JP2009048570A - Client terminal monitoring system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a client terminal monitoring system capable of performing monitoring, while protecting the privacy of an operation in the client terminal when monitoring the operation of the client terminal. <P>SOLUTION: The client terminal monitoring system includes: a screen information receiving part for receiving screen information being displayed in the display device 22 of each client terminal from each client terminal; an operation log information receiving part for receiving operation log information of each client terminal from each client terminal; a specified operation storage part for storing at least a predetermined specific operation; an operation determining part for determining whether or not an operation content in the received operation log information is the specific operation; a display change processing part for performing display change processing with respect to the partial or whole area of the received screen information by using the determination result; and a screen information display part for displaying the screen information subjected to display change processing by the prescribed display device 22. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

The present invention relates to a client terminal monitoring system capable of monitoring a client terminal while protecting the privacy of the operator of the client terminal when monitoring the operation on the client terminal.

  In recent years, information leakage of confidential information has become a problem in companies and the like. For this reason, problems such as information leakage occur due to operation management at the computer terminal used during work, that is, recording and managing what work is being done at which computer terminal. I try not to. Patent Documents 1 to 3 listed below disclose inventions related to such a remote monitoring system.

JP 2005-44226 A JP 2006-108947 A JP 2004-280169 A

  According to the above-described conventional technology, remote monitoring can be performed by receiving screen information displayed on the display device of each client terminal to be monitored by the server. As a result, an administrator who performs remote monitoring can monitor the screen displayed on each client terminal, so that the monitoring can be performed. However, on the other hand, the details of work performed by the operator and the electronic information transmitted by the operator are displayed. The contents of the email are visible to the administrator.

  For this reason, the operator of the client terminal is extremely uncomfortable that the privacy is infringed by the administrator, and the administrator wants the administrator to not see the information displayed on the screen of the client terminal. Strong demand. However, if such an operator's request is taken in, there is a problem that the administrator cannot monitor each client terminal and cannot prevent leakage of confidential information.

  In other words, it is necessary to solve the conflicting problems such as when the administrator's request is incorporated, the operator's discomfort and dissatisfaction are solicited, and when the operator's request is incorporated, there is a concern that sufficient monitoring cannot be performed. I must. Therefore, since the risk of information leakage, etc., is very high for companies at present, the demands of the administrator side are generally emphasized over the privacy of employees who are operators, and the screen on each client terminal Information is sequentially recorded and displayed, and the solution is made by not considering the demands of the operator.

  In view of the above problems, the inventor of the present invention invented a client terminal monitoring system that fulfills the needs of both the administrator side and the operator side.

  The invention of claim 1 is a client terminal monitoring system that performs operation management of each client terminal using screen information displayed on a display device of each client terminal, wherein the client terminal monitoring system includes A screen information receiving unit that receives screen information displayed on the display device of the client terminal from each client terminal, and an operation log information receiving unit that receives the operation log information of each client terminal from each client terminal; A specific operation storage unit that stores at least the specific operation, an operation determination unit that determines whether the operation content in the received operation log information is the specific operation, and using the determination result, A display change processing unit that performs display change processing on a part or all of the area, and performs the display change processing. The screen information, which is a client terminal monitoring system having a screen information display unit for displaying a predetermined display device.

  By configuring as in the present invention, display change processing for screen information received from the client terminal is controlled depending on whether or not a predetermined specific operation (for example, an operation that leads to fraud) is performed on the client terminal. Can do. Thus, for example, the display change process is not performed when a specific operation is performed, and the display change process is performed when a specific operation is performed.

  In the invention of claim 2, the display change processing unit does not perform display change processing on the received screen information when the determination result is a specific operation, and when the determination result is not a specific operation, This is a client terminal monitoring system that performs display change processing for all areas of received screen information.

  As described above, the display change process for the screen information is controlled depending on the presence / absence of the specific operation. However, since it is usually considered safe if the specific operation is not performed as in the present invention, the privacy of the operator of the client terminal is considered. In order to protect the display, the display change process is performed. In the case of a specific operation, there is a danger, so that the display change process is not performed for monitoring. As a result, both monitoring by the administrator and protection of the privacy of the operator can be achieved.

  The invention of claim 3 is a client terminal monitoring system that performs operation management of each client terminal using screen information displayed on a display device of each client terminal, wherein the client terminal monitoring system A screen information receiving unit that receives screen information displayed on the display device of the client terminal from each client terminal, and an operation log information receiving unit that receives the operation log information of each client terminal from each client terminal; A specific operation storage unit for storing at least a specific operation and an operation point for the specific operation, and operation log information within a predetermined time, and determining whether the operation content in each operation log information is the specific operation, In this case, a cumulative value of the operation point is calculated, and the cumulative value satisfies a predetermined condition. An operation determining unit that determines whether the display information is displayed, a display change processing unit that performs a display change process on a part or all of the received screen information using the determination result, and the display change process. A client terminal monitoring system having a screen information display unit that displays screen information on a predetermined display device.

  Similarly to the first aspect of the invention, the screen information received from the client terminal depending on whether or not a predetermined operation (for example, an operation that leads to an unauthorized operation) is performed in advance in the client terminal by being configured as in the present invention. The display change process can be controlled. Thus, for example, the display change process is not performed when a specific operation is performed, and the display change process is performed when a specific operation is performed.

  In the present invention, since it is determined whether the operation performed at the client terminal is dangerous based on the operation log information received within a predetermined time, the monitoring burden on the administrator can be reduced.

  In the invention of claim 4, the display change processing unit does not perform display change processing on the received screen information when the determination result satisfies a predetermined condition, and the determination result satisfies a predetermined condition. If not, the client terminal monitoring system performs display change processing on the entire area of the received screen information.

  The invention of claim 2 can also be configured as in the present invention.

  6. The client terminal monitoring system according to claim 5, wherein the client terminal monitoring system further performs a character recognition process on the screen information according to a determination result as to whether the operation is the specific operation, whereby characters included in the screen information. A screen information analysis unit for extracting information, a specific information storage unit for storing at least predetermined specific information, and character information that matches the specific information stored in the specific information storage unit for the extracted character information A specific information determination unit that determines whether or not there is, and when the display change processing unit determines that there is character information that matches the specific information, it matches the specific information in the screen information This is a client terminal monitoring system that performs a display change process on a part or all of character information areas other than character information.

  What matters most when protecting privacy by the operator is what kind of text is being input. For example, as an operator, there is a very strong feeling that an administrator can see a mail text input to an e-mail. Therefore, if at least the character information can be displayed and changed, much of the privacy protection for the operator can be solved. Further, since the administrator can confirm other than character information, for example, a window icon, it is possible to confirm what application software the operator is using. Therefore, for example, when the operator uses highly dangerous software such as file exchange software, it can be discovered while protecting the privacy of the operator.

  In the invention of claim 6, the client terminal monitoring system further performs a character recognition process on the screen information in accordance with a determination result as to whether the specific operation is performed, whereby characters included in the screen information. A screen information analysis unit for extracting information, a specific information storage unit for storing at least predetermined specific information and a point corresponding to the specific information, and the extracted character information stored in the specific information storage unit It is determined whether there is character information that matches the specific information that is being matched, a comparison point is calculated by using the point of the specific information corresponding to the matched character information, and the comparison point is compared with a predetermined point The display change processing unit satisfies a predetermined condition with respect to a point where the comparison point is determined in advance. If the the region of some or all of the character information other than the character information matching the identification information in the screen information and performs the display change processing, a client terminal monitoring system.

  The same technical effects as those of the invention of the fifth aspect can be obtained even if configured as in the present invention. Since the comparison point associated with the specific information is further used by using the present invention, the display change process can be subdivided.

  In the invention of claim 7, the client terminal monitoring system further performs character recognition processing on the screen information in accordance with a determination result as to whether the specific operation is performed, whereby characters included in the screen information A screen information analysis unit for extracting information, a predetermined specific information, a specific information storage unit for storing at least information in a range in which display change processing is not performed on the specific information, and the extracted character information, A specific information determination unit that determines whether or not there is character information that matches the specific information stored in the specific information storage unit, and the display change processing unit includes the character information that matches the specific information. If it is determined that there is a part or all of the character information in the screen information outside the predetermined range corresponding to the specific information of the character information that matches the specific information. Performs display change processing, a client terminal monitoring system.

  Instead of simply performing display change processing on character information other than character information that matches the specific information, a range in which display change processing is not performed may be changed according to the specific information. For example, the range that does not perform display change processing for dangerous terms is widened, and the term that does not perform display change processing for specific terms that are set as specific information but is not dangerous is narrowed. Monitoring can be performed.

  9. The client terminal monitoring system according to claim 8, wherein the client terminal monitoring system further performs character recognition processing on the screen information in accordance with a determination result as to whether the specific operation is performed, whereby characters included in the screen information. A screen information analysis unit for extracting information, a specific information storage unit for storing at least predetermined information, points corresponding to the specific information, and information on a range in which display change processing is not performed for the specific information or points And comparing the extracted character information by determining whether there is character information that matches the specific information stored in the specific information storage unit and using the point of the specific information corresponding to the matched character information And a specific information determination unit that compares the comparison point with a predetermined point, and the display change processing unit includes: When the comparison point satisfies a predetermined condition with respect to a predetermined point, in the screen information, part or all of the character information that matches the specific information outside the predetermined range corresponding to the specific information This is a client terminal monitoring system that performs a display change process on a character information area.

