# An Access Control Model for Preventing Virtual Machine Hopping Attack
## 5 Experiments
### Experiments and Results
The function of the kernel in VM2: First, the 4K size is divided from the address space for mapping the shared page. Then VM2 maps the shared page to its own address space according to the ID number of VM1 and the grant reference identifier; in VM2, the starting address of this mapped page is 0 xe19c0000; after that, the information \"Hello, by DY in DOM#1\" written by VM1 can be read and the access is completed. In order to verify the role of the PVMH module, the dynamic kernel needs to be removed from VM2 at first, then the PVMH module enabled and the dynamic kernel reinserted in VM2, as shown in Figures 7 and 8 respectively. After starting the PVMH module, VM2 loses its permission to access the shared memory, which results in the failure of the dynamic kernel insertion. Similar results can be observed in VM3 with and without the PVMH module. This is consistent with PVMH rules, because VM2 has lower confidentiality and lower integrity than VM1. **Attack scenario 2:** The attacker uses the VM4 to mount and modify the /boot partition of VM5 through Hypervisor. As a result, VM5 cannot be started, causing the virtual machine hopping attack. Expected result: After the PVMH module is started, if the access control rule is not satisfied, VM4 cannot access the/boot partition of VM5, even using the privileged virtual machine Dom0. Set the security level and category of VM4 and VM5, as shown in Table 7.  
Obviously, VM4 < VM5 when comparing both confidentiality and integrity. Without PVMH, VM4 can mount the/boot partition of VM5 through Dom0. After PVMH is started, however, VM4 cannot access VM5 anymore. The access matrix is given in Table 8. \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Subject/Object** & **SID = OID** & **Confidentiality Level** & **Integrity Level** & **Security Category** \\ \hline VM4 & 0000 000 0010 0 & C\({}_{4}\)(100) & I\({}_{4}\)(010) & 0011 000 1010 1000 \\ VM5 & 0000 000 0010 1 & C\({}_{3}\)(101) & I\({}_{5}\)(011) & 0000 0011 1001 1000 \\ \hline \hline \end{tabular}
\end{table} 
Table 7: Security settings of VM4 and VM5. \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Subject/Object** & **SID = OID** & \multicolumn{3}{c}{**Access Attribute**} & **Flag** \\ \cline{3-5}  & & **R** & **A** & **W** & \\ \hline VM4 & 0000 0000 0010 0 & 1 & 0 & 1 & 1 \\ VM5 & 0000 000 0010 1 & 1 & 0 & 0 & 1 \\ \hline \hline \end{tabular}
\end{table} 
Table 8: Access Matrix of VM4 and VM5. Figure 8: Refer shared memory in VM2, with PVMH enabled. Figure 7: Enable the PVMH module. VM4 uses the privileged virtual machine Dom0 to view the partition of VM5, as shown in Figure 9.  
The disk of VM5 is divided into two partitions: /and/boot. Before the PVMH module is enabled, VM4 mounts and accesses the/boot partition of VM5 through Dom0. The \"Start\" value of the partition/boot, 2048, is used to calculate the offset in command mount, as shown in Figure 10:  
Since VM4 can modify the/boot partition of VM5, it can attack VM5 easily. Unmount the partition, enable the PVMH module and remount the/boot partition of VM5. The results are as given in Figure 11.  
After the PVMH module is enabled, VM4 cannot mount the/boot partition of VM5. It should be noted that the mount operation corresponds to a series of Linux system calls. In our implementation, after the PVMH module interception, it affects the input of subsequent system calls, so the error message is \"No such file or directory\". Through these two specific scenario experiments, it can be seen that the PVMH module has played a role in preventing virtual machine hopping attacks. In addition to the above experimental results, performance cost testing of PVMH is required to understand the impact of integrating PVMH into the original virtualization platform. Performance overhead experiment: Taking attack scenario 1 as an example, the most critical and time-consuming step in shared memory communication is to generate a system interruption through the HYPERVISOR_grant_table_op function, and then call a set of hypercalls.