# An Access Control Model for Preventing Virtual Machine Hopping Attack
## 4 Methods
### PVMH Model Implementation  
We designed the PVMH architecture according to the security control module of the cloud computing platform, as shown in Figure 1.  
The PVMH framework prototype system is divided into two parts, with the core part in the hypervisor and the other part in the Host OS. The Host OS has an Access Management module. The hypervisor includes an Access Matrix module, an access control module (PVMH-ACM), a PVMH Information module, and an Access Decision module. 1. Access Management Module: The Access Management module is located in the Host OS, which is the entrance for the system administrator managing the entire PVMH module. When creating a virtual machine, the administrator can set the confidentiality level and integrity level according to specific requirements, and manage both the access matrix and information structure, according to the actual situation. 2. Access Decision Module: The main task of the Access Decision module is to check the access request sent by the virtual machine, to determine whether the access attribute of the PVMH \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Confidentiality Level** & **Integrity Level** & **Binary** & **Secret Level** \\ \hline C\({}_{1}\) & \(l_{1}\) & 111 & Level-1 \\ C\({}_{2}\) & \(l_{2}\) & 110 & Level-2 \\ C\({}_{3}\) & \(l_{3}\) & 101 & Level-3 \\ C\({}_{4}\) & \(l_{4}\) & 100 & Level-4 \\ C\({}_{5}\) & \(l_{5}\) & 011 & Level-5 \\ C\({}_{6}\) & \(l_{6}\) & 010 & Level-6 \\ C\({}_{7}\) & \(l_{7}\) & 001 & Level-7 \\ C\({}_{8}\) & \(l_{8}\) & 000 & Level-8 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Secret level. Figure 1: The PVMH architecture. module is satisfied, and filter requests that are illegal or have malicious data. Only legitimate requests are sent to PVMH-ACM module. 3 Access Matrix Module: The Access Matrix module is located in the virtual machine manager and stores all the required access matrices. 4 PVMH-ACM Module: The PVMH-ACM module is a concrete implementation of the security hook function interface provided by the Linux Security module (LSM). In addition, this module implements the specific functions of the PVMH model. 5 PVMH Information Module: Each virtual machine has its own information structure (PVMH Information), which is responsible for recording information about running virtual machines. The information includes the ID number of the virtual machine, the confidentiality level, the integrity level and the security category, and the pointer to the entry of the access matrix list entry and the current access set b(s), which was gradually established in the process from virtual machine starting-up to running. 6 Linux Security Module (LSM): LSM is the basis for implementing the PVMH-ACM module. When the underlying operating system starts, the LSM starts to function. When the corresponding security hook function is called, the user-implemented security module is called immediately. When the virtual machine issues an access request, the PVMH-ACM module determines whether to allow access to the resource according to the corresponding access control rules. The access control flowchart is shown in Figure 2:  
According to PVMH architecture, the specific implementation process is as follow:  
Figure 2: Access flowchart. high-res figure  
**Step 1**: The subject virtual machine sends a request to access the object virtual machine in a certain mode. The Access Decision module intercepts these requests, checks whether they conform to the access attributes of PVMH module, filters the illegal or malicious data requests directly, returns \"Error\", and sends the requests that conform to the access attributes to the PVMH-ACM module in Hypervisor. **Step 2**: The PVMH-ACM module queries in the Access Matrix and PVMH Information by resolving the incoming message, and makes decisions according to the state transition rules. Specifically, it takes it as an example that the subject virtual machine (SID) accesses the object virtual machine (OID) in read-only (R) mode. 1.