Proxy gateway-based security for RDP-type communication sessions

Abstract

The method includes the steps of: receiving data at a proxy gateway describing an action, the data corresponding to a physical computer input device action performed by a current computer user using an input device connected to a first computer while interacting with a second computer over a computer network during a communication session, the communication session being performed according to a protocol associated with an identified computer user and in which the data is sent by the first computer to the second computer through the proxy gateway and rendered as the action at the second computer; determining during the communication session whether the current computer user is the identified computer user based on a comparison of the data received at the proxy gateway to biometric data associated with the identified computer user; and performing a defined security action if it is determined during the communication session that the current computer user is other than the identified computer user.

Description

[Technical field]

[0001] The present invention relates generally to computer security. [Background technology]

[0002] Enterprises that allow employees to connect to the company network from remote locations face a variety of security-related and management-related challenges. One such challenge is ensuring that individuals who remotely access the company network to use company applications have not only provided the appropriate credentials and are authorized for such access and use, but that such individuals are in fact who they claim to be. Another challenge is monitoring the productivity of remote employees. Yet another challenge is ensuring the security of data accessed beyond the company's walls. Current attempts to address these challenges rely on software running on the remote employee's computer or on the company's computer, and even the latter is subject to the risk of circumvention by the employee. Summary of the Invention [Means for solving the problem]

[0003] In one aspect of the present invention, a method for computer user authentication is provided, the method comprising: receiving at a proxy gateway computer input device action data describing computer input device actions, including at least one of keyboard keystroke actions and pointing device actions, and including timing information associated with at least one of the actions, the computer input device actions corresponding to physical computer input device actions performed by a current computer user using at least one of a keyboard and a pointing device connected to a first computer while interacting with a second computer over a computer network during a communication session, the communication session being associated with an identified computer user and being performed according to a protocol in which the computer input device action data is transmitted by the first computer to the second computer via the proxy gateway and rendered at the second computer as the computer input device action; determining whether the current computer user is the identified computer user based on a comparison of the computer input device action data received at the proxy gateway with biometric data associated with the identified computer user during the communication session; and performing a predefined security action if it is determined during the communication session that the current computer user is other than the identified computer user.

[0004] In another aspect of the invention, the defined security action includes providing a notification to a system administrator.

[0005] In another aspect of the invention, the defined security action includes refraining from transferring any of the computer input device action data to the second computer.

[0006] In another aspect of the invention, the defined security action includes terminating the communication session.

[0007] In another aspect of the invention, the defined security action includes requiring the current computer user to submit or resubmit identification or other identifying information.

[0008] In another aspect of the invention, the determining is performed at multiple points during the communication session.

[0009] In another aspect of the invention, the determination is made at multiple points in time, either at random points in time, at random time intervals, at defined points in time, at defined time intervals, when a defined amount of new computer input device action data is received, and when a defined amount and type of new computer input device action data is received.

[0010] In another aspect of the invention, there is provided a computer user authentication system, the system including: a proxy gateway configured to receive computer input device action data describing computer input device actions, including any of keyboard keystroke actions and pointing device actions, and including timing information associated with any of the actions, the computer input device actions corresponding to physical computer input device actions performed by a current computer user using any of a keyboard and a pointing device connected to a first computer while interacting with a second computer over a computer network during a communication session, the communication session being associated with an identified computer user and being performed according to a protocol in which the computer input device action data is transmitted by the first computer through the proxy gateway to the second computer and rendered as the computer input device action at the second computer; a user authentication apparatus configured to determine whether the current computer user is the identified computer user based on a comparison result between the computer input device action data received at the proxy gateway and biometric data associated with the identified computer user during the communication session; and a security agent configured to perform a predefined security action if it is determined during the communication session that the current computer user is other than the identified computer user.

[0011] In another aspect of the present invention, there is provided a method for user productivity monitoring, the method comprising the steps of receiving computer input device action data at a proxy gateway describing computer input device actions including either keyboard keystroke actions or pointing device actions and including timing information associated with either of the actions, the computer input device actions corresponding to physical computer input device actions performed by a computer user using either a keyboard or a pointing device connected to a first computer while interacting with a second computer over a computer network during a communication session, the communication session being associated with the computer user and performed according to a protocol in which the computer input device action data is transmitted by the first computer through the proxy gateway to the second computer and rendered as the computer input device actions at the second computer, and recording the timing information in a data storage device.

[0012] In another aspect of the invention, the method further includes recording the timing information in association with an identifier associated with the computer user.

[0013] In another aspect of the invention, the method further comprises recording the timing information in association with an identifier associated with the communication session.

[0014] In another aspect of the present invention, there is provided a user productivity monitoring system comprising: a proxy gateway configured to receive computer input device action data describing computer input device actions, including either keyboard keystroke actions or pointing device actions, and including timing information associated with either of the actions, wherein the computer input device actions correspond to physical computer input device actions performed by a computer user using either a keyboard or a pointing device connected to a first computer while interacting with a second computer over a computer network during a communication session, the communication session being associated with the computer user and performed according to a protocol in which the computer input device action data is transmitted by the first computer through the proxy gateway to the second computer and rendered as the computer input device actions at the second computer; and a productivity data manager configured to record the timing information in a data storage device.

