Presentation on theme: "Your Desktop on Your Keychain"— Presentation transcript:
1Your Desktop on Your Keychain Ted WobberMSR Silicon Valleywith Muthukarrupan Annamalai,Andrew Birrell, and Dennis Fetterly
2Hardware vs. Desktop State Computers are (increasingly) everywhereIn furniture/kiosks/environment?New form factors for carrying state:Keychains, cellphones, watchesCan we make desktop state portable without also carrying the computer hardware?Desktop state = user preferences user data + applications
3Who cares?? Corporations and other large organizations Moving between offices, sitesOffice-sharingWork-at-home scenariosConsumers in generalBut kiosk infrastructure and security is a barrierEmerging marketsDesktop hardware is scarceBenefit may outweigh security risk
4Models of Desktop Portability LaptopsRoaming profilesRemote desktop
5Laptops Laptops are (usually) bulky and fragile Expensive to purchase and to manageProne to theftOnce stolen, data is (often) vulnerableBackup can be haphazardBut, laptops are self contained and offer a valuable platform for disconnected environments
6Roaming Profiles Applications don’t roam In Windows, difficult to separate user, application, and machine-specific stateSlow, bandwidth intensiveDifficult outside single admin domainSecurity of host machine?
7Remote Desktops Needs strong connectivity Latency-sensitive Difficult outside single admin domainNeeds managed server to provide RDP serviceMost desktop PCs aren’t “professionally managed”Local devices?
8Flash Changes the Equation Current cost: 1GB = ~$80Still following Moore’s LawRead/Write performance approaching diskModern flash has built-in wear-levelingMax write limitations are rarely a problemFor this talk: Flash == USB Flash Device
9Flash Statistics (estimate) Projected shipments million units in 20052 GB in ’04; 4GB+ in ’05.Estimated revenue on NAND-based Flash at $9.2 billion in ‘06 timeframeNAND Read/Write speeds are slated to increase as follows:‘04 read 8 MB/s; write 6.5MB/s.’05 read. 23 MB/s; write 16MB/s.‘06 read 40 MB/s; write 28 MB/s.‘07 guesstimates are 100MB/s using multiple NAND chips and cache.Already being extended with onboard CPU, memory, wireless, etc.
10Carry user state cache on flash Similar problems to roaming profiles:Applications don’t roamIn Windows, difficult to separate user, application, and machine-specific stateSlow, bandwidth intensiveDifficult outside single admin domainSecurity of host machine?
11Boot from Flash Drivers Flash capacity (in short term) Problem gets worse with age of installationFlash capacity (in short term)Size of OS + apps a problemWhat happens when disk is full?Machine state (e.g. hibernation) is non portableBackup?
12Our Solution Host machine runs virtual machine monitor User runs in a virtual machine (VirtualPC)Virtual disk is a “server in the sky”Remote disk handles overflow and backupThe flash acts as:A persistent cache/log of virtual diskStorage for virtual machine stateLocal disk as “lookaside” for virtual disk content
13Why Virtualization? Eliminates host-specific customization (e.g. drivers, etc)Easy to encapsulate and move VM stateFewer “moving parts” on hostEasier to manage/secure: VMM is only requirementDevelopment cost (our prototype < 1 kloc)Simple to customize basic abstractionsGood performance and getting betterHardware support of virtualizationOther platforms? XBox2?Virtual disks make provisioning new users easy
14Differencing Disk(s): Compact representation of overlaid contentStandard feature of virtual machinesConvenient for shared disk provisioningE.g. multiple users share same base diskVMM sees:Differencing Disk(s):Base Disk:
15Why a network connection? At least for now, flash drives are too smallWith Windows+Office it’s easy to overflow a 1GB diskBackup is automaticServer can keep multiple restore pointsPerhaps this requirement can be eliminated in the future
16Kiosk Architecture VMM Host Flash Disk VirtualPC Disk as seen by Write LogRead CacheYour Computing EnvironmentVirtualPCDisk as seen byyour programsFile ServerComposed of ...User-SpecificDifferencing DiskLookaside Images (~Base Disk)Base Disk Image
17Disk Writes VMM Host Flash Disk VirtualPC Disk as seen by Your Computing EnvironmentFlash DiskWrite LogVirtualPCRead CacheDisk as seen byyour programsFile ServerComposed of ...User-SpecificDifferencing DiskBase Disk ImageLookaside Images (~Base Disk)
18Disk Reads VMM Host Flash Disk VirtualPC Disk as seen by your programs Your Computing EnvironmentFlash DiskWrite Log1VirtualPCRead Cache3Disk as seen byyour programsFile ServerComposed of ...425User-SpecificDifferencing DiskBase Disk ImageLookaside Images (~Base Disk)
20A bit more detail Persistent state on flash Virtual machine state (optional)Writes logged since last mergeFingerprint for every 16K chunk in remote virtual diskMD5 as a fingerprinting algorithm (128 bits)Set of cached 16K chunks
21Persistent, in flashA: Chunk number to Fingerprint map (for entire disk)FP0FP1…FPNB: Write Log (sectors)27Data for sector 273Data for sector 317Data for sector 17C: Read Cache (chunks)……..7Data for chunk 7114Data for chunk 11435Data for chunk 35……..
