Security Of Virtualization Solutions

vmware

Memory Isolation

Direction Execution of User Requests

OS Requests lure to VMM while not Binary Transformation or Paravirtualization

The supervisor American state nes the RAM allotted to a virtual machine by the VMM via the virtual machine’s settings. The VMkernel allocates memory once it American state nes the resources to be utilized by the virtual machine. A guest OS uses physical memory allotted thereto by the VMkernel and American state ned within the virtual machine’s con guration autoimmune disorder.

Fig:Memory Isolation in vmware.

An OS booting on real hardware is given a zero-based physical address house; AN OS corporal punishment on virtual hardware is given a zero-based address space. The VMM offers every virtual machine the illusion that it's victimization such AN address house, virtualizing physical memory by adding an additional level of address translation. A machine address refers to actual hardware memory; a physical address may be a software package abstraction wont to give the illusion of hardware memory to a virtual machine. This paper uses “physical” in quotation marks to tell apart this deviation from the standard which means of the term.

Memory Protection

To protect privileged parts, like the VMM and VMkernel, vSphere uses sure well-known techniques. Address house layout organisation (ASLR) randomizes wherever core kernel modules square measure loaded into memory. The NX/XD C.P.U. options change the VMkernel to mark writeable areas of memory as nonexecutable. each ways shield the system from bu er over ow attacks in running code. NX/XD C.P.U. options are also exposed to guest virtual machines by default.

Device Isolation

Each virtual machine is isolated from different virtual machines running on an equivalent hardware. Virtual machines share physical resources like C.P.U., memory, and I/O devices; a guest OS in a private virtual machine cannot observe any device aside from the virtual devices created offered thereto.

To any clarify, a virtual machine will observe solely the virtual (or physical) devices assigned thereto by the systems administrator, like the subsequent examples:

• A virtual SCSI disk mapped to a autoimmune disorder on a disk

• AN actual disk or LUN connected to a physical host or array

• A virtual network controller connected to a virtual switch

• AN actual network controller connected to a physical network

Device Access to Hardware

At the hardware level, all direct access (DMA) transfers and device-generated interrupts square measure virtualized and isolated from different virtual machines. This prevents one virtual machine from accessing the memory house controlled by another virtual machine. If such an endeavor is formed by a virtual machine, the guest OS can receive a fault from the C.P.U..

Because the VMkernel and VMM mediate access to the physical resources, and every one physical hardware access takes place through the VMkernel, virtual machines cannot circumvent this level of isolation.

I/O Remapping

Modern processors feature AN I/O memory management unit that remaps I/O DMA transfers and device interrupts. this allows virtual machines to possess direct access to hardware I/O devices, like network cards, storage controllers (HBAs), and GPUs. In AMD processors, this feature is termed AMD I/O Virtualization (AMD-Vi) or I/O memory management unit (IOMMU); in Intel processors, the feature is termed Intel Virtualization Technology for Directed I/O (VT-d). among ESXi, use of this capability is termed DirectPath I/O. DirectPath I/O doesn't impact the protection properties in any approach. as an example, a virtual machine con gured to use VT-d or AMD-Vi to directly access a tool cannot in uence or access the I/O of another virtual machine.

1. Resource Provisioning, Shares, and Limits

2. Security of the VMware vSphere Hypervisor

DirectPath I/O

In a virtualized surroundings, resources square measure shared among all virtual machines. however as a result of system resources will be managed, it permits use limits on virtual machines. There square measure variety of ways to deal with this.

Provisioning

In a physical system, the OS will use all the hardware resources. If the system has 128GB of memory, and also the OS will address it, all of that memory will be used. an equivalent applies to C.P.U. resources. However, as antecedently noted, all resources square measure shared in an exceedingly virtual surroundings. AN OS victimization too several resources, C.P.U. as an example, probably will deprive another OS of the resources it wants. Provisioning is that the rst step in managing virtual machine resources. A virtual machine ought to be provisioned with solely the resources it needs to try and do employment. as a result of virtual machines ne'er will use additional C.P.U. or memory resources than provisioned, users will limit the impact on different virtual machines.

Shares

Users will any isolate and shield neighboring virtual machines from “noisy neighbors” through the employment of shares. Grouping “like” virtual machines into resource pools, and departure shares set to default, ensures that every one virtual machines within the pool receive about an equivalent resource priority. A “noisy neighbor” won't be ready to use quite the other virtual machine within the pool.

Limits

Previous recommendations prompt the employment of limits to manage resource usage. However, supported additional operational expertise, it's been found that virtual machine–level limits will have prejudicious operational e ects if used improperly.

