# V-MGSM: A Multilevel and Grouping Security Virtualization Model for Mobile Internet Service

Authors: Hui Zhu; Yingfang Xue; Xiaofeng Chen; Qiang Li; Hui Li
Journal: Mobile Information Systems
 (2015)

---

## Abstract

With the pervasiveness of smart phones and the advance of Mobile Internet, more and
more Mobile Internet services migrated to the cloud service platform for better user experience.
As one of the most indispensable components of the cloud computing infrastructure,
virtualization technology has attracted considerable interest recently. However, the flourish of
virtualization still faces many challenges in information security. In this paper, we propose a
novel architecture, called multilevel and grouping security model for virtualization (V-MGSM),
for the security of resources in cloud computing platform. Specifically, to fulfill the balance
between information sharing and privacy preservation, the virtual machines (VMs) are divided
into diverse groups based on their corresponding entities, and each VM in the same group is
assigned to different security level according to security requirements. Besides, the operation
between VMs is based on mandatory access control mechanism. Detailed security analysis
shows that the proposed V-MGSM can provide a secure communication mechanism for VMs
and implement the synchronous updates of the borrowed data. Ultimately, we implement V-MGSM
in Xen for experiments, and the results demonstrate that V-MGSM can indeed achieve
data security and privacy protection efficiently for Mobile Internet service.


---

## Body

## 1. Introduction

In our information society, Mobile Internet which makes Internet connection accessible and ubiquitous is becoming increasingly adopted by ordinary consumers. With wide popularity and broad application, Mobile Internet service performs adding huge income to business communities and the Mobile Internet industry has recently started to take off [1–3]. By the end of March 2013, there were more than 81 million Mobile Internet users in China which generated beyond 20 billion dollars Mobile Internet market scale.With tremendous advancement in mobile technology, people expect more services whenever and wherever possible. Although current mobile technologies and improvements allow shopping online, chatting online, or any other mobile applications through mobile terminals, several certain issues which hinder the communication process need to be addressed. For example, people tend to use mobile terminals such as smart phones to do anything realizable which causes series of problems including the following: the calculation load is magnified, the battery standby time is shortened, and the storage is limited. For the presented problems of mobile terminals, especially the limited computing ability and the limited storage discussed above, it is necessary to migrate Mobile Internet services to cloud platform to decrease the amount of computation and extend the standby time. A main advantage of cloud computing is to provide large storage and powerful computing ability by cloud server [4–6]. From this prospective, the cooperation between cloud computing and the Mobile Internet which is promising for cloud computing can transport applicable computing ability and storage from terminals to the cloud server. In short, the emergence of cloud computing is significant for the continued development of the Mobile Internet.Figure1 illustrates the necessity for traditional Mobile Internet services to be migrated to cloud service platform. Specifically, the larger the service scale is, the more the physical devices and instruments it requires to execute implementation are. In particular for Mobile Internet services, since it is constrained for the capacity of mobile terminals, more resources are required in the server of service provider [7, 8]. Benefiting from the increasing of computing ability and the decreasing of costs, virtualization technology brings many advantages over general technology in IT industry, such as raising utilization of hardware and promoting quality of service. For full use of infrastructure and reduction of the cost, more and more Mobile Internet service providers tend to migrate their services into a cloud service platform. However, the migrations of Mobile Internet service providers from conventional model to cloud services platform result in security issues which has become a critical concern. With virtualization, multitenant including medical service, education service, and enterprise service offers different services upon the same platform and may incur new vulnerabilities to the cloud platform, especially privacy violation between different service providers and internal access by VMs within one service provider. Even though virtualization security has attracted considerable interest in recent years and several secure solutions have been proposed [9, 10], the flourish of secure solutions for virtualization still faces many challenges in the balance between information sharing and privacy preservation. Security issues on virtualization technology have been the dominating barrier to the development and widespread use of Mobile Internet.(i)
A VM illegally accesses to another relatively important VM in a virtualization system without authorization, which may cause the leakage of confidential information.(ii)
To improve the efficiency of an organization, it is necessary to guarantee the information sharing among VMs which belong to the same organization.(iii)
Virtual machine monitor (VMM) has the highest priority in a virtualization system, and the virtualization system will be broken if VMM is accessed illegally.Figure 1
Cloud platform for Mobile Internet service.In order to construct a secure communication mechanism for virtualization [11] and fulfill the balance between information sharing and privacy preservation, a new multilevel and grouping security access control model (V-MGSM) is proposed in this paper. And our main contributions are threefold.(i)
In V-MGSM model, to implement the efficient isolation for VMs corresponding to different organizations, all VMs have been divided into several groups, which can avoid the unnecessary access and provide the privacy preservation among different groups.(ii)
For reasonable and secure access control, different security levels are assigned to VMs in the same group. In particular, a low-level VM is not able to access other VMs which have higher security levels; one VM could not access other VMs which are divided into other groups; and VMs with high level could manage VMs with low level. Then, the confidential information in a high-level VM will not be obtained by some malicious low-level VMs.(iii)
In the same group, a high-level VM could borrow data from a low-level VM, and when the borrowed data is modified in the low-level VM, the corresponding data in the high-level VM will be updated synchronously.The remainder of this paper is organized as follows. In Section2, we survey the related works. In Section 3, we present the architecture of our proposed V-MGSM model. Then, we provide the correctness and security proof of V-MGSM model in Section 4, followed by implementation in Section 5. Finally, we draw our conclusions in Section 6.


## 2. Related Works

### 2.1. Security Mechanisms for Virtualization

With the prosperity of virtualization, the security of communications between VMs has attracted considerable interest recently. The necessity of communication between VMs in the specific application scenario was firstly pointed out in [12], which mentioned that the implementation of access control mechanism for VMs’ communication was also essential. Furthermore, as a mandatory access control (MAC) mechanism, sHype [13] was one of the most well-known security architectures for VMM. Based on Xen, both the communication between VMs and the hardware resource access by VMs could be controlled well by sHype, which determine the kind of VMs that should run simultaneously according to the interest conflicts. However, the type of communication between VMs was not defined in sHype. Recently, some attention has been devoted into communication types between VMs. A Prioritized Chinese Wall (PCW) policy [14] was proposed, constructing a set of VMs which could communicate with each other dynamically. A role-based access control policy [15] was proposed later, which focused on the communication between guest VMs and VMM layer. However, they all ignored inter-VMs communication. A Virt-BLP model [16] based on BLP [17] model was proposed, which met the requirements of multilevel security for virtualization. As a security communication mechanism for virtual machine system, Virt-BLP model secured the communication between VMs, while the memory taken by access control matrix was so large.


