Cloud Computing and Security- BIS613D

Module – 02 [Chapter 3: 3.1 to 3.5 TB 01]

3.1 Implementation Level of Virtualization
3.1.1: Levels of Virtualization Implementation
 Virtualization is a computer architecture technology by which multiple virtual machines
(VMs) are multiplexed in the same hardware machine.
 After virtualization, different user applications managed by their own operating systems
(guest OS) can run on the same hardware independent of the host OS
 done by adding additional software, called a virtualization layer
 This virtualization layer is known as hypervisor or virtual machine monitor (VMM)

 function of the software layer for virtualization is to virtualize the physical hardware of a ost
machine into virtual resources to be used by the VMs
 Common virtualization layers include the instruction set architecture (ISA) level, hardware
level, operating system level, library support level, and application level

[Link]: Instruction Set Architecture Level

 At the ISA level, virtualization is performed by emulating a given ISA by the ISA of the host
machine. For example, MIPS binary code can run on an x86-based host machine with the help of
ISA emulation. With this approach, it is possible to run a large amount of legacy binary code
written for various processors on any given new hardware host machine.

BGSCET/AI & ML/2022-SCheme/MODULE-02/2024-25 1

 Cloud Computing and Security- BIS613D

 Instruction set emulation leads to virtual ISAs created on any hardware machine. The basic
emulation method is through code interpretation. An interpreter program interprets the source
instructions to target instructions one by one. One source instruction may require tens or hundreds
of native target instructions to perform its function. Obviously, this process is relatively slow. For
better performance, dynamic binary translation is desired.
 This approach translates basic blocks of dynamic source instructions to target instructions. The
basic blocks can also be extended to program traces or super blocks to increase translation
efficiency.
 Instruction set emulation requires binary translation and optimization. A virtual instruction set
architecture (V-ISA) thus requires adding a processor-specific software translation layer to the
compiler.

[Link]: Hardware Abstraction Level

 Hardware-level virtualization is performed right on top of the bare hardware.
 This approach generates a virtual hardware environment for a VM.
 The process manages the underlying hardware through virtualization. The idea is to
virtualize a computer’s resources, such as its processors, memory, and I/O devices.
 The intention is to upgrade the hardware utilization rate by multiple users concurrently. The
idea was implemented in the IBM VM/370 in the 1960s.
 More recently, the Xen hypervisor has been applied to virtualize x86-based machines to run
Linux or other guest OS applications.

[Link]: Operating System Level

 This refers to an abstraction layer between traditional OS and user applications.
 OS-level virtualization creates isolated containers on a single physical server and the OS
instances to utilize the hardware and software in data centers.
 The containers behave like real servers.
 OS-level virtualization is commonly used in creating virtual hosting environments to
allocate hardware resources among a large number of mutually distrusting users.
 It is also used, to a lesser extent, in consolidating server hardware by moving services on
separate hosts into containers or VMs on one server.

BGSCET/AI & ML/2022-SCheme/MODULE-02/2024-25 2

 Cloud Computing and Security- BIS613D

[Link]: Library Support Level

 Most applications use APIs exported by user-level libraries rather than using lengthy system
calls by the OS.
 Since most systems provide well-documented APIs, such an interface becomes
another candidate for virtualization.
 Virtualization with library interfaces is possible by controlling the communication link
between applications and the rest of a system through API hooks.

[Link]: User-Application Level

 Virtualization at the application level virtualizes an application as a VM.
 On a traditional OS, an application often runs as a process. Therefore, application-level
virtualization is also known as process-level virtualization.
 The most popular approach is to deploy high level language (HLL)VMs. In this scenario, the
virtualization layer sits as an application program on top of the operating system,
 The layer exports an abstraction of a VM that can run programs written and compiled to a
particular abstract machine definition.
 Any program written in the HLL and compiled for this VM will be able to run on it. The Microsoft
.NET CLR and Java Virtual Machine (JVM) are two good examples of this class of VM.