For example, a virtual machine is provisioned with 4GB and also the limit is ready to 4GB

3. Network Isolation

4. ESXi Networks

There square measure variety of networks to think about on AN ESXi server:

1. vSphere infrastructure networks, used for options like VMware vSphere vMotion®, VMware vSphere Fault Tolerance, and storage. These networks square measure thought of to be isolated for his or her speci c functions and sometimes aren't routed outside one physical set of server racks.

2. A management network that isolates shopper, command-line interface (CLI) or API, and third-party software package tra c from traditional tra c. This network ought to be accessible solely by system, network, and security directors. Use of “jump box” or virtual personal network (VPN) to secure access to the management network is suggested. Access among this network to sources of malware ought to be strictly controlled.

3. Virtual machine networks will be one or several networks over that virtual machine tra c ows. Isolation of virtual machines among this network will be increased with the employment of virtual rewall solutions that set rewall rules at the virtual network controller. These settings travel with the virtual machine because it migrates from host to host among a vSphere cluster.

5. Virtual Machine Networks

Just as a physical machine will communicate with different machines in an exceedingly network solely through a network adapter, a virtual machine will communicate with different virtual machines running on an equivalent ESXi host solely through a virtual switch. Further, a virtual machine communicates with the physical network, as well as virtual machines on different ESXi hosts, solely through a physical network adapter, unless it uses DirectPath I/O.

In considering virtual machine isolation in an exceedingly network context, users will apply these rules supported Figure 5:

• If a virtual machine doesn't share a virtual switch with the other virtual machine, it's fully isolated from different virtual networks among the host. this is often virtual machine one.

• If no physical network adapter is con gured for a virtual machine, the virtual machine is totally isolated from any physical networks. this is often virtual machine two. during this example, the sole access to a physical network is that if virtual machine three acts as a router between virtual switch two and virtual switch three.

• A virtual machine will span 2 or additional virtual switches provided that con gured by the administrator. this is often virtual machine three.

6. Virtual Networking Layer

The virtual networking layer consists of the virtual network devices through that virtual machines interface with the remainder of the network. ESXi depends on the virtual networking layer to support communication between virtual machines and their users. additionally, ESXi hosts use the virtual networking layer to speak with iSCSI SANs, NAS storage, and so on. The virtual networking layer includes virtual network adapters and also the virtual switches.

Virtual Switches

The networking stack uses a standard style for optimum exibility. A virtual switch is “built to order” at runtime from a group of tiny useful units, like the following:

• The core layer two forwarding engine

• VLAN tagging, stripping, and ltering units

• Virtual port capabilities speci c to a specific adapter or a specific port on a virtual switch • Level security, checksum, and segmentation o oad units

When the virtual switch is constructed at runtime, ESXi installs and runs solely those parts that square measure needed to support the speci c physical and virtual LAN adapter sorts employed in the con guration. Therefore, the system pays the bottom doable price in quality and helps guarantee a secure design.

Virtual Switch VLANs

ESXi supports IEEE 802.1q VLANs, which might be wont to any shield the virtual machine network, management networks, and storage con guration. VMware software package engineers wrote this driver in accordance with the IEEE speci ion. VLANs change segmentation of a physical network thus 2 machines on an equivalent physical network cannot send packets to or receive packets from one another unless they're on an equivalent VLAN.

Virtual Ports

The virtual ports in ESXi give a fashionable management channel for communication with the virtual LAN adapters connected to them. ESXi virtual ports magisterially observe that square measure the con gured receive lters for virtual LAN adapters connected to them, thus no learning is needed to populate forwarding tables.

They conjointly magisterially observe the “hard” con guration of the virtual LAN adapters connected to them. This capability makes it doable to line such policies as forbidding macintosh address changes by the guest and rejecting solid macintosh address transmission, as a result of the virtual switch port will basically magisterially observe what's “burned into ROM”—actually, keep within the con guration autoimmune disorder, outside the management of the guest OS.

The policies offered in virtual ports square measure far more di cult—if not impossible—to implement with physical switches. Either ACLs should manually be programmed into the switch port, or weak conjecture like “ rst macintosh seen is assumed to be correct” should be relied on.

Virtual Network Adapters

vSphere provides many varieties of virtual network adapters that guest OSs will use. the selection of adapter depends upon factors like support by the guest OS and performance, however all the adapters share the subsequent characteristics:

• they need their own macintosh addresses and unicast/multicast/broadcast lters. • they're strictly stratified LAN adapter devices.

• They act with the low-level VMkernel layer stack via a standard API.

KVM

1. Executive outline

You've most likely been reading regarding the economic science of cloud computing. the guarantees of economical, virtualized computing platforms square measure attractive: low entry price, dynamic filler to accommodate varied workloads, machine-controlled management, and more. the worth proposition appearance equally compelling for each rising and well-established organizations. Moving your mission-critical workloads to a cloud might save your organization a considerable fraction of its current IT expense. However, there's AN obstacle important enough to forestall you from ever taking advantage of the advantages cloud computing offers. That obstacle may be a very important question of security. What virtualization technology are you able to trust for the protection of your cloud? UN agency will give it? The answer: you'll trust the corporate that has the foremost virtualization expertise. you'll trust the open supply technology that powers its clouds. That company is IBM®, which technology is KVM.

