JP3954642B1 - Screen storage system - Google Patents

Abstract

【Task】
An object of the present invention is to provide a screen storage system that stores a screen displayed on a display device of a computer terminal within a proper range according to the operation when a predetermined operation is performed.
[Solution]
An operation screen information receiving unit that receives operation screen information, an operation screen information temporary storage unit that temporarily stores operation screen information, an operation log information reception unit that receives operation log information, and operation log information and start point information that serve as a trigger And the operation type information storage unit that stores the end point information in association with each other, the received operation log information, and the operation log information of the trigger are compared to determine whether to save. An operation log information comparing unit that extracts start point information and end point information corresponding to the operation log information, extracts operation screen information between the start point information and end point information, and an operation screen information storage unit that stores the extracted operation screen information And a screen storage system.
[Selection] Figure 1

Description

The present invention relates to a screen storage system that stores a screen displayed on a display device of a computer terminal within a suitable range according to the operation when a predetermined operation is performed.

  In an organization such as a company, a plurality of computer terminals are used for performing the business. In recent years, due to the growing interest in information leakage, operations at each computer terminal can be recorded and saved as a log. Has been done. However, there are many systems that store the screen displayed on the display device of the computer terminal because it is often difficult to know what kind of data is actually displayed on the screen from the log information alone.

  By saving the screen as image information, it is very useful because it is possible to confirm what data is displayed on the display device of the computer terminal. However, when there are a large number of managed computer terminals, such as several hundred, for example, a large amount of storage area is consumed for sequentially storing the screens of the computer terminals as image information. Therefore, it is required to efficiently save the screen as image information. As such a technique, there are those described in the following patent documents.

JP 2005-149267 A JP 2003-44320 A JP 2006-146411 A

  In the invention of Patent Document 1, when an unauthorized operation is detected in a computer terminal, a screen displayed on the display device of the computer terminal is stored as image information. Since it is important to know what operation was performed on the computer terminal when an unauthorized operation occurred, such an invention is useful, but what kind of operation is an unauthorized operation in the first place, and Since it is not known how long the screen should be stored as image information after the operation is detected, there is a problem that even unnecessary portions after the illegal operation is stored as image information. For example, copying confidential information to a removable disk should be refrained from the viewpoint of preventing information leakage, but the operation performed there is only "copying a file". Since this operation itself is also performed in normal business, it is difficult to position “file copy” as an unauthorized operation. Therefore, it is not possible to prevent information leakage due to such an operation. Once it is detected as an unauthorized operation, the screen is saved as image information. However, since it is unclear at which point the storage can be finished, the administrator will end up saving the operation manually. And the administrator has to select useless image information and necessary image information in the meantime, which is very burdensome.

  In the invention of Patent Document 2, when a specific operation in the monitored terminal is detected, the screen displayed on the display device of the monitored terminal is stored as image information. Also in this case, as in the case of the above-mentioned Patent Document 1, it is unclear when to end the storage after the start of the screen storage. This is very burdensome because the administrator has to select wasteful image information and necessary image information in the meantime.

  In the invention of Patent Document 3, the screen at the time when the displayed screen is switched is stored as image information. By using this invention, it may be preferable to save the transition of the display screen as the conference information in the conference as disclosed in Patent Document 3, but the screen can be saved only at the timing when the screen is switched. , It is not suitable for use as a monitoring system for preventing information leakage that requires storage over time in a series of operations.

  In view of the above problems, the inventor of the present application, when detecting a predetermined operation, displays the image displayed on the display device of the computer terminal while the processing corresponding to the operation is preset. Invented a screen storage system to store as

  The invention of claim 1 is a screen storage system for storing operation screen information displayed on the display device of each client terminal, and receives operation screen information displayed on the display device of each client terminal from each client terminal. An operation screen information receiving unit, an operation screen information temporary storage unit for temporarily storing the operation screen information received by the operation screen information receiving unit, and an operation log for receiving operation log information in each client terminal from each client terminal An operation type information storage unit that stores an information reception unit, operation log information serving as a trigger for saving operation screen information, start point information for starting the save, and end point information for ending the save; By comparing the received operation log information with the operation log information serving as the trigger in the operation type information storage unit, an operation is performed. It is determined whether to save screen information. When saving operation screen information, the start point information and end point information corresponding to the operation log information are extracted from the operation type information storage unit, and the start point information and An operation log information comparison unit that extracts operation screen information between end point information from the operation screen information temporary storage unit, and an operation that stores the operation screen information extracted from the operation screen information temporary storage unit by the operation log information comparison unit And a screen information storage unit.

