Utilizing video and input pipelines to protect virtual desktop infrastructure sessions
Methods and systems are described which facilitate protecting a virtual desktop infrastructure (VDI) session. A first communication channel is established between a DRM component and a VDI service. The DRM component decrypts a video stream from the VDI service and overlays the decrypted video stream on a user's display. A second communication channel is established between an inputs protection component and the VDI service. The inputs protection component encrypts input received at a user's input device and sends the encrypted input to the cloud VDI service.
1 . A method, implemented at a docking station, for protecting a virtual desktop infrastructure (VDI) session, comprising:
establishing a first communication channel between a first processor system and a cloud VDI service that provides remote access to a virtual service;
at the first processor system located in the docking station,
decrypting a video stream that is received from the cloud VDI service over the first communication channel and that corresponds to a first display output of the virtual service into a decrypted video stream;
overlaying the decrypted video stream over a second display output of an operating system (OS) associated with a computer system, wherein the decrypted video stream is inaccessible to the OS, wherein the decrypted video stream is received from the computer system connected to the docking station; and
initiating display of an indicator light, indicating that the decrypted video stream is secure, the indicator light being controlled by the first processor system isolated from the OS;
establishing a second communication channel between a second processor system and the cloud VDI service, the second processor system being inaccessible by the OS associated with the computer system; and
at the second processor system located in the docking station,
encrypting an input received from an input device connected to the docking station to generate an encrypted input; and
sending the encrypted input to the cloud VDI service via the second communication channel as an input to the virtual service,
wherein the first communication channel and the second communication channel are associated with a common cryptographic credential, and the cloud VDI service verifies that the first communication channel and the second communication channel are associated with the common cryptographic credential.
2 . The method of claim 1 , wherein the first processor system is a central processing unit (CPU).
3 . The method of claim 2 , wherein establishing the first communication channel between the first processor system and the cloud VDI service comprises establishing the first communication channel between an enclaved portion of the CPU and the cloud VDI service.
4 . The method of claim 1 , wherein the first processor system is a graphics processing unit (GPU).
5 . The method of claim 1 , wherein the second processor system is a microcontroller (MCU).
6 . The method of claim 5 , wherein sending the encrypted input to the cloud VDI service via the second communication channel comprises the MCU passing the encrypted input to the first processor system.
7 . The method of claim 1 , the common cryptographic credential being stored at the first processor system and the second processor system at provisioning of the first processor system and the second processor system.
8 . The method of claim 1 , wherein the cloud VDI service verifies that the first communication channel and the second communication channel are associated with the common cryptographic credential prior to sending the video stream over the first communication channel.
9 . The method of claim 1 , further comprising, at the first processor system, decrypting an audio stream that is received from the cloud VDI service.
10 . A docking station, comprising:
a first processor system located in the docking station that:
establishes a first communication channel between the first processor system and a cloud VDI service that provides remote access to a virtual service;
decrypts a video stream that is received from the cloud VDI service over the first communication channel and that corresponds to a first display output of the virtual service into a decrypted video stream;
overlays the decrypted video stream over a second display output received from a computer system connected to the docking station, wherein the decrypted video stream is inaccessible to an operating system (OS) associated with the computer system; and
initiates display of an indicator light, indicating that the decrypted video stream is secure, the indicator light being controlled by the first processor system isolated from the OS; and
a second processor system located in the docking station that:
establishes a second communication channel with the cloud VDI service, the second processor system being inaccessible by the OS;
encrypts an input received from an input device connected to the docking station to generate an encrypted input; and
sends the encrypted input to the cloud VDI service via the second communication channel as an input to the virtual service,
wherein the first communication channel and the second communication channel are associated with a common cryptographic credential, and the cloud VDI service verifies that the first communication channel and the second communication channel are associated with the common cryptographic credential.
11 . The docking station of claim 10 , wherein the first processor system is a central processing unit (CPU).
12 . The docking station of claim 11 , wherein establishing the first communication channel between the first processor system and the cloud VDI service comprises establishing the first communication channel between an enclaved portion of the CPU and the cloud VDI service.
13 . The docking station of claim 10 , wherein the first processor system is a graphics processing unit (GPU).
14 . The docking station of claim 10 , wherein the second processor system is a microcontroller (MCU).
15 . The docking station of claim 14 , wherein sending the encrypted input to the cloud VDI service via the second communication channel comprises the MCU passing the encrypted input to the first processor system.
16 . The docking station of claim 10 , wherein the first processor system also decrypts an audio stream that is received from the cloud VDI service.
17 . The docking station of claim 10 , the common cryptographic credential being stored at the first processor system and the second processor system at provisioning of the first processor system and the second processor system.
18 . The docking station of claim 10 , wherein the cloud VDI service verifies that the first communication channel and the second communication channel are associated with the common cryptographic credential prior to sending the video stream over the first communication channel.