Method and Apparatus for Simultaneously Monitoring Computer User Screen and Telephone Activity From a Remote Location

This invention relates in general to computer screen and voice monitoring from a remote location, and particularly relates to synchronized voice and data monitoring of a computer workstation from a remote location. Such monitoring is useful for providing training and assistance to those using such workstations, especially in connection with telephone use, can also be useful for providing an audit trial of significant on-screen events, or can be used as a trigger to initiate other separate events.

In some business environments, computers are used in conjunction with telephones in order to provide services. For example, in providing credit card-related services, it is known to provide customer service representatives (hereinafter referred to as "agents" or "employees"), with access to a computer workstation as well as a telephone. In the process of providing telephonic service from the agent to the customer, typically a customer will contact the agent (or vice versa) through a telephone connection, and the customer and the agent will discuss matters relating to the customer's account over the telephone.

During such telephone calls, in order to provide supportive information regarding the customer's account, it is likewise conventional to provide the customer's account information at the agent's workstation. As an example, in the instance of credit card services, it is conventional to provide the agent's computer with information such as the customer's outstanding balance, the amount last paid, etc. It is also known to provide the agent with access to a database including certain fields, to which the agent can input data responsive to the telephone conversation. For example, the agent may wish to insert data to indicate that the customer has promised payment by a certain date, or that certain special attention should be given to the customer for any reason.

It is likewise conventional to provide such agents in groups, conventionally referenced as "call centers". In certain instances, such call centers may have as many as 200 "agents" in a group, each having their own telephone extension, and each likewise having their own computer workstation having a monitor (or "screen"), which provides video signals responsive to various commands.

In order to provide supervision of such agents, it is often desired to allow an agent's supervisor (hereinafter "supervisor"), with a means for monitoring the screen and voice activities of such agents during their telephone conversations. Such monitoring of a "monitored workstation" may be considered quality control of the agent's services. For example, it is worthwhile for a supervisor to know if an agent is using his/her computer time efficiently (not moving back and forth from various screens or applications unnecessarily), or is rude or discourteous while on the telephone. Such information can be determined by having a supervisor "look over the shoulder" of an agent, viewing his/her computer activities as well as listening to the telephone conversations; however, due to human nature this tends to be an ineffective practice as an agent will tend to be "on guard" while being monitored, which may not provide the supervisor with a good example of how the agent normally would conduct his/her duties when not being monitored. For example, the agent could become nervous and not perform as well as normal if he/she knows he/she is being monitored.

Therefore, a need has been determined to provide remote monitoring of an agent's workstation, without the agent knowing it; in such an environment a supervisor can determine the agent's more typical activities on the job, therefore being provided with a more accurate set of information. Such a need is also present when multiple agents require such monitoring.

Needs have also been determined to provide remote monitoring of an agent's workstation for purposes other than training, such as to provide a record of on-screen events for audit trail purposes (such as could be the case in monetary wire transfers), or to provide a trigger to initiate other events such as critical account monitoring, all which may be done in a manner "transparent" to the agent.

The present invention overcomes deficiencies in the prior art by providing an improved method and apparatus for providing on-the-job work training of an agent or employee, including the provision for passive workstation monitoring which does not interfere with the operation of the employee's workstation, yet allows a supervisor of the employee to simultaneously monitor (and/or record for later playback if desired) the on-screen and telephonic activities of the employee, in order to provide the employee with valuable and accurate feedback regarding that employee's work habits, or to provide an audit trail or other function.

Generally described, the present invention provides a method of remotely monitoring on-screen activities of a monitored computer workstation, said monitored computer workstation having a display screen, operating system software, and a display driver, comprising the steps of: intercepting and interpreting at least one graphics primitive function call made to the display driver to define a localized changed screen region sized less than the display screen; utilizing the boundaries of the localized changed region to make a copy of the changed region by use of the operating system; and transporting the changed region copy to a remote location for view on the screen of a separate, monitoring workstation, such that the screen of the monitoring workstation periodically reflects screen changes made on the monitored workstation.

Also generally described, the present invention provides a method of remotely monitoring on-screen activities of a monitored computer workstation, the monitored computer workstation having a display screen and operating system software, comprising the steps of: comparing two sequential screen displays and determining a localized changed region including screen differences between the two full screen displays; utilizing the boundaries of the localized changed region to make a copy of the localized changed region by use of the operating system; and transporting the changed region copy to a remote location for view on the screen of a separate, monitoring workstation, such that the screen of the monitoring workstation periodically reflects screen changes made on the monitored workstation.