  By configuring as in the present invention, it is possible to specify from which time point (start point) to which time point (end point) should be stored when the operation screen information is stored. This makes it unnecessary to store unnecessary operation screen information, unlike the conventional case. In addition, in the past, there has been a need for the administrator to select necessary operation screen information from the operation screen information that has started saving, but there is no need to perform such work, and the necessary operation screen information is automatically obtained. Will be saved.

  In the invention of claim 2, the screen storage system further includes an operation log information storage unit that stores the operation log information received by the operation log information reception unit, and the operation type information storage unit includes the operation log information storage unit. The start point information is operation log information to start saving, the end point information is operation log information to end saving, and the operation log information comparison unit becomes the start point when saving the operation screen information. The operation log information and the operation log information serving as an end point are extracted from the operation type information storage unit, and the operation log information serving as the extracted start point and the end point among the operation log information stored in the operation log information storage unit Each date and time information of the operation log information is extracted, and operation screen information between the date and time information of the operation log information as the start point and the date and time information of the operation log information as the end point is stored in the operation screen information temporary storage unit. To extract, it is a screen storage system.

  In the above-mentioned invention, it is preferable that which operation screen information is stored is configured as in the present invention.

  The invention of claim 3 is a screen storage system for transmitting operation screen information displayed on the display device of the client terminal to the management terminal, and temporarily stores the operation screen information displayed on the display device of the client terminal. An operation screen information temporary storage unit, an operation log information storage unit for storing operation log information in the client terminal, an operation log information serving as a trigger for storing the operation screen information, and start point information for starting the storage, By comparing the operation type information storage unit that stores the end point information that ends the storage in association with each other, the operation log information, and the operation log information that serves as the trigger in the operation type information storage unit, the operation screen It is determined whether information is to be saved, and when saving operation screen information, the start type information and end point information corresponding to the operation log information are used as the operation type information. An operation log information comparing unit that extracts the operation screen information between the start point information and the end point information from the operation screen information temporary storage unit, and the operation log information comparison unit includes the operation screen information temporary storage unit. An operation screen information storage unit that stores operation screen information extracted from the operation screen information storage unit, and an operation screen information transmission unit that transmits operation screen information stored in the operation screen information storage unit to the management terminal.

  With the configuration of the present invention, the same processing as that of the above-described invention can be executed in the client terminal. As a result, necessary operation screen information is automatically selected at the client terminal, so that only necessary operation screen information is transmitted to the management terminal. As a result, the operation terminal information received from each client terminal need only be stored as before without changing the configuration of the management terminal.

  5. The screen storage system according to claim 4, wherein the operation screen information temporary storage unit further deletes the temporarily stored operation screen information at a predetermined timing.

  If the operation screen information temporarily stored is stored indefinitely, a useless storage area is used, and the performance of the computer terminal is deteriorated. Therefore, it is preferable to delete at a predetermined timing as in the present invention.

  The invention according to claim 5 is a management comprising a storage device that stores operation log information serving as a trigger for saving operation screen information, start point information for starting the save, and end point information for ending the save in association with each other. An operation screen information receiving unit that receives operation screen information displayed on the display device of each client terminal from each client terminal and temporarily stores it in the storage device of the management terminal, operation log information in each client terminal The operation log information receiving unit that receives from each client terminal, whether the received operation log information is compared with the operation log information serving as the trigger stored in the storage device, thereby saving the operation screen information. When the operation screen information is stored, the start point information and end point information corresponding to the operation log information are extracted from the storage device. An operation log information comparison unit that extracts operation screen information between the start point information and end point information from the storage device, and an operation screen information storage unit that stores the operation screen information extracted from the storage device by the operation log information comparison unit , A screen storage program that functions as.

