Self-service Cloud Computing by Jack Luo Shakeel Butt (Rugtgers University) H.Andres Lagar-Cavilla (GridCentric Inc.) Abhinav Srivastava (AT&T Labs-Research) Vinod Ganapathy (Rutgers University)

Traditional Cloud Uses virtual machine monitors (VMMs). Implemented in a trusted computing base. Hypervisor – controls physical hardware. Admin domain (Dom0) – control and monitor client VMs. Large and complex admin domain with privileges to access client VMs. Dom0 maybe used by attackers to gain access to client’s CPU registers and memory.

Downsides of Traditional Cloud Attacks against admin domain will compromise client security and privacy. Rely on cloud provider to deploy useful services. Deployment and configuration of services are not determined by client. Thus not customized.

New self-service cloud (SSC) Splits admin privileges between system-wide domain (Sdom0) and per-client domains (Udom0s). System-wide domain cannot inspect the code, data or computation of client VMs. Each client can perform privileged tasks on its own VMs. Service domains – privileged services that is provided by client themselves. Mutually trusted service domains checks compliancy while respecting client privacy. Flexibility, security and privacy.

Good SSC Privilege Model (Section 3.4). Removes unnecessary privileges from the traditional administrative domain. Applied to the principle of least privilege. The administrative domain does not necessarily need to have the privilege of scanning client’s private data.

Bad The SSC model is against the purpose of the cloud system. Have to install service domains before we can use the services. We want cloud service not traditional programs that we have to do an installation before we can use it.

Question What is the relationship between the SSC Privilege Model (the good) and the inconvenience (the bad) of the SSC Model? In other words, what is the root cause of the inconvenience.