of Computer Science and Technology, Huazhong University of Science and Technology, Wuhan, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1145\/3274694.3274720"},{"key":"ref2","first-page":"973","article-title":"Meltdown: Reading kernel memory from user space","volume-title":"Proc. 27th USENIX Secur. Symp.","author":"Lipp","year":"2018"},{"key":"ref3","first-page":"3825","article-title":"RETBLEED: Arbitrary speculative code execution with return instructions","volume-title":"Proc. 31st USENIX Secur. Symp.","author":"Wikner","year":"2022"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1147\/JRD.2016.2574138"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1007\/s11432-023-4017-0"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1109\/TPDS.2025.3628202"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2014.26"},{"key":"ref8","first-page":"161","article-title":"Control-flow bending: On the effectiveness of control-flow integrity","volume-title":"Proc. 24th USENIX Conf. Secur. Symp.","author":"Carlini","year":"2015"},{"key":"ref9","first-page":"177","article-title":"Non-control-data attacks are realistic threats,","volume-title":"Proc. USENIX Secur. Symp.","volume":"5","author":"Chen","year":"2005"},{"key":"ref10","first-page":"4211","article-title":"A hybrid alias analysis and its application to global variable protection in the linux kernel","volume-title":"Proc. 32nd USENIX Secur. Symp.","author":"Li","year":"2023"},{"key":"ref12","first-page":"689","article-title":"SCONE: Secure linux containers with intel SGX","volume-title":"Proc. 12th USENIX Symp. Operating Syst. Des. Implementation","author":"Arnautov","year":"2016"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2015.9"},{"key":"ref15","first-page":"163","article-title":"Linux capabilities: Making them work","volume-title":"Proc. Linux Symp.","author":"Hallyn","year":"2008"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1145\/3474123.3486762"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1145\/2694344.2694386"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1145\/3471621.3471849"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2025.230328"},{"key":"ref20","first-page":"1139","article-title":"Efficiently mitigating transient execution attacks using the unmapped speculation contract","volume-title":"Proc. 14th USENIX Symp. Operating Syst. Des. Implementation","author":"Behrens","year":"2020"},{"key":"ref21","article-title":"Linux KPTI Documentation, \u201clinux kernel","year":"2019"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1109\/ISCA59077.2024.00059"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1145\/3548606.3560585"},{"key":"ref24","article-title":"Dirty pagetable: A novel exploitation technique to rule linux kernel","author":"Wu","year":"2023"},{"key":"ref25","article-title":"USMAShare kernel code with me","author":"Liu","year":"2022"},{"key":"ref26","article-title":"Seccomp-bypass","author":"Williams","year":"2017"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1145\/3576915.3623154"},{"key":"ref29","first-page":"465","article-title":"Microkernel goes general: Performance and compatibility in the HongMeng production microkernel","volume-title":"Proc. 18th USENIX Symp. Operating Syst. Des. Implementation","author":"Chen","year":"2024"},{"key":"ref30","first-page":"241","article-title":"libmpk: Software abstraction for intel memory protection keys (intel MPK)","volume-title":"Proc. USENIX Annu. Tech. Conf.","author":"Park","year":"2019"},{"key":"ref31","first-page":"609","article-title":"EPK: Scalable and efficient memory protection keys","volume-title":"Proc. USENIX Annu. Tech. Conf.","author":"Gu","year":"2022"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833726"},{"key":"ref33","article-title":"MultiK: A framework for orchestrating multiple specialized kernels","author":"Kuo","year":"2019"},{"key":"ref34","first-page":"1","article-title":"Lock-in-Pop: Securing privileged operating system kernels by keeping on the beaten path","volume-title":"Proc. USENIX Annu. Tech. Conf.","author":"Li","year":"2017"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1109\/fits.2003.1264934"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1145\/3575693.3575716"},{"key":"ref38","first-page":"25","article-title":"Are you sure you want to use MMAP in your database management system","volume-title":"Proc. Conf. Innov. Data Syst. Res.","author":"Crotty","year":"2022"}],"container-title":["IEEE Transactions on Cloud Computing"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/6245519\/11554470\/11476886.pdf?arnumber=11476886","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,6,9]],"date-time":"2026-06-09T06:20:10Z","timestamp":1780986010000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11476886\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,4]]},"references-count":34,"journal-issue":{"issue":"2"},"URL":"https:\/\/doi.org\/10.1109\/tcc.2026.3681842","relation":{},"ISSN":["2168-7161","2372-0018"],"issn-type":[{"value":"2168-7161","type":"electronic"},{"value":"2372-0018","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,4]]}}}