  The above-described screen storage system can be constructed by reading and executing the screen storage program of the present invention on the management terminal.

By using the present invention, when a predetermined operation is detected, it is possible to sequentially save a screen while being set as a process corresponding to the operation. Therefore, since the timing to end screen saving is determined as in the conventional screen saving system, it is not necessary to save useless screens, and the screen image information required by the administrator and unnecessary screens are saved. It is not necessary to perform separation from the image information. In addition, since unnecessary screen image information is not saved, the storage area is not wasted.

  An overall conceptual diagram of the present invention is shown in FIG.

  The screen storage system 1 is realized by reading and processing a predetermined program in a computer terminal or server (hereinafter referred to as “management terminal 2”) used by an administrator who monitors each client terminal 3 ( Note that this program may be realized by being read into the client terminal 3). The management terminal 2 stores and monitors what program is being executed in the plurality of client terminals 3, what operation is being executed, and what screen is being displayed on the display device 22. Accordingly, information such as the program name and file name executed in the client terminal 3 and information input to the client terminal 3 through the input device 23 are periodically or newly stored in each client terminal 3. A function for transmitting information of the operation log from the client terminal 3 to the management terminal 2 at a predetermined timing such as when a program or file is executed or when it is terminated, and a screen displayed on the display device 22 of the client terminal 3 Is captured and transmitted to the management terminal 2 regularly or irregularly. The function of transmitting the operation log is to extract a program name and a file name executed in the arithmetic unit 20 of the client terminal 3, extract a program name and a file name in the memory, and an input device of the client terminal 3 The information input at 23 may be transmitted. In order to capture the screen, for example, screen information displayed on the screen may be read from the VRAM and transmitted as screen information.

  The management terminal 2 includes an arithmetic device 20 such as a CPU that executes arithmetic processing of a program, a storage device 21 such as a RAM and a hard disk that stores information, and processing results of the arithmetic device 20 and information to be stored, such as the Internet and a LAN. It includes at least a communication device 24 that transmits and receives via a network and a display device 22 such as a display. Each function (each unit) realized on the computer is executed when a unit (program, module, etc.) for executing the process is read into the arithmetic unit 20. When using the information stored in the storage device 21 in the processing, each function reads the corresponding information from the storage device 21 and uses the read information for processing in the arithmetic device 20 as appropriate. The management terminal 2 may have an input device 23 such as a keyboard, a mouse, or a numeric keypad. FIG. 3 schematically shows an example of the hardware configuration of the management terminal 2. Further, the management terminal 2 may have its functions distributed in a plurality of computer terminals or servers.

  Each means in the present invention is only logically distinguished in function, and may be physically or practically the same area.

  A conceptual diagram schematically showing an example of the system configuration of the screen storage system 1 is shown in FIG. In the present embodiment, a case where processing related to the operation screen is performed in the management terminal 2 will be described.

  The management terminal 2 includes an operation screen information reception unit 4, an operation screen information temporary storage unit 5, an operation log information reception unit 6, an operation log information storage unit 7, an operation type information storage unit 8, an operation log information comparison unit 9, and an operation screen. And an information storage unit 10.

  The operation screen information receiving unit 4 receives screen information of the operation screen displayed on the display device 22 of the client terminal 3 as image information from each client terminal 3 regularly or irregularly. The received image information is temporarily stored in the operation screen information temporary storage unit 5 described later. When the operation screen information is stored in the operation screen information temporary storage unit 5, the operation screen information reception unit 4 stores the date and time and information for identifying which client terminal 3 is the operation screen information. When the management terminal 2 receives operation screen information from each client terminal 3, it may be received via a network, or the operation screen information is recorded on a recording medium such as a DVD in the client terminal 3, and the recording medium is managed by the management terminal 2 It may be read by the terminal 2 and received by reading operation screen information therefrom.

