BIS613DCloud Computing and Security Module-3

Module2
VirtualMachinesandVirtualizationofClustersandDataCenters: ImplementationLevelsof
Virtualization, Virtualization Structure/Tools and Mechanisms, Virtualization of CPU/Memory
and I/O devices, Virtual Clusters and Resource Management, Virtualization for Data Center
Automation.

Textbook1:Chapter3:3.1to3.5

3.1ImplementationLevelsofVirtualization
Virtualization: Virtualization is the process of creating virtual instances of computing
resources—such as servers, storage, networks, or operating systems—on a single physical
machine. It allows multiple virtual environments to run independently on the same hardware,
improving resource utilization, scalability, and flexibility.

DifferenceBetweenTraditionalComputersandVirtualized Computers

Feature Traditional Computer _ □

; VirtualizedComputer¹ ¯=
^–
Hardware DedicatedtoasingleOSand Multiplevirtualinstancessharethesame
Usage applications. physical hardware.
Operating RunsoneOSperphysical machine. CanrunmultipleOSes(Windows, Linux,
System etc.) on the same machine.
Maximizes hardware efficiency by
Resource Oftenunderutilized,as resources
sharingCPU,RAM,andstorageamong
Utilization are fixed.
VMs.
Allapplicationssharethesame OS. Eachvirtualinstance(VMorcontainer) is
Isolation
isolated from others.
Addingresourcesrequiresnew Candynamicallyallocatemoreresources
Scalability
physical machines. without new hardware.
Ifoneapplicationcrashes,itcan Virtualinstancesareindependent, reducing
Security
affect the whole system. the impact of failures.
Manualsetupandconfiguration Canquicklydeployandclone
Deployment
per machine. VMs/containers.
Requiresindividualsystem Easiertomaintain,assnapshotsand
Maintenance
updates and backups. templates allow fast recovery.
Higher hardware costs, as each Lowercostsbyrunningmultiplevirtual
Cost
OSrequiresaseparatemachine. instances on fewer physical machines.
Limitedflexibility;onesystem per CanrundifferentOSesandapplications
Flexibility
hardware. simultaneously.

Example Scenarios

* TraditionalComputer:AsinglephysicalserverrunningWindows,dedicatedtoone task,
such as hosting a database.
* VirtualizedComputer:AphysicalserverrunningmultipleVMs—onewithWindows for
the database, another with Linux for a web server, and another for testing.

. pg. 1
BIS613DCloud Computing and Security Module-3

BenefitsofVirtualization

1. BetterResourceUtilization–Maximizeshardwareefficiencybyrunningmultiple VMs
on a single machine.
2. CostSavings–Reduceshardware,power,andmaintenance costs.
3. Scalability&Flexibility –Easilyscaleresourcesasneeded.
4. ImprovedSecurity&Isolation–VMsareisolatedfromeachother,reducing
security risks.
5. DisasterRecovery –Snapshotsandbackupsallowquickrecoveryincase offailures.

Virtualization Layer

Thevirtualization layer is asoftwarelayerthat abstracts physical hardwareresources (CPU,

memory, storage, network, etc.) and presents them as virtual resources to applications and
operating systems. It acts as a bridge between the physical hardware and virtual instances,
ensuring proper allocation, isolation, and management of resources.

RoleoftheVirtualizationLayer

 Abstraction:Hidesthecomplexityofhardware,allowingvirtualinstancestooperate
independently.
 Isolation:Ensuresthatvirtualinstances(VMsorcontainers)don’tinterferewithone
another.
 ResourceAllocation:Dynamicallyallocatesresourcesbasedondemand,ensuring
efficient usage.
 Compatibility:Enablesdifferentoperatingsystemsandapplicationstocoexistonthe same
physical machine.
 Portability:Allowsvirtualmachinesorcontainerstobeeasilymovedacrossphysical hosts.

. pg. 2
BIS613DCloud Computing and Security Module-3

BenefitsoftheVirtualization Layer
 EfficientUseofResources:Consolidatesmultipleworkloadsontofewerphysical
machines.
 Scalability:Enablesdynamicallocationofresourcestomeetchangingdemands
 ImprovedSecurity:Isolatesvirtualinstancesto minimizesecurityrisks.
 Flexibility:Supportsdiverseoperatingsystemsandapplicationsonthesame
hardware.
 DisasterRecovery: Facilitatesbackups,snapshots,andmigrationsforrapidrecovery.

Whatis aVirtualMachineMonitor (VMM)?

 AVirtualMachineMonitor(VMM),alsocalledahypervisor,isasoftwarelayeror
hardware component responsible for managing and running virtual machines (VMs)
on a host system. It provides the necessary abstraction and resource allocation toallow
multiple virtual machines to share the same physical hardware.

DifferencebetweenVirtualizationlayerandVMM

Aspects VMM Virtualization Layer

Definition. A component (software or hardware) The broader abstraction layer that
that creates, manages, and runs virtual virtualizes resources (e.g., hardware,
machines by abstracting hardware. OS, applications, or networks).

Directly responsible for managing Encompasses the VMM along with

Role
VMs and their access to hardware other components like APIs, drivers,
resources. and management tools.
Scope Focusedspecificallyonrunningand Includes hardware, VMM, virtual
managing virtual machines. networking, storage, and resource
abstraction tools.

Includes hypervisors (like VMM),

Examples VMwareESXi,MicrosoftHyper-V, SDN (software-defined networking),
KVM. and SDS (software-defined storage).
Primary - Createsandrunsvirtualmachines. - Abstractsallphysicalresources.
Function - Provides resource isolation and - Enables dynamic management of
sharing for VMs. hardware, networks, and applications.

Focusesonhardwareabstractionfor Operates at multiple levels, including

Abstraction virtual machines. hardware, operating systems, storage,
Level and networks.
Key - Virtual CPUs. - VMM.
Components - Virtualmemorymanagement. - Managementtools(e.g.,VMware
- Device emulation. vCenter).
- Virtual storage. - Virtualswitches(e.g.,Open
vSwitch).
- APIsand drivers.
Example - Runningmultiplevirtualmachineson a - Managingdatacenterresourcesusing
Scenarios single physical server. platforms like VMware vSphere.
- Isolatingworkloadsusinghypervisors - Supportingcloudplatforms(e.g.,
like Xen or KVM. AWS or Azure).

. pg. 3
BIS613DCloudComputing and Security Module-3

3.1.1LevelsofVirtualizationImplementation
Virtualizationisdoneinfiveabstractlevels rangingfromhardwaretoapplications

InstructionSetArchitectureLevel:
At the ISA level, virtualization primarily focuses on enabling the execution of
instructionswrittenforonearchitectureonahostmachinewithadifferentarchitecture.
Theprocessisachievedthrough instructionsetemulation,whichcaneitherinterpret
instructions one-by-one or dynamically translate blocks of instructions to improve
efficiency.
Note: Emulation refers to the process of mimicking or imitating the behavior of one
system,device,[Link],emulation allows
one machine or software to replicate the functions of another, enabling programs,
applications, or operating systems designed for one platform to run on a different
platform.

HowISAVirtualizationWorks

1. InstructionEmulation:
o ThesourceISA(e.g.,MIPS)isemulatedonthetargetISA(e.g.,x86)through a
software layer.
o Thesoftwarelayerinterpretsortranslatesthesourceinstructionsintotarget
machine instructions.
2. VirtualISA(V-ISA):

. pg. 4
BIS613DCloudComputing and Security Module-3

o A virtual instruction set architecture acts as an abstraction, making it

possibleforvarioussourceISAstoexecuteonthesamehostmachineby
translating and optimizing the instructions.
o Asoftwarelayer,addedtothecompiler,facilitatesthistranslationand
manages differences between ISAs.

KeyTechniquesin ISAVirtualization

1. Code Interpretation:
o Process:Aninterpreterprogramtranslatessourceinstructionsintohost
(native) instructions one-by-one during execution.
o Characteristics:
 Simple to implement.
 Highoverheadduetotheneedtoprocesseachinstruction individually.
o Performance:Slow,aseachsourceinstructionmayrequiretensoreven
hundreds of native instructions to execute.
2. DynamicBinaryTranslation:
o Process:
 Insteadofinterpretinginstructionsone-by-one,thismethodtranslates
blocks of source instructions (basic blocks, traces, or superblocks)
into target instructions.
 Thetranslatedblocksarecached,sosubsequentexecutionsdonotneed re-
translation.
o Characteristics:
 Fasterthaninterpretationduetocachingandreuseoftranslated
instructions.
 Optimizationopportunitiesarisefromanalyzingmultipleinstructions in
a block.
o Performance:Significantlybetterthaninterpretationbutrequiresmore
complex implementation.
3. BinaryTranslation andOptimization:
o Purpose:Enhanceperformanceandreducetheoverheadoftranslation.
o Methods:
 Static Binary Translation: Translates the entire binary code before
execution,whichavoidsruntimetranslationbutcanmissopportunities for
runtime optimizations.
 DynamicBinaryTranslation:Translatesinstructionsatruntime,
enabling better adaptability to runtime conditions.
 DynamicOptimizations:Includesreordering,inlining,andloop
unrolling to improve the efficiency of translated code.

ISA-level virtualization via instruction set emulation opens immense possibilities for
running diverse workloads across platforms, supporting legacy systems, and enabling
hardware independence. The shift from simple interpretation to more advanced
techniques like dynamic binary translation and optimizations has significantly
improveditsperformanceandapplicability,makingitakeyenablerforcross-platform
software execution.