Also generally described, the present invention provides a method of remotely of monitoring sequential on-screen activities of a monitored computer workstation having a display screen and a telephone extension, the method comprising: determining sequential localized changed screen regions which correspond to sequential screen changes; recording a telephone conversation occurring during the definition of at least two sequential screen changes; and playing back the telephone conversation portion in substantial synchronization with the sequential screen changes, to allow one at the monitoring workstation to simultaneously monitor on-screen and telephone conversations occurring at the monitored workstation.

Therefore, it is an object of the present invention to provide a method and apparatus for providing improved on the-job employee training.

Therefore, it is an object of the present invention to provide a method and apparatus for providing an audit trail of on-screen activities.

It is a further object of the present invention to provide a method and apparatus for providing improved employee training which is not disruptive to the employee's work activities.

It is a further object of the present invention to provide a method and apparatus for simultaneously monitoring the on-screen and telephone activities of an employee's workstation.

It is a further object of the present invention to provide a method and apparatus for simultaneously monitoring the on-screen and telephone activities of an employee's workstation, without the employee knowing same.

It is a further object of the present invention to provide a method and apparatus for simultaneously monitoring the on-screen and telephone activities of an employee's workstation, to determine the efficiency of the employee's activities.

It is a further object of the present invention to provide passive monitoring of an employee's workstation.

It is a further object of the present invention to provide a method and apparatus for simultaneously recording the on-screen and telephone activities of an employee's workstation, to allow for the remote playback of said activities at a second workstation at a later time for review purposes.

It is a further object of the present invention to provide a method and apparatus for simultaneously recording the on-screen and telephone activities of an employee's workstation, to allow for the remote playback of said activities at a second workstation on a common network.

Other objects, features, and advantages of the present invention will become apparent upon reading the following detailed description of the preferred embodiment of the invention when taken in conjunction with the drawing and the appended claims.

FIG. 1 is a diagram illustrating data flow paths intermediate various main elements used to practice the present invention.

FIG. 2 is a diagram illustrating data flow within software located on the agent's workstation.

FIGS. 3a-3c are sequential illustrative views showing sequential screen updates of "Changed Regions" 302 developed under the present invention by "Accumulated Changed Rectangles" likewise developed under the present invention.

FIG. 4 is an illustrative view illustrating data flow intermediate the Server, the Monitor Module, and the Capture Module.

FIG. 5 illustrates the composition of a Journal File 500, which allows for synchronized voice and screen data playback.

FIG. 6 is an illustration of a data packet 600 such as transferred over the network under the present invention.

FIG. 7 is a diagram 700 illustrating the interaction of various software elements loaded on the server, and how these elements interact with other elements.

FIG. 8 is a diagram 800 illustrating the interaction of various software elements during live monitoring from a user (also known as a supervisor) and an agent.

FIG. 9 is a diagram 900 illustrating the interaction of various software elements during scheduled monitoring of an agent.

Reference is now made to the drawings, in which like numerals indicate like elements throughout the several views.

General Configuration

Reference is now made to FIG. 1, which generally illustrates an overall configuration 10 according to the present invention. As shown, the configuration 10 includes a network interconnection means 15, to which is attached a server 20, a monitored workstation 30 (a.k.a. an "agents workstation"), and a monitoring workstation 40 (a.k.a. a "supervisor's workstation"). In the preferred embodiment, networking between these elements is done through TCP/IP protocols, although often other network protocols may be used without departing from the spirit and scope of the present invention. Voice hardware 50 is within or linked to the server 20 and controlled by server software as discussed later.

Under at least one embodiment of the present invention, on-screen activities conducted at the monitored workstation 30 can be viewed (or "monitored") by the supervisor (a.k.a. "user") on the screen of the monitoring workstation 40 either in real time (i.e., as the activities are actually occurring), and/or the on-screen activities conducted at the monitored workstation 30 can be recorded on the server 20 and "played back" at the monitoring workstation 40 at a later time. Under this embodiment of the present invention these activities may be played back much as one would play back the video tape of a television program, that is the on-screen and synchronized voice activities (routed through use of conventional voice hardware) that occurred at the monitored workstation 30 may allowed to "play" at the monitoring workstation 40 substantially as they actually happened, portions may be replayed, the activities may be stopped or "paused" for particular review, and certain portions may be skipped if so desired.

