GoVirtual : Document List - Papers

NOVA: A Microhypervisor-Based Secure Virtualization Architecture

fjadczak@vmware.com — Thu, 08 Jul 2010 13:40:11 GMT

Research Team: Udo Steinberg and Bernhard Kauer, Technische Universitat Dresden

The availability of virtualization features in modern CPUs has reinforced the trend of consolidating multiple guest operating systems on top of a hypervisor in order to improve platform-resource utilization and reduce the total cost of ownership. However, today’s virtualization stacks are unduly large and therefore prone to attacks. If an adversary manages to compromise the hypervisor, subverting the security of all hosted operating systems is easy. We show how a thin and simple virtualization layer reduces the attack surface significantly and thereby increases the overall security of the system.We have designed and implemented a virtualization architecture that can host multiple unmodified guest operating systems. Its trusted computing base is at least an order of magnitude smaller than that of existing systems. Furthermore, on recent hardware, our implementation outperforms contemporary full virtualization environments.

|||||http://os.inf.tu-dresden.de/papers_ps/steinberg_eurosys2010.pdf

Centrifuge: Integrated Lease Management and Partitioning for Cloud Services

fjadczak@vmware.com — Thu, 08 Jul 2010 15:48:58 GMT

Research Team: Atul Adya (Google); John Dunagan, Alec Wolman (Microsoft Research)

Making cloud services responsive is critical to providing a compelling user experience. Many largescale sites, including LinkedIn, Digg and Facebook, address this need by deploying pools of servers that operate purely on in-memory state. Unfortunately, current technologies for partitioning requests across these inmemory server pools, such as network load balancers, lead to a frustrating programming model where requests for the same state may arrive at different servers. Leases are a well-known technique that can provide a better programming model by assigning each piece of state to a single server. However, in-memory server pools host an extremely large number of items, and granting a lease per item requires fine-grained leasing that is not supported in prior datacenter lease managers.

This paper presents Centrifuge, a datacenter lease manager that solves this problem by integrating partitioning and lease management. Centrifuge consists of a set of libraries linked in by the in-memory servers and a replicated state machine that assigns responsibility for data items (including leases) to these servers. Centrifuge has been implemented and deployed in production as part of Microsoft’s Live Mesh, a large-scale commercial cloud service in continuous operation since April 2008. When cloud services within Mesh were built using Centrifuge, they required fewer lines of code and did not need to introduce their own subtle protocols for distributed consistency. As cloud services become ever more complicated, this kind of reduction in complexity is an increasingly urgent need.

|||||http://www.usenix.org/events/nsdi10/tech/full_papers/adya.pdf

Q-Clouds: Managing Performance Interference Effects for QoS-Aware Clouds

fjadczak@vmware.com — Thu, 08 Jul 2010 14:08:11 GMT

Research Team: Ripal Nathuji and Aman Kansal (Microsoft Research); Alireza Ghaffarkhah (University of New Mexico)

Cloud computing offers users the ability to access large pools of computational and storage resources on demand. Multiple commercial clouds already allow businesses to replace, or supplement, privately owned IT assets, alleviating them from the burden of managing and maintaining these facilities. However, there are issues that must be addressed before this vision of utility computing can be fully realized. In existing systems, customers are charged based upon the amount of resources used or reserved, but no guarantees are made regarding the application level performance or quality-of-service (QoS) that the given resources will provide. As cloud providers continue to utilize virtualization technologies in their systems, this can become problematic. In particular, the consolidation of multiple customer applications onto multicore servers introduces performance interference between collocated workloads, significantly impacting application QoS. To address this challenge, we advocate that the cloud should transparently provision additional resources as necessary to achieve the performance that customers would have realized if they were running in isolation. Accordingly, we have developed Q-Clouds, a QoS-aware control framework that tunes resource allocations to mitigate performance interference effects. Q-Clouds uses online feedback to build a multi-input multi-output (MIMO) model that captures performance interference interactions, and uses it to perform closed loop resource management. In addition, we utilize this functionality to allow applications to specify multiple levels of QoS as application Q-states. For such applications, Q-Clouds dynamically provisions underutilized resources to enable elevated QoS levels, thereby improving system efficiency. Experimental evaluations of our solution using benchmark applications illustrate the benefits: performance interference is mitigated completely when feasible, and system utilization is improved by up to 35% using Qstates.

|||||http://research.microsoft.com/pubs/118372/QClouds.pdf

Get What You Pay For: Providing Performance Isolation in Virtualized Execution Environments

fjadczak@vmware.com — Wed, 07 Jul 2010 16:04:02 GMT

Research Team: Hannes Payer, Harald Röck, Christoph Kirsch (Department of Computer Sciences, University of Salzburg, Austria)

