Guest OS Research Articles

Freezing time emulating new and faster devices with virtual machines

Recent proposals of emerging data storage devices make it necessary to reevaluate all levels of the storage hierarchy to optimize the software stack performance. However, these new devices are not always widely available and therefore early experiments may be impossible. Emulators aim at mimicking as close as possible the behavior of a component, nonetheless, emulating new and fast storage devices is a challenging task due to time perception. In this work, we propose an approach to emulate storage devices using virtual machines (VMs) allowing the evaluation of a new device within a real system. We use a technique called freezing time, which pauses a VM to manipulate its clock and hide the real I/O completion time. Our approach is implemented at the hypervisor level and it is transparent to the guest operating system or application. We evaluate the technique under a real system using regular magnetic disks to emulate faster storage devices. Our method presented a latency error of 6.5% compared to a real device. Moreover, decoupled experiment between two laboratories, at the Barcelona Super Computing Center (BSC) in Spain, and the Center of Computer Science and Free Software (C3SL) in Brazil, demonstrated that our approach is reproducible and promising to allow the virtual evaluation of next-gen storage devices.

Cacol: A zero overhead and non-intrusive double caching mitigation system

In a virtualized server, a page cache (which caches I/O data) is managed in both the hypervisor and the guest Operating System (OS). This leads to a well-known issue called double caching. Double caching is the presence of the same data in both the hypervisor page cache and guest OS page caches. Some experiments we performed show that almost 64% of the hypervisor page cache content is also present in guest page caches.Therefore, double caching is a huge source of memory waste in virtualized servers, particularly when I/O disk-intensive workloads are executed (which is common in today’s data centers). Knowing that memory is the limiting resource for workload consolidation, double caching is a critical issue.This paper presents a novel solution (called Cacol) to avoid double caching. Unlike existing solutions, Cacol is not intrusive as it does not require guest OS modification and induces very little performance overhead for user applications. We implemented Cacol in KVM hypervisor, a very popular virtualization system. We evaluated Cacol and compared it with Linux default solutions. The results confirm the advantages (no guest modification and no overhead) of Cacol against existing solutions.

Protecting composite IoT server by secure secret key exchange for XEN intra virtual machines

Challenges presented by ever increasing volumes of smart objects are huge in terms of security and privacy of data generated out of these objects. These challenges range from the usage scenario with other objects and dedicated servers which act as a middleman among various networks such as internet and wireless sensor network. In this paper, attempt has been made to highlight a simple use case of a composite server in a XEN-based virtualised system. Security threats like sniffing and spoofing are isolated and analysed with respect to a novel key transfer method between host and guest operating system in XEN-based virtualised system. In addition, secure and trust model to cater the said security threats like sniffing and spoofing is also presented. The performance of the proposed system in terms of CPU usage and network bandwidth is also shown.

Overload control for virtual network functions under CPU contention

In this paper, we analyze the problem of overloads caused by physical CPU contention in cloud infrastructures, from the perspective of time-critical applications (such as Virtual Network Functions) running at guest level. We show that guest-level overload control solutions to counteract traffic spikes (e.g., traffic throttling) are counterproductive against overloads caused by CPU contention. We then propose a general guest-level solution to protect applications from overloads also in the case of CPU contention. We reproduced the phenomena on a IP Multimedia Subsystem (IMS) testbed based on OpenStack on top of KVM. The results show that the approach can dynamically adapt the service throughput to the actual system capacity in both cases of traffic spikes and CPU contention, by guaranteeing at the same time the IMS latency requirements. • Resource contention is a common cause of overload in virtualized infrastructures. • CPU contention causes side effects on the QoS of time-critical applications. • Guest OS CPU metrics are often misinterpreted when dealing with CPU contention. • NFV Load throttling solutions can misbehave in the case of physical CPU contention. • Avoiding idle CPU time preemption helps to protect systems from contention effects.

