Confidential carbon commuting

Abstract

We discuss the problem of building a user-acceptable infrastructure for a large organisation that wishes to measure its employees' travel-to-work carbon footprint, based on the gathering of high resolution geolocation data on employees in a privacy-sensitive manner. This motivated the construction of a distributed system of personal containers in which individuals record fine-grained location information into a private data-store which they own, and from which they can trade portions of data to the organisation in return for specific benefits. This framework can be extended to gather a wide variety of personal data and facilitates the transformation of private information into a public good, with minimal and assessable loss of individual privacy. This is currently a work in progress. We report on the hardware, software and social aspects of piloting this scheme on the University of Cambridge's experimental cloud service, as well as contrasting it to a traditional centralised model.

Towards VM Consolidation Using a Hierarchy of Idle States

“…Remote management of home sensors [10], and privacy-preserving community-wide sensing [14] are other examples. These VM-hosted applications service workloads where each VM is idle for large periods of time, and at any instant, only a small fraction (across a given number of VMs) are actively serving clients.…”

“…Example OS-level virtualization solutions include LXC [2], OpenVZ [3], and VServer [5]. We choose LXC as our example virtualization solution for several reasons: i) it is open source, allowing easy analysis of its implementation, ii) it is in production use and is part of the mainstream Linux kernel, iii) it offers a low latency inactive VM state called "frozen", iv) it is being used in other projects which can benefit from increased VM density, such as Docker [1] (to provide "frozen in state apps"), and Confidential Commuting [14] (to provide per-user private VEEs). As noted, in addition to the booted (S 0 ) and shutdown state (S 2 ), LXC implements a frozen state (S 1 ) which forms a middle ground between booted and shutdown states.…”

“…We chose this workload because a) they are low duty-cycle in nature [32], i.e. private VMs have uncorrelated idle times, thus allowing greater multiplexing across inactive states, b) they are a topic of active research with numerous applications such as privacy-preserving online social networks [11,29,30], private sensor data collection and processing [14,16,31], and privacy-preserving offloading from mobile devices [17].…”

“…We believe that such categorization (as opposed to a mixed workload) allows us to better understand the behavior of different policies. Fixed inter-arrival time, Fixed duration: A common use of personal VMs is for periodic and fixed amount of data uploads from in-home sensors [31], or a user's smartphone [14,25]. This leads to a request sequence where requests have fixed inter-arrival times and durations.…”

“…However many VM workloads exhibit frequent, often long, and uncorrelated idle periods. Examples of such workloads include certain webhosting workloads [21], cyber-foraging workloads [28], and personal servers [14,25,31]. When multiple VMs with such workloads are co-hosted on a machine, decreasing the resource footprint of idle VMs allows for a much denser VM packing, thus reducing hosting costs for both tenants and cloud-providers.…”