# US 10,504,201 B2 · Method and apparatus for deterrence and detection of leakage during remote interactive sessions > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,504,201 B2 - Document ID: US10504201B2 - Status: Granted - Kind: B2 - Application number: 15/825,561 - Filed: 2017-11-29 - Published: 2019-05-30 - Granted: 2019-12-10 - Earliest claimed: 2017-11-29 - Assignees: Citrix Systems, Inc. - Applicants: Citrix Systems, Inc. - Inventors: Chris Mayers - Web page: https://patentgrep.com/patent/US10504201B2 ## CPC - G06F 3/1454: {involving copying of the display data of a local workstation or window to a remote workstation or window so that an actual copy of the data is displayed simultaneously on two or more displays, e.g. teledisplay} - G06F 9/45545: {Guest-host, i.e. hypervisor is an application program itself, e.g. VirtualBox} - G06F 9/45558: {Hypervisor-specific management and integration aspects} - G06F 21/00: Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity - G06F 21/6209: {to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself} - G06T 1/0021: {Image watermarking} - H04L 63/00: {Network architectures or network communication protocols for network security (cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00; network architectures or network communication protocols for wireless network security H04W12/00; security arrangements for protecting computers or computer systems against unauthorised activity G06F21/00)} - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - G06F 9/452: {Remote windowing, e.g. X-Window System, desktop virtualisation (protocols for virtual reality H04L67/131)} - G06F 21/1063: {Personalisation} - G06F 2009/45579: {I/O management, e.g. providing access to device drivers or storage} - G06F 2009/45595: {Network integration; Enabling network access in virtual machine instances} - G09G 2358/00: Arrangements for display data security - H04L 67/08: specially adapted for terminal emulation, e.g. Telnet - H04L 2463/101: applying security measures for digital rights management - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06T: IMAGE DATA PROCESSING OR GENERATION, IN GENERAL - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G09G: ARRANGEMENTS OR CIRCUITS FOR CONTROL OF INDICATING DEVICES USING STATIC MEANS TO PRESENT VARIABLE INFORMATION (arrangements for transferring data between digital computers and displays G06F3/14; static indicating arrangements comprising an association of a number of separate sources or light control cells G09F9/00; static indicating arrangements comprising integral associations of a number of light sources H01J, H01K, H10H, H05B33/12; scanning, transmission or reproduction of documents or the like, e.g. facsimile transmission, details thereof H04N1/00) ## Abstract A server includes a hardware platform, a hypervisor platform, and a virtual machine operating as an independent guest computing device. The virtual machine executes a remote graphics generation protocol to generate a bitmap to be transmitted for display on a client machine associated with the virtual machine, determine a protection label to be inserted within the bitmap, and determine an optimization technique to be performed on the bitmap. The remote graphics generation protocol also determines if the optimization technique, if performed, alters the protection label. If yes, then the protection label is inserted within the bitmap without performing the optimization technique. If no, then the optimization technique is performed and the protection label is inserted within the bitmap. ## Claims ### Claim 1 A server comprising: a hardware platform comprising hardware resources with at least a portion of said hardware resources to be allocated as virtualized resources; a hypervisor platform being provided based on execution of code instructions by said hardware platform; at least one virtual machine operating as an independent guest computing device, with at least a portion of the virtualized resources being allocated by said hypervisor platform to said at least one virtual machine; and said at least one virtual machine configured to execute a remote graphics generation protocol via said virtualized resources to perform the following: generate a bitmap to be transmitted for display on a client machine associated with the at least one virtual machine, determine at least one protection label to be inserted within the bitmap, determine at least one optimization technique to be performed on the bitmap, and determine if the at least one optimization technique, if performed, alters the at least one protection label inserted into the bitmap, and perform the following based on the determination: if yes, then insert the at least one protection label within the bitmap without performing the at least one optimization technique, and if no, then perform the at least one optimization technique and insert the at least one protection label within the bitmap. ### Claim 2 (depends on 1) The server according to claim 1 wherein inserting the at least one protection label comprises inserting a covert protection label that is not visible when the bitmap is displayed on the client machine. ### Claim 3 (depends on 2) The server according to claim 2 wherein inserting the covert protection label comprises embedding the covert protection label within the bitmap. ### Claim 4 (depends on 2) The server according to claim 2 wherein the covert protection label comprises at least one of a bit color change in the bitmap, changing position of where the bitmap is to be displayed on the client machine, and adding a unique mark to the bitmap. ### Claim 5 (depends on 1) The server according to claim 1 wherein inserting the at least one protection label comprises inserting a visual protection label that is visible when the bitmap is displayed on the client