System and method for optimizing visual session recording for user account management in a computing environment

• US 10,097,650 B2
• Filed: 10/07/2015
• Issued: 10/09/2018
• Est. Priority Date: 09/24/2014
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Sharma, Himanshu, Srinivasan, Sudhir, Sathyanarayan, Ramaprakash, Theebaprakasam, Arun, Kottahachchi, Buddhika Nandana, Stullich, Olaf
• Primary Examiner(s): Patel, Dhariya A
• Application Number:
  US14/877,024
• Publication Number:
  US 20160088103A1
• Time in Patent Office: 1,098 Days
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/5054 Automatic deployment of services triggered by the service manager, e.g. service implementation by automatic configuration of network components
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 43/14 using software, i.e. software packages network security related monitoring H04L63/1408
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34

Abstract

A system and method can monitor one or more user sessions on a target system in a computing environment. An account managing system can capture a plurality of user session screen captures that are associated with said one or more user sessions on the target system. Furthermore, the account managing system can compare a user session screen capture, which is captured at a time during said one or more user sessions, with one or more user session screen captures that are recorded before the time. Then, the account managing system can record said user session screen capture if the target system is determined to be active at the time when said user session screen capture is captured.

Claims

1. A method for monitoring one or more user sessions on an associated target system in an associated computing environment, the method comprising:

providing an account management system;

automatically capturing with the account management system a plurality of user session screen captures that are associated with a user session on the associated target system;

processing, by the account management system, each user session screen capture of the plurality of user session screen captures, the processing by the account management system comprising;

computing a hash for a user session screen capture;

comparing a hash computed for the user session screen capture, which was automatically captured at a time during the user session, with a hash that was computed for a user session screen capture that was automatically captured before the time and discarding the user session screen capture that was automatically captured at the time if the hash computed for the user session screen capture that was automatically captured at the time is identical to the hash that was computed for the user session screen capture that was automatically captured before the time; and

;

applying one or more screen capture comparison rules to selectively discard the user session screen capture that was automatically captured at the time if one or more differences identified between the user session screen capture that was automatically captured at the time and the user session screen capture that was automatically captured before the time satisfy at least one of the one or more screen capture comparison rules, wherein the one or more screen capture comparison rules comprise;

a first screen capture comparison rule which requires the one or more differences identified between the user session screen automatically captured at the time and the user session screen capture automatically captured before the time to be exclusively within a portion of the associated target system defined as being irrelevant to an auditing of the one or more user sessions;

a second screen capture comparison rule which requires the one or more differences identified between the user session screen automatically captured at the time and the user session screen capture automatically captured before the time to be exclusively outside a portion of the associated target system determined to be displaying an active foreground application executing on the associated target system; and

/or

a third screen capture comparison rule which requires the one or more differences identified between the user session screen capture automatically captured at the time and the user session screen capture automatically captured before the time to be exclusively outside of a portion of the associated target system determined to be displaying a selected application executing on the associated target system; and

automatically encoding, by the account management system, a subset of the plurality of user session screen captures into a video, the subset comprising those user session screen captures which were not discarded.

2. The method according to claim 1, further comprising:

determining the associated target system to be idle at the time the time the user session screen was automatically captured; and

discarding said user session screen capture responsive to determining the target system to be idle at the time when said user session screen capture is automatically captured.

3. The method according to claim 1, further comprising:

providing an agent deployed on the associated target system as part of the account management system; and

using the agent to monitor said one or more user sessions on the associated target system, wherein the agent operates to communicate with a privileged account manager server using a secure channel.

4. The method according to claim 1, further comprising:

providing a proxy server that is associated with a privileged account manager server as part of the account management system; and

using the proxy server to monitor said one or more user sessions on the associated target system, wherein the proxy server operates to monitor a plurality of user sessions on a plurality of target systems independently.

5. The method according to claim 1, further comprising:

providing an agent deployed on the associated target system as part of the account management system;

providing a proxy server that is associated with a privileged account manager server as part of the account management system; and

using simultaneously the agent and the proxy server to monitor said one or more user sessions on the associated target system.

6. The method according to claim 1, wherein:

automatically capturing with the account management system a plurality of user session screen captures that are associated with said user session on the associated target system comprises automatically capturing the plurality of user session screen captures associated with the user session on the associated target system at a predetermined interval.

7. The method according to claim 6, further comprising:

tuning the predetermined interval dynamically based on an activity in said one or more user sessions, wherein the tuning comprises increasing the predetermined interval if the activity is not critical and decreasing the predetermined interval if the activity is critical.

