Free location and playback method based on RDP (Remote Desktop Protocol) audit data as well as system

Abstract

The invention belongs to the technical field of the security audit of the computer and the network, and discloses a free location and playback method based on RDP (Remote Desktop Protocol) audit data as well as a system. The system comprises an RDP audit data service terminal and an RDP playback client terminal. The RDP audit data service terminal comprises an RDP agent server and an audit data server; and the RDP playback client terminal comprises an audit data client terminal, an RDP decoding module, a compression module, an RDP location module, an RDP playback module and an RDP playback interface module. The invention has the advantages of realization of the audit playback of the RDP, free location and playback, and capability of quickly locating the overlong audit content.

Description

technical field [0001] The invention belongs to the technical field of computer and network security auditing, and relates to a playback technology of remote RDP session audit content, specifically an arbitrary positioning playback method and system based on RDP audit data. Background technique [0002] According to the applicant's understanding: with the development of computer and network technology, more and more fields have applied computers and networks, and even many fields are basically completely dependent on computers and networks, especially in areas where computers and networks are very dense, such as telecommunications room , data centers, banks, etc., have very high requirements for the operation and maintenance of computers and networks, and at the same time, the audit requirements for operation and maintenance are also increasing. [0003] According to the applicant's research and investigation: Currently, the commonly used operation and maintenance methods ma...

AI Technical Summary

Problems solved by technology

The RDP protocol is designed by Microsoft Corporation and implemented server and client in its Windows operating system, and through research on the RDP protocol, it is found that it is not a big problem to realize auditing and playback, but it is not a big problem to realize arbitrary positioning playback. There are still great difficulties

[0004] Through the research and conclusion, it is found that: the main difficulties affecting RDP arbitrary positioning playback are: (1) The RDP protocol is a protocol that depends on the front and back, and the positioning is at the end, and the dependent data may be at the head or at an uncertain position in the middle; (2) The implementation of the RDP protocol itself is implemented in C / C++, and since it is mastered by Microsoft, and most of it is on the Windows platform, the open source code is basically C / C++, without Pascal Version

This is mainly because the design idea of ​​the RDP protocol is to use the TCP / IP network to remotely control the target Windows computer. The amount of data such as mouse and keyboard is small, while the amount of screen image data is large, so the concept of data buffering is designed in the RDP protocol. That is to say, if an image is repeated, the server will not repeatedly transmit it to the client, but just tell the client to fetch data from the buffer (computer memory). Therefore, if the RDP protocol data record is stored directly, it will be played back in normal order. , the problem is not big, but once you want to position and play back at will, the picture will be incomplete, or the picture will be chaotic, and the meaning of positioning will be lost

[0005] At present, there are also some technologies such as forward-reading and reconstructing image data based on experience values, etc., to realize RDP positioning and playback. However, because 100% pre-reading of sufficient data cannot be guaranteed, complete data cannot be reconstructed, especially in the case of long or For super long audit content, arbitrary positioning playback can hardly satisfy the application

Images