General Operation

Under a first embodiment of the present invention, software on the server is configured to send data polls to software installed and running on the agent's workstation. The software on the agent's workstation intercepts or "hooks" operating system graphics primitives relevant to actual screen display, and returns only selected screen portions (referred to as "Changed Regions") which have changed since the last data poll. These Changed Regions are then displayable at a remote location either in real time or at a later time. The technique is substantially "passive" in that it preferably does not perceptibly interfere with the operation of the agent's workstation which would be a signal to the agent that he or she is being monitored.

Under a second embodiment of the present invention, in response to a poll, the full screen is grabbed and compared (such as by an XOR operation) to a previously grabbed screen, and Changed Regions including the screen differences are sent over the network to the server. In one implementation, the first and last "differences" in the XOR comparison are determined, and all data therebetween is considered within the Changed Region, which is not in this case necessary rectangular.

General Environment

As noted above, one typical operating environment intended for the present invention is one known as a "call center" for credit services, in which an agent is taking and/or making calls to credit card customers, which may have questions regarding the status of their account(s). In such an environment, it would not be uncommon for a calling agent, during the course of a single telephone call, to access multiple screens and/or application windows in order to provide customer service. In order to provide consistent and acceptable service to such customers, it has been found advantageous to simultaneously monitor the "desktop" screen display and the telephonic habits of the agents, in order to properly train agents and to provide quality control of the agent's services.

A typical Monitored Workstation 30 includes hardware and software mounted thereon. An independent telephone extension is likewise typically provided alongside the Workstation 30, so one can talk on the phone while viewing the Workstation 30.

Hardware

The hardware used is typically conventional PC hardware such as that used to operate OS/2 or Windows, and different hardware configurations may be used without departing from the spirit and scope of the present invention.

Software

Referring now also to FIG. 2, under one embodiment of the present invention, the Monitored Workstation 30 is loaded with and runs a conventional graphics user interface such as OS/2 (indicated generally as 100 and defined by the dotted line). As is known in the art, the OS/2 operating system 100 incorporates the use of a graphics engine 102 (known as OS2GRE in OS/2 and GDI in Windows). Upon receiving an instruction from, for example, one of applications 110 and 112, (example: "draw a window") the operating system will utilize its Graphics Engine 102 to send a combination of typically smaller, more specific (i.e., low level) instructions by means of graphics primitives (e.g. "draw line", "bitblt" "draw wide border", "draw text", etc.,) to whatever video driver 104 (also known as a display driver) associated with the particular video display hardware (not shown) is being used within the monitored workstation. As noted in more detail below, it is these graphics primitives (function calls in their own right) which are interpreted under the present invention in order to define localized screen changes. Such screen changes can be due to "on screen typing", as described in detail below, or can also be pursuant to manual or automatic user commands (open/close window), or can be other automatic screen changes such as caused by a blinking cursor or an on-screen clock.

As may be understood, multiple applications 110, 112 may be used by the agent on the Monitored Workstation 30 in providing service to the customers. Since every application is drawing to its own virtual desk top, and because it does not know what the other applications are doing, it is the graphic engine's job is to take different requests from the applications, to determine what requests should be visible to the end user, and send those requests as a list of primitives to the video driver.

The general configuration and operation of the operating system 100 such as OS/2 is assumed to be known to one skilled in the art; however, the reference manual "OS/2 2.0 Technical Library--Presentation Driver Reference, Version 2.00", Published by IBM, First Edition, copyright 1992, and subsequent versions thereof, are incorporated herein by reference, including but not limited to the general operation of the OS/2 operating system, the function and operation of graphics primitives generally and individually, and dynamic link library functions (DLLs).

Generally

The capturing software generally consists of two modules, a Capture Module 120 and a Monitor Module 122. The Capture Module 120 is queried from the network as described in further detail below, and it in turn queries the Monitor Module 122. Prior to such query, the Monitor Module 122 has been monitoring some of the graphics primitives sent from the Graphics Engine 102 to the Display Driver 104, to determine if visible screen changes have been made, and if so where the changes have been made. Once given the boundaries (but not the content) of such a region (hereinafter the "Changed Region"), it is then the Capture Module's duty to go to the operating system, use some of its function calls to grab a copy of the Changed Region, compress it, and send it out onto the network and eventually to the server.

