Keystroke logger for Unix-based systems

• US 8,418,227 B2
• Filed: 08/21/2009
• Issued: 04/09/2013
• Est. Priority Date: 08/21/2009
• Status: Active Grant

• Current Assignee: Verizon Patent and Licensing Incorporated (Verizon Communications Inc.)
• Original Assignee: Verizon Patent and Licensing Incorporated (Verizon Communications Inc.)
• Inventors: Miller, Andrew G.
• Primary Examiner(s): Armouche, Hadi
• Assistant Examiner(s): ELAHI, SHAN E
• Application Number:
  US12/545,482
• Publication Number:
  US 20110047596A1
• Time in Patent Office: 1,327 Days
• Field of Search: 726/3, 709/225, 713/186
• US Class Current: 726/3
• CPC Class Codes: G06F 21/83 input devices, e.g. keyboards, mice or controllers thereof
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect

Abstract

A device receives, from an Internet program manager (IPM) server, an identification (ID) of a user associated with a user device and an Internet protocol (IP) address of the user device, and connects to the user device based on the user ID and the IP address of the user device. The device also receives, from the IPM server, a request to execute a logging application for the user device, and executes the logging application based on the request. The device further receives, via the logging application, one or more inputs or outputs associated with the user device, and records the one or more inputs or outputs associated with the user device.

Claims

1. A method comprising:

receiving, from an Internet program manager (IPM) server and by a demilitarized (DMZ) log server, a user identification (ID) of a user associated with a user device and an Internet protocol (IP) address of the user device;

connecting the computing device to the user device based on the user ID and the IP address of the user device;

receiving, from the IPM server and by the DMZ log server, a request to execute a logging application that records one or more inputs or one or more outputs associated with the user device;

executing, by the DMZ log server, the logging application based on the request, an IP address of a target device, the user ID, and the IP address of the user device;

receiving, by the DMZ log server and via the logging application, the one or more inputs or the one or more outputs; and

recording, by the DMZ log server, the one or more inputs or the one or more outputs.

2. The method of claim 1, where the request to execute the logging application includes a request to connect the user device to the target device, and where executing the logging application comprises:

verifying the request to execute the logging application based on the user ID, the IP address of the user device, and the IP address of the target device;

connecting the user device to the target device after the verifying of the request to execute the logging application; and

executing the logging application after the verifying of the request to execute the logging application.

3. The method of claim 1, where receiving the one or more inputs or the one or more outputs comprises:

providing, to the user device, a logging application window, associated with the logging application, for the target device; and

receiving the one or more inputs or the one or more outputs via the logging application window.

4. The method of claim 2, where verifying the request to execute the logging application comprises one or more of:

verifying that the user ID is valid;

verifying that the IP address of the target device is valid;

verifying that the IP address of the user device is valid;

or

verifying that the user device is permitted to connect to the target device.

5. The method of claim 2, where the target device comprises a UNIX based device.

6. The method of claim 1, where the one or more inputs or the one or more outputs include at least one of:

text input by the user via the user device,

text the user cuts and pastes via the user device,

text the user copies and pastes via the user device,

a configuration file change made via the user device,

a database change made via the user device, or

a password used by the user device.

22. The method of claim 1, where the or more inputs or the one or more outputs associated with the user device are provided at a UNIX command line.

23. The method of claim 1, where the or more inputs or the one or more outputs associated with the user device include substitute user UNIX commands entered by the user.

7. A method comprising:

receiving, by a computing device, login information from a user device associated with a user;

determining, by the computing device, a user identification (ID) of the user and an Internet protocol (IP) address of the user device based on the login information;

receiving, by the computing device and from the user device, a name and an IP address of a target device to be connected to the user device;

requesting, by the computing device, connection of the user device to the target device via a demilitarized (DMZ) log server and based on the name of the target device, the IP address of the target device, the user ID, and the IP address of the user device; and

causing, by the computing device, execution of a logging application within the DMZ log server,

the logging application recording one or more inputs or one or more outputs associated with the user device.

8. The method of claim 7, where the computing device comprises an Internet program manager (IPM) server.

9. The method of claim 7, where the target device comprises a UNIX based device.

10. The method of claim 7, where the one or more inputs or the one or more outputs include at least one of:

text input by the user via the user device,

text the user cuts and pastes via the user device,

text the user copies and pastes via the user device,

a configuration file change made via the user device,

a database change made via the user device, or

a password used by the user device.

11. A system comprising:

a demilitarized (DMZ) log server to;

receive, from an Internet program manager (IPM) server, an identification (ID) of a user associated with a user device and an Internet protocol (IP) address of the user device,

connect the device to the user device based on the user ID and the IP address of the user device,

receive, from the IPM server, a request to execute a logging application that records one or more inputs or one or more outputs associated with the user device and to connect the user device to a target device,

connect the user device to the target device based on the request, an IP address of the target device, the user ID, and the IP address of the user device,

execute the logging application based on the request,

receive, via the logging application, the one or more inputs or the one or more outputs, and

record the one or more inputs or the one or more outputs.

12. The system of claim 11, where, when connecting the user device to the target device, the DMZ log server is to:

verify the request based on at least one of the user ID, the IP address of the user device, and the IP address of the target device, and connect the user device to the target device after the verifying of the request.

13. The system of claim 12, where, when verifying the request, the DMZ log server is to one or more of:

verify that the user ID is valid,

verify that the IP address of the target device is valid,

verify that the IP address of the user device is valid, or

verify that the user device is permitted to connect to the target device.

14. The system of claim 11, where, when receiving the one or more inputs or one or more outputs, the DMZ log server is to:

provide, to the user device, a logging application window, associated with the logging application, for the target device, and

receive the one or more inputs or the one or more outputs via the logging application window.

15. The system of claim 11, where the target device comprises a UNIX based device, and where the one or more inputs or the one or more outputs are provided via a UNIX command line.

16. The system of claim 11, where, when recording the one or more inputs or the one or more outputs associated with the user device, the DMZ log server is to:

store, in a database server, the one or more inputs or the one or more outputs.

17. The system of claim 11, where the one or more inputs or the one or more outputs comprises at least one of:

text input by the user via the user device,

text the user cuts, or copies, and pastes via the user device,

text the user copies and pastes via the user device,

a configuration file changes change made via the user device,

a database changes change made via the user device, or

a passwords password used by the user device.

18. A system comprising:

a particular server to;

receive login information from a user device,

determine, based on the login information, a user identification (ID) of a user of the user device and an Internet protocol (IP) address of the user device,

receive, from the user device, a name and an IP address of a target device to be connected to the user device, and

provide, to a demilitarized (DMZ) log server and based on the name of the target device, the IP address of the target device, the user ID, and the IP address of the user device, a request to execute a logging application that records one or more inputs or one or more outputs associated with the user device and to connect the user device to the target device.

19. The system of claim 18, further comprising:

the DMZ log server,

the DMZ log server being to;

receive the request from the particular server,

verify the request based on the user ID, the IP address of the user device, the name of the target device, and the IP address of the target device, and

connect the user device to the target device after the verifying of the request.

20. The system of claim 18, further comprising:

the DMZ log server,

the DMZ log server being to;

receive the request from the first particular server,

execute the logging application based on the request,

provide, to the user device, a logging application window, associated with the logging application, for the target device,

receive the one or more inputs or the one or more outputs via the logging application window, and

store, in a database server, the one or more inputs or the one or more outputs.

21. The system of claim 18, where the target device comprises a UNIX based device, and where the one or more inputs or outputs are provided via a UNIX command line.