22Volatile, in memoryA: Chunk number to Fingerprint map (for entire disk)FP0FP1…FPNB: FP to Read Cachehash table (chunks)C: Write loghash table (sectors)FP0FP1…FPNFP735…Chunk 35…..7Chunk 7114Chunk 11417…Sector 17…..27Sector 273Sector 327FP1143FP3517……..…..…D: FP to Static Diskhash table (chunks)FPFPFP……..Lookaside Image
23Updating the Fingerprint Map Must compute new chunk fingerprintsPartial chunks requires unwritten sectorsRead old chunkNew FPAdd new sectors
24What’s actually implemented Write “log” is a differencing disk on flashDifferencing drive chain:Flash differencing disk → Home differencing disk → Home base diskManual merging onlyNo automatic updates in backgroundStandard VirtualPC “merge to parent”Merge updates read cacheRead cache is untuned
25Potential Drawbacks Security of kiosk machine Infrastructure rollout Connectivity requirementAs flash sizes grow, need for online server decreasesRange of solutions possible depending on sizeArtifacts of virtualizationAvailability of pass-through devicesFancy graphics devices unavailableEnsuring that working set fits within the cache
26Performance Bottlenecks Windows likes to write to diskFlash fills up quicklyDifferencing disk overlays >10% of base imageRead/write performance:4K Reads (sequential or random) ~.8 ms4K Writes (sequential) ~ 1.0 ms4K Writes (random) > 20ms !!!!We have confirmed this by analyzing traffic at the USB driver level. The root cause of the 20 ms latency is a mystery. Our observations are inconsistent with NAND-memory specs.
27Optimizations (current) Fast-launch defragmentation turned offPaging disabledLast-access date on files disabledVarious services turned offNo anti-virus / indexing
28Optimizations (possible) Implement real log (for sequentiality)With redundant write eliminationRAM disk for temporary files (e.g. IE)Keep guest-OS NTFS log on local diskLog writes to on-kiosk differencing disk … periodic sync to flashNetwork read/write compressionVirtual disk snapshots
29Security Primary threats: But, this is a computer: Bogus, tapped, or otherwise compromised kioskTheft of deviceBut, this is a computer:ASIC or processorNAND Memory
30Trusting the Kiosk Non-technical considerations Technical solutions Physical securitySite security (e.g. within a corporation)Physical packaging and locks (like an ATM)Kiosk owner must be accountableTechnical solutionsNGSCB / Trusted Boot / AttestationSmall footprint (e.g. just OS+VMM) helps hereUser-specific, unforgeable visual feedbackExternal helper device with UI (e.g. cellphone)
31Protecting Against Theft On-flash encryption, “unlocks” data only after:Flash authenticates kioskFlash informs user that kiosk is OKUser gives credentials (e.g. password or biometric)Lock-out on repetitive failureHost-based encryption is also possibleBut gives weaker guaranteesUser can roll back to disk state on server
32Related Projects Internet suspend/resume Stanford “Collective” project CMU / Intel LabsVirtual machine serial portabilitySupported by Coda-like distributed FSFlash for read optimizationStanford “Collective” projectPortable virtual machineVirtual state/disk “capsule” hierarchy
33Conclusions New model for desktop portability Augments range of existing techniquesSpectrum of flash-based solutionsLooking for ways we can help product effortsHaven’t explored business/market ramificationsHighlights two growing market forces: Flash and Virtualization