System and method for optimizing visual session recording for user account management in a computing environment

• US 9,185,175 B1
• Filed: 09/24/2014
• Issued: 11/10/2015
• Est. Priority Date: 09/24/2014
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Sharma, Himanshu, Srinivasan, Sudhir Kumar, Sathyanarayan, Ramaprakash, Theebaprakasam, Arun, Kottahachchi, Buddhika Nandana, Stullich, Olaf
• Primary Examiner(s): Patel, Dhairya A
• Application Number:
  US14/494,728
• Time in Patent Office: 412 Days
• US Class Current: 1/1
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34

Abstract

A system and method can monitor one or more user sessions on a target system in a computing environment. An account managing system can capture a plurality of user session screen captures that are associated with said one or more user sessions on the target system. Furthermore, the account managing system can compare a user session screen capture, which is captured at a time during said one or more user sessions, with one or more user session screen captures that are recorded before the time. Then, the account managing system can record said user session screen capture if the target system is determined to be active at the time when said user session screen capture is captured.

Claims

1. A method for monitoring user sessions on a target system in a computing environment, comprising:

providing an account management system;

automatically capturing with the account management system a plurality of user session screen captures that are associated with a user session on the target system at an interval;

tuning the interval dynamically based on an activity in said user session;

using the account management system to process each user session screen capture of said plurality of user session screen captures by,

computing a hash for the user session screen capture,

comparing the hash computed for the user session screen capture, which is captured at a time during said user session, with a hash that was computed for a user session screen capture that was recorded before the time and discarding said user session screen capture if the hash computed for the user session screen capture is identical to said hash that was computed for said user session screen capture that was recorded before the time, and

applying one or more screen capture comparison rules and discarding said user session screen capture if differences identified between the user session screen capture and said user session screen capture that was recorded before the time do not satisfy at least one of said one or more screen capture comparison rules; and

using the account management system to automatically encode into a video a subset of the plurality of recorded user session screen captures said subset comprising those user session screen captures which were not discarded.

2. The method according to claim 1, further comprising:

providing an agent deployed on the target system as part of said account management system; and

using said agent to monitor said one or more user sessions on the target system, wherein the agent operates to communicate with a privileged account manager server using a secure channel.

3. The method according to claim 1, further comprising:

providing a proxy server that is associated with a privileged account manager server as part of said account management system; and

using said proxy server to monitor said one or more user sessions on the target system, wherein the proxy server operates to monitor a plurality of user sessions on a plurality of target systems independently.

4. The method according to claim 1, further comprising:

providing an agent deployed on the target system as part of said account management system;

providing a proxy server that is associated with a privileged account manager server as part of said account management system;

using simultaneously said agent and said proxy server to monitor said one or more user sessions on the target system.

5. The method according to claim 1, wherein:

automatically capturing with the account management system a plurality of user session screen captures that are associated with said user session on the target system comprises automatically capturing the plurality of user session screen captures associated with said user session on the target system at a predetermined interval.

6. The method according to claim 1, wherein:

tuning the interval dynamically based on an activity in said user session comprises increasing the interval if the activity is not critical and reducing the interval if the activity is critical.

7. The method according to claim 1, further comprising:

allowing a user to

connect to a privileged account manager server,

get access to a privileged account on the target system, and

establish a user session.

8. The method according to claim 1, further comprising:

providing an agent deployed on the target system as part of said account management system; and

detecting, via said agent, an establishment of a user session on the target system.

9. The method according to claim 1, further comprising:

communicating with a privileged account manager server to obtain said one or more screen capture comparison rules.

10. The method according to claim 1, wherein applying one or more screen capture comparison rules and discarding said user session screen capture if differences identified between the user session screen capture and said user session screen capture that was recorded before the time do not satisfy at least one of said one or more screen capture comparison rules comprises:

applying a screen capture comparison rule which requires said differences be in an active foreground application and discarding said user session screen capture if said differences identified between the user session screen capture and said user session screen capture that was recorded before the time are not for an active foreground application.

11. The method according to claim 1, wherein applying one or more screen capture comparison rules and discarding said user session screen capture if differences identified between the user session screen capture and said user session screen capture that was recorded before the time do not satisfy at least one of said one or more screen capture comparison rules comprises:

applying a screen capture comparison rule which requires said differences be in a selected application and discarding said user session screen capture if said differences identified between the user session screen capture and said user session screen capture that was recorded before the time are not in the selected application.

12. The method according to claim 1, wherein applying one or more screen capture comparison rules and discarding said user session screen capture if differences identified between the user session screen capture and said user session screen capture that was recorded before the time do not satisfy at least one of said one or more screen capture comparison rules comprises:

applying a screen capture comparison rule which requires said differences be relevant to auditing of said user session and discarding said user session screen capture if said differences identified between the user session screen capture and said user session screen capture that was recorded before the time are not relevant to auditing said user session.

13. The method according to claim 1, further comprising:

automatically associating said video with a searchable metadata; and

storing said video in a database.

14. The method according to claim 1, further comprising:

allowing an administrator to view the video for monitoring said user session.