### 2.2. Development of Multilevel Access Control Model

At present, there are several security models and methods used in nonvirtualized system to guarantee the access control. Bell-LaPadula Model [18], SeaView model [19], and multilevel relational (MLR) [20] model have been introduced after thirty years of the research on multilevel access control [21]. Compared with other models previously proposed, MLR was clear in semantics and perfect in function after years of research on the security access control model and has been widely used in several areas and was pretty secure as a multilevel security model. However, in a multilevel user system, due to the fact that a high-level user may want to borrow data from a low-level user when it is reasonable and necessary, a high-level user can borrow data from low-level tuple in MLR and the high-level tuple which does have this borrowed data will be updated or deleted synchronously when the borrowed data has been modified by the low-level user. Meanwhile, a deadly secure risk caused by data borrowing in MLR is that the change of a high-level user’s perspective by a low-level user may result in the leakage of confidential data from high-level user if a borrowed relation exists between these two users.


## 2.1. Security Mechanisms for Virtualization

With the prosperity of virtualization, the security of communications between VMs has attracted considerable interest recently. The necessity of communication between VMs in the specific application scenario was firstly pointed out in [12], which mentioned that the implementation of access control mechanism for VMs’ communication was also essential. Furthermore, as a mandatory access control (MAC) mechanism, sHype [13] was one of the most well-known security architectures for VMM. Based on Xen, both the communication between VMs and the hardware resource access by VMs could be controlled well by sHype, which determine the kind of VMs that should run simultaneously according to the interest conflicts. However, the type of communication between VMs was not defined in sHype. Recently, some attention has been devoted into communication types between VMs. A Prioritized Chinese Wall (PCW) policy [14] was proposed, constructing a set of VMs which could communicate with each other dynamically. A role-based access control policy [15] was proposed later, which focused on the communication between guest VMs and VMM layer. However, they all ignored inter-VMs communication. A Virt-BLP model [16] based on BLP [17] model was proposed, which met the requirements of multilevel security for virtualization. As a security communication mechanism for virtual machine system, Virt-BLP model secured the communication between VMs, while the memory taken by access control matrix was so large.


## 2.2. Development of Multilevel Access Control Model

At present, there are several security models and methods used in nonvirtualized system to guarantee the access control. Bell-LaPadula Model [18], SeaView model [19], and multilevel relational (MLR) [20] model have been introduced after thirty years of the research on multilevel access control [21]. Compared with other models previously proposed, MLR was clear in semantics and perfect in function after years of research on the security access control model and has been widely used in several areas and was pretty secure as a multilevel security model. However, in a multilevel user system, due to the fact that a high-level user may want to borrow data from a low-level user when it is reasonable and necessary, a high-level user can borrow data from low-level tuple in MLR and the high-level tuple which does have this borrowed data will be updated or deleted synchronously when the borrowed data has been modified by the low-level user. Meanwhile, a deadly secure risk caused by data borrowing in MLR is that the change of a high-level user’s perspective by a low-level user may result in the leakage of confidential data from high-level user if a borrowed relation exists between these two users.


## 3. Proposed V-MGSM Model

In this section, we redesign the architecture, elements, data explanations, security theorem, and state transition rules for better use in virtualization and propose a multilevel and grouping access control model on the basis of MLR model to construct a secure communication mechanism for VMs. We first review the architecture of virtualization, which serves as the basis of V-MGSM model.The practical architecture of virtualization is shown as in Figure2(a). With a software layer VMM inserted between hardware and operating systems, several VMs could run on one single physical machine at the same time. In addition, for secure communication between VMs, a mandatory access control (MAC) module is constructed to control the flow of communication between VMM and VMs. However, from different VMs’ perspectives, VMM is regarded as different entities. As shown in Figure 2(b), a virtualization system could be divided into several groups according to VMs’ corresponding organizations such as User System 1 and User System 2, each of which consists of VM1 and VM2, VM3 and VM4, respectively. What is more, in user system’s perspective, they are managed and controlled by VMM1 and VMM2 separately, although there is only one VMM in virtualization system indeed.Architecture of virtualization: (a) piratical architecture; (b) architecture viewed by VMs.
(a)
(b)


### 3.1. Elements of V-MGSM Model

Before introducing the formal definitions of the multilevel relational model and multilevel relation for virtualization, in this part, we define the basic elements of V-MGSM model as follows.(i) Subject and Object. Subjects represent active entities such as processes and users; objects represent passive entities such as data and files. In V-MGSM model, one VM is considered as a subject or an object based on the information flow of a communication process.(ii) Security Level. Assuming that there are two VMs in virtual machine system, if and only if the subject and the object are in the same organization and the security level of subject is higher than or equal to that of the object, then the object can be accessed by the subject.(iii) Data Attributes. In V-MGSM model, with virtualization system grouped on the basis of entities, in the scenario of communication between VMs, a VM could be queried by another VM only when they are corresponding to the same entity.Definition 1 (independent multilevel relational model for virtualization).
LetD denote an attribute domain, let Ai denote a data attribute from domain D, let Ci denote the security level of Ai, and letRC denote the security level of a VM. The relational instances with different levels are described as (A1,C1,A2,C2,…,An,Cn,RC). The domain of security levels could be specified by the set {L,…,H}, in which all of security levels of RC and Ai from the infimum L to the supremum H are involved.Definition 2 (multilevel relation for virtualization).
Letr[rc] denote the security level of a VM, let r[ci] denote the security level of ai, and the records of a VM in the multilevel relations are denoted by (a1,c1,a2,c2,…,an,cn,rc). Then, all data of data attributes and security levels in multilevel relation meet the following expression:
(1)ai∈Di,rrc≤rci.Concretely, each relational instance(A1,C1,A2,C2,…,An,Cn,RC) consists of many records (a1,c1,a2,c2,…,an,cn,rc), which are the records of VMs. All data and security levels in the relational instance meet the following expression:
(2)ai∈Di∨ai=null,c1,rc∈L,…,H,rc≥c1.


