Server Virtualization - Term Paper Example

INTRODUCTION The rise of popularity of networked systems has spurred an increase in client/server applications. Dividing the functionality into clients and servers allows each to be specialized. The average computer user employs client/server applications on a daily basis, whether it is surfing on the web, retrieving email messages, or reading and writing files from a network file server. In any computing system, there is always room for improvement. Existing systems can be made more reliable, more efficient, more secure, or new and innovative features can be added. However, the very nature of client/server applications implies that multiple computers are involved and linked together by standardized protocols (Wolf and Halter, 2005). Modifying an existing service is an onerous task, oftentimes involving modifications to the clients and servers. Frequently these modifications must take place in the operating system kernel of other core components, which is not a viable solution for many end-users. Furthermore, many clients and servers are closed-source commercial products for which modification is not an option. The solution is to modify the service outside of the domain of the clients or the servers (Hoopes et al, 2009). A third entity, called a server virtualizer, is interposed between the clients and the servers. The virtualizer intercepts the service’s network packets and modifies them to introduce new features or improve existing properties of the service. Because the virtualizer is separate from and independent of the clients and servers, the clients and servers do not need to be modified. In theory, the virtualizer may be co-located with the clients or the servers, but the natural location of the virtualizer is in the network on a programmable router, located along the network path between client and server. UNDERSTANDING SERVER VIRTUALIZATION From the practical perspective, a service consists of two endpoints, the client and the server. A service is exported by the server, and used by the client. In most computer networks, the clients and servers are not directly connected, but the messages between them are routed through a series of network routers or switches. Virtualization is a technique that is used to alter one or more properties of the service, without modification to the clients or servers. In order to do this, a third component, called the virtualizer (see Figure 1), is interposed between the clients and servers (Hoopes et al, 2009). Figure 1: A virtualizer is interposed between the client and server. The virtualizer intercepts the network traffic between the clients and servers and modifies the properties of the service. In order to attain the goal of unmodified clients and servers, several restrictions must be placed on the virtualizer. First, the actual syntax of the virtualized service must be compatible with the existing implementations. For example, it is not possible to add or remove headers or data from the network packets or to rearrange the syntax of the existing headers. Second, existing application programs must continue to work with the new service. It would make little sense to modify the service to such an extent that the end user had to install new application software or use new tools that he is unfamiliar with. TYPES OF SERVER VIRTUALIZATIONS The concept of virtualization is open-ended; one can imagine many different kinds of modifications that can be performed to a network service. This paper examines several different types of virtualizations. These should not be seen as an exhaustive list, but as a set of examples intended to demonstrate the range of virtualizations that can be achieved. Translation. Translation transforms the syntax of the network service from one protocol to another. Translation of a service is analogous to translation of a human language, such as a translation between English and Spanish. For example consider the NFS protocol and the HTTP protocol that is used for the web. The protocols are inherently different: NFS is based on RPC and UDP, with iterative access to the contents of files, while HTTP is based on TCP and favors retrieval of the whole of the contents of a web page as one large chunk (Wolf and Halter, 2005). Converting the syntax of NFS to HTTP or vice-versa is an example of translation. Aggregation. Aggregation involves combining the resources of several independent services and creating the illusion of a single unified service. For example, we can use several file servers to store users’ home directories, and then aggregate those servers to create a single cohesive view of the home directory space. Replication. Replication is similar to aggregation in that independent services are combined to appear as a single service. However, rather than appearing as a single larger service, replication appears as a single more reliable service. Consider several file servers that store duplicate content, a technique generally referred to as mirroring. If one server should fail, another server can take its place. Fortification. Fortification enhances the resistance of a service to some form of attack. For example, consider a server that is subject to a denial of service attack. A fortifying virtualizer can