Isolated mini-domain for trusted cloud computing

Abstract

Cloud computing has recently received many interest due to its numerous advantages. Cloud users such as IT companies can reduce cost by requesting computing resource on demand. Cloud service provider such as Amazon Elastic Compute Cloud (EC2) runs virtual machines called instances for their user and tries to maximize physical resource utilization to increase profits. However, cloud computing has the security issues because user data and computation on it are processed and managed on the physical machine of cloud provider. User of cloud service must trust the cloud provider including not only cloud administrator but also the entire software stack of physical machine where guest virtual machine is executed. It is basically possible that administrators access user data because they have the highest privilege in the system for management of the system. In this paper, we examine the implementation issues incurred by I/O model of current xen virtual machine monitor for trusted cloud computing. We propose isolated mini-domain to protect user virtual machine under malicious cloud administrator. We evaluate the performance degradation incurred by our architecture and analyze how our architecture protects confidentiality and integrity of guest virtual machine.