[Link]: Relative Merits of Different Approaches

3.1.2: VMM Design Requirements and Providers

 layer between real hardware and traditional operating systems. This layer is commonly
called the Virtual Machine Monitor (VMM)
 three requirements for a VMM
 a VMM should provide an environment for programs which is essentially identical to the
original machine

BGSCET/AI & ML/2022-SCheme/MODULE-02/2024-25 3

 Cloud Computing and Security- BIS613D

 programs run in this environment should show, at worst, only minor decreases in speed
 VMM should be in complete control of the system resources.
 VMM includes the following aspects:
 (1) The VMM is responsible for allocating hardware resources for programs;
 (2) it is not possible for a program to access any resource not explicitly allocated to it;
 (3) it is possible under certain circumstances for a VMM to regain control of resources
already allocated.

 Table 3.2 compares four hypervisors and VMMs that are in use today.

3.1.3 Virtualization Support at the OS Level

[Link] :Why OS-Level Virtualization? :
o it is slow to initialize a hardware-level VM because each VM creates its own
image from scratch.
 OS virtualization inserts a virtualization layer inside an operating system to partition a
machine’s physical resources.
 It enables multiple isolated VMs within a single operating system kernel.
 This kind of VM is often called a virtual execution environment (VE), Virtual Private
System (VPS), or simply container
[Link]: The benefits of OS extensions are twofold:
o VMs at the operating system level have minimal startup/shutdown costs, low
resource requirements, and high scalability;
o for an OS-level VM, it is possible for a VM and its host environment to
synchronize state changes when necessary.
o These benefits can be achieved via two mechanisms of OS-level virtualization:

BGSCET/AI & ML/2022-SCheme/MODULE-02/2024-25 4

 Cloud Computing and Security- BIS613D

o (1) All OS-level VMs on the same physical machine share a single operating
system kernel;

o (2) the virtualization layer can be designed in a way that allows processes in
VMs to access as many resources of the host machine as possible.

o In cloud computing, the first and second benefits can be used to overcome the
defects of slow initialization of VMs at the hardware level, and being unaware
of the current application state, respectively.

[Link] Disadvantages of OS Extensions

 OS Extensions Disadvantage:
o All VMs on a container must use the same OS family (e.g., no mixing Windows and
Linux), which challenges users with different OS preferences.
 OS-Level Virtualization:
o The virtualization layer partitions resources within a single OS kernel, isolating VMs.
o Access requests from VMs are redirected to local resource partitions.
 Virtual Root Directories:
o Two methods: duplicating resources (high overhead) or sharing resources with the host
(more efficient).
 Conclusion:

BGSCET/AI & ML/2022-SCheme/MODULE-02/2024-25 5

 Cloud Computing and Security- BIS613D

o OS-level virtualization has significant resource overhead, making it a secondary choice to

hardware-assisted virtualization.

[Link] Virtualization on Linux or Windows Platforms

 OS-Level Virtualization:
o Most systems are Linux-based; Windows support is still in research.
o The Linux kernel abstracts hardware details, but new hardware may require a new kernel or
patched versions for extended functionality.
o Many Linux platforms allow running multiple VMs on the same hardware.
 OS Virtualization Tools:
o Examples include Linux vServer and OpenVZ for running platform-based applications on
Linux.
o FVM is developed specifically for Windows NT virtualization.

3.1.4 Middleware Support for Virtualization

 Library-level virtualization is also known as user-level Application Binary Interface
(ABI) or API emulation.
 This type of virtualization can create execution environments for running alien programs on a
platform

3.2 VIRTUALIZATION STRUCTURES/TOOLS AND MECHANISMS

3.2.1: Hypervisor and Xen Architecture
 The hypervisor software sits directly between the physical hardware and its OS.

BGSCET/AI & ML/2022-SCheme/MODULE-02/2024-25 6

 Cloud Computing and Security- BIS613D

 This virtualization layer is referred to as either the VMM or the hypervisor

[Link]: Xen Architecture

 Xen is an open source hypervisor program developed by Cambridge University.
Xen is a microkernel hypervisor
 The core components of a Xen system are the hypervisor, kernel, and applications
 The guest OS, which has control ability, is called Domain 0, and the others are called

Domain U
 Domain 0 is designed to access hardware directly and manage devices

• VM state is akin to a tree: the current state of the machine is a point that progresses
monotonically as the software executes.
• VMs are allowed to roll back to previous states in their execution (e.g., to fix configuration
errors) or rerun from the same point many times

3.2.2 Binary Translation with Full Virtualization

Hardware Virtualization:
 Full Virtualization: No modification of the host OS; uses binary translation to virtualize sensitive
instructions.
 Host-Based Virtualization: Involves both host and guest OS with a virtualization layer between
them.