Advantagesof ISA Virtualization

[Link] Support:

. pg. 5
BIS613DCloudComputing and Security Module-3

o Allowslegacybinarycode(e.g.,forMIPSorPowerPC)torunonnewer
hardware (e.g., x86 or ARM).
o Extendsthelifespanoflegacysoftwarewithoutneedinghardwareredesign.
2. Cross-ArchitectureCompatibility:
o ApplicationscanrunonhardwarewithdifferentISAs,enhancingportability and
flexibility.
3. FacilitatesHardware Upgrades:
o Softwarecompiledforolderprocessorscanrunonmodernprocessors,easing
transitions to new architectures.
4. EnablesPlatform Independence:
o VirtualISAsabstracttheunderlyinghardware,enablingsoftwaretooperate
across heterogeneous platforms.

Challenges and Limitations

1. PerformanceOverhead:
o EmulatinganISAonanotherisinherentlyslowerduetoinstruction-by-instruction
interpretation or translation.
o Dynamicbinarytranslationimprovesperformancebutstilladdsruntimeoverhead.
2. Complexity:
o Implementingdynamicbinarytranslationandoptimizationsrequiresadvanced
techniques and significant development effort.
3. Scalability:
o SupportinghighlydiverseISAscanbecomechallenging,especiallywhen
optimizing performance for multiple architectures.

3.1.1.2Hardwareabstraction level:
Hardware-level virtualization is a method of virtualization implemented directly on
the physical hardware to enable the creation and management of virtual machines
(VMs). It abstracts and virtualizes a computer's physical resources—such as CPU,
memory, and input/output (I/O) devices—allowing multiple operating systems to run
concurrently on the same physical machine.

KeyFeaturesofHardware-LevelVirtualization

1. Bare-MetalHypervisors:
o Ahypervisor(Type1)operatesdirectlyonthehardwarewithoutrequiringan
underlying host operating system.
o Itcreatesandmanagesvirtualhardwareenvironmentsforvirtualmachines.
2. ResourceVirtualization:
o VirtualizeshardwarecomponentssuchasCPUs,memory,networkinterfaces, and
storage.
o VMsappeartohavededicatedhardware,eventhoughtheysharethe
underlying physical resources.
3. ImprovedHardware Utilization:
o Allowsmultipleusersorworkloadstosharethesamehardware,increasing
resource utilization and efficiency.

. pg. 6
BIS613DCloudComputing and Security Module-3

4. Isolation:
o EachVMoperatesinisolation,meaningthatthefailureorcompromiseofone VM
does not affect others.

AdvantagesofHardware-LevelVirtualization

1. High Performance:
o Sincethehypervisorrunsdirectlyonhardware,itminimizesoverheadand provides
near-native performance for VMs.
2. Scalability:
o EasilysupportsmultipleVMs,enablingefficientuseofphysicalserver resources.
3. Fault Isolation:
o Problems in one VM (e.g., OS crashes or software bugs) do not impact other
VMs or the host system.
4. Versatility:
o Supportsrunningdifferentoperatingsystemsorenvironmentsonthesame physical
hardware.

3.1.1.3OperatingSystem Level

OperatingSystem(OS)levelvirtualizationisatypeofvirtualizationthatoperatesattheOS
kernellayer,creatingisolatedenvironmentscalledcontainersorvirtualenvironmentswithin
[Link] run on
the same physical hardware while sharing the same operating system kernel.

KeyFeaturesofOS-LevelVirtualization

1. Single OSKernel:
o All containers share the same underlying OS kernel, eliminating the need for
separate kernels for each environment.
o More lightweight compared to traditional hardware-level virtualization since
there's no need to emulate hardware.
2. IsolatedEnvironments (Containers):
o Containers behave like independent servers, with their own libraries, binaries,
and configuration files.
o Processesrunninginsideonecontainerareisolatedfromprocessesinother
containers.
3. EfficientResourceUtilization:
o OS-levelvirtualizationefficientlyshareshardwareresourceslikeCPU, memory,
and storage across containers.
o Reducesoverheadcomparedtofullvirtualization,asthereisnoneedfora hypervisor
or virtual hardware.

Advantagesof OS-Level Virtualization

[Link]:ContainersconsumefewerresourcescomparedtotraditionalVMs because they

do not require a full guest operating system.

. pg. 7
BIS613DCloudComputing and Security Module-3

2. High Performance:Since all containers share the same OS kernel, there is

minimaloverhead, resulting in near-native performance.
3. Scalability:Containerscanbecreated,started,stopped,anddestroyedquickly,making
them ideal for dynamic environments.
4. Isolation:Althoughcontainerssharethesamekernel,theyprovideprocessandfile system
isolation, ensuring that one container does not interfere with another.
5. EaseofDeployment:Containerspackageapplicationswiththeirdependencies,making
them portable across different environments.

DisadvantagesofOS-LevelVirtualization

1. Single OS Limitation:Since all containers share the same kernel, they must use the
[Link],you cannotrunaWindowscontainer onaLinux host.
2. Weaker Isolation:Compared to hardware-level virtualization, OS-level virtualization
provides less isolation. If the kernel is compromised, all containers are at risk.
3. CompatibilityIssues:Applicationsthatrequirespecifickernelmodulesorfeaturesnot
supported by the shared kernel may face compatibility challenges.

3.1.1.4LibrarySupportLevel:
Library-levelvirtualizationfocusesonvirtualizingtheinterfacebetweenanapplication and
the operating system by intercepting or emulating the API (Application Programming
Interface) calls. This type of virtualization is lightweight and primarily targets specific
application needs, rather than virtualizing entire operating systems or hardware.

KeyFeaturesofLibrary-LevelVirtualization

1. APIHooks:
o Applications typically interact with the operating system via APIs exported by
user-level libraries.
o Library-level virtualization works byintercepting API calls and redirecting
them to virtualized implementations.
2. ControlledCommunication:
o Virtualizationhappensbymanagingthecommunicationlinkbetweenthe
application and the underlying system.
o This approach avoids direct interaction with the operating system and replaces
it with controlled, virtualized responses.
3. Application-SpecificVirtualization:
o Focusedonenablingspecificfeaturesorcompatibility,suchassupporting
applications from one environment on another.

HowLibrary-LevelVirtualization Works

 Applicationsarewrittentousestandardlibrarycallsfortheirfunctionality,suchasfile access,
networking, or graphics.
 Library-level virtualization intercepts these calls (using API hooks) and replaces the
original functionality with emulated or redirected behavior.

Library-level virtualization is a targeted and lightweight form of virtualization that

focusesonemulatinguser-levelAPIstoenableapplicationcompatibilityand

. pg. 8
BIS613DCloudComputing and Security Module-3

portability. It plays a critical role in scenarios like running software across platforms,
leveraging hardware features in virtualized environments, and extending the life of
legacy [Link] it may not provide the full isolation or flexibility of OS- or
hardware-level virtualization, its efficiency and simplicity make it invaluable for
specific use cases.

3.1.1.5User-ApplicationLevel:

User-Application-level virtualization refers to the virtualization of individual

applications, treating each application as a virtualized entity, often running as an
isolated process. It is also known as process-level virtualization since the
virtualization focuses on isolating and managing application processes rather than
entire systems or hardware.

KeyFeaturesofUser-Application-LevelVirtualization

1. High-LevelLanguage(HLL)Virtual Machines:
o A common form of application-level virtualization involves High-Level
Language (HLL) Virtual Machines, which provide an abstraction layer for
running applications written in a specific language.
o The virtualization layer operates as an application program on top of the OS,
exporting a virtual machine abstraction.
o Examples:
 Java Virtual Machine (JVM): Executes Java bytecode, enabling Java
applications to run on any platform with a JVM implementation.
 [Link](CLR):Runsprograms
written in .NET-supported languages like C# and [Link].
2. ApplicationIsolationand Sandboxing:
o Another form of user-application level virtualization involves isolating
applications from the host OS and other applications.
o This approach wraps the application in a layer that prevents it from interfering
with system resources or other applications.
3. Application Streaming:
o Applicationsaredeployedasself-containedpackagesthatcanbeexecuted ina
virtualized environment without traditional installation processes.
o The application runs in an isolated sandbox, reducing dependency on the host
OS.

ApproachestoUser-ApplicationLevelVirtualization

1. High-LevelLanguage (HLL)Virtualization:
2. ApplicationIsolationandSandboxing:
3. Application Streaming

AdvantagesofUser-ApplicationLevelVirtualization

1. Cross-PlatformCompatibility:
o ApplicationswrittenforanabstractVM(e.g.,JVM,CLR)canrunonany system with
the corresponding VM implementation.
2. ImprovedSecurity:

. pg. 9
BIS613DCloudComputing and Security Module-3

o ApplicationsareisolatedfromthehostOSandotherapplications,reducingthe risk
of system compromise or interference.
3. Simplified Deployment:
o Applicationscanbedistributedasself-containedpackages,eliminatingtheneed for
complex installation procedures or OS-level dependencies.
4. ResourceEfficiency:
o Compared to hardware- or OS-level virtualization, application-level
virtualization has lower overhead as it focuses only on individual processes.
5. Portability:
o Virtualizedapplicationscanbe easilymovedbetweensystemsorplatforms.

DisadvantagesofUser-ApplicationLevelVirtualization

1. PerformanceOverhead:
o Runningapplicationsinavirtualizedenvironmentmayintroducesomelatency
compared to native execution.
2. LimitedScope:
o UnlikeOS-orhardware-levelvirtualization,application-levelvirtualization
cannot provide a full OS environment or support multiple users.
3. Compatibility Challenges:
o Notallapplicationscanbeeasilyvirtualized,especiallythosewithtightintegration
with the underlying OS or hardware.

3.1.1.6RelativeMeritsofDifferentApproaches:

In the above table, the column headings correspond to four technical merits. “Higher
Performance” and “Application Flexibility” are self-explanatory. “Implementation
Complexity” implies the cost to implement that particular virtualization level. “Application
Isolation” refers to the effort required to isolate resources committed to different VMs.