  Even if it comprises like this invention, the technical effect similar to invention of Claim 7 can be acquired. Since the comparison point associated with the specific information is further used by using the present invention, the display change process can be subdivided.

  In the invention of claim 9, the display change processing unit performs display change processing on a part or all of the screen information corresponding to the received operation log information other than the window area for the operation log information. It is a client terminal monitoring system.

  What the administrator wants to monitor is what operation the operator is currently performing. In other words, it is preferable to be able to confirm the contents of the window that is the target of the operation, and the importance of the other windows is not high. The window operated by the operator is a window corresponding to the operation log information. Therefore, display change processing is not performed for windows corresponding to operation log information in the screen information, and display change processing is performed for other areas, thereby achieving both monitoring by the administrator and protection of operator privacy. Can do.

  11. The display change processing unit according to claim 10, wherein the display change processing unit detects a region of an active window in screen information corresponding to the received operation log information, so that a part or all of the region other than the region of the active window is detected. It is a client terminal monitoring system that performs display change processing for.

  Similarly to the above-described invention, if it is an active window, it is the window that the operator is currently operating. Therefore, by detecting the area of the active window from the screen information, the display change process is not performed for the active window, and the display change process is performed for the other areas, thereby monitoring by the administrator and protecting the privacy of the operator. Can be achieved.

  In the invention of claim 11, the client terminal monitoring system further performs character recognition processing on the screen information in accordance with a determination result as to whether the specific operation is performed, whereby characters included in the screen information. A screen information analysis unit for extracting information, and the display change processing unit detects a window area in the screen information corresponding to the received operation log information and extracts the information by the screen information analysis unit. The character information and the application identification information that is the target of the operation content of the operation log information are compared to determine the character information that matches, and a part other than the window area including the determined character information or This is a client terminal monitoring system that performs display change processing for all areas.

  In order to determine the window that the operator is currently operating, it may be configured as in the present invention. In general, there are many application identification information such as application names in the title bar of the window. Therefore, by extracting character information from the screen information and comparing them with the application identification information in the operation log information, if there is character information that matches the application identification information, it can be a window corresponding to the operation log information High nature. Therefore, if the window includes the matched character information, it is considered that the window is currently operated by the operator. The window that the operator is operating is not subjected to the display change process, and the display change process is performed for the other areas to achieve both monitoring by the administrator and protection of the operator's privacy. Can do.

  The invention according to claim 12 is the client terminal monitoring system, wherein the display change processing unit changes a range in which the display change process is performed based on the operation log information received by the operation log information receiving unit.

  According to the present invention, it is possible to set a range in which display change processing is performed within an appropriate range according to operation log information. Accordingly, for example, in the case of a dangerous operation, the range for performing the display change process can be narrower than usual (that is, the administrator can confirm a wider range than usual).

  The invention of claim 13 is a client terminal monitoring system that performs operation management of each client terminal using screen information displayed on a display device of each client terminal, wherein the client terminal monitoring system performs operation determination. A client terminal having a display unit and a display change processing unit, and a monitoring terminal having a screen information receiving unit and a screen information display unit, and the operation determination unit is an operation content in the operation log information of the client terminal Is a specific operation stored in a predetermined storage area, and the display change processing unit uses the determination result to display change processing for a part or all of the received screen information. And at least the screen information subjected to the display change process is transmitted to the monitoring terminal, and the screen information receiving unit transmits to at least each of the client terminals. Receives screen information subjected to the display change process you are, the screen information display unit, a screen information performing the display change processing on the display device of the monitor terminal, a client terminal monitoring system.

  According to the first aspect of the present invention, as in the present invention, the function can be distributed to the monitoring terminal and the client terminal.

  The invention of claim 14 is a client terminal monitoring system that performs operation management of each client terminal using screen information displayed on a display device of each client terminal, wherein the client terminal monitoring system performs operation determination. A client terminal having a display unit and a display change processing unit, and a monitoring terminal having a screen information receiving unit and a screen information display unit, and the operation determination unit includes an operation log within a predetermined time of the client terminal. In the information, it is determined whether the operation content in each operation log information is a specific operation stored in a predetermined storage area, and in the case of the specific operation, it is associated with the specific operation stored in the predetermined storage area. A cumulative value of the given operation point is calculated, it is determined whether the cumulative value satisfies a predetermined condition, and the display change processing unit And performing display change processing on a part or all of the received screen information, and transmitting at least the screen information subjected to the display change processing to the monitoring terminal. The client terminal monitoring system receives screen information subjected to display change processing at a client terminal, and the screen information display unit displays the screen information subjected to the display change processing on a display device of the monitoring terminal.

  The invention of claim 3 can also be arranged with the functions distributed to the monitoring terminal and the client terminal as in the present invention.

  According to the invention of claim 15, the screen information displayed on the display device of each client terminal is displayed from each client terminal on a computer terminal having a storage device including a specific operation storage unit that stores at least a predetermined specific operation. The screen information receiving unit that receives the operation log information of each client terminal, the operation log information receiving unit that receives the operation log information from each client terminal, and whether the operation content in the received operation log information is a specific operation stored in the specific operation storage unit An operation determination unit that determines the display change processing unit that performs a display change process on a part or all of the received screen information using the determination result, the screen information that has been subjected to the display change process, It is a client terminal monitoring program that functions as a screen information display unit that displays on a predetermined display device.

  The invention of claim 1 can be realized by causing the computer terminal to read and execute the program of the present invention.

  According to the sixteenth aspect of the present invention, there is provided screen information for displaying a computer terminal having a storage device including a specific operation storage unit that stores at least a predetermined specific operation and an operation point corresponding thereto on the display device of each client terminal. The screen information receiving unit that receives from each client terminal, the operation log information receiving unit that receives the operation log information of each client terminal, and the operation log information within a predetermined time, the operation content in each operation log information is Operation determination that determines whether the specific operation is stored in the specific operation storage unit, calculates a cumulative value of the operation points in the case of the specific operation, and determines whether the cumulative value satisfies a predetermined condition Using the determination result, display change processing is performed on a part or all of the received screen information. Cormorant display change processing unit, a screen information performing the display change processing, a client terminal monitor program to function as the screen information display unit, to be displayed in the predetermined display device.

  The invention of claim 3 can be realized by causing the computer terminal to read and execute the program of the present invention.

By using the present invention, when the operation performed on the client terminal is a predetermined operation, for example, an operation that is suspected of leakage of confidential information, the administrator monitors the screen information at the time of the operation. On the other hand, in the case of an operation that is not predetermined, for example, a simple input operation, display change processing is performed on the screen information. As a result, for the operator side, in the normal operation, the administrator can no longer see the operator's screen, and the concern about privacy infringement is eliminated. This makes it possible to provide a client terminal monitoring system that can meet the demands of both the administrator side and the operator side.

  An overall conceptual diagram of the client terminal monitoring system 1 of the present invention is shown in FIG. 1, and an exemplary conceptual diagram of a system configuration is shown in FIG.

  The client terminal monitoring system 1 is realized by reading and processing a predetermined program in a computer terminal or server (hereinafter referred to as “monitoring terminal 2”) used by an administrator who monitors each client terminal 3. . The monitoring terminal 2 records and monitors what program is executed on the plurality of client terminals 3 and what screen is displayed. Accordingly, each client terminal 3 is provided with information such as the program name and file name executed in the client terminal 3 periodically or when a new program or file is executed or terminated. The function of transmitting information on the program name and file name from the client terminal 3 to the monitoring terminal 2 at the timing, and the function of capturing the screen of the client terminal 3 and transmitting it to the monitoring terminal 2 regularly or irregularly ing. The function of transmitting program name and file name information can be extracted by extracting the program name and file name being executed by the arithmetic unit 20 of the client terminal 3, or by extracting and transmitting the program name and file name in the memory. Good. That is, what is necessary is just to transmit what is called operation log information from the client terminal 3 to the monitoring terminal 2. In order to capture the screen, for example, the screen information displayed on the screen may be read from a display information storage device that stores information to be displayed on the screen, such as a VRAM, and transmitted as screen information.

  Note that the operation log information and the screen information may be associated with each other at the same time or may not be associated. The operation log information and the screen information may be transmitted from the client terminal 3 to the monitoring terminal 2 at the same timing, or may be transmitted at different timings.

  The monitoring terminal 2 includes an arithmetic device 20 such as a CPU for executing arithmetic processing of a program, a storage device 21 such as a RAM and a hard disk for storing information, processing results of the arithmetic device 20 and information stored in the storage device 21 on the Internet. And a communication device 24 that transmits and receives via a network such as a LAN and a display device 22 such as a display. Each function (each unit) realized on the computer is executed when a unit (program, module, etc.) for executing the process is read into the arithmetic unit 20. When using the information stored in the storage device 21 in the processing, each function reads the corresponding information from the storage device 21 and uses the read information for processing in the arithmetic device 20 as appropriate. The computer may include an input device 23 such as a keyboard, a mouse, or a numeric keypad. FIG. 3 schematically shows an example of the hardware configuration of the monitoring terminal 2. Further, the monitoring terminal 2 may have its functions distributed in a plurality of computer terminals or servers.

