Method and system for monitoring individual devices in networked environments

• US 20030200308A1
• Filed: 10/15/2002
• Published: 10/23/2003
• Est. Priority Date: 04/23/2002
• Status: Active Grant

• Current Assignee: Seer Insight Security Kabushiki Kaisha
• Original Assignee: Seer Insight Security Kabushiki Kaisha
• Inventors: Ishida, Akira, Mukai, Toru, Tameda, Eiji
• Granted Patent: US 7,421,491 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/75 Indicating network or usage conditions on the user display
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]

Abstract

According to the present invention, improved techniques for monitoring and managing access and activity at individual devices in a networked environment. Specific embodiments can provide individual and workplace productivity enhancement through self-regulation enforced by peer-group monitoring of network and application usage. In accordance with the specific embodiments of the present invention, techniques that reveal activity of individual users at any device, such as a computer telephone, or other device, within the network environment can be used to analyze flows of information within an enterprise, workplace productivity, network security and other applications in enterprises, including business entities, technical entities, and governmental entities. Specific embodiments provide systems, methods, computer programs and apparatus for monitoring activity at networked entities, such as individual devices, computers, other devices, or other networked computing entities. The information obtained from such monitoring can be used to populate databases, for example. Further, or in the alternative, specific embodiments include analyzing the information, and sharing the information with one or more networked computers and/or with other computational entities locally or remotely connectable with the network. Specific embodiments can have a broad range of functionality in a variety of business, technical and governmental applications.

Claims

1. A method, comprising:

recognizing events at the computer;

interpreting the events to obtain synoptic information; and

forwarding the synoptic information to at least one other computer for display.

2. The method of claim 1 further comprising:

receiving from at least one other computer synoptic information for display.

3. The method of claim 2, further comprising:

updating a Graphical User Interface (GUI) based upon the synoptic information received.

4. The method of claim 3, wherein:

updating the GUI provides a display of events taking place on each of a plurality of interconnected computers.

5. The method of claim 1, wherein the events comprise at least one of:

a user input, a system event, a keystroke, a mouse input, a selection made at a touch screen device, a trackball input, an incoming message from a communications interface, an internal system fault, or an external change in environment detected by any of a variety of sensing devices.

6. The method of claim 3, further comprising:

forwarding the computer synoptic information to a database for storing.

7. A method, comprising:

retrieving from a database computer synoptic information for a device;

processing the computer synoptic information; and

forwarding the processed information to at least one device for display.

8. The method of claim 7, wherein:

processing comprises incorporating information based upon a user identity provided during log-on into the computer synoptic information.

9. The method of claim 7, wherein:

forwarding comprises providing the information in a format displayable in a report area for messages on at least one of a plurality of devices.

10. The method of claim 7, wherein:

processing comprises analyzing the computer synoptic information.

11. The method of claim 10, wherein:

analyzing comprises determining at least one of web access time, mail count, print job count, logon time.

12. The method of claim 7, wherein:

analyzing comprises selecting from among the computer synoptic information based upon a user preference.

13. The method of claim 7, wherein:

analyzing comprises generating reports.

14. The method of claim 7, wherein:

analyzing comprises tracking the computer synoptic information to determine if one or more items has exceeded prescribed limits.

15. A system, comprising:

a first computer,

an agent resident on the first computer, and

a network interface making the first computer connectable to at least one other computer;

wherein the agent is operative to reflect information about activities conducted on the first computer to the at least one other computer, and to reflect information about activities conducted on the at least one other computer onto the first computer.

16. The system of claim 15, further comprising:

a database, operatively connectable to the first computer and the at least one other computer by the network;

wherein the database comprises information about users of the first computer and the at least one other computer.

17. The system of claim 15, further comprising:

a database enabler server, operatively connectable to the first computer and the at least one other computer by a communications connection;

wherein the database enabler server comprises a database of information about users of the first computer and the at least one other computer.

18. The system of claim 15, further comprising:

one or more servers; and

an agent resident upon each of the one or more servers;

wherein the agent is operative to reflect information about activities on the one or more servers to the first computer and the at least one other computer.

19. A system, comprising:

a first device,

an agent resident on the first device, and

a network interface making the first device connectable to at least one device;

wherein the agent is operative to reflect information about activities conducted on the first device to the at least one other device, and to reflect information about activities conducted on the at least one other device onto the first device.

