CCS335 Cloud Computing Portal

Introduction to Cloud Architecture, System Models, and Infrastructural Concepts.

Distributed and cloud computing systems are built over large numbers of autonomous computer nodes interconnected by SANs, LANs, or WANs. Massive systems are classified into four groups:

Computer Clusters: Interconnected stand-alone computers working cooperatively as a single integrated resource (Single-System Image or SSI).
Computing/Data Grids: Like an electric grid, it couples computers, software, and people across regions. Acts as a virtual platform supporting virtual organizations.
Peer-to-Peer (P2P) Networks: Every node acts as both client and server. Self-organizing with distributed control. Uses unstructured (flooding) or structured overlay networks.
Internet Clouds: Centralized data centers moving desktop computing to a service-oriented platform with elastic, virtualized resources provisioned dynamically on demand.

The NIST architecture defines 5 major actors participating in cloud computing transactions:

1. Cloud Consumer: Uses services and maintains a business relationship with providers.

2. Cloud Provider: Responsible for making a service available to interested parties.

3. Cloud Auditor: Conducts independent assessment of services, performance, and security.

4. Cloud Broker: Manages use, performance, and delivery; negotiates relationships. (Arbitrage, Aggregation)

5. Cloud Carrier: Intermediary providing connectivity and transport.

Service Models

IaaS (Infrastructure as a Service): Delivers computer infrastructure (networking, storage, servers). Pay-per-use, highly scalable. Example: Amazon EC2.
PaaS (Platform as a Service): Provides a platform allowing developers to build/run applications without managing infrastructure. Example: Google App Engine.
SaaS (Software as a Service): Delivers hosted software applications over the internet. Example: Salesforce, Gmail.

Deployment Models

Public Cloud: Open to general public. Cost-effective, zero maintenance, highly scalable.
Private Cloud: Exclusive use by a single organization. Better control, high security, higher cost.
Hybrid Cloud: Bridges public and private. Flexible but complex to integrate and manage.
Community Cloud: Shared by specific organizations with mutual concerns (e.g., banks, government).
Multi-Cloud: Using multiple cloud providers concurrently to prevent lock-in and increase reliability.

Cloud Infrastructure Architecture

Divided into two main parts: Frontend (Client Infrastructure, GUI/Web Browser) and Backend (Application, Service, Runtime Cloud, Storage, Infrastructure/Servers, Management, Security).

Design Challenges

1. Service Availability & Data Lock-in: Risk of single points of failure. Standardizing APIs is necessary to prevent data lock-in and allow multi-cloud usage.

2. Data Privacy & Security: Public networks expose systems to attacks (malware, guest hopping, hyperjacking, active/passive attacks).

3. Unpredictable Performance: I/O sharing interference among VMs causes bottlenecks. Needs widened links and better OS virtualized interrupts.

4. Distributed Storage & Bugs: Growing database needs require scalable SANs. Large-scale distributed bugs are hard to reproduce and debug.

5. Cloud Scalability & Interoperability: Handling rapid scale-up/down. OVF (Open Virtualization Format) helps package VMs portably.

6. Software Licensing: Traditional commercial licenses don't fit utility computing; requires new pay-per-use structures.

Core concepts of Virtual Machines, Hypervisors, and Hardware-level Virtualization.

Virtual Machine Taxonomy:

Process Virtual Machine: Runs as a normal application inside a host OS to support a single process (e.g., JVM). Provides platform-independent programming environment.
System Virtual Machine: Provides a complete system platform supporting the execution of a complete OS (e.g., VirtualBox, VMware).

Implementation Levels of Virtualization

App Level

Virtualizes an application as a VM (Process-level). Examples: JVM, .NET CLR.

Library Level

Virtualization with library interfaces via API hooks. Examples: WINE, vCUDA.

OS Level

Creates isolated containers on a single physical server (Namespace isolation). Examples: Jails, LPAR, Containers.

HAL

Hardware Abstraction Layer. Performed on top of bare hardware to generate virtual hardware environments. Examples: VMware, Xen, Hyper-V.

ISA Level

Instruction Set Architecture emulation via code interpretation/binary translation. Examples: QEMU, Bochs.

A Hypervisor (VMM) is software/firmware that creates and runs VMs, abstracting the physical hardware.

Type 1 (Native/Bare-Metal): Runs directly on hardware. Replaces host OS. Better performance. (e.g., VMware ESXi, Xen).
Type 2 (Hosted): Runs as an application on a host OS. Easier setup but higher overhead. (e.g., VirtualBox, VMware Workstation).

Xen Architecture

Xen is a microkernel hypervisor that separates policy from mechanism.

Domain 0 (Dom0): The privileged management OS loaded first. Contains device drivers, handles hardware access, and manages policies for other domains.

Domain U (DomU): Unprivileged guest domains where user applications run. Uses hypercalls to request I/O and resource allocation from Dom0/Xen.

