Optimize Performance of Virtual Machine Checkpointing via Memory Exclusion

Cloud computing systems routinely process users' confidential data, but the underlying virtualization software in use today is not constructed to minimize the exposure of such data. For instance, virtual machine (VM) checkpointing can drastically prolong the lifetime and vulnerability of confidential data without users' knowledge by storing such data as part of a persistent snapshot. A key requirement for minimizing the exposure of any data is the ability to cleanly isolate such data for either exclusion or processing. Traditional mechanisms for memory taint tracking are expensive whereas those for isolating application footprint in VM-based sandboxes are not transparent. In this paper, we propose a transparent and lightweight mechanism for isolating a confidential application's memory footprint in a VM. The key idea is for a parent VM to spawn a child VM, called a Privacy-preserving Virtual Machine (PPVM) within which the confidential application executes. Hypervisor features, such as VM checkpointing, that need to exclude the memory of a confidential application can safely ignore the child VM's memory footprint. Alternatively, features such as checkpoint encryption or malware tracking can operate only on the child VM's memory. We implement memory isolation for PPVM through a lightweight VM fork operation that uses copy-on-write to reduce the memory and filesystem overhead of the PPVM. Transparency is achieved through a confidential shell that allows the parent VM to spawn the confidential application in the PPVM and exercise control over it during runtime. We demonstrate the effectiveness of PPVM through its use with VM checkpointing, which can safely checkpoint the parent VM while excluding or encrypting the associated PPVM. We show that our PPVM implementation achieves effective memory isolation with low overheads on memory, CPU, and network performance.

Virtual Machine (VM) checkpointing enables a user to capture a snapshot of a running VM on persistent storage. VM checkpoints can be used to roll back the VM to a previous good state in order to recover from a VM crash or to undo a previous VM activity. Although VM checkpointing eases systems administration and improves usability, it can also increase the risks of exposing sensitive information. This is because the checkpoint may store VM's physical memory pages that contain confidential information such as clear text passwords, credit card numbers, patients' health records, tax returns, etc.This paper presents the design and implementation of SPARC, a security and privacy aware checkpointing mechanism. SPARC enables users to selectively exclude processes and terminal applications that contain sensitive data from being checkpointed. Selective exclusion is performed by the hypervisor by sanitizing memory pages in the checkpoint file that belong to the excluded applications. We describe the design challenges in effectively tracking and excluding process-specific memory contents from the checkpoint file in a VM running the commodity Linux operating system. Our preliminary results show that SPARC imposes only 1% - 5.3% of overhead if most pages are dirty before checkpointing is performed.

This paper describes how virtual classes can be supported in a vir-tual machine. Main-stream virtual machines such as the Java Vir-tual Machine and the.NET platform dominate the world today, and many languages are being executed on these virtual machines even though their embodied design choices conflict with the design choices of the virtual machine. For instance, there is a non-trivial mismatch between the main-stream virtual machines mentioned above and dynamically typed languages. One language concept that creates an even greater mismatch is virtual classes, in particular be-cause fully general support for virtual classes requires generation of new classes at run-time by mixin composition. Languages like CaesarJ and Object Teams can express virtual classes restricted to the subset that does not require run-time generation of classes, be-cause of the restrictions imposed by the Java Virtual Machine. We have chosen to support virtual classes by implementing a special-ized virtual machine, and this paper describes how this virtual ma-chine supports virtual classes with full generality.

Cloud computing is characterized by its essentially pay-per-use pricing with elasticity. Typically, the granularity of usage for such pricing is at virtual machine (VM) level in IaaS clouds, e.g., a multiple of machine hours. The elasticity and cost effectiveness in these clouds are primarily achieved through the exploitation of resource virtualization and sharing. However, a majority of applications running on VMs in clouds struggle to fully utilize resources allocated to them. Since co-location granularity is strictly restricted to VM level and resources allocated to VMs are space-shared, the unused resources are apt to be wasted while users are still charged for such wastage. In this paper, we address the problem of fine-grained and adaptive resource sharing for real pay-per-use pricing. To this end, we devise a resource management mechanism as a cost efficiency solution for both users and providers of clouds. The mechanism consists of a container-based resource allocator and a real-usage based pricing scheme. We demonstrate the efficacy of this mechanism via experiments, in Amazon EC2, using two typical workloads in clouds, web services and database services, and a compute-intensive high energy physics application. Our results show that the mechanism can achieve near-optimal cost efficiency.