[Link]: Full virtualization

 Full virtualization, noncritical instructions run on the hardware directly while critical

BGSCET/AI & ML/2022-SCheme/MODULE-02/2024-25 7

 Cloud Computing and Security- BIS613D

instructions are discovered and replaced with traps into the VMM to be emulated by software
 VMware puts the VMM at Ring 0 and the guest OS at Ring 1.
 The VMM scans the instruction stream and identifies the privileged, control- and
behavior-sensitive instructions.
 When these instructions are identified, they are trapped into the VMM, which emulates the
behavior of these instructions.
 The method used in this emulation is called binary translation.

[Link]: Therefore, full virtualization combines binary translation and

direct execution.

[Link] Host-Based Virtualization

Host-Based VM Architecture:
 A virtualization layer is installed on the host OS, which manages hardware, while guest OSes run
on top.
 Advantages:
o No need to modify the host OS.
o Host OS provides device drivers and low-level services, simplifying deployment.
 Disadvantages:
o Performance is lower due to multiple mapping layers.
o Binary translation is needed when guest OS and hardware ISAs differ, reducing
performance.
o While flexible, this architecture is often too slow for practical use.

3.2.3 Para-Virtualization with Compiler Support

[Link]: Para-Virtualization

BGSCET/AI & ML/2022-SCheme/MODULE-02/2024-25 8

 Cloud Computing and Security- BIS613D

• Para-virtualization needs to modify the guest operating systems

• A para-virtualized VM provides special APIs requiring substantial OS modifications in user
applications
• improve performance by modifying only the guest OS kernel. Figure 3.7 illustrates the
concept of a para-virtualized VM architecture. The guest operating sys tems are para-
virtualized. They are assisted by an intelligent compiler to replace the nonvirtualizable OS
instructions by hypercalls as illustrated in Figure 3.8.

[Link] KVM (Kernel-Based VM)

KVM (Kernel-based Virtual Machine):
 A Linux para-virtualization system in version 2.6.20.
 Memory management and scheduling are handled by the Linux kernel; KVM manages the
rest.
 It’s a hardware-assisted tool that improves performance and supports unmodified guest
OSes like Windows, Linux, Solaris, and other UNIX variants.

[Link] Para-Virtualization with Compiler Support

Para-Virtualization:
 Modifies the guest OS kernel to replace privileged instructions with hypercalls.
 In Xen, the guest OS runs at Ring 1, with privileged instructions replaced by hypercalls,
emulating the original OS behaviour.
o Example: VMware ESX: Fig 3.9 VMware developed virtualization tools for
desktops, servers, and data centers. ESX is a VMM for bare-metal x86 SMP servers,
directly accessing hardware and managing resources.

BGSCET/AI & ML/2022-SCheme/MODULE-02/2024-25 9

 Cloud Computing and Security- BIS613D

o It consists of four components: virtualization layer, resource manager, hardware

interface components, and a service console.
o ESX uses para-virtualization for improved performance, where the VM kernel
interacts directly with hardware, bypassing the host OS.
o The VMM virtualizes hardware resources (CPU, memory, network, disk), while the
resource manager allocates and maps them to each VM. The service console handles
booting and system management tasks.

3.3 VIRTUALIZATION OF CPU, MEMORY, AND I/O DEVICES

3.3.1 Hardware Support for Virtualization
 Processor Modes:
o Modern processors have user mode and supervisor mode to control access to hardware and
prevent system crashes. Privileged instructions run in supervisor mode, while others are
unprivileged.
 Virtualization Challenges:
o Virtualized environments have more layers, making OS and application management more
complex.
 Virtualization Products:
o VMware Workstation: A VM suite for x86/x86-64 systems allowing multiple VMs with
the host OS.
o Xen: A hypervisor for multiple architectures (IA-32, x86-64, Itanium, PowerPC 970),
modifying Linux as the hypervisor.

BGSCET/AI & ML/2022-SCheme/MODULE-02/2024-25 10

 Cloud Computing and Security- BIS613D

o KVM: A Linux kernel virtualization tool supporting hardware-assisted virtualization (Intel

VT-x, AMD-v) and paravirtualization (VirtIO framework) with devices like Ethernet, disk
I/O, and memory adjusters.
Example 3.4 Hardware Support for Virtualization in the Intel x86 Processor Fig: 3.10
Intel Full Virtualization:
 VT-x: Adds a privileged mode (VMX Root Mode) and traps sensitive instructions in the VMM.