### 3.2. Data Explanations of V-MGSM Model

To avoid the fuzziness in the querying result which may occur in accessing a VM in MLR, two important properties, Entity Multi-Instance and Record Multi-Instance, are introduced. And Table1 is an example taken to describe the definition of Entity Multi-Instance and Record Multi-Instance. Two entities (Gun,U) and (Gun,S) are described in Table 1, which are created by U-subject and S-subject, respectively; U level is the lowest level, U-record is a basic record and could only access U-record, and it could only be deleted by U-subject as well;TS is higher than U in security level. Thus, bothTS-record and U-record could be accessed byTS-subject;TS-subject has borrowed the value of attribute Range “2” which is authorized byTS-subject. However, the value of the attribute quantity inTS-subject is set byTS-subject as the value of attribute quantity in U-subject is not authorized byTS-subject. Then, two kinds of multi-instance including Record Multi-Instance and Entity Multi-Instance are mentioned in the example shown above.Table 1
Entity with multi-instance.
Name
C
1
Range
Quantity
R
C
Gun3
S
1
Null
S
Gun3
U
2
Null
T
S
Gun3
U
2
5000
UDefinition 3 (Record Multi-Instance).
In a multilevel relation, the records which have the same value ofA1 and different values of RC are called Record Multi-Instance.Definition 4 (Entity Multi-Instance).
In a multilevel relation, the records which have the same value ofA1 and different values of C1 are called Entity Multi-Instance, meaning that the levels of entities are different. Then, the meaning of r(A1,C1,A2,C2,…,An,Cn,RC) can be explained as follows.(i) Primary Key
A
1
and Security Level Attribute
C
1
in V-MGSM Model. Let A1 denote the value of the primary key as well as the name of a VM, and let r[C1] denote both the identity of entity corresponding to VM and the security level of the entity in an instance r. r[C1]=c1 implies that the security level of the entity is c1 and the entity with security level c1 is called c1-entity. In V-MGSM, with VMs divided into different groups according to their corresponding entities, different security levels are assigned to these entities. Given the value of C1 at the specific moment, only one entity could be authorized by subjects who have the same value of C1.(ii) Security Level Attribute
R
C
in a Record.
r
[
R
C
]
=
r
c represents that record r is inserted by a VM with level rc, called rc-VM, and the data in this record is authorized by rc-VMs. If no corresponding record existed, it means that the entity is not authorized by rc-VM. The security level of a record, called rc, is used to judge whether the access is successful. Specifically, the data of VMs could be accessed by a subject who has a higher level than rc. In other words, a rc-VM could access other VMs r′ if r′[c1]=r[c1], r′[RC]≤rc. The data in a record r could only be deleted or updated by its owner and a borrowed relation exists between two VMs r and r′ if and only if they are divided into the same group and meet r′[RC]≥r[RC]∧r′[Ai,Ci]=r[Ai,Ci], r∈relationR.


### 3.3. Security Theorem of V-MGSM

In this part, we first elaborate the modifiedSimple-security-*_property, which is selected as one of the basements for V-MGSM model and was initially proposed in BLP model. Then, four integrated properties designed for V-MGSM are introduced.Definition 5 (Simple-security-*_property).
In V-MGSM model, the security level of a subject is not dominated by the security level of an object. VMM has the highest priority in a virtualization system; VM could only read data from other VMs with lower levels in the same group and could not read data from VMM or other VMs with higher levels, eliminating the phenomenon of reading upward. Neither VMM nor other VMs with higher security levels could update or delete any data in low-level VMs, eliminating the phenomenon of writing downward. Moreover, two basic secure theorems defined in BLP model claimed that the phenomena of reading upward and writing downward should be avoided absolutely.Definition 6 (Entity Integrated property).
Entity Integrated property can be formally represented asr[A1], r[C1]≠null∧r[RC]≥r[C1]. The modified Entity Integrated property is designed to confirm that every VM is divided into a unique group. A1 is the value of the primary key as well as the name of a VM and C1 is the security level of an entity corresponding to VM in an instance r.Definition 7 (Multi-Instance Integrated property).
Multi-Instance Integrated property can be formally described asA1, C1, RC→Ai, 2≤i≤n. The modified Multi-Instance Integrated property is designed for the inexistence of fuzziness in the querying process, which may be caused by accessing the object by a subject in MLR. All instances with the same value of primary keys are allowed in any relation. However, given the security level, only one entity is authorized by the subject at most. For simplicity, only one entity is authorized by VMM according to the value of C1 when processing commands at specific moment.To demonstrate the Multi-Instance Integrated property briefly and clearly, an example shown in Table2 is used to describe the multi-instance conflict. Two entities with the same value of primary key “Gun3” and different values of C1 are presented in this example, which is not allowed in V-MGSM model. What is more, there is only one entity authorized to avoid the fuzziness in the querying result for a given security level. Compared with MLR, the advantage of V-MGSM model is that entity with multi-instance is permitted by crossing security levels. Meanwhile, only one entity is authorized when VM accesses other VMs.Table 2
Multi-instance integrity conflict.
Name
C
1
Range
Quantity
RC
Gun3
S
1
Null
S
Gun3
U
2
5000
S
Gun3
U
3
5000
UDefinition 8 (Data-Borrowing Integrated property).
To all recordsr∈relationR, r[Ci]≤r[RC], for 2≤i≤n, if r[Ai]≠null, ∃r′∈relationR, and r′[C1]=r[C1]∧r′[Ci]=r[Ci], then r[Ai]=r′[Ai]. In V-MGSM, a high-level user cares more about the borrowed relation with a low-level user, rather than the detailed value of the borrowed data. The borrowed data is vindicated by the low-level VM and the security level of the borrowed data should be maintained as that of the low-level VM.(i) The Main Thought of the Improved Data Borrowing. The thought of data borrowing in MLR model is relatively unreasonable, since amount of confidential information may leak from a high-level user because a low-level user can change the view of a high-level user. Compared with MLR which is designed for nonvirtualized system, V-MGSM model is more reasonable and could be applied to a virtualization system and the information in high-level VMs will not be leaked by a low-level VM’sDELETE orUPDATE operation, overcoming the disadvantage of MLR model.(ii) Conditions for a Successful Data-Borrowing Operation. For secure inner communications between VMs within the same group, the improvement of V-MGSM mainly focuses on the aspect of data borrowing and synchronous update. In specific, we assume that the existence of the borrowed data is the basic condition for a successful data-borrowing operation by a high-level user; then, a low-level VM owns the value of the borrowed attribute; finally, the security level of borrowed data in the high-level VM is still maintained as the original security level, which ensures that the borrowed information is still vindicated by its creator. If none of the conditions is met, the borrowed data should be set null.(iii) How to Perform Synchronous Update. The security level of the borrowed data is maintained as the original level in high-level VM to perform synchronous update of the borrowed data when it has been modified or deleted by low-level VM.Therefore, the borrowed data from low-level VMs is set null or updated synchronously in high-level VMs when deleted or modified by the creator, avoiding losing important information.Definition 9 (Nonborrowed Attribute Integrated property).
Nonborrowed Attribute Integrated property can be formally described as(Ai,Aj∈NBA), R[Ci]=R[Cj]. NBA denotes nonborrowed attributes in relation R. For all data in VMs, one instance of multirelation R meets Nonborrowed Attribute Integrated property when the security levels of Ai belonging to nonborrowed attributes are the same.


