Security and trust preserving inter‐ and intra‐cloud VM migrations

In Infrastructure-as-a-Service (IaaS) clouds, users manage the systems in virtual machines (VMs) called user VMs through remote management systems (RMSes). To allow users to manage their VMs during failures inside the VMs, IaaS usually provides out-of-band remote management. This management is performed indirectly via an RMS server in a privileged VM called the management VM. However, it is discontinued when a user VM is migrated. This is because an RMS server in the management VM at the source host is terminated on VM migration. Even worse, pending data is lost between an RMS client and a user VM. In this paper, we propose D-MORE for continuing out-of-band remote management across VM migration. D-MORE provides a privileged and migratable VM called DomR and performs out-of-band remote management of a user VM via DomR. During VM migration, it synchronously co-migrates DomR and its target VM and transparently maintains the connections between an RMS client, DomR, and its target VM. We have implemented D-MORE in Xen and confirmed that a remote user could manage his VM via DomR after the VM has been migrated. Our experiments showed that input data was not lost during VM migration and the overhead of D-MORE was acceptable.

Moving Target Defense (MTD) is a defensive mechanism based on dynamic system reconfiguration to prevent or thwart cyberattacks. In the last years, considerable progress has been made regarding MTD approaches for virtualized environments, and Virtual Machine (VM) migration is the core of most of these approaches. However, VM migration produces system downtime, meaning that each MTD reconfiguration affects system availability. Therefore, a method for a combined evaluation of availability and security is of utmost importance for VM migration-based MTD design. In this paper, we propose a Stochastic Reward Net (SRN) for the probability of attack success and availability evaluation of an MTD based on VM migration scheduling. We study the MTD system under different conditions regarding 1) VM migration scheduling, 2) VM migration failure probability, and 3) attack success rate. Our results highlight the tradeoff between availability and security when applying MTD based on VM migration. The approach and results may provide inputs for designing and evaluating MTD policies based on VM migration.

Recent developments in virtualization and communication technologies have transformed the way data centers are designed and operated by providing new tools for better sharing and control of data center resources. In particular, Virtual Machine (VM) migration is a powerful management technique that gives data center operators the ability to adapt the placement of VMs in order to better satisfy performance objectives, improve resource utilization and communication locality, mitigate performance hotspots, achieve fault tolerance, reduce energy consumption, and facilitate system maintenance activities. Despite these potential benefits, VM migration also poses new requirements on the design of the underlying communication infrastructure, such as addressing and bandwidth requirements to support VM mobility. Furthermore, devising efficient VM migration schemes is also a challenging problem, as it not only requires weighing the benefits of VM migration, but also considering migration costs, including communication cost, service disruption, and management overhead. This chapter provides an overview of VM migration benefits and techniques and discusses its related research challenges in data center environments. Specifically, the authors first provide an overview of VM migration technologies used in production environments as well as the necessary virtualization and communication technologies designed to support VM migration. Second, they describe usage scenarios of VM migration, highlighting its benefits as well as incurred costs. Next, the authors provide a literature survey of representative migration-based resource management schemes. Finally, they outline some of the key research directions pertaining to VM migration and draw conclusions.

Virtualization techniques effectively handle the growing demand for computing, storage, and communication resources in large-scale Cloud Data Centers (CDC). It helps to achieve different resource management objectives like load balancing, online system maintenance, proactive fault tolerance, power management, and resource sharing through Virtual Machine (VM) migration. VM migration is a resource-intensive procedure as VM’s continuously demand appropriate CPU cycles, cache memory, memory capacity, and communication bandwidth. Therefore, this process degrades the performance of running applications and adversely affects efficiency of the data centers, particularly when Service Level Agreements (SLA) and critical business objectives are to be met. Live VM migration is frequently used because it allows the availability of application service, while migration is performed. In this paper, we make an exhaustive survey of the literature on live VM migration and analyze the various proposed mechanisms. We first classify the types of Live VM migration (single, multiple and hybrid). Next, we categorize VM migration techniques based on duplication mechanisms (replication, de-duplication, redundancy, and compression) and awareness of context (dependency, soft page, dirty page, and page fault) and evaluate the various Live VM migration techniques. We discuss various performance metrics like application service downtime, total migration time and amount of data transferred. CPU, memory and storage data is transferred during the process of VM migration and we identify the category of data that needs to be transferred in each case. We present a brief discussion on security threats in live VM migration and categories them in three different classes (control plane, data plane, and migration module). We also explain the security requirements and existing solutions to mitigate possible attacks. Specific gaps are identified and the research challenges in improving the performance of live VM migration are highlighted. The significance of this work is that it presents the background of live VM migration techniques and an in depth review which will be helpful for cloud professionals and researchers to further explore the challenges and provide optimal solutions.