KVM meets all the factors cartoonist outlined for a sort one hypervisor. First, the virtual machine monitor (VMM) runs in privileged mode and directly uses hardware directions to virtualize the guest. Guest code executes most of the time directly on hardware at full speed. most significantly, the virtual-to-physical resource translation happens just one occasion. In meeting these criteria, KVM is adequate VMWare, Xen, z/VM, and different vacant metal hypervisors. the actual fact that KVM will co-reside with AN enterprise UNIX system OS doesn't amendment any of its sort one characteristics.

In fact, KVM is prepackaged nowadays each with and while not a full UNIX system surroundings. Red Hat offers a locked- down, hypervisor-only KVM product that omits the Enterprise UNIX system OS and restricts administrator access to atiny low set of controlled interfaces. This implementation demonstrates the pliability of KVM's bare- metal style.

Regardless, the plain truth is that the hypervisor sort may be a false indicator of security. whereas style and implementation square measure vital issues to hypervisor security, hypervisor structure isn't. A badly designed sort one hypervisor will be abundant less secure than a literary sort two hypervisor, and also the reverse is additionally true. KVM's hypervisor style provides isolation properties that square measure almost like VMware ESX. The sure code base of KVM is mostly an equivalent as for different x86 hypervisors.

1. Key advantages of KVM

The kernel-based virtual machine (KVM) hypervisor provides a full virtualization answer supported the UNIX system software package. the subsequent key advantages of KVM square measure delineated in additional detail later during this paper.

• KVM has sturdy guest isolation with an additional layer of protection against guest breakouts. necessary access management adds grade of isolation on the far side basic method separation.

• KVM's vacant metal style (Type one design) is comparable to different x86 hypervisors.

• KVM is strictly enforced and tested. With open supply, developers square measure unceasingly

inspecting KVM for flaws.

• KVM has the advantage over different x86 hypervisors in terms of lower total price of possession and bigger flexibility than competitive hypervisors.

2. Strong guest isolation

One of the primary things that involves mind relating to hypervisor security, notably in an exceedingly cloud surroundings wherever multiple purchasers square measure served by one software package instance, is guest isolation. within the cloud, purchasers place their trust within the hypervisor. Unquestionably, the hypervisor should be protected against security breaches involving guests in operation on prime of the hypervisor. These security problems include:

• Guests bypassing security controls to access either the host or different guests in ways in which violate the host security policy

• Guests intercepting shopper information or host resources to that they're not approved

• Guests trying or changing into the victim of security attacks, that might probably take down the

entire cloud.

In addition, shopper information should be protected against spare access from the hypervisor itself. Finally, guests would like the aptitude to make controlled shared storage for collaboration functions.

Because KVM is constructed into UNIX system, KVM guest methodes square measure subject to any or all the standard user house process separation that's integral to the UNIX system kernel's operation. UNIX system method separation continues to evolve over time. However, the foremost basic protection mechanisms have existed since early within the development of the UNIX system kernel, and square measure well tested and authorized. On x86 systems, the kernel, at the bottom level, uses the central process unit (CPU) chip set hardware to realize separation between user house mode and kernel (privileged or supervisor) mode. within the kernel, discretionary access management (DAC) prevents user house processes from unauthorized access of resources or different processes. DAC is that the ancient set of access controls during which users own their own resources and may manage access to those resources at their discretion.

3. Mandatory access management

KVM goes even any than basic DAC separation by incorporating necessary access management (MAC) through Security-Enhanced UNIX system (SELinux). With MAC, it's the administrator, not the method owner, UN agency determines the access a method should resources. macintosh implements sturdy guest isolation and controls resources offered to guests. The sVirt API, that integrates macintosh and UNIX system virtualization among SELinux, is enabled by default in RHEL six. As of the writing of this document, no different all-purpose x86 hypervisor implements macintosh by default, providing KVM with a layer of defense on the far side that of different hypervisors.

2. Rigorous implementation and testing

Open supply may be a methodology of engineering that distributes style and development effort globally. Participants contribute labor whereas making the most of the work of others to resolve totally different issues. most work takes place on web mailing lists within the kind of patch submissions to open supply communities. Anyone will browse, comment on, and contribute to the mailing lists. Communities put together decide individual submissions, and meritocracies kind organically. Maintainers intumesce from the communities UN agency square measure specialists in their fields and lead the communities. Open supply communities attract consultants worldwide in specific downside domains that will preferably be troublesome or not possible to assemble.