A Container-Based Technique to Improve Virtual Machine Migration in Cloud Computing

Hypervisor-enabled virtualization is a promising technology to deploy applications and implement Virtual Machine (VM) migration on cloud data centers. However, one critical aspect in hypervisor-based solution is that to deploy applications each VM is installed with a dedicated guest OS along with the requirement of binaries and library files and substantially large VM's image size. Therefore, it is a significant concern for data center administrators because it causes performance overheads. To solve these issues, a new paradigm of virtualization technology that has attracted considerable attention is containerization. Although, progress has been made to address container-based virtualization, there has been less attention to explore the issue of performance evaluation of container and VM in a migration environment. The main contribution of this research study is to develop an experimental setup to implement and evaluate the performance of LXD/CR container-based migration technique and compared it with the pre-copy VM migration scheme. To conduct this performance evaluation, first we modified Linux kernel and implemented LXD which uses liblxc to launch container, then migration of the running container is facilitated using a checkpoint/restore mechanism of CRIU technique. To ensure the applicability and validity for real-time cloud infrastructure, we executed a wide variety of benchmarks such as web server, CPU-intensive, disk I/O and database. From the results obtained, it is found that compared to pre-copy VM migration scheme, LXD/CR container migration technique reduces the downtime, migration time, amount of data transferred and the number of pages transferred by 75.66%, 65.55%, 76.63%, and 76.78%, respectively. In addition, the migration overhead caused is reduced by 55.89% w.r.t. CPU utilization and 76.52% w.r.t. RAM utilization. This being an important contribution for migrating the running applications efficiently and consequently increase the business value of the cloud infrastructure providers.

A Dynamic Memory Allocation Approach Based on Balloon Technology on Virtualization Platform

In virtualization platforms, Virtual Machines(VMs) have different memory demand when running different applications. Applications with high memory demand often result in guest swapping and performance degradation of the VM. Because of the semantic gap between the Virtual Machine Monitor(VMM) and the guest Operating System(OS), it is impossible to achieve reasonable allocation and use of memory resources between the guests. Our goal is to monitor the memory information in real time and achieve memory recovery and replenish of each VM in case of memory fluctuation. This method builds up a reasonable swapping mechanism, which can achieve automatic balance of memory allocation among multiple VMs, optimize guest swapping and improve memory utilization. We display it by visualization module. Based on ballooning technology, this paper designs a dynamic memory allocation method in KVM virtualization platform, which consists of memory monitoring, memory dynamic allocation, memory resource visualization and other modules. The results of many tests and analysis demonstrate that our method has the ability to basically achieve our expected goals and requirements.

Автоматизация обнаружения и анализа ошибок в гиперконвергентных системах

The paper is devoted to the problem of early error detection and analysis in hyperconverged systems. One approach to organizing hyperconverged systems is to install on each physical server a separate instance of an operating system (OS) that carries virtualization tools and tools for administering and using a distributed data warehouse. Errors can occur both at the level of a single OS instance and at the level of the entire cluster. For example, incorrect control element commands from one infrastructure node can cause software failure on another node. In addition, errors from the subsystems of the cluster can provoke abnormal situations inside virtual machines. The complexity of the architecture of hyperconverged systems makes it difficult to analyze the errors that occur in them. To simplify such an analysis and increase its effectiveness, it is necessary to automate the process of detecting problems and collecting data necessary for their study and correction. Existing approaches for automation of error detection are described and various improvements are suggested to adopt them for systems where distributed storage and virtualization technologies are actively used. Improvements include log collection from the whole cluster just after the error occurred, additional analysis of guest operating system behaviour inside virtual machines, usage of a knowledge base for automated crash recovery and duplicate detection. Finally, a real-life scenario of error handling process in Virtuozzo company products is described starting from error detection and ending with fix deployment.

Architectural Protection of Application Privacy against Software and Physical Attacks in Untrusted Cloud Environment

In cloud computing, it is often assumed that cloud vendors are trusted; the guest Operating System (OS) and the Virtual Machine Monitor (VMM, also called Hypervisor) are secure. However, these assumptions are not always true in practice and existing approaches cannot protect the data privacy of applications when none of these parties are trusted. We investigate how to cope with a strong threat model which is that the cloud vendors, the guest OS, or the VMM, or both of them are malicious or untrusted, and can launch attacks against privacy of trusted user applications. This model is relevant because applications may be small enough to be formally verified, while the guest OS and VMM are too complex to be formally verified. Specifically, we present the design and analysis of an architectural solution which integrates a set of components on-chip to protect the memory of trusted applications from potential software and hardware based attacks from untrusted cloud providers, compromised guest OS, or malicious VMM. Full-system performance evaluation results show that the design only incurs 9 percent overhead on average, which is a small performance price that is paid for the substantial security gain.

