SERVICE COMPLIANCE ENFORCEMENT USING USER ACTIVITY MONITORING AND WORK REQUEST VERIFICATION

• US 20130275579A1
• Filed: 04/10/2013
• Published: 10/17/2013
• Est. Priority Date: 04/13/2012
• Status: Active Grant

• Current Assignee: Edison Vault, LLC
• Original Assignee: International Business Machines Corporation
• Inventors: Hernandez, Milton H., Laredo, Jim A., Marder, Mattias, Ruan, Yaoping, Seshagiri, Nandagopal
• Granted Patent: US 9,608,881 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 41/0686 Additional information in the notification, e.g. enhancement of specific meta-data
• CPC Class Codes: H04L 41/069 using logs of notifications; Post-processing of notifications
• CPC Class Codes: H04L 41/5061 characterised by the interaction between service providers and their network customers, e.g. customer relationship management
• CPC Class Codes: H04L 43/08 Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34

Abstract

A computer implemented method, data processing system, and computer program product control point in time access to a remote client device and auditing system logs of the remote client device by an auditing server device to determine whether monitored user activity on the remote client device associated with a work request was in compliance with one or more regulations.

Claims

1. A computer implemented method for capturing and monitoring user activity, the method comprising:

identifying, by a client side agent, a monitored event within a workflow for supported application;

responsive to identifying the monitored event, capturing information about the monitored event, wherein the information includes a server response to the monitored event;

capturing a screenshot of the supported application;

associating the information with the screenshot; and

storing the associated information and screenshot as an audit log of the event.

2. The computer implemented method of claim 1, wherein the client side agent is a client side software system that communicates with and performs tasks to synchronize data changes with an integrated management system server.

3. The computer implemented method of claim 1, wherein the workflow is an application specific workflow or a monitoring workflow

4. The computer implemented method of claim 3 wherein the client side agent includes plug-ins that, the method further comprising:

performing custom action needed as part of a workflow trigger or workflow action inside application specific workflow embodiment; and

making calls into operating system or other ones of plug-ins to implement customized authentication, access control, or workflow automation for a specific application, wherein the customized authentication, access control, or workflow automation is selected from the group consisting of retrieving application credential from a wallet, retrieving a user policy setting from the wallet, looking up a user'"'"'s group membership, looking up an attribute from a user directory, reading data from a central fileshare, storing data to the central fileshare, looking up a time from the host system clock, performing an additional checksum on a target application prior to single sign-on, performing an additional check of the installation path on a target application prior to single sign-on, calling an external application, calling an external process, and making an HTTPS call to a third-party service.

5. The computer implemented method of claim 1, wherein the monitored event is a state change detected by the workflow, the state change selected from the group consisting of a change to a position of a current active window, a change to a title of the current active window, a mouse event, and a keyboard event.

6. The computer implemented method of claim 1, wherein the information is identified by a set of application programming interface applications that log event messages to integrated management system server, the set of application programming interface applications being selected from the group consisting of a bitmap recognition module comprising an optical character recognition module to capture bit-mapped application processes, a screen capturing module to dynamically capture the screenshot of the supported application based on user input that causes a state change within the workflow, and a graphical user interface module to dynamically capture an activity signature, the activity signature comprising a window title of a current active application and a button name that is interacted within a graphical user interface.

7. The computer implemented method of claim 1, further comprising:

waiting for image stabilization before capturing the screenshot; and

responsive to image stabilization, capturing the screenshot of the supported application.

8. The computer implemented method of claim 1, further comprising:

forwarding the audit log to an integrated management system server; and

storing the audit log at the integrated management system server.

16. The computer program product of claim 1, further comprising:

forwarding the audit log to an integrated management system server; and

storing the audit log at the integrated management system server.

9. A computer program product for capturing and monitoring user activity, the computer program product comprising:

a computer readable storage medium having computer readable program code embodied therewith, the computer readable program code comprising;

computer readable program code configured to identify a monitored event within a workflow for supported application;

computer readable program code, responsive to identifying the monitored event, configured to capture information about the monitored event, wherein the information includes a server response to the monitored event;

computer readable program code configured to capture a screenshot of the supported application;

computer readable program code configured to associate the information with the screenshot; and

computer readable program code configured to store the associated information and screenshot as an audit log of the event.

