Guest OS Research Articles

Virtual Machine Monitor Indigenous Memory Reclamation Technique

Sandboxing is a mechanism to monitor and control the execution of malicious or untrusted program. Memory overhead incurred by sandbox solutions is one of bottleneck for sandboxing most of applications in a system. Memory reclamation techniques proposed for traditional full virtualization do not suit sandbox environment due to lack of full scale guest operating system in sandbox. In this paper, we propose memory reclamation technique for sandboxed applications. The proposed technique indigenously works in virtual machine monitor layer without installing any driver in VMX non root mode and without new communication channel with host kernel. Proposed Page reclamation algorithm is a simple modified form of Least recently used page reclamation and Working set page reclamation algorithms. For efficiently collecting working set of application, we use a hardware virtualization extension, page Modification logging introduced by Intel. We implemented proposed technique with one of open source sandboxes to show effectiveness of proposed memory reclamation method. Experimental results show that proposed technique successfully reclaim up to 11% memory from sandboxed applications with negligible CPU overheads.

New virtualised AP for independent wireless network composition

Virtual access point (VAP) is one of the most useful wireless virtualisation technologies because of its concurrent operation to compose multiple wireless networks via generating service set identifier. A single physical wireless NIC could access multiple networks in a single channel and thus establish a variety of wireless access point without additional wireless network interface. However, as the number of VAP increases, available bandwidth is reduced due to the fact that the number of management frame is increased dramatically in a single channel. Since the management frames should be sent as a basic data rate, channel utilisation and overall network performance would be degraded. To address this problem, system virtualisation is employed to augment wireless NIC hardware. Augmented wireless NICs are exposed to the guest OS and thus can access different wireless channel physically. The results obtained mitigate the bandwidth utilisation of management frame composed to the legacy VAP scheme, increasing round-trip time latency slightly.

Sego

Sego is a hypervisor-based system that gives strong privacy and integrity guarantees to trusted applications, even when the guest operating system is compromised or hostile. Sego verifies operating system services, like the file system, instead of replacing them. By associating trusted metadata with user data across all system devices, Sego verifies system services more efficiently than previous systems, especially services that depend on data contents. We extensively evaluate Sego's performance on real workloads and implement a kernel fault injector to validate Sego's file system-agnostic crash consistency and recovery protocol.

SRVM

Single-Root I/O Virtualization (SR-IOV) is a specification that allows a single PCI Express (PCIe) device (ysical function or PF) to be used as multiple PCIe devices (virtual functions or VF). In a virtualization system, each VF can be directly assigned to a virtual machine (VM) in passthrough mode to significantly improve the network performance. However, VF passthrough mode is not compatible with live migration, which is an essential capability that enables many advanced virtualization features such as high availability and resource provisioning. To solve this problem, we design SRVM which provides hypervisor support to ensure the VF device can be correctly used by the migrated VM and the applications. SRVM is implemented in the hypervisor without modification in guest operating systems or guest VM drivers. Our experimental results show that SRVM can effectively migrate all memory state, and there is no data loss or corruption in applications after live migration. SRVM does not increase VM downtime. It only costs limited resources (an extra CPU core), and there is no significant runtime overhead in VM network performance. In fact, since the VF can continue to be used during the pre-copy ase, it offers network throughput which is 9.6 times and network latency which is 98% lower compared to other solutions that switch to para-virtualization mode during live migration.

Sego

Sego is a hypervisor-based system that gives strong privacy and integrity guarantees to trusted applications, even when the guest operating system is compromised or hostile. Sego verifies operating system services, like the file system, instead of replacing them. By associating trusted metadata with user data across all system devices, Sego verifies system services more efficiently than previous systems, especially services that depend on data contents. We extensively evaluate Sego's performance on real workloads and implement a kernel fault injector to validate Sego's file system-agnostic crash consistency and recovery protocol.

Urgent Virtual Machine Eviction with Enlightened Post-Copy

Virtual machine (VM) migration demands distinct properties under resource oversubscription and workload surges. We present enlightened post-copy, a new mechanism for VMs under contention that evicts the target VM with fast execution transfer and short total duration. This design contrasts with common live migration, which uses the down time of the migrated VM as its primary metric; it instead focuses on recovering the aggregate performance of the VMs being affected. In enlightened post-copy, the guest OS identifies memory state that is expected to encompass the VM's working set. The hypervisor accordingly transfers its state, mitigating the performance impact on the migrated VM resulting from post-copy transfer. We show that our implementation, with modest instrumentation in guest Linux, resolves VM contention up to several times faster than live migration.