Virtualization allows multiple systems encapsulated in so-called domains to share completely isolated from each other a single physical machine. Several companies are already taking advantage of virtualization technology in order to sell a certain amount of CPU speed and I/O capacity in terms of latency and throughput on demand to their customers. Independent of the load generated by the domains running on the system each domain has to get what its customer is paying for, not more and not less. We provide performance isolation for domain CPU speed, domain I/O throughput and latency, and time-critical applications running within a domain.

|||||http://eurosys2010.sigops-france.fr/poster_demo/eurosys2010-final14.pdf

Towards Energy Proportional Cloud for Data Processing Frameworks

fjadczak@vmware.com — Wed, 07 Jul 2010 15:40:23 GMT

Research Team: Hyeong S. Kim, Dong In Shin, Young Jin Yu, Hyeonsang Eom, Heon Y. Yeom (School of Computer Science and Engineering, Seoul National University)

Energy efficiency in cloud computing is becoming more and more important for IT operators of data centers. Several effort to use low power machines in the data center level has been explored. Also, data processing frameworks such as MapReduce and Hadoop are frequently used to process data intensive jobs. However, there have not been an extensive study on the impact of low power computers on such data processing frameworks. Actually, development of low power computers is demanding the architectural paradigm shift for cloud applications. In this paper, we evaluate Apache Hadoop on low power machines and study the feasibility of them in cloud systems. We also propose AnSwer (Augmentation and Substitution), an energy saving method to reduce energy consumption by introducing low power machines. In AnSwer, augmentation and substitution complement each other to prevent data loss and to improve overall power consumption.

|||||

BASIL: Automated IO Load Balancing Across Storage Devices

fjadczak@vmware.com — Wed, 07 Jul 2010 15:24:21 GMT

Research Team: Ajay Gulati, Chethan Kumar, Irfan Ahmad, Karan Kumar (VMware, Inc.)

Live migration of virtual hard disks between storage arrays has long been possible. However, there is a dearth of online tools to perform automated virtual disk placement and IO load balancing across multiple storage arrays. This problem is quite challenging because the performance of IO workloads depends heavily on their own characteristics and that of the underlying storage device. Moreover, many device-specific details are hidden behind the interface exposed by storage arrays.

In this paper, we introduce BASIL, a novel software system that automatically manages virtual disk placement and performs load balancing across devices without assuming any support from the storage arrays. BASIL uses IO latency as a primary metric for modeling. Our technique involves separate online modeling of workloads and storage devices. BASIL uses these models to recommend migrations between devices to balance load and improve overall performance.

We present the design and implementation of BASIL in the context of VMware ESX, a hypervisor-based virtualization system, and demonstrate that the modeling works well for a wide range of workloads and devices. We evaluate the placements recommended by BASIL, and show that they lead to improvements of at least 25% in both latency and throughput for 80 percent of the hundreds of microbenchmark configurations we ran. When tested with enterprise applications, BASIL performed favorably versus human experts, improving latency by 18-27%.

Slides can be found here: http://www.usenix.org/events/fast10/tech/slides/gulati.pdf

|||||http://www.usenix.org/events/fast10/tech/full_papers/gulati.pdf

Provenance for the Cloud

fjadczak@vmware.com — Wed, 07 Jul 2010 15:11:55 GMT

Research Team: Kiran-Kumar Muniswamy-Reddy, Peter Macko, and Margo Seltzer (Harvard School of Engineering and Applied Sciences)

The cloud is poised to become the next computing environment for both data storage and computation due to its pay-as-you-go and provision-as-you-go models. Cloud storage is already being used to back up desktop user data, host shared scientific data, store web application data, and to serve web pages. Today’s cloud stores, however, are missing an important ingredient: provenance.

Provenance is metadata that describes the history of an object. We make the case that provenance is crucial for data stored on the cloud and identify the properties of provenance that enable its utility. We then examine current cloud offerings and design and implement three protocols for maintaining data/provenance in current cloud stores. The protocols represent different points in the design space and satisfy different subsets of the provenance properties. Our evaluation indicates that the overheads of all three protocols are comparable to each other and reasonable in absolute terms. Thus, one can select a protocol based upon the properties it provides without sacrificing performance. While it is feasible to provide provenance as a layer on top of today’s cloud offerings, we conclude by presenting the case for incorporating provenance as a core cloud feature, discussing the issues in doing so.