All KVM development takes place in open supply communities. the event methodology brings nice advantages to KVM security. Maintainers and community members perform continuous examination and testing to seek out bugs. Weaknesses square measure known and patched quickly. Relentless analysis of the ASCII text file by multiple consultants is especially vital to reduce the likelihood of unknown vulnerabilities stepping into the code base and resulting in zero-day exploits. This development approach may be a explicit advantage that open supply has over proprietary development. Proprietary development is opaque; it's troublesome or not possible to get info regarding proprietary hypervisor internals. square measure guests extremely separated? square measure communications methods adequately controlled? square measure the privileged management arthropod genus coded correctly? while not security certification results offered, you have got very little selection however to trust proprietary vender security claims. However, there's zero mystery relating to the contents of KVM and its broader ecosystem; all its ASCII text file is accessible for viewing.

Conclusion

KVM may be a sure answer for implementing virtualized environments, like clouds that contain multiple tenants. KVM security stacks up well against different all-purpose x86 hypervisors. It implements layers of controls, as well as necessary access management and hardware-based isolation, to realize deep defense against attacks. KVM's direct access to hardware provides an equivalent level of protection as different vacant metal hypervisors.

Fig comparing both virtualisation technology as we can clearly see KVM is the clear winner.

Based on UNIX system, KVM advantages from the open supply development community, as well as constant examination for potential security flaws. moreover, KVM can presently succeed Common Criteria certification at AN EAL4+ level3.

Risk Assessment Report of Bluetooth technology

1. Introduction

   1. Case Scenario

      
      
      

This report is all regarding identification and mitigation of current security threats of the Bluetooth.

Bluetooth was a technology for poor. Yea virtually it absolutely was designed specified adding to a sensible device wouldn't raise the general price quite five greenbacks. Ericsson was at forefront to create Bluetooth. several suppose that if you set the passcode or permit solely paired device to attach to your Bluetooth enabled device makes thier device safe. Well I solely enlighten them square measure YOU SURE!!!

Authentication

Authorization

Encryption

Few of the safety problems that square measure concerned in Bluetooth square measure

Short Pins square measure allowed, the cryptography key length is negotiable, master is shared, finish to finish security isn't performed to call many. (believe Pine Tree State the list goes on and on!!!)

Now I will explain few attacks on Bluetooth

1. Bluejacking:

Bluejacking is that the causing of uninvited messages over Bluetooth to Bluetooth-enabled devices like mobile phones, PDAs or portable computer computers, causing a vCard which usually contains a message within the name field (i.e. for bluedating or bluechat) to a different Bluetooth enabled device via the OBEX protocol. Bluetooth contains a terribly restricted range; typically around ten meters on mobile phones, however laptops will reach up to one hundred meters with powerful transmitters.

Bluejacking permits phone users to send business cards anonymously victimisation Bluetooth wireless technology. Bluejacking doesn't involve the removal or alteration of any information from the device. Bluejackers usually rummage around for the receiving phone to ping or the user to react. so as to hold out a bluejacking, the causing and receiving devices should be at intervals ten meters of 1 another. Phone homeowners United Nations agency receive bluejack messages ought to refuse to feature the contacts to their address book. Devices that square measure set in non-discoverable mode don't seem to be vulnerable to bluejacking.

Mobile phones are adopted as associate everyday technology, and that they square measure present in social things as users carry them around as they move through completely different physical locations throughout the day. As a communicative device, the itinerant has been bit by bit concerned in ways in which move on the far side just providing a channel for mediate speech. One such appropriation is bluejacking, the observe of causing short, uninvited messages via vCard practicality to alternative Bluetooth-enabled phones. to settle on the recipients of bluejacks, senders complete a scan victimisation their mobile phones to look for the obtainable Bluetooth- enabled devices within the immediate space. A bluejacker picks one in every of the obtainable devices, composes a message at intervals a body of the phone’s contact interface, sends the message to the recipient, and remains within the neighbourhood to watch any reactions expressed by the recipient.

The messages tend to be anonymous since the recipient has no plan United Nations agency has sent the bluejack, and therefore the recipient has no info regarding the bluejacker, aside from the name and model of the bluejacker’s itinerant. attributable to Bluetooth’s short-range networking capabilities, bluejacking will solely occur between actors United Nations agency square measure at intervals ten meters of every alternative, that makes this activity extremely location-dependent. Contrary to what the name suggests, the bluejack recipient’s phone isn't hijacked; that's, the phone is at no time below the management of the bluejacker.