  Each means in the present invention is only logically distinguished in function, and may be physically or practically the same area.

  The monitoring terminal 2 includes a screen information receiving unit 4, a screen information storage unit 5, an operation log information receiving unit 6, an operation log information storage unit 7, an operation determination unit 8, a specific operation storage unit 9, a display change processing unit 10, and screen information. And a display unit 11.

  The screen information receiving unit 4 receives screen information displayed on the display device 22 of each client terminal 3 from each client terminal 3 that is monitored by the monitoring terminal 2. An example of the screen information acquired from the client terminal 3 in FIG. 5 is shown. When the screen information receiving unit 4 receives the screen information from each client terminal 3 periodically or at a predetermined timing, the screen information receiving unit 4 stores the screen information in the screen information storage unit 55. At this time, information for identifying the client terminal 3 and the date and time is stored in association with each other.

  The screen information storage unit 5 stores the screen information received by the screen information receiving unit 4 from each client terminal 3 in association with information for identifying the client terminal 3 and the date and time.

  The operation log information receiving unit 6 receives operation log information in the client terminal 3 from each client terminal 3 regularly or irregularly. The received operation log information is stored in an operation log information storage unit, which will be described later, along with the date and time, and identification information for identifying which client terminal 3 is the operation log information. The operation log information may be information indicating the operation content in each client terminal 3, for example, “file copy”, “file selection”, “drive addition”, “application activation”, “application termination”, Information indicating the operation of the operator of the client terminal 3 such as “switch active window”, “move window”, “change window size”, and the like is applicable. Further, as operation log information, in addition to the operation contents as described above, information related to the active window (position coordinates, etc.) may be attached.

  When the monitoring terminal 2 receives operation log information from each client terminal 3, it may be received via a network, or the operation log information is recorded on a recording medium such as a DVD in the client terminal 3, and the recording medium is monitored. It may be read by the terminal 2 and received by reading operation log information therefrom.

  The operation log information storage unit 7 stores the operation log information received from each client terminal 3 by the operation log information receiving unit 6. An example of the operation log information is shown in FIG. The operation log information is preferably stored for each client terminal 3 or its operator (login name or the like). Further, the operation log information stores information indicating the operation content in each client terminal 3 in association with date / time or information obtained by digitizing the date / time. In addition, when associating the information indicating the operation content with the date and time, it may be performed at the client terminal 3, may be performed when the operation log information is received by the monitoring terminal 2, or an operation log information storage unit It may be performed when stored in step 7.

  The operation determination unit 8 stores the operation log information received by the operation log information receiving unit 6, that is, the operation performed at each client terminal 3, stored in a specific operation storage unit 9 (described later). It is determined whether it is an operation.

  The specific operation storage unit 9 stores a predetermined specific operation for determining whether to perform display change processing on the screen information. Specific operations include operations such as unauthorized operations that lead to leakage of confidential information and personal information (for example, file copying, file movement, etc.), unauthorized software activation, game software activation, etc. . The specific operation can be arbitrarily set by the administrator. The specific operation may be a single operation, or a plurality of operations may be set as the specific operation. In this case, the operation determination unit 8 can detect the plurality of operations set as the specific operation (preferably, detect them continuously) to determine whether the operation is a specific operation.

  The display change processing unit 10 performs display change processing on the screen information of the client terminal 3 received by the screen information receiving unit 4 based on the determination result in the operation determination unit 8. For example, when the operation determination unit 8 determines that the operation log information received from a certain client terminal 3 is not a specific operation, display change processing is performed on part or all of the screen information received from the client terminal 3. There are various types of display change processing. For example, as shown in FIG. 7, a part of or all of the screen information is overcoated with a predetermined color, or the contents of the screen information are deleted. Processing, mosaic processing, etc.

  The screen information display unit 11 causes the display device 22 of the monitoring terminal 2 to display the screen information after the display change process is performed in the display change processing unit 10 and the screen information before the display change process is performed. For example, the screen information of FIG.

  First, a first embodiment of the present invention will be described with reference to the flowchart of FIG. 4 and the conceptual diagram of the system configuration of FIG. In the present embodiment, a case will be described in which when the operation determination unit 8 determines that the operation is not a specific operation, display change processing is performed on all of the screen information.

  The operation log information of the client terminal 3 and the screen information displayed on the display device 22 of the client terminal 3 are transmitted from each client terminal 3 to the monitoring terminal 2 periodically or at a predetermined timing. For this information, the screen information is received by the screen information receiving unit 4 (S100), and the operation log information is received by the operation log information receiving unit 6 (S100). The screen information received by the screen information receiving unit 4 is stored in the screen information storage unit 5 together with the client terminal 3 and date / time information that transmitted the information (S110). FIG. 5 shows an example of screen information received from the client terminal 3.

  The operation log information received by the operation log information receiving unit 6 includes the operation log information storage unit together with the client terminal 3 that transmitted the information and date / time information (when the operation log information does not include date / time information). 7 (S110).

  When the operation log information is received by the operation log information receiving unit 6, the operation determination unit 8 refers to the operation content in the operation log information and determines whether the operation is a predetermined specific operation stored in the specific operation storage unit 9. (S120). Then, referring to the operation content in the operation log information, if it is a specific operation, the display change processing unit 10 determines that the display change process is not performed on the screen information associated with the operation log information. To do. If the operation content in the operation log information is not a specific operation, the display change processing unit 10 determines to perform display change processing on the screen information associated with the operation log information.

  The operation log information and the screen information may be associated with each other if they are received at the same timing. If they are received at different timings, the date and time information in the operation log information (or the operation log information corresponds). Date / time information) and date / time information associated with the screen information are compared to determine whether display change processing is to be performed on the screen information of the date / time information closest to the date / time information of the operation log information. Further, since the operation log information and the screen information are received from various client terminals 3, the operation at the same client terminal 3 is performed based on the client terminal identification information in the operation log information and the client terminal identification information associated with the screen information. It is natural that log information and screen information are processed. These processes are naturally performed in the following embodiments.

  When the operation determination unit 8 determines that the display change process is to be performed on the screen information associated with the operation log information, the display change processing unit 10 displays the screen information received by the screen information reception unit 4 as follows. Execute display change processing. That is, a display change process is performed so that the administrator makes the screen information unreadable in the entire area of the screen information (S130). Then, the screen information after the display change process for the screen information is performed in S130, the screen information display unit 11 displays the screen displayed on the display device 22 of the monitoring terminal 2 on the display device 22 of the client terminal 3. Information is displayed (S140). That is, the processed screen information as shown in FIG. 7 is displayed on the display device 22 of the monitoring terminal 2. In this case, the processed screen information may not be displayed.

  When the operation determining unit 8 determines that the display change process is not performed on the screen information associated with the operation log information, the display change processing unit 10 displays the screen change on the screen information. Does not perform display change processing. Therefore, the screen information display unit 11 causes the display device 22 of the monitoring terminal 2 to display the screen information received by the screen information receiving unit 4 as it is as the screen information displayed on the display device 22 of the client terminal 3 (S140). ). That is, the screen information as shown in FIG. 5 is displayed on the display device 22 of the monitoring terminal 2.

  By doing as described above, the administrator of the monitoring terminal 2 cannot normally see the screen information displayed on the display device 22 of the client terminal 3, but when a specific operation is performed on the client terminal 3. In this case, the screen information displayed on the display device 22 of the client terminal 3 at that time can be confirmed. That is, the administrator can check whether the operator of the client terminal 3 is doing something illegal. As a result, the client terminal monitoring system 1 that achieves both monitoring by the administrator and privacy of the operator is possible.

  In the series of processing in the display change processing unit 10 and the screen information display unit 11, the screen information to be processed is associated with the screen information stored in the screen information storage unit 5 by predetermined identification information. preferable. In other words, the screen information on which the processing in each means is executed is associated with which screen information stored in the screen information storage unit 5 is being processed. As a result, when the administrator determines necessity such as the risk of information leakage for some reason, the administrator performs a predetermined operation from the input device 23 of the monitoring terminal 2, for example, to display screen information. When the monitoring terminal 2 accepts the operation by performing an operation indicating that the screen information after processing displayed in the unit 11 is not processed (display change processing is not performed), the processing is performed. Based on the identification information of the subsequent screen information, unprocessed screen information is extracted from the screen information storage unit 5 and displayed on the display device 22 of the monitoring terminal 2.

  For example, in the display device 22 of the monitoring terminal 2, when the screen information after processing shown in FIG. 6 is displayed as the screen information of the display device 22 of a certain client terminal 3, the administrator who viewed it for any reason. For example, when the risk of information leakage is determined from the video of the monitoring camera, for example, the administrator performs a predetermined operation on the monitoring terminal 2 so that, for example, the processed screen information is selected and not processed. When an operation for viewing the screen information is performed from the input device 23, the input is accepted, and the screen information corresponding to the identification information of the selected screen information after processing is extracted from the screen information storage unit 5. The extracted screen information is displayed on the display device 22 of the monitoring terminal 2. Since the screen information displayed at this time is the screen information before processing, the screen information shown in FIG. 5 is displayed.

