Optimized Cloud Deployment of Multi-tenant Software Considering Data Protection Concerns -- Abridged Version

Abstract

This work was presented as full paper at the 17th IEEE/ACM International Symposium on Cluster, Cloud and Grid Computing (CCGrid), 2017. Concerns about protecting personal data and intellectual property are major obstacles to the adoption of cloud services. To ensure that a cloud tenant’s data cannot be accessed by malicious code of another tenant, critical software components of different tenants are traditionally deployed on separate physical machines. However, such physical separation limits hardware utilization, leading to cost overheads due to inefficient resource usage. Secure enclaves offer mechanisms to protect code and data from potentially malicious code deployed on the same machine, thereby offering an alternative to physical separation. We show how secure enclaves can be employed to address data protection concerns of cloud tenants during resource optimization in software deployment. We provide a model, formalization and experimental evaluation of an efficient algorithmic approach to compute an optimized deployment of software components and virtual machines, taking into account data protection concerns and the availability of secure enclaves. Our experimental results show that even if only 20% of the physical machines offer secure enclaves, savings of energy consumption (a major cost driver) may be as high as 47.5%.