EASVD: A Modified Method to Enhance the Authentication for SPICE Virtual Desktop Virtual Desktop (VD) provides a convenient way for users to operate their virtual machines on different types of terminals. SPICE is an excellent protocol for the VD display. However, there are still several threats when using the original SPICE in the highlevel scenarios. The threats are mainly due to the fact that the original SPICE ignores the confidentiality of the VD. The threats contain the data interaction like copying, falsifying, and deleting between VDs u0026 different physical terminals. Furthermore, the original SPICE authentication is a onefactor method based on the IP address and password of the user. We bind each VD to a specific authorized terminal to reduce the threat posed by the data interaction between VDs and physical terminals in the highlevel security scenarios proposed in our paper. At the same time, we propose a twofactor authentication method which includes physical terminals authentication and userpassword authentication. We also reinforce the security of the VD by putting forward a modified way to storage the password. Our approach to intensify the VDs authentication has been implemented in terminals based on SPICE and Libvirt. Our method can effectively prevent the unauthorized users from illegal logging into the VD on the illegal physical terminals, even when the correct password is intercepted by unauthorized users. We demonstrate the effectiveness of our method by experimental results.

Extended pointers for memory protection in single address space systems Abstract   With reference to a single address space paradigm of memory addressing, we identify a set of mechanisms aimed at preserving the integrity of the virtual space of a given process from erroneous or fraudulent access attempts originated from other processes. These mechanisms guarantee a level of protection that is, in many respects, superior to that of a traditional multiple address space environment. We introduce extended pointers as a generalization of the concept of a memory address, which includes a password and an access authorization. A universally known, parametric oneway function is used to assign passwords. A specialized address translation circuitry supports memory reference and protection at the hardware level. A small set of protection primitives forms the process interface of the protection system. An indication of the flexibility of the proposed protection paradigm is given by applying extended pointers to the solution of a variety of protection problems.