 EPT: Improves memory virtualization by translating virtual to physical addresses.

 VT-d/VT-c: Supports I/O virtualization.

3.3.2 CPU Virtualization

• A CPU architecture is virtualizable if it supports the ability to run the VM’s privileged and
unprivileged instructions in the CPU’s user mode while the VMM runs in supervisor mode.
 VM Execution:
o VMs run most instructions on the host processor in native mode for efficiency, but
critical instructions (privileged, control-sensitive, behavior-sensitive) must be
handled carefully.
o Privileged Instructions: Run in privileged mode, trapped if executed outside.
o Control- and Behavior-Sensitive Instructions: Affect resource configuration or
behave differently based on configuration.
 Virtualizable CPU Architectures:
o RISC CPUs: Naturally virtualizable since all critical instructions are privileged.
o x86 CPUs: Not easily virtualizable due to non-privileged sensitive instructions
(e.g., SGDT, SMSW) that can't be trapped.
 System Calls:
o On a UNIX-like system, system calls trigger an interrupt handled by the kernel.

BGSCET/AI & ML/2022-SCheme/MODULE-02/2024-25 11

 Cloud Computing and Security- BIS613D

o In para-virtualization (e.g., Xen), both the guest OS and hypervisor handle

interrupts, with control passing between them, causing a slight performance
penalty.

[Link] Hardware-Assisted CPU Virtualization

• Hardware-Assisted CPU Virtualization: This technique attempts to simplify virtualization
because full or para virtualization is complicated

Privilege Mode Level:

• Intel and AMD add a Ring-1 mode to x86 processors, allowing the OS to run at Ring 0 and the
hypervisor at Ring 1.
• This traps privileged instructions in the hypervisor, simplifying virtualization and eliminating the need
for binary translation, while allowing unmodified OSes to run in VMs.

Example 3.5 Intel Hardware-Assisted CPU Virtualization : Fig: 3.11

Virtualizing x86 Processors:
 x86 processors are not inherently virtualizable, but efforts like Intel's VT-x technology
make it possible.
 VT-x adds VMX Root Mode and instructions for managing VMs and CPU states.
Hypervisors like Xen, VMware, and Microsoft Virtual PC use this technology.
 While hardware-assisted virtualization is efficient, the overhead from switching between
hypervisor and guest OS can reduce performance. Therefore, VMware uses a hybrid
approach, combining hardware offloading with software processing, and combines para-
virtualization for better performance.

BGSCET/AI & ML/2022-SCheme/MODULE-02/2024-25 12

 Cloud Computing and Security- BIS613D

3.3.3 Memory Virtualization

• Memory Virtualization: the operating system maintains mappings of virtual memory to
machine memory using page table
• All modern x86 CPUs include a memory management unit (MMU) and a translation look aside
buffer (TLB) to optimize virtual memory performance
• Two-stage mapping process should be maintained by the guest OS and the VMM, respectively:
virtual memory to physical memory and physical memory to machine memory.
• The VMM is responsible for mapping the guest physical memory to the actual machine
memory Fig: 3.12.

Shadow and Nested Page Tables:

 Each guest OS has a separate page table in the VMM, called the shadow page table. Nested
page tables add another layer of translation, increasing memory overhead and performance
costs.
 VMware uses shadow page tables for virtual-to-physical address translation. Processors use
TLB hardware to speed up memory mapping, avoiding dual-level translation on each access.
 AMD’s Barcelona processor (since 2007) supports hardware-assisted memory virtualization
using nested paging to improve address translation.

Example 3.6 Extended Page Table by Intel for Memory Virtualization

Intel's EPT and VPID: Fig: 3.13
 Intel developed the EPT (Extended Page Table) to improve the inefficient software shadow page
table technique, along with a Virtual Processor ID (VPID) to optimize TLB usage, significantly
enhancing memory virtualization performance.
 EPT uses four-level page tables, with the CPU translating virtual addresses by first checking the
EPT TLB. If the translation is not found, it searches the EPT, and if unsuccessful, an exception is
raised.

