Overview

Keystrike includes resident software processes on employee workstations (clients) and employer services (terminators). Keystrike creates communication tunnels between the client and a terminator with end-to-end integrity guarantees through a dispatch service (see diagram).

Keystrike currently supports terminators for Windows Remote Desktop and Linux Secure Shell (SSH).

The terminator is installed on a remote machine, that can be the destination host machine itself or a jump host serving as a gateway in front of a set of destination host machines depending on the target network infrastructure.

When a user input (keystroke or mouse click) is received by the remote machine, the Keystrike terminator requires a cryptographic attestation from the Keystrike client for that user input. Only when the terminator approves the attestation is the input released and processed by the remote machine.

Running on the end user’s workstation as a client, Keystrike cryptographically captures inputs from the user's keyboard and mouse when the user has a session with the target terminator. The client receives a keystroke directly from the operating system and using its private key, submits a cryptographic signature of the keystroke (called an integrikey), to the dispatch server if a connection is ongoing. An attacker with remote user access to the machine cannot forge the Keystrike signatures.

Importantly Keystrike never logs or sends the end-user’s keystrokes, only integrikeys.

The dispatch service routes integrikeys between clients and the appropriate terminator.

A SaaS dispatch is provided by Keystrike, running on the default websocket port 443. Each customer has their own dispatch URL which is detailed on the setup page in the admin panel.

The terminator runs on the remote machine, typically a remote server or jump host.

The terminator ensures that the keystrokes received from the primary protocol channel (such as a Remote Desktop connection) match up with the cryptographic signatures from the Keystrike channel. The Keystrike channel routes only cryptographic signatures and no private data (such as the keystrokes themselves) flow through the Keystrike channel.