A Synchronous Multi-Step Algorithm for Flexible and Efficient Virtual Network Reconfiguration

SummaryThis paper focus on providing a secure and trustworthy solution for virtual machine (VM) migration within an existing cloud provider domain, and/or to the other federating cloud providers. The infrastructure‐as‐a‐service (IaaS) cloud service model is mainly addressed to extend and complement the previous Trusted Computing techniques for secure VM launch and VM migration case. The VM migration solution proposed in this paper uses a Trust_Token based to guarantee that the user VMs can only be migrated and hosted on a trustworthy and/or compliant cloud platforms. The possibility to also check the compliance of the cloud platforms with the pre‐defined baseline configurations makes our solution compatible with an existing widely accepted standards‐based, security‐focused cloud frameworks like FedRAMP. Our proposed solution can be used for both inter‐ and intra‐cloud VM migrations. Different from previous schemes, our solution is not dependent on an active (on‐line) trusted third party; that is, the trusted third party only performs the platform certification and is not involved in the actual VM migration process. We use the Tamarin solver to realize a formal security analysis of the proposed migration protocol and show that our protocol is safe under the Dolev‐Yao intruder model. Finally, we show how our proposed mechanisms fulfill major security and trust requirements for secure VM migration in cloud environments.

A hybrid optical/electrical datacenter network (HOE-DCN) integrates the benefits of electrical packet switching (EPS) and optical circuit switching (OCS) for better architectural scalability. Meanwhile, as each network service usually involves multiple virtual machines (VMs) that form a virtual network (VNT), how to reconfigure the VNTs in an HOE-DCN to adapt to the dynamic network environment becomes an interesting and important problem to tackle. In this work, we optimize the procedure of VNT reconfigurations that remap VNTs to given virtual network embedding (VNE) schemes, <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">i.e.</i> , scheduling the required VM migrations and optical cross-connect (OXC) reconfiguration properly such that the overall VNT reconfiguration latency can be minimized. We first assume that all the VM migrations should be scheduled before the OXC reconfiguration to minimize service interruptions, and formulate a mixed integer linear programming (MILP) model to solve the scheduling problem exactly. Then, with the same assumption, we propose a time-efficient heuristic to schedule parallel VM migrations in batches such that the bandwidth competition can be significantly relieved. Finally, we divide the OXC reconfiguration into several progressive steps, and design a joint scheduling algorithm to arrange VM migrations together with the OXC reconfiguration steps.

Recent developments in virtualization and communication technologies have transformed the way data centers are designed and operated by providing new tools for better sharing and control of data center resources. In particular, Virtual Machine (VM) migration is a powerful management technique that gives data center operators the ability to adapt the placement of VMs in order to better satisfy performance objectives, improve resource utilization and communication locality, mitigate performance hotspots, achieve fault tolerance, reduce energy consumption, and facilitate system maintenance activities. Despite these potential benefits, VM migration also poses new requirements on the design of the underlying communication infrastructure, such as addressing and bandwidth requirements to support VM mobility. Furthermore, devising efficient VM migration schemes is also a challenging problem, as it not only requires weighing the benefits of VM migration, but also considering migration costs, including communication cost, service disruption, and management overhead. This chapter provides an overview of VM migration benefits and techniques and discusses its related research challenges in data center environments. Specifically, the authors first provide an overview of VM migration technologies used in production environments as well as the necessary virtualization and communication technologies designed to support VM migration. Second, they describe usage scenarios of VM migration, highlighting its benefits as well as incurred costs. Next, the authors provide a literature survey of representative migration-based resource management schemes. Finally, they outline some of the key research directions pertaining to VM migration and draw conclusions.

Moving Target Defense (MTD) is a defensive mechanism based on dynamic system reconfiguration to prevent or thwart cyberattacks. In the last years, considerable progress has been made regarding MTD approaches for virtualized environments, and Virtual Machine (VM) migration is the core of most of these approaches. However, VM migration produces system downtime, meaning that each MTD reconfiguration affects system availability. Therefore, a method for a combined evaluation of availability and security is of utmost importance for VM migration-based MTD design. In this paper, we propose a Stochastic Reward Net (SRN) for the probability of attack success and availability evaluation of an MTD based on VM migration scheduling. We study the MTD system under different conditions regarding 1) VM migration scheduling, 2) VM migration failure probability, and 3) attack success rate. Our results highlight the tradeoff between availability and security when applying MTD based on VM migration. The approach and results may provide inputs for designing and evaluating MTD policies based on VM migration.