[0015] In another aspect of the invention, there is provided a method for computer user input monitoring, the method comprising the steps of receiving at a proxy gateway computer input device action data describing computer input device actions including keyboard keystroke actions, the computer input device actions corresponding to physical computer input device actions performed by a computer user using a keyboard connected to a first computer while interacting with a second computer over a computer network during a communication session, the communication session being associated with the computer user and being performed according to a protocol in which the computer input device action data is sent by the first computer through the proxy gateway to the second computer and rendered as the computer input device action at the second computer; determining whether a delimited text string derived from the computer input device action data is within a table of predefined text strings and whether the derived text string is associated with the computer user; and performing a predefined security action during the communication session if the derived text string is not associated with the computer user.

[0016] In another aspect of the invention, the method further includes deriving the delimited text string from the computer input device action data.

[0017] In another aspect of the invention, there is provided a computer user input monitoring system, the method including: a proxy gateway configured to receive computer input device action data describing computer input device actions including keyboard keystroke actions, the computer input device actions corresponding to physical computer input device actions performed by a computer user using a keyboard connected to a first computer while interacting with a second computer over a computer network during a communication session, the communication session being associated with the computer user and performed according to a protocol in which the computer input device action data is sent by the first computer through the proxy gateway to the second computer and rendered as the computer input device action at the second computer; a text string monitor configured to determine whether a delimited text string derived from the computer input device action data is within a table of predefined text strings and whether the derived text string is associated with the computer user; and a security agent configured to perform a predefined security action during the communication session if the derived text string is not associated with the computer user.

[0018] In another aspect of the invention, a data security method is provided, the method comprising the steps of: receiving at a proxy gateway target data transmitted between a first computer and a second computer via a computer network through a proxy gateway, the target data being received during a communication session associated with a computer user and performed according to a protocol in which computer input device action data is transmitted by the first computer to the second computer via the computer network through the proxy gateway and rendered at the second computer as computer input device actions, the computer input device action data describing the computer input device actions including any of keyboard keystroke actions and pointing device actions and including timing information associated with any of the actions, the computer input device actions corresponding to physical computer input device actions performed by the computer user using a keyboard connected to the first computer while interacting with the second computer via the computer network during the communication session; creating a modified version of the target data according to a predefined modification action; and transmitting the modified version of the target data to any of the computers via the computer network.

[0019] In another aspect of the invention, the target data is received as clipboard-based data.

[0020] In another aspect of the invention, the creating includes modifying the target data according to a predefined data loss prevention action.

[0021] In another aspect of the invention, the creating includes omitting a portion of the target data from the modified version of the target data.

[0022] In another aspect of the invention, the target data is a data file having a first data file format, and the creating includes converting the target data to a data file having a second data file format.

[0023] In another aspect of the invention, the target data is a data file of a file type to which predefined content sanitization and reconstruction techniques can be applied, and the creating includes disassembling the target data file and reconstructing the target data file as the modified version of the target data, where all elements of the target data file that do not conform to predefined standards and policies for the file type are omitted from the reconstructed data file.

[0024] In another aspect of the invention, there is provided a data security system comprising: a proxy gateway configured to receive target data transmitted between a first computer and a second computer via a proxy gateway over a computer network, the target data being received during a communication session associated with a computer user and performed according to a protocol in which computer input device action data is transmitted by the first computer via the computer network to the second computer via the proxy gateway and rendered at the second computer as computer input device actions, the computer input device action data describing the computer input device actions including any of keyboard keystroke actions and pointing device actions and including timing information associated with any of the actions, the computer input device actions corresponding to physical computer input device actions performed by the computer user using a keyboard connected to the first computer while interacting with the second computer over the computer network during the communication session; and a data security manager configured to create a modified version of the target data according to a defined modification action, the proxy server further configured to transmit the modified version of the target data to any of the computers over the computer network. [Brief description of the drawings]

[0025] Aspects of the present invention will be more fully understood and appreciated from the following detailed description taken in conjunction with the accompanying drawings, in which:

[0026] [Figure 1A] 1 is a simplified conceptual diagram of a computer user authentication system constructed and operative in accordance with one embodiment of the present invention. [Figure 1B]1B is a simplified flowchart of an exemplary method of operation of the system of FIG. 1A operated in accordance with one embodiment of the present invention. [Figure 2A] 1 is a simplified conceptual diagram of a user productivity monitoring system constructed and operative in accordance with an embodiment of the present invention. [Figure 2B] 2B is a simplified flowchart of an exemplary method of operation of the system of FIG. 2A operated in accordance with one embodiment of the present invention. [Figure 3A] 1 is a simplified conceptual diagram of a computer user input monitoring system constructed and operative in accordance with an embodiment of the present invention; [Figure 3B] 3B is a simplified flowchart of an exemplary method of operation of the system of FIG. 3A operated in accordance with one embodiment of the present invention. [Figure 3C] 3B is a table of administrative user names that may be used by a privileged user to access restricted software applications, which is useful in understanding the system of FIG. 3A and the method of FIG. 3B. [Figure 4A] 1 is a simplified conceptual diagram of a data security system constructed and operative in accordance with an embodiment of the present invention. [Figure 4B] 4B is a simplified flowchart of an exemplary method of operation of the system of FIG. 4A operated in accordance with one embodiment of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0027] Reference is now made to Figures 1A and 1B, which are a simplified conceptual diagram of a computer user authentication system constructed and operative in accordance with an embodiment of the present invention, and Figure 1B is a simplified flowchart of an exemplary method of operation of the system of Figure 1A operative in accordance with an embodiment of the present invention. In the system of Figure 1A and the method of Figure 1B, a proxy gateway 100 is configured to facilitate a communications session between a computer 102 and a computer 104 over a computer network 106, such as the Internet; The communication session is associated with an identified computer user 108 and is performed according to a protocol in which computer input device action data 110 is transmitted from the computer 102 over the computer network 106 via the proxy gateway 100 to the computer 104 and rendered as computer input device actions at the computer 104; The computer input device action data 110 describes computer input device actions and includes timing information associated with any of the actions, the computer input device actions including any of keyboard keystroke actions and pointing device actions; The computer input device actions correspond to physical computer input device actions performed by the current computer user 112, for example, using either a keyboard 114 and a pointing device 116 connected to the computer 102 while interacting with the computer 104 over the computer network 106 during a communications session.

[0028] The computer 104 is preferably configured in accordance with conventional techniques to request that communications from the computer 102 during a communication session be routed or passed through the proxy gateway 100. The proxy gateway 100 is configured with the capability to access all data transmitted between the computers 102 and 104 through or via the proxy gateway 100 during a communication session carried out in accordance with the protocol. This includes all data transmitted in accordance with the protocol (e.g., but is not limited to, data describing keyboard keystroke actions and pointing device actions, timing information associated with any of the actions, display content, clipboard content, and protocol related messages such as error messages).

[0029] The communications session may be performed according to any protocol that provides the above functionality, such as, but not limited to, the Remote Desktop Protocol (RDP) developed by Microsoft Corporation of Redmond, Washington, USA, the HDX protocol developed by Citrix Systems, Inc. of Fort Lauderdale, Florida, the PC-over-IP (PCoIP) protocol developed by Teradici and supported by VMware Horizon of VMware, Inc., and the open source Virtual Network Computing (VNC) protocol. Computer input device action data 110 includes any type of information supported by a protocol related to the use of keyboards and pointing devices. The term "RDP-type protocol" is used herein to refer to any protocol that provides the above functionality, and the term "RDP-type communications session" is used herein to refer to a communications session performed according to any such protocol.

[0030] The user authentication device 118 is configured to determine whether the current computer user 112 is an identified computer user 108 based on a comparison of the computer input device action data 110 to the biometric data 120 associated with the identified computer user 108 during a communication session. In one embodiment, the biometric data 120 is configured based on the computer input device action data describing previous keyboard and pointing device usage by the identified computer user 108. Then, when the computer input device action data 110 associated with the current computer user 112 is received during a communication session initiated using, for example, a username and password associated with the identified computer user 108, the computer input device action data 110 is evaluated according to a biometric technique that compares the computer input device action data 110 to the biometric data 120 associated with the identified computer user 108 to determine whether the computer input device action data 110 matches the biometric data 120 according to predefined criteria, and therefore whether the current computer user 112 is in fact the identified computer user 108. Techniques for constructing biometric data 120 and performing such biometric authentication are described, for example, in Acien et al., "TypeNet: Deep Learning Keystroke Biometrics."

[0031] In one embodiment, the user authentication device 118 is integrated into the proxy gateway 100. In another embodiment, the user authentication device 118 is separate from the proxy gateway 100, and both the identity of the identified computer user 108 and the computer input device action data 110 are provided to the user authentication device 118, for example, via a computer network. In one embodiment, the user authentication device 118 performs the comparison between the computer input device action data 110 and the biometric data 120 associated with the identified computer user 108, and the user authentication device 118 is configured with the biometric data 120 associated with the identified computer user 108. In another embodiment, a biometric authentication server 122 performs this comparison, and the user authentication device 118 provides the identity of the identified computer user 108 and the computer input device action data 110, for example, via a computer network, to the biometric authentication server 122, which is configured with the biometric data 120 associated with the identified computer user 108 or is also provided with this information.