  Next, a second embodiment of the present invention will be described with reference to the flowchart of FIG. 9 and the conceptual diagram of the system configuration of FIG. In the present embodiment, a case will be described in which when the operation determination unit 8 determines that the operation is not a specific operation, display change processing is performed on character information in the screen information. In the description of this embodiment, the description of the same parts as described above may be omitted.

  An example of the system configuration in this embodiment is shown in FIG.

  The monitoring terminal 2 in this embodiment includes a screen information receiving unit 4, a screen information storage unit 5, an operation log information receiving unit 6, an operation log information storage unit 7, an operation determination unit 8, a specific operation storage unit 9, and a display change processing unit. 10, a screen information display unit 11, a screen information analysis unit 12, a specific information storage unit 13, and a specific information determination unit 14.

  When the operation determination unit 8 determines that the operation log information received by the operation log information receiving unit 6 is a predetermined specific operation, the screen information analysis unit 12 displays screen information (corresponding to the operation log information ( By performing character recognition processing on the screen information received by the screen information receiving unit 4, character information included in the screen information (“character” includes not only characters but also information such as numbers, symbols and marks). To be included). That is, since the screen information received from the client terminal 3 is in an image format, it is impossible to determine what characters are included in the screen information as it is. Therefore, by performing a predetermined character recognition process from the screen information, the character information included in the screen information is extracted.

  In the case of the screen information in FIG. 5, the character information of “Internet Explorer”, “My Document”, “My Computer”, “My Network” can be extracted from the desktop portion, and “Untitled-Message (HTML)” can be extracted from the mail portion. Format) "," File (F) "," Edit (E) ", Display (V)", "Insert (I)", "Format (O)", "Tool (T)", "Action (A)" ”,“ Help (H) ”,“ Send (S) ”,“ Account (N) ”,“ MSP Gothic ”,“ 14 ”,“ B ”,“ I ”,“ U ”,“ Destination ”,“ CC ” (C) ”,“ Subject (J) ”,“ Attachment ”,“ Specifications Confidential.xls (14KB) ”,“ Thank you very much ”“ Sending confidential files ”“ File name has been changed. "" The file entity is the employee ledger, "" All of our employees Information has been entered. "" It's secret. "So that the extracted as character information.

  Further, the screen information analysis unit 12 determines position information (such as relative coordinates on the screen) in the screen information for the extracted character information. For example, among the areas constituting the extracted character information, the position coordinates of “My Document” are the upper left x, y coordinates (0, 100), the lower left x, y coordinates (0, 105), and the upper right x , Y coordinates are determined as (40, 100), and the lower right x, y coordinates are determined as (40, 105), and are temporarily stored in the storage device 21 or the like. Note that the reference position coordinates, for example, the upper left position coordinates, the distance in the x-axis direction, and the distance in the y-axis direction may be stored without storing all four points.

  The specific information storage unit 13 stores at least specific information. Here, the specific information is a term that is concerned about information leakage, such as “confidential”, “secret”, “ledger”, and “secret”. In addition, it is possible to arbitrarily set specific endings, private terms, dangerous character strings related to security, emoticons, and the like. This specific information is set by an administrator by a predetermined method, and is stored in the specific information storage unit 13 described later.

  The specific information stored in the specific information storage unit 13 may be set for each operation content in the operation log information. For example, when the operation content is “Send Mail”, “Confidential” and “Confidential” are set as the specific information. When the operation content is “File Copy”, the specific information is “Ledger”, “Specification”. Document "," design document ", etc. are set.

  The specific information determination unit 14 determines whether there is character information that matches the specific information set in advance by the administrator for the character information extracted by the screen information analysis unit 12. When the specific information is set for each operation content in the operation log information, the specific information determination unit 14 is based on the operation content in the operation log information received by the operation log information receiving unit 6. The specific information stored in the screen information is extracted, and then it is determined whether there is character information that matches the extracted specific information for the character information extracted by the screen information analysis unit 12.

  The display change processing unit 10 performs a predetermined display change process on the character information in the screen information using the character information extracted by the screen information analysis unit 12 and the character information that matches the specific information determined by the specific information determination unit 14. I do. There are various types of display change processing. For example, as shown in FIG. 10, a process of superimposing a predetermined color on a character information area other than the predetermined range of the character information that matches the specific information is performed. Do. In addition to overcoating the color, there are a process for deleting the character information and a process for applying a mosaic to the character information. It should be noted that the position coordinates of the area constituting the character information that is determined by the screen information analysis unit 12 and that performs the display change process stored in the storage device 21, for example, “My Document” is the upper left (x, y) = (0 , 100), lower left (x, y) = (0, 105), upper right (x, y) = (40, 100), lower right (x, y) = (40, 105), the character information The position information is extracted from the storage device 21, and the display change process is performed on the area. The predetermined area may be arbitrarily set such as an area constituting the character information or a position coordinate serving as a reference of the area constituting the character information, for example, an area having a certain size from the upper left position coordinate.

  Thus, the predetermined range including the character information that matches the specific information is displayed as it is, and the predetermined area including the character information that is not so is processed so that the administrator cannot read it. Both operator privacy can be satisfied. Note that character information that matches the specific information may be made easier to understand by providing a process such as enclosing and highlighting the character information that matches the specific information.

  The screen information display unit 11 causes the display device 22 of the monitoring terminal 2 to display the screen information after the display change process is performed in the display change processing unit 10 and the screen information before the display change process is performed. For example, the screen information of FIG.

  Next, an example of the processing process of the present embodiment will be described with reference to the flowchart of FIG.

  The operation log information of the client terminal 3 and the screen information displayed on the display device 22 of the client terminal 3 are transmitted from each client terminal 3 to the monitoring terminal 2 periodically or at a predetermined timing. For this information, the screen information is received by the screen information receiving unit 4 (S200), and the operation log information is received by the operation log information receiving unit 6 (S200). The screen information received by the screen information receiving unit 4 is stored in the screen information storage unit 5 together with the date and time information of the client terminal 3 that transmitted the information (S210). FIG. 5 shows an example of screen information received from the client terminal 3.

  The operation log information received by the operation log information receiving unit 6 includes the operation log information storage unit together with the client terminal 3 that transmitted the information and date / time information (when the operation log information does not include date / time information). 7 (S210).

  When the operation log information is received by the operation log information receiving unit 6, the operation determination unit 8 refers to the operation content in the operation log information and determines whether the operation is a predetermined specific operation stored in the specific operation storage unit 9. (S220, S230). If the operation content in the operation log information is referred to and it is not a specific operation, the display change processing unit 10 causes part or all of the screen information associated with the operation log information (preferably the entire region). It is determined that display change processing is performed on

  When the operation determination unit 8 determines that display change processing is to be performed on the screen information associated with the operation log information, the display change processing unit 10 displays a predetermined area (screen information of the screen information). The display change processing unit 10 performs display change processing on a part or all of the region. Then, the screen information display unit 11 causes the display device 22 of the monitoring terminal 2 to display the screen information that has been subjected to the display change process by the display change processing unit 10 (S280). For example, when the display change is performed on the entire screen information, the screen information shown in FIG. 7 is displayed on the display device 22 of the monitoring terminal 2.

  On the other hand, in the determination by the operation determination unit 8 in S220 and S230, when it is determined that the operation content in the operation log information is a specific operation, the screen information analysis is performed on the screen information associated with the operation log information. The unit 12 performs character recognition processing (S240).

  That is, the screen information analysis unit 12 performs character recognition processing on the screen information of the client terminal 3 received by the screen information receiving unit 4, and extracts character information included in the screen information. For example, from the screen information of FIG. 5, character information in the screen information, for example, “Internet Explorer”, “My Document”, “My Computer”, “Untitled-Message (HTML format)”, “File (F)”, “Edit” Character information such as “(E)” and “display (V)” is extracted. At the time of this extraction, the position information in the screen information of the extracted character information may be stored together.

  For the character information extracted in this way, the specific information determination unit 14 determines whether there is character information that matches the specific information stored in the specific information storage unit 13 (S250). That is, it is determined whether the screen information includes a term (specific information) that may cause information leakage.

  For example, when “confidential”, “secret”, “ledger”, and “secret” are set as the specific information, it is determined whether or not the specific information is included in the extracted character information. In the case of the screen information shown in FIG. 5, among the extracted character information, the attached file name “specification confidential.xls (14KB)”, an e-mail message “send confidential file”, “file Since the entity is an employee ledger, it can be determined that the specific information is included in the text information “” and “secret”.

  After such a process of comparing the extracted character information with the specific information, the display change processing unit 10 performs a process of changing the display of the predetermined area of the screen information to a state that cannot be read by the administrator (S260). For example, image processing such as applying a predetermined color in a superimposed manner or applying a mosaic to a region of character information excluding character information that matches the specific information in the screen information is performed. In this image processing, since the position information in the screen information of each character information is determined when the character information is extracted in S240, the position of the region where the image processing is easily performed can be determined based on the position information. is there.