Impact of Factors Affecting Pre-copy Virtual Machine Migration Technique for Cloud Computing

Live Virtual Machine (VM) migration has significantly improved the flexibility of modern Data Centers (DC). However, seamless live migration of a VM between geo-distributed DCs faces several challenges due to difficulties in preserving the network configuration after the migration paired with a large network convergence time. Although SDN-based approaches can speed up network convergence time, these techniques have two limitations. First, they typically react to the new topology by installing new flow rules once the migration is finished. Second, because the WAN is typically not under SDN control, they result in sub-optimal routing thus severely degrading the network performance once the VM is attached at the new location. In this paper, we identify networking challenges for VM migration across geo-distributed DCs. Based on those observations, we design a novel long-haul VM migration scheme that overcomes those limitations. First, instead of reactively restoring connectivity after the migration, our SDN-based approach proactively restores flows across the WAN towards the new location with the help of EVPN and VXLAN overlay technologies. Second, the SDN controller accelerates the network convergence by announcing the migration to other controllers using MP-BGP control plane messages. Finally, the SDN controller resolves the sub-optimal routing problem that arises as a result of migration implementing a distributed anycast gateway. We implement our approach as extensions to the OpenDaylight controller. Our evaluation shows that our approach outperforms existing approaches in reducing the downtime by 400 ms and increasing the application performance up to 12 times.

Virtual machine (VM) migration is a technique for transferring the execution state of a VM from one physical host to another. While VM migration is critical for load balancing, consolidation, and server maintenance in virtualized data centers, it can also increase security risks. During VM migration, an attacker with sufficient privileges can compromise a VM by modifying its memory contents during transit to subvert its applications or the guest operating system. One could maintain dedicated, and presumably more secure, control networks to carry the migration traffic, but at significant hardware and administrative complexity. Alternatively, one could encrypt the migration traffic, which eliminates the need for dedicated control networks, but might introduce performance overheads. To date, there has been no systematic study of how encryption affects VM migration, especially in high-bandwidth low-delay networks that are common within data centers. In this paper, we present a study of the impact of AES and 3DES encryption algorithms on two widely used live VM migration approaches -- pre-copy and post-copy. Our key findings are as follows. The encryption algorithm used can have a significant impact on the total migration time. The impact of encryption on downtime varies with the type of the migration technique. The overhead of encryption also depends upon the relative speeds of source and target machines. Finally, an application's performance within a VM during encrypted migration varies with the type of the application and the migration mechanism.

The big data era is presenting unprecedented opportunities for generating new revenues in various sectors ranging from health care, economics, life science, to manufacturing. Datacenters (DCs) are widely deployed to provision various application services as well as to process big data. Since more and more servers are installed in DCs, the cost of electricity incurs a financial burden for the DC operators. Many DCs are equipped with renewable energy to reduce the electricity bill. However, the locations of the energy demands do not match the locations of the renewable energy generation. This mismatch may be addressed by virtual machine (VM) migration. The DCs, which lack renewable energy, can migrate their workloads to other DCs, which have abundant renewable energy. In addition, DC operators always want to maximize revenue and minimize operation cost. In this paper, the problem of maximizing revenue and minimizing operation cost of a green DC network enabled with and without VM migration is formulated by integer linear programming. Simulation results show that optimal results can be reached for small size problems. Two heuristic algorithms are proposed to efficiently solve large size problems. To our best knowledge, this is the first study of the revenue driven VM management problem in green DC networks towards big data with VM migration.

Virtualization techniques effectively handle the growing demand for computing, storage, and communication resources in large-scale Cloud Data Centers (CDC). It helps to achieve different resource management objectives like load balancing, online system maintenance, proactive fault tolerance, power management, and resource sharing through Virtual Machine (VM) migration. VM migration is a resource-intensive procedure as VM’s continuously demand appropriate CPU cycles, cache memory, memory capacity, and communication bandwidth. Therefore, this process degrades the performance of running applications and adversely affects efficiency of the data centers, particularly when Service Level Agreements (SLA) and critical business objectives are to be met. Live VM migration is frequently used because it allows the availability of application service, while migration is performed. In this paper, we make an exhaustive survey of the literature on live VM migration and analyze the various proposed mechanisms. We first classify the types of Live VM migration (single, multiple and hybrid). Next, we categorize VM migration techniques based on duplication mechanisms (replication, de-duplication, redundancy, and compression) and awareness of context (dependency, soft page, dirty page, and page fault) and evaluate the various Live VM migration techniques. We discuss various performance metrics like application service downtime, total migration time and amount of data transferred. CPU, memory and storage data is transferred during the process of VM migration and we identify the category of data that needs to be transferred in each case. We present a brief discussion on security threats in live VM migration and categories them in three different classes (control plane, data plane, and migration module). We also explain the security requirements and existing solutions to mitigate possible attacks. Specific gaps are identified and the research challenges in improving the performance of live VM migration are highlighted. The significance of this work is that it presents the background of live VM migration techniques and an in depth review which will be helpful for cloud professionals and researchers to further explore the challenges and provide optimal solutions.

In Infrastructure-as-a-Service (IaaS) clouds, users manage the systems in virtual machines (VMs) called user VMs through remote management systems (RMSes). To allow users to manage their VMs during failures inside the VMs, IaaS usually provides out-of-band remote management. This management is performed indirectly via an RMS server in a privileged VM called the management VM. However, it is discontinued when a user VM is migrated. This is because an RMS server in the management VM at the source host is terminated on VM migration. Even worse, pending data is lost between an RMS client and a user VM. In this paper, we propose D-MORE for continuing out-of-band remote management across VM migration. D-MORE provides a privileged and migratable VM called DomR and performs out-of-band remote management of a user VM via DomR. During VM migration, it synchronously co-migrates DomR and its target VM and transparently maintains the connections between an RMS client, DomR, and its target VM. We have implemented D-MORE in Xen and confirmed that a remote user could manage his VM via DomR after the VM has been migrated. Our experiments showed that input data was not lost during VM migration and the overhead of D-MORE was acceptable.

