Guest OS Research Articles

Cyber threats to the Private Academic Cloud

The potential breach of access to confidential content hosted in a university's Private Academic Cloud (PAC) underscores the need for developing new protection methods. This paper introduces a Threat Analyzer Software (TAS) and a predictive algorithm rooted in both an operational model and discrete threat recognition procedures (DTRPs). These tools aid in identifying the functional layers that attackers could exploit to embed malware in guest operating systems (OS) and the PAC hypervisor. The solutions proposed herein play a crucial role in ensuring countermeasures against malware introduction into the PAC. Various hypervisor components are viewed as potential threat sources to the PAC's information security (IS). Such threats may manifest through the distribution of malware or the initiation of processes that compromise the PAC's security. The demonstrated counter-threat method, which is founded on the operational model and discrete threat recognition procedures, facilitates the use of mechanisms within the HIPV to quickly identify cyber attacks on the PAC, especially those employing "rootkit" technologies. This prompt identification empowers defenders to take swift and appropriate actions to safeguard the PAC.

Revolutionizing Cloud Security: Innovative Approaches for Safeguarding Data Integrity

Cloud computing uses third-party servers or private clouds to provide online services and on-demand enterprise resource access. Microsoft Azure, Amazon, IBM, and Google Apps allow customers to design and run cloud-based apps from anywhere. These cloud services store and retrieve data from faraway servers, highlighting the importance of security due to internet data transfer. Before using cloud computing, firms must handle security issues. Pay-per-use, self-service, and scalability make the model popular in banking, healthcare, retail, education, manufacturing, and business. Pay-per-use models let users use servers, networks, storage, services, and applications without buying them. Limited data control can result in account service issues, traffic hijacking, insecure APIs, malicious insiders, technology sharing issues, and multi-tenancy data failures. Continuous research and development improve security and user confidence. This paper provides a framework for understanding cloud computing, identifies security dangers and research issues, and emphasizes its relevance in major industries. It also recommends cloud security innovations and assesses worldwide data protection policies to improve data security and reduce risks. Cloud-stored data is vulnerable to programs with security weaknesses, notwithstanding its benefits. If the guest OS’s security is unreliable, virtualization on a hypervisor may expose data to attacks. Additionally, data security vulnerabilities in transit and at rest will be addressed.

Improving live migration efficiency in QEMU: An eBPF-based paravirtualized approach

Virtual Machines are the key technology in cloud computing. In order to upgrade, repair or service the physical machine where a Virtual Machine is hosted, a common practice is to live-migrate the Virtual Machine to a different server. This involves copying all the guest memory over the network, which may take a non-negligible amount of time. In this work, we propose a technique to speed up the migration time by reducing the amount of guest memory to be transferred with the help of the guest OS. In particular, during live-migration, an eBPF program is injected in the guest kernel to obtain, and send to the Virtual Machine Monitor, the list of guest page frames that are currently unused. The VMM can then safely skip these pages during the copy. We have integrated this technique in the live-migration implementation of QEMU (Bellard, 2005), and we show the effects of our work in some experiments comparing the results against the QEMU default implementation.

GuaNary: Efficient Buffer Overflow Detection In Virtualized Clouds Using Intel EPT-based Sub-Page Write Protection Support

Write buffer overflow is a widespread and prevalent memory safety violation in C/C++, reported as the top vulnerability in 2022 and 2023. Secure memory allocators are generally used to protect systems against attacks that may exploit buffer overflows. Existing allocators mainly rely on two types of countermeasures to prevent or detect write overflows: canaries and guard pages, each with pros and cons in terms of detection latency and memory footprint. For virtualized cloud applications, this paper follows the Out of Hypervisor (OoH) trend and introduces GuaNary, a safety guard against write overflows, allowing synchronous detection at a low memory footprint cost. OoH is a new virtualization research axis introduced in 2022 advocating the exposure of hardware features for virtualization to the guest OS so that its processes can take advantage of them. Based on the OoH principle, GuaNary leverages Intel Sub-Page write Permission (SPP), a recent hardware virtualization feature that allows to write-protect guest memory at the granularity of 128B (namely, sub-page) instead of 4KB. We implement a software stack, LeanGuard, which promotes the utilization of SPP from inside virtual machines by new secure allocators that use GuaNary. Our evaluation shows that for the same number of protected buffers, LeanGuard consumes 8.3× less memory than SlimGuard, a recent state-of-art secure allocator. Further, for the same memory consumption, LeanGuard allows protecting 25× more buffers than SlimGuard.