All of the above activities can be and are preferably accomplished without any input from the Agent, and typically the Agent will have no knowledge that any of the above activities have occurred. This "transparent" operating feature allows for a realistic, typical sample of the Agent's on-screen activities.

Changed Rectangle

Referring now to FIGS. 3a-3c, at this point it is worthwhile to discuss some details of the Changed Region 302 and the Accumulated Changed Rectangle 304. FIG. 3a illustrates a typical agent's visible screen 300 (a.k.a. "desktop"). Provision is made to allow the agent to type in a customer's name (example: "JOHN DOE") telephone number (example: 876-5423) and address (example: 168 Maple Street) into corresponding field of a typical database.

Changes to the agent's desktop can be considered "updates" to previous screen images. Under the present invention, these updates are periodically grouped together as "Changed Regions", and information relating to these Changed Regions is sent back to the server to allow for its viewing at a remote location (for example at the Monitoring Workstation), typically by "pasting" the Changed Region atop a previous screen image corresponding to the agent's desktop prior to the update in the Changed Region. One embodiment of the present invention defines the boundaries of such a changed region by use of an Accumulated Changed Rectangle", which is updated by the use of graphics primitives as discussed in later detail.

Reference is now made to FIG. 3a. By typing the letters "JOHN DO". it may be seen that the agent has updated a portion of the screen which can be circumscribed by an Accumulated Changed Rectangle 304, which is the Changed Region 302. In this case, the first and last typed letters between data polls are "J" and "O". Under the example given, after the "O" is typed, a data poll from the server will cause the Capture Module 120 to request the boundaries of the Accumulated Changed Rectangle 304 from the Monitor Module 122. The Monitor Module returns such information by returning the screen coordinates of two separate points 306 and 308 in the form (x.sub.1, y.sub.1, x.sub.2, Y.sub.2). It may be seen that such coordinates define the upper and lower x and y screen pixel ranges occupied by the Changed Region 302.

FIG. 3b illustrates a subsequent Changed Region 302 defined by an Accumulated Changed Rectangle 304. It may be seen that the first typed character in this subsequent Changed Region 302 is "E", and the last typed character is "2".

FIG. 3c shows yet another subsequent Changed Region 302, its first typed character being "3", and the last typed character being "8". The definition and separation of the Accumulated Changed Rectangles 304 will be clarified by later discussion.

As noted above, it is important to note that on-screen changes due to typing as described above are not the only type of screen changes which can be monitored under the present invention. Other such screen changes could be those also be pursuant to manual or automatic user commands such as "open/close window"-type commands, "draw bitblt"-types of commands, or can be other automatic screen changes such as those caused by a blinking cursor or an on-screen clock. For example, a database application's window could be opened (or brought to the top of the desktop) by a user pursuant to a command, which would result in at least the displayed window (and its contents) being included in a Changed Region. After the window was opened, as an example a customer's account number could be entered into a field (creating screen changes) which could result in the database application automatically displaying supplemental on-screen information such as the customer's address, telephone number, and account history. All such "automatic" screen changes would likewise be included in the Changed Region.

The Capture Module 120

As generally noted above, it is the function of the Capture Module 120 to capture the Changed Region 302 defined by the Accumulated Changed Rectangle 304 provided by the Monitor Module 122, and send data corresponding to the region 302 over the network 15 to the server 20.

The Capture Module 120 listens on an IP port of a TCP/IP network, although other network protocols are contemplated under the present invention. All TCP/IP communications and protocols are handled by the Capture Module 120.

In one embodiment, the Capture Module 120 receives instructions from the server (over the network) to either "Get First", or "Get Next". "Get First" instructs the Capture Module to grab the entire desktop and begins sending it to the server over the network. "Get Next" instructs the Capture Module to grab a Changed Region (including all changes since the last grab), and begin sending the Changed Region to the server over the network, unless there is some data remaining in the Capture Module from a previous capture. In the case of the latter, the remaining data (or a portion thereof) is transferred as detailed below.