Cloud computing has overtaken the traditional computing technologies by providing virtualized resources on demand. Cloud data centers consume a huge amount of power and emit much carbon dioxide, resulting in two challenging problems: high energy consumption and global warming. Our prior work has derived an enhanced energy model that considered energy consumed in computing, migration and host reactivating, and proposed three highly efficient virtual machine (VM) migration schemes. In this work, the three schemes are further enhanced, through considering the traffic factor in VM migration and adopting VM clustering. The resulting schemes have significantly reduced the number of VM migration and their migration costs. The time complexities of these schemes have been analyzed, their performance evaluated through simulation. Results showed that, comparing with the ones without VM clustering, the migration energy usage is dropped to 32%, resulting in the total energy saving of 23%, with a small increase in SLA violation. The proposed schemes would have significant impact when applying to virtualization of wireless mobile networks, in which the communication cost, including bandwidth and delay factors, is significant.

Network resources and traffic priorities can be utilized to distribute requested tasks across edge nodes at the edge layer. However, due to the variety of tasks, the edge nodes have an impact on data accessibility. Resource management approaches based on Virtual Machine (VM) migration, job prioritization, and other methods were used to overcome this problem. A Minimized Upgrading Batch VM Scheduling (MSBP) has recently been developed, which reduces the number of batches required to complete a system-scale upgrade and assigns bandwidth to VM migration matrices. However, due to poor resource sharing caused by suboptimal VM utilization, the MSBP was unable to effectively ensure the global best solutions. In order to distribute resources and schedule tasks optimally during VM migration, this paper proposes the MSBP with Multi-objective Optimization of Resource Allocation (MORA) method. The major goal of this proposed methodology is to take into account different objectives and solve the Pareto-front problem to enhance lifetime of the fog-edge network. First, it formulates an NP-hard challenge for MSBP by taking into account a variety of factors such as network sustainability, path contention, network delay, and cost-efficiency. The Multi-objective Krill Herd optimization (MoKH) algorithm is then used to address the NP-hard issue using the Pareto optimality rule and produce the best solution. First, it introduces an NP-hard challenge for MSBP by accounting in network sustainability, path contention, network latency, and cost-efficiency. The Pareto optimality rule is then implemented to overcome the NP-hard problem and provide the optimum solution employing the Multi-objective Krill Herd optimization (MoKH) algorithm. This increases network lifetime and improves resource allocation cost efficiency. Finally, the simulation results show that the MSBP-MORA distributes resources more efficiently and hence increases network lifetime when compared to other traditional algorithms.

Cloud providers generally run one or more Virtual Machine (VM) instances on the same physical machine. Though it increases data center utilization, it exposes VM to a co-location attack. VM placement and migration are the two strategies adopted for mitigating co-locations. Current methods for VM placement or VM migration consider only security as decision criteria and do not consider other factors like Quality-of-Service degradation, data center utilization, etc. This work proposes a placement and migration strategy for mitigation of co-location attacks with joint consideration of multi objectives like QoS, data center utilization, energy consumption, and security risks. A security-driven multi-criteria optimization -based VM placement policy is proposed. A joint consideration of multiobjective performance optimization along with co-location security risk minimization is done to design a novel VM placement policy based on user categorization. The policy can reduce the likelihood of co-location target VM with attacker VM without much degradation to the performance of VM and data center utilization. The solution mitigates co-location risks without much compromise to the performance of VM and data center resource utilization. The co-residence risk is mitigated by the categorization of users into three levels i.e. unlabeled, risky, and safe, and physical machines into two groups as safe and unsafe. The PMs available in data center is grouped into three different VM placement policies, they are undecided pool, safe pool and unsafe pool.

A Service Sustainable Live Migration Strategy for Multiple Virtual Machines in Cloud Data Centers

The rapid growth in cloud computing encourages the cloud provider to create more reliable, scalable and efficient cloud environment. For providing such a scalable environment, cloud provider develops large-scale Cloud Data Centers (CDC). Such CDCs consume a large amount of electrical energy for operational purpose and cooling purpose to keep the machines operating at a right temperature, but it also emits a large amount of carbon-dioxide. Thus to decrease the energy consumption, Virtual Machines (VMs) are consolidated to fewer numbers of active servers through VM migration techniques, this leads to Service Level Agreement (SLA) violation and performance degradation. Therefore to retain the energy-performance tradeoff, we should perform an optimum number of VM migrations. There are two cases when the VM migration performed: First when a hot spot is found and Second when a cold spot is found. But in both the cases we do not directly migrate the VM instead first we check whether it is required to migrate the VM. After that, the algorithm finds an appropriate destination host on which the VM will be migrated. In this paper, we implement three approaches to select destination host: First-fit, Best-fit, and Worst-fit. Finally compare the result of a number of VM migration performed, energy consumption and SLA violations with existing one.