An Embedded Approach to Hypervisor-Oriented Interruption Virtualization Operation

This paper presents a method for virtualizing interruptions in an embedded hypervisor environment. The method involves the hypervisor taking control of hardware interruptions, providing them to a guest operating system (OS) for virtualization, and simulating interruption events through service threads running on the hypervisor. The guest OS executes a virtualization interruption service program using interruption injection operations provided by the hypervisor, bypassing the need to respond to hardware interruptions. This approach allows interruption service programs to be executed in a conventional stack environment, eliminating the need for copying and preserving the execution context. A comparative analysis with the virtualization scheme in Xen reveals that the proposed method reduces the overhead associated with field preservation, thereby enabling more efficient interruption response.

Using Docker virtual containers to launch services

Docker is a virtualization tool that allows developers and system administrators to run applications and services in containers isolated from each other and from the guest operating system. Docker containers, unlike other virtualization tools, work directly with the host machine hardware, which is good for system resource consumption. Containers run from prebuilt images. The ability to collect all dependencies and application data in an image allows you not to worry about compatibility with the systems in which the container will run. The independence of containers from each other allows you to run entire groups of related services, in which a change of version or data in one of the containers does not affect the functioning of the rest of the group.

KHV: KVM-Based Heterogeneous Virtualization

A KVM (Kernel-based Virtual Machine) is subject to the complexity of the Linux kernel and the difficulty and cost of safety certification; thus, it is not popularized in embedded high-reliability scenarios. This paper proposes a KVM-based Heterogeneous Virtualization (KHV), which is independent of hardware virtualization (KVM mandatory virtualization), follows the principle of static partitioning, localizes the hypervisor, and inherits the KVM software ecosystem. KHV balances the demands of static partitioning and flexible sharing in the embedded system. The paper implemented KHV on the RISC-V Xuantie C910 CPU-based SoC and conducted a performance comparison with KVM. The experiment shows that KHV is 50% smaller than KVM in terms of fluctuation, and KHV makes the guest OS have the same performance as the bare-metal OS in scheduler benchmarks, whereas KVM dropped an average of 28%.

Information Safety in Cloud Computing

This paper discusses the security of data in cloud computing. It is a study of data in the cloud and aspects related to it concerning security. The paper will go in to details of data protection methods and approaches used throughout the world to ensure maximum data protection by reducing risks and threats. Availability of data in the cloud is beneficial for many applications but it poses risks by exposing data to applications which might already have security loopholes in them. Similarly, use of virtualization for cloud computing might risk data when a guest OS is run over a hypervisor without knowing the reliability of the guest OS which might have a security loophole in it. The paper will also provide an insight on data security aspects for Data-in-Transit and Data-at-Rest. The study is based on all the levels of SaaS (Software as a Service), PaaS (Platform as a Service) and IaaS (Infrastructure as a Service).

Evaluation of Adaptive Partitioning and Real-Time Capability for Virtualization With Xen Hypervisor

In this article, the fundamental suitability of the open-source hypervisor Xen for safety-critical real-time application is analyzed. In the field of avionics, satisfying criteria such as safety criticality and real-time capability are mandatory and pose one of the greatest challenges when developing systems and functions that are to be qualified for the installation in passenger aircraft. System architectures that additionally aspire adaptive behavior in terms of self-configuration and reconfiguration complicate these challenges even more. Spatial and temporal partitioning is a fundamental requirement for the implementation of safety-critical systems but is of static behavior in current avionic standards such as A653. Implementing a fully functional partitioning that is able to reconfigure during runtime would be a great leap forward in the field of adaptive avionics. The open-source hypervisor Xen offers features to dynamically create and manage virtual machines that natively come with architecture-related segregation. In order to determine the feasibility of Xen in the field of safety-critical real-time application, its spatial and temporal partitioning capabilities and occurring latencies are analyzed in this article. The analysis is based on specifically designed benchmarks that measure the accuracy of periodic task execution with different system load levels featuring various Xen schedulers and guest operating system kernels. The overall results for the spatial partitioning and real-time capabilities turn out to be promising but remain with minor interferences, varying based on the setup benchmarking configuration. The temporal partitioning enforced by Xen remains with clearly identified and fixable issues before a deterministic function execution in hard real time is reached.