Impact of Factors Affecting Pre-copy Virtual Machine Migration Technique for Cloud Computing

Live Virtual Machine (VM) migration has significantly improved the flexibility of modern Data Centers (DC). However, seamless live migration of a VM between geo-distributed DCs faces several challenges due to difficulties in preserving the network configuration after the migration paired with a large network convergence time. Although SDN-based approaches can speed up network convergence time, these techniques have two limitations. First, they typically react to the new topology by installing new flow rules once the migration is finished. Second, because the WAN is typically not under SDN control, they result in sub-optimal routing thus severely degrading the network performance once the VM is attached at the new location. In this paper, we identify networking challenges for VM migration across geo-distributed DCs. Based on those observations, we design a novel long-haul VM migration scheme that overcomes those limitations. First, instead of reactively restoring connectivity after the migration, our SDN-based approach proactively restores flows across the WAN towards the new location with the help of EVPN and VXLAN overlay technologies. Second, the SDN controller accelerates the network convergence by announcing the migration to other controllers using MP-BGP control plane messages. Finally, the SDN controller resolves the sub-optimal routing problem that arises as a result of migration implementing a distributed anycast gateway. We implement our approach as extensions to the OpenDaylight controller. Our evaluation shows that our approach outperforms existing approaches in reducing the downtime by 400 ms and increasing the application performance up to 12 times.

CBase: Fast Virtual Machine storage data migration with a new data center structure

Virtual machine (VM) migration is a technique for transferring the execution state of a VM from one physical host to another. While VM migration is critical for load balancing, consolidation, and server maintenance in virtualized data centers, it can also increase security risks. During VM migration, an attacker with sufficient privileges can compromise a VM by modifying its memory contents during transit to subvert its applications or the guest operating system. One could maintain dedicated, and presumably more secure, control networks to carry the migration traffic, but at significant hardware and administrative complexity. Alternatively, one could encrypt the migration traffic, which eliminates the need for dedicated control networks, but might introduce performance overheads. To date, there has been no systematic study of how encryption affects VM migration, especially in high-bandwidth low-delay networks that are common within data centers. In this paper, we present a study of the impact of AES and 3DES encryption algorithms on two widely used live VM migration approaches -- pre-copy and post-copy. Our key findings are as follows. The encryption algorithm used can have a significant impact on the total migration time. The impact of encryption on downtime varies with the type of the migration technique. The overhead of encryption also depends upon the relative speeds of source and target machines. Finally, an application's performance within a VM during encrypted migration varies with the type of the application and the migration mechanism.

The big data era is presenting unprecedented opportunities for generating new revenues in various sectors ranging from health care, economics, life science, to manufacturing. Datacenters (DCs) are widely deployed to provision various application services as well as to process big data. Since more and more servers are installed in DCs, the cost of electricity incurs a financial burden for the DC operators. Many DCs are equipped with renewable energy to reduce the electricity bill. However, the locations of the energy demands do not match the locations of the renewable energy generation. This mismatch may be addressed by virtual machine (VM) migration. The DCs, which lack renewable energy, can migrate their workloads to other DCs, which have abundant renewable energy. In addition, DC operators always want to maximize revenue and minimize operation cost. In this paper, the problem of maximizing revenue and minimizing operation cost of a green DC network enabled with and without VM migration is formulated by integer linear programming. Simulation results show that optimal results can be reached for small size problems. Two heuristic algorithms are proposed to efficiently solve large size problems. To our best knowledge, this is the first study of the revenue driven VM management problem in green DC networks towards big data with VM migration.

Reconfigurations of virtual networks in cloud environments are enabled by virtual machine (VM) migration technologies. A lot of research work has focused on the implementation of VM migration (such as pre/post-copy techniques) and the determination of the destination hosts for the VM placement. The latter is often related to virtual network embedding (VNE) because it entails the mapping of virtual network functions and traffic flows on the physical substrate. However, a lack of consideration of VNE in the research on VM migration (and vice versa) still prevails. We consider this joint problem and observe that when one regards this as a multi-step model, remarkable benefits in terms of migration time, migration traffic volume, and even migration feasibility are obtained. In this paper, we present a heuristic algorithm to accelerate the solution and show that high-quality solutions can be achieved in polynomial time with suitable parameter settings.

