1. A non-transitory medium embodying a computer program, the computer program controlling inputoutput (IO) operations of a user’s computer, the user’s computer being implemented as a virtual machine (VM) in a physical computer system, the physical computer system including at least one device, the computer program comprising:
an interface software component interfacing with the VM and the physical computer system, the interface software component causing a central processing unit (CPU) of the physical computer system to perform the following operations:
sensing a request for an IO operation between the VM and the device; and
performing a transformation of IO data passing between the VM and the device, said transformation changing contents of the IO data and being adjunct to complete servicing of the request, as issued, for the IO operation;
the transformation of the IO data thereby being undefeatable by any user action via the VM.
2. The non-transitory medium of claim 1, in which:
the device is a display;
the IO data is VM display data output from the VM and intended for display; and
the transformation is a replacement of at least a portion of the VM display data with display data stored external to the VM;
wherein the computer program further causes the CPU to display the VM display data with the non-defeatable display data overlaid.
3. The non-transitory medium of claim 1, wherein the interface software component further performs the following steps:
filtering the IO data with respect to at least one predetermined filtering condition; and
performing the transformation of the IO data only when the filtering condition is met.
4. The non-transitory medium of claim 3, wherein the filtering condition is that the IO data includes at least one restricted term.
5. The non-transitory medium of claim 3, wherein the filtering condition is that the IO data is from a restricted source.
6. The non-transitory medium of claim 3, wherein:
the IO data includes image data;
the step of filtering the IO data comprises detecting the presence of a representation of a target image within the image data; and
the transformation is substitution of a representation of a replacement image in place of the representation of the target image.
7. The non-transitory medium of claim 6, wherein:
the IO data is in a non-character image format;
the target image is a representation of a restricted character string; and
the step of filtering the IO data comprises applying character recognition to the IO data.
8. The non-transitory medium of claim 3, wherein the filtering condition is the presence in the IO data of a copy protection indication.
9. The non-transitory medium of claim 1, wherein the transformation comprises insertion into the IO data of a source indication associated with the VM.
10. The non-transitory medium of claim 1, wherein the transformation is time-varying.
11. The non-transitory medium of claim 1, wherein the device is a network connection device.
12. The non-transitory medium of claim 11, wherein the transformation is a bandwidth limiting of the IO data being transferred between the VM and the network connection device.
13. The non-transitory medium of 11, wherein:
the requested IO operation is a transfer of the IO data between the VM and the network connection device; and
the transformation is a time delay of the transfer.
14. The non-transitory medium of claim 11, wherein:
the requested IO operation is a transfer of the IO data from the VM to a first destination address via the network connection device;
the transformation is a redirection of the IO data to a second destination address different from the first.
15. The non-transitory medium of claim 1, wherein:
the device is a display;
the display renders data stored in a display map; and
the step of performing the transformation comprises altering a selected portion of the display map.
16. The non-transitory medium of claim 15, wherein the altering of the selected portion of the display data comprises substituting non-defeatable display data for the selected portion.
17. The non-transitory medium of claim 15, wherein the altering of the selected portion of the display data comprises changing all occurrences in the display map of a display color to a replacement color.
18. The tangible medium of claim 1, wherein:
the device is a data storage device;
the requested IO operation is a transfer of data between the VM and the storage device; and
the transformation comprises changing at least a portion of the data during the transfer between the VM and the storage device.
19. The non-transitory medium of claim 18, wherein the transformation comprises encrypting data written by the VM to the data storage device and decrypting data read from the data storage device by the VM.
20. The non-transitory medium of claim 18, wherein the transformation of the IO data comprises compressing data written by the VM to the data storage device and decompressing data read from the data storage device by the VM.
21. The non-transitory medium of claim 1, wherein:
the device is a network connection device;
the requested IO operation is a transfer of data between the VM and the network connection device; and
the transformation comprises changing at least a portion of the IO data during the transfer between the VM and the network connection device.
