ASG-NetX
ASG-Deskside
ASG-LENS ASG-NetX home Talk to us

Device channels for virtualised sessions

Your devices stay where they are. Only what they produce travels.

Your applications run in a datacentre. The scanner, the camera, the pen and the signing card are on a desk hundreds of kilometres away. ASG-Deskside lets each device finish its job where it already sits, and sends just the finished result into the session — down to a PDF signed by hand on a real pad, with a certificate Acrobat validates.

H.264 FRAME · BITRATE TUNED TO THE LINK PAGE-01.JPG · 238 KB · SUB-SECOND SIGNATURE + CERTIFICATE · 1,617 BYTES RECOGNISED TEXT · NO AUDIO SENT ON STROKE PATH · PRESSURE AND TIMING HANDWRITING + CERTIFICATE · ONE SIGNED PDF SIGNED ASSERTION · NEVER THE FINGERPRINT raw device traffic · private keys · files NEVER LEAVE THE DESK Video call Scan Signature Verified CN=A. HARVEY Notes Transfer approved by Agreement Consent form · signed Sign in Signed in NO PASSWORD TYPED AT THE DESK IN THE SESSION The device finishes the job it was built for. The application opens it as it always has.

Nothing installed

No driver in the session, no kernel code, nothing on the session host — and nothing on the endpoint beyond a browser extension your own policy deploys.

Nothing redirected

The device itself never crosses the network. Its output does, already finished, once. A private key never leaves the card it lives on.

Nothing to roll out

Switched on one application at a time, by configuration. A capability cannot reach a device unless an administrator turned it on for that application.

Seven capabilities. Six of them work today.

Each is the same shape: a person does something at their desk, and the software in the session receives it as though the hardware were wired to the server.

CamWebcam

The camera already built into their laptop, open inside the application.

H.264 · bitrate tunes itself to the link

Learn more →
Working
ScanDocument scanner

Paper into the tray at the desk; pages arrive in the application's own scan dialog.

eSCL · WIA · chrome.documentScan

Learn more →
Working
SealSmart card

Signed with the card in their own pocket, and verified against the certificate in the session.

PIV slots 9A–9E · PKCS#1 · SHA-256

Learn more →
Working
VoiceDictation

They hold a button and speak; the words appear in the field that has focus.

Recognition on the device · nothing sent to a cloud

Learn more →
Working
InkSignature pad

A Wacom pad on the desk, driven straight from the browser. Its own screen shows the prompt and the Clear, Cancel and OK keys. No pad? The panel takes a finger or a mouse.

WebHID · no Wacom software, nothing on the server

Learn more →
Working
SignDocument signing

A PDF is open in the session. One click, the person signs on the pad at their desk, and the signed file is saved beside the original — handwriting and a certificate signature that Acrobat validates.

Handwriting + PKI in one pass · nothing installed in the session

Learn more →
Working
UnlockPasskey

They touch the fingerprint reader instead of typing a password, and the sign-in completes.

WebAuthn at the endpoint

Learn more →
Planned

Measured, in live sessions

Sub-secondTo move a finished A4 scan into the application in the session — 238 KB.
549Pen points with pressure and timing in one signature — 70 KB, image included.
1.6 KBAn entire certificate signature reply.
NothingInstalled on the session host, for any capability.

Scan, Seal, Voice, Ink and Sign all run on an entirely unmodified platform, with no ASG component anywhere in the path. Cam alone needs a camera channel carried in the gateway.

Security

What it can reach, and what it can’t.

The honest way to answer this is to print the permission list, because it is short enough to print. Everything the extension is allowed to do is on this page.

Manifest permissions, in full
nativeMessaging
the local scan helper
documentScan
scanning on ChromeOS
offscreen
the microphone document
Sites it may run on
https://*.cameyo.com/*
https://*.cameyo.net/*

There is nothing else. No host permissions, no tabs, no storage, no cookies, no webRequest. The extension cannot see any site other than your own Cameyo sessions — not your banking tab, not your intranet, not anything.

In transit

  • No new network path. Everything rides inside the Cameyo session you already have, over TLS on 443. No second connection, no extra port, no new firewall rule, no endpoint of ours anywhere in the path.
  • Integrity checked frame by frame. Every frame carries a checksum and a sequence number. Measured: zero checksum failures and zero gaps across 2,117 frames, byte-identical at both ends up to 8 Mbit/s.
  • Only finished results cross. A 32-byte digest goes out and a signature comes back. The raw device protocol never travels, so there is nothing on the wire to replay against a device.

At the desk

  • Inert until an administrator says otherwise. With no capability tag on an application, no device is opened, no browser permission is requested and no helper is started. Every gate fails closed, and that is not configurable.
  • Signing always asks a person. Each request raises a confirmation at the endpoint showing what is being signed, and is refused without a click. Added after we watched a key on a TPM sign silently.
  • The PIN is unreachable by the page. It is collected in the extension's own isolated context, goes straight to the card, and is never written into the page, never logged and never kept. The private key never leaves the card at all.
  • Dictation stays on the device. If the endpoint cannot recognise speech locally, ASG-Deskside refuses rather than quietly sending the audio to a cloud service.

In the session

  • Nothing is installed. No driver, no kernel code, no agent, no service — so there is no new attack surface on a server you have already hardened.
  • Sessions cannot reach each other. The scanner listener checks which session a caller belongs to and refuses anything from another one.
  • Remove the tag and it is gone. No uninstall, no cleanup, no residue — the capability simply stops existing the next time the application starts.

Turning it on takes two steps.

There is no third one. Nothing is installed on a server, and nothing changes for the people already using the application.

STEP 01

Deploy the extension

Your own browser policy pushes it to the endpoints you choose. Until an application asks for a device, it does nothing at all.

STEP 02

Tag the application

One tag on the application that needs the device — !ASG_SCAN_PIPE=1. That tag is the whole control surface, and it is yours.

NO STEP 03

That is the list

No driver, no agent, no image change, no downtime. Remove the tag and the capability is gone the next time the application starts.

CapabilityWindows deskChromebookHow the device is reached
CamWorkingWorkingBrowser camera APIs
ScanWorkingWorkingWIA at the desk, or the browser's own scanning
SealWorkingWorkingInbox smart card driver, or PC/SC in the browser
VoiceWorkingWorkingMicrophone and on-device recognition
InkWorkingWorkingWacom STU pad over WebHID, or the screen itself
SignWorkingWorkingThe PDF already open in the session
UnlockPlannedPlannedPasskey at the endpoint

Which device is costing your people the most time?

Tell us that, and which capability your users need next — it moves up the queue. ASG-Deskside is built on your platform's own extension points and installs nothing on your servers.

Talk to us
ASG NETX LTD · 66 Paul Street, London EC2A 4NA ASG-Deskside — device channels for virtualised sessions

Talk to us about ASG-Deskside

Tell us about the devices and applications involved. We reply within one working day, and use your details only to respond, as set out in our privacy notice.