Utilizing video and input pipelines to protect virtual desktop infrastructure sessions
AssigneeMicrosoft Technology Licensing, LLC
InventorsOrr Srour, Ori Laslo, Ashish Gupta, Vadim Makhervaks, Andrew Lee Jenks, Samuel John Wenker
Life of this patent
Estimating the term…
Abstract
Methods and systems are described which facilitate protecting a virtual desktop infrastructure (VDI) session. A first communication channel is established between a DRM component and a VDI service. The DRM component decrypts a video stream from the VDI service and overlays the decrypted video stream on a user's display. A second communication channel is established between an inputs protection component and the VDI service. The inputs protection component encrypts input received at a user's input device and sends the encrypted input to the cloud VDI service.
Claims18
A method, implemented at a docking station, for protecting a virtual desktop infrastructure (VDI) session, comprising:
- establishing a first communication channel between a first processor system and a cloud VDI service that provides remote access to a virtual service;
- at the first processor system located in the docking station,
- decrypting a video stream that is received from the cloud VDI service over the first communication channel and that corresponds to a first display output of the virtual service into a decrypted video stream;
- overlaying the decrypted video stream over a second display output of an operating system (OS) associated with a computer system, wherein the decrypted video stream is inaccessible to the OS, wherein the decrypted video stream is received from the computer system connected to the docking station;
- and
- initiating display of an indicator light, indicating that the decrypted video stream is secure, the indicator light being controlled by the first processor system isolated from the OS;
- establishing a second communication channel between a second processor system and the cloud VDI service, the second processor system being inaccessible by the OS associated with the computer system;
- and
- at the second processor system located in the docking station,
- encrypting an input received from an input device connected to the docking station to generate an encrypted input;
- and
- sending the encrypted input to the cloud VDI service via the second communication channel as an input to the virtual service,
- wherein the first communication channel and the second communication channel are associated with a common cryptographic credential, and the cloud VDI service verifies that the first communication channel and the second communication channel are associated with the common cryptographic credential.
A docking station, comprising:
- a first processor system located in the docking station that:
- establishes a first communication channel between the first processor system and a cloud VDI service that provides remote access to a virtual service;
- decrypts a video stream that is received from the cloud VDI service over the first communication channel and that corresponds to a first display output of the virtual service into a decrypted video stream;
- overlays the decrypted video stream over a second display output received from a computer system connected to the docking station, wherein the decrypted video stream is inaccessible to an operating system (OS) associated with the computer system;
- and
- initiates display of an indicator light, indicating that the decrypted video stream is secure, the indicator light being controlled by the first processor system isolated from the OS;
- and
- a second processor system located in the docking station that:
- establishes a second communication channel with the cloud VDI service, the second processor system being inaccessible by the OS;
- encrypts an input received from an input device connected to the docking station to generate an encrypted input;
- and
- sends the encrypted input to the cloud VDI service via the second communication channel as an input to the virtual service,
- wherein the first communication channel and the second communication channel are associated with a common cryptographic credential, and the cloud VDI service verifies that the first communication channel and the second communication channel are associated with the common cryptographic credential.
Dependencies are inferred from the claim text.