Confidential Virtual Machines Untuk Keamanan Data Sensitif Desain Arsitektur, Overhead Kinerja, Dan Strategi Penempatan Beban Kerja

Abstract

Virtualization is a key foundation of modern cloud computing, yet the multi-tenant model in conventional virtualized environments still leaves weaknesses in protecting data in use, namely data being processed in memory. This study develops and evaluates a secure virtualization model based on Confidential Virtual Machines (CVMs) by focusing on three aspects: CVM architecture design, performance overhead under heterogeneous workloads, and a security-aware workload placement strategy based on data sensitivity. A quantitative experimental approach compares conventional virtual machines and CVMs on CPU-intensive, memory-intensive, I/O-intensive, and sensitive-data workloads. Three placement strategies are also evaluated: random placement, performance-based placement, and security-aware placement. The results show that CVMs strengthen data-in-use protection by reducing host visibility into guest memory and supporting attestation. From a performance perspective, CVM overhead remains relatively low for compute-dominant workloads, but becomes more visible for memory- and I/O-sensitive workloads, particularly network-intensive execution. The placement evaluation shows that security-aware placement provides the best balance between security and performance by prioritizing sensitive workloads on CVM-enabled environments without excessive loss of system efficiency. Thus, selective CVM adoption based on data sensitivity is a practical approach for supporting secure virtualization in modern cloud infrastructures.