Employing Vertical Elasticity for Efficient Big Data Processing in Container-Based Cloud Environments

Recently, “Big Data” platform technologies have become crucial for distributed processing of diverse unstructured or semi-structured data as the amount of data generated increases rapidly. In order to effectively manage these Big Data, Cloud Computing has been playing an important role by providing scalable data storage and computing resources for competitive and economical Big Data processing. Accordingly, server virtualization technologies that are the cornerstone of Cloud Computing have attracted a lot of research interests. However, conventional hypervisor-based virtualization can cause performance degradation problems due to its heavily loaded guest operating systems and rigid resource allocations. On the other hand, container-based virtualization technology can provide the same level of service faster with a lightweight capacity by effectively eliminating the guest OS layers. In addition, container-based virtualization enables efficient cloud resource management by dynamically adjusting the allocated computing resources (e.g., CPU and memory) during the runtime through “Vertical Elasticity”. In this paper, we present our practice and experience of employing an adaptive resource utilization scheme for Big Data workloads in container-based cloud environments by leveraging the vertical elasticity of Docker, a representative container-based virtualization technique. We perform extensive experiments running several Big Data workloads on representative Big Data platforms: Apache Hadoop and Spark. During the workload executions, our adaptive resource utilization scheme periodically monitors the resource usage patterns of running containers and dynamically adjusts allocated computing resources that could result in substantial improvements in the overall system throughput.

Towards High-Efficient Transaction Commitment in a Virtualized and Sustainable RDBMS

The relational database service in cloud usually achieves energy efficiency by using virtualization technology, in which it consolidates multiple independent database systems into a single physical machine while enforcing the hardware-level isolation among them. However, the disk I/O performance is inevitably hurt due to the resource contention on the shared device. We propose VMSQL, a novel disk I/O model for the virtualized relational database management system (RDBMS). VMSQL has two innovations over the original disk model of virtualized database systems. First, VMSQL enforces the synchronous operation in guest operating system to handle with the transaction commitment. Due to its simplicity, a portion of CPU cycles is decoupled from I/O buffer management and then used to serve the upcoming requests, thereby improving their response times. Second, in host system, VMSQL asynchronizes the storage path of transactions which are committed from the different co-located guest databases. An obvious advantage of this procedure is that systems can apply host-level improvements into the disk I/O performance of virtualized RDBMS, relieving the random I/O and enhancing the throughput of whole system. We implement a prototype of this Sync-Async model in QEMU-KVM hypervisor, in which the InnoDB engine is deployed in the guest operating system. Extensive experiments are conducted to verify its advantages and the results are positive without any loss of ACID-compliance. In the meanwhile, VMSQL incurs moderate overhead at the hypervisor layer.

A modelling & Simulation via CloudSim for Live Migration in Virtual Machines

In growing era of cloud computing, one major utility is better and improved performance. For which Cloud Computing is a model which provides various resources available in a pool from where the users can get available the same when required. In the overall process there can be an important issue that is Fault tolerance to provide the high availability for the process which is being required by the user. And simultaneously if any fault occurs then user might not found any server downtime and other kind of delay in getting the response. There are many compute nodes such as Virtual machines further controlled by the Hypervisor. For transferring the load among compute nodes can be done by Cold Migration earlier there was a technique Non-Live migration. But at the same time there were lot many issues and challenges with the same that user might get the server downtime for infinite delay. For overcoming that there is an on-going technique which is known as Hot Migration or Live migration. It allows system administrators to shuffle the load available on an operating system instance to other Guest Operating system instance without any intervention on hosted service. This approach benefits to provide and efficient online system where no downfall in server maintenance. It also cures the load balancing, reconfiguration of data centers. The simulation of above aforesaid concept has been done via Cloudsim a tool for modelling and simulation in Cloud computing environment for live migration of virtual machines without intervention of cloud services. This paper simulated the work and gives the efficient results in comparison to the existing techniques.