In an alternate configuration, it may also be possible to provide the Capture Module with three basic instructions from the server over the network, to begin monitoring, end monitoring, or to respond to a data poll requesting Changed Region data.

If the server instructs the Capture Module 120 to "Get First", the Capture Module sends an instruction to the Monitor Module 122 to begin (or to resume) monitoring, which typically includes an instruction to reset Changed Region boundaries as described in further detail below. The Monitor Module 122 then resumes a process of intercepting and interpreting graphics primitives (as described elsewhere in more detail) until the Capture Module 120 queries the Monitor Module 122 and is given the above-referenced coordinates of and Accumulated Changed Rectangle which bounds the Changed Region.

Under one embodiment of the present invention, every time the Monitor Module 122 is queried by the Capture Module 120, it returns a return code (indicating "screen changes" or "no screen changes") and the above-referenced screen coordinates (x.sub.1, Y.sub.1, x.sub.2, Y.sub.2). If the return code indicates changes have been made to the coordinates (x.sub.1, Y.sub.1, x.sub.2, Y.sub.2) since they were last reset, the coordinates (x.sub.1, Y.sub.1, x.sub.2, Y.sub.2) are used by the Capture Module 120 to capture the Changed Region. As described in detail below, Changed Region data is stripped of some of its color-related data, compressed, and then sent over the network to the server.

In order to store the bitmap of the Changed Region, the Capture Module 120 utilizes its own device context or "workspace". Its maximum size is the desktop. No presentation space allowing for viewing of the Capture Module's device context is needed for operation of the Capture Module, although one could be used for software diagnostic purposes.

After receiving the boundaries of the Changed Region, from the Monitor Module 122, the Capture Module 120 issues a graphics call to grab the bitmap which is defined by the Accumulated Changed Rectangle. When grabbing that bitmap, if the monitored workstation's desktop bitmap is 256 colors, the Capture Module can grab the bitmap into 16 color format, thus effectively "stripping" some data therefrom, thus reducing the amount of data to be sent over the network.

As noted above, the Monitor Module 122 sends the Changed Region screen coordinates (x.sub.1, Y.sub.1, x.sub.2, Y.sub.2) to the Capture Module 120 upon query from the Capture Module. Upon such a query, the coordinates (x.sub.1, Y.sub.1, x.sub.2, Y.sub.2) are immediately reset to their reset values (discussed in more detail below). Such resetting upon query is done as an atomic operation in order that screen changes are not missed between query and reset.

As noted above, the Changed Region screen coordinates (x.sub.1, Y.sub.1, x.sub.2, Y.sub.2) are periodically reset upon query by the Capture Module. These values correspond to the minimum x value, maximum y value, maximum x value, and maximum y value, respectively, for the pixels within the Changed Region. When reset, these values are set such that x.sub.1 is set to a value higher than the highest possible x value of any pixel on the desktop, x.sub.2 is set to a value lower than the lowest possible x value of any pixel on the desktop, y.sub.1 is set to a value higher than the highest possible y value of any pixel on the desktop, and Y.sub.2 is set to a value lower than the lowest possible y value of any pixel on the desktop. This allows the "update logic" to be consistent from the first time the coordinates need updating.

After the Changed Region is grabbed from the agent's desktop, it is then compressed (if so desired) by the Capture Module 120. Various compression techniques may be used without departing from the spirit and scope of the present invention.

It is now necessary to transfer the compressed Changed Region data along the network to the server. The poll from the server to the Capture Module 120 includes a maximum defined sample size which may be sent over the network, and may be restricted according to the network's data flow limitations. Therefore it may be understood that the data corresponding to the buffered Changed Region data may exceed the server-defined sample size. If so, the Capture Module 120 sends the Changed Region data along the network in multiple portions corresponding to sample size.

Each portion of at-most-sample-sized data is sent back to the server with flags to indicate if is the entire Changed Region Data ("Only in Chain") or if it is part of a chain of samples ("First in Chain", "Middle in Chain", "Last in Chain"). The server recognizes the flags and begins to store the data in a journal file (see FIG. 5) as described further below. After each sample is received by the server, it then waits a preset "poll delta" time period until sending another poll across the network to the Monitor Module 122 for the next sample.