### 3.4. State Transition Rules to V-MGSM Model

In this part, four orders (INSERT,DELETE,UPDATE, andSELECT) and their corresponding grammars are defined as the state transition rules of V-MGSM model.Definition 10 (INSERT manipulation language).
Grammatical form ofINSERT manipulation language is described as follows:
(3)INTERTINTOR[(A1,A2,…)]VALUESa1,a2,…a1∈D1,a2∈D2,….Semantics. R denotes the name of a relation, A1 denotes the name of VM, and [] denotes the alternative items. EveryINSERT operation could create one record with security level c into relation R by a c-subject at most. For all 2≤i≤n, if Ai is in the list of “into” attribute, then r[Ai]=ai∧r[Ci]=r[RC]. Another case, r[Ai]=null∧r[Ci]=r[RC]=c, should be taken into account if the value of Ai is not inserted into record r.INSERT operation is permitted only when none of records r′∈relationR meets r′[A1]=r[A1]∧r′[RC]=c. One record could be inserted successfully if the generated state of virtualization satisfies Entity Integrated (EI) property, Multi-Instance Integrated property, and Nonborrowed Attribute Integrated (NBAI) property simultaneously.Definition 11 (DELETE manipulation language).
Grammatical form ofDELETE manipulation language is described as follows:
(4)DELETEFROMRWHEREp.Semantics.R denotes the name of a relation, p denotes a check expression which could be security attribute expression or data expression, and the data of any VM could only be deleted by its creator.DELETE operation is permitted if and only if r[RC]=c and meets p and then deletes record r. In V-MGSM model, another situation shown as follows is taken into account because of data borrowing. For all records r∈relationR, we can obtain r′[Ai]=null, if ∃r′∈relationR, and r′[C1]=r[C1]∧r′[RC]>r[RC]∧r′[Ai,Ci]=r[Ai,Ci].Definition 12 (UPDATE manipulation language).
Grammatical form ofUPDATE manipulation can be described as follows:
(5)UPDATESETA2=s2,A3=s3[WHEREp]2≤i≤n.Semantics. ForUPDATE manipulation language, the data of any VM could only be updated by its creator. In V-MGSM model, another situation, synchronous update of the borrowed information, is taken into consideration if high-level VM has borrowed data from low-level VM. The value of A1 is not allowed to be modified inUPDATE operation. For all records r in relation R, if p∧r[RC]=c, then r[Ai,Ci]=(si,c). The value of the updated attribute could only be updated by its creator, so the security level of updated attribute is maintained as that of its owner whether it has been borrowed or not. The value of updated attribute in both of the low-level VM and high-level VM is updated synchronously when borrowed relation exists between these two VMs. Therefore, if ∃r′∈relationR, r′Ai,Ci=rAi,Ci∧r′RC>c, and r′[Ci]=c, then  r′[Ai]=si.Definition 13 (SELECT manipulation language).
Grammatical form ofSELECT manipulation language is described as follows:
(6)SELECTA1[,A2]FROMR1[,R2]WHEREp.Semantics. Let * denote selecting all data from relation R, and let p denote a check expression which could be security attribute expression or data expression. Data of VMs in relation R1[,R2] will be calculated in p, and record r will be accessed by a higher-level subject in the same group. If r[C1]=r′[C1]∧r[RC]≤c′, then the information of VM could be queried by c′-subject.


## 3.1. Elements of V-MGSM Model

Before introducing the formal definitions of the multilevel relational model and multilevel relation for virtualization, in this part, we define the basic elements of V-MGSM model as follows.(i) Subject and Object. Subjects represent active entities such as processes and users; objects represent passive entities such as data and files. In V-MGSM model, one VM is considered as a subject or an object based on the information flow of a communication process.(ii) Security Level. Assuming that there are two VMs in virtual machine system, if and only if the subject and the object are in the same organization and the security level of subject is higher than or equal to that of the object, then the object can be accessed by the subject.(iii) Data Attributes. In V-MGSM model, with virtualization system grouped on the basis of entities, in the scenario of communication between VMs, a VM could be queried by another VM only when they are corresponding to the same entity.Definition 1 (independent multilevel relational model for virtualization).
LetD denote an attribute domain, let Ai denote a data attribute from domain D, let Ci denote the security level of Ai, and letRC denote the security level of a VM. The relational instances with different levels are described as (A1,C1,A2,C2,…,An,Cn,RC). The domain of security levels could be specified by the set {L,…,H}, in which all of security levels of RC and Ai from the infimum L to the supremum H are involved.Definition 2 (multilevel relation for virtualization).
Letr[rc] denote the security level of a VM, let r[ci] denote the security level of ai, and the records of a VM in the multilevel relations are denoted by (a1,c1,a2,c2,…,an,cn,rc). Then, all data of data attributes and security levels in multilevel relation meet the following expression:
(1)ai∈Di,rrc≤rci.Concretely, each relational instance(A1,C1,A2,C2,…,An,Cn,RC) consists of many records (a1,c1,a2,c2,…,an,cn,rc), which are the records of VMs. All data and security levels in the relational instance meet the following expression:
(2)ai∈Di∨ai=null,c1,rc∈L,…,H,rc≥c1.