  For example, when a display change process for painting a predetermined color on character information other than character information that matches the specific information is set in advance, the “specification of confidential information.xls (14 KB)” is first displayed. ”,“ Because the file is an employee ledger ”and“ secret ”, the display change processing is performed for the area composed of the position information. In addition, regarding the text information of “Specification Confidential.xls (14KB)”, “Send a confidential file” in the e-mail message, “Because the substance of the file is an employee ledger”, “Secret.” Other than the specific information, “External Confidential.xls (14KB)”, “Send the file of”, “The substance of the file is employee”, “So,” and “Is.” Display change processing is performed for the configured area. The screen information shown in FIG. 10 is obtained by performing display change processing on the screen information shown in FIG. As shown in FIG. 10, the display change process may be performed on all character information other than the character information that matches the specific information, or the display change process may be performed only on a part thereof. For example, the display change process may not be performed on character information including text including character information that matches the specific information.

  The screen information after the display change process for the screen information is performed in S260, the screen information display unit 11 uses the monitoring terminal 2 as the screen information displayed on the display device 22 of the client terminal 3 of the monitoring terminal 2. It is displayed on the display device 22 (S270). That is, the processed screen information as shown in FIG. 10 is displayed on the display device 22 of the monitoring terminal 2.

  Note that the screen information to be processed in the series of processing in the screen information analysis unit 12, the specific information determination unit 14, the display change processing unit 10, and the screen information display unit 11 is stored in the screen information storage unit 5. It is preferable that they are linked by predetermined identification information (the same applies to all embodiments). In other words, the screen information on which the processing in each means is executed is associated with which screen information stored in the screen information storage unit 5 is being processed. As a result, for example, when the administrator determines necessity such as the risk of information leakage from the processed screen information displayed on the display device 22 of the monitoring terminal 2, the administrator determines that the monitoring terminal 2 By performing a predetermined operation from the input device 23, for example, an operation indicating that the screen information after processing displayed on the screen information display unit 11 is not processed (display change processing is not performed) is displayed. When the operation is accepted by the monitoring terminal 2, the unprocessed screen information is extracted from the screen information storage unit 5 based on the identification information of the processed screen information, and the screen information is stored in the monitoring terminal 2. It is displayed on the display device 22.

  For example, in the display device 22 of the monitoring terminal 2, when the screen information after processing shown in FIG. 10 is displayed as the screen information of the display device 22 of a certain client terminal 3, the administrator who has seen it displays a lot of specific information. When the risk of information leakage is determined from the above, the administrator performs a predetermined operation on the monitoring terminal 2, for example, selecting the processed screen information and then viewing the unprocessed screen information Is input from the input device 23, the input is received, and screen information corresponding to the identification information of the selected screen information after processing is extracted from the screen information storage unit 5. The extracted screen information is displayed on the display device 22 of the monitoring terminal 2. Since the screen information displayed at this time is the screen information before processing, the screen information shown in FIG. 5 is displayed.

  As a result, even if the administrator operating the monitoring terminal 2 monitors the client terminal 3 in real time, the screen information displayed on the client terminal 3 is managed except for character information that matches the specific information. Since the user cannot read the information, the privacy of the operator of the client terminal 3 can be protected. On the other hand, since the administrator of the monitoring terminal 2 can see the part including the specific information and the part other than the character information, whether the operation performed on the client terminal 3 is a suspicious operation or not Screen information other than information, such as frame color and screen layout, can be viewed. This also does not prevent the use of specific software such as file exchange software. As described above, the screen information after processing is normally displayed on the display device 22 of the monitoring terminal 2 and the screen information before processing is displayed as necessary, thereby monitoring the privacy of the operator. It is possible to do.

  In the second embodiment, the case where the display change process is performed for a predetermined area of character information other than the character information that matches the specific information has been described. However, in the present embodiment, how much specific information is used in the screen information. It is determined whether display change processing is to be performed on the screen information by determining whether the display information is using points (index values).

  The specific information storage unit 13 stores points in association with specific information. FIG. 11 schematically shows this state.

  The specific information determination unit 14 determines whether there is character information that matches the specific information stored in the specific information storage unit 13 for the character information extracted from the screen information by the screen information analysis unit 12, and matches the specific information. A comparison point is calculated for the character information to be used. For example, in the case of FIG. 5, the character information extracted from the screen information has four pieces of character information that matches the specific information: “confidential”, “confidential”, “ledger”, and “secret”. In the case of FIG. 11, the points associated with the information are “5 points” for “confidential”, “1 point” for “ledger”, and “4 points” for “secret”. Therefore, the comparison point for the screen information is 5 + 5 + 1 + 4 = 15 points.

  After calculating the comparison point for the screen information in this way, the specific information determination unit 14 compares whether the comparison point exceeds a preset point (set point), and if not, performs a display change process. If it exceeds, it is determined that the display change process is not performed. In the specific information determination unit 14, when calculating the comparison point, the calculation by addition has been described above. However, the calculation other than the addition, for example, subtraction, multiplication, division, or multiplication by a predetermined coefficient is performed in advance. A comparison point may be calculated by a predetermined calculation and compared with a set point.

  When the specific information determination unit 14 determines that the display change process is to be performed, the display change processing unit 10 performs a display change process such that the administrator cannot interpret the character information extracted by the screen information analysis unit 12. Do. In this case, as shown in FIG. 12, display change processing may be performed for all of the extracted character information, or as shown in FIG. 10, a predetermined area including character information other than character information that matches the specific information. You may comprise so that a display change process may be performed (the process process in this case performs the process process similar to Example 2). If the display change process is not performed in the specific information determination unit 14, the display change process is not performed on the screen information.

  When the specific information determination unit 14 determines not to perform the display change process, the screen information display unit 11 displays the screen information received by the screen information reception unit 4 on the display device 22 of the monitoring terminal 2 as it is. If the determination unit 14 determines that the display change process is to be performed, the display change processing unit 10 causes the display device 22 of the monitoring terminal 2 to display the processed screen information.

  Next, a processing process in the third embodiment will be described with reference to the flowchart of FIG.

  The operation log information of the client terminal 3 and the screen information displayed on the display device 22 of the client terminal 3 are transmitted from each client terminal 3 to the monitoring terminal 2 periodically or at a predetermined timing. For this information, the screen information is received by the screen information receiving unit 4 (S300), and the operation log information is received by the operation log information receiving unit 6 (S300). The screen information received by the screen information receiving unit 4 is stored in the screen information storage unit 5 together with the client terminal 3 and date / time information that transmitted the information (S310). FIG. 5 shows an example of screen information received from the client terminal 3.

  The operation log information received by the operation log information receiving unit 6 includes the operation log information storage unit together with the client terminal 3 that transmitted the information and date / time information (when the operation log information does not include date / time information). 7 (S310).

  When the operation log information is received by the operation log information receiving unit 6, the operation determination unit 8 refers to the operation content in the operation log information and determines whether the operation is a predetermined specific operation stored in the specific operation storage unit 9. (S320, S330). If the operation content in the operation log information is referred to and it is not a specific operation, the display change processing unit 10 causes part or all of the screen information associated with the operation log information (preferably the entire region). It is determined that display change processing is performed on

  When the operation determination unit 8 determines that display change processing is to be performed on the screen information associated with the operation log information, the display change processing unit 10 displays a predetermined area (screen information of the screen information). The display change processing unit 10 performs display change processing on a part or all of the region. Then, the screen information display unit 11 causes the display device 22 of the monitoring terminal 2 to display the screen information subjected to the display change process by the display change processing unit 10 (S410). For example, when the display change is performed on the entire screen information, the screen information shown in FIG. 7 is displayed on the display device 22 of the monitoring terminal 2.

  On the other hand, in the determination by the operation determination unit 8 in S320 and S330, when it is determined that the operation content in the operation log information is a specific operation, screen information analysis is performed on the screen information associated with the operation log information. The unit 12 performs character recognition processing (S340).

  That is, for the screen information of the client terminal 3 received by the screen information receiving unit 4, the screen information analysis unit 12 performs character recognition processing on the screen information and extracts character information included in the screen information. For example, from the screen information of FIG. 5, character information in the screen information, for example, “Internet Explorer”, “My Document”, “My Computer”, “Untitled-Message (HTML format)”, “File (F)”, “Edit” Character information such as “(E)” and “display (V)” is extracted. At the time of this extraction, the position information in the screen information of the extracted character information may be stored together.

  For the character information extracted in this way, the specific information determination unit 14 determines whether there is character information that matches the specific information stored in the specific information storage unit 13 (S350). That is, it is determined whether the screen information includes a term (specific information) that may cause information leakage.

  For example, when “confidential”, “secret”, “ledger”, and “secret” are set as the specific information, it is determined whether or not the specific information is included in the extracted character information. In the case of the screen information shown in FIG. 5, among the extracted character information, the attached file name “specification confidential.xls (14KB)”, an e-mail message “send confidential file”, “file Since the entity is an employee ledger, it can be determined that the specific information is included in the text information “” and “secret”.

  Thus, when the specific information determination unit 14 determines character information that matches the specific information, a comparison point is calculated for them. That is, a comparison point for the screen information is calculated (S360).

  In the case where the screen information is shown in FIG. 5, the character information that matches the specific information is “confidential”, “confidential”, “ledger”, and “secret”, so the comparison point is 15 points (= 5 + 5 + 1 + 4) ( FIG. 11).

  After calculating the comparison points for the screen information in this way, the specific information determination unit 14 determines whether the comparison points exceed a preset point (S370, S380).