In this paper we develop a model which represents the addressing of resources by processes executing on a virtual machine. The model distinguishes two maps: the o-map which represents the map visible to the operating system software running on the virtual machine, and the f-map which is invisible to that software but which is manipulated by the virtual machine monitor running on the real machine. The o-map maps process names into resource names and the f-map maps virtual resource names into real resource names. Thus, a process running on a virtual machine addresses its resources under the composed map f o o. In recursive operation, f maps from one virtual machine level to another and we have f o f o ... o f o o.The model is used to describe and characterize previous virtual machine designs. We also introduce and illustrate a general approach for implementing virtual machines which follows directly from the model. This design, the Hardware Virtualizer, handles all process exceptions directly within the executing virtual machine without software intervention. All resource faults (VM-faults) generated by a virtual machine are directed to the appropriate virtual machine monitor without the knowledge of processes on the virtual machine (regardless of the level of recursion).

The VMIL workshop is a forum for research in virtual machines (VM) and intermediate languages (IL). It is dedicated to identifying programming mechanisms and constructs that are currently realized as code transformations or implemented in libraries but should rather be supported at the VM level. Candidates for such mechanisms and constructs include modularity mechanisms (aspects, context-dependent layers), concurrency (threads and locking, actors, software transactional memory), transactions, etc. Topics of interest include the investigation of which such mechanisms are worthwhile candidates for integration with the VM, how said mechanisms can be elegantly (and reusably) expressed at the IL level (e.g., in bytecode), how their implementations can be optimized, and how VM architectures might be shaped to facilitate such implementation efforts.

The container-based cloud is used in various service infrastructures as it is lighter and more portable than a virtual machine (VM)-based infrastructure and is configurable in both bare-metal and VM environments. The Internet-of-Things (IoT) cloud-computing infrastructure is also evolving from a VM-based to a container-based infrastructure. In IoT clouds, the service availability of the cloud infrastructure is more important for mission-critical IoT services, such as real-time health monitoring, vehicle-to-vehicle (V2V) communication, and industrial IoT, than for general computing services. However, in the container environment that runs on a VM, the current fault detection method only considers the container’s infra, thus limiting the level of availability necessary for the performance of mission-critical IoT cloud services. Therefore, in a container environment running on a VM, fault detection and recovery methods that consider both the VM and container levels are necessary. In this study, we analyze the fault-detection architecture in a container environment and designed and implemented a Fast Fault Detection Manager (FFDM) architecture using OpenStack and Kubernetes for realizing fast fault detection. Through performance measurements, we verified that the FFDM can improve the fault detection time by more than three times over the existing method.

Scheduling in a virtual machine environment is pivotal because of its significant effect on the responsibility of Virtual Machines (VMs). Scheduling of Virtual CPU uses the BOOST mechanism and drives priority inversion and interference to the delay-sensitive VM. To tackle these issues, various techniques and methodologies have been proposed. However, these techniques can excessively delay VMs because they only focus on preferentially processing the high-priority VM. This in turn can violate the Quality of Service (QoS) of a virtual machine with relatively low priority despite the small gap. Therefore, it is imperative to apply a delay bound mechanism. In this paper, we propose a delay-constrained scheduling algorithm to guarantee the QoS of virtual machines running in a real-time virtual machine environment by applying maximum delay. We also define those factors of the proposed algorithm that will affect the system's performance. The proposed algorithm can simultaneously ensure fast response time for high-priority tasks and improve the QoS of a low-priority virtual machine, with minimum overhead.

Transient and permanent faults in complex digital systems used for safety-critical applications may result in catastrophic effects. It becomes therefore extremely important to adopt techniques such as fault injection to observe the behavior of the system in the presence of faults. Several tools have been proposed in the literature that support fault injection. However, few of them allow observing complex computer-based systems. This paper presents current advances in this field, by focusing on Low Level Virtual Machine (LLVM) based fault injectors and FAUMachine. We give an overview of the LLVM environment, and two based fault injection tools: LLFI and KULFI. Moreover, we introduce FAUmachine as virtual machine that supports fault injection in different components of the system (memory, disk and network). We present limitations and difficulties of the tool, and we propose a new implementation that allows injecting faults into the register of the target processor. The paper concludes with a comparison between the fault injection tools based on virtual machine in a first level, and between the LLVM-based fault injection tools in a second level.

