Proper And Efficient Utilization Of Hardware

Published Date: 02 Nov 2017

There are 2 main types of hypervisors, or architectures for hypervisors, which are;

Type-1 (Bare Metal or Native);

These are hypervisors that directly run on the host hardware infrastructure, and controls directly all the hardware components and monitors the host operating systems. In other words, it runs exactly between the hardware infrastructure and the guest operating systems. Typical examples of this hypervisor includes VMware ESXi, Oracle VM, Xen, and Microsoft Hyper-V.

Type-2 (Hosted);

These are hypervisors that run as guests themselves on another operating system. These hypervisors do not control the hardware infrastructure directly, but through the host operating system. In the case of this kind of hypervisor, it runs between the guest operating system and the host operating system and does not have any direct access to the physical hardware infrastructure. Typical examples of this hypervisor includes VMware Server, QEMU, VMware workstation, KVM, and Microsoft Virtual PC.

(Oracle® VM User’s Guide Release 3.0 for x86 E18549-03)

Diagram 1: Hypervisor Design (http://blogs.technet.com/b/chenley/archive/2011/02/09/hypervisors.aspx)

There are also several methods or techniques that are used to virtualize hardware and software, which are generally differentiated based on the layer of the system architecture on which the virtualization takes place. Some of these methods include;

Full Virtualization

This is a virtualization method in which the physical hardware system is completely virtualized such that the guest operating system believes it is running directly on the physical hardware. Every single feature of the hardware system is completely virtualized, including memory access I/O operations, complete instruction sets, and interrupts.

Para-virtualization (operating system assisted virtualization)

This virtualization method is achieved by virtualizing part of the physical hardware system. In para-virtualization, a software interface similar to the physical hardware is presented to the virtualized guest operating system. This allows just part of the guests’ operations which are more difficult to be performed in a virtualized infrastructure to be performed on the physical hardware.

Hardware assisted virtualization

This virtualization method allows the full virtualization of the hosts’ physical hardware platform through the assistance of recent hardware that have this capability. These hardware, with virtualization support, are mostly the host processors. Other terms for hardware assisted virtualization include; native virtualization, and accelerated virtualization.

At present, the increased use of virtualization technologies is accelerated by the many advantages it offers and the need to cut down on operational costs by almost all organizations. Some of the advantages virtualization presents include;

Proper and efficient utilization of hardware.

The simplification of operations such as backups and migrations.

Reduction in operational costs.

Although virtualization has all these advantages and a lot more, it is not without its own set of shortcomings. Virtualization presents several security vulnerabilities due to the number of operational layers added. As such, the need for increased security controls and management is required. One of the major advantages of virtualization, which is the ability to run several operating systems on one physical infrastructure can also present itself as a very big security vulnerability. A lot of virtualization technologies provide the ability of virtualized operating systems to share data between them. This capability can be exploited and the whole virtual infrastructure compromised if it is not monitored and secured properly.

This thesis is aimed at presenting certain security issues that are related to virtualization technologies. The paper will also attempt to provide recommendations on how to best implement virtual infrastructures and how to secure them.

Introduction

Purpose and Scope

As indicated above, the purpose and scope of this thesis is to present the certain security issues that are related to virtualization technologies. And the thesis will also attempt to provide recommendations on how to best implement virtual infrastructures and how to secure them. In this paper, only some of the virtualization technologies available today will be discussed.

Audience

The intended audience for this document is system and security administrators, security program managers, information system security officers, and others who have responsibilities for or are otherwise interested in the security of server or desktop full virtualization technologies.

This document assumes that readers have some operating system, networking, and security expertise. Because of the constantly changing nature of full virtualization technologies, readers are encouraged to take advantage of other resources (including those listed in this document) for more current and detailed information.