Performance Evaluation of Xen, KVM, and Proxmox Hypervisors

Hardware virtualization plays a major role in IT infrastructure optimization in private data centers and public cloud platforms. Though there are many advancements in CPU architecture and hypervisors recently, but overhead still exists as there is a virtualization layer between the guest operating system and physical hardware. This is particularly when multiple virtual guests are competing for resources on the same physical hardware. Understanding performance of a virtualization layer is crucial as this would have a major impact on entire IT infrastructure. This article has performed an extensive study on comparing the performance of three hypervisors KVM, Xen, and Proxmox VE. The experiments showed that KVM delivers the best performance on most of the selected parameters. Xen excels in file system performance and application performance. Though Proxmox has delivered the best performance in only the sub-category of CPU throughput. This article suggests best-suited hypervisors for targeted applications.

VBD-MF: A Block Device to Monitor the File System of Virtual Machine

The virtual block device is the data carrier of virtual machine (VM) and user information, while the file system is the ultimate goal of many attackers. We proposed a security device named virtual block device mapping to file (VBD-MF) that can translate block-level operations into file-level ones by building a mapping from blocks to files. VBD-MF could provide an out-of-VM way to monitor the file system with no modification on the code of virtual machine monitor (VMM) and guest OS, and it also provided other security tools and methods with direct interface to operate the file system. We implemented a prototype on Linux and KVM. The evaluation shows that VBD-MF has a better capability of monitoring with some loss on performance of read and write. Compared to the traditional monitoring of host-based file system, VBD-MF has a better hidden and safety property.

A novel disk I/O scheduling framework of virtualized storage system

Modern data centers usually use virtual machine technology to host various big data applications in a single physical machine, not only enhancing the server utilization, but also providing them with the hardware-level isolation. However, in a typical virtualized environment an extra software layer called virtual machine monitor (VMM) is often interposed between the hardware resource and guest operating system (virtual machine, VM), shielding the specific user-process semantic inside a running VM. As a result, it obstructs the disk I/O scheduler of VMM to acquire the accurate information of a user-process (often a big data application), and thus proposes a challenge on the I/O request scheduling as well as the disk resource management at the granularity of VM user-process. Eventually, the disk I/O performance of a virtualized system is sub-optimal. This paper introduces an improved disk I/O scheduling framework for the virtualized system. It aims at bridging the semantic gap between physical disk I/O scheduler and VM user-process, providing a fair sharing of disk I/O resource among concurrent VMs. At the same time, it improves the overall disk I/O performance through a novel method for creating the image file of VM. Besides, an extra scheduling algorithm is proposed to further refine the storage performance. Finally, we implement these improvements on Xen hypervisor and conduct extensive experiments to verify our framework. The experimental result shows that our work improve the performance of read-intensive, write-intensive and mixed workloads up to 9, 10.7 and 20% respectively.

Efficient operating system level virtualization techniques for cloud resources

Cloud computing is an advancing technology which provides the servcies of Infrastructure, Platform and Software. Virtualization and Computer utility are the keys of Cloud computing. The numbers of cloud users are increasing day by day. So it is the need of the hour to make resources available on demand to satisfy user requirements. The technique in which resources namely storage, processing power, memory and network or I/O are abstracted is known as Virtualization. For executing the operating systems various virtualization techniques are available. They are: Full System Virtualization and Para Virtualization. In Full Virtualization, the whole architecture of hardware is duplicated virtually. No modifications are required in Guest OS as the OS deals with the VM hypervisor directly. In Para Virtualization, modifications of OS is required to run in parallel with other OS. For the Guest OS to access the hardware, the host OS must provide a Virtual Machine Interface. OS virtualization has many advantages such as migrating applications transparently, consolidation of server, online maintenance of OS and providing security. This paper briefs both the virtualization techniques and discusses the issues in OS level virtualization.

μRTZVisor: A Secure and Safe Real-Time Hypervisor

Virtualization has been deployed as a key enabling technology for coping with the ever growing complexity and heterogeneity of modern computing systems. However, on its own, classical virtualization is a poor match for modern endpoint embedded system requirements such as safety, security and real-time, which are our main target. Microkernel-based approaches to virtualization have been shown to bridge the gap between traditional and embedded virtualization. This notwithstanding, existent microkernel-based solutions follow a highly para-virtualized approach, which inherently requires a significant software engineering effort to adapt guest operating systems (OSes) to run as userland components. In this paper, we present μ RTZVisor as a new TrustZone-assisted hypervisor that distinguishes itself from state-of-the-art TrustZone solutions by implementing a microkernel-like architecture while following an object-oriented approach. Contrarily to existing microkernel-based solutions, μ RTZVisor is able to run nearly unmodified guest OSes, while, contrarily to existing TrustZone-assisted solutions, it provides a high degree of functionality and configurability, placing strong emphasis on the real-time support. Our hypervisor was deployed and evaluated on a Xilinx Zynq-based platform. Experiments demonstrate that the hypervisor presents a small trusted computing base size (approximately 60KB), and a performance overhead of less than 2% for a 10 ms guest-switching rate.