ThenumberofX’sinthetablecellsreflectstheadvantagepointsofeachimplementationlevel. Five
X’s implies the best case and one X implies the worst case. Overall, hardware and OS support
will yield the highest performance. However, the hardware and application levels are also the
most expensive to implement. User isolation is the most difficult to achieve. ISA
implementation offers the best application flexibility.

3.1.2VMMDesignRequirementsandproviders

. pg.10
BIS613DCloudComputing and Security Module-3

Hardware-level virtualization adds a layer, the Virtual Machine Monitor (VMM), between
the hardware and operating systems. The VMM manages hardware resources and allows
multiple operating systems to run simultaneously on a single hardware setup by virtualizing
components like the CPU. A VMM must meet three key requirements:

1. Provideanenvironmentessentiallyidenticaltotheoriginalmachine.
2. Minimizeperformanceoverhead.
3. Maintaincompletecontrol oversystem resources.

While VMMs ensure functional equivalence to physical hardware, two performance-related

exceptionsareallowed:resourceavailabilitylimitations(whenmultipleVMsshareresources) and
timing dependencies (due to software layers and concurrent VMs).

Efficiency is crucial for VMMs, as slow emulators or interpreters are unsuitable for real
machines. To ensure performance, most virtual processor instructions should execute directly
on physical hardware without VMM intervention.

TheVMMmanagesresourcesbyallocatingthemtoprograms,restrictingunauthorizedaccess, and
regaining control when needed. However, implementing VMMs can be challenging on
certain processor architectures (e.g., x86), where privileged instructions cannot always be
[Link]
VMM requirements, a method known as hardware-assisted virtualization.

Key Observations:

 VMware Workstation supports a wide range of guest operating systems and uses full
virtualization.
 VMware ESX Server eliminates a host OS, running directly on hardware with para-
virtualization.
 XensupportsdiversehostOSsand usesahypervisor-basedarchitecture.
 KVM runs exclusivelyon Linux hosts and supports para-virtualizationfor
multiplearchitectures.

3.1.3VirtualizationSupportattheOSlevel:

. pg.11
BIS613DCloudComputing and Security Module-3

Cloud computing, enabled by VM technology, shifts the cost and responsibility of managing
computational centers to third parties, resembling the role of banks. While transformative, it
faces two significant challenges:

1. DynamicResourceScaling:Adaptingtovaryingcomputationaldemands,wheretasks
may require a single CPU at times and hundreds of CPUs at others.
2. Slow VM Instantiation: Current methods for creating VMs, such as fresh boots
orreplicating templates, are slow and do not account for the current application state.

Toaddressthesechallengesandenhancecloudcomputingefficiency,significantresearchand
development are needed.

3.1.3.1WhyOS-LevelVirtualization?

OS-levelvirtualizationaddressesthechallengesofhardware-levelvirtualization,suchasslow
initialization,storageissuesduetorepeatedcontentinVMimages,slowperformance,andthe need
for para-virtualization or hardware modifications. It introduces a virtualization layer
withintheoperatingsystemtopartitionphysicalresourcesandenablemultipleisolatedvirtual
environments (VEs), also called containers or Virtual Private Systems (VPS).

VEs share the same OS kernel but appear as independent servers to users, each with its own
processes, file system, user accounts, network settings, and more. This approach, known as
single-OS image virtualization, is an efficient alternative to hardware-level virtualization.
Figure 3.3 illustrates operating systems virtualization from the point of view of a machine
stack.

. pg.12
BIS613DCloudComputing and Security Module-3

3.1.3.2AdvantagesofOSExtensions

OS-levelvirtualizationofferstwokey advantages overhardware-levelvirtualization:

1. Efficiency and Scalability: OS-level VMs have low startup/shutdown costs, minimal
resource requirements, and high scalability.
2. StateSynchronization:VMscansynchronizestatechangeswiththehostenvironment
when needed.

Thesebenefitsare enabledbytwo mechanisms:

 AllVMs shareasingleOS kernel,reducing overhead.

 ThevirtualizationlayerallowsVMstoaccesshostresourceswithoutmodifyingthem.

In cloud computing, these features address the slow initialization of hardware-level VMs and
their inability to account for the current application state.

3.1.3.3Disadvantages ofOS Extensions

TheprimarydisadvantageofOS-levelvirtualizationisthatallVMsonasinglecontainermust
[Link],aLinux-basedcontainercannotrun a
Windows OS. This limitation challenges its usability in cloud computing, where users may
prefer different operating systems.

ToimplementOS-levelvirtualization:

 A virtualization layer is added to the OS to partition hardware resources for

isolatedvirtual environments (VMs).
 VMs share the same OS kernel, and access requests are redirected to their respective
resource partitions.
 VirtualrootdirectoriescanbecreatedusingmethodslikethechrootcommandinUNIX
systems.

Twomethodsformanagingresourcepartitions are:

1. DuplicatingresourcesforeachVM: Thisincur highresource costsandoverhead.

2. Sharingmostresourceswiththehostandcreatingprivatecopiesondemand:This is
more efficient and commonly used.

Due to its limitations and overhead in some scenarios, OS-level virtualization is often
considered a secondary choice compared to hardware-assisted virtualization.

3.1.3.4VirtualizationonLinuxorWindowsPlatforms
OS-level virtualization systems are predominantly Linux-based, while Windows-based
platforms are still in the research phase. The Linux kernel provides an abstraction layer that
[Link], new
hardware may require updates or patches to the Linux kernel for extended functionality.

KeypointsaboutLinuxOS-levelvirtualization:

. pg.13
BIS613DCloudComputing and Security Module-3

 Most Linux platforms are not tied to a specific kernel, enabling a host to run multiple
VMs simultaneously on the same hardware.
 Linux-basedtools,suchasLinuxvServerandOpenVZ,supportrunningapplications from
other platforms through virtualization.
 OnWindows,FVMisaspecifictooldevelopedforOS-levelvirtualizationonthe Windows
NT platform.

Example3.1:VirtualizationSupportfortheLinuxPlatform

OpenVZisanopen-source,[Link] the
creation of virtual private servers (VPSes) that operate like independent Linux servers.
OpenVZ modifies the Linux kernel to provide features like virtualization, resource
management, isolation, and checkpointing.

Key Features:

1. Isolation:
o EachVPShasitsownfiles,useraccounts,processtree,virtualnetwork,virtual
devices, and interprocess communication (IPC) mechanisms.
2. ResourceManagement:
o DiskAllocation:Two levels:
 First level: The OpenVZ server administrator assigns disk space limits
to each VM.
 Secondlevel:VMadministratorsmanagediskquotasforusersand groups.
o CPUScheduling:
 First level: OpenVZ's scheduler allocates time slices based on virtual
CPU priority and limits.
 Secondlevel:UsesthestandardLinuxCPU scheduler.
o ResourceControl:OpenVZhas~20parameterstocontrolVMresourceusage.
3. CheckpointingandLive Migration:
o AllowssavingthecompletestateofaVMtoadiskfile,transferringittoanother
machine, and restoring it there.
o Theprocesstakesonlyafewseconds,althoughnetworkconnectionre-
establishment causes minor delays.

Advantages:

 Efficientresourcemanagementandisolation.
 QuickVMmigration withminimal downtime.

Challenges:

 Delayinprocessingduetomigratingactivenetwork connections.

Table3.3provides asummaryof OS-levelvirtualizationtools

. pg.14
BIS613DCloudComputing and Security Module-3

3.1.4MiddlewareSupportfor Virtualization

Library-levelvirtualization,alsoreferredtoasuser-levelApplicationBinaryInterface(ABI) or
API emulation, enables execution environments to run specific programs on a platform
withouttheneed tovirtualizethe entireoperating [Link] API call
interception and remapping.

OverviewofLibrary-LevelVirtualizationSystems/MiddlewareandLibrarySupportfor
Virtualization:

1. WABI:
o Middleware that translates Windows system calls into Solaris system
calls,allowing Windows applications to run on Solaris systems.
2. Lxrun:
o Asystem callemulator enablingLinuxapplicationsdesignedforx86hoststo run
on UNIX systems.
3. WINE:
o Provideslibrarysupporttovirtualizex86processors,enablingWindows
applications to run on UNIX-based systems.
4. Visual MainWin:
o A compiler support systemthat allows developers to use Visual Studio
tocreate Windows applications capable of running on some UNIX hosts.
5. vCUDA:
o A virtualization solution for CUDA, enabling applications requiring GPU
accelerationtoutilizeGPUresourcesremotely.(DiscussedindetailinExample 3.2.)

Key Benefits:

 Enablescross-platformapplicationexecutionwithouttheoverheadofafullvirtualized
operating system.
 Usefulforrunningalienprogramsefficientlyon differentplatforms.

Challenges:

 PerformancedependsontheaccuracyandefficiencyofAPIcallremapping.

. pg.15
BIS613DCloudComputing and Security Module-3

 Limitedtospecificprogramcompatibilitybasedonsystemcallemulation.

Example3.2vCUDAforVirtualizationofGeneral-Purpose GPUs

vCUDA is a virtualization solution designed to enable CUDA applications to run on guest

operating systems (OSes) by virtualizing the CUDA library. It allows compute-intensive
applications to leverage GPU acceleration in a virtualized environment.