Evaluation and design of function for tracing diffusion of classified information for file operations with KVM

Cases of classified information leakage have become increasingly common. To address this problem, we have proposed a function for tracing the diffusion of classified information within an operating system. However, this function suffers from the following two problems: first, in order to introduce the function, the operating system's source code must be modified. Second, there is a risk that the function will be disabled when the operating system is attacked. Thus, we have designed a function for tracing the diffusion of classified information in a guest operating system by using a virtual machine monitor. By using a virtual machine monitor, we can introduce the proposed function in various environments without modifying the operating system's source code. In addition, attacks aimed at the proposed function are made more difficult, because the virtual machine monitor is isolated from the operating system. In this paper, we describe the implementation of the proposed function for file operations and child process creation in the guest operating system with a kernel-based virtual machine. Further, we demonstrate the traceability of diffusing classified information by file operations and child process creation. We also report the logical lines of code required to introduce the proposed function and performance overheads.

Design of Function for Tracing Diffusion of Classified Information for IPC on KVM

The leaking of information has increased in recent years. To address this problem, we previously proposed a function for tracing the diffusion of classified information in a guest OS using a virtual machine monitor (VMM). This function makes it possible to grasp the location of classified information and detect information leakage without modifying the source codes of the guest OS. The diffusion of classified information is caused by the file operation, child process creation, and inter-process communication (IPC). In a previous study, we implemented the proposed function for a file operation and child process creation excluding IPC using a kernel-based virtual machine (KVM). In this paper, we describe the design of the proposed function for IPC on a KVM without modifying the guest OS. The proposed function traces the local and remote IPCs inside the guest OS from the outside so as to trace the information diffusion. Because IPC with an outside computer might cause an information leakage, tracing the IPCs enables the detection of such a leakage. We also report the evaluation results including the traceability and performance of the proposed function.

A Novel Framework for Hypervisor Design

The paper discusses the constructive framework for writing hypervisor on the top of the VM. Hypervisor plays a vital role in monitoring VM in cloud. Hypervisors are system programs that virtualizes the running of the architecture. These are critical, safe, small and hard program to write and debug or evaluate. Hypervisors are system software programs that virtualize the architecture they run on. They are typically small, safety-critical, and hard to debug, which makes them a feasible and interesting target for formal verification. Previous functional verifications of system software were all based on interactive theorem proving, requiring substantial human effort complemented by expert proven knowledge. In this paper we present the frame work of a hypervisor and basic implementation module of hypervisor and simulator module of hypervisor.The virtual environment is controlled and managed by software known as the hypervisor. The hypervisor executes at a higher privilege level than the “guest” operating systems; the hypervisor can access any memory assigned to any guest operating system. Furthermore, a guest operating system cannot access resources in the system unless permitted to do so by the hypervisor.

Formal Analysis of Security Models for Mobile Devices, Virtualization Platforms, and Domain Name Systems

In this work we investigate the security of security-critical applications, i.e. applications in which a failure may produce consequences that are unacceptable. We consider three areas: mobile devices, virtualization platforms, and domain name systems.The Java Micro Edition platform defines the Mobile Information Device Profile (MIDP) to facilitate the development of applications for mobile devices, like cell phones and PDAs. We first study and compare formally several variants of the security model specified by MIDP to access sensitive resources of a mobile device.Hypervisors allow multiple guest operating systems to run on shared hardware, and offer a compelling means of improving the security and the flexibility of software systems. In this work we present a formalization of an idealized model of a hypervisor. We establish (formally) that the hypervisor ensures strong isolation properties between the different operating systems, and guarantees that requests from guest operating systems are eventually attended. We show also that virtualized platforms are transparent, i.e. a guest operating system cannot distinguish whether it executes alone or together with other guest operating systems on the platform.The Domain Name System Security Extensions (DNSSEC) is a suite of specifications that provides origin authentication and integrity assurance services for DNS data. We finally introduce a minimalistic specification of a DNSSEC model which provides the grounds needed to formally state and verify security properties concerning the chain of trust of the DNSSEC tree.We develop all our formalizations in the Calculus of Inductive Constructions —formal language that combines a higher-order logic and a richly-typed functional programming language— using the Coq proof assistant.

