Techniques for monitoring a shared hardware resource

Patent metadata

Field	Value
Publication number	US-10459763-B2
Application number	US-201514593367-A
Country	US
Kind code	B2
Filing date	Jan 9, 2015
Priority date	Jan 10, 2014
Publication date	Oct 29, 2019
Grant date	Oct 29, 2019

Abstract

A technique for monitoring a shared hardware resource in a computer system running at least two partitions includes collecting measurement data from the hardware resource. An aggregation of the measurement data over a certain time interval is computed. A noise level value adapted to a workload is calculated using a workload dependent heuristic. Noise data, based on the calculated noise level value, is generated. The computed aggregation of measurement data is mixed with the generated noise data. The mixed aggregation of measurement data is output to an external interface for monitoring.

First claim

What is claimed is:

1. A data processing system, comprising:
a measurement component connected to a shared hardware resource that is shared by multiple partitions and configured to collect measurement data from the hardware resource and compute an aggregation of the measurement data over a certain time interval, wherein the shared hardware resource includes a cryptographic adapter;
a noise data generator connected to the measurement component and configured to compute a noise level value based on the aggregation of the measurement data and generate noise data based on the noise level value, wherein the noise level value is calculated using a workload dependent heuristic adapted to a workload; and
an external interface connected to the measurement component, wherein the measurement component mixes the aggregation of the measurement data with the noise data generated by the noise data generator to generate monitor data in which details of cryptographic operations performed by a guest using the cryptographic adapter cannot be learned by a hypervisor environment administrator or another guest from the generated monitor data thereby reducing a risk of violating privacy of the partitions that share the hardware resource and outputs the generated monitor data to the external interface for monitoring, and wherein the heuristic generates at least one usage profile for the shared hardware resource comprising a list of measurements measured over a first time interval, and wherein each of the measurements comprises a vector of values and is associated with a specific partition and the vector of values is taken from a simulation or a real computation of the workload over a period of time, where the heuristic computes for each usage profile: a first sub-usage profile from the corresponding usage profile by removing measurement data associated with a first partition from the usage profile; an absolute value of a difference of the aggregation of the measurements in the corresponding usage profile and an aggregation of measurements in the first sub-usage profile; and a sum of absolute values of vector components representing the difference.

2. The system of claim 1 , further comprising a noise information repository accessible from the measurement component and the noise data generator, wherein the noise information repository is adapted for storing noise data and/or noise level values as noise information computed by the noise data generator.

3. The system of claim 1 , wherein the measurement component is adapted to sample and collect specific measurements from the shared hardware resource and to provide the measurement samples to the noise data generator.

4. The system of claim 1 , wherein data inside the measurement component is shielded from external access with exception of the mixed measurement data accessible through the external interface and the aggregation of the measurement data accessible to the noise data generator, and wherein data inside the noise data generator and data inside the noise information repository is shielded from external access.

5. The system of claim 1 , wherein the noise information repository initially does not contain noise information, and wherein the noise data generator is adapted to write noise information to the noise information repository and to read noise information from the noise information repository and the measurement component is adapted to detect or to read noise information from the noise information repository.

6. The system of claim 1 , wherein the noise data generator and/or the noise information repository are part of the measurement component.

7. A computer program product, comprising:
a tangible computer-readable storage device; and
computer-readable program code stored on the computer-readable storage device, wherein the computer-readable program code, when executed on a data processing system, causes the data processing system to:
collect measurement data from a shared hardware resource that is shared by multiple partitions, wherein the shared hardware resource includes a cryptographic adapter;
compute an aggregation of the measurement data over a certain time interval;
use a workload dependent heuristic to calculate a noise level value adapted to a workload;
generate noise data based on the calculated noise level value;
mix the computed aggregation of the measurement data with the generated noise data to generate monitor data in which details of cryptographic operations performed by a guest using the cryptographic adapter cannot be learned by a hypervisor environment administrator or another guest from the generated monitor data thereby reducing a risk of violating privacy of the partitions that share the hardware resource; and
output the generated monitor data to an external interface for monitoring, wherein the heuristic generates at least one usage profile for the shared hardware resource comprising a list of measurements measured over a first time interval, and wherein each of the measurements comprises a vector of values and is associated with a specific partition and the vector of values is taken from a simulation or a real computation of the workload over a period of time, and where the heuristic computes for each usage profile: a first sub-usage profile from the corresponding usage profile by removing measurement data associated with a first partition from the usage profile; an absolute value of a difference of the aggregation of the measurements in the corresponding usage profile and an aggregation of measurements in the first sub-usage profile; and a sum of absolute values of vector components representing the difference.

8. The computer program product of claim 7 , wherein the measurement data is restricted to data associated with a subset of at least two of the partitions run by the data processing system.

9. The computer program product of claim 7 , wherein the heuristic calculates a maximum of approximated noise level values used as the noise level value to generate the noise data.

10. The computer program product of claim 7 , wherein the heuristic computes a new noise level value while providing measurement data confounded with noise data generated based on an existing noise level value and then replaces the existing noise level value by the new noise level value.

11. The computer program product of claim 10 , wherein a first noise level value and a first time interval are replaced by a second noise level value and a second time interval, wherein the first noise level value is calculated using the first time interval and the second noise level value is calculated using the second time interval, which is greater than the first time interval, if the first noise level value is higher than a defined threshold value.

Assignees

• IBM

Inventors

• Buendgen Reinhard
• Mayer Ulrich
• Werner Klaus
• Huber Matthias

Classifications

• G06F11/3068

  where the reporting involves data format conversion · CPC title

• G06F2221/2135

  Metering · CPC title

• G06F21/00

  Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity · CPC title

• G01R29/26

  Measuring noise figure; Measuring signal-to-noise ratio · CPC title

• G06F2009/45587

  Isolation or security of virtual machine instances · CPC title