{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,7]],"date-time":"2026-09-07T20:07:39Z","timestamp":1788811659128,"version":"build-2803163510"},"reference-count":67,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"3","license":[{"start":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T00:00:00Z","timestamp":1782864000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T00:00:00Z","timestamp":1782864000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T00:00:00Z","timestamp":1782864000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"},{"start":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T00:00:00Z","timestamp":1782864000000},"content-version":"am","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"}],"funder":[{"name":"TIM S.p.A"},{"name":"National Science Foundation","award":["CNS-1818971"],"award-info":[{"award-number":["CNS-1818971"]}]},{"DOI":"10.13039\/501100000780","name":"European Commission","doi-asserted-by":"crossref","id":[{"id":"10.13039\/501100000780","id-type":"DOI","asserted-by":"crossref"}]},{"name":"Italian National Recovery and Resilience Plan"},{"name":"Italian Ministry of Education and Research","award":["2022ZA8T22"],"award-info":[{"award-number":["2022ZA8T22"]}]},{"name":"Smart Networks and Services Joint Undertaking"},{"name":"Horizon Europe Research and Innovation Programme","award":["101139067"],"award-info":[{"award-number":["101139067"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Cloud Comput."],"published-print":{"date-parts":[[2026,7]]},"DOI":"10.1109\/tcc.2026.3697819","type":"journal-article","created":{"date-parts":[[2026,5,28]],"date-time":"2026-05-28T22:38:56Z","timestamp":1780007936000},"page":"2136-2153","source":"Crossref","is-referenced-by-count":0,"title":["SURE: A High-Performance, Efficient, and Secure Serverless Framework Based on Unikernels"],"prefix":"10.1109","volume":"14","author":[{"given":"Federico","family":"Parola","sequence":"first","affiliation":[{"name":"Politecnico di Torino","place":["Torino, Italy"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1367-5544","authenticated-orcid":false,"given":"Shixiong","family":"Qi","sequence":"additional","affiliation":[{"name":"University of Kentucky","place":["Lexington, KY, USA"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Anvaya B.","family":"Narappa","sequence":"additional","affiliation":[{"name":"University of California","place":["Riverside, CA, USA"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1849-5155","authenticated-orcid":false,"given":"K. K.","family":"Ramakrishnan","sequence":"additional","affiliation":[{"name":"University of California","place":["Riverside, CA, USA"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6134-7890","authenticated-orcid":false,"given":"Fulvio","family":"Risso","sequence":"additional","affiliation":[{"name":"Politecnico di Torino","place":["Torino, Italy"]}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1145\/3472883.3487003"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1145\/3600006.3613155"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1145\/3445814.3446701"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1145\/3651890.3672216"},{"key":"ref5","first-page":"199","article-title":"Fork in the road: Reflections and optimizations for cold start latency in production serverless systems","volume-title":"Proc. 19th USENIX Symp. Operating Syst. Des. Implementation","author":"Chai","year":"2025"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1109\/IWQoS49365.2020.9213020"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1145\/3342195.3392698"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1145\/2451116.2451167"},{"key":"ref9","first-page":"61","article-title":"OSvOptimizing the operating system for virtual machines","volume-title":"Proc. 2014 USENIX Annu. Tech. Conf.","author":"Kivity","year":"2014"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1145\/2557963.2566628"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1145\/3447786.3456248"},{"key":"ref12","first-page":"559","article-title":"Jitsu: Just-in-time summoning of unikernels","volume-title":"Proc. 12th USENIX Symp. Networked Syst. Des. Implementation","author":"Madhavapeddy","year":"2015"},{"key":"ref13","article-title":"Compatibility of unikraft","year":"2024"},{"key":"ref14","article-title":"runu OCI runtime","year":"2024"},{"key":"ref15","article-title":"NanoVMs","year":"2024"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1145\/3015146"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1145\/3698038.3698558"},{"key":"ref18","article-title":"Memory protection keys","year":"2024"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1145\/3544216.3544259"},{"key":"ref20","article-title":"Service Mesh. Simplified","year":"2024"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1145\/3620678.3624652"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1145\/3132747.3132763"},{"key":"ref23","first-page":"419","article-title":"Firecracker: Lightweight virtualization for serverless applications","volume-title":"Proc. 17th USENIX Symp. Networked Syst. Des. Implementation","author":"Agache","year":"2020"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1145\/1961295.1950399"},{"key":"ref25","first-page":"1489","article-title":"Following the data, not the function: Rethinking function orchestration in serverless computing","volume-title":"Proc. 20th USENIX Symp. Networked Syst. Des. Implementation","author":"Yu","year":"2023"},{"key":"ref26","first-page":"408","article-title":"LIFL: A lightweight, event-driven serverless platform for federated learning","volume-title":"Proc. Mach. Learn. Syst.","volume":"6","author":"Qi","year":"2024"},{"key":"ref27","first-page":"719","article-title":"FLUSH