# An Access Control Model for Preventing Virtual Machine Hopping Attack
## 5 Experiments
### Experiments and Results  
There are many cases of virtual machine hopping attacks. Two of the possible scenarios of virtual machine hopping attacks have been selected here to verify the role of the PVMH module. **Attack scenario 1:** Virtual machine hopping attacks between virtual machines due to shared memory communication. Typical communication through shared memory is as follows: VM1 creates shared memory and transfers its grant reference to both virtual machines VM2 and VM3; VM2 and VM3 respectively map the authorized memory pages to their respective address spaces; By address mapping, VM2 and VM3 can read or write the shared page as it is exactly in their own memory address. When VM2 and VM3 have finished accessing this shared memory, they revoke the memory page address. At last, VM1 revokes the authorization and reclaims the grant reference. In the experiment, shared memory communication is implemented by dynamic kernel. Expected result: After the PVMH module is started, if VM2 and VM3 do not satisfy the access control rules, the shared memory cannot be used, thus the dynamic kernel fails and cannot be inserted in VM2 and VM3. Create virtual machines with the virt-manager tool, as shown in Figure 3.  
After creation, list all running virtual machines, as shown in Figure 4. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Machine** & **System Version** & **Kernel Version** & **Graphical Interface** \\ \hline Host machine & Ubuntu 16.04.5 & 4.15.0-42-generic & Yes \\ Virtual machine & CentOS-6.10 & 4.4.163-1.el6.elrepo.i686 & No \\ Xen Hypervisor & N/A & xen-hypervisor-4.6-amd64 & N/A \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Operating system environment. Figure 3: Create VM1. The security level and category of virtual machines are given in Table 5.  
Obviously, VM1 \(>\) VM2 \(>\) VM3 when comparing confidentiality and VM1 \(>\) VM2 \(=\) VM3 when integrity is concerned. Without PVMH, VM1, VM2, and VM3 can access each other. After PVMH is configured, however, VM1 can access VM2 and VM3 while VM2 and VM3 cannot access VM1. The access matrix is given in Table 6.  
The shared memory is created in VM1 and the key log is printed, as shown in Figure 5.  
The function of the kernel in VM1: First take a physical page of 4K size; then write \"Hello, by DY in DOM#1\" into this page; the starting memory address is 0 xdb566000 in the address space of VM1; then authorize according to the ID number of VM2 and VM3 and return the corresponding grant reference identifier, which is 797 for VM2 and 798 for VM3. According to the ID number of VM1 and the grant reference identifier mentioned above, the shared memory is referenced in the VM2 through dynamic kernel. Without PVMH, VM2 successfully reads the shared information written by VM1, as shown in Figure 6. \begin{table}
\begin{tabular}{c c c c c} \hline \hline \multirow{2}{*}{**Subject/Object**} & \multirow{2}{*}{**SID=OID**} & \multicolumn{3}{c}{**Access Attribute**} & \multirow{2}{*}{**Flag**} \\ \cline{3-3} \cline{5-6}  & & **R** & **A** & **W** \\ \hline VM1 & 0000 0000 0000 1 & 1 & 1 & 1 \\ VM2 & 0000 000 0001 0 & 0 & 0 & 0 \\ VM3 & 0000 000 0001 1 & 0 & 0 & 0 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Access matrix of VM1, VM2, and VM3. Figure 4: Command listing all running virtual machines. Figure 5: Create shared memory in VM1. Figure 6: Refer shared memory in VM2, without PVMH module. \begin{table}
\begin{tabular}{c c c c} \hline \hline \multirow{2}{*}{**Subject/Object**} & \multirow{2}{*}{**SID=OID**} & \multirow{2}{*}{**Confidentiality Level**} & \multirow{2}{*}{**Integrity Level**} & \multirow{2}{*}{**Security Category**} \\ \hline VM1 & 0000 0000 0000 1 & C\({}_{1}\)(111) & 12(110) & 0011 0100 1000 1010 \\ VM2 & 0000 0000 0001 0 & C\({}_{3}\)(101) & 1s(011) & 0000 1011 1001 0110 \\ VM3 & 0000 0000 0001 1 & C\({}_{5}\)(100) & 1s(011) & 0010 1011 1010 0011 \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Security settings of VM1, VM2, and VM3.