Dom0

DomU

Xen Hypervisor

Hardware

Types of Virtualization

Full Virtualization: Complete emulation of underlying hardware using Binary Translation. Unmodified guest OS runs seamlessly.
Para-Virtualization: Exposes a modified software interface. Guest OS is modified to replace privileged instructions with "hypercalls" (e.g., Xen). Better performance but requires OS source code.
Hardware-Assisted: Hardware provides architectural support (Intel VT-x, AMD-V) to trap sensitive instructions without software binary translation overhead.
Partial Virtualization: Partial emulation (e.g., Address Space Virtualization). Many apps run transparently but not all OS features are supported.

Hardware Resource Virtualization

CPU

CPU Virtualization: To prevent a crash, non-privileged instructions run natively. Privileged and control-sensitive instructions are trapped into the VMM. x86 architecture originally struggled with this until Hardware-Assisted CPU Virtualization (Intel VT-x) introduced the VMX Root Mode (Ring -1), allowing the hypervisor to run below the OS.

Memory

Memory Virtualization: Involves a two-stage mapping. Guest OS maps Virtual Address -> Guest Physical Address. The VMM uses Shadow Page Tables to map Guest Physical Address -> Machine Address. Intel introduced EPT (Extended Page Tables) in hardware to accelerate this dual-translation process.

I/O

I/O Virtualization: Manages routing requests between virtual devices and shared hardware. Three ways: 1) Full Device Emulation (replicates devices in software, slow), 2) Para-virtualization / Split Driver (Frontend in DomU, Backend in Dom0 interacting via shared memory), 3) Direct I/O (VM accesses hardware directly via Intel VT-d).

In-depth look at Virtual Clusters, Advanced Virtualization types, and Docker Containers.

Desktop Virtualization: Abstracts the desktop environment, storing it remotely on a server/data center and accessing it via client/server approach (e.g., VNC, Citrix XenDesktop). Provides high availability and mobility.

Network Virtualization: Aggregates physical networks into a logical network (VLAN) or provides network functionality to an OS partition (Internal NAT/Bridge).

Storage Virtualization: Decouples physical organization of hardware from logical representation. Often implemented via Storage Area Networks (SANs).

OS-Level Virtualization: The OS kernel allows for multiple isolated user-space instances (Containers/Jails). Efficient for server consolidation (e.g., OpenVZ, Solaris Zones).

Application Virtualization: Allows apps to run in environments that do not natively support them by emulating partial file systems/libraries (e.g., Wine, VMware ThinApp).

A Virtual Cluster comprises virtual servers interconnected by a virtual network, spanning across multiple physical clusters. It allows dynamic deployment, load balancing, and fault tolerance.

Live VM Migration

Moving a running VM from one physical host to another without application downtime. Solves maintenance issues and enables "green computing" by consolidating loads.

1. Pre-Migration

→

2. Reservation

→

3. Pre-Copy

→

4. Store & Copy

→

5. Commit

→

6. Activation

Memory Migration: Moving the memory instance. ISR (Internet Suspend-Resume) uses temporal locality to cache changed files.

File System Migration: Global file systems (NAS/SAN) avoid copying huge disk contents across the network during migration.

Network Migration: Virtual IP and MAC addresses move with the VM to maintain open network connections without redirection mechanisms.

Virtual Machines

Virtualizes the entire hardware stack via a hypervisor. Each VM includes a full Guest OS. Provides strict isolation but is resource-heavy, large in size, and slow to boot.

Containers

OS-level virtualization sharing a single host kernel. Contains only app code and dependencies. Extremely lightweight, fast to iterate, and highly portable, but shares vulnerability risks if kernel is breached.

Docker Components

Docker Engine: The core software, comprising a Daemon (background server), REST API, and CLI client.
Docker Client: The interface (`docker build`, `docker pull`, `docker run`) used by developers to communicate with the Daemon.
Docker Host: The machine executing the Daemon and hosting the containers/images.
Docker Images: Read-only file templates with multiple layers of instructions used to build containers.
Docker Container: A lightweight, isolated runtime environment created from an image.
Docker Registry (Hub): A cloud-based repository for storing, sharing, and discovering public or private Docker Images.

Docker Storage & Networking

Storage: Data Volumes (host directories), Volume Containers (sharing states between containers), Directory Mounts.

Networking: Bridge (default isolation), Host (shares host network), Overlay (Swarm multi-host), Macvlan (assigns MAC to container), None.

Cloud Software Environments: GAE, AWS, Azure, Eucalyptus, and OpenStack.

Computing Environments: Mainframe (robust, critical tasks), Client-Server, Cloud Computing, Mobile Computing, Grid Computing, Embedded Systems.