[0032] In one embodiment, the user authentication device 118 is configured to determine whether the current computer user 112 is an identified computer user 108 described above at different times during the communication session, for example, at random times or time intervals, at defined times or time intervals, upon receiving a defined amount or amount and type of new computer input device action data 110 (e.g., every time ten keyboard keystrokes are received), or any combination of these factors.

[0033] The security agent 124 is configured to perform one or more predefined security actions 126 (e.g., but not limited to, providing a notification to a system administrator, refraining from transferring any of the computer input device action data 110 to the computer 104, terminating the communication session, or requesting that the computer user submit or resubmit identification or other identifying information) if, during a communication session, it is determined that the current computer user 112 is other than an identified computer user 108.

[0034] The system of FIG. 1A and the method of FIG. 1B can be described in the context of the following exemplary scenario in which a computer user of computer 102 initiates an RDP-type communication session with computer 104 via proxy gateway 100 and provides a username and password to computer 104 in order to access computer 104 itself. Computer 104 checks the username and password and uses them to identify a particular computer user (referred to as identified computer user 108). However, it is unclear whether the computer user who provided the username and password (referred to as current computer user 112) is in fact the identified computer user 108 or an impostor. To address this, proxy gateway 100 receives keyboard keystroke actions and pointing device actions performed by current computer user 112 in the form of computer input device data 110 according to the RDP protocol, as well as a username, and provides this information to user authentication device 118. The user authentication device 118 provides the username and computer input device data 110 to the biometric authentication server 122, which then accesses the biometric data 120 associated with the identified computer user 108, compares the computer input device data 110 to the biometric data 120, and determines that the computer input device data 110 does not match the biometric data 120 according to predefined criteria, and therefore determines that the current computer user 112 is not in fact the identified computer user 108, but rather an impostor. The biometric authentication server 122 provides this information to the user authentication device 118, which then instructs a security agent 124 to take appropriate security action.

[0035] Reference is now made to Figures 2A and 2B. Figure 2A is a simplified conceptual diagram of a user productivity monitoring system constructed and operative in accordance with an embodiment of the present invention, and Figure 2B is a simplified flowchart of an exemplary method of operation of the system of Figure 2A operative in accordance with an embodiment of the present invention. The system of Figure 2A includes one or more elements of the system of Figure 1A , which elements are similarly configured unless otherwise noted. In the system of Figure 2A and the method of Figure 2B , a proxy gateway 100 is configured to facilitate an RDP-type communication session between a computer 102 and a computer 104 over a computer network 106, as previously described, the communication session being associated with an identified computer user 108. The proxy gateway 100 receives computer input device action data 110 from the computer 102, the computer input device action data 110 describing keyboard keystroke actions and / or pointing device actions, and including timing information associated with any of the actions.

[0036] The productivity data manager 200 is configured to record the timing information 202 in a data store 204, which may be any type of data storage device. The timing information 202 includes any of the timing information included in the computer input device action data 110, and the timing information 202 is preferably recorded after the current computer user 112 has been authenticated as an identified computer user 108, as described with reference to Figures 1A and 1B above. The timing information 202 is preferably stored with an identifier 206, such as an identifier associated with the identified computer user 108 and / or the communication session itself.

[0037] Timing information 202 preferably includes any type of timing information used in conventional user productivity monitoring techniques (e.g., but not limited to, timestamps indicating the time of execution of keyboard keystroke actions and / or pointing device actions). For example, productivity monitor 208 may query timing information 202 in accordance with conventional user productivity monitoring techniques to provide productivity information associated with such techniques.

[0038] In one embodiment, the productivity data manager 200 is integrated into the proxy gateway 100. In another embodiment, the productivity data manager 200 is separate from the proxy gateway 100 and receives the timing information 202 and the identifier 206 from the proxy gateway 100.

[0039] Reference is now made to Figures 3A and 3B. Figure 3A is a simplified conceptual diagram of a computer user input monitoring system constructed and operative in accordance with an embodiment of the present invention, and Figure 3B is a simplified flowchart of an exemplary method of operation of the system of Figure 3A operative in accordance with an embodiment of the present invention. The system of Figure 3A includes one or more elements of the system of Figure 1A , which elements are similarly configured unless otherwise noted. In the system of Figure 3A and the method of Figure 3B , the proxy gateway 100 is configured to facilitate an RDP-type communication session between the computer 102 and the computer 104 over the computer network 106, as previously described, and the communication session is associated with an identified computer user 108. The proxy gateway 100 receives computer input device action data 110 from the computer 102, which describes keyboard keystroke actions (the computer input device action data 110 may additionally describe pointing device actions and include timing information associated with any of the actions).

[0040] The text string monitor 300 is configured to derive delimited text strings, such as space-delimited text strings, from the keyboard keystrokes described by the computer input device action data 110 and determine whether the derived text string is found in a table 302 of predefined text strings associated with a particular user ID. If the derived text string is found in the table 302 but is not associated with an identified computer user 108 in the table 302, the security agent 124 performs one or more predefined security actions 126.