  For example, when the set point is 10 points, since the comparison point is 15 points in FIG. 5, the comparison point is larger. Accordingly, the display change processing unit 10 performs a display change process on a predetermined area of the screen information (a part or all of the screen information). Then, the screen information display unit 11 causes the display device 22 of the monitoring terminal 2 to display the screen information subjected to the display change process by the display change processing unit 10 (S410). For example, when the display change is performed on the entire screen information, the screen information shown in FIG. 7 is displayed on the display device 22 of the monitoring terminal 2.

  On the other hand, when the set point is 20 points, since the comparison point is 15 points in FIG. 5, the set point is larger. Accordingly, the display change processing unit 10 performs a display change process in which the administrator cannot read the predetermined area of the character information other than the character information that matches the specific information among the character information extracted from the screen information (S390). . This display change process can be performed in the same manner as in the second embodiment.

  The screen information display unit 11 displays the screen information subjected to the display change process in the display change processing unit 10 in this manner on the display device 22 of the monitoring terminal 2 (S400). If the received screen information is shown in FIG. 5, the screen information shown in FIG. 12 is displayed on the monitoring terminal 2. Depending on the display change process, screen information other than that shown in FIG. 12, for example, screen information as shown in FIG. 10 may be displayed. Various processes can be provided in the display change process as described above.

  The display change process can be configured to be a display change process subdivided for each specific information. For example, as shown in FIG. 14, the specific information storage unit 13 may store specific information (or points for the specific information) and display change processing for the specific information. Such processing can be executed in combination with the first to third embodiments. In the following description, the case of combination with Example 3 will be described. Therefore, in addition to associating a range where display change processing is not performed with points, it is also possible to perform processing by associating specific information with ranges where display change processing is not performed.

  In the case of the present embodiment, the display change processing unit 10 performs the display change process in a range corresponding to each specific information during the display change process. For example, for the specific information “confidential”, “display change processing is not performed for all sentences containing the specific information”, and for “secret” “display only specific information without display change processing”, “ledger” For the display change processing within the range corresponding to each specific information and its point, such as “Display without performing display change processing for the block from specific information to the next break (punctuation, space, segment, etc.)” Will be performed.

  When the screen information is shown in Fig. 5, "Specification confidential" .xls (14KB) "," Send confidential file "in the email message," Because the file is an employee ledger "," Secret " . ”Includes character information that matches the specific information. Therefore, when the display change processing unit 10 performs the display change processing for the screen information of FIG. 5 as in the first to third embodiments, the “specification document confidential.xls (14 KB)” and the “confidential file” are displayed. Display change processing is not performed for “Sends”, “Because the file entity is an employee ledger,” for “Because it is a ledger”, only the display change processing is not performed for “File entity is” Display change processing is performed. For “secret”, only “secret” is not subjected to display change processing, and “is.” Is subjected to display change processing.

  As described above, the display change processing unit 10 may be configured to perform the display change process while referring to the range of the display change process corresponding to the specific information stored in the specific information storage unit 13. The screen information display unit 11 displays the screen information subjected to the display change processing in this way on the display device 22 of the monitoring terminal 2. FIG. 15 schematically shows screen information when the display change process of this embodiment is performed.

  In the above-described display change processing unit 10 according to the second to fourth embodiments, the case where the display change process is performed on character information in a predetermined area other than the character information that matches the specific information has been described. It is not necessary to perform display change processing on character information (referred to as “exclusion information”) that is determined in advance to be highly likely to be detected and that no relevance to information leakage is recognized. For example, the character information on the toolbar in a predetermined program such as “My Computer”, “My Network”, “Recycle Bin” in the desktop portion of the screen information, “Send (S)” in the e-mail transmission portion, etc. This is necessary character information that is not input by the operator from the client terminal 3. Accordingly, these character information is stored in advance in the exclusion information storage unit (not shown) as exclusion information, and is extracted when the display change processing unit 10 performs the display change processing of the character information in the predetermined area. Each character information and the exclusion information stored in the exclusion information storage unit are compared, and the exclusion information can be configured not to be subjected to display change processing (not to be unreadable by the administrator). With this configuration, the administrator can easily view the screen information whose display has been changed, and the operator can also protect information that he wants to protect as privacy, such as characters he / she has entered. An example of screen information subjected to the processing in the present embodiment is shown in FIG.

  In the screen information of FIG. 16, character information of each icon on the desktop, the toolbar of the e-mail transmission program, the font name, and the character information such as each icon on the transmission screen are set as exclusion information in the exclusion information storage unit. Indicates a case where display change processing is not performed.

  In the first embodiment described above, the area for performing the display change process is the entire screen information, but an area other than the window of the application that has performed the operation content in the operation log information may be the target of the display change process. This case will be described in the present embodiment.

  In general, a window in which some operation is performed is often an active window. Therefore, the window of the application corresponding to the operation log information is an active window, and the display change process is performed on the area other than the active window.

  Therefore, in the display change processing unit 10 of the client terminal monitoring system 1 in the first embodiment, the window area is detected from the screen information, the active window is determined from the window area, and the display change process is performed on the area other than the active window. What is necessary is just to comprise. Note that the display change process may be performed not on the active window but on an area other than the window.

  Specifically, when the display change processing unit 10 performs the display change process, a window is first detected. The window is detected by detecting an area composed of straight lines in the screen information (preferably a rectangular area, but may be a polygonal area composed of straight lines since windows may be displayed in an overlapping manner). In addition, an area including icons such as “minimize button”, “maximize button”, and “close button” in the title bar can be determined as a window.

  Whether the window is an active window can be determined by comparing areas determined as windows in the screen information, determining the density and chromaticity of the title bar in the area, and determining a window having a high density and chromaticity as the active window. . The determination may be made by other methods.

  Using the position coordinates of the area of the window (or active window) determined as described above, display change processing is performed on a part or all of the area other than the position coordinates of the area. As a result, the display change process is performed on an area other than the operation content window corresponding to the operation log information.

  In the above-described case, a case has been described in which a window is simply detected and display change processing is performed on an area other than the window or the active window. May be used to determine the window corresponding to the operation log information.

  In this case, the determination is made using character information extracted from the screen information as in the second to fifth embodiments. That is, the display change processing unit 10 detects the position information of the window area, and then extracts the application name targeted for the operation content from the operation log information received by the operation log information receiving unit 6. Then, the character information extracted from the screen information by the screen information analysis unit 12 is compared with the extracted application name, and position information of matching (including partial matching) or similar character information is determined. Then, the window area including the position information of the matched character information becomes the window area corresponding to the operation log information (it can be determined because the application name is generally displayed in the window title bar). . Therefore, the display change processing unit 10 performs a display change process on an area other than the window area.

  For example, when the operation log information is shown in FIG. 6, the name of the application targeted for the operation content is “customer information (confidential)”. Therefore, the character information extracted from the screen information by the screen information analysis unit 12 is compared with the application name “customer information (confidential)” in the operation log information, and the position information of the matching or similar character information in the screen information is determined. . When the position information in the screen information of the character information “customer information (confidential)” can be determined, the window area including the position information of the character information is determined. The area of this window is position information corresponding to the operation log information. Therefore, the display change processing unit 10 performs display change processing on an area other than the area of this window (the window including the character information of “customer information (confidential)”).

  By performing the process as described above, the display change process can be executed for an area other than the window corresponding to the operation log information. As a result, the administrator can confirm the operation details of the window in which the operation was performed, but the display change processing is performed for the other parts, so the administrator cannot see it and the operator's You can keep your privacy.

  In the above-described sixth embodiment, the case where the display change process is performed on an area other than the window area corresponding to the operation log information has been described. However, only character information in the window area corresponding to the operation log information is extracted. The processing of the second embodiment to the fifth embodiment may be executed on the character information.

  That is, when the operation determination unit 8 determines that the operation is a specific operation, first, the window area is detected from the screen information, and the active window area is detected from the window by the method of the sixth embodiment. And the screen information analysis part 12 extracts the character information in the area | region of the said active window among screen information. By executing such processing, it is possible to extract only the character information in the area of the active window in the screen information.

  The character information in the active window area can also be extracted by the following processing. First, a window is detected, and an active window area is detected from the window by the method of the sixth embodiment. Then, the screen information analysis unit 12 extracts character information from the screen information, and compares the extracted character information position information with the position information of the active window area (position information of the active window area). Character information in the region of the active window is extracted). Even if such processing is executed, it is possible to extract only the character information in the area of the active window in the screen information.

  Using the character information extracted as described above, a comparison process with the specific information in the specific information determination unit 14 is performed in the same manner as in the second to fifth embodiments described above, and other than character information that matches the specific information. A display change process can be performed for an area including character information and the like.

  That is, it is possible to extract only the character information in the active window area and compare it with the specific information, and to perform the display change process for character information other than the character information that matches the specific information. Therefore, in the case of the present embodiment, in the case of a specific operation, the character information of the portion where there is a risk of information leakage or the like is displayed, and the other character information is subjected to display change processing. . Since the display change process is originally performed on the window area other than the active window, the administrator can check the surrounding screen information. Further, the character information extraction process that imposes a load on the process can be limited only to the area of the active window, so that the process load can be reduced.

  In the above-described first to seventh embodiments, the range for performing the display change process may be changed based on the operation log information. That is, when the display change processing unit 10 performs the display change process, a range for performing the display change process is specified based on the operation log information received by the operation log information receiving unit 6 (operation log information and display change process). And the display change process may be performed based on the range.

