Inhyuk Kim

NOPFIT: File System Integrity Tool for Virtual Machine Using Multi-byte NOP Injection

File system integrity is very important to a system security, because it affects all users that share system files. Therefore, file system integrity tool (FIT) is widely used for host based file system monitoring. Recently, virtualization technology is applied to several computing areas such as server virtualization and cloud computing, and increasingly demands for a FIT. However, previous virtual machine FITs are not suitable for virtual machines, because its structure is insufficient to real-time file system monitoring. In this paper, we design and implement a NOPFIT: a FIT using a multi-byte NOP injection on lguest virtual machine. The multi-byte NOP is new debugging technique using undefined opcode exception. Our experimental results demonstrate that the NOPFIT has very low performance overhead. The results indicate that the NOPFIT is appropriate for real-time file system monitoring.

NHVM: Design and Implementation of Linux Server Virtual Machine Using Hybrid Virtualization Technology

The virtualization technology has been developed rapidly with the growth of the hardware supported virtualization technologies and the appearance of the various services. Many researchers are concentrating on developing the virtualization technologies which are recognized as the most significant core technology of the IT applications such as green IT and cloud computing. The major processor companies have introduced various hardware supported virtualization technologies for overcoming the limitations of the software virtualization technologies. Until now, however, the hardware supported virtualization technologies are used only for supporting the full-virtualization technologies. In this paper, we introduced our efficient server virtual machine, which merged the hardware supported virtualization technologies with conventional para-virtualization technologies. Through our proposed hybrid virtualization technology, we could reduce the complexity and overhead of traditional server virtual machines. And lastly, we evaluated and compared our proposed virtual machine with traditional server virtual machines through the experiments.

Light-weight kernel instrumentation framework using dynamic binary translation

Mobile platforms such as Android and iOS, which are based on typical operating systems, have been widely adopted in various computing devices from smart phones even to smart TVs. Along with this, the necessity of kernel instrumentation framework has also grown up for efficient development and debugging of a kernel itself and its components. Although the existing approaches are providing some information about the kernel state including physical register value and primitive memory map, it is hard for the developers to understand and exploit the information. Moreover, the excessive analysis overhead in the existing approach makes them impractical to be used in real systems. Meanwhile, there have been a few studies on analyzing the user-level applications using dynamic binary translation and they are now widely used. In this paper, by extending this idea of dynamic binary translation for user-level applications to the kernel, we propose a new dynamic kernel instrumentation framework. Our framework focuses on the modules such as device drivers, rather than the kernel itself, since the modules comprise a large portion of OS development. Because of the frequent execution of kernel modules, the dynamic kernel instrumentation framework should guarantee the quality of the translated target code. However, costly optimizations to achieve high execution performance are rather harmful to the overall performance. Therefore, in order to improve performance of both translations, we suggest light-weight translator based on pseudo-machine instruction representation and tabular-base translation instead of typical intermediate representation. We implement our framework on Linux system, and our experimental evaluations show that it could quite effectively instrument the target with nominal overhead.

MyAV: An all-round virtual machine monitor for mobile environments

Recently, various security issues in mobile devices have appeared due to improvement of the performance of mobile devices and the emergence of open mobile platforms. In this paper, we present MyAV, which is an all-round virtual machine monitor, to support various platforms from x86 desktops to ARM embedded platforms by minimizing the processor dependencies. It provides a secure execution environment using newly proposed technique of kernel-user address space separation. Many security vendors offer many different solutions including vaccine development for mobile devices, but it is still difficult to respond quickly to new malware. Another solution is resource isolation using virtual machine to share conventional hardware in a safe environment. However, existing virtual machines are unsuitable to be applied to mobile devices, because the original purpose of those virtual machines is based on server virtualization technology for operating a large number of guests. We present our design considerations using the resource isolation technique and report various experimental results based on the x86 desktop and an ARM embedded environment.