20. The system of claim 19, wherein

the first device comprises at least one of:

a phone, a mobile phone, a personal data assistant (PDA), pager, computer, navigation system, global positioning system (GPS) device, a digital camera, video camera, home-entertainment-system control box, remote garage door opener, two-way radio, baby monitor, facsimile machine, or office copy machine.

21. The system of claim 19, further comprising:

a second device,

wherein the agent is further operative to reflect information about activities conducted on the first device using information gathered at the second device to the at least one other device.

22. The system of claim 21, wherein

the second device comprises at least one of:

a video camera, a microphone, a smart card reader, a biometric monitor.

23. An apparatus, comprising:

means for recognizing events;

means for interpreting the events to obtain synoptic information; and

means for forwarding the synoptic information to at least one other apparatus for display.

24. An apparatus, comprising:

means for retrieving from a database computer synoptic information for a device;

means for processing the computer synoptic information; and

means for forwarding the processed information to at least one device for display.

25. A computer program product for providing a user environment at a computer, comprising:

code that recognizes events at the computer;

code that interprets the events to obtain synoptic information;

code that forwards the synoptic information to at least one other computer for display; and

a computer readable storage medium for holding the codes.

26. A computer program product, comprising:

code that retrieves from a database computer synoptic information for a device;

code that processes the computer synoptic information;

code that forwards the processed information to at least one device for display; and

a computer readable storage medium for holding the codes.

27. A computer, comprising:

an agent, operatively disposed to monitor activities or events, and upon detection, to interpret the activity or event to collect synoptic information; and

thereupon to provide synoptic information to one or more external devices; and

to reflect synoptic information about activities or events conducted on the one or more other devices;

a communications interface, providing connectivity to at least one of a plurality of other computers;

an information setting process, that cooperatively with the agent, collects information about events or activities;

a banner, to display activities or events occurring with at least one of a plurality of other computers;

a report engine, that provides reports based upon information received via the communications interface; and

a drawing manager, for presenting information reflecting activities or events.

28. An enabler server, comprising:

a communications interface, providing connectivity to at least one computer;

a converted data exit, operative to provide conversion between formats for information about the at least one computer received via the communications interface;

a database, operative to provide storage and retrieval for the information about the at least one computer received via the communications interface;

an analysis engine, operative to perform an analysis upon the information about the at least one computer received via the communications interface to form an analysis result;

an authorization engine, operative to control access to the at least one computer; and

,

at least one of a 2D data manager and a 3D data manager, for providing a presentation of the analysis result.

29. A user interface method, comprising:

depicting a view of a first user'"'"'s work environment from the perspective of the first user on a screen of a second user, the work environment comprising a representation of the first user'"'"'s device;

depicting content of the first user'"'"'s device display into the representation of the first user'"'"'s device on the screen of the second user;

thereby providing a “

look over the shoulder”

view of the content and environment of the first user'"'"'s device displayed on the screen of the second user.

30. A method for monitoring security at one or more computers in a work area(s) of interest, comprising:

querying a database for synoptic information about a user logged into a computer located at the work area of interest;

requesting information from a video camera having a view of the work area of interest;

determining based upon the synoptic information about the user and the information from the video camera, whether the user is present in the work area;

comparing information from the video camera to a stored video image of a correct user assigned to the work area to determine whether the correct user is at the work area.

31. The method of claim 30, wherein:

comparing information from the video camera to a stored video image of a correct user assigned to the work area to determine whether the correct user is at the work area further comprises;

notifying of an unauthorized access if the user at the work area is not the correct user.

32. The method of claim 30, wherein:

determining based upon the synoptic information about the user and the information from the video camera, whether the user is present in the work area further comprises;

notifying of an unauthorized absence for the user who is not at his work area.

33. The method of claim 30, further comprising:

determining whether another work area of interest is to be monitored, and if so, repeating querying, requesting, determining and comparing for a new work area of interest.

34. The method of claim 30, further comprising:

determining based upon the synoptic information whether the user has performed an unauthorized access attempt;

notifying other users if the user has performed an unauthorized access attempt, thereby increasing peer pressure among users.

35. An apparatus for providing workplace productivity enhancement, comprising:

means for detecting events relating to network and application usage;

means for monitoring by a peer group of the events; and

means for regulating user activity enforced by the peer-group.

36. A method for providing workplace productivity enhancement, comprising:

detecting events relating to network and application usage;

monitoring by a peer group of the events; and

regulating user activity through enforcement by the peer-group.