Resource Management for Isolation Enhanced Cloud Services Enhanced - PowerPoint PPT Presentation

Resource Management for Isolation Enhanced Cloud Services Enhanced Cloud Services Himanshu Raj , Ripal Nathuji, Abhishek Singh, Paul England XCG, Microsoft Research

Motivation � Isolation issues in shared-resource computing infrastructures Service SLA Service SLA Service Providers Infrastructure Provider Raj et al.:Isolation Enhanced Cloud Services 2

Motivation � Side-channel attacks compromising performance and security Isolation � DoS, Information leak (key stealing not shown for VMs yet) Areas lacking: � SLA specification � Isolation mechanisms � Resource management Raj et al.:Isolation Enhanced Cloud Services 3

Proposed Solution � Isolation attributes part of the SLA � Mechanisms for better isolation � Enhanced resource management � Include constraints based on isolation attributes � Include constraints based on isolation attributes Raj et al.:Isolation Enhanced Cloud Services 4

SLA Isolation Attributes � Degree of hardware fault resistance (n) � Type: Integer, e.g., n = 5 � Cache-based side channel attack avoidance � For DoS and Information leakage avoidance � For DoS and Information leakage avoidance � Type: Boolean Raj et al.:Isolation Enhanced Cloud Services 5

Enforcing Cache Isolation Main Memory Shared L3 Shared L3 Shared L3 Shared L3 L2 L2 L2 L2 L2 L2 L2 L2 L1D L1D L1D L1D L1D L1D L1D L1D � Cache hierarchy aware core assignment � Page-coloring based cache partitioning Raj et al.:Isolation Enhanced Cloud Services 6

Cache Hierarchy Aware Core Assignment Main Memory Shared L3 Shared L3 L2 L2 L2 L2 L2 L2 L2 L2 L1D L1D L1D L1D L1D L1D L1D L1D Raj et al.:Isolation Enhanced Cloud Services 7

Page-coloring Based Cache Partitioning Main Memory Shared L3 Shared L3 L2 L2 L2 L2 L2 L2 L2 L2 L1D L1D L1D L1D L1D L1D L1D L1D Raj et al.:Isolation Enhanced Cloud Services 8

Results: No Isolation 180 Target VM + 160 Perturbation VM (1 Thread) 140 120 Execution Time (s) Target VM + Perturbation VM (2 100 Threads) 80 Target VM + Ex Perturbation VM (3 Perturbation VM (3 60 60 Threads) 40 Target VM 20 0 Working Set Size Shared L3 L2 L2 L2 L2 L1D L1D L1D L1D 9

Results: Cache-coloring 180 160 Target VM + Perturbation 140 VM (1 Thread) Execution Time (s) 120 Target VM + Perturbation 100 VM (2 Threads) 80 Target VM + Perturbation 60 60 Ex VM (3 Threads) 40 Target VM 20 0 Working Set Size Shared L3 L2 L2 L2 L2 L1D L1D L1D L1D 10

Integration with VM Placement System � Constraints on resources Blade � New isolation constraints � 4000 blade cloud, <80% Processor Domains Available Processors Fault Domain utilization, ~30-40 ms for Available Memory Available Memory search without search without D1 … backtracking (with high success probability) Page Color Domains Available Current VMs � Working on other heuristics for CSP with … P1 system dynamism � Migration Current VMs Capacity Available Raj et al.:Isolation Enhanced Cloud Services 11

Conclusions � Incorporation of isolation attributes in the SLA � System-level mechanisms to address isolation � RM enhancements with isolation related constraints constraints Raj et al.:Isolation Enhanced Cloud Services 12

rhim@microsoft.com Raj et al.:Isolation Enhanced Cloud Services 13