monitor usage of the server, detect which clients are causing excessive resource consumption, and throttle those clients back so that they do not interfere with legitimate clients. OVERLAY NETWORKS AND PROGRAMMABLE ROUTERS To support virtualization without modifying the clients or servers, virtualization must be performed on an intermediate computer located in the network between the clients and servers. There are two ways of doing this: overlay networks (Zhao et al, 2004) or programmable networks. An overlay network (see Figure 2) is created by inserting additional computers called overlay nodes into the network and explicitly routing the packets through the new computers. As an alternative to installing new computers, slices of existing computers connected to the network may also be used as overlay nodes. For example, assume a client wishes to communicate with a server via a virtualizer. The virtualizer is placed on an overlay node and inserted into the network. The client is configured to connect to the overlay node instead of the server. The overlay node that runs the virtualizer is responsible for performing the virtualization and forwarding the packets to the server. The return path must also go through the overlay node. This can be done either by using a custom implementation of the server, or by having the overlay node act as a virtual client so that the server believes the request came from the overlay node. Overlay networks have the advantage that they are flexible and can be implemented with simple user-mode programs on commodity hardware. However, they have the disadvantage that they are not fully transparent to the clients and servers, because the clients and servers need to be modified to support the overlay routing. To an extent this lack of transparency can be mitigated by using an automated tool to maintain the routing on the clients and servers. However, the introduction of an automated tool is itself a lack of transparency. Figure 2: Overlay Network. An overlay network is formed by adding additional computers, or overlay nodes, to the network and explicitly routing traffic through the overlay node. Bold arrows show the path of a packet from the client to the server. Programmable routers solve the lack of transparency in overlay networks by using an existing network component, the router, to serve as a platform for the virtualizer without requiring the introduction of a new machine. Routing is an automatic function of the IP protocol. When the client communicates with the server, the IP packets are routed in a best-effort path from client to server through a series of routers. Generally speaking, clients and servers do not need to be reconfigured when new routers are inserted or removed from the network; the routing protocols within IP automatically adjust for insertion and removal of routers (Wolf and Halter, 2005). The fact that these routers already exist in the network makes them ideal locations for the virtualizer. Traditional routers are static and inflexible, but new technologies such as programmable routers (Kohler et al, 2000) and active networks (Tennenhouse et al, 1997) make routers dynamic and capable of executing arbitrary programs when routing packets. In the extreme case, each network packet contains a small program that the router executes to route the packet. Less extreme proposals add the ability to install custom modules into the router that change the routing functionality. In this way, the virtualizer is written as a module and downloaded to the router. The router is then customized and includes all of the functionality necessary to perform the virtualization. The clients and servers do not need to be reconfigured, because they are already communicating via the router. NETWORK FILE SERVICE VIRTUALIZATION The typical user employs a variety of client/server services, each of which is a candidate for virtualization. The web provides access to websites on the Internet, and is likely the most common and familiar service that users interact with on a daily basis. Also popular is email service, in which users send and retrieve email to and from servers. The domain name service (DNS) is used to resolve Internet host names into IP addresses. The network file service provides file and directory storage servers to their clients. Clients read and write file contents across the network from the file server’s disk. This provides several benefits vs. storing files on the client’s local disk. The file server computer is typically more reliable than the client due to special fault-tolerant software or hardware. The file server also allows the user to migrate from one client computer to another and still access his files. Finally, many clients can connect to a single file server and share access to a common set of files. The pervasiveness of network file systems makes them an ideal vehicle to demonstrate the viability of the virtualization techniques. The Network File System (or NFS) (Sandberg et al, 1985) is the de-facto network file system for UNIX, and normally serves as adequate vehicle to demonstrate the virtualization techniques. There are several possible alternatives, including the Server Message Block (or SMB) protocol that is commonly used by Microsoft Windows, but the