On-demand Isolated I/O for Security-sensitive Applications on Commodity Platforms