VMInformant: an instrumented virtual machine to support trustworthy cloud computing

Cloud computing is attractive for both consumers and providers to benefit from potential economies of scale in reducing cost of use (for consumers) and operation of infrastructure (for providers). In the IaaS service deployment model of the cloud, consumers can launch their own virtual machines (VMs) on infrastructure made available by a cloud provider, enabling a number of different applications to be hosted within the VM. The cloud provider generally has full control and access to the VM, providing the potential for a provider to access both VM configuration parameters and the hosted data. Trust between the consumer and the provider is key in this context, and generally assumed to exist. However, relying on this assumption can be limiting. We argue that the VM owner must have greater access to operations that are being carried out on their VM by the provider and greater visibility on how this VM and its data are stored and processed in the cloud. We present VMInformant", a VM monitoring system that can keep the user informed and alerted about various events that have taken place on their VM (both inside the VM and via calls made through a hypervisor). A taxonomy of VM security-related events is presented, along with performance overheads associated with monitoring such events using CPU and I/O intensive benchmarks. We argue that having this level of transparency is essential to improve trust between a cloud consumer and provider, especially in the context of a public cloud system