Blue-Pill Oxpecker: A VMI Platform for Transactional Modification

Although multiple techniques have been proposed with the goal of minimizing the semantic gap in virtual machine introspection, most concentrate on passive observation of the internal state, while there are also a number of proposals with which active modification of the VM's internal state is made possible. However there are issues when modifications are applied, such as keeping a consistent kernel state and avoiding a crash. In this paper we propose Oxpecker, a VMI platform for transactional modification. The out-of-VM read access allows an introspector to detect malware in the guest OS (e.g., rootkit) and the transactional write access allows Oxpecker to reliably neutralize the detected threats. To begin a transaction, Oxpecker monitors VM state changes waiting for an idle moment which is free of possible race-conditions in the guest kernel memory. Thereafter, it invokes a VMI client's callback to proceed with reading/writing in its memory. Upon user request or possible exceptions, transaction is rolled back while the transaction ACID properties are maintained at all times. Oxpecker is implemented and evaluated under different real-world workloads. Additionally and as a practical example, a tool is developed, and open sourced, based on Oxpecker with which guest VM processes could be killed.

Virtual Machine Extrospection: A Reverse Information Retrieval in Clouds

In a virtualized environment, it is not difficult to retrieve guest OS information from its hypervisor. However, it is very challenging to retrieve information in the reverse direction, i.e., retrieve the hypervisor information from within a guest OS, which remains an open problem and has not yet been comprehensively studied before. In this paper, we take the initiative and study this reverse information retrieval problem. In particular, we investigate how to determine the host OS kernel version from within a guest OS. We observe that modern commodity hypervisors introduce new features and bug fixes in almost every new release. Thus, by carefully analyzing the seven-year evolution of Linux KVM development (including 3,485 patches), we can identify 19 features and 20 bugs in the hypervisor detectable from within a guest OS. Building on our detection of these features and bugs, we present a novel framework called Hyperprobe that for the first time enables users in a guest OS to automatically detect the underlying host OS kernel version in a few minutes. We implement a prototype of Hyperprobe and evaluate its effectiveness in six real world clouds, including Google Compute Engine (a.k.a. Google Cloud), HP Helion Public Cloud, ElasticHosts, Joyent Cloud, CloudSigma, and VULTR, as well as in a controlled testbed environment, all yielding promising results.

Live Migration in Bare-Metal Clouds

Live migration allows a running operating system (OS) to be moved to another physical machine with negligible downtime. Unfortunately, live migration is not supported in bare-metal clouds, which lease physical machines rather than virtual machines to offer maximum hardware performance. Since bare-metal clouds have no virtualization software, implementing live migration is difficult. Previous studies have proposed OS-level live migration; however, to prevent user intervention and broaden OS choices, live migration should be OS-independent. In addition, the overhead of live migration mechanisms should be as low as possible. This paper introduces BLMVisor, a live migration scheme for bare-metal clouds. To achieve OS-independent and lightweight live migration, BLMVisor utilizes a very thin hypervisor that exposes physical hardware devices to the guest OS directly rather than virtualizing the devices. The hypervisor captures, transfers, and reconstructs physical device states by monitoring access from the guest OS and controlling the physical devices with effective techniques. To minimize performance degradation, the hypervisor is mostly idle after completing the live migration. A performance evaluation confirmed that the OS performance with BLMVisor is comparable to that of a bare-metal machine.

Reconciling Time Slice Conflicts of Virtual Machines With Dual Time Slice for Clouds

The proliferation of system virtualization poses a new challenge for the coarse-grained time sharing techniques for consolidation, since operating systems are running on virtual CPUs. The current system stack was designed under the assumption that operating systems can seize CPU resources at any moment. However, for the guest operating system on a virtual machine (VM), such assumption cannot be guaranteed, since virtual CPUs of VMs share a limited number of physical cores. Due to the time-sharing of physical cores, the execution of a virtual CPU is not contiguous, with a gap between the virtual and real time spaces. Such a virtual time discontinuity problem leads to significant inefficiency for lock and interrupt handling, which rely on the immediate availability of CPUs whenever the operating system requires computation. To reduce scheduling latencies of virtual CPUs, shortening time slices can be a straightforward strategy, but it may lead to the increased overhead of context switching costs across virtual machines for some workloads. It is challenging to determine a single time slice to satisfy all the VMs. In this article, we propose to have dual time slice to resolve the time slice conflict problem occurred in different types of virtual machines.