  The operation screen information temporary storage unit 5 temporarily stores the operation screen information received from each client terminal 3 by the operation screen information reception unit 4 as image information. The operation screen information temporarily stored here is preferably deleted after a predetermined time. The operation screen information is preferably saved for each client terminal 3 or each user (login name, etc.).

  The operation log information reception unit 6 receives operation log information in the client terminal 3 from each client terminal 3 regularly or irregularly. The received operation log information is stored in the operation log information storage unit 7 to be described later together with the date and time and information for identifying which client terminal 3 is the operation log information. The operation log information may be information indicating the operation content in each client terminal 3, and indicates the operation of the user of the client terminal 3, such as “file copy”, “file selection”, “drive addition”, and the like. Information applies. When the management terminal 2 receives operation log information from each client terminal 3, it may be received via a network, or the operation log information is recorded on a recording medium such as a DVD in the client terminal 3, and the recording medium is managed by the management terminal 2 It may be read by the terminal 2 and received by reading operation log information therefrom.

  The operation log information storage unit 7 stores the operation log information received from each client terminal 3 by the operation log information reception unit 6. An example of the operation log information is schematically shown in FIG. The operation log information is preferably stored for each client terminal 3 or its user (login name or the like).

  The operation type information storage unit 8 stores the operation for saving the screen information and from where (start point) to where (end point) the screen information should be saved. FIG. 6 schematically shows an example of the operation type information storage unit 8. As the operation type information, the administrator can arbitrarily set which operation log information is to be stored when the screen information is stored. In addition, the administrator can arbitrarily set operation log information serving as a starting point for saving screen information and operation log information serving as an end point.

  Based on the operation log information received by the operation log information reception unit 6, the operation log information comparison unit 9 determines whether the operation log information is a trigger for starting the saving of the screen information. Comparison and determination are made by referring to FIG. For example, if the received operation log information is “file copy”, it is determined because it is operation log information stored in the operation type information storage unit 8 and serving as a trigger for saving screen information. If it is “new file creation”, the operation log information receiving unit 6 receives the next operation log as it is because it is not stored in the operation type information storage unit 8 as the operation log information of the trigger for saving the screen information. Wait for.

  Further, when it is determined that the screen information is to be saved as a result of the above comparison and determination, the operation log information comparison unit 9 extracts the operation screen information corresponding to the start point and the end point from the operation screen information temporary storage unit 5. And it is memorize | stored in the operation screen information storage part 10 mentioned later. This extraction may be performed based on date and time information, information for identifying the client terminal 3, and the like in the operation log information.

  The operation screen information storage unit 10 stores the operation screen information determined by the operation log information comparison unit 9 to store the screen information.

  Next, an example of the processing process of the screen storage system 1 in the present embodiment will be described with reference to the flowchart of FIG. 4 and the conceptual diagram of FIG.

  From each client terminal 3 to the management terminal 2, information on various operations (operation log information) performed from the input device 23 of the client terminal 3 and operation screen information displayed on the display device 22 of the client terminal 3 are stored. Are transmitted regularly or at a predetermined timing. The operation screen information is received by the operation screen information reception unit 4 of the management terminal 2, and the operation log information is received by the operation log information reception unit 6 of the management terminal 2 (S100). Note that the timing for recording the operation log information and the timing for capturing the operation screen information may be the same or different.

  When receiving the operation screen information from each client terminal 3, the operation screen information receiving unit 4 temporarily stores the received operation screen information together with the date and time, the identification information indicating which client terminal 3 is the operation screen information. The unit 5 temporarily stores it (S110).

  Further, when the operation log information receiving unit 6 receives the operation log information from each client terminal 3, the operation log information is stored in the operation log information together with the date and time, the identification information indicating which client terminal 3 is the operation log information. The data is stored in the unit 7 (S110).

  When the operation log information is received, the operation log information comparison unit 9 determines whether the operation log information received by the operation log information reception unit 6 is operation log information that triggers to start saving screen information. Comparison is made by referring to the storage unit 8 (for example, FIG. 6) (S120).

