NOVA, a microhypervisor maintained by BlueRock Security and originally developed at TU Dresden with contributions from Intel and FireEye, drew attention this week for a capability that matters more as AI infrastructure consolidates: bringing AMD DMA isolation to shared, multi-tenant machines. The threat it targets is the one most people running models on rented GPU boxes never think about. As BlueRock CEO Harold Byun frames it, "without IOMMU protections, a compromised device driver can DMA-read arbitrary regions of memory compromising confidentiality or DMA-write arbitrary regions of memory compromising integrity." On a machine where several workloads share hardware, a device assigned to one of them can, absent isolation, reach straight into another's memory below the level the operating system polices.
NOVA's answer is architectural. It is a combined microkernel and hypervisor with a deliberately minimal trusted computing base and capability-based authorization, roughly 96% C++, running on both Intel (VT-x, EPT) and AMD (AMD-V, SVM, NPT). For the DMA problem specifically, it enforces per-device and per-memory-page access control through the IOMMU, aborting any unauthorized memory transaction, so a device handed to one VM cannot touch a neighbor's pages. It scales to workloads with 256TB of physical memory and 128 petabytes of virtual address space, uses lockless page-table maintenance so disjoint regions update concurrently, and adds CPU cache partitioning for quality of service. Optional hardening includes Intel's Control-Flow Enforcement Technology and a measured launch with a dynamic root of trust on Intel TXT platforms.
The differentiator, and the reason it is worth a builder's attention rather than a footnote, is verification. NOVA ships under GPLv2 on GitHub, and its specifications and proofs are maintained separately as machine-checked formal verification, not just tested but proven against a formal model. That is a different and stronger claim than most isolation software makes, and it is exactly the kind of claim that survives contact with an adversary who controls a malicious driver. The honest caveat from BlueRock is that the project remains experimental, so this is not a drop-in production layer today.
Place it next to the other half of this week's security story and the shape is clear. Apple's Private Cloud Compute leaned on NVIDIA Confidential Computing and a Google Titan chip to isolate tenants on hardware Apple does not own, the proprietary, vendor-attested route to confidential AI. NOVA is the open, GPLv2, formally-verified route to the same goal: how do you isolate workloads, and the devices they talk to, on shared AI infrastructure strongly enough to prove it, not just assert it. DMA is the under-discussed attack surface in that picture, because the device can reach memory the OS believes is protected, and as inference consolidates onto dense multi-tenant machines, a minimal and proven trusted computing base is the only kind of isolation claim that holds when the driver itself is the threat.