# US 2019/0319984 A1 · Recording remote access actions in video files > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2019/0319984 A1 - Document ID: US20190319984A1 - Status: Published application - Kind: A1 - Application number: 15/954,312 - Filed: 2018-04-16 - Published: 2019-10-17 - Earliest claimed: 2018-04-16 - Assignees: Honeywell International Inc. - Applicants: Honeywell International Inc. - Inventors: Eli Abramson - Web page: https://patentgrep.com/patent/US20190319984A1 ## CPC - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 67/12: specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks - H04L 63/02: {for separating internal from external traffic, e.g. firewalls} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04N 5/76: Television signal recording - H04N 5/765: Interface circuits between an apparatus for recording and another apparatus - H04L 63/0272: {Virtual private networks} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04N: PICTORIAL COMMUNICATION, e.g. TELEVISION ## Abstract A method of remote access action includes directing user actions including a first action to a destination device in an industrial control system (ICS) through a terminal server including a memory, a remote access recording component (RARC), and a security center coupled by a communication server through a network connection to the ICS. The terminal server is coupled to a streaming server having a recorded session repository database. The terminal server limits the user to specifically allowed actions and directs actions if allowed enabling user selecting the destination device from a menu that then provides a connection for the first action to be begun. The RARC during the remote session records streams of video of display window content and text representing the first action, combines the text and display window content to generate a combined video output file and stores the file in the session repository database. ## Claims ### Claim 1 A method of remote access action recording in a video file of a remote session, comprising: during said remote session directing said remote access actions of a user including a first action to be applied to a destination device located within at least one industrial control system (ICS) through a terminal server including a memory and a remote access recording component (RARC) and a security center that is coupled by a communication server through a network connection to said ICS, wherein said terminal server is coupled to a streaming server having a recorded session repository database, and wherein said terminal server limits said user to only specifically allowed said remote access actions and directing said first action if said specifically allowed that enables said user selecting said destination device from a menu that then provides a connection to said destination device for said first action to be begun; said RARC during each sampling interval of said remote session: recording streams of video of display window content as well as text representing said first action; combining said text and said display window content to generate a single combined video comprising output file, and storing said combined video comprising output file in said recorded session repository database. ### Claim 2 (depends on 1) The method of claim 1, wherein said remote access actions comprise keystrokes by said user entered on a workstation computer coupled to said terminal server. ### Claim 3 (depends on 1) The method of claim 1, wherein said remote access actions comprise voice commands. ### Claim 4 (depends on 1) The method of claim 1, wherein said network connection comprises an Internet connection, a virtual private network (VPN), or wide area network (WAN). ### Claim 5 (depends on 1) The method of claim 1, wherein said network connection comprises said Internet connection. ### Claim 6 (depends on 1) The method of claim 1, wherein said user comprises a contractor or engineer allowed by a manager of said ICS to perform work at said ICS. ### Claim 7 (depends on 1) The method of claim 1, wherein said destination device comprises a process controller, field device, or processing equipment, and wherein said first action comprises changing a setting of said process controller, field device, or changing a threshold value or a login permission. ### Claim 8 (depends on 1) The method of claim 1, wherein said RARC comprises firmware in said memory 130a. ### Claim 9 (depends on 1) The method of claim 1, wherein said text of said remote access actions are added as a caption in said display window content. ### Claim 10 (depends on 1) The method of claim 1, further comprising an auditor connected to said security center auditing said remote session comprising streaming said combined video comprising output files to identify malicious activity. ### Claim 11 (depends on 1) The method of claim 1, wherein said terminal server performs said limiting said user to only specifically allowed said remote access actions and directing said first action by accessing a website hosting said security center through which said user opens a browser to said Security Center to select said destination device. ### Claim 12 A security management system for at least one industrial control system (ICS), comprising: a terminal server including a memory and a remote access recording component (RARC) coupled to a security center that is coupled by a communication server through a network connection to said ICS, wherein said terminal server is coupled to a streaming server having a recorded session repository database and wherein said terminal server is for limiting a user to only specifically allowed remote access actions and directing a first action if said specifically allowed that enables said user selecting a destination device in said ICS during a remote session from a menu that then provides a connection to said destination device for said first action to be begun; said RARC during each sampling interval of said remote session: recording streams of video of display window content as well as text representing said first action; combining said text and said display window content to generate a single combined video comprising output file, and storing said combined video comprising output file in said recorded session repository database. ### Claim 13 (depends on 12) The system of claim 12, wherein said remote access actions comprise keystrokes by said user entered on a workstation computer coupled to said terminal server. ### Claim 14 (depends on 12) The system of claim 12, wherein said wherein said network connection comprises an Internet connection, a virtual private network (VPN), or wide area network (WAN). ### Claim 15 (depends on 14) The system of claim 14, wherein said network connection comprises said Internet connection. ### Claim 16 (depends on 12) The system of claim 12, wherein said destination device comprises a process controller, field device, or processing equipment, and wherein said first action comprises changing a setting of said process controller, field device, or changing a threshold value or a login permission. ### Claim 17 (depends on 12) The system of claim 12, wherein said RARC comprises firmware in said memory. ### Claim 18 (depends on 12) The system of claim 12, wherein said text of said remote access actions are added as a caption in said display window content.