Method and apparatus for deterrence and detection of leakage during remote interactive sessions

Patent metadata

Field	Value
Publication number	US-10504201-B2
Application number	US-201715825561-A
Country	US
Kind code	B2
Filing date	Nov 29, 2017
Priority date	Nov 29, 2017
Publication date	Dec 10, 2019
Grant date	Dec 10, 2019

Abstract

A server includes a hardware platform, a hypervisor platform, and a virtual machine operating as an independent guest computing device. The virtual machine executes a remote graphics generation protocol to generate a bitmap to be transmitted for display on a client machine associated with the virtual machine, determine a protection label to be inserted within the bitmap, and determine an optimization technique to be performed on the bitmap. The remote graphics generation protocol also determines if the optimization technique, if performed, alters the protection label. If yes, then the protection label is inserted within the bitmap without performing the optimization technique. If no, then the optimization technique is performed and the protection label is inserted within the bitmap.

First claim

That which is claimed:

1. A server comprising:
a hardware platform comprising hardware resources with at least a portion of said hardware resources to be allocated as virtualized resources;
a hypervisor platform being provided based on execution of code instructions by said hardware platform;
at least one virtual machine operating as an independent guest computing device, with at least a portion of the virtualized resources being allocated by said hypervisor platform to said at least one virtual machine; and
said at least one virtual machine configured to execute a remote graphics generation protocol via said virtualized resources to perform the following:
generate a bitmap to be transmitted for display on a client machine associated with the at least one virtual machine,
determine at least one protection label to be inserted within the bitmap,
determine at least one optimization technique to be performed on the bitmap, and
determine if the at least one optimization technique, if performed, alters the at least one protection label inserted into the bitmap, and perform the following based on the determination:
if yes, then insert the at least one protection label within the bitmap without performing the at least one optimization technique, and
if no, then perform the at least one optimization technique and insert the at least one protection label within the bitmap.

2. The server according to claim 1 wherein inserting the at least one protection label comprises inserting a covert protection label that is not visible when the bitmap is displayed on the client machine.

3. The server according to claim 2 wherein inserting the covert protection label comprises embedding the covert protection label within the bitmap.

4. The server according to claim 2 wherein the covert protection label comprises at least one of a bit color change in the bitmap, changing position of where the bitmap is to be displayed on the client machine, and adding a unique mark to the bitmap.

5. The server according to claim 1 wherein inserting the at least one protection label comprises inserting a visual protection label that is visible when the bitmap is displayed on the client machine.

6. The server according to claim 1 wherein if the determined optimization technique comprises a lossy compression of the bitmap, then the at least one protection label is inserted within the bitmap without performing the lossy compression of the bitmap.

7. The server according to claim 1 wherein if the determined optimization technique comprises changing color bits in the bitmap, then the at least one protection label is inserted within the bitmap after the color bit change has been performed.

8. The server according to claim 1 wherein the generated bitmap comprises segmented portions, with the at least one protection label to be divided among the segmented portions, and with each segmented portion having an optimization technique associated therewith so that determining if the at least one optimization technique, if performed, alters the at least one protection label, comprises determining if the optimization technique for each segmented portion, if performed, alters the divided protection label.

9. A method for executing a remote graphics generation protocol for at least one virtual machine in a virtualization server comprising:
generating a bitmap to be transmitted for display on a client machine associated with the at least one virtual machine;
determining at least one protection label to be inserted within the bitmap;
determining at least one optimization technique to be performed on the bitmap; and
determining if the at least one optimization technique, if performed, alters the at least one protection label inserted into the bitmap, and perform the following based on the determining:
if yes, then inserting the at least one protection label within the bitmap without performing the at least one optimization technique, and
if no, then performing the at least one optimization technique and inserting the at least one protection label within the bitmap.

10. The method according to claim 9 wherein inserting the at least one protection label comprises inserting a covert protection label that is embedded within the bitmap so as to not be visible when the bitmap is displayed on the client machine.

11. The method according to claim 9 wherein the covert protection label comprises at least one of a bit color change in the bitmap, changing position of where the bitmap is to be displayed on the client machine, and adding a unique mark to the bitmap.

12. The method according to claim 9 wherein inserting the at least one protection label comprises inserting a visual protection label that is visible when the bitmap is displayed on the client machine.

13. The method according to claim 9 wherein if the determined optimization technique comprises a lossy compression of the bitmap, then the at least one protection label is inserted within the bitmap without performing the lossy compression of the bitmap.

14. The method according to claim 9 wherein if the determined optimization technique comprises changing color bits in the bitmap, then the at least one protection label is inserted within the bitmap after the color bit change has been performed.

15. A non-transitory computer readable medium for at least one virtual machine in a virtualization server, with the non-transitory computer readable medium having a plurality of computer executable instructions for causing the at least one virtual machine to execute a remote graphics generation protocol to perform steps comprising:
generating a bitmap to be transmitted for display on a client machine associated with the at least one virtual machine;
determining at least one protection label to be inserted within the bitmap;
determining at least one optimization technique to be performed on the bitmap; and
determining if the at least one optimization technique, if performed, alters the at least one protection label inserted into the bitmap, and perform the following based on the determining:
if yes, then inserting the at least one protection label within the bitmap without performing the at least one optimization technique, and
if no, then performing the at least one optimization technique and inserting the at least one protection label within the bitmap.

16. The non-transitory computer readable medium according to claim 15 wherein inserting the at least one protection label comprises inserting a covert protection label that is embedded within the bitmap so as to not be visible when the bitmap is displayed on the client machine.

17. The non-transitory computer readable medium according to claim 16 wherein the covert protection label comprises at least one of a bit color change in the bitmap, changing position of where the bitmap is to be displayed on the client machine, and adding a unique mark to the bitmap.

18. The non-transitory computer readable medium according to claim 15 wherein inserting the at least one protection label comprises inserting a visual protection label that is visible when the bitmap is displayed on the client machine.

19. The non-transitory computer readable medium according to claim 15 wherein if the determined optimization technique comprises a lossy compression of the bitmap, then the at least one protection label is inserted within the bitmap without performing the lossy compression of the bitmap.

20. The non-transitory computer readable medium according to claim 15 wherein if t

Assignees

• Citrix Systems Inc

Inventors

• Mayers Chris

Classifications

• G06F9/452

  Remote windowing, e.g. X-Window System, desktop virtualisation (protocols for virtual reality H04L67/131) · CPC title

• H04L67/08

  specially adapted for terminal emulation, e.g. Telnet · CPC title

• G06F21/00

  Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity · CPC title

• H04L63/0428

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title

• G06F21/6209

  to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself · CPC title