Dynamic Consolidation of Virtual Machine: A Survey of Challenges for Resource Optimization in Cloud Computing

Background:: Virtualization is an efficient technology that accelerates available data center to support efficient workload for the application. It completely based on guest operating system which keeps track of infrastructure that keeps track of real time usage of hardware and utilization of software. Objective:: To address the issues with Virtualization this paper analyzed various virtualization terminology for treating best effective way to reduce IT expenses while boosting efficiency and deployment for all levels of businesses. Methods: This paper discusses about the scenarios where various challenges met by Dynamic VM consolidation. Dynamic conclusion of virtual machines has the ability to increase the consumption of physical setup and focus on reducing power utilization with VM movement for stipulated period. Gathering the needs of all VM working in the application, adjusting the Virtual machine and suitably fit the virtual resource on a physical machine. Profiling and scheduling the virtual CPU to another Physical resource. This can be increased by making live migration with regards to planned schedule of virtual machine allotment. Results:: The recent trends followed in comprehending dynamic VM consolidation is applicable either in heuristic-based techniques which has further approaches based on static as well as adaptive utilization threshold. SLA with unit of time with variant HOST adoption (SLATAH) which is dependent on CPU utilization threshold with 100% for active host. Conclusion:: The cloud provider decision upon choosing the virtual machine for their application also varies with their decision support system that considers data storage and other parameters. It is being compared for the continuous workload distribution as well as eventually compared with changing demands of computation and in various optimization VM placement strategies.

Secure Virtualization for Cloud Environment Using Guest OS and VMM-based Technology

Cloud computing, the utility base computing, is going to become the mainstream of IT future. Governments and enterprises are realizing that by immigrating into the cloud they can significantly enhance their current infrastructure or application services with minimum cost and maximum elasticity. But securing cloud user digital assets and addressing privacy concerns of cloud costumers has become serious challenge. Providing security in cloud always has to consider performance. Employing high secure methods with massive complexity will increase overall service cost, to address this problem in this paper a two- tier security architecture is proposed. This architecture use multiple work mode for security components in guest level to decrease security process over-head and a security supervisory in hypervisor layer to make sure avoiding from false security alarms

Towards a Resilient Server with an external VMI in the Virtualization Environment

Currently, cloud computing technology is implemented by many industries in the world. This technology is very promising due to many companies only need to provide relatively smaller capital for their IT infrastructure. Virtualization is the core of cloud computing technology. Virtualization allows one physical machine to runs multiple operating systems. As a result, they do not need a lot of physical infrastructures (servers). However, the existence of virtualization could not guarantee that system failures in the guest operating system can be avoided. In this paper, we discuss the monitoring of hangs in the guest operating system in a virtualized environment without installing a monitoring agent in the guest operating system. There are a number of forensic applications that are useful for analyzing memory, CPU, and I/O, and one of it is called as LibVMI. Drakvuf, black-box binary analysis system, utilizes LibVMI to secure the guest OS. We use the LibVMI library through Drakvuf plugins to monitor processes running on the guest operating system. Therefore, we create a new plugin to Drakvuf to detect Hangs on the guest operating system running on the Xen Hypervisor. The experiment reveals that our application is able to monitor the guest operating system in real-time. However, Extended Page Table (EPT) violations occur during the monitoring process. Consequently, we need to activate the altp2m feature on Xen Hypervisor to by minimizing EPT violations.

Real-time virtualization with Xvisor

Embedded virtualization has gained attention in recent years due to increasing usage of embedded systems in cyber-physical systems and the Industry 4.0 revolution. Especially in combination with multi-core embedded systems, virtualization reduces the number of embedded systems and simultaneously delivers a secure and separated environment in each virtualized system. Applications in such cyber-physical systems often require real-time guarantees with hard deadlines. To guarantee those real-time constraints in virtualization, both hypervisor and guest operating system must support real-time scheduling. Selecting the optimal scheduling algorithm on both scheduling levels is hard and is only optimal for the analysed application. Due to the multiple scheduling levels, a set of scheduling algorithm combinations must be analysed which is too costly without analysis on higher abstraction levels. By using an analysis methodology to find this optimal combination using higher abstraction levels analysis, we reduce the set at every abstraction level. In this paper, we present a real-time hypervisor, based on Xvisor, for multi-core embedded systems. We modified the hypervisor to support real-time scheduling and the compositional schedulability analysis and validated the analysis methodology using this embedded hypervisor.