KeyFeaturesof vCUDA:

1. Purpose:
o Virtualizes the CUDA library for guest OSes, enabling CUDA applications to
execute GPU-based tasks indirectly through the host OS.
2. Architecture:
o Followsaclient-server modelwiththreemaincomponents:
 vCUDA Library:
 Resides in the guest OS as a substitute for the standard CUDA
library.
 InterceptsandredirectsAPIcallstothehostOS.
 ManagesvirtualGPUs(vGPUs).
 VirtualGPU (vGPU):
 AbstractsGPUhardware,providesauniforminterface,and
manages device memory allocation.
 TracksandstoresCUDA APIflow.
 vCUDAStub:
 Residesin thehost OS.
 ReceivesandinterpretsrequestsfromtheguestOS.
 CreatesexecutioncontextsforCUDAAPIcallsandmanagesthe
physical GPU resources.
3. FunctionalityofvGPU:
o AbstractstheGPUstructure,givingapplicationsaconsistentviewofhardware.
o HandlesmemoryallocationbymappingvirtualaddressesintheguestOStoreal
device memory in the host OS.
o StorestheflowofCUDA APIcalls forproper execution.
4. Workflow:
o CUDAapplications ontheguestOSsend APIcallsto thevCUDA library.
o ThevCUDAlibraryredirectsthesecalls tothevCUDAstub on thehost OS.
o The vCUDA stub processes the requests, executes them on the physical GPU,
and returns results to the guest OS.

BenefitsofvCUDA:

 EnablesGPUaccelerationinvirtualizedenvironmentswithoutdirectlyrunningCUDA on
hardware-level VMs.
 EfficientlyhandlesresourceallocationandexecutionacrossguestandhostOSes.

Challenges:

 Reliesheavilyontheclient-serverarchitectureandtheefficiencyofAPIcall redirection.

. pg.16
BIS613DCloudComputing and Security Module-3

 PerformancemaydependonthecomplexityofGPUtasksandoverheadof virtualization.

3.2VirtualizationStructures/ToolsAndMechanisms

There are three typical classes of VM architectures, differentiated by the placement of the
virtualization layer in the system stack. Virtualization transforms a machine’s architecture by
inserting a virtualization layer between the hardware and the operating system. This layer
convertsrealhardwareintovirtualhardware,enablingdifferentoperatingsystems(e.g.,Linux and
Windows) to run simultaneously on the same physical machine.

ClassesofVM Architectures:

1. HypervisorArchitecture(orVMM):
o Thehypervisoroperatesdirectlyonthehardwarelayer,actingasthe virtualization
layer.
o Itmanagesthehardwareresourcesandvirtualizesthemforguestoperating systems.
o SupportsmultipleOSinstancesonthesamehardwareefficiently.
2. Para-Virtualization:
o Amodifiedversion oftheguest OScollaborateswith thevirtualization layer.
o Offers better performance compared to traditional hypervisors by reducing the
overhead of virtualization.
3. Host-Based Virtualization:
o Thevirtualizationlayerrunsasanapplicationontopofanexistinghost operating
system.
o EasiertoimplementbutlessefficientduetotheadditionallayerofthehostOS.

Key Points:

 Thevirtualizationlayeriscrucialfortranslatingrealhardwareintovirtualhardware.
 Thesearchitecturesenableflexibilityinrunningmultipleoperatingsystemsonthesame
machine.

. pg.17
BIS613DCloudComputing and Security Module-3

 Hypervisors (or VMMs) and other approaches vary in performance, complexity, and
implementation.

Hypervisorand Xen Architecture

Thehypervisor(orVirtualMachineMonitor,VMM)enableshardware-levelvirtualizationby
actingasanintermediatelayerbetweenphysicalhardware(e.g.,CPU,memory,disk,network
interfaces) and the operating systems (OS). It facilitates the creation of virtual resources that
guest OSes and applications can utilize.

TypesofHypervisorArchitectures:

1. Micro-KernelHypervisor:
o Onlyincludesessentialandunchangingfunctionalities,suchasphysical memory
management and processor scheduling.
o Devicedriversandotherchangeablecomponentsarekeptoutsidethe hypervisor.
o Examples:MicrosoftHyper-V.
o Advantages:Smallercodesize,reducedcomplexity,andeasiermaintainability.
2. MonolithicHypervisor:
o Integratesallfunctionalities,includingdevicedrivers,withinthehypervisor itself.
o Examples:VMwareESX forserver virtualization.
o Advantages:Comprehensivefunctionalitybutwithalargercodebaseand potential
complexity.

KeyFeaturesofaHypervisor:

 Supports virtualized access to physical hardware through hypercalls for guest

OSesand applications.
 Convertsphysicaldevicesintovirtualresourcesforusebyvirtual machines(VMs).
 Playsacritical rolein resourcemanagement andscheduling formultipleVMs.

These architectures allow efficient use of physical hardware while enabling multiple OSes to
run simultaneously.

3.2.1.1TheXenArchitecture

[Link]
virtualization layer between hardware and the operating system, enabling multiple guest OS
[Link],
kernel, and applications.

A key feature of Xen is Domain 0 (Dom0), a privileged guest OS that manages hardware
accessandresource allocationforotherguestdomains(Domain U).SinceDom0controlsthe entire
system, its security is critical. If compromised, an attacker can control all virtual machines.

Xen allows users to manage VMs flexibly creating, copying, migrating, and rolling back
[Link],thisflexibilityalsointroducessecurityrisks,asVMscanreverttoprevious

. pg.18
BIS613DCloudComputing and Security Module-3

states, potentially reintroducing vulnerabilities. Unlike traditional machines with a linear

execution timeline, Xen VMs form a tree-like execution state, enabling multiple instances
and rollbacks, which benefits system management but also creates security challenges.

Note:AkeyfeatureofXenisDomain0(Dom0),aprivilegedvirtualmachineresponsiblefor
managing hardware, I/O operations, and other guest VMs (Domain U). Dom0 is the first OS
to load and has direct hardware access, allowing it to allocate resources and manage devices
for unprivileged guest domains.

Control,I/O(Domain0) Guestdomain Guestdomain

Application

Application

Application

Application

Application

Application

Application

Application

Application

Application
Domain0 XenoLinux XenoWindows

XEN (Hypervisor)

Hardwaredevices

FIGURE3.5
TheXenarchitecture’sspecialdomain0forcontrolandI/O,andseveralguestdomainsforuserapplications.

3.2.2Binary TranslationwithFullVirtualization

Hardwarevirtualizationcanbecategorizedintofullvirtualizationandhost-basedvirtualization based on
implementation technologies.

Full Virtualization

 Full virtualization allows a guest OS to run without modification by using binary

translation to handle critical instructions.
 Noncritical instructions execute directly on hardware for efficiency, while critical
instructions are trapped and emulated by the Virtual Machine Monitor (VMM).
 VMwareandsimilarsolutionsplacethe VMMatRing0andtheguestOS atRing1,
ensuring complete decoupling from hardware.
 Although binary translation enables compatibility, it introduces performance
overhead, particularly for I/O-intensive applications. Performance on x86 systems
typically reaches 80% to 97% of native execution speed.

Host-Based Virtualization

 Inthisapproach,ahostOSmanageshardware,withavirtualizationlayerplacedon top to
run guest OSes.
 Unlikefullvirtualization,thehostOSremainsincontrol, providingdriversandlow- level
services, simplifying deployment.
 However, performance suffers due to multiple layers of mapping—every hardware
request must pass through four layers, leading to significant slowdowns.
 If the guest OS and hardware have different ISAs, binary translationis
required,further reducing performance.

. pg.19
BIS613DCloudComputing and Security Module-3

While host-based virtualization offers flexibility, it is generally less efficient than full
virtualization with a VMM.

3.2.3Para-VirtualizationwithCompilerSupport

Para-virtualization reduces virtualization overhead by modifying the guest OS to replace

[Link] full
virtualization, which relies on binary translation, para-virtualization improves performance
but introduces compatibility and maintenance challenges.

ChallengesofPara-Virtualization

1. Compatibility&PortabilityIssues:Sincepara-virtualization modifies the guest OS,

supporting unmodified OSes becomes difficult.
2. HighMaintenanceCosts:OSkernelmodificationsrequireongoingupdatesand support.
3. VariablePerformanceGains:Theperformanceimprovementdependsonthe workload
and system architecture.

Para-VirtualizationArchitecture

. pg.20
BIS613DCloudComputing and Security Module-3

Para-VirtualizationwithCompilerSupport

 GuestOSModification:TheOSkernelismodified,butuserapplicationsmayalso need
changes.
 Hypercalls:PrivilegedinstructionsthatwouldnormallyrunatRing0arereplaced with
hypercalls to the hypervisor.
 IntelligentCompiler:Aspecializedcompilerassistsinidentifyingand replacing
nonvirtualizableinstructions withhypercalls,optimizing performance.
 ImprovedEfficiency:Comparedtofullvirtualization,para-virtualization
significantly reduces overhead, making VM execution closer to native
performance.
 Limitation:SincetheguestOSismodified,itcannotrundirectlyonphysical
hardware without a hypervisor.

Para-Virtualizationonx86Architecture

 Traditionalx86processorshavefourprivilegelevels(Rings 0–3):
o Ring0: Kernel(full controlofhardware)
o Ring3:Userapplications(restrictedaccess)
 In para-virtualization, the guest OS cannot execute at Ring 0 directly. Instead, it
operatesatalowerring,usinghypercallstointeractwiththehypervisoratRing0.

Due tothe inefficiencyof binary translation,many virtualization solutions,includingXen, KVM,

and VMware ESX, use para-virtualization.

KVM(Kernel-BasedVirtualMachine)

 ALinux-basedpara-virtualizationsystem,integratedintotheLinux2.6.20kernel.
 Leverages Linux's existing memory management and scheduling, making it more
lightweight than a full hypervisor.
 SupportsunmodifiedguestOSes,includingWindows,Linux,Solaris,andUNIX variants,
with hardware-assisted virtualization.