[0041] In one embodiment, the text string monitor 300 is integrated into the proxy gateway 100. In another embodiment, the text string monitor 300 is separate from the proxy gateway 100 and receives the computer input device action data 110 from the proxy gateway 100.

[0042] The system of Figure 3A and the method of Figure 3B can be described in the context of the following exemplary scenario in which a current computer user 112 of a computer 102 initiates an RDP type communication session with a computer 104 via a proxy gateway 100 and is authenticated as an identified computer user 108 with the username "Bob" as described above with reference to Figures 1A and 1B. The text string monitor 300 derives the text string "AD admin" from the computer input device action data 110 received by the proxy gateway 100 from the computer 102 during the RDP type communication session. The text string monitor 300 checks a table 302, the contents of which are shown in Figure 3C, which is a table of administrative usernames that may be used by privileged users to access restricted software applications. The text string monitor 300 determines that the derived text string "AD admin" is found in the table 302, but that it is not associated with "Bob" in the table 302, but is associated with another user with the username "Joe". The text string monitor 300 provides this information to the proxy gateway 100, which then instructs the security agent 124 to take the appropriate security action.

[0043] Reference is now made to Figure 4A and, in addition, to Figure 4B. Figure 4A is a simplified conceptual diagram of a data security system constructed and operative in accordance with an embodiment of the present invention, and Figure 4B is a simplified flow chart of an exemplary method of operation of the system of Figure 4A operative in accordance with an embodiment of the present invention. The system of Figure 4A includes one or more elements of the system of Figure 1A , which elements are similarly configured unless otherwise noted. In the system of Figure 4A and the method of Figure 4B , the proxy gateway 100 is configured to facilitate an RDP-type communication session between the computer 102 and the computer 104 over the computer network 106, as described above, and the communication session is associated with an identified computer user 108. Apart from computer input device action data 110 (Figure 1A ), which may be received by the proxy gateway 100 as described above, the proxy gateway 100 receives data 400 from the computer 102 or the computer 104 (for simplicity, Figure 4A shows the flow of data 400 in only one direction). Data 400 includes any type of data (e.g., but not limited to, text, images, data files copied to a clipboard application provided by any computer operating system), and may include all data transmitted according to an RDP-type protocol of a communications session.

[0044] The data security manager 402 is configured to create a modified version of the data 400 according to one or more predefined modification actions 404, where the modified version of the data 400 is referred to as modified data 406. In one embodiment, the modified data 406 is created by modifying the data 400 according to one or more predefined data loss prevention actions, such as according to any technique that masks, conceals, or omits personally identifiable information (PII) contained in the data 400. For example, if a computer user copies a credit card number to the clipboard, the data security manager 102 may replace the credit card number with xxxx-xxxx-xxxx-xxxx. In another embodiment, if the data 400 is a data file of a particular type to which a Content Disarm & Reconstruction (CDR) technique can be applied, such as a Microsoft Word® file, the data security manager 102 may apply the CDR technique to the data file by deconstructing the data file, data 400, and reconstructing the data file as modified data 406, in which all elements of the data file, data 400, that do not match predefined standards and policies for the file type are omitted from the data file, modified data 406. In another embodiment, if the data 400 is a data file of a particular data file format, such as a Microsoft Excel® data file in .XLSX format, the modified data 406 is created by converting the data 400 to another data file format, such as an Adobe Acrobat® data file in .PDF format, and optionally including a predefined watermark. Then, instead of transmitting the data 400, the proxy gateway 100 transmits the modified data 406 over the computer network 106 to either the computer 102 or 104, which was the original destination of the data 400 (for simplicity, FIG. 4A shows the flow of the modified data 406 in only one direction).

[0045] In one embodiment, the data security manager 402 is integrated into the proxy gateway 100. In another embodiment, the data security manager 402 is separate from the proxy gateway 100 and receives the data 400 from the proxy gateway 100. In another embodiment, the data security manager 402 provides the data 400 to a third party service 408, which creates modified data 406 as described above and provides the modified data 406 to the data security manager 402.

[0046] In conclusion, the invention, various embodiments of which have been described above, takes advantage of a proxy gateway where computers communicate in an RDP type communication session, and does not operate from a computer endpoint of the session that may be circumvented by the computer user. In relation to an enterprise that allows employees to connect to the corporate network from remote locations, the invention, in various embodiments, relates to verifying that an individual remotely accessing the corporate network to use corporate applications in association with a particular user ID is not only authorized for such access and use, but is in fact who they claim to be, and hopefully, remains who they claim to be while using such corporate resources. The invention, in various embodiments, further relates to monitoring the productivity of remote employees and ensuring the security of remotely accessed data.

[0047] Any aspect of the invention described herein may be implemented in computer hardware and / or computer software embodied in a non-transitory computer-readable medium in accordance with conventional techniques, where the computer hardware includes one or more computer processors, computer memory, I / O devices, and network interfaces that interoperate in accordance with conventional techniques.