  As a result of this comparison, when the operation log information stored in the operation type information storage unit 8 and serving as a trigger for saving the screen information matches the received operation log information (S130), the matched operation The operation log information as the start point and the operation log information as the end point in the operation type information corresponding to the log information are extracted (S140).

  For example, the received operation log information is “file copy”, and “file copy” is stored in the operation type information storage unit 8 as shown in FIG. If it matches, the information of the start point and end point of the “file copy”, that is, the information of “selection operation of file of the same title” and “operation of file copy” is extracted.

  Then, the operation log information comparison unit 9 specifies the time point of the start point and the time point of the end point by referring to the operation log information storage unit 7, and the operation screen information in the client terminal 3 in the meantime is obtained as the operation screen information. Extracted from the temporary storage unit 5 and stored in the operation screen information storage unit 10 (S150).

  For example, in the above-described case, in the operation log information “file copy”, the operation that is the starting point for starting the saving of the operation screen information is “selecting the file with the same title”, and the operation that is the ending point is “file copy operation”. Can be extracted from the operation type information storage unit 8, the operation log information comparison unit 9 searches the operation log information storage unit 7 for the corresponding operation. In other words, if the operation log information “file copy” is selected, for example, for the file name “customer information (confidential)”, the file name “customer information (secret)” and the file name “customer” are selected. The operation log information storage unit 7 identifies the time point of the file copy operation of “information (confidential)”. In this case, it is preferable that the identification is performed using identification information such as the three client terminals.

  Then, the time of the selection operation of the file name “customer information (confidential)” is “January 30, 2007 11:18”, and the time of the file copy operation of the file name “customer information (confidential)” is “2007 1”. Therefore, the operation log information comparison unit 9 determines the operation screen information of the client terminal 3 (the client terminal 3 of “SKY123456” in the case of the operation log information in FIG. 5) during this period. Extracted from the operation screen information temporary storage unit 5 and stored in the operation screen information storage unit 10. This is schematically shown in FIG.

  In this way, by specifying the start point and end point timing for saving operation screen information, there is no need for the administrator to search for only the necessary portion of the operation screen information later, and unnecessary operation screen information is saved. There is no need to keep it.

  Next, another embodiment of the present invention will be described. In the first embodiment, the operation screen information and the operation log information are transmitted from each client terminal 3 to the management terminal 2 regularly or irregularly. However, in this embodiment, the operation screen information and the operation log information are batch processed. The case of transmitting to the management terminal 2 will be described.

  In this case, the operation screen information receiving unit 4 receives a plurality of operation screen information transmitted by batch processing from each client terminal 3 and stores it in the operation screen information temporary storage unit 5. The operation log information receiving unit 6 receives a plurality of operation log information transmitted from each client terminal 3 by batch processing and stores it in the operation log information storage unit 7 (each operation log information is rearranged in time series). Preferably).

  The operation log information comparison unit 9 is operation log information serving as a trigger for starting to save screen information, which sequentially stores each operation log information stored in the operation log information storage unit 7 in the operation type information storage unit 8. To compare.

  For example, when the operation log information sent by batch processing is shown in FIG. 5, the operation log information of “Start menu active” of the first operation log information “January 30, 2007 11:18” is shown in FIG. It is compared whether or not it matches the operation log information that is stored in the operation type information storage unit 8 as shown in FIG. Since they do not match here, the operation log information of the next operation log information, “customer information (secret) file selection” of “January 30, 2007 11:18”, is the operation type information as shown in FIG. It is compared whether or not it matches the operation log information stored in the storage unit 8 and serving as a trigger for saving the operation screen information. Since the operation log information sent in batch processing includes a plurality of operation log information, the operation log information stored in the operation type information storage unit 8 is sequentially stored in the operation log information. Whether the operation log information matches with the trigger is compared. If the operation log information matches, the operation log information comparison unit 9 similar to that in the first embodiment performs the process to store the operation screen information from the operation screen information temporary storage unit 5. Is extracted and stored in the operation screen information storage unit 10.

  Then, after the above-described processing is performed on all the operation log information received by the batch processing, or after the processing is finished and a certain time has elapsed, the operation screen information (operation screen which is no longer necessary) stored in the operation screen information temporary storage unit 5 is stored. The operation screen information that has not been saved in the information saving unit 10 is deleted.