  The display change process range is stored in association with the operation content in the operation log information, or when the operation log information includes information indicating the degree of danger. When the display change process is performed, the display change process is performed by specifying the range in which the display change process is performed by referring to information indicating the operation content and the risk level in the operation log information.

  By performing such processing, the display change processing range is changed based on the operation log information, and display change according to the operation can be performed.

  In the above-described first to eighth embodiments, when it is determined that the operation is a specific operation, it is determined whether or not to perform the display change process. Based on the operation log information within a predetermined time, It is also possible to determine the risk due to a specific operation performed during that time, and to determine whether or not to perform display change processing when it is determined that there is a risk. That is, when the operation log information is received by the operation log information receiving unit 6, a point (operation point) for the operation content in each operation log information within a predetermined time is determined. Then, it is determined whether the operation point is equal to or greater than a predetermined value (greater than a predetermined value). If the operation point is equal to or greater than a predetermined value (greater than a predetermined value), it is determined that there is a risk. Judge that there is no.

  Therefore, the specific operation storage unit 9 stores specific operations and operation points in association with them. FIG. 18 schematically shows an example of the specific operation storage unit 9.

  First, in the case of the first embodiment, based on the operation log information within a predetermined time, the risk of an operation performed during that time is determined, and if it is determined that there is a risk, whether or not the display change process is performed. A case in which the determination is made will be described.

  The operation log information of the client terminal 3 and the screen information displayed on the display device 22 of the client terminal 3 are transmitted from each client terminal 3 to the monitoring terminal 2 periodically or at a predetermined timing. For this information, the screen information is received by the screen information receiving unit 4 (S500), and the operation log information is received by the operation log information receiving unit 6 (S500). The screen information received by the screen information receiving unit 4 is stored in the screen information storage unit 5 together with the client terminal 3 and date / time information that transmitted the information (S510). FIG. 5 shows an example of screen information received from the client terminal 3.

  The operation log information received by the operation log information receiving unit 6 includes the operation log information storage unit together with the client terminal 3 that transmitted the information and date / time information (when the operation log information does not include date / time information). 7 (S510).

  When the operation log information receiving unit 6 receives the operation log information, the operation determining unit 8 extracts the operation log information within a predetermined time stored in the operation log information storage unit 7. For example, the operation log information for five minutes before the time when the operation log information is received is extracted, and the operation content in each operation log information is extracted. Then, it is determined whether or not each operation content is a specific operation, and if it is a specific operation, the operation points associated therewith are accumulated (S520). In this way, the cumulative value of the operation points within a predetermined time can be calculated.

  Then, the accumulated value of the operation point is compared with a predetermined value (S530), and if the accumulated value is equal to or greater than the predetermined value (greater than the predetermined value), the operation determination unit 8 causes the display change processing unit 10 to store the operation log information. It is determined that display change processing is not performed on the associated screen information. As a result of the comparison, if the accumulated value is less than the predetermined value (below the predetermined value), the operation determination unit 8 causes the display change processing unit 10 to perform ideographic change processing on the screen information associated with the operation log information. It is determined to perform.

  When the operation determination unit 8 determines that the display change process is to be performed on the screen information associated with the operation log information, the display change processing unit 10 displays the screen information received by the screen information reception unit 4 as follows. Execute display change processing. That is, a display change process is performed so that the administrator makes the screen information unreadable in the entire area of the screen information (S540). Then, the screen information displayed on the display device 22 of the monitoring terminal 2 is displayed on the display device 22 of the client terminal 3 by the screen information display unit 11 as the screen information after the display change processing for the screen information is performed in S540. Information is displayed (S550). That is, the processed screen information as shown in FIG. 7 is displayed on the display device 22 of the monitoring terminal 2. In this case, the processed screen information may not be displayed.

  When the operation determining unit 8 determines that the display change process is not performed on the screen information associated with the operation log information, the display change processing unit 10 displays the screen change on the screen information. Does not perform display change processing. Therefore, the screen information display unit 11 causes the display device 22 of the monitoring terminal 2 to display the screen information received by the screen information receiving unit 4 as the screen information displayed on the display device 22 of the client terminal 3 (S560). ). That is, the screen information as shown in FIG. 5 is displayed on the display device 22 of the monitoring terminal 2.

  By doing so, it is determined whether the operator is performing a dangerous operation after taking into account the operation of the operator over time. If there is a risk, the display change process is not performed. When there is no danger, the display change process can be performed. Also in this embodiment, normally, the administrator of the monitoring terminal 2 cannot see the screen information displayed on the display device 22 of the client terminal 3, but when a specific operation is performed on the client terminal 3. The screen information displayed on the display device 22 of the client terminal 3 at that time can be confirmed. That is, the administrator can check whether the operator of the client terminal 3 is doing something illegal. As a result, the client terminal monitoring system 1 that achieves both monitoring by the administrator and privacy of the operator is possible.

  In the above-described embodiment, the case where the cumulative value of the operation points within a predetermined time is used in the case of the embodiment 1, but also in the case of the embodiment 2 to the embodiment 8, the operation content of the specific operation is simply described. Instead of the determination, the determination may be made using the accumulated value of the operation points within a predetermined time. That is, the operation content determination process of a specific operation is performed by extracting operation log information within a predetermined time as described above, calculating a cumulative value of those operation points, and comparing the cumulative value with a predetermined value. It can be executed by replacing it to make a determination.

  Moreover, although the case where the cumulative value is used has been described in the above-described embodiment, the processing may be performed using a calculation value obtained by performing a predetermined calculation other than the cumulative value instead of the cumulative value.

  In the above-described first to ninth embodiments, the case where the monitoring terminal 2 receives screen information and operation log information from each client terminal 3 and the monitoring terminal 2 performs display change processing on the screen information has been described. The client terminal 3 may be configured to perform a display change process on the screen information and pass the screen information on which the display change process has been performed to the monitoring terminal 2 (at this time, the screen information that has not been subjected to the display change process is also monitored) It may be given to the terminal 2).

  That is, the operation determination unit 8, the specific operation storage unit 9, the display change processing unit 10, the screen information analysis unit 12, the specific information storage unit 13, and the specific information determination unit 14 are provided in the client terminal 3, and the screen information reception unit 4. The screen information storage unit 5, the operation log information receiving unit 6, the operation log information storage unit 7, and the screen information display unit 11 can be configured to be provided in the monitoring terminal 2. Each storage unit may be provided in the monitoring terminal 2 so that the client terminal 3 makes an inquiry to the monitoring terminal 2 during the determination process of the operation determination unit 8 and the specific information determination unit 14. Each means may be distributed by a plurality of computer terminals.

  In the case of the above-described first to tenth embodiments, even when the screen information stored in the screen information storage unit 5 and not subjected to the display change process is displayed on the display device 22 of the monitoring terminal 2, You may display on the display apparatus 22 of the monitoring terminal 2 after performing the display change process in an Example. In other words, each process in the operation determination unit 8, the display change processing unit 10, the screen information analysis unit 12, the specific information determination unit 14, the screen information processing unit and the like is performed from the screen information storage unit 5. This may be done for no screen information.

  In the case of the above-described first to eleventh embodiments, whether or not the display change processing unit 10 performs the display change process is determined based on the number of times that the operation determination unit 8 determines that the specific operation is performed within a predetermined time. It can also be configured.

When the operation performed on the client terminal 3 by the client terminal monitoring system 1 described above is a predetermined operation, for example, an operation that is suspected of leakage of confidential information, the screen information at the time of the operation is displayed. On the other hand, in the case of an operation that is not predetermined, for example, a simple input operation, display change processing is performed on the screen information. As a result, for the operator side, in the normal operation, the administrator can no longer see the operator's screen, and the concern about privacy is eliminated. As a result, the client terminal monitoring system 1 that fulfills the needs of both the administrator side and the operator side becomes possible.

It is a conceptual diagram which shows the whole concept of this invention. It is a conceptual diagram which shows an example of the system configuration | structure of this invention. It is a conceptual diagram which shows an example of the hardware constitutions of the monitoring terminal of this invention. It is a flowchart which shows an example of the processing process of this invention. It is an example of the screen information received from a client terminal. It is an example of operation log information received from a client terminal. It is an example of the screen information which performed the display change process in Example 1. FIG. It is a conceptual diagram which shows another example of the system configuration | structure of this invention. It is a flowchart which shows another example of the processing process of this invention. It is an example of the screen information which performed the display change process in Example 2. FIG. It is a figure which shows typically an example of the specific information storage part which memorize | stores specific information and a point. It is an example of the screen information which performed the display change process in Example 3. It is a flowchart which shows another example of the processing process of this invention. It is a figure which shows typically an example of the specific information storage part which memorize | stores specific information, a point, and the range to display-change. It is an example of the screen information which performed the display change process in Example 4. It is an example of the screen information which performed the display change process in Example 5. It is a flowchart which shows another example of the processing process of this invention. It is a figure which shows typically an example of the specific operation memory | storage part which memorize | stores specific operation and an operation point.