Model of hidden IT security threats in the cloud computing environment

A model of threats has been proposed that makes it possible to identify potential vulnerabilities of the cloud computing environment, including the actions related to system task scheduler malfunction in a timely manner and, thus, efficiently block information action channels beyond the control of guest operating systems or application software.

Evaluation of isolation in virtual machine environments encounter in effective attacks against memory

AbstractOne of the main features of the hypervisor is the isolation among virtual machine (VM) environments. By isolation between VMs, malicious activity in one VM could not affect all other VMs, so it is necessary to apply security mechanisms in order to improve isolation between VMs. Before applying security policies to a virtualization system, it is necessary to quantitatively measure the hypervisor from isolation point of view aiming at increasing security of isolation among VMs; then considering the circumstances of the VM execution environments and the results of measurements, we can find areas in the virtualization system with the most effective on enhancing isolation. This paper, proposed a semi‐Markov model for evaluation of isolation, by studying the Xen virtualization architecture. We considered certain type of vulnerability that successfully exploiting it can lead to the attacker's malicious codes execution in part of memory address space. We included all three layers in virtualization for the evaluation purpose, because we wanted to consider strength and weakness areas in virtualization system and not just specific layer such as hypervisor, so it can be figured out that improving security in which layer of virtualization is most effective in improving security of isolation, in respect to the increasing or decreasing attacker's (defender's) ability to be successful. The sensitivity analysis results show that MTTSF is more sensitive to the increasing ability of defensive mechanisms to be successful at the application layer and decreasing the attacker's ability to successfully exploit vulnerabilities at the guest operating system layer, model parameters. Copyright © 2015 John Wiley & Sons, Ltd.

Scalable Attestation: A Step toward Secure and Trusted Clouds

Scalable attestation combines secure boot and trusted boot technologies, and extends them up into the host, its programs, and into the guest's operating system and workloads, to both detect and prevent integrity attacks. Anchored in hardware, this integrity appraisal and attestation protects persistent data (files) from remote attack, even if the attack is root privileged. As an added benefit of a hardware rooted attestation, the authors gain a simple hardware-based geolocation attestation to help enforce regulatory requirements. This design is implemented in multiple cloud testbeds based on the QEMU/KVM hypervisor, OpenStack, and OpenAttestation, and is shown to provide significant additional integrity protection at negligible cost.

Silo

Many cloud applications can benefit from guaranteed latency for their network messages, however providing such predictability is hard, especially in multi-tenant datacenters. We identify three key requirements for such predictability: guaranteed network bandwidth, guaranteed packet delay and guaranteed burst allowance. We present Silo, a system that offers these guarantees in multi-tenant datacenters. Silo leverages the tight coupling between bandwidth and delay: controlling tenant bandwidth leads to deterministic bounds on network queuing delay. Silo builds upon network calculus to place tenant VMs with competing requirements such that they can coexist. A novel hypervisor-based policing mechanism achieves packet pacing at sub-microsecond granularity, ensuring tenants do not exceed their allowances. We have implemented a Silo prototype comprising a VM placement manager and a Windows filter driver. Silo does not require any changes to applications, guest OSes or network switches. We show that Silo can ensure predictable message latency for cloud applications while imposing low overhead.

MN-MATE

Recent advent of manycore system increases needs for larger but faster memory hierarchy. Emerging next generation memories such as on-chip DRAM and nonvolatile memory (NVRAM) are promising candidates for replacement of DRAM-only main memory. Combined with the manycore trends, it gives an opportunity to rethink conventional resource management system with a memory hierarchy for a single cloud node. In an attempt to mitigate the energy and memory problems, we propose MN-MATE, an elastic resource management architecture for a single cloud node with manycores, on-chip DRAM, and large size of off-chip DRAM and NVRAM. In MN-MATE, the hypervisor places consolidated VMs and balances memory among them. Based on the monitored information about the allocated memory, a guest OS co-schedules tasks accessing different types of memory with complementary access intensity. Polymorphic management of DRAM hierarchy accelerates average memory access speed inside each guest OS. A guest OS reduces energy consumption with small performance loss based on the NVRAM-aware data placement policy and the hybrid page cache. A new lightweight kernel is developed to reduce the overhead from the guest OS for scientific applications. Experiment results show that our techniques in MN-MATE platform improve system performance and reduce energy consumption.