Design and Implementation of Networking Virtualization for Cluster File Systems

An effective network layer which reduces cluster file system complexity is definitely needed in cluster computing environments where more than thousands of nodes are connected on a variety of different networks. Therefore, widely used cluster file systems such as Lustre, PVFS2, and GlusterFS provide networking virtualization layer. Through networking virtualization layer, each node accesses other nodes using a single interface over a variety of networks. However, previous networking virtualization technologies are complicated and not portable. In this paper, we propose a simple, portable, and socket-like networking virtualization layer that operates on user-mode. We also evaluate our virtualization layer using benchmark tools.

A Cooperative Authentication of IPSec and SEND Mechanisms in IPv6 Environments

The IPv6 network protects the IP layer by using the IPSec protocol and the SEND mechanism. However each host should be authenticated repeatedly when the two mechanisms are used at the same time. In this paper, we propose a cooperation scheme to share the authentication information between the SEND mechanism and the IPSec protocol. By sharing the authentication data of the host with the SEND mechanism, IPSec protocol expects the cost reduction for establishing a secure communication channel. We also evaluate the performance of the proposed mechanism by implementing the cooperation scheme.

Hardware assisted dynamic memory balancing in virtual machines

Virtualization technology can reduce the total cost of ownership by sharing resources with respect to the resource demand of each guest. Therefore, an efficient resource sharing mechanism is important for a virtual machine monitor (VMM). We introduce a hardware assisted dynamic memory balancing mechanism that balances memory among guests. Our proposed scheme estimates memory demand for each guest and periodically re-balances memory allocation based on this estimation. In order to estimate working set size (WSS), we use least recently used (LRU) histogram as a prediction model. Construction of LRU histogram is performed in a guest transparent way by using hardware memory management unit (MMU) virtualization support. Our experiments show that the proposed scheme accurately estimates the WSS with low overhead. They also show that it substantially improves performance over static memory allocation.

Design and implementation of page sharing scheme between guests in virtualization environments

According to the development of virtualization technology and enhancement of hardware performance, there will be more and more guests on a host in virtualization environments. These guests use many common files and each file should be duplicated on each guest filesystem and memory. In order to eliminate these duplications of resources, many corporations and laboratories proposed several resource sharing schemes. However, there are some problems such as overhead and complexity. In this paper, in order to reduce such duplications, we propose a page sharing scheme optimized for executable files and libraries using shadow paging. Also, we validate our scheme with some evaluation results that show improvements in memory utilization and performance, through the implementation of the proposed scheme and experiments.

MyUT: Design and implementation of efficient user-level thread management for improving cache utilization

The appearance of the multicore processors and the advancement of multithread programming have lead the new paradigm of the system optimization. Especially, the cache performance has been known as the one of the most important factor of the system optimization. The user-level thread management, the unvirtualized thread and the exception-less system call are introduced to improve the cache utilization of the multithread programming and parallel programming. However, these schemes have some limitations on applications domain. So, we propose the general purpose user-level thread management scheme to reduce the context-switch, CPU-migration and synchronous system call which pollute the amount of caches. We show evaluation of our system on the three workloads. We show the performance improvements of about 10-20% in respect of the CPU, memory and IO intensive workloads and analyze the effects of the three policies and techniques through the experiments.

Strata: wait-free synchronization with efficient memory reclamation by using chronological memory allocation

A locking is the typical mechanism to coordinate the race between multiple threads. But it downgrades the overall system performance due to the waiting time for the locked data to be unlocked. Wait-free synchronization is the one of the schemes to cope with the locking cost. The basic idea is making a replica of the shared data in order to manipulate it, and then applying the updated data. Due to the allocation of replicas without waiting, the most cost consuming step of wait-free synchronization is the reclamation of memory. This paper presents strata, a wait-free synchronization scheme with efficient memory reclamation. It allocates memory in the chronological order for efficient reclamation, and guarantees both update and read side wait-free in O(1) execution time.