I/O virtualization is utilized by cloud platforms to provide tenants with efficient, scalable, and manageable network and storage services. The de-facto industrial standard, paravirtualization, offers rich cloud functionality by introducing split front-end and back-end drivers in the guest and host operating systems, respectively. Given this fact, paravirtualization incurs host inefficiency and performance overhead. Thus, emerging hardware virtio accelerators (i.e., SRIOV-capable devices that conform to virtio specification) with device passthrough technologies mitigate the performance issue. However, adopting these devices presents the challenge of insufficient support for live migration.This paper proposes Un-IOV, a novel I/O virtualization system that simultaneously achieves bare-metal level I/O performance and migratability. The key idea is to develop a new hybrid virtualization stack with: (1) a host-bypassed direct data path for virtio accelerators, and (2) a relayed control path guaranteeing seamless live migration support. Un-IOV achieves high scalability by consuming minimum host resources. Extensive experiment results demonstrate that Un-IOV achieves superior network and storage virtualization performance than software implementations with comparable performance of direct passthrough I/O virtualization, while imposing zero guest modification (i.e., guest transparency).

With the rapid deployment of cloud services and the transformation of traditional on-prem services, e.g., infrastructure, platform, and security, to cloud platforms, the demand for High Availability for cloud services is essential. The growth of compute services through cloud platforms can no longer be met via standard resource provisioning techniques, which includes resources such as compute devices, network devices, etc. Device virtualization is key for cloud resource allocation. Even with the continued adoption of workload containerization, the requirement of domain isolation and the flexibility of service provisioning, containerization within a Virtual Machine is the preferred cloud deployment model. In this paper, we present the design of a live network device update mechanism, e.g., driver and firmware, through a host managed device emulation interface for services deployed on a cloud compute platform. This design does not require scheduled shutdowns of the cloud server, nor does it require hardware redundancy for a system administrator to perform driver and/or firmware maintenance updates. The innovative design presented in this paper enables dynamic resource sharing based upon the service requirements, e.g., failover switching time and network throughput, between the target devices to be updated along with other network devices either in service or on standby. A live networking device mechanism reduces compute service interruption and provides a transparent network function transition between the target interfaces and the failover interfaces.

Physical layer (PHY) security has aroused great research interest in recent years, exploiting physical uncertainty of wireless channels to provide communication secrecy without placing any computational restrictions on the adversaries under the information-theoretic security model. Particularly, researches have been focused on investigating Wyner's Wiretap Channel for constructing practical wiretap codes that can achieve simultaneous transmission secrecy and reliability. While theoretically sound, PHY security through the wiretap channel has never been realized in practice, and the feasibility and physical limitations of implementing such channels in the real world are yet to be well understood. In this paper, we design and implement a practical opportunistic secret communication system over the wireless wiretap channel for the first time to our best knowledge. We show that, our system can achieve nearly perfect secrecy given a fixed codeword length by carefully controlling the structure of the parity-check matrix of wiretap codes to strike the proper balance between the transmission rate and secrecy. Our system is implemented and evaluated extensively on a USRP N210-based testbed. The experimental results demonstrate the physical limitations and the feasibility of building practical wiretap channels in both the worst channel case and the case where the sender has only the knowledge of instantaneous channel capacities. Our system design and implementation successfully attempts towards bridging the gap between the theoretical wiretap channel and its practice, alleviating the unrealistic and strong assumptions imposed by the theoretical model.