Keyboard, mouse, and video (KVM) session capture system that stores and can playback portions of live KVM session via forensic capture module

• US 8,397,004 B2
• Filed: 06/30/2008
• Issued: 03/12/2013
• Est. Priority Date: 01/31/2006
• Status: Active Grant

• Current Assignee: Raritan Americas Incorporated (Legrand SA)
• Original Assignee: Raritan Americas Incorporated (Legrand SA)
• Inventors: Schweig, Marc E.
• Primary Examiner(s): PEYTON, TAMMARA R
• Application Number:
  US12/164,233
• Publication Number:
  US 20090013109A1
• Time in Patent Office: 1,716 Days
• Field of Search: 710 8- 10, 710104-106, 710/313, 710/100, 710/300, 710/310, 710/312, 710/62, 710/72, 711/100, 711/162
• US Class Current: 710/73
• CPC Class Codes: G06F 3/0227 Cooperation and interconnection of the input arrangement with other functional units of a computer G06F3/023 - G06F3/037 take precedence

Abstract

Keyboard, mouse and video (KVM) capture session architecture that includes command center forensics. That is, redirector hardware (HW) and a command center forensics (CCF) appliance. The redirector HW includes a computer interface module (CIM) with a computer readable encoded media. The CIM is configured to record at least one KVM session. The computer readable encoded media is configured to instruct sending an identical copy of the recorded at least one KVM session to the CCF appliance. The CCF appliance being configured to store and playback the identical copy.

Claims

1. An apparatus for use in a Keyboard, Video, Mouse (KVM) system comprising:

at least a console for remotely managing at least one server via a network, wherein said management is provided by bidirectionally coupling KVM signals signal between the console and the server, and each of the KVM signals has a source and a destination;

a first unit for coupling each of the KVM signals to their respective destinations and for simultaneously providing a representation of each of the KVM signals at an output coupled to a network;

a second unit coupled via the network to the output of the first unit, wherein the second unit is configured to store each of said representations; and

a browser-based search and playback application configured to access the second unit, to search for said stored representations of said KVM signals using one or more of keystrokes or mouse click patterns of said KVM signals, date, time, user ID or IP address information to identify one or more KVM sessions of interest, and to initiate a playback of stored representations for said sessions of interest, wherein

said apparatus is responsive to command signals that direct the apparatus to store all or a predetermined portion of the KVM signals.

2. The apparatus of claim 1 wherein each representation is a replica of its associated KVM signal and said second unit stores each replica.

3. The apparatus of claim 1 wherein each representation is a packetized version of its associated KVM signal and said second unit stores each such representation.

4. The apparatus of claim 1 wherein the command signals direct the apparatus to store KVM signals upon a predetermined condition.

5. The apparatus of claim 4 wherein the predetermined condition is a reboot condition.

6. The apparatus of claim 4 wherein the server provides video signals having a predetermined screen resolution and said predetermined condition is a change in said screen resolution.

7. The apparatus of claim 6 wherein the command signal specifies the quality of the video signal stored.

8. The apparatus of claim 1 wherein the second unit is configured to store representations of KVM signals from different consoles destined for different servers simultaneously.

9. The apparatus of claim 1 wherein said second unit is configured to retrieve stored representations of said KVM signals.

10. The apparatus of claim 9 wherein said second unit is responsive to retrieval signals provided by said playback application.

11. The apparatus of claim 10 wherein the retrieval signals direct the second unit to retrieve all or a portion of the stored representations.

12. The apparatus of claim 1 wherein the stored representations of the KVM signal are time stamped.

13. The apparatus of claim 1 wherein the stored representations of the KVM signal are encrypted.

14. The apparatus of claim 1 wherein the second unit is configured to store only the predetermined portion of the KVM signals in a filtered recording mode.

15. The apparatus of claim 11 wherein the second unit is configured to retrieve only the portion of the stored representations in a filtered playback mode.