## 3.2. Data Explanations of V-MGSM Model

To avoid the fuzziness in the querying result which may occur in accessing a VM in MLR, two important properties, Entity Multi-Instance and Record Multi-Instance, are introduced. And Table1 is an example taken to describe the definition of Entity Multi-Instance and Record Multi-Instance. Two entities (Gun,U) and (Gun,S) are described in Table 1, which are created by U-subject and S-subject, respectively; U level is the lowest level, U-record is a basic record and could only access U-record, and it could only be deleted by U-subject as well;TS is higher than U in security level. Thus, bothTS-record and U-record could be accessed byTS-subject;TS-subject has borrowed the value of attribute Range “2” which is authorized byTS-subject. However, the value of the attribute quantity inTS-subject is set byTS-subject as the value of attribute quantity in U-subject is not authorized byTS-subject. Then, two kinds of multi-instance including Record Multi-Instance and Entity Multi-Instance are mentioned in the example shown above.Table 1
Entity with multi-instance.
Name
C
1
Range
Quantity
R
C
Gun3
S
1
Null
S
Gun3
U
2
Null
T
S
Gun3
U
2
5000
UDefinition 3 (Record Multi-Instance).
In a multilevel relation, the records which have the same value ofA1 and different values of RC are called Record Multi-Instance.Definition 4 (Entity Multi-Instance).
In a multilevel relation, the records which have the same value ofA1 and different values of C1 are called Entity Multi-Instance, meaning that the levels of entities are different. Then, the meaning of r(A1,C1,A2,C2,…,An,Cn,RC) can be explained as follows.(i) Primary Key
A
1
and Security Level Attribute
C
1
in V-MGSM Model. Let A1 denote the value of the primary key as well as the name of a VM, and let r[C1] denote both the identity of entity corresponding to VM and the security level of the entity in an instance r. r[C1]=c1 implies that the security level of the entity is c1 and the entity with security level c1 is called c1-entity. In V-MGSM, with VMs divided into different groups according to their corresponding entities, different security levels are assigned to these entities. Given the value of C1 at the specific moment, only one entity could be authorized by subjects who have the same value of C1.(ii) Security Level Attribute
R
C
in a Record.
r
[
R
C
]
=
r
c represents that record r is inserted by a VM with level rc, called rc-VM, and the data in this record is authorized by rc-VMs. If no corresponding record existed, it means that the entity is not authorized by rc-VM. The security level of a record, called rc, is used to judge whether the access is successful. Specifically, the data of VMs could be accessed by a subject who has a higher level than rc. In other words, a rc-VM could access other VMs r′ if r′[c1]=r[c1], r′[RC]≤rc. The data in a record r could only be deleted or updated by its owner and a borrowed relation exists between two VMs r and r′ if and only if they are divided into the same group and meet r′[RC]≥r[RC]∧r′[Ai,Ci]=r[Ai,Ci], r∈relationR.


## 3.3. Security Theorem of V-MGSM

In this part, we first elaborate the modifiedSimple-security-*_property, which is selected as one of the basements for V-MGSM model and was initially proposed in BLP model. Then, four integrated properties designed for V-MGSM are introduced.Definition 5 (Simple-security-*_property).
In V-MGSM model, the security level of a subject is not dominated by the security level of an object. VMM has the highest priority in a virtualization system; VM could only read data from other VMs with lower levels in the same group and could not read data from VMM or other VMs with higher levels, eliminating the phenomenon of reading upward. Neither VMM nor other VMs with higher security levels could update or delete any data in low-level VMs, eliminating the phenomenon of writing downward. Moreover, two basic secure theorems defined in BLP model claimed that the phenomena of reading upward and writing downward should be avoided absolutely.Definition 6 (Entity Integrated property).
Entity Integrated property can be formally represented asr[A1], r[C1]≠null∧r[RC]≥r[C1]. The modified Entity Integrated property is designed to confirm that every VM is divided into a unique group. A1 is the value of the primary key as well as the name of a VM and C1 is the security level of an entity corresponding to VM in an instance r.Definition 7 (Multi-Instance Integrated property).
Multi-Instance Integrated property can be formally described asA1, C1, RC→Ai, 2≤i≤n. The modified Multi-Instance Integrated property is designed for the inexistence of fuzziness in the querying process, which may be caused by accessing the object by a subject in MLR. All instances with the same value of primary keys are allowed in any relation. However, given the security level, only one entity is authorized by the subject at most. For simplicity, only one entity is authorized by VMM according to the value of C1 when processing commands at specific moment.To demonstrate the Multi-Instance Integrated property briefly and clearly, an example shown in Table2 is used to describe the multi-instance conflict. Two entities with the same value of primary key “Gun3” and different values of C1 are presented in this example, which is not allowed in V-MGSM model. What is more, there is only one entity authorized to avoid the fuzziness in the querying result for a given security level. Compared with MLR, the advantage of V-MGSM model is that entity with multi-instance is permitted by crossing security levels. Meanwhile, only one entity is authorized when VM accesses other VMs.Table 2
Multi-instance integrity conflict.
Name
C
1
Range
Quantity
RC
Gun3
S
1
Null
S
Gun3
U
2
5000
S
Gun3
U
3
5000
UDefinition 8 (Data-Borrowing Integrated property).
To all recordsr∈relationR, r[Ci]≤r[RC], for 2≤i≤n, if r[Ai]≠null, ∃r′∈relationR, and r′[C1]=r[C1]∧r′[Ci]=r[Ci], then r[Ai]=r′[Ai]. In V-MGSM, a high-level user cares more about the borrowed relation with a low-level user, rather than the detailed value of the borrowed data. The borrowed data is vindicated by the low-level VM and the security level of the borrowed data should be maintained as that of the low-level VM.(i) The Main Thought of the Improved Data Borrowing. The thought of data borrowing in MLR model is relatively unreasonable, since amount of confidential information may leak from a high-level user because a low-level user can change the view of a high-level user. Compared with MLR which is designed for nonvirtualized system, V-MGSM model is more reasonable and could be applied to a virtualization system and the information in high-level VMs will not be leaked by a low-level VM’sDELETE orUPDATE operation, overcoming the disadvantage of MLR model.(ii) Conditions for a Successful Data-Borrowing Operation. For secure inner communications between VMs within the same group, the improvement of V-MGSM mainly focuses on the aspect of data borrowing and synchronous update. In specific, we assume that the existence of the borrowed data is the basic condition for a successful data-borrowing operation by a high-level user; then, a low-level VM owns the value of the borrowed attribute; finally, the security level of borrowed data in the high-level VM is still maintained as the original security level, which ensures that the borrowed information is still vindicated by its creator. If none of the conditions is met, the borrowed data should be set null.(iii) How to Perform Synchronous Update. The security level of the borrowed data is maintained as the original level in high-level VM to perform synchronous update of the borrowed data when it has been modified or deleted by low-level VM.Therefore, the borrowed data from low-level VMs is set null or updated synchronously in high-level VMs when deleted or modified by the creator, avoiding losing important information.Definition 9 (Nonborrowed Attribute Integrated property).
Nonborrowed Attribute Integrated property can be formally described as(Ai,Aj∈NBA), R[Ci]=R[Cj]. NBA denotes nonborrowed attributes in relation R. For all data in VMs, one instance of multirelation R meets Nonborrowed Attribute Integrated property when the security levels of Ai belonging to nonborrowed attributes are the same.