10. The computer program product of claim 9, wherein the client side agent is a client side software system that communicates with and performs tasks to synchronize data changes with an integrated management system server.

11. The computer program product of claim 9, wherein the workflow is an application specific workflow or a monitoring workflow

12. The computer program product of claim 11 wherein the client side agent includes plug-ins that, the method further comprising:

performing custom action needed as part of a workflow trigger or workflow action inside application specific workflow embodiment; and

making calls into operating system or other ones of plug-ins to implement customized authentication, access control, or workflow automation for a specific application, wherein the customized authentication, access control, or workflow automation is selected from the group consisting of retrieving application credential from a wallet, retrieving a user policy setting from the wallet, looking up a user'"'"'s group membership, looking up an attribute from a user directory, reading data from a central fileshare, storing data to the central fileshare, looking up a time from the host system clock, performing an additional checksum on a target application prior to single sign-on, performing an additional check of the installation path on a target application prior to single sign-on, calling an external application, calling an external process, and making an HTTPS call to a third-party service.

13. The computer program product of claim 9, wherein the monitored event is a state change detected by the workflow, the state change selected from the group consisting of a change to a position of a current active window, a change to a title of the current active window, a mouse event, and a keyboard event.

14. The computer program product of claim 9, wherein the information is identified by a set of application programming interface applications that log event messages to integrated management system server, the set of application programming interface applications being selected from the group consisting of a bitmap recognition module comprising an optical character recognition module to capture bit-mapped application processes, a screen capturing module to dynamically capture the screenshot of the supported application based on user input that causes a state change within the workflow, and a graphical user interface module to dynamically capture an activity signature, the activity signature comprising a window title of a current active application and a button name that is interacted within a graphical user interface.

15. The computer program product of claim 9, further comprising:

waiting for image stabilization before capturing the screenshot; and

responsive to image stabilization, capturing the screenshot of the supported application.

17. A computer comprising:

a storage having computer readable program code for capturing and monitoring user activity embodied therewith;

a bus connecting the storage to a processor; and

a processor, wherein the processor executes the computer readable program code;

to identify a monitored event within a workflow for supported application;

responsive to identifying the monitored event, to capture information about the monitored event, wherein the information includes a server response to the monitored event;

to capture a screenshot of the supported application;

to associate the information with the screenshot; and

to store the associated information and screenshot as an audit log of the event.

18. The computer of claim 17, wherein the client side agent is a client side software system that communicates with and performs tasks to synchronize data changes with an integrated management system server.

19. The computer of claim 17, wherein the workflow is an application specific workflow or a monitoring workflow

20. The computer of claim 19 wherein the client side agent includes plug-ins that, wherein the processor further executes the computer readable program code:

to perform custom action needed as part of a workflow trigger or workflow action inside application specific workflow embodiment; and

to make calls into operating system or other ones of plug-ins to implement customized authentication, access control, or workflow automation for a specific application, wherein the customized authentication, access control, or workflow automation is selected from the group consisting of retrieving application credential from a wallet, retrieving a user policy setting from the wallet, looking up a user'"'"'s group membership, looking up an attribute from a user directory, reading data from a central fileshare, storing data to the central fileshare, looking up a time from the host system clock, performing an additional checksum on a target application prior to single sign-on, performing an additional check of the installation path on a target application prior to single sign-on, calling an external application, calling an external process, and making an HTTPS call to a third-party service.

21. The computer of claim 17, wherein the monitored event is a state change detected by the workflow, the state change selected from the group consisting of a change to a position of a current active window, a change to a title of the current active window, a mouse event, and a keyboard event.

22. The computer of claim 17, wherein the information is identified by a set of application programming interface applications that log event messages to integrated management system server, the set of application programming interface applications being selected from the group consisting of a bitmap recognition module comprising an optical character recognition module to capture bit-mapped application processes, a screen capturing module to dynamically capture the screenshot of the supported application based on user input that causes a state change within the workflow, and a graphical user interface module to dynamically capture an activity signature, the activity signature comprising a window title of a current active application and a button name that is interacted within a graphical user interface.

23. The computer of claim 17, wherein the processor further executes the computer readable program code:

to wait for image stabilization before capturing the screenshot; and

responsive to image stabilization, to capture the screenshot of the supported application.

24. The computer of claim 17, wherein the processor further executes the computer readable program code:

to forward the audit log to an integrated management system server; and

storing the audit log at the integrated management system server.