Hypervisor Research Articles

Evaluation of A Secure Live Migration of Virtual Machines Using IPsec Implementation

Live migration enables administrators to perform online maintenance on host and virtual machines without interrupted service during fault occurrences. While migrating VMs between physical servers of different data centers over the network is considered, security is essential for securing the migration data which has not been considered in most cases up until now. This paper considers performing live migration under an IPsec implemented transmission channel to achieve a secured transmission of migration data between servers. IPsec is proven to be secure and can be implemented for live migration but due to the excessive amount of overhead produced by IPsec, proposed sophisticated tuning of MTU and MSS values resulted in a better migration performance.

Process Hiding by Virtual Machine Monitor for Attack Avoidance

Process Hiding by Virtual Machine Monitor for Attack Avoidance

Register-Based Process Virtual Machine Acceleration Using Hardware Extension with Hybrid Execution

The Process Virtual Machine (VM) is typical software that runs applications inside operating systems. Its purpose is to provide a platform-independent programming environment that abstracts away details of the underlying hardware, operating system and allows bytecodes (portable code) to be executed in the same way on any other platforms. The Process VMs are implemented using an interpreter to interpret bytecode instead of direct execution of host machine codes. Thus, the bytecode execution is slower than those of the compiled programming language execution. Several techniques including our previous paper, the “Fetch/Decode Hardware Extension”, have been proposed to speed up the interpretation of Process VMs. In this paper, we propose an additional methodology, the “Hardware Extension with Hybrid Execution” to further enhance the performance of Process VMs interpretation and focus on Register-based model. This new technique provides an additional decoder which can classify bytecodes into either simple or complex instructions. With “Hybrid Execution”, the simple instruction will be directly executed on hardware of native processor. The complex instruction will be emulated by the “extra optimized bytecode software handler” of native processor. In order to eliminate the overheads of retrieving and storing operand on memory, we utilize the physical registers instead of (low address) virtual registers. Moreover, the combination of 3 techniques: Delay scheduling, Mode predictor HW and Branch/goto controller can eliminate all of the switching mode overheads between native mode and bytecode mode. The experimental results show the improvements of execution speed on the Arithmetic instructions, loop & conditional instructions and method invocation & return instructions can be achieved up to 16.9x, 16.1x and 3.1x respectively. The approximate size of the proposed hardware extension is 0.04mm2 (or equivalent to 14.81k gates) and consumes an additional power of only 0.24mW. The stated results are obtained from logic synthesis using the TSMC 90nm technology @ 200MHz.

Research and Application of Monitoring and Control Technology for District Heating System

This paper systematically presents a thorough analysis on the construction of the heating monitoring system in Nanjing General Hospital, China. The monitoring method and strategy of were discussed in detail. Besides, the optimization design of the simple closed loop control system was conducted. Finally, an optimal operation analysis system consisting of the heating host machine, costumer thermal monitoring system, and outside environment monitoring system for the heating room was established. As a result, the heating quality, the heating efficiency, and the relationship with costumer were greatly improved.

On the Evolution of Virtualization and Cloud Computing: A Review

Cloud computing, the technology that makes it possible for computing resources to be provisioned to clients / subscribers over long distances, as well as its component technology – virtualization, which makes it possible for multiple guest systems to co-reside on a single host machine and share the computing resources of the host, have both become very popular technologies that have witnessed giant improvements in the 21<SUP>st</SUP> century. This is a review paper that presents an overview of the technologies of virtualization and cloud computing, tracing their history and evolution down a timeline to what they have today, and providing pointers to prospects of future advancements to virtualization and cloud computing.

Detecting Cache-Based Side Channel Attacks in the Cloud: An Approach with Cascade Detection Mode

Information leakage introduced by side channel attacks (SCA) has become a serious threat to the cloud. Using SCA, malicious users can steal private information from other virtual machines by analyzing third party distinct resource-contention responses. To the best of our knowledge, the investigation in detecting SCA in the cloud is very limited. In this paper, we introduce a novel approach for detecting cache-based side channel attacks, named SideDetector, based on the observation that the creation of a side channel has certain effects on the resource utilization in both the host machines and virtual machines. First, exploring this observation, we analyze the attack features from both the hosts and guests and propose four detection metrics. Second, we investigate the use of cascade detection mode, which consists of the stage of host detection and guest detection. Third, shape tests and regularity tests are used to calculate the detection metrics, and pattern recognition techniques are used to indicate the attacks. Finally, we conduct a series of experiments to evaluate the SideDetector. The experimental results show that SideDetector is capable of detecting the cache-based side channel attacks in the cloud effectively.