Network resources and traffic priorities can be utilized to distribute requested tasks across edge nodes at the edge layer. However, due to the variety of tasks, the edge nodes have an impact on data accessibility. Resource management approaches based on Virtual Machine (VM) migration, job prioritization, and other methods were used to overcome this problem. A Minimized Upgrading Batch VM Scheduling (MSBP) has recently been developed, which reduces the number of batches required to complete a system-scale upgrade and assigns bandwidth to VM migration matrices. However, due to poor resource sharing caused by suboptimal VM utilization, the MSBP was unable to effectively ensure the global best solutions. In order to distribute resources and schedule tasks optimally during VM migration, this paper proposes the MSBP with Multi-objective Optimization of Resource Allocation (MORA) method. The major goal of this proposed methodology is to take into account different objectives and solve the Pareto-front problem to enhance lifetime of the fog-edge network. First, it formulates an NP-hard challenge for MSBP by taking into account a variety of factors such as network sustainability, path contention, network delay, and cost-efficiency. The Multi-objective Krill Herd optimization (MoKH) algorithm is then used to address the NP-hard issue using the Pareto optimality rule and produce the best solution. First, it introduces an NP-hard challenge for MSBP by accounting in network sustainability, path contention, network latency, and cost-efficiency. The Pareto optimality rule is then implemented to overcome the NP-hard problem and provide the optimum solution employing the Multi-objective Krill Herd optimization (MoKH) algorithm. This increases network lifetime and improves resource allocation cost efficiency. Finally, the simulation results show that the MSBP-MORA distributes resources more efficiently and hence increases network lifetime when compared to other traditional algorithms.

The rapid growth in cloud computing encourages the cloud provider to create more reliable, scalable and efficient cloud environment. For providing such a scalable environment, cloud provider develops large-scale Cloud Data Centers (CDC). Such CDCs consume a large amount of electrical energy for operational purpose and cooling purpose to keep the machines operating at a right temperature, but it also emits a large amount of carbon-dioxide. Thus to decrease the energy consumption, Virtual Machines (VMs) are consolidated to fewer numbers of active servers through VM migration techniques, this leads to Service Level Agreement (SLA) violation and performance degradation. Therefore to retain the energy-performance tradeoff, we should perform an optimum number of VM migrations. There are two cases when the VM migration performed: First when a hot spot is found and Second when a cold spot is found. But in both the cases we do not directly migrate the VM instead first we check whether it is required to migrate the VM. After that, the algorithm finds an appropriate destination host on which the VM will be migrated. In this paper, we implement three approaches to select destination host: First-fit, Best-fit, and Worst-fit. Finally compare the result of a number of VM migration performed, energy consumption and SLA violations with existing one.

Virtualization has been shown to be an attractive path to increase overall system resource utilization. The use of live virtual machine (VM) migration has enabled more effective sharing of system resources across multiple physical servers, resulting in an increase in overall performance. Live VM migration can be used to load balance virtualized clusters. To drive live migration, we need to be able to measure the current load imbalance. Further, we also need to accurately predict the resulting load imbalance produced by any migration.In this paper we present a new metric that captures the load of the physical servers and is a function of the resident VMs. This metric will be used to measure load imbalance and construct a load-balancing VM migration framework. The algorithm for balancing the load of virtualized enterprise servers follows a greedy approach, inductively predicting which VM migration will yield the greatest improvement of the imbalance metric in a particular step. We compare our algorithm to the leading commercially available load balancing solution - VMware's Distributed Resource Scheduler (DRS). Our results show that when we are able to accurately measure system imbalance, we can also predict future system state. We find that we can outperform DRS and improve performance up to 5%. Our results show that our approach does not impose additional performance impact and is comparable to the virtual machine monitor overhead.

A Service Sustainable Live Migration Strategy for Multiple Virtual Machines in Cloud Data Centers

Cloud providers generally run one or more Virtual Machine (VM) instances on the same physical machine. Though it increases data center utilization, it exposes VM to a co-location attack. VM placement and migration are the two strategies adopted for mitigating co-locations. Current methods for VM placement or VM migration consider only security as decision criteria and do not consider other factors like Quality-of-Service degradation, data center utilization, etc. This work proposes a placement and migration strategy for mitigation of co-location attacks with joint consideration of multi objectives like QoS, data center utilization, energy consumption, and security risks. A security-driven multi-criteria optimization -based VM placement policy is proposed. A joint consideration of multiobjective performance optimization along with co-location security risk minimization is done to design a novel VM placement policy based on user categorization. The policy can reduce the likelihood of co-location target VM with attacker VM without much degradation to the performance of VM and data center utilization. The solution mitigates co-location risks without much compromise to the performance of VM and data center resource utilization. The co-residence risk is mitigated by the categorization of users into three levels i.e. unlabeled, risky, and safe, and physical machines into two groups as safe and unsafe. The PMs available in data center is grouped into three different VM placement policies, they are undecided pool, safe pool and unsafe pool.