A Secure System-Wide Process Scheduler across Virtual Machines
A Secure System-Wide Process Scheduler across Virtual Machines
复制标题
DOI：
10.1109/prdc.2010.34
复制
发表时间：
2010-12
期刊：
影响因子：
--
通讯作者：
H. Tadokoro;Kenichi Kourai;S. Chiba
中科院分区：
文献类型：
--
作者：
H. Tadokoro;Kenichi Kourai;S. Chiba
使用虚拟机（vm）进行服务器整合使得难以按照管理员的意图执行进程。每个VM中的进程调度器不知道其他VM，只独立调度一个VM中的进程。为了解决这个问题，需要跨虚拟机进行进程调度。但是，这种系统范围的调度很容易受到来自受损虚拟机对其他虚拟机的拒绝服务攻击。在本文中，我们提出了一个运行在虚拟机监视器（VMM）中的安全的系统级进程调度程序——君主调度程序。Monarch调度程序监控进程的执行情况，并改变所有虚拟机的调度行为。为了从VMM更改进程调度，它在不修改客户机操作系统的情况下一致地操作运行队列和进程状态。它的混合调度通过利用虚拟机之间的性能隔离来减轻DoS攻击。我们证实，君主调度器可以实现有用的调度，开销很小。
Server consolidation using virtual machines (VMs) makes it difficult to execute processes as the administrators intend. A process scheduler in each VM is not aware of the other VM and schedules only processes in one VM independently. To solve this problem, process scheduling across VMs is necessary. However, such system-wide scheduling is vulnerable to denial-of-service (DoS) attacks from a compromised VM against the other VMs. In this paper, we propose the Monarch scheduler, which is a secure system-wide process scheduler running in the virtual machine monitor (VMM). The Monarch scheduler monitors the execution of processes and changes the scheduling behavior in all VMs. To change process scheduling from the VMM, it manipulates run queues and process states consistently without modifying guest operating systems. Its hybrid scheduling mitigates DoS attacks by leveraging performance isolation among VMs. We confirmed that the Monarch scheduler could achieve useful scheduling and the overheads were small.