  In the above-described processing, when the operation screen information stored in the operation screen information temporary storage unit 5 matches the operation log information serving as a trigger, the start point and the end point are specified, and the operation screen information between them is sequentially determined. Although the case where it preserve | saves to the operation screen information preservation | save part 10 was demonstrated, after specifying the start point and the end point, after processing the next operation log information and performing the process which concerns on all the operation log information, each identified The operation screen information between the start point and the end point may be extracted from the operation screen information temporary storage unit 5 and stored in the operation screen information storage unit 10.

  In the first embodiment and the second embodiment described above, the management terminal 2 receives the operation screen information and the operation log information from each client terminal 3 and executes the processing. In this embodiment, the processing is performed on the client terminal. 3 will be described. The basic processing is the same as in the first and second embodiments.

  In this case, each client terminal 3 includes an operation screen information temporary storage unit 5, an operation log information storage unit 7, an operation log information comparison unit 9, an operation type information storage unit 8, an operation screen information storage unit 10, an operation screen information transmission. Unit 11 and operation log information transmission unit 12 are provided. An example of the system configuration in this case is shown in FIG. In the following description, the processing similar to that in the first embodiment is described in the case where the client terminal 3 performs the processing.

  The operation screen information temporary storage unit 5 extracts operation screen information displayed on the display device 22 of the client terminal 3 from the VRAM or the like, and temporarily stores it as image information. The operation screen information temporarily stored here is preferably deleted after a predetermined time. The operation screen information is preferably saved every day.

  The operation log information storage unit 7 stores operation log information in the client terminal 3. In this operation log information, information indicating the operation content at each terminal is stored in association with the date and time.

  The operation type information storage unit 8 stores the operation for saving the screen information and from where (start point) to where (end point) the screen information should be saved. FIG. 6 schematically shows an example of the operation type information storage unit 8. The operation type information can be arbitrarily set by the administrator as to which operation log is detected when the screen information is stored. Also, the administrator can arbitrarily set the operation as the starting point and the operation as the end point for saving the screen information.

  The operation log information comparison unit 9 starts saving screen information based on operation log information stored in the operation log information storage unit 7 or operation log information input from the input device 23 of the client terminal 3 or the like. Whether or not the operation log is a trigger is compared and determined by referring to the operation type information storage unit 8 (for example, FIG. 6). For example, if the received operation log information is “file copy”, it is determined because it is operation log information stored in the operation type information storage unit 8 and serving as a trigger for saving screen information. If it is “new file creation”, the operation log information receiving unit 6 receives the next operation log as it is because it is not stored in the operation type information storage unit 8 as the operation log information of the trigger for saving the screen information. Wait for.

  Further, when it is determined that the screen information is to be saved as a result of the above comparison and determination, the operation log information comparison unit 9 extracts the operation screen information corresponding to the start point and the end point from the operation screen information temporary storage unit 5. And it is memorize | stored in the operation screen information storage part 10 mentioned later. This extraction may be performed based on date and time information in the operation log information.

  The operation screen information storage unit 10 stores the operation screen information determined by the operation log information comparison unit 9 to store the screen information.

  The operation screen information transmission unit 11 manages the operation screen information stored in the operation screen information storage unit 10 or the operation screen information extracted by the operation log information comparison unit 9 from the operation screen information temporary storage unit 5 at a predetermined timing. 2 to send.

  The operation log information transmission unit 12 transmits the operation log information stored in the operation log information storage unit 7 to the management terminal 2 at a predetermined timing. The operation screen information and the operation log information may be transmitted to the management terminal 2 at the same timing.

  Next, an example of the processing process of the screen storage system 1 in the present embodiment will be described with reference to the flowchart of FIG. 9 and the conceptual diagram of FIG.