Reference Pattern-Aware Instant Memory Balancing for Consolidated Virtual Machineson Manycores

Memory contention among consolidated VMs on the same hardware has created the need for repetitive memory balancing operations. In an attempt to provide a prompt memory balancing mechanism, we found problems with the retardation of memory reallocation by the reclamation delay. The scheduling of the VMs and their VCPUs generates the delay, the dirtiness of the candidate pages for balancing makes the delay fluctuated, and a conflict of two reclamation policies between the guest OS and the hypervisor deteriorates the application performance. As a remedy to these problems, we propose HyperDealer2 (HD2), which selects the victim pages based on the reference patterns of clean pages, reclaims them with hypervisor-level paging, and reallocates those pages with explicit ballooning of the recipient guest OS. HD2 eliminates the involvement of victim VMs in memory reclamation and extends the dwell time of reclaimed pages in the reclaimed state. Consequently, HD2 significantly reduces the time taken to reallocate memory with a low overhead and enhances the value of additional memory for the recipient VMs. The experimental results of HD2 show that the execution time of memory-intensive applications in the recipient VM is reduced by up to 50 percent in spite of less than 2 percent performance penalty.

English

English

Improving Agility and Elasticity in Bare-metal Clouds

Bare-metal clouds are an emerging infrastructure-as-a-service (IaaS) that leases physical machines (bare-metal instances) rather than virtual machines, allowing resource-intensive applications to have exclusive access to physical hardware. Unfortunately, bare-metal instances require time-consuming or OS-specific tasks for deployment due to the lack of virtualization layers, thereby sacrificing several beneficial features of traditional IaaS clouds such as agility, elasticity, and OS transparency. We present BMcast, an OS deployment system with a special-purpose de-virtualizable virtual machine monitor (VMM) that supports quick and OS-transparent startup of bare-metal instances. BMcast performs streaming OS deployment while allowing direct access to physical hardware from the guest OS, and then disappears after completing the deployment. Quick startup of instances improves agility and elasticity significantly, and OS transparency greatly simplifies management tasks for cloud customers. Experimental results have confirmed that BMcast initiated a bare-metal instance 8.6 times faster than image copying, and database performance on BMcast during streaming OS deployment was comparable to that on a state-of-the-art VMM without performing deployment. BMcast incurred zero overhead after de-virtualization.

Improving Agility and Elasticity in Bare-metal Clouds

Bare-metal clouds are an emerging infrastructure-as-a-service (IaaS) that leases physical machines (bare-metal instances) rather than virtual machines, allowing resource-intensive applications to have exclusive access to physical hardware. Unfortunately, bare-metal instances require time-consuming or OS-specific tasks for deployment due to the lack of virtualization layers, thereby sacrificing several beneficial features of traditional IaaS clouds such as agility, elasticity, and OS transparency. We present BMcast, an OS deployment system with a special-purpose de-virtualizable virtual machine monitor (VMM) that supports quick and OS-transparent startup of bare-metal instances. BMcast performs streaming OS deployment while allowing direct access to physical hardware from the guest OS, and then disappears after completing the deployment. Quick startup of instances improves agility and elasticity significantly, and OS transparency greatly simplifies management tasks for cloud customers. Experimental results have confirmed that BMcast initiated a bare-metal instance 8.6 times faster than image copying, and database performance on BMcast during streaming OS deployment was comparable to that on a state-of-the-art VMM without performing deployment. BMcast incurred zero overhead after de-virtualization.

Hypervisors’ Guest Isolation Capacity Evaluation in the Private Cloud Using SIAGR Framework

Hypervisor vendors do claim that they have negated virtualization overhead compared to a native system. They also state that complete guest isolation is achieved while running multiple guest operating systems (OSs) on their hypervisors. But in a virtualization environment which is a combination of hardware, hypervisor and virtual machines (VMs) with guest operating systems, there bound to be an impact on each guest operating system while other guest operating systems are fully utilizing their allotted system resources. It is interesting to study hypervisor’s guest isolation capacity while several guest operating systems running on it. This paper selected three hypervisors, namely ESXi 4.1, XenServer 6.0 and KVM (Ubuntu 12.04 Server) for the experimentation. The three hypervisors are prudently preferred as they represent three different categories (full virtualized, para-virtualized, and hybrid virtualized). Focus being on hypervisors’ guest isolation capacity evaluation, therefore, private cloud is chosen over public cloud as it has fewer security concerns. Private Cloud is created using apache’s CloudStack. Windows 7 OS is deployed as a guest VM on each hypervisor and their guest isolation capacity is evaluated for CPU and Network performances.