S-terminal collects the users authentication information locally, then creates an encrypted tunnel to the remote host using ssh and starts an X session. All X applications on the remote machine communicate with the local host through the encrypted tunnel.
