# An Access Control Model for Preventing Virtual Machine Hopping Attack
## 4 Methods
### PVMH Model Design
#### 4.1.1 Model Elements  
Basically, the PVMH model inherits most notations of the BLP model; its main model elements include: Subject, object, access attribute, access control matrix, security level, etc., as follows:  
1. Subject: The capital S represents the subject set, while the lowercase s is a single subject, namely \(S=\{s_{1},\;s_{2},\;\ldots,\;s_{n}\}\).
2. Object: The capital O represents the object set, while the lowercase o represents a single object, namely \(O=\{o_{1},\;o_{2},\;\ldots,\;o_{n}\}\).
3. Access Attribute Set \(A=\{r,\;a,\;w,\;e\}\): The PVMH model has different attributes: Read-only (\(r\)), write-only (\(a\)), read-write (\(w\)), and execute (\(e\)).
4. Access Matrix \(M\): Each element \(m_{ij}\) in \(M\) represents the access permission of subject \(S_{i}\) to object \(O_{j}\) in current state.
5. Security Level \(R=(C,\;I,K)\): The capital C indicates the confidentiality level, the capital I indicates the integrity level, and the capital K indicates the security category. The PVMH model has several functions associated with security level: \(f_{sc}\) for subject confidentiality, \(f_{si}\) for subject integrity, \(f_{sk}\) for subject security category, \(f_{oc}\) for object confidentiality, \(f_{oi}\) for object integrity, \(f_{ok}\) for object security category, \(f_{ht}\) for the highest writing-up level, and \(f_{ht}\) for the lowest writing-up level. Function \(f_{role}\) represents user identity, that is, whether the user is a trusted subject (Hypervisor or the privileged virtual machine) or a general subject. The notations \(\geq\) and \(>\) represent the partially ordered relationship of confidentiality between subject and object, while the notation \(\supseteq\) represents the inclusion relationship of the security category between subject and object. The security level set \(\mathrm{R}=\left(R_{1},R_{2},\ldots,R_{p}\right)\) is a partial order set, and each item \(R_{i}=\left(C_{i},\;I_{i},K^{\prime}_{i}\right)\) in the set represents a security level, where \(C_{i}\in C\), \(I_{i}\in\mathrm{I}\), \(K^{\prime}_{i}\subseteq K\), \(1\leq i\leq p\). \(R_{i}\) dominates \(R_{j}\), denoted as \(R_{i}\geq R_{j}\), if and only if \(C_{i}\geq C_{j}\cup I_{i}\geq I_{j}\cup K^{\prime}_{i}\supseteq K^{\prime}_{j}\). The functions \(f_{sr}\) stands for the security levels of the subject and \(f_{or}\) represents for the security levels of the object.
6. Subject-object Security Label: The subject security label includes security level, information category (optional), and the highest writing-up level. The highest writing-up level of the subject indicates the highest security level of the object that allows the subject to perform the append or write-only access. The object security label includes security level, information category (optional), and lowest writing-up level. The lowest writing-up level of the object represents the lowest security level of the subject that allows append or write-only access to the object.
7. Request Element \(RA=\{g,\;r\}\): The lowercase \(g\) represents a get or give request while the lowercase \(r\) represents a release or rescind request.
8. The system state set \(V\) is represented by a quaternion \(V=\{B\times M\times F\times H\}\), where \(B=P(S\times O\times A)\) is the current access set, \(b\) represents the current access set, \(M\) is the access control matrix, \(F\) is the access function, and \(H\) is the hierarchical structure between objects, representing the subordinate relationship between objects. In object hierarchy, there is at most one node and only one parent node, and there is no ring in the structure.