## 3.4. State Transition Rules to V-MGSM Model

In this part, four orders (INSERT,DELETE,UPDATE, andSELECT) and their corresponding grammars are defined as the state transition rules of V-MGSM model.Definition 10 (INSERT manipulation language).
Grammatical form ofINSERT manipulation language is described as follows:
(3)INTERTINTOR[(A1,A2,…)]VALUESa1,a2,…a1∈D1,a2∈D2,….Semantics. R denotes the name of a relation, A1 denotes the name of VM, and [] denotes the alternative items. EveryINSERT operation could create one record with security level c into relation R by a c-subject at most. For all 2≤i≤n, if Ai is in the list of “into” attribute, then r[Ai]=ai∧r[Ci]=r[RC]. Another case, r[Ai]=null∧r[Ci]=r[RC]=c, should be taken into account if the value of Ai is not inserted into record r.INSERT operation is permitted only when none of records r′∈relationR meets r′[A1]=r[A1]∧r′[RC]=c. One record could be inserted successfully if the generated state of virtualization satisfies Entity Integrated (EI) property, Multi-Instance Integrated property, and Nonborrowed Attribute Integrated (NBAI) property simultaneously.Definition 11 (DELETE manipulation language).
Grammatical form ofDELETE manipulation language is described as follows:
(4)DELETEFROMRWHEREp.Semantics.R denotes the name of a relation, p denotes a check expression which could be security attribute expression or data expression, and the data of any VM could only be deleted by its creator.DELETE operation is permitted if and only if r[RC]=c and meets p and then deletes record r. In V-MGSM model, another situation shown as follows is taken into account because of data borrowing. For all records r∈relationR, we can obtain r′[Ai]=null, if ∃r′∈relationR, and r′[C1]=r[C1]∧r′[RC]>r[RC]∧r′[Ai,Ci]=r[Ai,Ci].Definition 12 (UPDATE manipulation language).
Grammatical form ofUPDATE manipulation can be described as follows:
(5)UPDATESETA2=s2,A3=s3[WHEREp]2≤i≤n.Semantics. ForUPDATE manipulation language, the data of any VM could only be updated by its creator. In V-MGSM model, another situation, synchronous update of the borrowed information, is taken into consideration if high-level VM has borrowed data from low-level VM. The value of A1 is not allowed to be modified inUPDATE operation. For all records r in relation R, if p∧r[RC]=c, then r[Ai,Ci]=(si,c). The value of the updated attribute could only be updated by its creator, so the security level of updated attribute is maintained as that of its owner whether it has been borrowed or not. The value of updated attribute in both of the low-level VM and high-level VM is updated synchronously when borrowed relation exists between these two VMs. Therefore, if ∃r′∈relationR, r′Ai,Ci=rAi,Ci∧r′RC>c, and r′[Ci]=c, then  r′[Ai]=si.Definition 13 (SELECT manipulation language).
Grammatical form ofSELECT manipulation language is described as follows:
(6)SELECTA1[,A2]FROMR1[,R2]WHEREp.Semantics. Let * denote selecting all data from relation R, and let p denote a check expression which could be security attribute expression or data expression. Data of VMs in relation R1[,R2] will be calculated in p, and record r will be accessed by a higher-level subject in the same group. If r[C1]=r′[C1]∧r[RC]≤c′, then the information of VM could be queried by c′-subject.


## 4. Correctness and Security Analysis

### 4.1. Correctness of V-MGSM Model

To prove the correctness of V-MGSM model unambiguously, two steps are necessary. One is the proof of all recordsr in a relation R that meet four integrated properties; the other one is the proof that any sequence of operations includingINSERT,DELETE, andUPDATE transforms an arbitrary legal state into another legal state.Definition 14.
V-MGSM model is correctly equal to the fact that all records in a relationR in a legal state in virtualization system meet four integrated properties defined in Section 3.Definition 15.
A model is correctly equal to the fact that any legal state can be transformed into another legal state by any sequence ofINSERT,DELETE, andUPDATE which are previously defined.It is necessary to stress thatINSERT,DELETE, andUPDATE operations change an arbitrary legal state in virtualization system into another legal state. Evidently, anySELECT operation does not change any state because no data is inserted, updated, or deleted. Then, we assume that record r has been operated in the following steps.(i)
A generated data by anINSERT operation does not break Entity Integrated property, Data-Borrowing Integrated property, or Nonprimary Key Integrated property according to the semantics ofINSERT operation. Therefore, we just need to prove that anINSERT operation does not break Multiple Instance Integrated property. Based on the manipulation regulation ofINSERT operation, one recordr is inserted successfully only when r′ which meets r′[A1]=r[A1]∧r′[RC]=c does not exist in relation R. In a word, the generated state by anINSERT operation does not break four previously defined integrated properties.(ii)
The reason why anyDELETE operation does not break four integrated properties is explained in detail. Entity Integrated property, Multiple Instance Integrated property, and Nonprimary Key Integrated property are met because no record r′ in the original relation R has been inserted or updated after aDELETE operation. For r∈relationR, if ∃r′∈relationR and r′[C1]=r[C1]∧r′[RC]>r[RC]∧r′[Ai,Ci]=r[Ai,Ci], then we can obtain r′[Ai]=null, and Data-Borrowing Integrated property is met mandatorily in relation R. Therefore,DELETE operation does not break four defined integrated properties.(iii)
AnyUPDATE operation does not break four integrated properties. Actually, all integrated properties have been met mandatorily based on the semantics ofUPDATE operation. Therefore, if the initial state is correct, any state transformed from any correct state by anUPDATE operation is correct or legal as we defined in Definition 15.Hence, all related operations can transform a legal state into another legal state without breaking four integrated properties. Eventually, we can prove that the proposed V-MGSM model is correct.