Secure Live VM Migration in Cloud Computing: A Survey

Cloud computing (CC) refers to delivering applications, platform used to execute user application and Infrastructure to fulfill user hardware requirement as a service over internet. Virtual Machine (VM) is normally stored on Datacenters who consist of set of physical servers where VM is executing to fulfill service when gets accessed by end user. VM controlled by hypervisor also termed as VM Monitor (VMM). VMM manages VM execution, decides which VM to be selected for migration and how VM to be migrated. VM migration can be done by considering centralize VM migration or distributed approach. Once Migration decision done a caution need to be needed whether a VM to be transferred is free from attack, and the destination where VM is about to migrate is safe to execute on destination server. Considered a VM page is open to attack, it can be compromised by end world, also a destination server.

A scalable and automatic mechanism for resource allocation in self-organizing cloud

Taking advantage of the huge potential of consumers’ untapped computing power, self-organizing cloud is a novel computing paradigm where the consumers are able to contribute/sell their computing resources. Meanwhile, host machines held by the consumers are connected by a peer-to-peer (P2P) overlay network on the Internet. In this new architecture, due to large and varying multitudes of resources and prices, it is inefficient and tedious for consumers to select the proper resource manually. Thus, there is a high demand for a scalable and automatic mechanism to accomplish resource allocation. In view of this challenge, this paper proposes two novel economic strategies based on mechanism design. Concretely, we apply the Modified Vickrey Auction (MVA) mechanism to the case where the resource is sufficient; and the Continuous Double Auction (CDA) mechanism is employed when the resource is insufficient. We also prove that aforementioned mechanisms have dominant strategy incentive compatibility. Finally, extensive experiment results are conducted to verify the performance of the proposed strategies in terms of procurement cost and execution efficiency.

Symbiotic Dynamic Memory Balancing for Virtual Machines in Smart TV Systems

Smart TV is expected to bring cloud services based on virtualization technologies to the home environment with hardware and software support. Although most physical resources can be shared among virtual machines (VMs) using a time sharing approach, allocating the proper amount of memory to VMs is still challenging. In this paper, we propose a novel mechanism to dynamically balance the memory allocation among VMs in virtualized Smart TV systems. In contrast to previous studies, where a virtual machine monitor (VMM) is solely responsible for estimating the working set size, our mechanism is symbiotic. Each VM periodically reports its memory usage pattern to the VMM. The VMM then predicts the future memory demand of each VM and rebalances the memory allocation among the VMs when necessary. Experimental results show that our mechanism improves performance by up to 18.28 times and reduces expensive memory swapping by up to 99.73% with negligible overheads (0.05% on average).

Analysis of the Efficiency of Ventilation Systems in Underground Garages

Underground garages host machines that run on different fuels and have variable capacity. Exhaust emissions of different intensities are leading to significant accumulation of these gases in certain areas. Ensuring the evacuation and carrying out concentration below the standards is the main objective of special ventilation installations and air flow guidance. The paper makes an analysis of the functioning of these systems in various operating conditions.

English

Cloud computing is becoming popular Buzzword today. Cloud computing provides opportunity to dynamically scale the computing resources for applications, which is shared among customers using virtualization technology. Infrastructure as a Service (IaaS) allows the cloud provider freely locate the infrastructure over the internet in cost-effective manner by migrating in the form of virtual machine. A resource monitoring system, monitors utilization of resources of host machine can be used as a base criteria for determining idle machine. Utilizing this types of idle machines results in effective utilization of machine, energy saving etc. Hence, proposed system uses collection of Virtual Machines (VMs) running on unused computers at the edge and allocate them dynamically, based on user demands. Proposed system is Designed and implemented as an inventory management system in which server manages heterogeneous system, handles end-user request and serve them effective virtual machine. There are three main issues discussed in this paper (I) ―Resource monitoring and connection establishment‖ (II) ―Inventory management system‖ i.e. finding efficient virtual machine and allocating them. (III) ―Reallocation of the Virtual Machines‖, re-configuring the VM if required Machines configuration is not available on cloud side. This paper analyses problem from the perspective of an end-users like small and middle organization. Which uses cloud Services in order to achieve scalable provisioning with respect to Qos constraints.

CMonitor: VMI-based fine-grained monitoring mechanism in cloud

For the lack of detailed semantic in prior works, a transparent fine-grained monitoring technique (cMonitor) is proposed. Deployed outside the virtual machines, the cMonitor utilizes the elevated privileges of the virtual machine monitor to monitor the network connection, the processes and the relationship between them in protected systems by reconstructing fine-grained system semantics. These semantics contain process states and corresponding network connection. Experimental results show that cMonitor not only can be rapidly deployed in realistic cloud, but also can effectively and universally obtain these fine-grained semantics to assist detection of some advanced network attack. Meanwhile, the network performance overhead is about 3%, which is acceptable.