  In each client terminal 3, information (operation log information) of various operations performed from the input device 23 of the client terminal 3 is stored in the operation log information storage unit 7 of the client terminal 3 periodically or at a predetermined timing. (S200). Further, the operation screen information displayed on the display device 22 of the client terminal 3 is extracted as image information from the VRAM or the like periodically or at a predetermined timing, and temporarily stored in the operation screen information temporary storage unit 5. (S200). These operation log information and operation screen information are preferably stored and temporarily stored in association with the date and time.

  When the operation log information comparison unit 9 receives new operation log information, the operation log information comparison unit 9 determines whether the received operation log information is an operation log serving as a trigger to start saving screen information (for example, FIG. Comparison is made by referring to 6) (S210).

  As a result of this comparison, when the operation log information stored in the operation type information storage unit 8 and serving as a trigger for saving the screen information matches the received operation log information (S220), the matched operation The operation log information as the start point and the operation log information as the end point in the operation type information corresponding to the log information are extracted (S230).

  For example, the received operation log information is “file copy”, and “file copy” is stored in the operation type information storage unit 8 as shown in FIG. If it matches, the information of the start point and end point of the “file copy”, that is, the information of “selection operation of file of the same title” and “operation of file copy” is extracted.

  Then, the operation log information comparison unit 9 specifies the time point of the start point and the time point of the end point by referring to the operation log information storage unit 7, and the operation screen information in the client terminal 3 in the meantime is obtained as the operation screen information. Extracted from the temporary storage unit 5 and stored in the operation screen information storage unit 10 (S240).

  For example, in the above-described case, in the operation log information “file copy”, the operation that is the starting point for starting the saving of the operation screen information is “selecting the file with the same title”, and the operation that is the ending point is “file copy operation”. Can be extracted from the operation type information storage unit 8, the operation log information comparison unit 9 searches the operation log information storage unit 7 for the corresponding operation. In other words, if the operation log information “file copy” is selected, for example, for the file name “customer information (confidential)”, the file name “customer information (secret)” and the file name “customer” are selected. The operation log information storage unit 7 identifies the time point of the file copy operation of “information (confidential)”.

  Then, the time of the selection operation of the file name “customer information (confidential)” is “January 30, 2007 11:18”, and the time of the file copy operation of the file name “customer information (confidential)” is “2007 1”. The operation log information comparison unit 9 extracts the operation screen information during this period from the operation screen information temporary storage unit 5 and stores it in the operation screen information storage unit 10. This is schematically shown in FIG.

  The operation screen information transmission unit 11 transmits the operation screen information stored in the operation screen information storage unit 10 in this way to the management terminal 2 at a predetermined timing (S250). Similarly, the operation log information transmission unit 12 transmits the operation log information stored in the operation log information storage unit 7 to the management terminal 2 at a predetermined timing (S250).

  As in the first and second embodiments, the processing of this embodiment also specifies the start point and the end point timing for saving the operation screen information, so that the administrator can search for only the necessary portion of the operation screen information later. And there is no need to save useless operation screen information.

  Further, unlike the first and second embodiments, since the main processing is performed in the client terminal 3, the management terminal 2 needs to receive only necessary operation screen information. Therefore, the processing burden on the management terminal 2 is reduced as compared with the case of the first and second embodiments.

By using the screen storage system 1 of the present invention, when a predetermined operation is detected, it is possible to sequentially store the screen while being set as a process corresponding to the operation. Therefore, since the timing for ending screen saving is determined as in the conventional screen saving system 1, it is not necessary to save useless screens, and the screen image information necessary for the administrator and unnecessary. It is not necessary to separate the image information from the screen. In addition, since unnecessary screen image information is not saved, the storage area is not wasted.

It is a figure which shows typically the whole conceptual diagram of this invention. It is a figure which shows typically an example of the system configuration | structure of this invention. It is a figure which shows an example of the hardware constitutions of a management terminal typically. It is a flowchart which shows an example of the process of this invention typically. It is a figure which shows typically the operation log information storage part. It is a figure which shows typically the operation type information storage part. It is a conceptual diagram which shows typically the start point and end point which extract operation screen information. It is a figure which shows typically an example of the other system configuration | structure of this invention. It is a flowchart which shows an example of the other process of this invention typically.

