TECHNICAL FIELD

This disclosure relates to computer cluster management, and more particularly to techniques for security-aware scheduling of virtual machines in a multi-tenant infrastructure.

BACKGROUND

Modern virtualized computing systems are often deployed as a computing cluster formed of multiple computing nodes that host various virtualized entities (e.g., virtual machines, virtual disks, executable containers, etc.). The virtualized entities (VEs) each consume a certain portion of the physical resources (e.g., computing resources, storage resources, networking resources, etc.) of the nodes to support operation of the VEs. As an example, a system administrator can create a virtual machine (VM) at a node in a computing cluster to perform certain functionalities (e.g., a virtual desktop, a database engine, etc.). Historically, only a single tenant would be allocated to any given node of the cluster. The physical boundary of the given node is deemed to provide sufficient isolation between tenants in a multi-tenant environment (e.g., cloud-based IaaS environment), which isolation serves to avoid a wide range of security vulnerabilities. While this node-level physical isolation addresses many security concerns, it often leads to suboptimal resource allocation. For example, suppose a tenant assigns eleven users to a first node, each of which user needs a virtual desktop to run on the first node. Further suppose that if the incremental addition of the eleventh one of the new user's virtual desktop exceeds the resource availability of the first node, then a second node is allocated. In this example case, the eleventh user consumes only 10% of the second node, leaving 90% of the resource availability (e.g., CPU headroom) being unused. Although this allocation and assignment satisfies the aforementioned security isolation, this is wasteful, at least in the second node is underutilized. The load could be rebalanced between the two nodes, however this still leaves approximately 90% of available resources unutilized.

Accordingly, techniques for sharing the physical resources of the nodes of the clusters have evolved to include a more fine-grained allocation of resources. Specifically, fine-grained allocation of VMs can be carried out down to individual physical cores that constitute the CPUs of the nodes. For example, if a VM requires a 4-core virtual CPU (vCPU), then four of the physical cores of a 6-core physical CPU will be allocated to the VM. Since a particular VM will often not use its allocated CPU resources 100% of the time, system administrators often “overcommit” the CPU resources. As an example, the VM in the foregoing example might use the four physical cores assigned to it an average of 50% of the time. In this case, an admin might assign another 4-core VM to the node which results in having eight vCPU cores assigned to a node that has merely six physical CPU cores. In this case, the utilization of the CPU resources might be increased, but at the expense of possible workload delays while waiting for CPU resources to become available (e.g., the CPU “wait time”). Still, many VM users are satisfied with an allocation of CPU-time (e.g., average of 50% of four CPU cores) over a particular time period. Moreover, the security isolation between physical cores has been deemed sufficient by many tenants in a multi-tenant environment.

To facilitate the aforementioned fine-grained partitioning of the physical CPU resources, the simultaneous multithreading (SMT) capability of today's multi-core CPUs is leveraged. Specifically, in an SMT regime, the operating system partitions each core of a physical CPU into multiple logical cores that are assigned workloads by the OS. For example, a node with six physical cores may be partitioned into 12 logical cores that each represents 50% of a physical core. In this case, the logical cores rather than the physical cores can be allocated to serve as the vCPU cores, providing CPU resource allocation on an arbitrarily fine-grained CPU-time basis.

Unfortunately, the security isolation between logical cores introduces several security vulnerabilities, thus presenting challenges in allocating virtual machines to logical CPU resources in a multi-tenant environment. As an example, certain elements (e.g., store buffers, fill buffers, load ports, uncacheable memory, etc.) of a common address space associated with a set of logical CPU cores from a CPU that utilizes speculative execution may potentially enable information disclosure via a side channel with local access. As such, there is an unwanted potential for information leaks between tenants who have respective VMs that use co-located logical cores of a particular CPU. One approach to address these security vulnerabilities is by reverting to isolation boundaries that are aligned with the boundaries of the physical CPU cores or even reverting to the physical isolation provided at the node level. However, these approaches again result in potential underutilization and/or overcommitment of CPU resources, which in turn may undesirably increase costs borne by the tenants and/or may decrease performance as seen by the tenants. What is needed is a way to assign VMs of multiple tenants to logical CPU cores while avoiding security vulnerabilities.

Therefore, what is needed is a technique or techniques that address security vulnerabilities when allocating virtual machines to logical CPU resources in a multi-tenant environment.

SUMMARY

The present disclosure describes techniques used in systems, methods, and in computer program products for security-aware scheduling of virtual machines in a multi-tenant infrastructure, which techniques advance the relevant technologies to address technological issues with legacy approaches. More specifically, the present disclosure describes techniques used in systems, methods, and in computer program products for scheduling of virtual machines into secure isolation groups in a multi-tenant infrastructure. Certain embodiments are directed to technological solutions for applying security rules to assign virtual machines to logical CPU resources in a multi-tenant computing environment.

The disclosed embodiments modify and improve over legacy approaches. In particular, the herein-disclosed techniques provide technical solutions that address the technical problems attendant to avoiding security vulnerabilities when allocating virtual machines to logical CPU resources in a multi-tenant environment. Such technical solutions involve specific implementations (i.e., data organization, data communication paths, module-to-module interrelationships, etc.) that relate to the software arts for improving computer functionality.

Many of the herein-disclosed embodiments for applying security rules to assign virtual machines to logical CPU resources in a multi-tenant computing environment are technological solutions pertaining to technological problems that arise in the hardware and software arts that underlie multi-tenant computing clusters. Aspects of the present disclosure achieve performance and other improvements in peripheral technical fields including, but not limited to, computing resource optimization techniques and secure computing on cloud computing infrastructure.

Further details of aspects, objectives, and advantages of the technological embodiments are described herein, and in the drawings and claims.