The Upgrade of EAST Divertor

The scientific and the engineering missions of EAST are to explore the reactor related regimes with long pulse lengths and high plasma core confinement and solutions for power exhaust and particle control under steady state operation and to establish technology basis of full superconducting tokamaks. EAST can operate with double null or single null divertor mode. The goals of the divertor are to get high parameters plasma, long pulse operation and single or double null plasma shape. So the divertor is designed as up-down symmetry structure to provide large experimental flexibility. The divertor should have the capacity to endure higher heat flux and provide recycling and impurity control. Up to now, three generations divertors which are steel, carbon and tungsten divertor respectively have been developed and installed on EAST. The steel divertor is just used in the commissioning test of the host machine in 2006. The carbon divertor which is composed of graphite tiles, CuCrZr heat sink and stainless steel supports is commissioned to endure thermal load of no more than 4 MW/m2 in 2008. Thus the tungsten divertor which is based upon cassette and mono-block technology like ITER is expected to endure the heat flux up to 10 MW/m2 in 2014.

DVM: A Big Virtual Machine for Cloud Computing

As cloud-based computation grows to be an increasingly important paradigm, providing a general computational interface to support datacenter-scale programming has become an imperative research agenda. Many cloud systems use existing virtual machine monitor (VMM) technologies, such as Xen, VMware, and Windows Hypervisor, to multiplex a physical host into multiple virtual hosts and isolate computation on the shared cluster platform. However, traditional multiplexing VMMs do not scale beyond one single physical host, and it alone cannot provide the programming interface and cluster-wide computation that a datacenter system requires. We design a new instruction set architecture, DISA, to unify myriads of compute nodes to form a big virtual machine called DVM and present programmers the view of a single computer, where thousands of tasks run concurrently in a large, unified, and snapshotted memory space. The DVM provides a simple yet scalable programming model and mitigates the scalability bottleneck of traditional distributed shared memory systems. Along with an efficient execution engine, the capacity of a DVM can scale up to support large clusters. We have implemented and tested DVM on four platforms, and our evaluation shows that DVM has excellent performance and scalability. On one physical host, the system overhead of DVM is comparable to that of traditional VMMs. On 16 physical hosts, the DVM runs 10 times faster than MapReduce/Hadoop and X10. On 160 compute nodes in the TH-1/GZ supercomputer, the DVM delivers a $\bf{12.99\times}$ speedup over the computation on 10 compute nodes. The implementation of DVM also allows it to run above traditional VMMs, and we verify that DVM shows linear speedup on a parallelizable workload on 256 large EC2 instances.

Using a vision cognitive algorithm to schedule virtual machines

Abstract Scheduling virtual machines is a major research topic for cloud computing, because it directly influences the performance, the operation cost and the quality of services. A large cloud center is normally equipped with several hundred thousand physical machines. The mission of the scheduler is to select the best one to host a virtual machine. This is an NPhard global optimization problem with grand challenges for researchers. This work studies the Virtual Machine (VM) scheduling problem on the cloud. Our primary concern with VM scheduling is the energy consumption, because the largest part of a cloud center operation cost goes to the kilowatts used. We designed a scheduling algorithm that allocates an incoming virtual machine instance on the host machine, which results in the lowest energy consumption of the entire system. More specifically, we developed a new algorithm, called vision cognition, to solve the global optimization problem. This algorithm is inspired by the observation of how human eyes see directly the smallest/largest item without comparing them pairwisely. We theoretically proved that the algorithm works correctly and converges fast. Practically, we validated the novel algorithm, together with the scheduling concept, using a simulation approach. The adopted cloud simulator models different cloud infrastructures with various properties and detailed runtime information that can usually not be acquired from real clouds. The experimental results demonstrate the benefit of our approach in terms of reducing the cloud center energy consumption

Mahimahi

This demo presents a measurement toolkit, Mahimahi, that records websites and replays them under emulated network conditions. Mahimahi is structured as a set of arbitrarily composable UNIX shells. It includes two shells to record and replay Web pages, RecordShell and ReplayShell, as well as two shells for network emulation, DelayShell and LinkShell. In addition, Mahimahi includes a corpus of recorded websites along with benchmark results and link traces (https://github.com/ravinet/sites). Mahimahi improves on prior record-and-replay frameworks in three ways. First, it preserves the multi-origin nature of Web pages, present in approximately 98% of the Alexa U.S. Top 500, when replaying. Second, Mahimahi isolates its own network traffic, allowing multiple instances to run concurrently with no impact on the host machine and collected measurements. Finally, Mahimahi is not inherently tied to browsers and can be used to evaluate many different applications. A demo of Mahimahi recording and replaying a Web page over an emulated link can be found at http://youtu.be/vytwDKBA-8s. The source code and instructions to use Mahimahi are available at http://mahimahi.mit.edu/.