[0048] It should be understood that as used herein, the term "processor" or "device" is intended to include any processing device, such as, for example, one that includes a CPU (Central Processing Unit) and / or other processing circuitry. It should also be understood that the term "processor" or "device" may refer to more than one processing device, and that various elements associated with a processing device may be shared by other processing devices.

[0049] As used herein, the term "memory" is intended to include memory associated with a processor or CPU, such as, for example, RAM, ROM, fixed memory devices (e.g., hard drives), removable memory devices (e.g., diskettes), flash memory, etc. Such memory may be considered a computer-readable storage medium.

[0050] Furthermore, as used herein, the phrase "input / output device" or "I / O device" is intended to include, for example, one or more input devices (e.g., a keyboard, a mouse, a scanner, etc.) for inputting data into a processing unit, and / or one or more output devices (e.g., a speaker, a display, a printer, etc.) for presenting results associated with a processing unit.

[0051] Embodiments of the invention may include systems, methods, and / or computer program products. The computer program product may include computer readable storage medium(s) having computer readable program instructions that cause a processor to perform aspects of the invention.

[0052] A computer-readable storage medium may be a tangible device capable of holding and storing instructions used by an instruction execution device. A computer-readable storage medium may be, for example, but not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of computer-readable storage media includes portable computer diskettes, hard disks, random access memories (RAMs), read-only memories (ROMs), erasable programmable read-only memories (EPROMs or flash memories), static random access memories (SRAMs), portable compact disk read-only memories (CD-ROMs), digital versatile disks (DVDs), memory sticks, floppy disks, mechanically encoded devices such as punch cards or ridge structures in grooves on which instructions are recorded, and any suitable combination of the foregoing. Computer-readable storage media, as used herein, should not be construed as being, per se, a transitory signal, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., light pulses passing through a fiber optic cable), or an electrical signal transmitted over an electrical wire.

[0053] The computer-readable program instructions described herein may be downloaded from a computer-readable storage medium into each computing / processing device, or may be downloaded to an external computer or external storage device over a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network may include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in a computer-readable storage medium in the respective computing / processing device.

[0054] The computer readable program instructions for carrying out the operations of the present invention may be source or object code written in any combination of one or more programming languages, including assembler instructions, instruction set architecture (ISA) instructions, machine instructions, machine dependent instructions, microcode, firmware instructions, state setting data, or object oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as the "C" programming language or similar programming languages. The computer readable program instructions may be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection may be made to an external computer (e.g., via the Internet using an Internet Service Provider). In some embodiments, to carry out aspects of the invention, electronic circuitry including, for example, a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), may execute computer readable program instructions utilizing state information of the computer readable program instructions to customize the electronic circuitry.

[0055] Aspects of the present invention are described herein with reference to flowcharts and / or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the invention. It will be understood that each block of the flowcharts and / or block diagrams, and combinations of blocks in the flowcharts and / or block diagrams, can be implemented by computer readable program instructions.

[0056] These computer readable program instructions may be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to manufacture a machine, such that the instructions executed by the processor of the computer or other programmable data processing apparatus create means for performing the functions / acts specified in the blocks or combinations of blocks in the flowcharts and / or block diagrams. These computer readable program instructions may be stored in a computer readable storage medium that can direct a computer, programmable data processing apparatus, and / or other device to function in a particular manner, such that the computer readable storage medium having instructions stored thereon comprises an article of manufacture including instructions for performing aspects of the functions / acts specified in the blocks or combinations of blocks in the flowcharts and / or block diagrams.

[0057] The computer readable program instructions may be loaded into a computer, other programmable apparatus, or other device to cause the computer, other programmable data processing apparatus, or other device to perform a series of operational steps to generate a computer-implemented process, such that the instructions operating on the computer, other programmable apparatus, or other device perform the functions / acts identified in the blocks or combinations of blocks in the flowcharts and / or block diagrams.

[0058] The flowcharts and block diagrams in the drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in the flowcharts or block diagrams may represent a module, segment, or portion of computer instructions that includes one or more executable computer instructions for implementing the specified logical function. In some alternative implementations, the functions shown in the blocks may be performed out of the order shown in the drawings. For example, depending on the functionality involved, two blocks shown in succession may in fact be executed substantially simultaneously, or the blocks may be executed in reverse order in some cases. It should also be noted that each block in the flowcharts and block diagrams, as well as combinations of these blocks, may be implemented by a dedicated hardware-based system and / or a dedicated software-based system that performs the specified functions or acts.

[0059] The description of various embodiments of the present invention has been presented for purposes of illustration and is not intended to be exhaustive or limited to the disclosed embodiments. Many modifications and variations that do not depart from the scope and spirit of the described embodiments will be apparent to those skilled in the art.