As an example, if a particular Captured Region stored and compressed by the Monitor Module is 70K, and the sample size limit was 25K, the Monitor Module would send back three samples sized 25, 25, and 20K, in response to three polls, and upon the fourth server data poll the Capture Module 120 would query the Monitor Module for a new Accumulated Changed Boundary.

Reference is now made to FIG. 4, which illustrates instruction and data flow between the server 20, the Capture Module 120, and the Monitor Module 122. In the example shown, a first "Get First" command is given from the Server to the Capture Module (over the network connection). No query is needed from the Capture Module to the Monitor Module; this requires a full desktop grab, which after compression results in, for example, a 70K block of data to be sent from the Capture Module to the Server. As the defined maximum sample size over the network is for this example 25K, the response to the "Get First" command results in the return of a 25K data sample, followed by another 25K sample, followed by a 20K sample. After each sample is returned, a predetermined "poll delay" time period is allowed to pass before the next poll, a "Get Next" poll, is sent from the server. After the 70K (25+25+20) block of data corresponding to the first full desktop grab is received by the server, it is time stamped as detailed below and the server waits another "poll delay" time period until sending another "Get Next" poll. In the FIG. 4 example the Capture Module then does poll the Monitor Module 122 for the above-referenced screen coordinates (x.sub.1, Y.sub.1, x.sub.2, Y.sub.2). After receiving the coordinates, in the example shown, a 23K grab is made, which is within the 25K limit, thus allowing an "only-in-chain" transfer across the network to the Server. After waiting another "poll delay" (also known as a "poll delta") time period, the server sends another "Get Next" poll. In the FIG. 4 example, no screen changes had been made, so no Changed Region data is grabbed from the agent's desktop by the Capture Module.

It may be understood that the time periods between the poll delay periods are variable, depending on network traffic and processing times required by the Capture and Monitor Modules. This is consistent with that shown in FIG. 5 indicating that the Changed Region data is received at the server at varying time intervals.

The Monitor Module 122

As noted above, the Monitor Module 122 monitors particular graphics primitives being sent from the graphics engine 102 to the display driver 104. Such "monitoring" is done in one preferred embodiment by "hooking" the primitives through (in the case of OS/2) use of a user provided Dynamic Link Library (DLL) specified in file OS2.INI. This library in one preferred embodiment is the Monitor Module 122 (MONITOR.DLL, see FIG. 2). More detailed discussion of the "hooking" technique is provided below.

As noted above, between queries from the Capture Module 120, the Monitor Module 122 is intercepting and interpreting primitives and defining an Accumulated Changed Rectangle 304 (which defines the Changed Region). Upon query from the Capture Module 120, it will return to the Capture Module the screen coordinates of two separate points 306 and 308 in the form (x.sub.1, Y.sub.1, X.sub.2, Y.sub.2), identifying the Rectangle 304. As noted above, these two points correspond to opposing corners of the rectangular shaped Changed Region. This is all of the information sent to the Capture Module 120 from the Monitor Module 122. Immediately upon such query, the Monitor Module 122 resets the screen coordinates (x.sub.1, y.sub.1, x.sub.2, Y.sub.2) to their reset values as discussed above, and then again starts accumulating changed regions defined by the primitives.

Interpretation

As noted above, the Monitor Module 122 intercepts and interprets graphics primitives sent from the Graphics Engine 102 to the Display Driver 104.

As will be appreciated by one skilled in the art, when an application running under an operating system such as OS/2 wishes to perform output, actions common to any output device are handled by the Graphics Engine 102. Actions requiring knowledge of the specific output device are forwarded to a Presentation Driver.

OS/2, for example, requires that Presentation Drivers provide a entry point, OS2.sub.-- PM.sub.-- DRV.sub.-- ENABLE, through which an initialization sequence is performed. In one step of that initialization sequence, the Presentation Driver fills in a Dispatch Table. The Dispatch Table, which resides in the Graphics Engine's memory space, then contains pointers to functions residing in the Presentation Driver. The Dispatch Table provides the Graphics Engine with the functions to invoke when a graphic operation is to be performed on a specific piece of hardware. These graphic operations are frequently referred to as graphics primitives.