Explanation of symbols

1: Screen storage system 2: Management terminal 3: Client terminal 4: Operation screen information reception unit 5: Operation screen information temporary storage unit 6: Operation log information reception unit 7: Operation log information storage unit 8: Operation type information storage unit 9 : Operation log information comparison unit 10: Operation screen information storage unit 11: Operation screen information transmission unit 12: Operation log information transmission unit 20: Computing device 21: Storage device 22: Display device 23: Input device 24: Communication device

Claims (5)

A screen storage system for storing operation screen information displayed on a display device of each client terminal,
An operation screen information receiving unit that receives operation screen information displayed on the display device of each client terminal from each client terminal;
An operation screen information temporary storage unit for temporarily storing the operation screen information received by the operation screen information reception unit;
Operation log information reception unit for receiving operation log information from each client terminal from each client terminal;
An operation type information storage unit that stores operation log information serving as a trigger for saving operation screen information, start point information for starting the save, and end point information for ending the save in association with each other;
When it is determined whether to save operation screen information by comparing the received operation log information with the operation log information serving as the trigger in the operation type information storage unit, and when saving operation screen information Extracts the start point information and end point information corresponding to the operation log information from the operation type information storage unit, and extracts operation screen information between the start point information and end point information from the operation screen information temporary storage unit A log information comparison unit;
An operation screen information storage unit for storing operation screen information extracted from the operation screen information temporary storage unit by the operation log information comparison unit;
A screen storage system comprising: The screen storage system further includes:
An operation log information storage unit that stores the operation log information received by the operation log information reception unit,
The start point information of the operation type information storage unit is operation log information that starts saving, and the end point information is operation log information that ends saving,
The operation log information comparison unit
When saving the operation screen information, the operation log information serving as the start point and the operation log information serving as the end point are extracted from the operation type information storage unit and stored in the operation log information storage unit. Of these, the date and time information of the extracted operation log information as the start point and the operation log information as the end point is extracted, and the date and time information of the operation log information as the end point and the date and time information of the operation log information as the end point are extracted. Extracting operation screen information from the operation screen information temporary storage unit;
The screen storage system according to claim 1. A screen storage system for transmitting operation screen information to be displayed on a display device of a client terminal to a management terminal,
An operation screen information temporary storage unit for temporarily storing operation screen information displayed on the display device of the client terminal;
An operation log information storage unit for storing operation log information in the client terminal;
An operation type information storage unit that stores operation log information serving as a trigger for saving operation screen information, start point information for starting the save, and end point information for ending the save in association with each other;
By comparing the operation log information with the operation log information serving as the trigger in the operation type information storage unit, it is determined whether to save the operation screen information. Operation log information for extracting the start point information and end point information corresponding to operation log information from the operation type information storage unit, and extracting operation screen information between the start point information and end point information from the operation screen information temporary storage unit A comparison unit;
An operation screen information storage unit for storing operation screen information extracted from the operation screen information temporary storage unit by the operation log information comparison unit;
An operation screen information transmission unit that transmits the operation screen information stored in the operation screen information storage unit to the management terminal;
A screen storage system comprising: The operation screen information temporary storage unit further includes:
Deleting the temporarily stored operation screen information at a predetermined timing;
The screen storage system according to any one of claims 1 to 3, wherein A management terminal including a storage device that stores operation log information serving as a trigger for saving operation screen information, start point information for starting the save, and end point information for ending the save in association with each other,
An operation screen information receiving unit that receives operation screen information displayed on the display device of each client terminal from each of the client terminals and temporarily stores it in the storage device of the management terminal,
Operation log information receiving unit for receiving operation log information from each client terminal from each client terminal,
When comparing the received operation log information with the operation log information serving as the trigger stored in the storage device to determine whether to save the operation screen information, and when saving the operation screen information An operation log information comparison unit that extracts the start point information and end point information corresponding to the operation log information from the storage device, and extracts operation screen information between the start point information and end point information from the storage device,
An operation screen information storage unit for storing operation screen information extracted from the storage device by the operation log information comparison unit;
A screen storage program characterized by functioning as

Images