. pg.21
BIS613DCloudComputing and Security Module-3

Example3.3VMwareESXServerforPara-Virtualization

VMware pioneered the virtualization market, providing solutions for desktops, servers, and
data centers. VMware ESX is a bare-metal hypervisor designed for x86 symmetric
multiprocessing (SMP) servers, enabling efficient virtualization by directly managing
hardware resources.

KeyComponentsof VMwareESX Server

1. VirtualizationLayer(VMM Layer)
o TheVirtualMachineMonitor(VMM)virtualizesCPU,memory,network,disk
controllers, and human interface devices.
o EachVMhasitsownsetofvirtualhardwareresources,isolatedfromothers.
2. ResourceManager
o AllocatesCPU, memory,storage, andnetworkbandwidthto VMs.
o Mapsphysicalresourcestovirtualhardwareresourcesforefficientdistribution.
3. HardwareInterfaceComponents
o IncludesdevicedriversthatfacilitatedirectaccesstoI/Odevices.
o Uses a VMkernel-based para-virtualization architecture for improved
performance.
4. ServiceConsole(LegacyinESX,removedinESXi)
o Handles system booting,initialization of VMMand Resource Manager, and
administrative functions.

Para-VirtualizationinESX

 TheVMkernelinteractsdirectlywiththehardware,bypassingtheneedforahostOS.
 Para-virtualizeddrivers(e.g.,VMXNETfornetworking,PVSCSIfordiskI/O)improve
performance.
 Provides better efficiency than full virtualization while supporting unmodified guest
OSes via hardware-assisted virtualization (Intel VT, AMD-V).

By leveraging para-virtualization, VMware ESX optimizes performance, enhances resource

management, and ensures scalability, making it a preferred choice for enterprise data center
virtualization.

. pg.22
BIS613DCloudComputing and Security Module-3

VirtualizationofCPU,Memory,AndI/ODevices

HardwareSupportforVirtualization
Modern processors support multiple processes running simultaneously, but they require
protectionmechanismstopreventsystem [Link] user
mode and supervisor mode:

 UserMode:Runsunprivilegedinstructions,restrictingdirecthardwareaccess.
 Supervisor Mode:Runs privilegedinstructions,allowingdirectcontrolover system
hardware.

In virtualized environments, ensuring OS and application correctness is more complex due to

additional abstraction layers.

HardwareVirtualization Products

Severalsolutionsleveragehardwaresupportforvirtualization,including:

1. VMware Workstation
o Ahost-basedvirtualization softwaresuiteforx86andx86-64 systems.
o RunsmultipleVMs simultaneouslyon ahost OS.
2. Xen Hypervisor
o Workson IA-32,x86-64, Itanium,andPowerPC 970architectures.
o ModifiesLinuxtofunctionas ahypervisor,controllingguest OSes.
3. KVM(Kernel-Based VirtualMachine)
o IntegratedintotheLinuxkernelasavirtualizationinfrastructure.
o Supports hardware-assisted virtualization (Intel VT-x, AMD V) and
paravirtualization via the VirtIO framework.
o VirtIOcomponentsinclude:
 ParavirtualEthernetCard(for networking).
 DiskI/OController (optimizedstorage access).
 BalloonDevice(dynamicallyadjustsVMmemory allocation).

. pg.23
BIS613DCloudComputing and Security Module-3

 VGAGraphicsInterface(enhancedgraphicsperformanceusingVMware
drivers).

By leveraging hardware-assisted virtualization, modern hypervisors like VMware, Xen, and

KVM achieve higher efficiency, reduced overhead, and improved performance for virtual
machines.

Example3.4:HardwareSupport forVirtualization in the Intelx86 Processor

Software-based virtualization methods are complex and introduce performance overhead. To

address this, Intel provides hardware-assisted virtualization techniques that simplify
implementation and improve efficiency.

Figure 3.10 provides an overview of Intel’s full virtualization techniques. For processor
virtualization, Intel offers the VT-x or VT-i technique. VT-x adds a privileged mode (VMX
Root Mode) and some instructions to processors. This enhancement traps all sensitive
[Link],IntelofferstheEPT,which
translatesthevirtualaddresstothemachine’[Link] I/O
virtualization, Intel implements VT-d and VT-c to support this.

3.3.2CPUVirtualization
AVirtualMachine(VM)replicatesarealcomputersystem,executingmostinstructionsonthe host
processor in native mode for efficiency. However, critical instructions must be carefully
managed to ensure stability and correctness.

TypesofCriticalInstructions

1. Privileged Instructions
o Executeonlyinprivileged mode.
o Ifexecuted inuser mode,theytriggeratrap.
2. Control-Sensitive Instructions
o Modifysystemresources(e.g.,changingmemory configuration).
3. Behavior-SensitiveInstructions

. pg.24
BIS613DCloudComputing and Security Module-3

o Changebehaviorbasedonsystemconfiguration(e.g.,memoryload/store
operations).

VirtualizabilityofCPU Architectures

 RISCCPUs(e.g.,PowerPC,SPARC)arenaturallyvirtualizablesinceallsensitive
instructions are privileged.
 x86CPUswerenotoriginallydesignedforvirtualization,assomesensitiveinstructions
(e.g., SGDT, SMSW) are not privileged.
o TheseinstructionsbypasstheVMM,makingvirtualizationdifficultwithout
software-based techniques like binary translation.

ParavirtualizationinCPU Virtualization

 In a UNIX-like system, a system call triggers an 80h interrupt, transferring control to

the OS kernel.
 In aparavirtualizedsystem(e.g.,Xen),thesystemcall:
1. Triggersthe80h interruptin theguest OS.
2. Alsotriggers the82h interruptin the hypervisor.
3. ThehypervisorprocessesthecallbeforereturningcontroltotheguestOS kernel.
 Benefit:RunsunmodifiedapplicationsinaVM.
 Drawback:Smallperformanceoverhead duetoadditionalhypervisor intervention.

Hardware-AssistedCPUVirtualization

Tosimplifyvirtualization,Intel andAMDintroducedhardware extensions:

 IntelVT-x /AMD-V: Adds anew privilegemode(Ring-1).

o Hypervisorruns atRing -1.
o GuestOSruns atRing0 (normalOS mode).
o Allprivilegedinstructionsareautomaticallytrappedintothehypervisor.

AdvantagesofHardware-AssistedVirtualization:
i. Removestheneedforbinarytranslation(improving performance).
ii. Allowsunmodifiedoperatingsystemstoruninvirtual machines.
iii. Simplifiesvirtualizationimplementation.

Example3.5:IntelHardware-AssistedCPUVirtualization

Virtualizingx86Processors

 UnlikeRISC processors, x86processorswerenotoriginallyvirtualizable.

 Sincex86-basedlegacysystemsarewidelyused, virtualizationis necessary.

IntelVT-x Technology

 IntroducesVMXRootMode,anadditionalprivilegelevel.
 Addsspecialinstructionsto:
o Start/stopVMs.

. pg.25
BIS613DCloudComputing and Security Module-3

o Allocatememory pages tostoreCPU states.

 UsedinhypervisorslikeXen,VMware,andMicrosoftVirtualPC.

Performance Considerations

 Highefficiencyexpected,butswitchingbetweenhypervisorandguestOScauses overhead.
 HybridApproach(usedby VMware):
o Offloadssometasks tohardwarewhile keepingothers in software.
 Combining Para-Virtualization with Hardware-Assisted Virtualization further boosts
performance.

3.3.3MemoryVirtualization

1. VirtualMemoryVirtualization Basics

 SimilartotraditionalvirtualmemoryinmodernOSes.
 Standard OSes use page tables for one-stage mapping (Virtual Memory →
PhysicalMemory).
 Virtualizedenvironmentsrequireatwo-stage mapping:
o GuestOS:VirtualMemory→PhysicalMemory(GuestView).
o VMM:PhysicalMemory→MachineMemory (ActualHardware).

2. MemoryManagementinVirtualizedSystems

 MemoryManagementUnit(MMU)andTranslationLookasideBuffer(TLB)help optimize
performance.
 GuestOScontrolsvirtual-to-physicalmappingbutcannotdirectlyaccessmachine memory.
 VMM(Hypervisor)handlesactualmemory allocationtopreventconflicts.

3. ShadowPageTables&Nested Paging

. pg.26
BIS613DCloudComputing and Security Module-3

 ShadowPageTable (SPT):
o MaintainedbytheVMM to mapguestphysicalmemory→machinememory.
o ReducesguestOSoverheadbutincreasesmemoryusageandperformance costs.
 NestedPageTables (NPT):
o Addsanotherlayer ofaddress translation.
o FirstintroducedinAMDBarcelona(2007)ashardware-
assistedmemoryvirtualization.
o ReducesVMMoverhead byoffloadingtranslationtohardware.

4. VMware'sApproach

 Usesshadowpagetablesto mapvirtualmemory tomachine memory.

 TLBcachingavoidsrepeatedtranslations,improving performance.
 AMDandIntelnowsupporthardware-assistedmemoryvirtualizationtoreduceoverhead.

Example3.6ExtendedPageTablebyIntelforMemoryVirtualization

1. TheProblemwithShadowPage Tables

 Software-basedshadowpagetableswereinefficientandcausedhighperformance
overhead.
 Frequentmemorylookups andcontextswitchessloweddownvirtualizedenvironments.

2. Intel’sEPT Solution

 Hardware-assistedmemoryvirtualizationthateliminatestheneedforshadowpage tables.
 Works with Virtual ProcessorID (VPID) to optimize Translation Lookaside
Buffer(TLB) usage.
 Reducesmemorylookuptimeandimprovesperformance significantly.

3. How EPT Works

 Usesafour-level pagetablehierarchy (sameasguest OSpagetables).