Claims

1. receiving computer input device action data at a proxy gateway describing computer input device actions including either keyboard keystroke actions or pointing device actions and including timing information associated with either of the actions, the computer input device actions corresponding to physical computer input device actions performed by a current computer user using either a keyboard or a pointing device connected to a first computer while interacting with a second computer over a computer network during a communication session, the communication session being associated with an identified computer user and being performed according to a protocol in which the computer input device action data is transmitted by the first computer through the proxy gateway to the second computer and rendered at the second computer as the computer input device actions; determining whether the current computer user is the identified computer user based on a comparison of the computer input device action data received at the proxy gateway during the communication session with biometric data associated with the identified computer user; performing a predefined security action if, during the communication session, the current computer user is determined to be other than the identified computer user; 16. A method for authenticating a computer user comprising:

2. The method of claim 1 , wherein the predefined security action includes providing a notification to a system administrator.

3. The method of claim 1 , wherein the predefined security action includes refraining from transferring any of the computer input device action data to the second computer.

4. The method of claim 1 , wherein the defined security action includes terminating the communication session.

5. The method of claim 1 , wherein the predefined security action includes requiring the current computer user to submit or resubmit identification or other identifying information.

6. The method of claim 1 , wherein the determining is performed at multiple points during the communication session.

7. 2. The method of claim 1, wherein the determination is made at a plurality of points in time, either at random points in time, at random time intervals, at predefined points in time, at predefined time intervals, when a predefined amount of new computer input device action data is received, and when a predefined amount and type of new computer input device action data is received.

8. a proxy gateway configured to receive computer input device action data describing computer input device actions, including either keyboard keystroke actions or pointing device actions, and including timing information associated with either of the actions, wherein the computer input device actions correspond to physical computer input device actions performed by a current computer user using either a keyboard or a pointing device connected to a first computer while interacting with a second computer over a computer network during a communication session, the communication session being associated with an identified computer user and being performed according to a protocol in which the computer input device action data is sent by the first computer through the proxy gateway to the second computer and rendered as the computer input device actions at the second computer; a user authentication device configured to determine whether the current computer user is the identified computer user based on a comparison of the computer input device action data received at the proxy gateway during the communication session with biometric data associated with the identified computer user; a security agent configured to perform a predefined security action if, during the communication session, the current computer user is determined to be other than the identified computer user; A computer user authentication system comprising:

9. The system of claim 8 , wherein the predefined security action includes providing a notification to a system administrator.

10. The system of claim 8 , wherein the predefined security action includes refraining from transferring any of the computer input device action data to the second computer.

11. The system of claim 8 , wherein the defined security action includes terminating the communication session.

12. 9. The system of claim 8, wherein the user authentication device is configured to determine whether the current computer user is the identified computer user at multiple points during the communication session.

13. The system of claim 12, wherein the determination is made at a plurality of points in time, either at random points in time, at random time intervals, at predefined points in time, at predefined time intervals, when a predefined amount of new computer input device action data is received, and when a predefined amount and type of new computer input device action data is received.

14. receiving computer input device action data at a proxy gateway describing computer input device actions, including either keyboard keystroke actions or pointing device actions, and including timing information associated with either of the actions, the computer input device actions corresponding to physical computer input device actions performed by a computer user using either a keyboard or a pointing device connected to a first computer while interacting with a second computer over a computer network during a communication session, the communication session being associated with the computer user and being performed according to a protocol in which the computer input device action data is transmitted by the first computer through the proxy gateway to the second computer and rendered at the second computer as the computer input device actions; recording said timing information in a data storage device; 13. A method for monitoring user productivity, comprising:

15. The method of claim 1 , further comprising the step of recording the timing information in association with an identifier associated with the computer user.

16. The method of claim 1 , further comprising the step of recording the timing information in association with an identifier associated with the communication session.

17. a proxy gateway configured to receive computer input device action data describing computer input device actions, including either keyboard keystroke actions or pointing device actions, and including timing information associated with either of the actions, the computer input device actions corresponding to physical computer input device actions performed by a computer user using either a keyboard or a pointing device connected to a first computer while interacting with a second computer over a computer network during a communication session, the communication session being associated with the computer user and performed according to a protocol in which the computer input device action data is sent by the first computer through the proxy gateway to the second computer and rendered as the computer input device actions at the second computer; a productivity data manager configured to record the timing information in a data storage device; A user productivity monitoring system, including:

18. The system of claim 1 , wherein the productivity data manager is configured to record the timing information in association with an identifier associated with the computer user.

19. The system of claim 1 , wherein the productivity data manager is configured to record the timing information in association with an identifier associated with the communication session.

20. receiving computer input device action data at a proxy gateway describing computer input device actions including keyboard keystroke actions, the computer input device actions corresponding to physical computer input device actions performed by a computer user using a keyboard connected to a first computer while interacting with a second computer over a computer network during a communication session, the communication session being associated with the computer user and performed according to a protocol in which the computer input device action data is transmitted by the first computer through the proxy gateway to the second computer and rendered at the second computer as the computer input device actions; determining whether a delimited text string derived from the computer input device action data is within a table of predefined text strings and whether the derived text string is associated with the computer user; performing a predefined security action during the communication session if the derived text string is not associated with the computer user; 13. A method for monitoring computer user input comprising:

21. 21. The method of claim 20, further comprising deriving the delimited text string from the computer input device action data.

