Virtual Desktop Keystroke Encryption Against Client-Side Keylogging
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Keystrokes are susceptible to keylogging malware and application-level attacks due to decryption at the client device, making them vulnerable to unauthorized access and attacks.
Innovation Solution
Implement end-to-end encryption of keystrokes by encrypting keyboard inputs at the client device and decrypting them only at the virtual desktop host server, using a dynamically updated encryption mechanism, such as a symmetric encryption key, to secure the transmission and prevent decryption at vulnerable client levels.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If keystrokes are decrypted at the client device, then the virtual desktop application can process keyboard input, but the keystrokes become vulnerable to keylogging malware and application-level attacks
Solution Approach 1:
The decryption function is extracted from the client device and relocated to the virtual desktop host server. Only the encrypted keystroke data is transmitted to the server, where decryption occurs in a secure environment. This extraction removes the vulnerability point at the client level while maintaining the necessary functionality for the virtual desktop application to process the decrypted input.
Solution Approach 2:
An encrypted transmission channel acts as an intermediary between the client device and the virtual desktop host server. This intermediary protects the keystroke data during transmission and ensures that decryption only occurs at the server端, preventing keylogging malware and application-level attacks from accessing the plaintext input at the client device.
2Reliability
If keystrokes are encrypted during transmission, then security against keylogging is improved, but the system complexity increases due to encryption mechanism implementation
Solution Approach 1:
The encryption and decryption mechanisms operate automatically without requiring user intervention. The system self-manages the encryption of keystrokes at the client device, secure transmission through the encrypted channel, and automatic decryption at the server端. This self-service approach minimizes the operational complexity for users while maintaining robust security.
Solution Approach 2:
The encryption system is designed to work universally across different virtual desktop applications and client devices. The same encryption mechanism and protocol are applied consistently regardless of the specific application or device, simplifying implementation and maintenance while providing comprehensive security coverage.
Data Source
AI summary
A computing system may receive, during a virtual desktop session, a keyboard input. The computing system may encrypt, using a keyboard encryption driver configured with an encryption mechanism, the keyboard input. The computing system may identify, based on the keyboard input, a transmission path for the encrypted keyboard input between the keyboard encryption driver and a virtual desktop host server. The computing system may transmit, via the identified transmission path and to the virtual desktop host server, the encrypted keyboard input, which may be decrypted by the virtual desktop host server using a decryption mechanism corresponding to the encryption mechanism, and passed to a virtual desktop application.