Leveraging virtual machine introspection with memory forensics to detect and characterize unknown malware using machine learning techniques at hypervisor

The Virtual Machine Introspection (VMI) has emerged as a fine-grained, out-of-VM security solution that detects malware by introspecting and reconstructing the volatile memory state of the live guest Operating System (OS). Specifically, it functions by the Virtual Machine Monitor (VMM), or hypervisor. The reconstructed semantic details obtained by the VMI are available in a combination of benign and malicious states at the hypervisor. In order to distinguish between these two states, the existing out-of-VM security solutions require extensive manual analysis. In this paper, we propose an advanced VMM-based, guest-assisted Automated Internal-and-External (A-IntExt) introspection system by leveraging VMI, Memory Forensics Analysis (MFA), and machine learning techniques at the hypervisor. Further, we use the VMI-based technique to introspect digital artifacts of the live guest OS to obtain a semantic view of the processes details. We implemented an Intelligent Cross View Analyzer (ICVA) and implanted it into our proposed A-IntExt system, which examines the data supplied by the VMI to detect hidden, dead, and dubious processes, while also predicting early symptoms of malware execution on the introspected guest OS in a timely manner. Machine learning techniques are used to analyze the executables that are mined and extracted using MFA-based techniques and ascertain the malicious executables. The practicality of the A-IntExt system is evaluated by executing large real-world malware and benign executables onto the live guest OSs. The evaluation results achieved 99.55% accuracy and 0.004 False Positive Rate (FPR) on the 10-fold cross-validation to detect unknown malware on the generated dataset. Additionally, the proposed system was validated against other benchmarked malware datasets and the A-IntExt system outperforms the detection of real-world malware at the VMM with performance exceeding 6.3%.

TinyVisor: An extensible secure framework on android platforms

As the utilization of mobile platform keeps growing, the security issue of mobile platform becomes a serious threat to user privacy. The current security measures mainly focus on the application level and the framework level, with little protection on the kernel. Virtualization technologies have been used in x86 platforms to protect the security of the kernel. With a higher privilege than the guest operating system, the hypervisor can effectively detect and defend against the malicious activity inside the guest kernel. In this paper, we build a hypervisor framework called TinyVisor leveraging the ARM virtualization extensions to protect the guest system security. The framework is transparent to the guest operating system and applications without any code modification. On top of the framework, we propose a secure module called H-Binder to protect the integrity and secrecy of the Binder transaction data in Android system. We implement the prototype of TinyVisor with the H-Binder module and evaluate the performance. The experiment results show non-significant performance loss.

A Hypervisor Approach to Enable Live Migration with Passthrough SR-IOV Network Devices

Single-Root I/O Virtualization (SR-IOV) is a specification that allows a single PCI Express (PCIe) device (physical function or PF) to be used as multiple PCIe devices (virtual functions or VF). In a virtualization system, each VF can be directly assigned to a virtual machine (VM) in passthrough mode to significantly improve the network performance. However, VF passthrough mode is not compatible with live migration, which is an essential capability that enables many advanced virtualization features such as high availability and resource provisioning. To solve this problem, we design SRVM which provides hypervisor support to ensure the VF device can be correctly used by the migrated VM and the applications. SRVM is implemented in the hypervisor without modification in guest operating systems or guest VM drivers. SRVM does not increase VM downtime. It only costs limited resources (an extra CPU core only during the live migration pre-copy phase), and there is no significant runtime overhead in VM network performance.

An Energy-Efficient Virtualization-Based Secure Platform for Protecting Sensitive User Data

Currently, the exchange cycles of various computers, smartphones, tablets, and others have become shorter, because new high-performance devices continue to roll out rapidly. However, existing legacy devices are not old-fashioned or obsolete to use. From the perspective of sustainable information technology (IT), energy-efficient virtualization can apply a way to increase reusability for special customized devices and enhance the security of existing legacy devices. It means that the virtualization can customize a specially designed purpose using the guest domain from obsolete devices. Thus, this could be a computing scheme that keeps energy supplies and demands in balance for future sustainable IT. Moreover, energy-efficient virtualization can be the long-term and self-sustainable solution such as cloud computing, big data and so forth. By separating the domain of the host device based on virtualization, the guest OS on the segmented domain can be used as a Trusted Execution Environment to perform security features. In this paper, we introduce a secure platform to protect sensitive user data by domain isolation utilizing virtualization. The sensitive user data on our secure platform can protect against the infringement of personal information by malicious attacks. This study is an effective solution in terms of sustainability by recycling them for special purposes or enhancing the security of existing devices.