We conceptualise bluejacking as a violation of possessional territory. galvanized by Goffman, we tend to propose that the itinerant could be a possessional territory as a results of the intimacy and continuing contact between itinerant users and their phones. A possessional territory, in our usage, is associate object that engenders attachment and defense by people who understand possession and may be stated as a “personal impact.” Possessional territories operate “egocentrically”; that's, they move around with their homeowners United Nations agency maintain and exert regulative management, like the definition of settings. Since we tend to characterize the itinerant as a possessional territory, we tend to adapt the class of violation, outlined as a short lived incursion wherever seizure isn't essentially the goal as a probable and acceptable class of infringement during this context.

We additionally propose that bluejackers try to modify their expertise of public area by partaking within the violation of others’ possessional territories through the act of illicit and anonymous electronic communication. guests to public areas will interact in habitual behaviors at a selected location, like choosing a favourite parking spot that one will come back to on every ordered visit, to achieve a way of familiarity to locations that square measure oft re-visited. These physical environments then hold enough significance to inspire defense among people who inhabit them and defensive behaviors, which might vary from process a private area at intervals a speech or whereas employing a work surface work-surface. Typically, associate somebody of a public place tends to modify a location if he or she feels that the social conventions of an area permit one the license to mark a territory.

2. Man in the middle attack:

This is not a attack that you simply dont grasp off. Infact I even have several friends United Nations agency in world act as man-in-the-middle either for serving to Pine Tree State or gaining info that they'll use for his or her own sensible. Buckeye State an excessive amount of critique on Pine Tree State, anyways, returning to the current quite attack, associate aggressor will hijack a already established bluetooth session to induce the info sent over bluetooth. the first objective of the aggressor is to attach the victim's portable computer to a faux Access purpose. aggressor uses the device that receives the Bluetooth packets in promiscuous mode and so sends cast ones to the mobile and portable computer of the victim.

Because Bluetooth could be a wireless communication system, there's perpetually a clear stage that its transmissions may be deliberately jam-pawncked or intercepted, or false/altered info may be passed to the piconet devices. to supply protection for the piconet, the system will establish security at many protocol levels. Bluetooth has inbuilt security measures at the link level.

Our work principally concentrates on the Man-In-The-Middle attack. By principle, with none verification of the general public keys, MITM attacks square measure usually potential against any message sent by victimisation public-key technology. the prevailing model uses the Bluetooth device that support SSP (Printer) that creates use of the simply Works, Numeric Comparison and therefore the Pass key entry association models. however it absolutely was proven that the prevailing model isn't abundantly secure. thus we tend to propose to use Out-Of-Band channeling association model to own additional security.

Out Of Band refers to communications that occur outside of a antecedently established communication ways or channel. The cryptographical systems that square measure secure against MITM attacks need a further exchange or transmission of data over some quite secure channel.

Counter Measures for This attacker

Knowing of potential issues of jacking and denial of service attacks of Bluetooth is that the initiative. Knowing that this stuff will occur could facilitate a user debate in once and wherever it's best to use their device. it'll additionally create them insure that info they are doing not would like to use over the air is insured to induce to the potential receiver.

The best resolution is to show off your Bluetooth device till you wish to speak with another user. Since we all know that code will activate and off Bluetooth a tool, disabling it and going it on isn't your best bet. If you want to keep the device on, than the concept of the E2X bag could also be your best choice explained below

Based on the Summary notes of information provided by Audit Scenario Document,

Detection and Prevention

These attacks can be detected by monitoring the bluetooth communication channels we should be caution about any unknown device in the list of known device and unknown authentication attempts or also known as pairing attempts with the target device.

There are many stuff you will do to stop folks from connecting to your Bluetooth devices. this text focuses specifically on protective your telephone, however the following pointers will apply to alternative devices furthermore.

Depending on your specific telephone, you’ll have totally different Bluetooth choices and settings offered, however identical general recommendation applies to all or any phones.

If your phone isn't paired with another Bluetooth device at any time, flip its Bluetooth capability off.

Figure#1Bluetooth menu in mac os.

-to avoid Associate in Nursing unknown device from making an attempt to attach to that. even though you're paired with a tool, you ought to still close up Bluetooth discovery (so alternative devices will’t see your phone) furthermore as machine pairing (which can enable a tool you’re not conversant in to attach to your phone while not your approval).

On most phones you'll access all of those settings from one Bluetooth menu, that is sometimes found on the most menu, or below a sub-menu known as one thing like Settings, Configuration, or Connections. If Bluetooth is presently enabled on your phone, you ought to see the small Bluetooth icon (a weird-looking white B within a blue oval) somewhere on the most screen.

Depending on your phone and also the device or devices you usually try it with, you will or might not be needed to enter a passcode to create the affiliation. If your phone needs a passcode so as for a tool to try with it and you’re ready to amendment the code, create it one thing tougher to guess than “0000” or “1234” (which square measure the default codes for several devices).

By following these easy tips, and by often glancing at your phone to visualize if it's connected to a tool or personal space network (PAN) that you’re not conversant in, you'll keep strangers from connecting to your phone and either inflicting injury or stealing information.

