In cloud computing, it is often assumed that cloud vendors are trusted; the guest Operating System (OS) and the Virtual Machine Monitor (VMM, also called Hypervisor) are secure. However, these assumptions are not always true in practice and existing approaches cannot protect the data privacy of applications when none of these parties are trusted. We investigate how to cope with a strong threat model which is that the cloud vendors, the guest OS, or the VMM, or both of them are malicious or untrusted, and can launch attacks against privacy of trusted user applications. This model is relevant because applications may be small enough to be formally verified, while the guest OS and VMM are too complex to be formally verified. Specifically, we present the design and analysis of an architectural solution which integrates a set of components on-chip to protect the memory of trusted applications from potential software and hardware based attacks from untrusted cloud providers, compromised guest OS, or malicious VMM. Full-system performance evaluation results show that the design only incurs 9 percent overhead on average, which is a small performance price that is paid for the substantial security gain.

Increasingly, cyber attacks (e.g., kernel rootkits) target the inner rings of a computer system, and they have seriously undermined the integrity of the entire computer systems. To eliminate these threats, it is imperative to develop innovative solutions running below the attack surface. This paper presents MGuard, a new most inner ring solution for inspecting the system integrity that is directly integrated with the DRAM DIMM devices. More specifically, we design a programmable guard that is integrated with the advanced memory buffer of FB-DIMM to continuously monitor all the memory traffic and detect the system integrity violations. Unlike the existing approaches that are either snapshot-based or lack compatibility and flexibility, MGuard continuously monitors the integrity of all the outer rings including both OS kernel and hypervisor of interest, with a greater extendibility enabled by a programmable interface. It offers a hardware drop-in solution transparent to the host CPU and memory controller. Moreover, MGuard is isolated from the host software and hardware, leading to strong security for remote attackers. Our simulation-based experimental results show that MGuard introduces no speed overhead, and is able to detect nearly all the OS-kernel and hypervisor control data related rootkits we tested.

As cloud diversifies into different application fields, understanding and characterizing the specific work load sand application requirements play important roles in the design of efficient cloud infrastructure and system software support. Video analytic is a rapidly advancing field and it is widely used in many application domains (i.e., health, medical care, surveillance, and defense). To support video analytic applications efficiently in cloud, one has to overcome many challenges such as lack of understanding of the relationship and trade off between analytic performance metrics and resource requirements. Furthermore, cloud computing has grown from the early model of resource sharing to data sharing and workflow sharing. To address the challenges and to lever age emerging trends, we propose and experiment with a domain specific cloud environment for video analytic applications. We design a cloud infrastructure framework for sharing video data, analytic software, and workflow. In addition, we create a video analytic quality aware resource plan model to guarantee users QoS and optimize usage of resources based on predictive knowledge of video analytic softwares performance metrics and a resource planning model that optimizes the overall analytic service quality under users constraints (i.e., time and cost).The predictive knowledge is represented as input and analytic software specific predictors. The experimental results show that the video analytic quality aware resource planning model can balance the tradeoff between analytic quality and resource requirements, and achieve optimal or near-optimal planning for video analytic workloads with constraints in a resource shared environment. Simulation studies show that resource planning results using ground truth and video analytic performance predictions are very similar, which indicates that our analytic quality/resource predictors are very accurate.

In this paper, we present a novel approach of using the integrated GPU to accelerate conventional operations that are normally performed by the CPUs, the bulk memory operations, such as memcpy or memset. Offloading the bulk memory operations to the GPU has many advantages, i) the throughput driven GPU outperforms the CPU on the bulk memory operations; ii) for on-die GPU with unified cache between the GPU and the CPU, the GPU private caches can be leveraged by the CPU for storing moved data and reducing the CPU cache bottleneck; iii) with additional lightweight hardware, asynchronous offload can be supported as well; and iv) different from the prior arts using dedicated hardware copy engines (e.g., DMA), our approach leverages the exiting GPU hardware resources as much as possible. The performance results based on our solution showed that offloaded bulk memory operations outperform CPU up to 4.3 times in micro benchmarks while still using less resources. Using eight real world applications and a cycle based full system simulation environment, the results showed 30% speedup for five, more than 20% speedup for two of the eight applications.