. pg.27
BIS613DCloudComputing and Security Module-3

 Translation Process:
1. GuestOSuses GuestCR3(Control Register3)topointto L4pagetable.
2. CPU must translate Guest Physical Address (GPA) to Host Physical Address
(HPA) using EPT.
3. TheCPUfirstcheckstheEPTTLBforanexisting translation.
4. Ifnot found,it searches theEPT pagetables(up to5 times intheworst case).
5. Ifstillnot found,anEPT violationexceptionis triggered.
6. The CPU will access memory multiple times to resolve the mapping (up to 20
memory accesses).

4. Optimization:EPTTLB Expansion

 IntelincreasedthesizeofEPTTLBtostoremoretranslationsandreducememory accesses.
 Thisdramaticallyimprovesmemoryaccessspeedandvirtualizationefficiency.

5. Impact ofEPT onVirtualization

 Removestheneed for shadowpagetables, reducing overhead.

 WorksseamlesslywithIntelVT-xforfasterCPU virtualization.
 Improvesperformanceforworkloadsrunninginvirtualizedenvironmentslike VMware,
Xen, and KVM.

3.3.4I/OVirtualization

. pg.28
BIS613DCloudComputing and Security Module-3

I/Ovirtualizationallowsvirtualmachines(VMs)toshareandaccessphysicalI/Odevices efficiently. There

are three main methods to implement I/O virtualization:

1. FullDevice Emulation

 TheVMM(Virtual MachineMonitor)emulateswell-knownhardwaredevices.
 Guest OS interacts withavirtual device, which is mapped to areal physical deviceby
the virtualization layer.
 Functionsperformedbythevirtualizationlayer:
o Emulatesdevicefeatures likeinterrupts,DMA,anddevice enumeration.
o RemapsguestOSI/O addressestorealdevice addresses.
o Multiplexesandroutes I/OrequestsfrommultipleVMs.
o Supportsadvanced featureslikeCopy-on-Write(COW) disks.
 Advantages:
o AllowscompatibilitywithunmodifiedguestOSes.
 Disadvantages:
o Highoverheadandslow performanceduetosoftware emulation.

2. Para-Virtualization(SplitDriverModel)

 UsedinXenandothervirtualization platforms.
 Usesafrontenddriver(insidetheguestOS)andabackenddriver(insidethehypervisor or
privileged VM).
 Howit works:
o Frontenddriver(DomainU):Handles I/O requestsfromguestOS.
o Backenddriver(Domain0):ManagesrealI/Odevicesandroutesdatabetween VMs.
o Communicationoccursviaasharedmemoryblock.
 Advantages:
o Betterperformancethan fulldeviceemulation.
 Disadvantages:
o HigherCPU overheadduetotheneedfor additional processing.

3. DirectI/OVirtualization

 AllowsdirectaccessbetweentheVM and thephysicaldevice.

 Benefits:
o Near-nativeperformancebecause I/Ooperationsbypasssoftware emulation.
o LowerCPUoverheadcomparedtopara-virtualization.
 Challenges:
o Currentimplementationsfocusmainlyonnetworkingfor mainframes.
o DifficultiesinreclaimingandreassigningphysicaldevicesafterVMmigration.
o Riskofarbitrarydevicestates(e.g., DMA errorsleadingtosystem crashes).

4. Hardware-AssistedI/OVirtualization

 IntelVT-dtechnologysupportsI/O DMAremappinganddeviceinterruptremapping.
 Helpsunmodified,specialized,orvirtualization-awareguestOSesrun efficiently.

5. Self-VirtualizedI/O(SV-IO)

. pg.29
BIS613DCloudComputing and Security Module-3

 UsesmulticoreprocessorstomanageI/Ovirtualizationtasks.
 VirtualInterface(VIF) Model:
o Providesvirtualdeviceswithan accessAPIfor VMs.
o Providesamanagement APIfortheVMM.
o Eachvirtualdevice(VIF)hasauniqueIDandusesmessagequeuesforcommunicatio
n.
 Applications:
o Virtualnetwork interfaces
o Virtualblockdevices (disks)
o Virtualcameradevices

Summary

Method Performance CPUOverhead Hardware Dependency

FullDevice Emulation Low High No
Para-Virtualization Moderate Moderate Yes(ModifiedOS)
DirectI/O High Low Yes(Special Hardware)
Hardware-AssistedI/O(VT-d) High Low Yes
Self-VirtualizedI/O(SV-IO) High Low-Moderate Yes

I/Ovirtualizationcontinuestoevolve,withhardware-assistedmethodslikeVT-dandSV- IO
improving efficiency and reducing overhead.

Example3.7VMwareWorkstationforI/OVirtualization

VMware Workstation is a hosted hypervisor that runs as an application on a host operating

system (OS). It relies on guest OS, host OS, and VMM (Virtual Machine Monitor) to
implement I/O virtualization efficiently.

HowVMwareWorkstationImplementsI/OVirtualization

1. VMApp(Application Layer):
o Runsasanapplication insidethehost OS.

. pg.30
BIS613DCloudComputing and Security Module-3

o ManagesVMoperationsanduserinteractions.
2. VMDriver(HostOS Driver):
o Loadedintothe hostOS kernel.
o ActsasabridgebetweenVMAppand VMM.
o FacilitatescontroltransfersbetweenthehostOSandtheVMM world.
3. VirtualMachineMonitor (VMM):
o Runsataprivilegedlevel directlyonthehardware.
o Managesthe executionofguestOSesandhandlesvirtualizationtasks.
4. ProcessorExecution:
o Aphysicalprocessoroperates intwodistinct states:
 HostWorld: Executes tasksforthe host OS.
 VMMWorld:RunstheguestOSandvirtualizedworkloads.
o VMDriverfacilitatestransitionsbetweenthesetwoexecutionstates.

AdvantagesofVMwareWorkstation’sI/OVirtualization

1. Broadhardwarecompatibility(supportsvariousguestOSeswithoutmodification).
2. RunsasaregularapplicationonhostOS,makinginstallationandmanagementsimple.
3. LeverageshostOSdriversforbetter I/Osupport.

Disadvantages

1. Performanceoverheadduetofulldeviceemulation.
2. Slowerthandirect I/Ovirtualization approaches.

. pg.31
BIS613DCloudComputing and Security Module-3

3.3.5Virtualizationinmulticore Processors

Asmulti-coreprocessorsbecomemoreprevalent,virtualizingthempresentsuniquechallenges
compared to single-core processors. While multi-core CPUs offer higher performance by
integrating multiple cores on a single chip, virtualization introduces complexities in task
scheduling, parallel execution, and resource management.

ChallengesinMulti-Core Virtualization

1. Parallelism&Programming Models

 Applicationsmustbeparallelizedtofullyutilizemultiplecores.
 New programming models, languages, and libraries are required to simplify
parallelprogramming.

2. TaskScheduling&Resource Management

 Efficientschedulingalgorithmsareneededtodistributetasksacross cores.
 Resourceallocationpoliciesmustbalanceperformance,complexity,andpower efficiency.

3. DynamicHeterogeneity

 The integration of different types of cores (fat CPU cores & thin GPU cores) on
thesame chip makes resource management more complex.
 Astransistorreliabilitydecreasesandcomplexityincreases,systemdesignersmust adapt
scheduling techniques dynamically.

Multi-core virtualization presents challenges in parallel execution, task scheduling, and

[Link],andefficientschedulingiscrucial for
performance. Dynamic heterogeneity, where CPU and GPU cores coexist, further
complicates resource allocation.

Toaddressthesechallenges:

 Virtual Processor Cores (VCPUs) abstract low-level hardware management, allowing

dynamic core migration and suspension.
 VirtualHierarchiesadaptcacheandcoherencestructurestooptimizeworkload distribution,
reducing cache misses and improving isolation between VMs.

These advancements enhance performance, flexibility, and efficiency, making multi-core

virtualization ideal for server consolidation and cloud computing.

. pg.32
BIS613DCloudComputing and Security Module-3

3.4 VIRTUALCLUSTERSANDRESOURCEMANAGEMENT

WhatareVirtual Clusters?

A physical cluster is a group of physical servers connected through a network. In contrast, a

virtual cluster consists of virtual machines (VMs) spread across multiple physical machines.
These VMs are connected via a virtual network and can be managed flexibly.

KeyCharacteristics ofVirtual Clusters:

. pg.33
BIS613DCloudComputing and Security Module-3

 VMscanrunonphysicalmachines andbe assigned dynamically.

 EachVMrunsitsown operatingsystem,which can differ fromthehost system.
 VMsimproveserver utilizationbyrunningmultipleapplicationson thesamephysical
hardware.
 VMscanbereplicatedacrossmultipleserverstoenhanceperformance,faulttolerance, and
disaster recovery.
 Virtualclusterscanexpandorshrinkdynamically,dependingon demand.
 If aphysicalmachinefails,onlytheVMsonthatmachineareaffected,whileother VMs and
the host system continue running.

ChallengesinVirtualClusterManagement:

1. FastDeployment& Scheduling
o Virtual clusters must be quickly set up, shut down, and switched to
optimizeresource use.
o Green computing techniques aim to save energy, but live VM migration
cancause performance overhead.
o Loadbalancingstrategies helpdistributeworkloadsefficientlyacrossVMs.
2. High-PerformanceVirtual Storage
o VMimages(softwaretemplates)mustbestoredefficientlytoreducespaceand
improve deployment speed.
o Copy-on-Write(COW)technologyallowscreatingnewVMsquicklybymodifying
existing templates instead of duplicating entire disk images.
o AutomatingVMconfigurationscansavetimewhenmanaginglargenumbersof
VMs.

Conclusion:

Virtual clusters provide flexibility, efficient resource usage, and better fault tolerance.
However,theyrequirecareful managementforfastdeployment,effectiveloadbalancing, and
optimized storage. Strategies like automated configuration and optimized migration help
improve performance while reducing overhead.

