Coordinated and Secure Server Consolidation Using Virtual Machines

Server consolidation using virtual machines (VMs) can improve resource utilization by sharing physical resources. Each VM is isolated from the others for security and VMs can be easily migrated for load balancing. Since there are several VMs in a physical machine, the virtual machine monitor (VMM) multiplexes the physical resources among VMs according to system settings. The administrators determine the system settings and manage the VMs for suspension, resumption, or migration using a privileged VM called the management VM. In this situation, each VM is influenced from VMs coexisting in the same machine. For performance, processes in one VM can compete with processes in other VMs for CPUs because VMs share physical CPUs. For security, due to the privileges of the management VM, sensitive information in the VMs may leak via the management VM. If the attackers intrude in the management VM, they can easily steal sensitive information from the VM’s memory. To address these problems, this thesis proposes coordinated and secure server consolidation. Our VMM provides a system-wide process scheduler called the Monarch scheduler and a secure memory manager called VMCrypt. The design principle of these systems is reducing the functionalities implemented in the VMM. The Monarch scheduler uses the existing process schedulers in guest operating systems (OSes) as a part of it and changes the behaviors of the minimum number of processes. It mediates CPUs among processes in different VMs to achieve system-wide scheduling policies. To control the execution of processes, it suspends and resumes processes by using a technique called direct kernel object manipulation (DKOM). To hide the details of DKOM for various guest OSes, the Monarch scheduler provides a high-level API for writing scheduling policies. On the other hand, VMCrypt