As Bluetooth gets additional and additional in style, additional folks can try and use it to their advantage, therefore the additional protected and knowledgeable you're, the better.

Prevention Counter Measures to Bluetooth Attacks in steps:

1.Switch off Bluetooth once not in use

2.Purchase solely devices having long PIN codes

3. Refrain from coming into PIN into Bluetooth device for pairing

4.Limit the electrical power itself to stay the vary of the network at intervals the physical space

5.Switch off all superfluous SCO/eSCO links

6.Select the correct place once 2 Bluetooth devices meet for the primary time and generate data formatting keys.

Virtualization

Virtualization

Introduction-

Virtualization is the process of simulating virtual environment for any software or program to run on different platforms or hardware system, or can also be defined as -
                  Virtualization is a process of creating a virtual version (in place of original) of something such as an operating system, a Server, a Storage device or network resources.

Virtualization can be seen as part of an overall trend in enterprise IT that includes autonomic computing, a scenario in which the Information Technology environment will be able to manage itself based on perceived activity, and utility computing, in which computer processing power is seen as a utility that clients can pay for only as needed. The usual goal of virtualization is to centralize administrative tasks while improving scalability and overall hardware-resource utilization. With virtualization, several operating systems can be run in parallel on a single CPU. This parallelism tends to reduce overhead costs and differs from multitasking, which involves running several programs on the same OS.

Operating system virtualization is the use of software to allow a piece of hardware to run multiple operating system images at the same time. The technology got its start on mainframes decades ago, allowing administrators to avoid wasting expensive processing power.

Type of Virtualization

Reasons for virtualization

• In the case of server consolidation, many small physical servers are replaced by one larger physical server to increase the utilization of costly hardware resources such as CPU. Although hardware is consolidated, typically OSes are not. Instead, each OS running on a physical server becomes converted to a distinct OS running inside a virtual machine. The large server can "host" many such "guest" virtual machines. This is known as Physical-to-Virtual (P2V) transformation.

• Consolidating servers can also have the added benefit of reducing energy consumption. A typical server runs at 425 W and VMware estimates an average server consolidation ratio of 10:1.

• A virtual machine can be more easily controlled and inspected from outside than a physical one, and its configuration is more flexible. This is very useful in kernel development and for teaching operating system courses.

• A new virtual machine can be provisioned as needed without the need for an up-front hardware purchase.

• A virtual machine can easily be relocated from one physical machine to another as needed. For example, a salesperson going to a customer can copy a virtual machine with the demonstration software to his laptop, without the need to transport the physical computer. Likewise, an error inside a virtual machine does not harm the host system, so there is no risk of breaking down the OS on the laptop.

• Because of the easy relocation, virtual machines can be used in disaster recovery scenarios.

Hardware virtualization

Hardware virtualization or platform virtualization refers to the creation of a virtual machine that acts like a real computer with an operating system. Software executed on these virtual machines is separated from the underlying hardware resources. For example, a computer that is running Microsoft Windows may host a virtual machine that looks like a computer with the Ubuntu Linux operating system; Ubuntu-based software can be run on the virtual machine.

In hardware virtualization, the host machine is the actual machine on which the virtualization takes place, and the guest machine is the virtual machine. The words host and guest are used to distinguish the software that runs on the physical machine from the software that runs on the virtual machine. The software or firmware that creates a virtual machine on the host hardware is called a hypervisor or Virtual Machine Manager.

Different types of hardware virtualization include:

1. Full virtualization: Almost complete simulation of the actual hardware to allow software, which typically consists of a guest operating system, to run unmodified.
2. Partial virtualization: Some but not all of the target environment is simulated. Some guest programs, therefore, may need modifications to run in this virtual environment.
3. Paravirtualization: A hardware environment is not simulated; however, the guest programs are executed in their own isolated domains, as if they are running on a separate system. Guest programs need to be specifically modified to run in this environment.

 Memory virtualization

  Memory virtualization allows networked, and therefore distributed, servers to share a pool of memory to overcome physical memory limitations, a common bottleneck in software performance. With this capability integrated into the network, applications can take advantage of a very large amount of memory to improve overall performance, system utilization, increase memory usage efficiency, and enable new use cases. Software on the memory pool nodes (servers) allows nodes to connect to the memory pool to contribute memory, and store and retrieve data. Management software and the technologies of memory overcommitment manage shared memory, data insertion, eviction and provisioning policies, data assignment to contributing nodes, and handles requests from client nodes. The memory pool may be accessed at the application level or operating system level. At the application level, the pool is accessed through an API or as a networked file system to create a high-speed shared memory cache. At the operating system level, a page cache can utilize the pool as a very large memory resource that is much faster than local or networked storage.