### 4.2. Security Analysis

To prove the security of V-MGSM model, we define the secure state and explain the reason why the state is still secure after executing series of operations mentioned in the earlier part.Definition 16.
Secure state in V-MGSM model means that no downward information flow exists during communication process between VMs.The output of any subjects2 belonging to SV(c) is not influenced by deleting any input of subject s1 belonging to SH(c). LetS be the set of all subjects including all VMs, and let R be all records with different levels in a virtual machine system. Then, we define SV(c) as a set of all subjects whose security levels are lower than or equal to c,RV(c) denote a set of all records whose levels are lower than or equal to c, and SH(c), RH(c):S-SV(c) are RH(c),R-RV(c), respectively. For any access level c, we have obtained the following equations with great ease according to the meaning of each notation:
(7)S=SVc∪SHc∧SVc∩SHc=∅,R=RVc∪RHc∧RVc∩RHc=∅.To prove the security of V-MGSM model, we take sequence of operations includingINSERT,DELETE,SELECT, andUPDATE by VMs as input in V-MGSM and output the result which includes two parts: (1) a set of records or result of failed access is returned to VM by anySELECT operation; (2) the successful or failed information returns to the subject afterINSERT,DELETE, orUPDATE operation. Upon analyzing the possible access results returned to the subject, the security proof of V-MGSM consists of two situations.(i)
For any access levelc, the output to any subject s∈SV(c) is not influenced by changing RH(c) and four cases in the following need to be taken into consideration.
(a)
Due to the semantics of SELECT operation, when executing a SELECT manipulation byc′-subject and c′ is less than or equal to c, no record in the set RH(c′) will be returned to subject s. Therefore, the output to the subject s∈SV(c) is not influenced by changing RH(c) as RH(c′)⊇RH(c).(b)
TheINSERT operated by a c′-subject is declined if record r′′∈relationR, and r′′[A1]=r[A1]∧r′′[RC]=c′. Go a further step; theINSERT operation will also be declined whether the generated record breaks EI property, Multi-Instance Integrated property, NBAI property, or Data-Borrowing Integrated property.(c)
TheDELETE operated by a subjects is declined only when the deleted record r is not created by the subject s, which means that the subject s does not have the right to execute any operation on this record as the subject does not have the ownership of this record.(d)
TheUPDATE operated by a subject s is declined whether the update operation results in breaking EI property, Multi-Instance Integrated property, and NBAI property or it is not executed by its creator.Whereinr is the record created by a c-subject and r′ is the record created by a c′-subject, only recordsr and r′ are involved and should be taken into account. The successful or failed information, which is delivered to the subjects∈ SV (c), is not influenced by changing RH(c) because r, r′∈RH(c′)⊇RH(c). Then, we can draw a conclusion that RV(c) is not changed by deleting any input of a subject s∈SH(c).(ii)
The state in V-MGSM model is modified only byINSERT,DELETE, orUPDATE operation and we assume that c′ is greater thanc in following situations.
(a)
c′-VM could generate a c′-record byINSERT operation.(b)
c′-VM could only delete c′-record.(c)
c′-VM could update c′-record.Sincec′ is greater than c, r′∉RV(c).Finally, we draw a conclusion that no downward information flow exists during communication process. The results returned to any subjects2 belonging to set SV(c) which is not influenced by deleting the input of any subjects1 belonging to set SH(c). Thus, any state of virtualization transformed from a secure initial state is maintained securely after new state transition rules are carried out.


## 4.1. Correctness of V-MGSM Model

To prove the correctness of V-MGSM model unambiguously, two steps are necessary. One is the proof of all recordsr in a relation R that meet four integrated properties; the other one is the proof that any sequence of operations includingINSERT,DELETE, andUPDATE transforms an arbitrary legal state into another legal state.Definition 14.
V-MGSM model is correctly equal to the fact that all records in a relationR in a legal state in virtualization system meet four integrated properties defined in Section 3.Definition 15.
A model is correctly equal to the fact that any legal state can be transformed into another legal state by any sequence ofINSERT,DELETE, andUPDATE which are previously defined.It is necessary to stress thatINSERT,DELETE, andUPDATE operations change an arbitrary legal state in virtualization system into another legal state. Evidently, anySELECT operation does not change any state because no data is inserted, updated, or deleted. Then, we assume that record r has been operated in the following steps.(i)
A generated data by anINSERT operation does not break Entity Integrated property, Data-Borrowing Integrated property, or Nonprimary Key Integrated property according to the semantics ofINSERT operation. Therefore, we just need to prove that anINSERT operation does not break Multiple Instance Integrated property. Based on the manipulation regulation ofINSERT operation, one recordr is inserted successfully only when r′ which meets r′[A1]=r[A1]∧r′[RC]=c does not exist in relation R. In a word, the generated state by anINSERT operation does not break four previously defined integrated properties.(ii)
The reason why anyDELETE operation does not break four integrated properties is explained in detail. Entity Integrated property, Multiple Instance Integrated property, and Nonprimary Key Integrated property are met because no record r′ in the original relation R has been inserted or updated after aDELETE operation. For r∈relationR, if ∃r′∈relationR and r′[C1]=r[C1]∧r′[RC]>r[RC]∧r′[Ai,Ci]=r[Ai,Ci], then we can obtain r′[Ai]=null, and Data-Borrowing Integrated property is met mandatorily in relation R. Therefore,DELETE operation does not break four defined integrated properties.(iii)
AnyUPDATE operation does not break four integrated properties. Actually, all integrated properties have been met mandatorily based on the semantics ofUPDATE operation. Therefore, if the initial state is correct, any state transformed from any correct state by anUPDATE operation is correct or legal as we defined in Definition 15.Hence, all related operations can transform a legal state into another legal state without breaking four integrated properties. Eventually, we can prove that the proposed V-MGSM model is correct.


## 4.2. Security Analysis

To prove the security of V-MGSM model, we define the secure state and explain the reason why the state is still secure after executing series of operations mentioned in the earlier part.Definition 16.
Secure state in V-MGSM model means that no downward information flow exists during communication process between VMs.The output of any subjects2 belonging to SV(c) is not influenced by deleting any input of subject s1 belonging to SH(c). LetS be the set of all subjects including all VMs, and let R be all records with different levels in a virtual machine system. Then, we define SV(c) as a set of all subjects whose security levels are lower than or equal to c,RV(c) denote a set of all records whose levels are lower than or equal to c, and SH(c), RH(c):S-SV(c) are RH(c),R-RV(c), respectively. For any access level c, we have obtained the following equations with great ease according to the meaning of each notation:
(7)S=SVc∪SHc∧SVc∩SHc=∅,R=RVc∪RHc∧RVc∩RHc=∅.To prove the security of V-MGSM model, we take sequence of operations includingINSERT,DELETE,SELECT, andUPDATE by VMs as input in V-MGSM and output the result which includes two parts: (1) a set of records or result of failed access is returned to VM by anySELECT operation; (2) the successful or failed information returns to the subject afterINSERT,DELETE, orUPDATE operation. Upon analyzing the possible access results returned to the subject, the security proof of V-MGSM consists of two situations.(i)
For any access levelc, the output to any subject s∈SV(c) is not influenced by changing RH(c) and four cases in the following need to be taken into consideration.
(a)
Due to the semantics of SELECT operation, when executing a SELECT manipulation byc′-subject and c′ is less than or equal to c, no record in the set RH(c′) will be returned to subject s. Therefore, the output to the subject s∈SV(c) is not influenced by changing RH(c) as RH(c′)⊇RH(c).(b)
TheINSERT operated by a c′-subject is declined if record r′′∈relationR, and r′′[A1]=r[A1]∧r′′[RC]=c′. Go a further step; theINSERT operation will also be declined whether the generated record breaks EI property, Multi-Instance Integrated property, NBAI property, or Data-Borrowing Integrated property.(c)
TheDELETE operated by a subjects is declined only when the deleted record r is not created by the subject s, which means that the subject s does not have the right to execute any operation on this record as the subject does not have the ownership of this record.(d)
TheUPDATE operated by a subject s is declined whether the update operation results in breaking EI property, Multi-Instance Integrated property, and NBAI property or it is not executed by its creator.Whereinr is the record created by a c-subject and r′ is the record created by a c′-subject, only recordsr and r′ are involved and should be taken into account. The successful or failed information, which is delivered to the subjects∈ SV (c), is not influenced by changing RH(c) because r, r′∈RH(c′)⊇RH(c). Then, we can draw a conclusion that RV(c) is not changed by deleting any input of a subject s∈SH(c).(ii)
The state in V-MGSM model is modified only byINSERT,DELETE, orUPDATE operation and we assume that c′ is greater thanc in following situations.
(a)
c′-VM could generate a c′-record byINSERT operation.(b)
c′-VM could only delete c′-record.(c)
c′-VM could update c′-record.Sincec′ is greater than c, r′∉RV(c).Finally, we draw a conclusion that no downward information flow exists during communication process. The results returned to any subjects2 belonging to set SV(c) which is not influenced by deleting the input of any subjects1 belonging to set SH(c). Thus, any state of virtualization transformed from a secure initial state is maintained securely after new state transition rules are carried out.


