Research And Implementation Of Partition-based Resource Constraint Mechanism

Server partitioning technology is a hot topic of research in server consolidation. Partitioning can occur at four different levels, i.e. physical partitioning, logical partitioning, software partitioning and Operating System (OS) level partitioning. OS level partitioning is implemented in the OS kernel, which virtualizes the OS's application execution environment, rather than the physical hardware. We call this technology as kernel partitioning technology.In a server with multiple partitions supported by kernel partitioning technology, the system resources are shared between all partitions. Without some resource control ability for partitions, once a partition suffers from attack or intrusion, it is likely to monopolize all the system resources, resulting in the Denial of Service (DoS) attack to the system. Most of the modern OSs offers some mechanisms for limiting the use of system resources, such as process rlimit and disk quotas. Nevertheless, these mechanisms are not applicable to constraint the use of resources for partitions. Aiming to solve this problem, the partition-based resource constraint mechanism is proposed in this thesis. This mechanism can control the use of system resources at the partition granularity, which consequently enhances the server system's security and availability. Furthermore, it can optimize the use of system resources to some extent along with increasing the server system's service level.The mechanism's features, significance and key factors of implementation are discussed in detail and a logical framework is presented in addtition. Likewise, the KPRC (Kylin Partition-based Resource Constraint) mechanism is designed and implemented in the Kylin operating system. KPRC improves the administrator's power on managing partitions and strengthens the Kylin partition's security. Test results for the KPRC reveal that, with reasonable performance overhead, it can control the use of system resources by partitions effectively, sequentially improve the system's capability to defense the type of resource starvation DoS attack.The main contributions of this thesis are:· The partition-based resource constraint mechanism is proposed. Such mechanism can control the use of resources for partitions.· A general logical framework for partition-based resource constraint is presented, which is very easy to implement and has good extensibility.· The KPRC mechanism is implemented, in which five types of resource control ability are included, i.e. processor time, virtual address space size, file number, disk space and process number.