Restricting guest instances in a shared environment

A computer program product comprising:

• a computer readable storage medium readable by one or more processors and storing instructions for execution by the one or more processors for performing a method comprising:
• obtaining, by a trusted component of a host computing system, wherein the host comprises one or more processors, from a client, via a hypervisor of the host, a request to run an instance of a guest image within the hypervisor, wherein the request comprises a unique identifier of the guest image, contents of the guest image, and a communication key, and wherein the request is encrypted with a request key accessible to the owner and the trusted component and not accessible to the hypervisor;
• generating, by the trusted component, an authorization request to an authorizing entity of the client requesting authorization for the hypervisor to run the instance, wherein the authorization request comprises the unique identifier, a use counter, and a unique challenge;
• encrypting, by the trusted component, the authorization request with the communication key;
• and
• communicating, by the trusted component, the authorization request to the authorizing entity, via the hypervisor.

A system comprising:

• a memory;
• one or more processors in communication with the memory;
• and
• program instructions executable by the one or more processors via the memory to perform a method, the method comprising:
• obtaining, by a trusted component of a host computing system, wherein the host comprises one or more processors, from a client, via a hypervisor of the host, a request to run an instance of a guest image within the hypervisor, wherein the request comprises a unique identifier of the guest image, contents of the guest image, and a communication key, and wherein the request is encrypted with a request key accessible to the owner and the trusted component and not accessible to the hypervisor;
• generating, by the trusted component, an authorization request to an authorizing entity of the client requesting authorization for the hypervisor to run the instance, wherein the authorization request comprises the unique identifier, a use counter, and a unique challenge;
• encrypting, by the trusted component, the authorization request with the communication key;
• and
• communicating, by the trusted component, the authorization request to the authorizing entity, via the hypervisor.