RELOAD: A high resolution, low noise, l3 cache side-channel attack","volume-title":"Proc. 23rd USENIX Secur. Symp.","author":"Yarom","year":"2014"},{"key":"ref28","first-page":"195","article-title":"Fixing races for fun and profit: How to use access (2)","volume-title":"Proc. USENIX Secur. Symp.","author":"Dean","year":"2004"},{"key":"ref29","first-page":"4111","article-title":"Elasticlave: An efficient memory model for enclaves","volume-title":"Proc. 31st USENIX Secur. Symp.","author":"Yu","year":"2022"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1145\/3651890.3672221"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1109\/DISCEX.2000.821514"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1145\/2103656.2103678"},{"key":"ref33","article-title":"Inter-VM shared memory device","year":"2024"},{"key":"ref34","article-title":"Provisioned concurrency for lambda functions","year":"2024"},{"key":"ref35","article-title":"F-Stack","year":"2024"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1145\/3341302.3342071"},{"key":"ref37","article-title":"DPDK Poll Mode Driver","year":"2024"},{"key":"ref38","first-page":"445","article-title":"NetVM: High performance and flexible networking using virtualization on commodity platforms","volume-title":"Proc. 11th USENIX Symp. Networked Syst. Des. Implementation","author":"Hwang","year":"2014"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1109\/LANMAN61958.2024.10621881"},{"key":"ref40","first-page":"969","article-title":"ServiceRouter: Hyperscale and minimal cost service mesh at meta","volume-title":"Proc. 17th USENIX Symp. Operating Syst. Des. Implementation","author":"Saokar","year":"2023"},{"key":"ref41","first-page":"609","article-title":"EPK: Scalable and efficient memory protection keys","volume-title":"Proc. USENIX Annu. Tech. Conf.","author":"Gu","year":"2022"},{"key":"ref42","first-page":"241","article-title":"libmpk: Software abstraction for intel memory protection keys (intel MPK)","volume-title":"Proc. USENIX Annu. Tech. Conf.","author":"Park","year":"2019"},{"key":"ref43","first-page":"1221","article-title":"ERIM: Secure, efficient in-process isolation with protection keys (MPK)","volume-title":"Proc. 28th USENIX Secur. Symp.","author":"Vahldiek-Oberwagner","year":"2019"},{"key":"ref44","article-title":"Write XOR eXecute","year":"2024"},{"key":"ref45","article-title":"Speculative buffer overflows: Attacks and defenses","author":"Kiriansky","year":"2018"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1145\/3173162.3173204"},{"key":"ref47","article-title":"MicroVM virtual platform","year":"2026"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1109\/NetSoft57336.2023.10175428"},{"key":"ref49","article-title":"Online boutique","year":"2024"},{"key":"ref50","first-page":"117","article-title":"The design and implementation of open vSwitch","volume-title":"Proc. 12th USENIX Symp. Networked Syst. Des. Implementation","author":"Pfaff","year":"2015"},{"key":"ref51","article-title":"lwIP - A Lightweight TCP\/IP stack","year":"2024"},{"key":"ref52","article-title":"Vhost-user protocol","year":"2026"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1109\/TNSM.2023.3256891"},{"key":"ref54","article-title":"NGINX service mesh","year":"2024"},{"key":"ref55","first-page":"205","article-title":"Serverless in the wild: Characterizing and optimizing the serverless workload at a large cloud provider","volume-title":"Proc. 2020 USENIX Annu. Tech. Conf.","author":"Shahrad","year":"2020"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1145\/3419111.3421275"},{"key":"ref57","article-title":"Locust: A modern load testing framework","year":"2024"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1145\/3343737.3343750"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1186\/s42400-020-00051-9"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1145\/3445814.3446731"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1145\/3503222.3507759"},{"key":"ref62","first-page":"43","article-title":"StackMap: Low-latency networking with the OS stack and dedicated NICs","volume-title":"Proc. 2016 USENIX Annu. Tech. Conf.","author":"Yasukata","year":"2016"},{"key":"ref63","first-page":"101","article-title":"NetMap: A novel framework for fast packet I\/O","volume-title":"Proc. USENIX Annu. Tech. Conf.","author":"Rizzo","year":"2012"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1145\/3477132.3483569"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1145\/3381052.3381326"},{"key":"ref66","first-page":"936","article-title":"Jenny: Securing syscalls for PKU-based memory isolation systems","volume-title":"Proc. 31st USENIX Secur. Symp.","author":"Schrammel","year":"2022"},{"key":"ref67","first-page":"21","article-title":"RedLeaf: Isolation and communication in a safe operating system","volume-title":"Proc. 14th USENIX Symp. Operating Syst. Des. Implementation","author":"Narayanan","year":"2020"}],"container-title":["IEEE Transactions on Cloud Computing"],"original-title":[],"link":[{"URL":"https:\/\/ieeexplore.ieee.org\/ielam\/6245519\/11678135\/11537379-aam.pdf","content-type":"application\/pdf","content-version":"am","intended-application":"syndication"},{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/6245519\/11678135\/11537379.pdf?arnumber=11537379","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,9,7]],"date-time":"2026-09-07T19:08:19Z","timestamp":1788808099000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11537379\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,7]]},"references-count":67,"journal-issue":{"issue":"3"},"URL":"https:\/\/doi.org\/10.1109\/tcc.2026.3697819","relation":{},"ISSN":["2168-7161"],"issn-type":[{"value":"2168-7161","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,7]]}}}