## 4 Access Control Model for Preventing VM Escape Attack
### PVME Model
#### 4.3.1 Model Elements  
The PVME model uses the same symbols of the BLP model. The basic elements include: subject, object, access attribute set, main object security level, access control matrix, object level and system status. The following is a detailed description of the basic elements of PVME model. 1. Subject: the subject represents the active side that issues access operations and access requests. It usually refers the users or processes that can make the information flow. The capital \(S\) represents the subject set and the lowercase \(s\) represents a single subject, namely \(S=\{s_{1},s_{2},\ldots,s_{n}\}\). 2. Object: the object represents the side that can be accessed, generally documents, procedures or equipment that can be called. The capital \(O\) represents the subject set and the lowercase \(o\) represents a single subject, namely \(O=\{o_{1},o_{2},\ldots,o_{n}\}\). 3. Access Attribute Set: access set \(A=\{r,a,w,e^{*},c^{*}\}\). In our research environment, the communicating parties involved Hypervisor, VM, QEMU and Guest OS. However the subject can only be Hypervisor or QEMU and the object can be Hypervisor, Guest OS, VM or QEMU. When a virtual machine communicates with the Hypervisor, in addition to traditional access modes (read-only (\(r\)), write-only (\(a\)), write-read (\(w\))), we redefine the implementation of access mode (\(e^{*}\)), and add a new access mode (\(c^{*}\)). Since the execution (\(e\)) access in the BLP model is completely redefined in the PVME model, we use \(e^{*}\) to make that distinction. The execution (\(e^{*}\)) and control (\(c^{*}\)) modes are the only two operations that exist when theHypervisor communicates with virtual machines. Therefore, the access attribute set \(A=\{r,a,w,e^{*},c^{*}\}\). 4. Access Control Matrix: the element \(m_{ij}\) of access control matrix M represents the subject \(S_{i}\) owns the access to the object \(O_{j}\) in current state. 5. Security Level: the security level contains security classification and security category. \(C=\{C_{1},C_{2},\ldots,C_{n}\}\) denotes the security classification set where \(C_{1}>C_{2}>\ldots>C_{n}\) and \(K=\{K_{1},K_{2},\ldots,K_{m}\}\) represents the security category set whose element \(K_{i}(1\leq i\leq m)\) is a specific access property. Security level set \(L=\{L_{1},L_{2},\ldots,L_{p}\}\) is a partial ordered set, each item in the set \(L_{i}=(C_{i},K_{i})\) represents a security level, which \(C_{i}\in C\), \(K_{i}\subseteq K\), \(1\leq i\leq p\). If and only if \(C_{i}\geq C_{j}\cup K_{i}\supseteq\ K_{j}\) then we get \(L_{i}\geq L_{j}\). Each element in security level vector set \(F\) (\(F\subseteq L^{s}\times L^{o}\times L^{s}\)) is \(f=(f_{s},f_{o},f_{c})\) where \(f_{s}\) is the security level function of the object, \(f_{o}\) is the security level function of the object and \(f_{c}\) is the current security level function of the subject. Object Hierarchy: object level set \(H\) indicates the subordinate relationship between subject and object. In the object hierarchy, a node mostly has one and only one parent without a hierarchy ring. The symbol \(O_{j}\in H(O)\) represents \(O_{j}\) is the leaf node and \(O\) is the parent node in the hierarchy. 7. System Status: system Status collection is a four-tuple \(V=~{}\{B\times M\times F\times H\}\), every single element quadruple \(v=\{b\times M\times f\times H\}\) represents a system status, in which \(B\), \(M\), \(F\), \(H\) are the current accessing set, access control matrix, security level vector set and the hierarchy of the objects, respectively. The symbol \(B=P(S\times O\times A)\), and its element \(b\) (\(b\subseteq S\times O\times A\)) is the current access set, which records what subject can access what objects in which access property. 8. Request Element Set: request element set \(RA=~{}\{g,~{}r\}\), where the \(g\) denotes get or give the requests and the \(r\) denotes release or rescind the requests.