Towards Observable and Trustworthy System Foundations for Intelligent Cloud Infrastructures
Abstract:
Modern intelligent cloud infrastructures operate at unprecedented scale and complexity, hosting diverse workloads from user-facing services to autonomous AI pipelines. Ensuring their security and accountability relies fundamentally on observability—the ability to capture and reason about runtime system behaviors, and isolation—the ability to protect data from unreliable system components.
However, current systems provide neither capability robustly. Existing observability frameworks capture coarse-grained events, without exposing the fine-grained causal or semantic context behind them. They fail to explain why failures occur, how attacks propagate, or the ramifications. Furthermore, once the privileged system software—operating system (OS) or hypervisor—is compromised, observability itself becomes untrustworthy: adversaries can alter or tamper with the captured events, rendering forensics unreliable. Meanwhile, emerging hardware-assisted Trusted Execution Environments (TEEs), e.g., Confidential Virtual Machines (CVMs), offer strong isolation from hosts but provide no accountability or confinement for the large and vulnerable software stacks within these protected environments.
This dissertation advances the foundations of trustworthy cloud systems by unifying fine-grained, tamper-resistant observability with accountable and confined isolated execution. It explores how system behaviors can remain visible, attestable, and confidential even under privileged or untrusted components. The research proceeds through four complementary systems. PalanTír incorporates instructionlevel processor traces with system-call provenance to reconstruct fine-grained causal dependencies for attack investigation. Appare extends observability into kernel space by identifying anomalous in-kernel control flows that reveal OS-level exploits.
HitchHiker protects observability itself using a hardware-assisted, micro-TCB TEE design that maintains log integrity under OS or hypervisor compromise. Finally, Erebor generalizes these principles to confidential cloud computing by isolating untrusted workloads inside sandboxed CVMs, enabling private data processing and efficient data sharing. Together, these systems demonstrate that visibility and isolation must be co-designed: trust must extend from observing system behaviors, to securing the act of observation itself, and ultimately to confining workloads within accountable isolated environments.