Asymptotic optimality of a greedy randomized algorithm in a large-scale service system with general packing constraints

We consider a service system model primarily motivated by the problem of efficient assignment of virtual machines to physical host machines in a network cloud, so that the number of occupied hosts is minimized.There are multiple types of arriving customers, where a customer’s mean service time depends on its type. There is an infinite number of servers. Multiple customers can be placed for service into one server, subject to general “packing” constraints. Service times of different customers are independent, even if served simultaneously by the same server. Each new arriving customer is placed for service immediately, either into a server already serving other customers (as long as packing constraints are not violated) or into an idle server. After a service completion, each customer leaves its server and the system. We propose an extremely simple and easily implementable customer placement algorithm, called Greedy-Random (GRAND). It places each arriving customer uniformly at random into either one of the already occupied servers (subject to packing constraints) or one of the so-called zero-servers, which are empty servers designated to be available to new arrivals. One instance of GRAND, called GRAND( $$aZ$$ ), where $$a\ge 0$$ is a parameter, is such that the number of zero-servers at any given time $$t$$ is $$aZ(t)$$ , where $$Z(t)$$ is the current total number of customers in the system. We prove that GRAND( $$aZ$$ ) with $$a>0$$ is asymptotically optimal, as the customer arrival rates grow to infinity and $$a\rightarrow 0$$ , in the sense of minimizing the total number of occupied servers in steady state. In addition, we study by simulations various versions of GRAND and observe the dependence of convergence speed and steady-state performance on the number of zero-servers.

A novel memory allocation scheme for memory energy reduction in virtualization environment

Energy consumption is now a growing problem and leads to high costs in large data center based on virtualization technology. In data center, large memory consumes the main part of total energy, up to 41%. Observed from our experiments, we find that the dispersion characteristic of the virtual machine memory has a great impact on the overall energy consumption. This paper redesigns virtual machine's memory allocation scheme to reduce memory's energy consumption in virtual machine monitor. Two heuristic algorithms of allocating memory for virtual machines are proposed. Besides, based on the new memory allocations, we also design a dynamic memory management system for runtime environment. Experimental results show that our scheme achieves above 50% power reduction.

CIVSched: A Communication-Aware Inter-VM Scheduling Technique for Decreased Network Latency between Co-Located VMs

Server consolidation in cloud computing environments makes it possible for multiple servers or desktops to run on a single physical server for high resource utilization, low cost, and reduced energy consumption. However, the scheduler in the virtual machine monitor (VMM), such as Xen credit scheduler, is agnostic about the communication behavior between the guest operating systems (OS). The aforementioned behavior leads to increased network communication latency in consolidated environments. In particular, the CPU resources management has a critical impact on the network latency between co-located virtual machines (VMs) when there are CPU- and I/O-intensive workloads running simultaneously. This paper presents the design and implementation of a communication-aware inter-VM scheduling (CIVSched) technique that takes into account the communication behavior betweeninter-VMs running on the same virtualization platform. The CIVSched technique inspects the network packets transmitted between local co-resident domains to identify the target VM and process that will receive the packets. Thereafter, the target VM and process are preferentially scheduled by the VMM and the guest OS. The cooperation of these two schedulers makes the network packets to be timely received by the target application. Experimental results on the Xen virtualization platform depict that the CIVSched technique can reduce the average response time of network traffic by approximately 19 percent for the highly consolidated environment, while keeping the inherent fairness of the VMM scheduler.

HyperCheck: A Hardware-AssistedIntegrity Monitor

The advent of cloud computing and inexpensive multi-core desktop architectures has lead to the widespread adoption of virtualization technologies. Furthermore, security researchers embraced virtual machine monitors (VMMs) as a new mechanism to guarantee deep isolation of untrusted software components, which coupled with their popularity promoted VMMs as a prime target for exploitation. In this paper, we present HyperCheck, a hardware-assisted tampering detection framework designed to protect the integrity of hypervisors and operating systems. Our approach leverages System Management Mode (SMM), a CPU mode in x86 architecture, to transparently and securely acquire and transmit the full state of a protected machine to a remote server. We have implement two prototypes based on our framework design: HyperCheck-I and HyperCheck-II, that vary in their security assumptions and OS code dependence. In our experiments, we are able to identify rootkits that target the integrity of both hypervisors and operating systems. We show that HyperCheck can defend against attacks that attempt to evade our system. In terms of performance, we measured that HyperCheck can communicate the entire static code of Xen hypervisor and CPU register states in less than 90 million CPU cycles, or 90 ms on a 1 GHz CPU.