Hypervisor-based protection of code

Michael Kiperberg, Roee Leon, Amit Resh, Asaf Algawi, Nezer J. Zaidenberg

Research output: Contribution to journalArticlepeer-review

12 Scopus citations


The code of a compiled program is susceptible to reverse-engineering attacks on the algorithms and the business logic that are contained within the code. The main existing countermeasure to reverse-engineering is obfuscation. Generally, obfuscation methods suffer from two main deficiencies: 1) the obfuscated code is less efficient than the original and 2) with sufficient effort, the original code may be reconstructed. We propose a method that is based on cryptography and virtualization. The most valuable functions are encrypted and remain inaccessible even during their execution, thus preventing their reconstruction. A specially crafted hypervisor is responsible for decryption, execution, and protection of the encrypted functions. We claim that the system can provide protection even if the attacker: 1) has access to the operating system kernel and 2) can intercept communication over the system bus. The evaluation of the system's efficiency suggests that it can compete with and outperform obfuscation-based methods.

Original languageEnglish
Article number8624561
Pages (from-to)2203-2216
Number of pages14
JournalIEEE Transactions on Information Forensics and Security
Issue number8
StatePublished - Aug 2019
Externally publishedYes


  • Security
  • code protection
  • cryptography
  • trusted platform module
  • virtual machine monitors


Dive into the research topics of 'Hypervisor-based protection of code'. Together they form a unique fingerprint.

Cite this