. pg.34
BIS613DCloudComputing and Security Module-3

3.4.2LiveVMMigrationStepsandPerformance Effects

In a mixed-node cluster, virtual machines (VMs) typically run on physical hosts, but if a host
fails, its VM role can be taken over by another VM on a different host. This enables flexible
[Link],ifahostfails,itsVMs also
fail, which can be mitigated through live VM migration.

VirtualClusterManagementApproaches:

1. Guest-BasedManager:TheclustermanagerrunsinsidetheguestOS(e.g.,OpenMosix,
Sun’s Oasis).
2. Host-BasedManager:TheclustermanagerrunsonthehostOS,supervisingVMs(e.g.,
VMware HA).
3. Independent Manager:Bothguestand hosthaveseparateclustermanagers,increasing
complexity.
4. Integrated Cluster Management:Aunified manager controls both virtual and physical
resources.

LiveVMMigrationProcess(6 Steps):

1. StartMigration:IdentifytheVManddestinationhost,oftentriggeredbyloadbalancing or
server consolidation strategies.
2. MemoryTransfer:TheVM’smemoryiscopiedtothedestinationhostinmultiple rounds,
ensuring minimal disruption.
3. Suspend and Final Copy: The VM pauses briefly to transfer the last memory portion,
CPU, and network states.
4. CommitandActivate:ThedestinationhostloadstheVMstateandresumesexecution.
5. Redirect Network & Cleanup: The network redirects to the new VM, and the old VM
is removed.

PerformanceEffects:

. pg.35
BIS613DCloudComputing and Security Module-3

 The first memory copy takes 63 seconds, reducing network speed from 870 MB/s to
765 MB/s.
 Additionalmemorycopyroundsfurtherreducespeedto694MB/sin9.8seconds.
 Thetotaldowntimeisonly 165milliseconds,ensuringminimalservice disruption.

KeyBenefitsofLiveMigration:

 Ensures continuous service availability in cloud computing, HPC, and computational

grids.
 Enablesdynamicresourceallocationon demand.
 Supportsdisasterrecoverywithminimal overhead.
 Preventsresource contentionwithcarefulnetwork andCPUusage planning.

LiveVM migration enhances cloud computing by enabling seamless workload balancing and
minimizing downtime during host failures. Platforms like VMware and Xen support these
migrations, allowing multiple VMs to run efficiently on a shared physical infrastructure.

VMrunningnormallyonHost A Stage0:Pre-Migration

ActiveVMonHostA

AlternatephysicalhostmaybepreselectedformigrationBlockdevices mirrored
and free resources maintained

Stage1:Reservation

Initializeacontaineronthetargethost

Overheadduetocopying Stage2:Iterativepre-copy

Enableshadowpaging

Copydirtypagesinsuccessiverounds.

Downtime Stage3:Stopandcopy

(VMoutofservice) SuspendVMonhostA

GenerateARPtoredirecttraffictoHostBSynchronizeall remaining
VM state to Host B

Stage4:Commitment

VMstateonHostAisreleased

VMrunningnormallyonHostB Stage5:Activation

VMstartsonHostBConnectstolocaldevices Resumes
normaloperation

Figure.3.20Livemigrationprocessofa VMfrom onehostto another.

. pg.36
BIS613DCloudComputing and Security Module-3

3.4.3MigrationofMemory,Files,andNetworkResources
Shared clusters reduce costs and improve resource utilization. When migrating a system to a
new physical node, key factors include memory migration, file system migration, and
network migration.

1. Memory Migration

 VMmemorymigrationinvolvesmoving memorystates efficiently.

 The Internet Suspend-Resume (ISR) technique uses temporal locality to transfer only
changed data.
 Atree-basedfilestructureminimizesdatatransfer bycopyingonlymodifiedparts.
 ISRresultsinhigh downtime,making it unsuitableforlivemigrations.

2. FileSystem Migration

 VMmigrationrequiresa consistent,location-independentfilesystem accessibleonall

hosts.
 Twoapproaches:
1. VirtualDiskTransport(copiesentirediskbutisslowforlargedata).
2. GlobalDistributedFileSystem(avoidscopying,supportsdirectnetworkaccess).
 Smart Copying uses spatial locality, transferring only differences between the old and
new locations.
 ProactiveStateTransferpredictsthedestinationandpre-transferscriticaldata.

3. NetworkMigration

 MigratingVMsmustmaintainnetworkconnectionswithoutdisruption.
 EachVMhasavirtualIPandMACaddress,separatefromthehostmachine.
 UnsolicitedARPreplies notifynetworkpeersoftheVM’snewlocation.
 SwitchednetworksdetectnewVMlocationsand reroutetraffic automatically.

4. LiveVMMigrationTechniques

 PrecopyApproach:
o Transfersallmemorypagesfirst,theniteratively copiesonlymodified pages.
o Reducesdowntimebutincreasestotalmigrationtime.
 Checkpoint/Recovery&Trace/Replay(CR/TR-Motion):
o Transfersexecutionlogsinsteadofdirtypages,minimizingmigration time.
o Limitedbydifferencesin sourceandtargetsystem performance.
 PostcopyApproach:
o Transfersmemorypagesoncebuthashigherdowntimeduetofetchdelays.
 MemoryCompression:
o UsesspareCPUresourcestocompressmemorypagesbeforetransfer,reducing data
size.

. pg.37
BIS613DCloudComputing and Security Module-3

5. LiveMigrationUsingXen

 XenHypervisorallows multipleOSestosharehardware.
 Domain0(Dom0)managesVMcreation,termination,andmigration.
 Xenusesasend/receive model totransferVMstates efficiently.

KeyTakeaways

 Livemigrationensuresminimaldowntime whilekeepingservices running.

 Optimizedmemory,file,andnetworktransfertechniquesimproveefficiency.
 Different migration strategies (Precopy, Postcopy, CR/TR-Motion, and Compression)
balance speed and downtime based on system needs.
 XenprovidesareliableVMmigrationframework forenterprise environments.

Example3.8LiveMigrationofVMsbetweenTwoXen-EnabledHosts
WhatisLive Migration?
Live migration is the process of moving a running Virtual Machine (VM) from one physical
machine to another without stopping its operations. This means users experience little to no
downtime while the VM is being transferred.

How DoesXen HandleLive Migration?

Xen uses a method called Remote Direct Memory Access (RDMA) to speed up migration by
bypassingtraditionalnetworkcommunicationprotocolslikeTCP/[Link]
processing by the CPU, making the transfer faster and more efficient.

KeyStepsinXen’sLiveMigrationProcess:
1. MigrationDaemon(abackground process)managesthe migration.
2. ShadowPageTablestrackmemorychangesduringthemigration process.
3. [Link] new
machine in precopy rounds.
4. Memorypagesare compressedbeforetransferto reducedatasize andimprovespeed.
5. Thenewhostdecompresses thememorypagesandresumestheVM.

Trade-offsinMigration
 The compression algorithm must be fast and effective for different types of memory
data.
 Usingasinglecompressionmethodforallmemorypagesisnotefficientbecause different
memory types require different strategies.

Conclusion
LivemigrationinXen,enhancedbyRDMA,allowsseamlessVMtransferwithminimalimpact on
performance. Techniques like precopying, dirty bitmaps, and compression improve efficiency
while ensuring smooth operation.

. pg.38
BIS613DCloudComputing and Security Module-3

3.4.4DynamicDeploymentofVirtualClusters
WhatisDynamicDeploymentofVirtualClusters?
Dynamic deployment allows virtual clusters (vClusters) to change in size, move, or adapt to
resource demands. This helps in efficient resource management, improved performance, and
cost savings in cloud computing.

ResearchProjectsonVirtualClusters:
1. Cluster-on-Demand(COD)–DukeUniversity
o Goal:DynamicallyallocateserverstomultiplevClusters.
o Results:Efficientsharing ofVMsusingSunGridEngine.
2. CellularDisco–Stanford University
o Goal:Deployavirtualclusteronashared-memorymultiprocessor system.
o Results:MultipleVMssuccessfullymanagedunderCellularDiscoVirtual Machine
Monitor (VMM).
3. VIOLIN–Purdue University
o Goal:Improveperformancethroughdynamic adaptation ofVMs.
o Results:Reducedexecutiontimeforparallelapplicationsbyadaptingtochanging
workloads.
4. GRAAL– INRIA,France
o Goal:EvaluateparallelalgorithmsinXen-enabledvirtualclusters.
o Results:Achieved75%ofmaximumperformancewhileusingonly30%ofthe total
resources.

Example3.9:COD(Cluster-on-Demand)–DukeUniversity
CODisavirtualclustermanagementsystemthatallowsautomaticresizingandreallocationof clusters.

 UsesSunGridEngineforschedulingworkloads.
 Userscanrequestresources dynamicallyvia awebinterface.
 Figure3.24showshowthenumberofserversindifferentvClusterschangedovereight days
based on demand.
 Helpswithloadbalancing,resourcereservation,andautomatic provisioning.

. pg.39
BIS613DCloudComputing and Security Module-3

Example3.10:VIOLIN –Purdue University

VIOLINfocusesonliveVMmigrationtodynamicallyadjustvirtualclustersforbetterresource use.

 Supportsmultiplevirtualenvironments(VIOLIN1–5)runningonsharedphysical clusters.
 CanmoveVMsbetweenclustersasneededwithoutdisrupting applications.
 Keyresult:Increasedresourceutilizationwithonly a1%increaseinexecution time.