8. The method according to claim 1, further comprising:

allowing an associated user to;

connect to a privileged account manager server,

obtain access to a privileged account on the associated target system, and

establish the one or more user sessions on the associated target system.

9. The method according to claim 1, further comprising:

providing an agent deployed on the associated target system as part of the account management system; and

detecting, via the agent on the associated target system, an establishment of a user session on the target system.

10. The method according to claim 1, further comprising:

communicating with a privileged account manager server to obtain the one or more screen capture comparison rules.

11. The method according to claim 1, further comprising:

providing an agent deployed on the associated target system as part of the account management system, the agent being is associated with a privileged account manager server;

subscribing, via the agent on the associated target system, to a control system on the associated target system to obtain application state information.

12. The method according to claim 1, further comprising:

associating the video with a searchable metadata; and

storing the video associated with the metadata in an associated database accessible to an associated administrator thereby enabling the associated administrator to replay the stored video for monitoring said one or more user sessions.

13. The method according to claim 12, further comprising:

allowing the associated administrator to replay the stored video for monitoring said one or more user sessions.

14. The method according to claim 1, wherein the applying the one or more screen capture comparison rules to selectively discard the user session screen capture that was automatically captured at the time comprises applying each of the first, second and third screen capture comparison rules to selectively discard the user session screen capture that was automatically captured at the time.

15. A system for monitoring one or more user sessions on an associated target system in an associated computing environment, the system comprising:

a computer system comprising one or more microprocessors and a memory device;

an account management system, running on the computer system, wherein the account management system operates to;

automatically capture a plurality of user session screen captures that are associated with a user session on the associated target system;

process each user session screen capture of the plurality of user session screen captures by;

computing a hash for a user session screen capture;

comparing a hash computed for the user session screen capture, which was automatically captured at a time during the user session, with a hash that was computed for a user session screen capture that was automatically captured before the time and discarding the user session screen capture that was automatically captured at the time if the hash computed for the user session screen capture that was automatically captured at the time is identical to the hash that was computed for the user session screen capture that was automatically captured before the time; and

applying one or more screen capture comparison rules to selectively discard the user session screen capture that was automatically captured at the time if one or more differences identified between the user session screen capture that was automatically captured at the time and the user session screen capture that was automatically captured before the time satisfy at least one of the one or more screen capture comparison rules, wherein the one or more screen capture comparison rules comprise;

a first screen capture comparison rule which requires the one or more differences identified between the user session screen automatically captured at the time and the user session screen capture automatically captured before the time to be exclusively within a portion of the associated target system defined as being irrelevant to an auditing of the one or more user sessions;

a second screen capture comparison rule which requires the one or more differences identified between the user session screen automatically captured at the time and the user session screen capture automatically captured before the time to be exclusively outside a portion of the associated target system determined to be displaying an active foreground application executing on the associated target system; and

/or

a third screen capture comparison rule which requires the one or more differences identified between the user session screen capture automatically captured at the time and the user session screen capture automatically captured before the time to be exclusively outside of a portion of the associated target system determined to be displaying a selected application executing on the associated target system; and

automatically encode into a video a subset of the plurality of user session screen captures, the subset comprising those user session screen captures which were not discarded.

16. The system according to claim 15, wherein:

said account managing system operates to discard said user session screen capture if the target system is determined to be idle at the time when said session screen capture is captured.

17. The system according to claim 15, wherein:

the account management system comprises an agent that is deployed on the associated target system to monitor said one or more user sessions on the associated target system, wherein the agent is configured to communicate with a privileged account manager server using a secure channel.

18. The system according to claim 15, wherein:

the account management system comprises a proxy server that is associated with a privileged account manager server and which monitors the one or more user sessions on the associated target system, wherein the proxy server is configured to monitor a plurality of user sessions on a plurality of target systems independently.

19. The system according to claim 15, wherein:

the account management system comprises an agent that is deployed on the associated target system and a proxy server that is associated with a privileged account manager server; and

the account management system uses the agent and the proxy server simultaneously to monitor said one or more user sessions on the associated target system.

20. The system according to claim 15, wherein:

the account management system is configured to automatically capture the plurality of user session screen captures associated with the user session on the associated target system at an interval.

21. The system according to claim 15, wherein:

the account management system is configured to dynamically tune the interval based on an activity in the user session by;

increasing the interval if the activity is not critical; and

decreasing the interval if the activity is critical.

22. The system according to claim 15, wherein:

the account management system is configured to associate searchable metadata with the video and store the video associated with the searchable metadata in a database accessible to an administrator thereby enabling the administrator to replay the stored video for monitoring the user session.