Grid computing is a new paradigm for distributed computing, and service has become building block of grid applications. However, current approaches can not free developers from low-level laborious work when building grid applications. We propose a service-oriented virtual machine called Abacus Virtual Machine to simplify the task of grid application development. As a language level virtual machine, it provides a service-oriented instruction set to abstract the operations on the services of a grid application. It also virtualizes services and creates a virtual global system image for grid applications, thus services can be transparently distributed and shared. In this way, Abacus Virtual Machine hides the cumbersome underlying details from programmers and reduces the complexity greatly in grid application development

Public Clouds are the backbone of the modern IT Industry. The modern tech start-ups to are heavily dependent on the Public Clouds as save the capital expenditure. Public Clouds offer a wide range of Virtual Infrastructure beginning from single core 0.25 GB RAM virtual machines to 128 cored 3904 GB RAM Virtual Servers aided with GPUs. Apart from costing, The performance of the virtual machines can impact on the services offered. The paper tries to analyse the performance of the Light virtual machines provided by the different cloud vendors and maps their ability to handle certain set of tasks. The prime objective is to compare the entry level virtual machines that are mostly used across the industry for the multiple purposes and find which is the efficient and productive. The systems under Test are the 1 GB RAM machines provided by the most popular Cloud service providers.

Resource provisioning in scalable cloud using bio-inspired artificial neural network model

As CMOS technology scales, the Increasingly smaller transistor components are susceptible to a variety of in-field hardware errors. Traditional redundancy techniques to deal with the increasing error rates are expensive and energy inefficient. To address this emerging challenge, many researchers have recently proposed the idea of relaxed hardware design and exposing errors to software. For such relaxed hardware to become a reality, it is crucially important for system software, such as the virtual machine hypervisor, to be resilient to hardware faults. To address the above fundamental software challenge in enabling relaxed hardware design, we are making a major effort in restructuring an important part of system software, namely the virtual machine hypervisor, to be resilient to faulty cores. A fault in a relaxed core can only affect those virtual machines (and applications) running on that core, but the hypervisor and other virtual machines remain intact and continue providing services. We have redesigned every component of Xen, a large, popular virtual machine hypervisor, to achieve such error resiliency. This paper presents our design and implementation of the restructured Xen (we refer to it as FTXen). Our experimental evaluation on real systems shows that FTXen adds minimum application overhead, and scales well to different ratios of reliable and relaxed cores. Our results with random fault injection show that FTXen can successfully survive all injected hardware faults.

This paper introduces HEMVM, an innovative heterogeneous blockchain framework that seamlessly integrates diverse virtual machines (VMs), including the Ethereum Virtual Machine (EVM) and the Move Virtual Machine (MoveVM), into a unified system. This integration facilitates interoperability while retaining compatibility with existing Ethereum and Move toolchains by preserving high-level language constructs. HEMVM’s unique cross-VM operations allow users to interact with contracts across various VMs using any wallet software, effectively resolving the fragmentation in user experience caused by differing VM designs. Our experimental results demonstrate that HEMVM is both fast and efficient, incurring minimal overhead (less than 4.4%) for intra-VM transactions and achieving up to 9,300 TPS for cross-VM transactions. Our results also show that the cross-VM operations in HEMVM are sufficiently expressive to support complex decentralized finance interactions across multiple VMs. Finally, the parallelized prototype of HEMVM shows performance improvements up to 44.8% compared to the sequential version of HEMVM under workloads with mixed transaction types.

Analyzing the (harm of) intrusion to enterprise servers is an onerous and error-prone work. Though dynamic taint tracking enables automatic fine-grained intrusion harm analysis for enterprise servers, the significant runtime overhead introduced is generally intolerable in the production workload environment. Thus, we propose PEDA (Production Environment Damage Analysis) system, which decouples the onerous analysis work from the online execution of the production servers. Once compromised, the "has-been-infected" execution is analyzed during high fidelity replay on a separate instrumentation platform. The replay is implemented based on the heterogeneous virtual machine migration. The servers' online execution runs atop fast hardware-assisted virtual machines (such as Xen for near native speed), while the infected execution is replayed atop binary instrumentation virtual machines (such as Qemu for the implementation of taint analysis). From identified intrusion symptoms, PEDA is capable of locating the fine-grained taint seed by integrating the backward system call dependency tracking and one-step-forward taint information flow auditing. Started with the fine-grained taint seed, PEDA applies dynamic taint analysis during the replayed execution. Evaluation demonstrates the efficiency of PEDA system with runtime overhead as low as 5%. The real-life intrusion studies successfully show the comprehensiveness and the precision of PEDA's intrusion harm analysis.