 Storage Virtualization: It is commonly used in storage area network (SAN).It helps to perform the tasks of recovery in less time and easily, archiving and backup. It can be placed in different levels of SAN.

While there are numerous, listed here are some core benefits:

• Enterprise Continuity – Lower downtime associated with vision important apps and programs.
• Improved upon Utilization – Increase efficiency by increasing the usage of server assets coming from 25% (average) to 60%+.
• Cost is reduced – Need much less components, energy and area.
• Managing is simplified– Deploy, administration and monitoring from one unit.

 Network Virtualization

     network virtualization is the process of combining hardware and software network resources and network functionality into a single, software-based administrative entity, a virtual network. Network virtualization involves platform virtualization, often combined with resource virtualization.

Network virtualization is categorized as either external, combining many networks, or parts of networks, into a virtual unit, or internal, providing network-like functionality to the software containers on a single system. Whether virtualization is internal or external depends on the implementation provided by vendors that support the technology.

 Components of a virtual network

Various equipment and software vendors offer network virtualization by combining any of the following:

• Network hardware, such as switches and network adapters, also known as network interface cards (NICs)
• Network elements such as firewalls and load balancers
• Networks, such as virtual LANs (VLANs) and containers such as virtual machines (VMs)
• Network storage devices
• Network M2M elements such as telecommunications 4G HLR and SLR devices
• Network mobile elements such as laptops, tablets, and cell phones
• Network media, such as Ethernet and Fibre Channel

 Server Virtualization

     Server virtualization is the masking of server resources, including the number and identity of individual physical servers, processors, and operating systems, from server users. The server administrator uses a software application to divide one physical server into multiple isolated virtual environments. The virtual environments are sometimes called virtual private servers, but they are also known as guests, instances, containers or emulations.

 

As you can see that all workstation's are running there respective operating system and working on, while for a enterprise requirement all the data processed on local client side workstation should be stored in central server after being received by  Virtualized Central Server, this is very important so the user can get his interdependency of choosing his working workstation operating system environment.

 

 The intention is to spare the user from having to understand and manage complicated details of server resources while increasing resource sharing and utilization and maintaining the capacity to expand later.

Virtualization indicates partitioning one server directly into many virtual servers called Virtual Machines (VMs). Using Hypervisor technology, networking, storage, and computing resources are collectively and delivered to Virtual machine. Even though sharing the resources of same physical server, 

 Desktop Virtalization

Desktop virtualization is the concept of separating the logical desktop from the physical machine.

One form of desktop virtualization, virtual desktop infrastructure (VDI), can be thought as a more advanced form of hardware virtualization. Rather than interacting with a host computer directly via a keyboard, mouse, and monitor, the user interacts with the host computer using another desktop computer or a mobile device by means of a network connection, such as a LAN, Wireless LAN or even the Internet. In addition, the host computer in this scenario becomes a server computer capable of hosting multiple virtual machines at the same time for multiple users^.

As organizations continue to virtualize and converge their data center environment, client architectures also continue to evolve in order to take advantage of the predictability, continuity, and quality of service delivered by their Converged Infrastructure. For example, companies like HP and IBM provide a hybrid VDI model with a range of virtualization software and delivery models to improve upon the limitations of distributed client computing^. Selected client environments move workloads from PCs and other devices to data center servers, creating well-managed virtual clients, with applications and client operating environments hosted on servers and storage in the data center. For users, this means they can access their desktop from any location, without being tied to a single client device. Since the resources are centralized, users moving between work locations can still access the same client environment with their applications and data For IT administrators, this means a more centralized, efficient client environment that is easier to maintain and able to more quickly respond to the changing needs of the user and business

     Thin clients, which are seen in desktop virtualization, are simple and/or cheap computers that are primarily designed to connect to the network. They may lack significant hard disk storage space, RAM or even processing power, but many organizations are beginning to look at the cost benefits of eliminating “thick client” desktops that are packed with software (and require software licensing fees) and making more strategic investments. Desktop virtualization simplifies software versioning and patch management, where the new image is simply updated on the server, and the desktop gets the updated version when it reboots. It also enables centralized control over what applications the user is allowed to have access to on the workstation.

Application virtualization

 Application virtualization is software methodology that encapsulates application software from the underlying operating system on which it is executed. A fully virtualized application is not installed in the traditional sense, although it is still executed as if it were. The application behaves at runtime like it is directly interfacing with the original operating system and all the resources managed by it, but can be isolated or sandboxed to varying degrees. In this context, the term "virtualization" refers to the artifact being encapsulated (application), which is quite different to its meaning in hardware virtualization, where it refers to the artifact being abstracted (physical hardware).

 he application remains unaware that it accesses a virtual resource instead of a physical one. Since the application is now working with one file instead of many files and registry entries spread throughout the system, it becomes easy to run the application on a different computer and previously incompatible applications can be run side-by-side.

