This thesis explores the utility of interest management in peer-to-peer environments. Specifically, it proposes: a model for formulaic specification of interest criteria that is implementation neutral in terms of underlying interest operators (the functions that determine the satisfaction of interest); and, an interest management propagation model that ensures the specifications (termed formula interest expressions) are only sent to those DVE components that are likely to be able to satisfy the interest criteria. This selective propagation model uses a distributed index of supported interest operators to determine candidate remote filterers. Remote filtering ensures that a state change message is only sent if it meets the interest criteria previously expressed by the intended recipient. The selective remote filtering model requires no central infrastructure and is entirely supported by peer DVE components, which may join and leave the DVE dynamically. The performance of the proposed propagation model, in terms of the number of logical messages required, is compared to the only existing propagation model where interest expressions are simply sent to all participating DVE components. Analysis reveals that for stable long-lived DVEs the proposed model can significantly messaging overhead and thereby increase the potential scale-up of the DVE. The viability of the proposed model is examined by means of proof-of-concept system, which exercises the specification and propagation models over a range of values for key variables. / Doctor of Philosophy (PhD)

Virtualization environments have become basic building blocks in consolidated data centers and cloud computing infrastructures. By running multiple virtual machines (VMs) in a shared physical machine, virtualization achieves high utilization of hardware resources and provides strong isolation between virtual machines. This dissertation discusses the implementation and the evaluation of an approach, called kernel service outsourcing, which improves the performance and the reliability of guest systems in the virtualized, multi-kernel environments. Kernel service outsourcing allows applications to exploit OS services from an external kernel existing in the shared system, not limiting application OS service requests to the local kernel. Because external kernels may provide more efficient services than the local kernel does, kernel service outsourcing provides new opportunities with applications in the guest OS for better performance. In addition, we apply the kernel service outsourcing technique to implement natural diversity, improving the reliability of the virtualized systems. We present two major benefits of kernel service outsourcing. First, we show that I/O service outsourcing can significantly improve the I/O performance of guest OSes by up to several times. In some important cases, the performance of network applications in the guest OS using network outsourcing was comparable to that of native OS (Linux). We also apply kernel service outsourcing between Windows and Linux, and show that kernel service outsourcing is viable even with two heterogeneous OS kernels. In addition, we study further performance optimization techniques that can be achieved in the external kernel when certain OS services are outsourced to the external kernel. The second benefit of kernel service outsourcing is to improve system reliability through natural diversity created by the combination of different kinds of the OS kernel implementations. Because OS services can be outsourced to different versions or even heterogeneous types of OS kernel for equivalent functions, malicious attacks that aim to exploit certain vulnerabilities in specific versions of OS kernels would not succeed in the outsourced kernels. Our case studies with Windows and Linux show that kernel service outsourcing was able to prevent the malicious attacks designed to exploit implementation-dependent vulnerabilities in the OSes from becoming successful in the outsourced systems.

In this thesis, we address the problem faced by modern operating systems due to the exploitation of Hardware-Assisted Full-Virtualization technology by attackers. Virtualization technology has been of growing importance these days. With the help of such a technology, multiple operating systems can be run on a single piece of hardware, with little or no modification to the operating system. Both Intel and AMD have contributed to x86 full-virtualization through their respective instruction set architectures. Hardware virtualization extensions can be found in almost all x86 processors these days. Hardware virtualization technologies have opened a whole new frontier for a new kind of attack. A system hacker can abuse hardware virualization technology to gain control over an operating system on-the-fly (i.e., without a system restart) by installing a thin Virtual Machine Monitor (VMM) below the native operating system. Such a VMM based malware is termed a Hardware-Assisted Virtual Machine (HVM) rootkit. We discuss the technique used by a rootkit named Blue Pill to subvert the Windows Vista operating system by exploiting the AMD-V (codenamed "Pacifica") virtualization extensions. HVM rootkits do not hook any operating system code or data regions; hence detecting the existence of such malware using conventional techniques becomes extremely difficult. This thesis discusses existing methods to detect such rootkits and their inefficiencies. In this work, we implement a proof-of-concept HVM rootkit using Intel-VT hardware virtualization technology and also discuss how such an attack can be defended against by using an autonomic architecture called SHARK, which was proposed by Vikas et al., in MICRO 2008.

Thesis (Ph. D.)--Rutgers University, 2009. / "Graduate Program in Computer Science." Includes bibliographical references (p. 123-130).

