Supporting Security Sensitive Tenants in a Bare-Metal Cloud
Talkat USENIX ATC '19 · on Thursday, 2019-07-11· at 15:00· USENIX ATC Track II: Grand Ballroom VII–IX·
summary
Claims a bare-metal cloud architecture called SecCloud that lets tenants pick security vs cost vs performance by running isolation, provisioning and attestation services (provider-run Hill isolation, PMI network-boot provisioning, and keylime/TPM attestation). Prototype boots with LinuxBoot in flash and measures provisioning times: ~300s for fast network-boot vs ~700s for Foreman local install, ~170s with LinuxBoot comparable to VMs. Benchmarks show up to 210% overhead for MPI-style network I/O, ~30% for Spark, and a minimized provider TCB (Hill ≈2k LOC).
AI-written summary · about
chapters (4)
- 0:00Start
- 0:36Problems with Existing Cloud Offerings
- 5:15Bolted Implementation
- 10:26What about the firmware?
related talks
41mMetal As A Service — Manage Your Bare Metal in MaaS Like a Virtual Machine
24mPCI Compliance using Cloud Foundry and BOSH Add-ons
28mSecuring Cloud-Native Workloads from the Metal Up
22mEnabling Cloud Foundry to Run on Bare Metal
43mFreedom, security and the cloud
14mMultitenancy for Fast and Programmable Networks in the Cloud
18mPoby: SmartNIC-accelerated Image Provisioning for Coldstart in Clouds
38mBoot to Cloud Security Considerations with IoT