Explanation of symbols

1: Client terminal monitoring system 2: Monitoring terminal 3: Client terminal 4: Screen information reception unit 5: Screen information storage unit 6: Operation log information reception unit 7: Operation log information storage unit 8: Operation determination unit 9: Specific operation storage Unit 10: Display change processing unit 11: Screen information display unit 12: Screen information analysis unit 13: Specific information storage unit 14: Specific information determination unit 20: Computing device 21: Storage device 22: Display device 23: Input device 24: Communication apparatus

Claims (16)

A client terminal monitoring system that performs operation management of each client terminal using screen information displayed on a display device of each client terminal,
The client terminal monitoring system includes:
A screen information receiving unit that receives the screen information displayed on the display device of each client terminal from each client terminal; and
An operation log information receiving unit that receives the operation log information of each client terminal from each client terminal; and
A specific operation storage unit for storing at least a predetermined specific operation;
An operation determination unit that determines whether the operation content in the received operation log information is the specific operation;
Using the determination result, a display change processing unit that performs a display change process on a part or all of the received screen information;
A screen information display unit for displaying the screen information subjected to the display change process on a predetermined display device;
A client terminal monitoring system comprising: The display change processing unit
If the determination result is a specific operation, display change processing is not performed on the received screen information.
If the determination result is not a specific operation, display change processing is performed on the entire area of the received screen information.
The client terminal monitoring system according to claim 1. A client terminal monitoring system that performs operation management of each client terminal using screen information displayed on a display device of each client terminal,
The client terminal monitoring system includes:
A screen information receiving unit that receives the screen information displayed on the display device of each client terminal from each client terminal; and
An operation log information receiving unit that receives the operation log information of each client terminal from each client terminal; and
A specific operation storage unit for storing at least a predetermined specific operation and an operation point corresponding thereto;
In the operation log information within a predetermined time, it is determined whether the operation content in each operation log information is the specific operation, and in the case of the specific operation, the cumulative value of the operation point is calculated, and the cumulative value is a predetermined value An operation determination unit that determines whether the condition is satisfied;
Using the determination result, a display change processing unit that performs a display change process on a part or all of the received screen information;
A screen information display unit for displaying the screen information subjected to the display change process on a predetermined display device;
A client terminal monitoring system comprising: The display change processing unit
When the determination result satisfies a predetermined condition, display change processing is not performed on the received screen information.
When the determination result does not satisfy a predetermined condition, a display change process is performed on the entire area of the received screen information.
The client terminal monitoring system according to claim 3. The client terminal monitoring system further includes:
A screen information analysis unit that extracts character information included in the screen information by performing character recognition processing on the screen information according to a determination result of whether the specific operation is performed,
A specific information storage unit for storing at least predetermined specific information;
A specific information determination unit that determines whether there is character information that matches the specific information stored in the specific information storage unit for the extracted character information;
The display change processing unit
When it is determined that there is character information that matches the specific information, a display change process is performed for a part or all of the character information area other than the character information that matches the specific information in the screen information.
The client terminal monitoring system according to any one of claims 1 to 4, wherein The client terminal monitoring system further includes:
A screen information analysis unit that extracts character information included in the screen information by performing character recognition processing on the screen information according to a determination result of whether the specific operation is performed,
A specific information storage unit that stores at least predetermined specific information and a point corresponding to the specific information;
For the extracted character information, it is determined whether there is character information that matches the specific information stored in the specific information storage unit, and a comparison point is calculated by using the point of the specific information corresponding to the matched character information And a specific information determination unit that compares the comparison point with a predetermined point,
The display change processing unit
When the comparison point satisfies a predetermined condition with respect to a predetermined point, display change processing is performed for some or all character information areas other than character information that matches the specific information in the screen information. ,
The client terminal monitoring system according to any one of claims 1 to 4, wherein The client terminal monitoring system further includes:
A screen information analysis unit that extracts character information included in the screen information by performing character recognition processing on the screen information according to a determination result of whether the specific operation is performed,
A specific information storage unit for storing at least predetermined specific information and information in a range in which display change processing is not performed on the specific information;
A specific information determination unit that determines whether there is character information that matches the specific information stored in the specific information storage unit for the extracted character information;
The display change processing unit
When it is determined that there is character information that matches the specific information, in the screen information, part or all of the character information outside the predetermined range corresponding to the specific information of the character information that matches the specific information , Display change processing,
The client terminal monitoring system according to any one of claims 1 to 4, wherein The client terminal monitoring system further includes:
A screen information analysis unit that extracts character information included in the screen information by performing character recognition processing on the screen information according to a determination result of whether the specific operation is performed,
A specific information storage unit that stores at least predetermined information, a point corresponding to the specific information, and information on a range in which display change processing is not performed on the specific information or the point;
For the extracted character information, it is determined whether there is character information that matches the specific information stored in the specific information storage unit, and a comparison point is calculated by using the point of the specific information corresponding to the matched character information And a specific information determination unit that compares the comparison point with a predetermined point,
The display change processing unit
When the comparison point satisfies a predetermined condition with respect to a predetermined point, in the screen information, part or all of the character information that matches the specific information outside the predetermined range corresponding to the specific information Perform display change processing for the text information area.
The client terminal monitoring system according to any one of claims 1 to 4, wherein The display change processing unit
In the screen information corresponding to the received operation log information, display change processing is performed on a part or all of the area other than the window area for the operation log information.
The client terminal monitoring system according to any one of claims 1 to 4, wherein The display change processing unit
In the screen information corresponding to the received operation log information, display change processing is performed on a part or all of the area other than the active window area by detecting the active window area.
The client terminal monitoring system according to any one of claims 1 to 4, wherein The client terminal monitoring system further includes:
A screen information analysis unit that extracts character information included in the screen information by performing character recognition processing on the screen information according to a determination result of whether the specific operation is performed;
The display change processing unit
In the screen information corresponding to the received operation log information, a window area is detected,
The character information extracted by the screen information analysis unit is compared with the application identification information that is the target of the operation content of the operation log information to determine the character information that matches, and includes the determined character information Perform display change processing for some or all areas other than the window area.
The client terminal monitoring system according to any one of claims 1 to 4, wherein The display change processing unit
Based on the operation log information received by the operation log information receiving unit, the range for performing the display change process is changed.
12. The client terminal monitoring system according to claim 1, wherein the client terminal monitoring system is any one of claims 1 to 11. A client terminal monitoring system that performs operation management of each client terminal using screen information displayed on a display device of each client terminal, wherein the client terminal monitoring system includes an operation determination unit, a display change processing unit, And a monitoring terminal having a screen information receiving unit and a screen information display unit,
The operation determination unit is
It is determined whether the operation content in the operation log information of the client terminal is a specific operation stored in a predetermined storage area,
The display change processing unit
Using the determination result, display change processing is performed for a part or all of the received screen information, and at least the display change processing screen information is transmitted to the monitoring terminal,
The screen information receiving unit
Receiving screen information subjected to display change processing at least in each client terminal;
The screen information display unit
Displaying the screen information subjected to the display change process on a display device of the monitoring terminal;
A client terminal monitoring system. A client terminal monitoring system that performs operation management of each client terminal using screen information displayed on a display device of each client terminal, wherein the client terminal monitoring system includes an operation determination unit, a display change processing unit, And a monitoring terminal having a screen information receiving unit and a screen information display unit,
The operation determination unit is
In the operation log information within a predetermined time of the client terminal, it is determined whether the operation content in each operation log information is a specific operation stored in a predetermined storage area, and in the case of the specific operation, the predetermined storage Calculate a cumulative value of operation points associated with the specific operation stored in the area, determine whether the cumulative value satisfies a predetermined condition,
The display change processing unit
Using the determination result, display change processing is performed for a part or all of the received screen information, and at least the display change processing screen information is transmitted to the monitoring terminal,
The screen information receiving unit
Receiving screen information subjected to display change processing at least in each client terminal;
The screen information display unit
Displaying the screen information subjected to the display change process on a display device of the monitoring terminal;
A client terminal monitoring system. A computer terminal having a storage device including a specific operation storage unit that stores at least a predetermined specific operation,
A screen information receiving unit that receives screen information displayed on the display device of each client terminal from each client terminal;
An operation log information receiving unit for receiving operation log information of each client terminal from each client terminal;
An operation determination unit that determines whether the operation content in the received operation log information is a specific operation stored in the specific operation storage unit;
A display change processing unit that performs a display change process on a part or all of the received screen information using the determination result;
A screen information display unit for displaying the screen information subjected to the display change process on a predetermined display device;
A client terminal monitoring program characterized by being caused to function as: A computer terminal having a storage device including a specific operation storage unit that stores at least a predetermined specific operation and an operation point corresponding thereto.
A screen information receiving unit that receives screen information displayed on the display device of each client terminal from each client terminal;
An operation log information receiving unit for receiving operation log information of each client terminal from each client terminal;
In the operation log information within a predetermined time, it is determined whether the operation content in each operation log information is a specific operation stored in the specific operation storage unit, and in the case of the specific operation, the cumulative value of the operation points is calculated. , An operation determination unit that determines whether the accumulated value satisfies a predetermined condition,
A display change processing unit that performs a display change process on a part or all of the received screen information using the determination result;
A screen information display unit for displaying the screen information subjected to the display change process on a predetermined display device;
A client terminal monitoring program characterized by being caused to function as:

Images