Network virtualization and overlay networks have emerged as powerful tools for improving the flexibility of the Internet. Overlays are used to provide a wide range of useful services in today's networking environment, and they are also viewed as important building blocks for an agile and evolvable future Internet. Regardless of the specific service it provides, an overlay needs assistance in several areas in order to perform properly throughout its existence. This dissertation focuses on the mechanisms underlying the provision of auxiliary support services that perform control and management functions for overlays, such as overlay assignment, resource allocation, overlay monitoring and diagnosis. The priorities and objectives in the design of such mechanisms depend on network conditions and the virtualization environment. We identify opportunities for improvements that can help provide auxiliary services more effectively at different overlay life stages and under varying assumptions. The contributions of this dissertation are the following: 1. An overlay assignment algorithm designed to improve an overlay's diagnosability, which is defined as its property to allow accurate and low-cost fault diagnosis. The main idea is to increase meaningful sharing between overlay links in a controlled manner in order to help localize faults correctly with less effort. 2. A novel definition of bandwidth allocation fairness in the presence of multiple resource sharing overlays, and a routing optimization technique to improve fairness and the satisfaction of overlays. Evaluation analyzes the characteristics of different fair allocation algorithms, and suggests that eliminating bottlenecks via custom routing can be an effective way to improve fairness. 3. An optimization solution to minimize the total cost of monitoring an overlay by determining the optimal mix of overlay and native links to monitor, and an analysis of the effect of topological properties on monitoring cost and the composition of the optimal mix of monitored links. We call our approach multi-layer monitoring and show that it is a flexible approach producing minimal-cost solutions with low errors. 4. A study of virtual network embedding in software defined networks (SDNs), identifying the challenges and opportunities for embedding in the SDN environment, and presenting two VN embedding techniques and their evaluation. One objective is to balance the stress on substrate components, and the other is to minimize the delays between VN controllers and switches. Each technique optimizes embedding for one objective while keeping the other within bounds.

Multicore servers in datacenter systems are routinely used to run multiple disparate application workload mixes. Analysis performed in Google's datacenters show, for instance, components (i.e., processes) of up to 19 distinct applications to be co-deployed on a single multicore node. Virtualization technology further encourages this trend, increasing platform utilization via higher levels of workload consolidation. Systems software on these shared server nodes must meet challenges that include (a) providing end-to-end performance guarantees for possibly multiple applications and delivering global platform-level properties such as platform-level power or utilization caps., (b) mediating use of shared resources efficiently while offering isolation guarantees for multiple applications running on consolidated platforms to maintain their performance properties predictably, and (c) meeting multiple dynamic competing application performance levels and platform-level properties efficiently, especially in oversubscribed systems. The goals of this thesis addresses (a)-(c) as follows: (1) by developing system-level mechanisms for addressing challenges (a)-(c), (2) by demonstrating their ability to deliver improved application performance with less variability and improved platform efficiency, and (3) by creating principles and representative methods for realizing the isolation properties sought by applications and the efficiency sought for platforms. The concrete realization of these goals is a Virtual Platforms (VP) enabled hypervisor - where per application or platform-level policy objectives are expressed at the system-level via elastic resource abstractions, which may also change dynamically during system runtime. For multiple consolidated applications (and their virtual platforms), there are methods that monitor and mediate their use of shared platform resources to deliver improved isolation for predictable performance, while Merlin: a resource allocator for shared multicore servers makes it easier to implement higher-level arbitration policies while meeting multiple performance and platform properties. As single-node multicore platforms evolve further from small numbers of homogeneous cores toward multiple sets or islands of potentially heterogeneous cores residing on a single chip, such platforms will have multiple resource managers managing their respective `islands' of resources. Though geared toward improved scalability and functionality, for applications spanning across multiple diverse resource islands to realize such opportunities, systems software must make it easier for them to interact with the island managers; and also help islands based systems achieve end-to-end performance properties via joint coordination amongst their island managers. In order to meet the challenges in maintaining performance objectives on future `scale-out' platforms, this thesis contributes inTune: a framework for inter-island operation, offering APIs and mechanisms that permit applications (and their virtual platforms) to interface with resource islands and their resource managers to jointly achieve application performance guarantees and global platform-level properties. This thesis focuses on the management of compute, physical memory and memory bandwidth resources of single node server platforms, however the methods presented in this work can be extended to other resource types including network and storage resources. InTune and Virtual-Platforms are implemented in the Xen hypervisor for x86 multi-core platforms with multiple NUMA memory nodes. Evaluation with representative parallel, web-based, and real-time applications and application mixes demonstrate the benefits of using our methods to achieve application performance and platform policy objectives.

