Auditing clipboard operations in virtual desktop environments

Patent metadata

Field	Value
Publication number	US-11099865-B2
Application number	US-201916271587-A
Country	US
Kind code	B2
Filing date	Feb 8, 2019
Priority date	Jan 2, 2019
Publication date	Aug 24, 2021
Grant date	Aug 24, 2021

Abstract

Techniques are described for auditing clipboard operations in virtual desktop environments. The auditing takes place by detecting clipboard operations that are being redirected between the virtual desktop and the client device and recording log entries containing information about each clipboard operation that was redirected. In order to reduce auditing potential noise information, the redirection process is modified to delay populating the clipboard and recording log entries until a paste operation or other request for the clipboard is detected. In some situations, the clipboard redirection may be blocked based on the auditing capability, such as in cases where the auditing cannot take place due to the client computing device lacking support for auditing the clipboard operation and recording the necessary log entry.

First claim

What is claimed is:

1. A method for auditing clipboard operations in a virtual desktop environment, the method comprising:
establishing, over a network connection, a virtual desktop session between a virtual desktop client operating on a client computing device and a virtual desktop agent operating on a host server;
detecting, by the virtual desktop agent, a cut/copy operation that places data into a clipboard of a guest operating system (OS) on the host server;
in response to detecting the cut/copy operation, transmitting the data placed into the clipboard of the guest OS from the virtual desktop agent to the virtual desktop client over the network connection;
receiving the data by the virtual desktop client, wherein the virtual desktop client sets a clipboard delay rendering option on the clipboard of an operating system of the client computing device in response to receiving the data from the virtual desktop agent;
detecting, by the virtual desktop client, a paste operation that requests the data from a clipboard in an operating system on the client computing device; and
in response to detecting the paste operation, populating the data received from the virtual desktop agent into the clipboard of the operating system of the client computing device by the virtual desktop client and recording a log entry describing the copy and paste operation into an event log, wherein the clipboard delay rendering option delays recording the log entry and populating the data received from the virtual desktop agent into the clipboard of the operating system on the client computing device until the paste operation is detected, wherein the log entry is recorded only if the paste operation is detected on the client device that transfers the data outside of the virtual desktop session, and wherein the log entry is not recorded if the data is pasted inside the virtual desktop session.

2. The method of claim 1 , further comprising:
detecting, by the virtual desktop client, a second cut/copy operation that places data into the clipboard of the operating system of the client computing device;
in response to detecting the second cut/copy operation, transmitting the data placed into the clipboard of the operating system of the client computing device from the virtual desktop client to the virtual desktop agent over the network connection;
detecting, by the virtual desktop agent, a second paste operation that requests data from the clipboard of the guest OS on the host server; and
in response to detecting the second paste operation, populating the data received from the virtual desktop client into the clipboard of the guest OS on the host server by the virtual desktop agent and recording a second log entry into the event log, the second log entry describing the second copy and paste operation.

3. The method of claim 2 , wherein the virtual desktop agent uses clipboard delay rendering in order to delay populating the data received from the virtual desktop client into the clipboard of the guest OS on the host server until the second paste operation is received.

4. The method of claim 1 , wherein transmitting the data placed into the clipboard of the guest OS from the virtual desktop agent to the virtual desktop client over the network connection further comprises:
determining whether the virtual desktop client supports auditing clipboard operations prior to transmitting the data to the virtual desktop client; and
if the virtual desktop client does not support auditing clipboard operations, blocking the transmission of the data to the virtual desktop client, otherwise if the virtual desktop client supports auditing clipboard operations, transmitting the data to the virtual desktop client.

5. The method of claim 1 , wherein recording a log entry describing the copy and paste operation into an event log further comprises:
determining whether the cut/copy operation and the paste operation originate from applications hosted in the same server farm; and
recording the log entry in the event log only if the cut/copy operation and the paste operation do not originate from applications hosted in the same server farm.

6. The method of claim 1 , wherein the log entry indicates:
an amount of the data received from the virtual desktop agent and populated into the clipboard of the operating system of the client computing device;
a format of the data;
user identifier (ID) and/or domain of a user that initiated the copy and paste operation;
internet protocol (IP) address of the client computing device; and
a process identifier (ID) of an application that requested the paste operation from the operating system on the client computing device.

7. A computing device, comprising:
at least one processor; and
memory including instructions that, when executed by the at least one processor, cause the computing device to perform the steps of:
establishing, over a network connection, a virtual desktop session between a virtual desktop client operating on a client computing device and a virtual desktop agent operating on a host server;
detecting, by the virtual desktop agent, a cut/copy operation that places data into a clipboard of a guest operating system (OS) on the host server;
in response to detecting the cut/copy operation, transmitting the data placed into the clipboard of the guest OS from the virtual desktop agent to the virtual desktop client over the network connection;
receiving the data by the virtual desktop client, wherein the virtual desktop client sets a clipboard delay rendering option on the clipboard of an operating system of the client computing device in response to receiving the data from the virtual desktop agent;
detecting, by the virtual desktop client, a paste operation that requests the data from a clipboard in an operating system on the client computing device; and
in response to detecting the paste operation, populating the data received from the virtual desktop agent into the clipboard of the operating system of the client computing device by the virtual desktop client and recording a log entry describing the copy and paste operation into an event log, wherein the clipboard delay rendering option delays recording the log entry and populating the data received from the virtual desktop agent into the clipboard of the operating system on the client computing device until the paste operation is detected wherein the log entry is recorded only if the paste operation is detected on the client device that transfers the data outside of the virtual desktop session, and wherein the log entry is not recorded if the data is pasted inside the virtual desktop session.

8. The computing device of claim 7 , wherein the memory further comprises instructions that, when executed by the at least one processor, cause the computing device to perform the steps of:
detecting, by the virtual desktop client, a second cut/copy operation that places data into the clipboard of the operating system of the client computing device;
in response to detecting the second cut/copy operation, transmitting the data placed into the clipboard of the operating system of the client computing device from the virtual desktop client to the virtual desktop agent over the network connection;
detecting, by the virtual desktop agent, a second paste operation that requests data from the clipboard of the guest OS on the host server; and
in response to detecting the second paste operation, populating the data received from the virtual desktop client into the clipboard of the guest OS on the host server by the virtual desktop agent and recording a second log entry into the event log, the second log entry describing the second copy and paste operation.

9. The computing device of clai

Assignees

• Vmware Inc

Inventors

• Ma Yuan
• Lin Zhi
• Hu Jinxing
• Wang Baochen
• Yu Yang

Classifications

• G06F9/452 Primary

  Remote windowing, e.g. X-Window System, desktop virtualisation (protocols for virtual reality H04L67/131) · CPC title

• G06F9/451

  Execution arrangements for user interfaces · CPC title

• G06F9/543

  User-generated data transfer, e.g. clipboards, dynamic data exchange [DDE], object linking and embedding [OLE] · CPC title