Figure 1, based on three very
different threat models. In the first class, both the hypervisor and
the guest OS are trusted. In the second class, only the hypervisor
is trusted, while in the third class, only the OS is trusted. In the
first class, we use the remote attestation protocol defined for the
Trusted Platform Module (TPM) [1].