Hypervisors and Virtualization

Hypervisors Overview

• Hypervisors, also known as Virtual Machine Monitors (VMMs), are essential to virtualization technology.
• They enable multiple operating systems to share a single hardware host.
• A hypervisor manages and allocates physical resources like CPU, memory, and storage among VMs.
• Two main types exist: Type 1 (bare-metal) and Type 2 (hosted).
• Crucial for providing Infrastructure as a Service (IaaS) in cloud computing, allowing on-demand VM deployment and management.
• Hypervisors are central to modern computing architectures, creating isolated environments and optimizing server utilization.

Role in Cloud Computing Implementations

• Hypervisors provide the virtualization layer for creating and managing VMs on physical hardware.
• Cloud providers create and manage VMs for customers on a pay-as-you-go basis using Hypervisors.
• Hypervisors abstract physical hardware, allowing multiple virtualized instances to run on a single server in IaaS.
• In PaaS, the cloud provider uses virtualization technologies, abstracting the hypervisor layer from developers.
• SaaS providers use hypervisors to manage the infrastructure supporting their services.
• Desktops are virtualized by hypervisors in Desktop as a Service so end-users have remote access.

Functions and Benefits of Hypervisors

• Resource Virtualization: Allows for the creation of virtual instances with separate operating systems by abstracting physical resources.
• Isolation: Each VM operates independently, preventing interference with other VMs.
• CPU and Memory Management: Manages the allocation of CPU and memory resources among VMs for fair and efficient utilization.
• Device Emulation: VMs can interact with hardware resources via emulated or para-virtualized devices.
• Live Migration: VMs can be moved from one physical host to another without service interruption.
• Snapshot and Cloning: Creation of snapshots or clones of VMs are allowed for backup and testing.
• Security Isolation: VMs are isolated from each other to enhance security, preventing potential security breaches.
• Resource Scaling: VM resources are dynamically adjusted according to demand.

Types of Hypervisors

Type 1: Bare-Metal Hypervisors

• Bare-metal hypervisors (Type 1) run directly on the hardware of a physical server, without needing an OS.
• Installed as the first layer of software with direct host machine resource access.
• Direct hardware access optimizes resource utilization.
• Better performance and resource efficiency versus Type 2 hypervisors as there is no underlying host OS.
• Manages multiple VMs and provides isolation between them acting as a dedicated virtualization layer.
• Security is enhanced because direct hardware control reduces the attack surface compared to systems with additional OS layers.
• Used in data centers for server consolidation allowing resource utilization on a single server.
• Prevalent in enterprise environments, cloud data centers, and scenarios where performance and scalability are critical.
• Core component manages and allocates physical resources, abstracting hardware and providing a virtualized environment.
• VM Monitor oversees the execution of VMs and manages their interactions with hardware.
• Resource Scheduler allocates and manages physical resources based on predefined policies.
• Hypervisor API allows interaction with external management tools.
• Virtual Switches manage network traffic with features like VLAN support and network isolation.
• VMware ESXi is enterprise-class, and known for performance, scalability, and extensive feature sets.
• Microsoft Hyper-V Server is designed for virtualization in Windows environments.
• KVM (Kernel-based Virtual Machine) turns the Linux kernel into a hypervisor, commonly used in open-source and cloud environments.

Type 2: Hosted Hypervisors

• Hosted hypervisors (Type 2) run on top of a host operating system.
• They rely on an underlying OS for resource management.
• Ease of installation is better than bare-metal.
• Performance overhead because host OS introduces extra layer for virtualization.
• Common in development environments prioritizing ease of use and compatibility.
• VMs can run multiple OSs on a single machine.
• The hypervisor application itself is the core component running as a software layer on the host OS.
• The Virtual Machine Manager (VMM) configures virtual machines.
• Host OS manages hardware resources and provides a platform for the hypervisor.
• A hosted hypervisor relies on its OS for resource allocation.
• Hosted hypervisors are integrated with their OS by using device drivers to communicate with hardware.
• VirtualBox is Oracle's open-source, for desktop virtualization.
• VMware Workstation is a popular hosted hypervisor designed for running multiple operating systems.
• Parallels Desktop is a Mac OS hypervisor, able to run Windows alongside Mac OS.

Security Challenges for Hypervisors

• Securing hypervisors is essential that should prevent potential vulnerabilities and ensure the integrity of systems.
• Hypervisors are software and may have vulnerabilities for attackers to exploit to gain unauthorized access.
• VM escape attacks consist of an attacker leaving the machine to gain access to others.
• Misconfiguration in VMs may lead to isolation issues where one VM accesses anothers.
• Compromised virtual machine images can introduce security risks.
• Lack of environmental scanning can make it difficult to detect and respond to security incidents.
• No security patches for hypervisor software can lead to more possible security breaches.

Improving Hypervisor Security

• Regularly apply security patches and updates to address known vulnerabilities.
• Review and configure hypervisor settings securely and disable ones not needed.
• Implement access controls to limit access of the hypervisor and its associated interfaces.
• Secure the management protocol with strong passwords and encryption.
• Install network segmentation with intrusion detection and firewall prevention.
• Use digital signatures for firmware to assure it is properly untampered with hardware updates.
• Have backup configuration that has recovery procedures for the hypervisor, VMs and critical settings.