BGSCET/AI & ML/2022-SCheme/MODULE-02/2024-25 13

 Cloud Computing and Security- BIS613D

 The translation process involves multiple memory accesses, leading to high latency. To reduce
this, Intel expanded the EPT TLB size to minimize memory accesses.

3.3.4 I/O Virtualization

• I/O Virtualization managing the routing of I/O requests between virtual devices and the shared
physical hardware
• managing the routing of I/O requests between virtual devices and the shared physical hardware
• Full device emulation emulates well-known, real-world devices All the functions of a device or
bus infrastructure, such as device enumeration, identification, interrupts, and DMA, are
replicated in software. This software is located in the VMM and acts as a virtual device
• Two-stage mapping process should be maintained by the guest OS and the VMM,
respectively: virtual memory to physical memory and physical memory to machine memory.
• The VMM is responsible for mapping the guest physical memory to the actual machine
memory. Fig: 3.14

BGSCET/AI & ML/2022-SCheme/MODULE-02/2024-25 14

 Cloud Computing and Security- BIS613D

Example 3.7 VMware Workstation for I/O Virtualization Fig: 3.15

 VMware Workstation runs as an application using I/O device support from the guest OS, host OS,
and VMM. The VMApp communicates with the host through a driver (VMDriver), transferring
control between the host and VMM.
 It employs full device emulation for I/O virtualization, with a virtual NIC modeling an AMD
Lance controller. The guest OS driver triggers packet transmissions by interacting with virtual I/O
ports, which the VMApp emulates. The packet is then sent via the host NIC, and a virtual interrupt
notifies the guest when the packet is sent. Reception follows a reverse process.

BGSCET/AI & ML/2022-SCheme/MODULE-02/2024-25 15

 Cloud Computing and Security- BIS613D

3.3.5 Virtualization in Multi-Core Processors

• Muti-core virtualization has raised some new challenges
• Two difficulties: Application programs must be parallelized to use all cores fully, and
software must explicitly
• Assign tasks to the cores, which is a very complex problem
• The first challenge, new programming models, languages, and libraries are needed to
make parallel programming easier.
• The second challenge has spawned research involving scheduling algorithms and
resource management policies
• Dynamic heterogeneity is emerging to mix the fat CPU core and thin GPU cores on the
same chip
[Link] Physical versus Virtual Processor Core
This technique operates beneath the ISA and is unaffected by the OS or VMM. It allows a VCPU
to move between cores and suspend execution if no appropriate cores are available.

[Link] Virtual Hierarchy

In many-core chip multiprocessors (CMPs)
• Instead of supporting time-sharing jobs on one or a few cores, use the abundant cores
space-sharing, where single-threaded or multithreaded jobs are simultaneously assigned to
separate groups of cores

3.4 VIRTUAL CLUSTERS AND RESOURCE MANAGEMENT

3.4.1 Physical versus Virtual Clusters Fig: 3.18
• Virtual clusters are built with VMs installed at distributed servers from one or more
physical clusters.

BGSCET/AI & ML/2022-SCheme/MODULE-02/2024-25 16

 Cloud Computing and Security- BIS613D

• Assign tasks to the cores, which is a very complex problem

• Fast deployment
• High-Performance Virtual Storage
• reduce duplicated blocks

• Figure 3.19 shows the concept of a virtual cluster based on application partitioning or
customization.
• The different colors in the figure represent the nodes in different virtual clusters.
• As a large number of VM images might be present, the most important thing is to determine how
to store those images in the system efficiently.
• There are common installations for most users or applications, such as operating systems or user-
level programming libraries. These software packages can be preinstalled as templates (called
template VMs). With these templates, users can build their own software stacks.
• New OS instances can be copied from the template VM. User-specific components
such as programming libraries and applications can be installed to those instances.
• Three physical clusters are shown on the left side of Figure 3.18. Four virtual clusters are created
on the right, over the physical clusters.
• The physical machines are also called host systems. In contrast, the VMs are guest systems. The
host and guest systems may run with different operating systems. Each VM can be installed on a
remote server or replicated on multiple servers belonging to the same or different physical clusters.
• The boundary of a virtual cluster can change as VM nodes are added, removed, or migrated
dynamically over time.