Note:
 Virtualclustershelpefficientlymanageandallocateresources.
 COD and VIOLIN show that dynamic adaptation can significantly improve resource
utilization.
 LivemigrationallowsVMsto bemovedwithminimal downtime.
 Thesetechniquesenablescalable,flexible,andcost-effectivecloudcomputing solutions.

. pg.40
 BIS613DCloudComputing and Security Module-3

VIRTUALIZATIONFORDATA-CENTERAUTOMATION
Data centers have expanded rapidly, with major IT companies like Google, Amazon, and
Microsoft investing heavily in automation. This automation dynamically allocates hardware,
software, and database resources to millions of users while ensuring cost-effectiveness and
Quality of Service (QoS). The rise of virtualization and cloud computing has driven this
transformation, with market growth from $1.04 billion in 2006 to a projected $3.2 billion by
2011.

ServerConsolidationinDataCenters

Datacentershandleheterogeneousworkloads, categorized as:

 Chattyworkloads(e.g., webvideoservices)that havefluctuating demand.

 Noninteractive workloads (e.g., high-performance computing) that require consistent
resource allocation.

Tomeetpeakdemand,resourcesareoftenstaticallyallocated,leadingtounderutilizedservers and
wasted costs in hardware, space, and power. Server consolidation—particularly
virtualization-based consolidation—optimizes resource management by reducing physical
servers and improving hardware utilization.

. pg.41
BIS613DCloudComputing and Security Module-3

BenefitsofServerVirtualization

 Enhanceshardwareutilizationbyconsolidatingunderutilizedservers.
 ImprovesresourceprovisioningthroughagileVMdeployment.
 Reducescosts,includingserverpurchases,maintenance,power,cooling,and cabling.
 Enhancesavailabilityandbusinesscontinuity,asVMcrashesdonotimpactotherVMs or the
host system.

ChallengesandOptimizationStrategies

 ResourceScheduling:Efficient,multi-levelschedulersimproveutilizationandQoS.
 Dynamic CPU Allocation: Adjusts resources based on VM utilization and
workloaddemand.
 Two-LevelResourceManagement:UseslocalVMcontrollersandglobalservercontrollers
for optimized allocation.
 Power Management: A VM-aware power budgeting scheme balances power savings
with performance while addressing hardware heterogeneity.

By leveraging virtualization and multicore processing (CMP), data centers can enhance
efficiency, but optimization in memory access, VM reassignment, and power management
remains a challenge.

VirtualStorageManagement

 Storage virtualization in system environments differs from traditional storage

aggregation, focusing on VM image management and application data handling.
 Akeychallengeisstoragebottlenecks,asVMscompetefordisk resources.
 Parallax, a distributed storage system, addresses these challenges by offering scalable
virtual disks across a common physical storage device. It enhances storage flexibility,
reduces storage footprint, and supports advanced features like snapshots.

Overall, virtualization significantly improves data-center efficiency by optimizing server and

storage management, reducing costs, and enabling scalable, automated resource allocation.

Example3.11–ParallaxVirtualStorageSystem

[Link]
efficientstoragemanagementbyusingasetofper-hoststorageappliancesthatshareaccessto a
common block device.

KeyFeaturesofParallax:

 Cluster-Wide Storage Management:Acentralized administrative domain manages all

storage appliance VMs.
 PushesStorageFunctionalitytoHosts:Featureslikesnapshotsareimplementedin software
instead of dedicated hardware.
 Virtual Disk Images (VDIs): Provides single-writer virtual disks, accessible from any
physical host in the cluster.

. pg.42
BIS613DCloudComputing and Security Module-3

 EfficientBlockVirtualization:UsesXen’sblocktapdriverandtapdisklibraryfor handling
block storage requests across VMs.
 Storage ApplianceVM: ActsasanintermediarybetweenclientVMsandphysical
hardware, facilitating live upgrades of block device drivers.

Parallax enhances flexibility, scalability, and ease of storage management in virtualized data
centers by integrating advanced block storage virtualization techniques.

3.5.3CloudOSforVirtualizedDataCenters

Tofunctionascloudproviders,datacentersmustbevirtualizedusingVirtualInfrastructure
(VI)managers andCloudOSes.Table3.6outlinesfoursuchplatforms:

1. Nimbus(Open-source)
2. Eucalyptus(Open-source)
3. OpenNebula(Open-source)
4. vSphere4(Proprietary,VMware)

KeyFeaturesofVIManagers&CloudOSes:

 VMCreation&Management:Allplatformssupportvirtualmachinesandvirtual clusters for

elastic cloud resources.
 VirtualNetworking:Nimbus,Eucalyptus,andOpenNebulaoffervirtualnetwork support,
enabling flexible communication between VMs.
 DynamicResourceProvisioning:OpenNebulastandsoutbyallowingadvance reservations
of cloud resources.
 HypervisorSupport:
o Nimbus,Eucalyptus,andOpenNebulauseXen& KVMforvirtualization.
o vSphere4utilizesVMwareESX&ESXihypervisors.

. pg.43
BIS613DCloudComputing and Security Module-3

 VirtualStorage&DataProtection:OnlyvSphere4supportsvirtualstoragealongwith
networking and data protection.

Example3.12EucalyptusforVirtualNetworkingofPrivateCloud

Eucalyptus is an open-source software system designed for private cloud infrastructure and
InfrastructureasaService(IaaS).ItenablesvirtualnetworkingandVMmanagement,butdoes not
support virtual storage.

KeyFeaturesofEucalyptus:

 PrivateCloudDeployment:
o SupportsEthernetandInternet-basednetworkingtoconnectVMs.
o Caninteractwith public andprivate clouds.
 Component-basedWebServicesArchitecture:
o UsesWS-Securitypoliciesforsecure communication.
o Webservicesexposelanguage-agnosticAPIsviaWSDLdocuments.
 ResourceManagersinEucalyptus:
o InstanceManager:ManagesVMexecution,inspection,andtermination.
o GroupManager:Handlesschedulingandvirtualnetworkmanagement.
o CloudManager:Centraluserentry-point,queriesnodes,makesscheduling
decisions.
 AWSCompatibility:
o WorkslikeAmazonEC2APIsandsupportsS3storageemulation.
o CompatiblewithSOAP,REST,andCLI-basedmanagement.
 Platform Support:
o InstalledonLinux-basedplatforms.

Eucalyptus provides a flexible and scalable solution for private cloud networking but lacks
some security and general-purpose cloud features.

. pg.44
BIS613DCloudComputing and Security Module-3

Example3.13VMwarevSphere4asaCommercialCloudOS

vSphere4,releasedbyVMwareinApril2009,isavirtualizationplatformdesignedforprivate cloud
management. It extends earlier VMware products like Workstation, ESX, and Virtual
Infrastructure. The system interacts with applications through vCenter and provides
infrastructure and application services.

Theinfrastructureservices includethreecomponents:

 vCompute(ESX, ESXi, DRS)

 vStorage(VMS,thinprovisioning)
 vNetwork(distributedswitchingandnetworking)

The application services focus on:

 Availability(VMotion,StorageVMotion,HA,FaultTolerance, Data Recovery)

 Security(vShieldZones,VMsafe)
 Scalability(DRS,HotAdd)

[Link]
available on the vSphere 4 website.

. pg.45
BIS613DCloudComputing and Security Module-3

3.5.4TrustManagementinVirtualizedDataCenters
A Virtual Machine Monitor (VMM) creates and manages Virtual Machines (VMs) by acting
as a software layer between the operating system and hardware. It provides secure isolation
and manages access to hardware resources, making it thefoundation ofsecurity in virtualized
environments. However, if a hacker compromises the VMM or management VM, the entire
system is at risk. Security issues also arise from random number reuse, which can lead to
encryption vulnerabilities and TCP hijacking attacks.

VM-BasedIntrusionDetection

IntrusionDetectionSystems(IDS) [Link] canbe:

 Host-basedIDS(HIDS)–Runsonamonitoredsystembutisvulnerabletoattacks.
 Network-basedIDS(NIDS)–Monitorsnetwork trafficbutstrugglesto detectfake actions.

AVM-basedIDSleveragesvirtualizationtoisolateVMs,preventingcompromisedVMsfrom
affecting others. The Virtual Machine Monitor (VMM) can audit access requests, combining
the strengths of HIDS and NIDS. There are two methods for implementation:

1. IDSasanindependent processinsideahigh-privilegedVMonthe VMM.

2. IDSintegratedintotheVMMwithdirecthardware access.

GarfinkelandRosenblumproposedaVMM-basedIDSthatmonitorsguestVMsusingapolicy
framework and trace-based security enforcement. However, logs used for analysis can be
compromised if the operating system is attacked.

. pg.46
BIS613DCloudComputing and Security Module-3

HoneypotsandHoneynets

Besides IDS, honeypots and honeynets are used to detect attacks by tricking attackers into
interacting with fake systems. Honeypots can be physical or virtual, and in virtual honeypots,
the host OS and VMM must be protected to prevent attacks from guest VMs.

Example3.14EMCEstablishmentofTrustedZonesforProtectionofVirtual
Clusters Provided to Multiple Tenants

EMC and VMware collaborated to develop security middleware for trust management in
[Link]
security in virtual clusters, where multiple applications and OS instances for different tenants
operate in separate virtual environments.

TrustedZonesArchitecture

 PhysicalInfrastructure(CloudProvider)–Formsthefoundationatthe bottom.
 VirtualClusters(Tenants)–Separatevirtualenvironmentsfordifferenttenants.
 PublicCloud(GlobalUsers)–Representsbroader usercommunities.
 Security Measures – Includes anti-virus, worm containment, intrusion detection, and
encryption.

ThetrustedzonesensuresecureisolationofVMswhileallowingcontrolledinteractionsamong
tenants,providers,[Link]
environments.

. pg.47
BIS613DCloudComputing and Security Module-3

. pg.48