Sensitive information protection during screen sharing on remote desktops
Example methods and systems for sensitive information protection during screen sharing on a remote desktop are described. In one example, a computer system may establish a connection between a remote desktop and a client device to allow access to multiple applications supported by the remote desktop. The computer system may obtain configuration information identifying sensitive information that includes at least a particular application from the multiple applications or an information item. Based on the configuration information, the computer system may monitor the particular application or the information item. In response to detecting that (a) screen sharing is enabled for a first user to share a visual representation associated with the remote desktop with a second user and (b) the particular application or the information item being monitored is active, the computer system may perform a remediation action to protect against potential disclosure of the sensitive information.
1 . A method for a computer system to protect sensitive information during screen sharing on a remote desktop in a virtualized desktop infrastructure (VDI) environment that includes the computer system, a client device and a connection server, wherein the method comprises:
establishing, by the computer system, a first connection between the remote desktop running on a virtualized computing instance supported by the computer system and the client device operated by a first user to allow access to multiple applications supported by the remote desktop, wherein establishment of the first connection is facilitated by the connection server;
obtaining, by the computer system, configuration information identifying sensitive information that requires protection during screen sharing of the remote desktop, wherein the sensitive information includes at least a particular application from the multiple applications or an information item associated with the particular application;
monitoring, by the computer system, the particular application or the information item based on the configuration information; and
in response to detecting that (a) screen sharing is enabled for the first user to share a visual representation associated with the remote desktop with a second user and (b) the particular application or the information item being monitored is active,
establishing a second connection between the remote desktop and the client device that is separate from the first connection used to generate the visual representation associated with the remote desktop; and
relaunching, using the second connection, the particular application or the information item in a user interface (UI) element that is excluded from the visual representation shared with the second user.
2 . The method of claim 1 , further comprising:
closing the particular application or the information item that is active on the remote desktop.
3 . The method of claim 1 , wherein
a seamless window server of the remote desktop interacts with a seamless window client of the client device to relaunch the particular application or the information item on the UI element, wherein the UI element includes a seamless window.
4 . The method of claim 3 , wherein detecting that screen sharing is enabled comprises:
in response to a determination that screen sharing has ended, (a) the seamless window server interacting with the seamless window client to close the seamless window and (b) a controller of the remote desktop relaunching the particular application or the information item on the remote desktop.
5 . The method of claim 1 , wherein monitoring the particular application or the information item comprises:
detecting, by a controller of the remote desktop based on one or more event notifications from a sensitive information monitor, a launch of the particular application or the information item on the remote desktop before or after screen sharing is enabled.
6 . The method of claim 1 , wherein detecting that screen sharing is enabled comprises:
monitoring, by an event tracker of the remote desktop, a unified communications application that is running on the remote desktop; and
detecting, by a controller of the remote desktop based on one or more event notifications from the event tracker, that screen sharing is enabled using the unified communications application.
7 . A non-transitory computer-readable storage medium that includes a set of instructions which, in response to execution by a processor of a computer system, cause the processor to perform a method of sensitive information protection during screen sharing on a remote desktop, wherein the method comprises:
establishing a first connection between the remote desktop supported by the computer system and a client device operated by a first user to allow access to multiple applications supported by the remote desktop;
obtaining configuration information identifying sensitive information that requires protection during screen sharing, wherein the sensitive information includes at least a particular application from the multiple applications or an information item associated with the particular application;
based on the configuration information, monitoring the particular application or the information item; and
in response to detecting that (a) screen sharing is enabled for the first user to share a visual representation associated with the remote desktop with a second user and (b) the particular application or the information item being monitored is active,
establishing a second connection between the remote desktop and the client device that is separate from the first connection used to generate the visual representation associated with the remote desktop; and
relaunching, using the second connection, the particular application or the information item in a user interface (UI) element that is excluded from the visual representation shared with the second user.
8 . The non-transitory computer-readable storage medium of claim 7 , wherein the method further comprises:
closing the particular application or the information item that is active on the remote desktop.
9 . The non-transitory computer-readable storage medium of claim 7 , wherein
a seamless window server of the remote desktop interacts with a seamless window client of the client device to relaunch the particular application or the information item on the UI element, wherein the UI element includes a seamless window.
10 . The non-transitory computer-readable storage medium of claim 9 , wherein detecting that screen sharing is enabled comprises:
in response to a determination that screen sharing has ended, closing the seamless window and relaunching the particular application or the information item on the remote desktop.
11 . The non-transitory computer-readable storage medium of claim 7 , wherein monitoring the particular application or the information item comprises:
detecting, by a sensitive information controller of the remote desktop based on one or more event notifications from a sensitive information monitor, a launch of particular application or the information item on the remote desktop before or after screen sharing is enabled.
12 . The non-transitory computer-readable storage medium of claim 7 , wherein detecting that screen sharing is enabled comprises:
monitoring, by an event tracker of the remote desktop, a unified communications application that is running on the remote desktop; and
detecting, by a sensitive information controller of the remote desktop based on one or more event notifications from the event tracker, that screen sharing is enabled using the unified communications application.
13 . A computer system, comprising:
a processor; and
a non-transitory computer-readable medium having stored thereon instructions that, when executed by the processor, cause the processor to perform the following:
establish a first connection between a remote desktop supported by the computer system and a client device operated by a first user to allow access to multiple applications supported by the remote desktop;
obtain, from the client device via the connection, configuration information identifying sensitive information that requires protection during screen sharing, wherein the sensitive information includes at least a particular application from the multiple applications or an information item associated with the particular application;
based on the configuration information, monitor the particular application or the information item; and
in response to detecting that (a) screen sharing is enabled for the first user to share a visual representation associated with the remote desktop with a second user and (b) the particular application or the information item being monitored is active,
establish a second connection between the remote desktop and the client device that is separate from the first connection used to generate the visual representation associated with the remote desktop; and
relaunch, using the second connection, the particular application or the information item in a user interface (UI) element that is excluded from the visual representation shared with the second user.
14 . The computer system of claim 13 , wherein the non-transitory computer readable storage medium further includes instructions that cause the processor to:
close the particular application or the information item that is active on the remote desktop.
15 . The computer system of claim 13 , wherein
a seamless window server of the remote desktop interacts with a seamless window client of the client device to relaunch the particular application or the information item on the UI element, wherein the UI element includes a seamless window.
16 . The computer system of claim 15 , wherein the instructions for detecting that screen sharing is enabled cause the processor to:
in response to a determination that screen sharing has ended, close the seamless window and relaunch the particular application or the information item on the remote desktop.
17 . The computer system of claim 13 , wherein the instructions for monitoring the particular application or the information item cause the processor to:
detect, by a sensitive information controller of the remote desktop based on one or more event notifications from a sensitive information monitor, a launch of the particular application or the information item on the remote desktop before or after screen sharing is enabled.