# An Access Control Model for Preventing Virtual Machine Hopping Attack
## 4 Methods
### PVMH Model Design
#### 4.2.5 Security Level  
The PVMH model has 8 confidentiality levels and 8 integrity levels. The confidentiality set is defined as \(C=\{C_{1},\ C_{2},\ \ldots,\ C_{8}\}\), where \(C_{1}>C_{2}>\ldots>C_{8}\), while the integrity set is defined as \(I=\{I_{1},\ I_{2},\ldots,I_{8}\}\), where \(I_{1}>I_{2}>\ldots>I_{8}\). Both the confidentiality level and integrity level are 3-bit binary numbers, as shown in Table 2.  
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**Virtual Machine State** & **Corresponding Function** & **Effect** & \begin{tabular}{c} **Corresponding** \\ **Transition Rules** \\ \end{tabular} \\ \hline \begin{tabular}{c} virtual machine \\ management \\ \end{tabular} & modifying access permission & \begin{tabular}{c} Hypervisor modifies access permission for \\ a certain virtual machine. \\ Hypervisor modifies security level of \\ a certain subject virtual machine. \\ Hypervisor modifies security level of \\ a certain object virtual machine. \\ Hypervisor modifies security level of \\ a certain object virtual machine. \\ Hypervisor grants some access attribute to \\ a certain subject virtual machine. \\ \end{tabular} & Rule 8 \\  & releasing access attribute & \begin{tabular}{c} Hypervisor modifies security level of \\ a certain subject virtual machine. \\ a certain subject virtual machine. \\ a certain subject virtual machine. \\ a certain subject virtual machine. \\ \end{tabular} & Rule 10 \\ \hline \begin{tabular}{c} creating a guest \\ virtual machine \\ \end{tabular} & \begin{tabular}{c} creating a subject \\ creating an object \\ \end{tabular} & \begin{tabular}{c} Hypervisor creates a subject virtual \\ machine and sets its security level. \\ Hypervisor creates an object virtual \\ machine and sets its security level. \\ \end{tabular} & Rule 5 \\ \hline \begin{tabular}{c} deleting a guest \\ virtual machine \\ \end{tabular} & \begin{tabular}{c} deleting a subject \\ deleting an object \\ \end{tabular} & \begin{tabular}{c} Hypervisor deletes a subject virtual \\ machine and its related data. \\ Hypervisor deletes an object virtual \\ machine and its related data. \\ \end{tabular} & Rule 6 \\ \hline \begin{tabular}{c} virtual machine \\ communication (access \\ to shared data, etc.) \\ \end{tabular} & \
\begin{tabular}{c} writing an object \\ reading an object \\ \end{tabular} &
\begin{tabular}{c} Subject virtual machine writes data into \\ and reads data from object virtual machine. \\ Subject virtual machine only reads data \\ from object virtual machine. \\ Subject virtual machine only writes data \\ into object virtual machine. \\ \end{tabular} & Rule 1 \\ \hline \hline \end{tabular}
\end{table}
Table 1: State transition rules.  
PVMH has 16 security categories or access permissions. The security category set is defined as \(K=\{K_{1},\ K_{2},\ \ldots,\ K_{16}\}\). The security category is a 16-bit binary number, where each bit is a specific access permission. When the \(i^{\text{th}}\) bit from the left is set to 1, the subject gains access to the object in \(K_{i}\) mode. When it is set to 0, the subject loses this access.