## 5. Implementation of V-MGSM Model

As shown in Figure3, we construct a MAC framework which is composed of VMM, Management, XSM, V-MGSM MAC, ACCF, and VMs. Specifically, ACCF denotes access control configuration file, Management is used to manage the access control over other VMs in Domain0, and V-MGSM MAC is a security module which is implemented as a security hook function based on XSM, provided by Xen, and manages communications between VMs according to the state transition rules in V-MGSM model. When a VM makes a request to access another VM with access attributeSELECT,UPDATE, orDELETE, the XSM intercepts the request; and XSM transfers this access request to V-MGSM MAC; then, ACCF stores the access authority and relation between subjects and objects, which is used to help V-MGSM MAC to determine whether the access request is declined or not; finally, V-MGSM MAC returns the decision. If the returned decision is “Yes,” then XSM authorizes the subject to access the object with the access attribute; otherwise, the access is declined.Figure 3
The implementation of MAC framework in Xen.The implementation is built in a workstation with four quad-core Intel Core i7, 2.5 GHz CPUs, 16 GB memory, and 1 T storage. In specific, the version of Xen is 3.3.1, the operating system in Domain0 is CentOS 5.4, and each VM covered in the test operates on Ubuntu 8.10. A web service is provided by Apache in Domain0, through which each VM could log in and query information of shared memory; in addition, a software used to apply to sharing memory and set the value in shared memory, called Virmem, is executed in every VM.Step 1 (the initialization of the virtualization in Xen).
Five VMs are created in Xen and denoted by VM1, VM2, VM3, VM4, and VM5, respectively, and the security levels of them areH3,H2,H1,H3, andH2, whereH3 >H2 >H1. For efficient privacy preservation between different organizations, VM1, VM2, and VM3 are grouped into User System 1, and VM4 and VM5 are in User System 2; the unique identifications of User System 1 and System 2 are L1 and L2, respectively. Then, the Virmem in VM3, VM4, and VM5 is applied for sharing the memory and sets the first byte of each shared memory by “e,” “k,” and “m,” respectively. And VM2 is applied for sharing the memory to VM1 and sets the first byte’s value by “b.”Step 2 (VM1 in User System 1 and VM4 in User System 2 query all shared memory in Domain0 by web service, resp.).
Then, the results are shown in Tables3(a) and 3(b). As VM1 owns the highest security level, all data in User System 1 but not User System 2 could be queried by VM1. And as shown in Table 3(a), the values of C1 in these records are the same which means that all VMs are corresponding to the same group User System 1. As shown in Table 3(b), when VM4 queries all shared memory in User System 2, the value of C1 is also the same. Therefore, the result shows that our proposed V-MGSM model is correctly and securely applied to the privacy preservation for virtualization.Table 3
The test’s results of V-MGSM.
(a)
The result of VM1’s first query
VM name
C
1
Data (first byte)
C
2
R
C
VM1
L1
b
H2
H3
VM2
L1
b
H2
H2
VM3
L1
e
H1
H1
(b)
The result of VM4’s query
VM name
C
1
Data (first byte)
C
2
R
C
VM4
L2
k
H3
H3
VM5
L2
m
H2
H2
(c)
The result of VM2’s query
VM name
C
1
Data (first byte)
C
2
R
C
VM2
L1
f
H2
H2
VM3
L1
e
H1
H1
(d)
The result of VM1’s second query
VM name
C
1
Data (first byte)
C
2
R
C
VM1
L1
f
H2
H3
VM2
L1
f
H2
H2
VM3
L1
e
H1
H1Step 3 (the value of shared memory is updated by VM2).
VM2 in User System 1 updates the first byte’s value of shared memory to “f” by Virmem. Then, VM2 queries shared memory by web service in Domain0, and the result is shown as in Table 3(c).Step 4 (VM1 queries shared memory again).
As shown in Table3(d), the value of data in both first and second records is modified to “f.” Hence, the value of borrowed shared memory in a high-level VM could be updated synchronously and successfully if it is updated by its owner, a low-level VM.The experimental results show that multilevel security access control for VMs and efficient isolation for VMs corresponding to different groups and synchronous update have been implemented in a virtualization system and perform a secure communication process between VMs.


## 6. Conclusions

In this paper, based on multilevel relation, a new multilevel and grouping security model, called V-MGSM, is proposed for virtualization. In specific, on the basis of the security requirements for different VMs, we redesign the elements, integrated properties, and data manipulation languages of V-MGSM model, and all VMs are divided into several groups based on their corresponding entities, which can avoid the unnecessary access and provide the privacy protection among different groups. Besides, different security levels are assigned to VMs in the same group, and the confidential information in a high-level VM will not be obtained by some malicious low-level VM. Then, when the borrowed data is modified in the low-level VM, the corresponding data in the high-level VM will be updated synchronously. In addition, detailed security analysis shows that the proposed V-MGSM can provide a secure communication mechanism for VMs and achieve the synchronous updates of the borrowed data. Eventually, we implement V-MGSM in Xen for experiments, and the results demonstrate that V-MGSM can indeed achieve efficiency for Mobile Internet service.



---

*Source: 841292-2015-02-10.xml*