22. 21. The method of claim 20, wherein the predefined security action includes providing a notification to a system administrator.

23. 21. The method of claim 20, wherein the predefined security action includes refraining from transferring any of the computer input device action data to the second computer.

24. The method of claim 20 , wherein the defined security action includes terminating the communication session.

25. 21. The method of claim 20, wherein the predefined security action includes requiring a current computer user to submit or resubmit identification or other identifying information.

26. a proxy gateway configured to receive computer input device action data describing computer input device actions including keyboard keystroke actions, the computer input device actions corresponding to physical computer input device actions performed by a computer user using a keyboard connected to a first computer while interacting with a second computer over a computer network during a communication session, the communication session being associated with the computer user and performed according to a protocol in which the computer input device action data is sent by the first computer through the proxy gateway to the second computer and rendered as the computer input device actions at the second computer; a text string monitor configured to determine whether a delimited text string derived from the computer input device action data is within a table of predefined text strings and whether the derived text string is associated with the computer user; a security agent configured to perform a predefined security action during the communication session if the derived text string is not associated with the computer user; 1. A computer user input monitoring system comprising:

27. 27. The system of claim 26, wherein the text string monitor is configured to derive the delimited text strings from the computer input device action data.

28. 27. The system of claim 26, wherein the predefined security action includes providing a notification to a system administrator.

29. 27. The system of claim 26, wherein the defined security action includes refraining from transferring any of the computer input device action data to the second computer.

30. 27. The system of claim 26, wherein the defined security action includes terminating the communication session.

31. 27. The system of claim 26, wherein the predefined security action includes requiring a current computer user to submit or resubmit identification or other identifying information.

32. receiving, at the proxy gateway, target data transmitted between the first computer and the second computer via the proxy gateway over a computer network, the target data is received during a communication session associated with a computer user and executed according to a protocol in which computer input device action data is transmitted by the first computer over the computer network via the proxy gateway to the second computer and rendered at the second computer as computer input device actions; the computer input device action data describes the computer input device actions, including any of keyboard keystroke actions and pointing device actions, and includes timing information associated with any of the actions; the computer input device actions correspond to physical computer input device actions performed by the computer user using a keyboard connected to the first computer while interacting with the second computer over the computer network during the communications session; creating a modified version of the target data according to a defined modification action; transmitting the modified version of the target data to one of the computers over the computer network; A data security method, comprising:

33. The method of claim 32 , wherein the target data is received as clipboard-based data.

34. 33. The method of claim 32, wherein the creating includes modifying the target data according to a predefined data loss prevention action.

35. 33. The method of claim 32, wherein the creating comprises omitting a portion of the target data from the modified version of the target data.

36. 33. The method of claim 32, wherein the target data is a data file having a first data file format, and the creating comprises converting the target data to a data file having a second data file format.

37. 33. The method of claim 32, wherein the target data is a data file of a file type to which predefined content sanitization and reconstruction techniques can be applied, and wherein the creating includes disassembling the target data file and reconstructing the target data file as the modified version of the target data, wherein all elements of the target data file that do not conform to predefined standards and policies for the file type of the target data file are omitted from the reconstructed data file.

38. a proxy gateway configured to receive target data transmitted between a first computer and a second computer via the proxy gateway over a computer network, the target data is received during a communication session associated with a computer user and executed according to a protocol in which computer input device action data is transmitted by the first computer over the computer network via the proxy gateway to the second computer and rendered at the second computer as computer input device actions; the computer input device action data describes the computer input device actions, including any of keyboard keystroke actions and pointing device actions, and includes timing information associated with any of the actions; a proxy gateway corresponding to physical computer input device actions performed by the computer user using a keyboard connected to the first computer while interacting with the second computer over the computer network during the communication session; a data security manager configured to create a modified version of the target data according to a defined modification action; wherein the proxy server is further configured to transmit the modified version of the target data to any of the computers over the computer network.

39. 40. The system of claim 38, wherein the target data is received as clipboard-based data.

40. 40. The system of claim 38, wherein the data security manager is configured to modify the target data according to a predefined data loss prevention action.

41. 40. The system of claim 38, wherein the data security manager is configured to omit portions of the target data from the modified version of the target data.

42. 40. The system of claim 38, wherein the target data is a data file having a first data file format, and the data security manager is configured to convert the target data to a data file having a second data file format.

43. 39. The system of claim 38, wherein the target data is a data file of a file type to which predefined content sanitization and reconstruction techniques can be applied, and the data security manager is configured to deconstruct the target data file and reconstruct the target data file as the modified version of the target data, where all elements of the target data file that do not conform to predefined standards and policies for the file type of the target data file are omitted from the reconstructed data file.

Images