22. The non-transitory medium of claim 21, wherein the transformation of the IO data comprises encrypting data written by the VM to the network connection device and decrypting data read from the network connection device by the VM.
23. The non-transitory medium of claim 21, wherein the transformation of the IO data comprises compressing data written by the VM to the network connection device and decompressing data read from the network connection device by the VM.
24. The non-transitory medium of claim 1, wherein the transformation of the IO data comprises cryptographic transformation of the IO data.
25. The non-transitory medium of claim 1, wherein:
the VM supports a plurality of IO modes;
the interface software component further performs a step of filtering the IO data with respect to at least one predetermined filtering condition, the interface software component performing the transformation of the IO data only when the filtering condition is met;
the step of filtering is performed on IO data corresponding to a first one of the plurality of IO modes; and
the predetermined transformation is applied to IO data in a second one of the IO modes when the IO data in the first IO mode satisfies a transformation-triggering criterion.
26. The non-transitory medium of claim 25, wherein the IO modes include a video mode and an audio mode.
27. A non-transitory medium embodying a computer program, the computer program controlling inputoutput (IO) of a user’s computer, the user’s computer being implemented as a virtual machine (VM) in a physical computer system, the physical computer system including at least one device that carries out an IO operation on the basis of device control data, the computer program causing a central processing unit (CPU) of a physical computer system to perform the following steps:
loading an interface software component that interfaces with the VM and the physical computer system;
storing the device control data associated with the VM in a buffer; and
upon sensing a transformation command from an administrative system external to the VM, causing the interface software component to change contents of the device control data by entering replacement data into at least a portion of the buffer, said replacement data being entered as a processing step that is adjunct to completion of the IO operation, the entry of the replacement data thereby being undefeatable by any action initiated via the VM.
28. The non-transitory medium of claim 27, in which the device is a display and the device control data is VM display data.
29. The non-transitory medium of claim 28, further comprising:
the buffer is a display buffer for storing the VM display data that is output from the VM and is intended for display; and
the replacement data comprises arbitrary data written to the display buffer;
in which the display is provided for displaying the contents of the display buffer.
30. The non-transitory medium of claim 27, wherein:
the device is a data storage device;
the IO operation is a transfer of data between the VM and the storage device; and
the replacement data comprises a cryptographic transformation of data written by the VM to the data storage device and of data read from the data storage device by the VM.
31. The non-transitory medium of claim 27, wherein:
the device is a data storage device;
the IO operation is a transfer of data between the VM and the storage device; and
the replacement data comprises a compression of data written by the VM to the data storage device and an expansion of data read from the data storage device by the VM.
32. The non-transitory medium of claim 27, in which the device is a network connection device;
the IO operation is a transfer of data between the VM and the network connection device; and
the replacement data comprises a cryptographic transformation of data written by the VM to the network connection device and of data read from the data storage device by the VM.
The claims below are in addition to those above.
All refrences to claim(s) which appear below refer to the numbering after this setence.
We claim:
1. A secure network resource access system for facilitating network access by network terminals to network resources located behind an enterprise firewall, the secure network resource access system comprising:
a proxy server located logically outside the enterprise firewall for receiving application data from the network terminals; and
a polling server located logically behind the enterprise firewall, the polling server being configured for polling the proxy server to initiate transmission of the received application data from the proxy server to the polling server.
2. The secure network resource access system according to claim 1, wherein each said network resource includes an alias name, and the application data includes the alias name of one of the network resources, and the polling server is configured to direct the application data to the one network resource in accordance with alias name.
3. A method for facilitating secure network access by network terminals to network resources located behind an enterprise firewall, the method comprising the steps of:
polling a proxy server located logically outside the enterprise firewall for requests for communication with the network resources;
receiving application data and associated network resource data from the proxy server in response to the polling step; and
directing the application data to one of the network resources in accordance with the associated network resource data.
4. The method according to claim 3, wherein each said network resource includes an alias name, and the network resource data includes the alias name of the one network resource.