The authors of this paper propose MyCloud, an architecture for improving the confidentiality of the data in virtual machines (VMs) in cloud systems. The main idea is to remove the privileges of the control VM (which normally gives the cloud provider full access to the users’ VMs) and let VM owners define an access matrix to control access to their data. This approach narrows the trusted computing base (TCB) of the cloud system, thus improving the overall security by making the virtual machine monitor (VMM) simpler and easier to verify for security.

The paper describes the proposed architecture, compares it to standard clouds, and then presents an evaluation of its performance overhead and security. I found the content well organized, with good coverage of the important points of the proposed approach. It successfully shows how a complex system can be restructured to make it more secure. The motivation is compelling and there is a good survey of related work.

The only weak point of the paper lies in the English usage. The authors talk of “privacy” when they mean “confidentiality.” Privacy is an individual’s right, so one cannot talk about the privacy of a VM or its data. There are also numerous grammatical errors. I think the authors might have mentioned that the access matrix in their VMs can also protect against integrity attacks. In spite of this, the paper is worth reading for those involved in the security design of cloud systems and general complex systems.