Google App Engine (GAE)

A PaaS offering built on Google's search engine data center expertise. Supports scalable web apps in Python/Java. Apps include Gmail, Google Docs, Google Earth.

Modules: Datastore, App runtime environment, SDK, Admin console, Web service infra.
GFS (Google File System): Stores massive data redundantly using 64MB blocks.
MapReduce: Framework for distributed application programming.
BigTable: Distributed, multi-level map NOSQL storage for structured data.
Chubby: Distributed coarse-grained lock service.

Amazon Web Services (AWS)

Provides IaaS, PaaS, and SaaS using a massive global infrastructure (Regions, Availability Zones, Edge Locations). Pay-as-you-go.

EC2 (Elastic Compute Cloud): Secure, resizable virtual VMs (IaaS).
Lambda: Serverless, event-driven compute.
Elastic Beanstalk: PaaS for deploying web apps.
VPC: Virtual Private Cloud for isolated networking.
Route 53: Scalable DNS.
S3: Object storage with 99.999999999% durability.
Glacier: Long-term cold data archiving.
RDS & DynamoDB: Relational and NoSQL managed databases.

Microsoft Azure

Cost-effective cloud platform providing Compute (VMs, Fabric, Batch), Networking (VNet, App Gateway, Express Route), Storage (Blob, Queue, File, Data Lake), and Web+Mobile services. Evolved from Windows Azure (2008) to a robust enterprise cloud.

Eucalyptus

An open-source Linux-based IaaS platform highly compatible with AWS EC2 and S3 APIs, ideal for hybrid clouds.

Node Controller (NC): Manages instance lifecycle, talks to OS/hypervisor.
Cluster Controller (CC): Middleman managing multiple NCs.
Cloud Controller (CLC): Front-end web interface/API.
Walrus (Storage Controller): Handles block storage and snapshots (like S3).

Network Modes:

Static: Allocates IP address mapped to MAC.
System: Assigns MAC and bridges to physical network.
Managed: VLAN isolated security groups.

OpenStack

Open-source IaaS cloud platform originally created by Rackspace and NASA. Comprises separately installed key services interacting via APIs and an AMQP message broker.

NovaCompute (hypervisor mgmt)

NeutronNetworking (VLANs, IPs)

SwiftObject Storage

CinderBlock Storage (disks)

KeystoneIdentity (Authentication)

GlanceImage Registry

Cloud Security Threats, Data Protection, and Identity & Access Management (IAM).

Virtualization System-Specific Attacks

Guest Hopping: An attacker penetrates one VM and jumps to another hosted on the same hardware. Mitigation: High Assurance Platforms (HAP) and forensics.
Hyperjacking: The attacker compromises and replaces the legitimate hypervisor with a rogue one, taking total control of the VM host without the guest OS's knowledge. (Like a rootkit).
VM Migration Attack: Exploits the live migration process. The attacker alters the state of memory being transferred over the data/control/migration plane.
Cross-VM Cache Side Channel: Exploits shared cache memory between VMs on the same hardware to extract cryptographic keys.

Data Security and Storage

Protecting data stored (at rest) or moving (in motion). Core principles include Confidentiality, Integrity, Accountability, and Availability (CIA Triad).

Components: Visibility, Exposure Mgmt, Prevention Controls, Detection, Response.
Challenges: Lack of visibility, less control on 3rd party infra, shared responsibility confusion, compliance demands, distributed storage sovereignty.

Benefits: Easy backups, cloud data compliance (DLP tools), advanced encryption at rest/transit, lower TCO, AI-based incident response.
Storage Types: Object storage, File storage, and Block storage.

IAM ensures that the right people/roles (identities) can access the tools they need. Uses "Principals" (human or workload) assigned with credentials.

Challenges: High turnover/lifecycle management, diverse populations (employees, partners), disparate directories creating complex webs, lack of centralized view, and compliance visibility.

IAM Core Architecture Modules

User Mgmt: Identity life cycles, onboarding/deprovisioning.

Authentication Mgmt: Verifying *who* the user is (credentials/passwords).

Authorization Mgmt: Entitlements; defining *what* services they can access.

Access Mgmt: Responding to requests to access resources based on policies.

Data Mgmt & Provisioning: Pushing authorizations to IT resources automatically.

Monitoring & Auditing: Tracking access logs for compliance reporting.

IAM Practices in the Cloud (Federation & SSO)

Enterprise Identity Provider (IdP): Organization federates identities within a trusted circle of CSP domains using an internal IdP. Pros: Leverages existing IAM, consistent policies. Cons: Inefficiencies managing non-employees (customers).
Identity Management-as-a-Service (IDaaS): Outsource federated identity to a third party (e.g., Ping Identity) acting as a multiprotocol federation gateway (SAML 1.1 vs 2.0). Pros: Hides integration complexity. Cons: Less visibility into architecture, relies on provider SLA.

Unit 1: Cloud Architecture Models