Granted Patent B2

US 12,657,349 · App. 18/467,831 · Granted Jun 16, 2026

Inventors: Xiaoyu Kong (Beijing, CN); YiQun Yun (Beijing, CN); ZhangLin Zhou (Beijing, CN); Yang Yu (Beijing, CN)

Assignee: Omnissa, LLC

G06F21/83G06F21/602

Abstract

Claims (43)

1 . A computer-implemented method of encrypting keystroke data in a multi-session-enabled computing device, the method comprising:

maintaining, by a keyboard device driver executing in a kernel global space on the multi-session-enabled computing device, a keyboard-to-session mapping that maps a first keyboard device of a first computer to a first desktop session and a second keyboard device of a second computer to a second desktop session;

receiving a first control message requesting enabling of keystroke encryption for a protected application executing in the first desktop session, the first control message including application identification information of the protected application;

enabling the keystroke encryption for keystrokes targeting the first desktop session based on receipt of the first control message by storing, in a state database residing in the kernel global space, a state record associated with the first desktop session and identifying the protected application;

receiving keystroke data at a keyboard device driver from the first keyboard device and the second keyboard device;

determining, based on the keyboard-to-session mapping that the keystroke data is directed to the first or the second desktop session;

in response to determining that (i) the state record for the first desktop session is present in the state database and that (ii) the protected application identified in the state database has current keyboard focus in the first desktop session at the time of receiving the keystroke data, encrypting the keystroke data sent to the protected application in the first desktop session while the protected application maintains the keyboard focus in the first desktop session; and

transmitting the keystroke data sent to another application of the second desktop session in an unencrypted form while the keystroke encryption is enabled for the protected application in the first desktop session.

2 . The computer-implemented method of claim 1 , wherein the first control message was generated by the protected application based on acquisition of the keyboard focus by the protected application within the first desktop session.

3 . The computer-implemented method of claim 1 , further comprising:

receiving a second control message requesting disabling of the keystroke encryption for the protected application executing in the first desktop session; and

disabling the keystroke encryption for keystrokes targeting the first desktop session based on receipt of the second control message.

4 . The computer-implemented method of claim 1 , wherein the application identification information includes a session identifier, a process identifier, and a thread identifier.

5 . The computer-implemented method of claim 1 , wherein determining that the protected application has current keyboard focus in the first desktop session comprises querying, by a kernel driver associated with the first desktop session, a focus pointer that identifies a thread currently designated to receive keyboard input within the first desktop session, and matching the thread to the application identification information stored in the state record.

6 . A computer system comprising:

a processor; and

a non-transitory computer readable medium having stored thereon program code executable by the processor, the program code causing the processor to:

maintain, by a keyboard device driver executing in a kernel global space on a multi-session-enabled computing device, a keyboard-to-session mapping that maps a first keyboard device of a first computer to a first desktop session and a second keyboard device of a second computer to a second desktop session;

receive, from a protected application executing in the first desktop session, a first control message requesting enabling of keystroke encryption, the first control message including application identification information of the protected application;

enable the keystroke encryption for keystrokes directed to the first desktop session based on receipt of the first control message by storing, in a state database residing in the kernel global space, a state record associated with the first desktop session and identifying the protected application;

receive keystroke data at a keyboard device driver from the first keyboard device and the second keyboard device;

determine, based on the keyboard-to-session mapping that the keystroke data is directed to the first or the second desktop session;

in response to determining that (i) the state record for the first desktop session is present in the state database and that (ii) the protected application identified in the state database has current keyboard focus in the first desktop session at the time of receiving the keystroke data, encrypt the keystroke data sent to the first desktop session while the keystroke encryption is enabled for the first desktop session; and

transmit the keystroke data sent to another application of the second desktop session in an unencrypted form while the keystroke encryption is enabled for the protected application in the first desktop session.

7 . The computer system of claim 6 , wherein the first control message was generated by the protected application based on acquisition of the keyboard focus by the protected application within the first desktop session.

8 . The computer system of claim 6 , wherein the program code further causes the processor to:

receive a second control message requesting disabling of the keystroke encryption for the protected application executing in the first desktop session; and

disable the keystroke encryption for keystrokes targeting the first desktop session based on receipt of the second control message.

9 . The computer system of claim 6 , wherein the application identification information includes a session identifier, a process identifier, and a thread identifier.

10 . The computer system of claim 6 , wherein determining that the protected application has current keyboard focus in the first desktop session comprises querying, by a kernel driver associated with the first desktop session, a focus pointer that identifies a thread currently designated to receive keyboard input within the first desktop session, and matching the thread to the application identification information stored in the state record.

11 . A non-transitory computer-readable storage medium having stored thereon program code executable by a processor, the program code embodying a method comprising:

maintaining, by a keyboard device driver executing in a kernel global space on a multi-session-enabled computing device, a keyboard-to-session mapping that maps a first keyboard device of a first computer to a first desktop session and a second keyboard device of a second computer to a second desktop session;

receiving a first control message requesting enabling of keystroke encryption for a protected application executing in the first desktop session, the first control message including application identification information of the protected application;

enabling the keystroke encryption for keystrokes targeting the first desktop session based on receipt of the first control message by storing, in a state database residing in the kernel global space, a state record associated with the first desktop session and identifying the protected application;

receiving keystroke data at a keyboard device driver from the first keyboard device and the second keyboard device;

determining, based on the keyboard-to-session mapping that the keystroke data is directed to the first or the second desktop session;

in response to determining that (i) the state record for the first desktop session is present in the state database and that (ii) the protected application identified in the state database has current keyboard focus in the first desktop session at the time of receiving the keystroke data, encrypting the keystroke data sent to the protected application in the first desktop session while the protected application maintains the keyboard focus in the first desktop session; and

transmitting the keystroke data sent to another application of the second desktop session in an unencrypted form while the keystroke encryption is enabled for the protected application in the first desktop session.

12 . The non-transitory computer-readable storage medium of claim 11 , wherein the first control message was generated by the protected application based on acquisition of the keyboard focus by the protected application within the first desktop session.

13 . The non-transitory computer-readable storage medium of claim 11 , wherein the method further comprises:

receiving a second control message requesting disabling of the keystroke encryption for the protected application executing in the first desktop session; and

disabling the keystroke encryption for keystrokes targeting the first desktop session based on receipt of the second control message.

14 . The non-transitory computer-readable storage medium of claim 11 , wherein determining that the protected application has current keyboard focus in the first desktop session comprises querying, by a kernel driver associated with the first desktop session, a focus pointer that identifies a thread currently designated to receive keyboard input within the first desktop session, and matching the thread to the application identification information stored in the state record.

Assignments (4)

Priority Claims (1)

Continuity (1)

References Cited (70)