To abstract physical into virtual computing infrastructures is a longstanding goal. Efforts in the computing industry started with early work on virtual machines in IBM's VM370 operating system and architecture, continued with extensive developments in distributed systems in the context of grid computing, and now involve investments by key hardware and software vendors to efficiently virtualize common hardware platforms. Recent efforts in virtualization technology are driven by two facts: (i) technology push -- new hardware support for virtualization in multi- and many-core hardware platforms and in the interconnects and networks used to connect them, and (ii) technology pull -- the need to efficiently manage large-scale data-centers used for utility computing and extending from there, to also manage more loosely coupled virtual execution environments like those used in cloud computing. Concerning (i), platform virtualization is proving to be an effective way to partition and then efficiently use the ever-increasing number of cores in many-core chips. Further, I/O Virtualization enables I/O device sharing with increased device throughput, providing required I/O functionality to the many virtual machines (VMs) sharing a single platform. Concerning (ii), through server consolidation and VM migration, for instance, virtualization increases the flexibility of modern enterprise systems and creates opportunities for improvements in operational efficiency, power consumption, and the ability to meet time-varying application needs. This thesis contributes (i) new technologies that further increase system flexibility, by addressing some key problems of existing virtualization infrastructures, and (ii) it then directly addresses the issue of how to exploit the resulting increased levels of flexibility to improve data-center operations, e.g., power management, by providing lightweight, efficient management technologies and techniques that operate across the range of individual many-core platforms to data-center systems. Concerning (i), the thesis contributes, for large many-core systems, insights into how to better structure virtual machine monitors (VMMs) to provide more efficient utilization of cores, by implementing and evaluating the novel Sidecore approach that permits VMMs to exploit the computational power of parallel cores to improve overall VMM and I/O performance. Further, I/O virtualization still lacks the ability to provide complete transparency between virtual and physical devices, thereby limiting VM mobility and flexibility in accessing devices. In response, this thesis defines and implements the novel Netchannel abstraction that provides complete location transparency between virtual and physical I/O devices, thereby decoupling device access from device location and enabling live VM migration and device hot-swapping. Concerning (ii), the vManage set of abstractions, mechanisms, and methods developed in this work are shown to substantially improve system manageability, by providing a lightweight, system-level architecture for implementing and running the management applications required in data-center and cloud computing environments. vManage simplifies management by making it possible and easier to coordinate the management actions taken by the many management applications and subsystems present in data-center and cloud computing systems. Experimental evaluations of the Sidecore approach to VMM structure, Netchannel, and of vManage are conducted on representative platforms and server systems, with consequent improvements in flexibility, in I/O performance, and in management efficiency, including power management.

Nominally, one can expect any user of modern technology to at least carry a handheld device of the class of an iPAQ (perhaps in the form of a cellphone). The availability of technology in the environment (home, office, public spaces) also continues to grow at an amazing pace. With advances in technology, it is feasible to remain connected and enjoy services that we care about, be it entertainment, sports, or plain work, anytime anywhere. We need a system that supports seamless migration of services from handhelds to the environment (or vice versa) and between environments. Virtualization technology is able to support such a migration by providing a common virtualized interface on both source and destination. In this dissertation, we focus on two levels of virtualization to address issues for seamless mobility. We first identify three different kinds of spaces and three axes to support mobility in these spaces. Then we present two systems that address these dimensions from different perspectives. For middleware level virtualization, we built a system called MobiGo that can capture the application states and restore the service execution with saved states at the destination platform. It provides the architectural elements for efficiently managing different states in the different spaces. Evaluation suggested that the overhead of the system is relatively small and meets user's expectation. On the other hand, for device level virtualization, Chameleon is a Xen-like system level virtualization system to support device level migration and automatic capability adaptation at a lower level. Chameleon is able to capture and restore device states and automatically accommodate the heterogeneity of devices to provide the migration of services. Device level virtualization can address some issues that cannot be addressed in middleware level virtualization. It also has less requirements than middleware level virtualization in order to be applied to existing systems. Through performance measurements, we demonstrate that Chameleon introduces minimal overhead while providing capability adaptation and device state migration for seamless mobility in ubiquitous computing environments.

Mobile computing devices like handhelds are becoming ubiquitous and so is computing embedded in cyber-physical systems like cameras, smart sensors, vehicles, and many others. Further, the computation and communication resources present in these settings are becoming increasingly powerful. The resulting, rich execution platforms are enabling increasingly complex applications and system uses. These trends enable richer execution platforms for running ever more complex distributed applications. This thesis explores these opportunities (i) for cooperative mobile platforms, where the combined resources of multiple computing devices and the sensors attached to them can be shared to better address certain application needs, and (ii) for distributed platforms where opportunities for cooperation are further strengthened by virtualization. The latter offers efficient abstractions for device sharing and application migration that enable applications to operate across dynamically changing and heterogeneous systems without their explicit involvement. An important property of cooperative distributed platforms is that they jointly and cooperatively provide and maintain the collective resources needed by applications. Another property is that these platforms make decisions about the resources allocated to certain tasks in a decentralized fashion. In contrast to volunteer computing systems, however, cooperation implies the commitment of resources as well as the commitment to jointly managing them. The resulting technical challenges for the mobile environments on which this thesis is focused include coping with dynamic network topology, the runtime addition and removal of devices, and resource management issues that go beyond resource usage and scheduling to also include topics like energy consumption and battery drain. Platform and resource virtualization can provide important benefits to cooperative mobile platforms, the key one being the ability to hide from operating systems and applications the complexities implied by collective resource usage. To realize this opportunity, this thesis extends current techniques for device access and sharing in virtualized systems, particularly to improve their flexibility in terms of their ability to make the implementation choices needed for efficient service provision and realization in the mobile and embedded systems targeted by this work. Specifically, we use middleware-based approaches to flexibly extend device and service implementations across cooperative and virtualized mobile platforms. First, for cooperating platforms, application-specific overlay networks are constructed and managed in response to dynamics at the application level and in the underlying infrastructure. When virtualizing these platforms, these same middleware techniques are shown capable of providing uniform services to applications despite platform heterogeneity and dynamics. The approach is shown useful for sharing and remotely accessing devices and services, and for device emulation in mobile settings.

Thesis (D.Phil.(Computer Science))--University of Pretoria, 2006. / Includes bibliographical references.