wide support base of NFS and the volume of existing reference implementations make NFS preferable (Wolf and Halter, 2005). SERVER VIRTUALIZATION: EXAMPLE OF GECKO Gecko is an NFS/HTTP translation virtualization. It performs a translation between the NFS protocol that is commonly used as a network file service and the HTTP protocol that is used to browse web pages. The prime motivation for Gecko is a lack of accessibility to the web from common UNIX applications. Most UNIX applications expect to use standard file system semantics to read and write content. Enabling these applications to use the web requires significant modification and recompilation. Gecko solves this problem by translating the HTTP protocol into the NFS protocol that can be accessed directly by the client operating system. Once a Gecko file system is mounted, existing applications can access web pages, images, and other web objects as if they were stored in the file system. Existing applications can be used without modification or recompilation. In fact the existing applications are not even aware that the content they are accessing resides remotely on a web server. Two prototypes of Gecko were implemented, called Gecko-I (Baker and Hartmann, 1999) and Gecko-II (Baker and Hartmann, 2001). The first prototype, Gecko-I, suffered from reliability and scalability problems. Gecko-I maintains a data structure, called the handle table, that stores a considerable amount of state. If the Gecko-I translator fails, the handle table is lost and cannot be regenerated, leading to failure of the applications on the client computers. Similarly, maintaining the large amount of state led to a scalability problem in maintaining the large data structure. This led to an important design goal in virtualization, that the amount of state on the virtualizer should be minimized to improve reliability and scalability. The second prototype, Gecko-II, was implemented to solve the deficiencies of Gecko-I. The size of the state is reduced using a novel compression mechanism to compress the state so that it fits in the NFS handles that are stored on the client. This improves the reliability and scalability by converting hard state into soft state, allowing the state to be regenerated in the case of a failure. Both the Gecko-I and Gecko-II prototypes were evaluated and determined to provide a useful translation service. Users can mount the web via Gecko on their computers and use standard UNIX commands to operate on web pages. The “cat” command can display the source code of a web page. Pages can be searched using a combination of “grep” and “find.” Programs can be executed directly from the web, and code libraries can be linked directly from the web using the ln command. Altogether, Gecko provides a useful service, demonstrates the viability of virtualization, and provides insights into how to create virtualizations in general. CONCLUSION Client/server applications offer many advantages and are prevalent in today’s computing environment given the wide use of the Internet and local area networks. In particular, the network file service is widely used due to the advantages of storing files centrally on a dedicated file server. The wide adoption of client/server applications has also brought with it a significant disadvantage: the protocols and standards they use have become entrenched and are difficult to modify. Innovations and new features cannot be added without a lengthy standardization process and the addition of new modules to both clients and servers. Virtualization presents a practical alternative to modifying the clients and servers. Virtualization modifies the network protocol in the network, adding new features or enhancing existing properties transparently to the clients and servers. Not requiring modification to clients and servers means that new innovations can be developed and deployed quickly, and even legacy computers can make use of new features. REFERENCES Scott Baker and John H. Hartman. (1999). The Gecko NFS Web Proxy. Computer Networks 31, 1725-1736. Scott Baker and John H. Hartman. (2001). The Design and Implementation of the Gecko NFS Web Proxy. Software Practice and Experience, volume 31, number 6, pp. 637-665, May. John Hoopes, Aaron Bawcon, Paul Kenealy, et al. (2009). Virtualization for Security, Syngress. Eddie Kohler, Robert Morris, Benjie Chen, John Jannotti, and M. Frans Kaashoek. (2000). “The Click modular router,” In ACM Transactions on Computer Systems 18(3), August, pp. 263-297 David L. Tennenhouse, Jonathan M. Smith, W. David Sincoskie, David J. Wetherall, and Gary J. Minden. (1997). A Survey of Active Network Research. IEEE Communications Magazine, vol. 35, no. 1, pp. 80-86. January. Russel Sandberg, David Goldberg, Steve Kleiman, Dan Walsh, and Bob Lyon. (1985). Design and implementation of the Sun network filesystem. In Proceedings of the Summer 1985 USENIX Conference, pp.119-130, June. Chris Wolf and Erick Halter. (2005). Virtualization: From Desktop to the Enterprize. Apress Ben Y. Zhao, Ling Huang, Jeremy Stribling, Sean C. Rhea, Anthony D. Joseph, and John D. Kubiatowicz. (2003). Tapestry: A Resilient Global-Scale Overlay for Service Deployment. IEEE Journal on Selected Areas in Communicasions, vol. 22, no. 1, January. Read More