Utilizing video and input pipelines to protect virtual desktop infrastructure sessions

A method, implemented at a computer system that includes a processor system, for protecting a virtual desktop infrastructure (VDI) session, comprising:

• establishing a first communication channel between an enclaved portion of the processor system and a cloud VDI service that provides remote access to a virtual service, the enclaved portion of the processor system being inaccessible by an operating system (OS) that executes at the computer system;
• at the enclaved portion of the processor system,
• decrypting a video stream that is received from the cloud VDI service over the first communication channel and that corresponds to a first display output of the virtual service into a decrypted video stream;
• overlaying the decrypted video stream over a second display output of the OS, wherein the decrypted video stream is inaccessible to the OS;
• and
• initiating display of a user interface indicator that the decrypted video stream is secure;
• establishing a second communication channel between a microcontroller unit and the cloud VDI service, the microcontroller unit being inaccessible by the OS;
• and
• at the microcontroller unit,
• encrypting an input received from an input device associated with the computer system to generate an encrypted input;
• and
• sending the encrypted input to the cloud VDI service via the second communication channel as an input to the virtual service,
• wherein the first communication channel and the second communication channel are associated with a common cryptographic credential, and the cloud VDI service verifies that the first communication channel and the second communication channel are associated with the common cryptographic credential.