BGSCET/AI & ML/2022-SCheme/MODULE-02/2024-25 17

 Cloud Computing and Security- BIS613D

[Link] Fast Deployment and Effective Scheduling

Fast Deployment and Green Computing:
 Fast deployment involves quickly constructing and distributing software stacks to physical nodes
and switching between virtual clusters. When a user finishes, their virtual cluster should shut down
or suspend to save resources.
 Green computing focuses on reducing power consumption at a cluster level, not just individual
workstations. Live migration of VMs allows workload transfer but can incur overhead, affecting
cluster utilization, throughput, and QoS.
 The challenge is to design migration strategies for energy efficiency without impacting
performance. Load balancing in virtual clusters, achieved through user logins and load indices, can
enhance resource utilization and reduce system response time. Dynamic VM migration ensures
balanced loads across nodes.

[Link] High-Performance Virtual Storage

Template VM Deployment:
 Template VMs can be distributed across hosts for customization. Efficient disk space management
and hashing reduce duplication. Deployment involves preparing disk images, configuring VMs,
selecting hosts, and using COW templates for faster setup.
 Preedited profiles simplify configuration, and proper host selection ensures balanced workloads
across the network.

BGSCET/AI & ML/2022-SCheme/MODULE-02/2024-25 18

 Cloud Computing and Security- BIS613D

3.4.2 Live VM Migration Steps and Performance Effects

 In a mixed-node cluster, VMs can fail over to another host with the same guest OS, unlike
physical-to-physical failovers. VM life migration mitigates the issue when a host fails.
 The management of virtual clusters can be done through guest-based, host-based, or integrated
cluster managers. Virtual clusters can be dynamically allocated in cloud computing, providing
resources upon demand.
 For live VM migration, the goal is to minimize downtime, network usage, and migration time
without affecting other services. Migration involves preparing the VM, transferring memory,
suspending the VM, and activating it on the destination host.
 Guest-based manager: Cluster manager resides on a guest system, with multiple VMs forming the
cluster (e.g., openMosix on Xen, Sun's Oasis on VMware).
 Host-based manager: Cluster manager resides on the host system, supervising guest systems and
restarting them on another physical machine (e.g., VMware HA).
 Independent manager: A separate cluster manager is used for both host and guest systems,
increasing complexity.
 Integrated manager: A unified manager distinguishes between virtualized and physical resources
for better infrastructure management.
 Live VM migration: Enhances cluster management by enabling dynamic resources, failure
recovery, and application in grids, clouds, and HPC.
 Cloud computing: Focus on minimizing downtime, network consumption, and migration time
during live VM migration for services.
 Resource contention: Ensure migration doesn’t disrupt other active services on the host due to
resource conflicts (e.g., CPU, network bandwidth).
 VM states:
o Inactive: VM is not enabled by the virtualization platform.
o Active: VM is instantiated and performing tasks.
o Paused: VM is instantiated but disabled or waiting.
o Suspended: VM’s machine file and virtual resources are saved to disk.
 Live migration steps: Involves six steps (refer to Figure 3.20)

Steps 0 and 1: Start migration – Prepare for migration by selecting the VM and destination host,
usually triggered automatically (e.g., load balancing, server consolidation).
Step 2: Transfer memory – Transfer the VM's memory to the destination to ensure service
continuity. Memory data is transferred iteratively, with changes copied in each round until the
"dirty" memory is minimal, without interrupting execution.

BGSCET/AI & ML/2022-SCheme/MODULE-02/2024-25 19

 Cloud Computing and Security- BIS613D

Step 3: Suspend the VM – Suspend the VM to transfer the final memory data and other non-
memory data (e.g., CPU, network states). This results in a brief "downtime," which should be
minimized.

Steps 4 and 5: Commit and activate the new host – After transferring all data, the VM's state
is reloaded on the destination host, and services resume. The network connection is redirected,
and the original VM is removed.

3.4.3 Migration of Memory, Files, and Network Resources

 High initial costs: Clusters have significant costs (space, power, cooling).
 Leasing or sharing clusters: A cost-effective solution, offering economies of scale and better
resource utilization.
 Early management systems: Focus on scalable mechanisms for defining clusters and partitioning
nodes for specific services.
 Migration considerations: Important issues should be addressed when migrating a system to
another physical node.

