Ditto: Elastic Confidential VMs with Secure and Dynamic CPU Scaling
Shixuan Zhao, Mengyuan Li, Mengjia Yan, Zhiqiang Lin
TL;DR
The paper tackles the rigidity of current Confidential Virtual Machines (CVMs), where fixed CPU capacities and opaque runtime state hinder agile cloud resource management. It introduces Elastic CVM and a novel Worker vCPU, coupled with a Worker vCPU Abstraction Layer, enabling hypervisor-assisted dynamic CPU scaling while preserving CVM security. The Ditto prototype showcases a confidential serverless platform built on OpenWhisk, Kubernetes, and Confidential Containers, achieving faster response, improved CPU efficiency, and finer-grained scaling compared to fixed-CVM setups. This approach suggests a practical path toward cost-effective, flexible confidential computing in public clouds, with broad implications for serverless and microservices workloads in secure environments.
Abstract
Confidential Virtual Machines (CVMs) are a type of VMbased Trusted Execution Environments (TEEs) designed to enhance the security of cloud-based VMs, safeguarding them even from malicious hypervisors. Although CVMs have been widely adopted by major cloud service providers, current CVM designs face significant challenges in runtime resource management due to their fixed capacities and lack of transparency. These limitations hamper efficient cloud resource management, leading to increased operational costs and reduced agility in responding to fluctuating workloads. This paper introduces a dynamic CPU resource management approach, featuring the novel concept of "Elastic CVM. This approach allows for hypervisor-assisted runtime adjustment of CPU resources using a specialized vCPU type, termed Worker vCPU. This new approach enhances CPU resource adaptability and operational efficiency without compromising security. Additionally, we introduce a Worker vCPU Abstraction Layer to simplify Worker vCPU deployment and management. To demonstrate the effectiveness of our approach, we have designed and implemented a serverless computing prototype platform, called Ditto. We show that Ditto significantly improves performance and efficiency through finergrain resource management. The concept of "Elastic CVM" and the Worker vCPU design not only optimize cloud resource utilization but also pave the way for more flexible and cost-effective confidential computing environments.