Benefits of application virtualization

Allows applications to run in environments that do not suit the native application:

• e.g. Wine allows some Microsoft Windows applications to run on Linux.
• e.g. CDE, a lightweight application virtualization, allows Linux applications to run in a distribution agnostic way

Operating System Virtualization

    Operating System virtualization is the use of software that allows a piece of hardware to run multiple operating system images at the same time.

In operating system-level virtualization, a physical server is virtualized at the operating system level, enabling multiple isolated and secure virtualized servers to run on a single physical server. The "guest" OS environments share the same OS as the host system – i.e. the same OS kernel is used to implement the "guest" environments. Applications running in a given "guest" environment view it as a stand-alone system. The pioneer implementation was FreeBSD jails; other examples include Solaris Containers, OpenVZ, Linux-VServer, LXC.

like this above this machine is currenly in Ubuntu Environment but in real world its haring its hardware with Windows 7.

Full Virtualization

 In computer science, full virtualization is a virtualization technique used to provide a certain kind of virtual machine environment, namely, one that is a complete simulation of the underlying hardware. Full virtualization requires that every salient feature of the hardware be reflected into one of several virtual machines – including the full instruction set, input/output operations, interrupts, memory access, and whatever other elements are used by the software that runs on the bare machine, and that is intended to run in a virtual machine. In such an environment, any software capable of execution on the raw hardware can be run in the virtual machine and, in particular, any operating systems. The obvious test of virtualization is whether an operating system intended for stand-alone use can successfully run inside a virtual machine.

Similarly, full virtualization was not quite possible with the x86 platform until the 2005-2006 addition of the AMD-V and Intel VT-x extensions (see x86 virtualization). Many platform virtual machines for the x86 platform came very close and claimed full virtualization even prior to the AMD-V and Intel VT-x additions. Examples include Adeos, Mac-on-Linux, Parallels Desktop for Mac, Parallels Workstation, VMware Workstation, VMware Server (formerly GSX Server), VirtualBox.

Data Virtualization

approach to data management that allows an application to retrieve and manipulate data without requiring technical details about the data, such as how it is formatted or where it is physically located

Database virtualization may use a single ODBC-based DSN to provide a connection to a similar virtual database layer.

Benefits of Data Virtualization

• Reduce risk of data errors
• Reduce systems workload through not moving data around
• Increase speed of access to data on a real-time basis
• Significantly reduce development and support time
• Increase governance and reduce risk through the use of policies Reduce data storage required

Database virtualization

Database virtualization in this case we create multiple layers of a single database and put to be accessed by user all over the required platform or area. a single database is manipulated and edited all around and all of those changes are saved in the central main database or in technical term we can say that- Data virtualization is the decoupling of the database layer, which lies between the storage and application layers within the application stack. Virtualization of the database layer enables a shift away from the physical, toward the logical or virtual. Virtualization enables compute and storage resources to be pooled and allocated on demand. This enables both the sharing of single server resources for multi-tenancy, as well as the pooling of server resources into a single logical database or cluster. In both cases, database virtualization provides increased flexibility, more granular and efficient allocation of pooled resources, and more scalable computing.

Virtualization in education

Virtualization in field of education is playing a great significant role where ever it is applied Successfully managing multiple sites and an array of faculty, staff, and student needs is becoming increasingly difficult as budgets decrease and equipment and facilities age. Use virtualization in education to help cut costs, increase efficiency, and adapt quickly and automatically to changing requirements.

Choose from:

• Hardware virtualization. Run multiple operating systems (for example, Linux and Windows) on a single server.
• Application virtualization. Rapidly deploy applications, even those that conflict with each other, with low administrative overhead.
• Presentation virtualization. Execute an application on one computer and present it with another.
• Desktop virtualization. Run multiple operating systems (OSs) on a single desktop. Centrally execute Windows 7 in virtual machines (VMs) running on servers.
• Virtualization management. Manage your entire virtual and physical infrastructures with a unified set of tools.

All the products and technologies we use in virtualization solutions have a common, policy-based management system that helps to ease the load on system managers.

Benefits

• Help reduce your total cost of ownership (TCO) and increase your return on investment (ROI) across your entire computing infrastructure.
• Turn computing assets into on-demand services to improve your business agility.
• Maintain "one application, one server" while reducing physical server sprawl through server consolidation and provisioning.
• Provide optimal desktop solutions for different user needs while still meeting IT requirements.
• Centrally provision and manage both physical and virtual resources.
• Help ensure effective business continuity and disaster recovery by compartmentalizing workflows and maintaining failover plans.
• Rapidly model and test different environments without significant expansion of hardware and physical resources.
• Improve security by isolating computing layers and minimizing the chance of widespread failure.
  
  

 thanks....

Pleae share it.....