[Link] Memory Migration

 Memory migration: Moving a VM’s memory from one host to another is crucial and typically
follows common implementation paradigms based on application/workload characteristics.
 Memory size: Migration typically involves hundreds of megabytes to a few gigabytes, requiring
efficient handling.

BGSCET/AI & ML/2022-SCheme/MODULE-02/2024-25 20

 Cloud Computing and Security- BIS613D

 Internet Suspend-Resume (ISR): Exploits temporal locality by leveraging overlapping memory

states between suspended and resumed VM instances.
 Tree-based file representation: Each file is represented as a tree of subfiles, with caching ensuring
only changed files are transmitted.
 ISR limitations: Suitable when live migration isn’t necessary, but results in higher downtime
compared to other techniques.

[Link] File System Migration

1. Consistent file system: A system must provide each VM with a location-independent view of the
file system, accessible on all hosts.
2. Virtual disk solution: One approach is giving each VM a virtual disk, but migrating an entire disk
over a network is impractical due to large disk sizes.
3. Global file system: A shared file system across all machines removes the need for file migration,
as all files are network-accessible.
4. Distributed file system in ISR: ISR uses a distributed file system for transporting suspended VM
states without mapping the actual file systems. VMM only interacts with local files for
suspend/resume operations.
5. Smart copying: The VMM uses spatial locality to transmit only differences between file systems
at suspend/resume locations, reducing data transfer.
6. Proactive state transfer: In cases with no locality, synthesizing the state at the resume site or
predicting the site can reduce migration overhead, especially for non-user files like OS and
applications.

[Link] Network Migration

 VM migration: A migrating VM should maintain open network connections without relying on
forwarding mechanisms or redirection. Each VM gets a unique virtual IP and MAC address,
mapped by the VMM.
 ARP reply: On a switched LAN, an unsolicited ARP reply advertises the VM's new location,
reconfiguring peers to send future packets to the new IP. Alternatively, the VM can keep its MAC
address, and the network switch detects the move.
 Live migration: Allows a VM to move without interrupting its OS or applications. It’s used for
system maintenance, load balancing, and fault tolerance. Precopy allows live migration without
stopping the VM.
 Precopy approach: Transfers memory pages iteratively, minimizing downtime. However,
performance degrades due to continuous data transfer. Adaptive rate limiting helps, but migration
time increases.
 CR/TR-Motion: A faster approach that transfers execution traces instead of dirty pages, reducing
migration time and downtime. It works when the log replay rate exceeds the log growth rate.
 Postcopy approach: Transfers all memory pages once, reducing total migration time but causing
higher downtime due to page-fetching latency.
 Memory compression: In multicore systems, abundant CPU resources allow for page
compression, significantly reducing transferred data with minimal overhead.

BGSCET/AI & ML/2022-SCheme/MODULE-02/2024-25 21

 Cloud Computing and Security- BIS613D

[Link] Live Migration of VM Using Xen

Example 3.8 Live Migration of VMs between Two Xen-Enabled Hosts
 Xen live migration: Allows transferring a VM between physical machines with minimal downtime
by moving its working state and memory while running.
 RDMA support: Xen uses Remote Direct Memory Access (RDMA) to speed up migration by
bypassing TCP/IP overhead, reducing the need for CPU involvement, caches, or context switches.
 Compression scheme: The migration process uses a compression scheme, requiring trade-offs
between speed and algorithm effectiveness. Different compression algorithms are used for memory
pages with varying regularities.
 Migration process: Migration daemons in management VMs handle the migration. Shadow page
tables track memory changes during the precopy phase, with dirty pages flagged in a bitmap,
which is sent to the migration daemon for compression.
 Memory handling: The compressed memory data is sent to the target, where it is decompressed for
use.

3.4.4 Dynamic Deployment of Virtual Clusters

Table 3.5 summarizes four virtual cluster research projects. We briefly introduce them here just to identify
their design objectives and reported results.

BGSCET/AI & ML/2022-SCheme/MODULE-02/2024-25 22

 Cloud Computing and Security- BIS613D

3.5 Virtualization for data-center automation

• Data-center automation means that huge volumes of hardware,software, and database
resources in these data centers can be allocated dynamically to millions of Internet users
simultaneously, with guaranteed QoS and cost-effectiveness
• This automation process is triggered by the growth of virtualization products and cloud
computing services.

• The latest virtualization development highlights high availability (HA), backup services,
workload balancing, and further increases in client bases.