15. A system for monitoring user sessions on a target system in a computing environment, comprising:

a computer system comprising one or more microprocessors and a memory;

an account management system, running on said computer system, wherein said account management system is configured to automatically capture a plurality of user session screen captures that are associated with a user session on the target system at an interval;

wherein the account management system tunes the interval dynamically based on an activity in said user session;

wherein the account management system is further configured to process each user session screen capture of said plurality of user session screen captures by,

computing a hash for the user session screen capture,

comparing the hash computed for the user session screen capture, which is captured at a time during said user session, with a hash that was computed for a user session screen capture that was recorded before the time and discarding said user session screen capture if the hash computed for the user session screen capture is identical to said hash that was computed for said user session screen capture that was recorded before the time, and

applying one or more screen capture comparison rules and discarding said user session screen capture if differences identified between the user session screen capture and said user session screen capture that was recorded before the time do not satisfy at least one of said one or more screen capture comparison rules; and

wherein the account management system is further configured to automatically encode into a video a subset of the plurality of recorded user session screen captures said subset comprising those user session screen captures which were not discarded.

16. The system according to claim 15, wherein:

the account management system comprises an agent that is deployed on the target system to monitor said one or more user sessions on the target system, wherein the agent is configured to communicate with a privileged account manager server using a secure channel.

17. The system according to claim 15, wherein:

the account management system comprises a proxy server that is associated with a privileged account manager server and which monitors said one or more user sessions on the target system, wherein the proxy server operates to monitor a plurality of user sessions on a plurality of target systems independently.

18. The system according to claim 15, wherein:

the account management system comprises an agent that is deployed on the target system and a proxy server that is associated with a privileged account manager server; and

wherein the account management system uses the agent and the proxy server simultaneously to monitor said one or more user sessions on the target system.

19. The system according to claim 15, wherein:

said account management system operates to automatically capture the plurality of user session screen captures associated with said user session on the target system at a predetermined interval.

20. The system according to claim 15, wherein:

said account management system dynamically tunes the interval based on an activity in said user session by increasing the interval if the activity is not critical and reducing the interval if the activity is critical.

21. The system according to claim 15, wherein:

said account management system is configured to enable a user to

connect to a privileged account manager server,

get access to a privileged account on the target system, and

establish a user session.

22. The system according to claim 15, wherein:

the account management system comprises an agent on the target system wherein the agent is configured to detect an establishment of a user session on the target system.

23. The system according to claim 15, wherein:

the account management system comprises an agent on the target system wherein the agent is configured to communicate with a privileged account manager server to obtain said one or more screen capture comparison rules.

24. The system according to claim 15, wherein applying one or more screen capture comparison rules and discarding said user session screen capture if differences identified between the user session screen capture and said user session screen capture that was recorded before the time do not satisfy at least one of said one or more screen capture comparison rules comprises:

applying a screen capture comparison rule which requires said differences be in an active foreground application and discarding said user session screen capture if said differences identified between the user session screen capture and said user session screen capture that was recorded before the time are not for an active foreground application.

25. The system according to claim 15, wherein applying one or more screen capture comparison rules and discarding said user session screen capture if differences identified between the user session screen capture and said user session screen capture that was recorded before the time do not satisfy at least one of said one or more screen capture comparison rules comprises:

applying a screen capture comparison rule which requires said differences be in a selected application and discarding said user session screen capture if said differences identified between the user session screen capture and said user session screen capture that was recorded before the time are not in a selected application.

26. The system according to claim 15, wherein applying one or more screen capture comparison rules and discarding said user session screen capture if differences identified between the user session screen capture and said user session screen capture that was recorded before the time do not satisfy at least one of said one or more screen capture comparison rules comprises:

applying a screen capture comparison rule which requires said differences be relevant to auditing of said user session and discarding said user session screen capture if said differences identified between the user session screen capture and said user session screen capture that was recorded before the time are not relevant to auditing of said user session.

27. The system according to claim 15, wherein:

said account management system is configured to associated searchable metadata with said video and store said video in a database accessible to an administrator thereby enabling the administrator to replay the stored video for monitoring said user session.

28. A non-transitory machine readable storage medium having instructions stored thereon for monitoring one or more user sessions on a target system in a computing environment, which instructions, when executed cause a computer system to perform steps comprising:

providing an account management system;

automatically capturing with the account management system a plurality of user session screen captures that are associated with a user session on the target system at an interval;

tuning the interval dynamically based on an activity in said user session;

using the account management system to process each user session screen capture of said plurality of user session screen captures by,

computing a hash for the user session screen capture,

comparing the hash computed for the user session screen capture, which is captured at a time during said user session, with a hash that was computed for a user session screen capture that was recorded before the time and discarding said user session screen capture if the hash computed for the user session screen capture is identical to said hash that was computed for said user session screen capture that was recorded before the time, and

applying one or more screen capture comparison rules and discarding said user session screen capture if differences identified between the user session screen capture and said user session screen capture that was recorded before the time do not satisfy at least one of said one or more screen capture comparison rules; and

using the account management system to automatically encode into a video a subset of the plurality of recorded user session screen captures said subset comprising those user session screen captures which were not discarded.