Practical construction and audit for trusted cloud execution environment

Trustworthiness is a critical factor for the large-scale use of cloud services. However, traditional Trusted Computing technologies only work with the assumption that all the kernel modules and user-space processes installed in the tenant's virtual machine should be pre-fixed and the integrity digests should be pre-confirmed. This paper proposes a practical mechanism for trusted cloud environment construction and audit, which combines virtual Trusted Platform Module (vTPM) and trust evidence audit. vTPM guarantees the trusted boot up, while the audit method check the trust status of the run-time virtual machine based on auditing the trusted evidence collected from the memory of the user virtual machine. A prototype is also implemented according to the above mechanism. Experimental results show that the mechanism is effective and the performance overhead incurred is minor.