3.5.1 Server Consolidation in Data Centers

• heterogeneous workloads -chatty workloads and noninteractive workloads
• Server consolidation is an approach to improve the low utility ratio of hardware
resources by reducing the number of physical servers

Virtual Storage Management

 Storage virtualization: In system virtualization, it refers to storage managed by VMMs and guest
OSes, including VM images and application data.
 Encapsulation and isolation: System virtualization allows multiple isolated VMs on a physical
machine, but storage lags behind, becoming a bottleneck in VM deployment.
 Storage management complexity: Virtualization adds a layer between hardware and OS,
complicating storage. Guest OSes cannot directly access hard disks, and multiple VMs competing
for disk access increases complexity.
 Storage operations issues: VM storage operations like remapping volumes and checkpointing are
often cumbersome and sometimes unavailable.

BGSCET/AI & ML/2022-SCheme/MODULE-02/2024-25 23

 Cloud Computing and Security- BIS613D

 Parallax system: A distributed storage solution for virtual environments. It uses Content
Addressable Storage (CAS) to reduce VM image sizes, supporting large-scale VM deployments in
data centers.
 Storage VM architecture: Parallax relocates traditional storage features into a federation of storage
VMs on the same physical hosts as the VMs they serve, offering a virtual disk for each VM.

• storage virtualization has a different meaning in a system virtualization environment

• system virtualization, virtual storage includes the storage managed by VMMs

3.5.3 Cloud OS for Virtualized Data Centers (Table 3.6)

• Data centers must be virtualized to serve as cloud providers

Eucalyptus for Virtual Networking of Private Cloud :

• Eucalyptus is an open source software system intended mainly for supporting

Infrastructure as a Service (IaaS) clouds

• The system primarily supports virtual networking and the management of VMs;

virtual storage is not supported.

• Its purpose is to build private clouds
• three resource managers

Instance Manager: controls the execution, inspection, and terminating of VM instances on the host
where it runs.
Group Manager: gathers information about and schedules VM execution on specific instance managers,
as well as manages virtual instance network.

BGSCET/AI & ML/2022-SCheme/MODULE-02/2024-25 24

 Cloud Computing and Security- BIS613D

Cloud Manager: is the entry-point into the cloud for users and administrators. It queries node managers
for information about resources, makes scheduling decisions, and implements them by making requests to
group managers.

3.5.4 Trust Management in Virtualized Data Centers

 VMM role: A Virtual Machine Monitor (VMM) creates and manages VMs by placing a layer of
software between the OS and hardware, allowing multiple VMs on a single physical machine.
 Encapsulation: VMs encapsulate the state of their guest OS, which can be copied, shared, or
deleted like a file, posing security risks.
 Security through VMM: The VMM controls hardware access for VMs, providing isolation and
serving as the foundation for virtual system security.
 Management VM vulnerability: If a hacker gains control of the VMM or management VM, the
entire system is compromised.
 Freshness issue: Security protocols relying on random number freshness are at risk if a VM rolls
back and reuses random numbers, potentially exposing sensitive data or enabling attacks like TCP
hijacking.

[Link] VM-Based Intrusion Detection

 Intrusions & IDS: Intrusions are unauthorized access to systems, and intrusion detection systems
(IDS) identify such access. IDS can be host-based (HIDS) or network-based (NIDS) depending on
the data source.
 HIDS vs NIDS: HIDS is implemented on the monitored system but risks being attacked, while
NIDS monitors network traffic and can't detect fake actions.
 Virtualization-based IDS: Virtualization isolates guest VMs on the same hardware, limiting the
impact of intrusions to individual VMs. A VMM monitors and audits hardware and system
software access, combining benefits of both HIDS and NIDS.
 VM-based IDS Methods: VM-based IDS can run as an independent process in each VM or be
integrated into the VMM with high privileges to access hardware.
 Policy Engine & Analysis: The IDS uses a policy engine to monitor guest VMs and analyze
intrusion actions. Logs are used for attack analysis, but their credibility is a concern.
 Honeypots & Honeynets: Honeypots attract attackers with fake systems to analyze actions. Virtual
honeypots use guest OS and VMM to simulate vulnerable environments, while protecting the real
system.

BGSCET/AI & ML/2022-SCheme/MODULE-02/2024-25 25