|||||http://www.usenix.org/events/fast10/tech/full_papers/muniswamy-reddy.pdf

Secure Cloud Computing with a Virtualized Network Infrastructure

fjadczak@vmware.com — Wed, 07 Jul 2010 14:19:45 GMT

Research Team: Fang Hao, T.V. Lakshman, Sarit Mukherjee, Haoyu Song (Bell Labs, Alcatel-Lucent)

Despite the rapid development in the field of cloud computing, security is still one of the major hurdles to cloud computing adoption. Most cloud services (e.g. Amazon EC2) are offered at low cost without much protection to users. At the other end of the spectrum, highly secured cloud services (e.g. Google “government cloud”) are offered at much higher cost by using isolated hardware, facility, and administrators with security clearance. In this paper, we explore the “middle ground”, where users can still share physical hardware resource, but user networks are isolated and accesses are controlled in the way similar to that in enterprise networks. We believe this covers the need for most enterprise and individual users. We propose an architecture that takes advantage of network virtualization and centralized controller. This architecture overcomes scalability limitations of prior solutions based on VLANs, and enables users to customize security policy settings the same way they control their on-site network.

|||||http://www.usenix.org/events/hotcloud10/tech/full_papers/Hao.pdf

A First Look at Problems in the Cloud

fjadczak@vmware.com — Wed, 07 Jul 2010 14:15:36 GMT

Research Team: Theophilus Benson⋆, Sambit Sahu†, Aditya Akella⋆, and Anees Shaikh†
⋆University of Wisconsin - Madison, †IBM Research

Cloud computing provides a revolutionary model for the deployment of enterprise applications and Web services alike. In this new model, cloud users save on the cost of purchasing and managing base infrastructure, while the cloud providers save on the cost of maintaining underutilized CPU, memory, and network resources. Inmigrating to this new model, users face a variety of issues. Commercial clouds provide several support models to aide users in resolving the reported issues. This paper arises from our quest to understand how to design IaaS support models for more efficient user troubleshooting. Using a data driven approach, we start our exploration into this issue with an investigation into the problems encountered by users and the methods utilized by the cloud support’s staff to resolve these problems. We examine message threads appearing in the forum of a large IaaS provider over a 3 year period. We argue that the lessons derived from this study point to a set of principles that future IaaS offerings can implement to provide users with a more efficient supportmodel. This data driven approach enables us to propose a set of principles that are pertinent to the experiences of users and that we believe could vastly improve the SLA observed by the users.

|||||http://www.usenix.org/events/hotcloud10/tech/full_papers/Benson.pdf

Information-Acquisition-as-a-Service for Cyber-Physical Cloud Computing

fjadczak@vmware.com — Wed, 07 Jul 2010 14:08:09 GMT

Research Team: Silviu S. Craciunas, Andreas Haas, Christoph M. Kirsch, Hannes Payer, Harald Rock, Andreas Rottmann, Ana Sokolova, Rainer Trummer (Department of Computer Sciences, University of Salzburg, Austria); Joshua Love, Raja Sengupta (Center for Collaborative Control of Unmanned Vehicles, University of California, Berkeley)

Data center cloud computing distinguishes computational services such as database transactions and data storage from computational resources such as server farms and disk arrays. Cloud computing enables a software-as-a-service business model where clients may only pay for the service they really need and providers may fully utilize the resources they actually have. The key enabling technology for cloud computing is virtualization. Recent developments, including our own work on virtualization technology for embedded systems, show that service-oriented computing through virtualization may also have tremendous potential on mobile sensor networks where the emphasis is on information acquisition rather than computation and storage. We propose to study the notion of information-acquisitionas-a-service of mobile sensor networks, instead of server farms, for cyber-physical cloud computing. In particular, we discuss the potential capabilities and design challenges of software abstractions and systems infrastructure for performing information acquisition missions using virtualized versions of aerial vehicles deployed on a fleet of high-performance model helicopters.

|||||http://www.usenix.org/events/hotcloud10/tech/full_papers/Craciunas.pdf

Toward Risk Assessment as a Service in Cloud Environments

fjadczak@vmware.com — Wed, 07 Jul 2010 14:05:39 GMT

Research Team: Burton S. Kaliski Jr. and Wayne Pauley (EMC Corporation)

Security and privacy assessments are considered a best practice for evaluating a system or application for potential risks and exposures. Cloud computing introduces several characteristics that challenge the effectiveness of current assessment approaches. In particular, the on-demand, automated, multi-tenant nature of cloud computing is at odds with the static, human process-oriented nature of the systems for which typical assessments were designed. This paper describes these challenges and recommends addressing them by introducing risk assessment as a service.

|||||http://www.usenix.org/events/hotcloud10/tech/full_papers/Kaliski.pdf