ForenVisor: A Tool for Acquiring and Preserving Reliable Data in Cloud Live Forensics

Live forensics is an important technique in cloud security but is facing the challenge of reliability. Most of the live forensic tools in cloud computing run either in the target Operating System (OS), or as an extra hypervisor. The tools in the target OS are not reliable, since they might be deceived by the compromised OS. Furthermore, traditional general purpose hypervisors are vulnerable due to their huge code size. However, some modules of a general purpose hypervisor, such as device drivers, are indeed unnecessary for forensics. In this paper, we propose a special purpose hypervisor, called ForenVisor, which is dedicated to reliable live forensics. The reliability is improved in three ways: reducing Trusted Computing Base (TCB) size by leveraging a lightweight architecture, collecting evidence directly from the hardware, and protecting the evidence and other sensitive files with Filesafe module. We have implemented a proof-of-concept prototype on the Windows platform, which can acquire the process data, raw memory, and I/O data, such as keystrokes and network traffic. Furthermore, we evaluate ForenVisor in terms of code size, functionality, and performance. The experiment results show that ForenVisor has a relatively small TCB size of about 13 KLOC, and only causes less than 10 percent performance reduction to the target system. In particular, our experiments verify that ForenVisor can guarantee that the protected files remain untampered, even when the guest OS is compromised by viruses, such as `ILOVEYOU' and Worm.WhBoy. Also, our system can be loaded as a hypervisor without needing to pause the target OS. This allows it to not only avoid destructing but also to gather the live evidence of the target OS. We also posted the source code of ForenVisor on Github.

Towards a TrustZone-Assisted Hypervisor for Real-Time Embedded Systems

Virtualization technology starts becoming more and more widespread in the embedded space. The penalties incurred by standard software-based virtualization is pushing research towards hardware-assisted solutions. Among the existing commercial off-the-shelf technologies for secure virtualization, ARM TrustZone is attracting particular attention. However, it is often seen with some scepticism due to the dual-OS limitation of existing state-of-the-art solutions. This letter presents the implementation of a TrustZone-based hypervisor for real-time embedded systems, which allows multiple RTOS partitions on the same hardware platform. The results demonstrate that virtualization overhead is less than 2 percent for a 10 milliseconds guest-switching rate, and the system remains deterministic. This work goes beyond related work by implementing a TrustZone-assisted solution that allows the execution of an arbitrary number of guest OSes while providing the foundation to drive next generation of secure virtualization solutions for resource-constrained embedded devices.

Cloud Computing: Types, Topologies, Virtual Machine and VM Migration for decrease in power consumption

As the usage of internet is increasing day by day, more and more people are now getting connected with the web. In the last few years, internet has become a powerful platform that has changed the way to do a business and the way of communication. The number of users which were using the services of internet in last ten years is becoming double in the number, in every two years. As the number of users is increasing the more storage and new technologies and new platform to develop software are on a huge demand. Then cloud computing came into the picture, which is providing huge storage capacity, on demand self-service, pay according to usage, flexible pricing, resource pooling, software for users and services on their demand which can be accessed anywhere (SaaS), platform to develop new software (PaaS), any hardware which is required for development (IaaS). Now even XaaS i.e. everything as a service (here X is considered as everything, its value can be any) is also coming into the picture. To run one or more than one services or applications together but in their separated space or partition, we need virtual machine. It is refer to the one instance of an operating system (Guest OS). Then Virtualization makes it possible to run many operating systems and applications on the same physical computer at the same time. It makes the physical system energy efficient, as many machines or applications are able to run all together, in a way it consumes less energy. To make the physical system more energy efficient, migration of virtual machine is done, so that we can reduce the energy consumption. VM Migration is used for migration of virtual machine from one PM (physical machine) to another physical machine or host. In this paper, we will discuss about the introduction of cloud computing-its types and topologies; and the main focus would be on energy efficiency using VM migration.