machine. ### Claim 6 (depends on 1) The server according to claim 1 wherein if the determined optimization technique comprises a lossy compression of the bitmap, then the at least one protection label is inserted within the bitmap without performing the lossy compression of the bitmap. ### Claim 7 (depends on 1) The server according to claim 1 wherein if the determined optimization technique comprises changing color bits in the bitmap, then the at least one protection label is inserted within the bitmap after the color bit change has been performed. ### Claim 8 (depends on 1) The server according to claim 1 wherein the generated bitmap comprises segmented portions, with the at least one protection label to be divided among the segmented portions, and with each segmented portion having an optimization technique associated therewith so that determining if the at least one optimization technique, if performed, alters the at least one protection label, comprises determining if the optimization technique for each segmented portion, if performed, alters the divided protection label. ### Claim 9 A method for executing a remote graphics generation protocol for at least one virtual machine in a virtualization server comprising: generating a bitmap to be transmitted for display on a client machine associated with the at least one virtual machine; determining at least one protection label to be inserted within the bitmap; determining at least one optimization technique to be performed on the bitmap; and determining if the at least one optimization technique, if performed, alters the at least one protection label inserted into the bitmap, and perform the following based on the determining: if yes, then inserting the at least one protection label within the bitmap without performing the at least one optimization technique, and if no, then performing the at least one optimization technique and inserting the at least one protection label within the bitmap. ### Claim 10 (depends on 9) The method according to claim 9 wherein inserting the at least one protection label comprises inserting a covert protection label that is embedded within the bitmap so as to not be visible when the bitmap is displayed on the client machine. ### Claim 11 (depends on 9) The method according to claim 9 wherein the covert protection label comprises at least one of a bit color change in the bitmap, changing position of where the bitmap is to be displayed on the client machine, and adding a unique mark to the bitmap. ### Claim 12 (depends on 9) The method according to claim 9 wherein inserting the at least one protection label comprises inserting a visual protection label that is visible when the bitmap is displayed on the client machine. ### Claim 13 (depends on 9) The method according to claim 9 wherein if the determined optimization technique comprises a lossy compression of the bitmap, then the at least one protection label is inserted within the bitmap without performing the lossy compression of the bitmap. ### Claim 14 (depends on 9) The method according to claim 9 wherein if the determined optimization technique comprises changing color bits in the bitmap, then the at least one protection label is inserted within the bitmap after the color bit change has been performed. ### Claim 15 A non-transitory computer readable medium for at least one virtual machine in a virtualization server, with the non-transitory computer readable medium having a plurality of computer executable instructions for causing the at least one virtual machine to execute a remote graphics generation protocol to perform steps comprising: generating a bitmap to be transmitted for display on a client machine associated with the at least one virtual machine; determining at least one protection label to be inserted within the bitmap; determining at least one optimization technique to be performed on the bitmap; and determining if the at least one optimization technique, if performed, alters the at least one protection label inserted into the bitmap, and perform the following based on the determining: if yes, then inserting the at least one protection label within the bitmap without performing the at least one optimization technique, and if no, then performing the at least one optimization technique and inserting the at least one protection label within the bitmap. ### Claim 16 (depends on 15) The non-transitory computer readable medium according to claim 15 wherein inserting the at least one protection label comprises inserting a covert protection label that is embedded within the bitmap so as to not be visible when the bitmap is displayed on the client machine. ### Claim 17 (depends on 16) The non-transitory computer readable medium according to claim 16 wherein the covert protection label comprises at least one of a bit color change in the bitmap, changing position of where the bitmap is to be displayed on the client machine, and adding a unique mark to the bitmap. ### Claim 18 (depends on 15) The non-transitory computer readable medium according to claim 15 wherein inserting the at least one protection label comprises inserting a visual protection label that is visible when the bitmap is displayed on the client machine. ### Claim 19 (depends on 15) The non-transitory computer readable medium according to claim 15 wherein if the determined optimization technique comprises a lossy compression of the bitmap, then the at least one protection label is inserted within the bitmap without performing the lossy compression of the bitmap. ### Claim 20 (depends on 15) The non-transitory computer readable medium according to claim 15 wherein if the determined optimization technique comprises changing color bits in the bitmap, then the at least one protection label is inserted within the bitmap after the color bit change has been performed.