OS/2 also provides a mechanism for a program to examine, and modify, the contents of the Dispatch Table. In OS/2, by creating an entry in file OS2.INI, as detailed below, a user provided Dynamic Link Library, or DLL, is called soon after the Presentation Driver has initialized the Dispatch Table. The user provided DLL can then modify the dispatch table, and intercept future graphics primitive calls. The entries in the dispatch table are in predefined order. For example, we know that address of the graphics primitive GreBitblt resides in entry 0.times.26.

The required entry into OS2.INI is as follows:

Application Name: PM.sub.-- ED.sub.-- HOOKS

Key Name: PMDDHK

Text: ›filename of user provided DLL!

The user provided DLL provided under the present invention, below referred to as MONITOR.DLL (also known as the above-referenced "Monitor Module 122"), must and does provide an entry point, OS2.sub.-- PM.sub.-- DRV.sub.-- ENABLE. This entry point will be invoked with three parameters: 1) the subfunction, 0.times.0C, which indicates the meaning of the other parameters, 2) a pointer to some flags which we can ignore here, and 3) a pointer to a pointer to the dispatch table. When this function is called, MONITOR.DLL saves a copy of the original dispatch table, and modifies the dispatch table so that functions residing within MONITOR.DLL will be invoked rather than the original table entry. When the modified dispatch table is used to invoke graphics primitives, MONITOR.DLL will receive control. When any operation performed by MONITOR.DLL is complete, it then invokes the original graphic primitive by invoking the function through the address saved in the copy of the original dispatch table. This is easily accomplished since one of the parameters of every graphics primitive function contains its position in the dispatch table.

Once a primitive has been hooked, it receives control any time the primitive is invoked by the Graphics Engine. In general, MONITOR.DLL performs the following steps:

1) Process only if monitoring has been started (monStart).

2) Validate the parameters to ensure that pointers can successfully be dereferenced without a general protection fault occurring.

3) Process only if the operation is being performed on a screen device context rather than to memory or to a printer.

4) Calculate a candidate rectangle from the provided parameters. A candidate rectangle is a temporary rectangle to be considered for later inclusion in the Accumulated Changed Rectangle.

5) Convert from World to Screen Coordinate Space if necessary.

6) Clip the candidate rectangle to the clipping region--essentially the visible portion of the window being updated.

7) Accumulate the candidate rectangle into the Changed Region.

As an example of the above steps, we now consider GreBitBlt, which receives nine parameters.

1) A boolean variable is maintained within MONITOR.DLL which indicates whether monitoring has been started. Examine it to determine if more processing should be done.

2) Parameter three, cPoints, indicates the number of points contained in parameter four, paptlPoint. First ensure that the required number of points for our requirements are present (at least 2). Second, ensure that the memory pointed at by paptlPoint can be accessed.

3) Use the GreQueryDeviceCaps Graphics Engine function with parameter one, hdc, and CAPS.sub.-- FAMILY index. Examine the returned value, cOutData, to determine if the operation is to be performed on a screen device.

4) For GreBitBlt, paptlPoint will address the lower left and upper right points of the target rectangle. No further calculation is required to obtain the candidate rectangle for this primitive.

5) In OS/2, it is possible that different coordinate spaces are used. For the GreBitBIt primitive, parameter six includes a flag, BBO.sub.-- TARGWORLD, which indicates if the coordinate rectangle must be transformed into Device Coordinates. The Graphics Engine provides a function to do just that, GreConvert. The resulting rectangle will be the correct length and width, but may be relative to a window origin rather than relative to the screen origin. Use GreGetDCOrigin and shift the rectangle if the Device Context origin is not equal to the screen origin.

6) The Clipping Region, maintained by the Graphics Engine, indicates where the Graphics Engine permits drawing. It generally excludes portions of an application window which are not visible because they are covered by other windows. The MONITOR.DLL queries the bounding rectangle of the Clipping Region via GreGetClipBox and converts to Screen Coordinates with GreGetDCOrigin. It then calculates the intersection of the candidate rectangle and the Clip Box. The resulting rectangle describes the area of the screen which will be impacted by the GreBitBlt operation.

7) Each candidate rectangle is merged into an Accumulated Changed Reectangle. The Accumulated Changed Reectangle is the area which bounds all of the candidate rectangles processed since the last Reset.

In the example above, GreBitBlt, the Graphics Engine provides a candidate rectangle directly as indicated in step four above. Other primitives supply different parameters, but the update area can be readily calculated with simple arithmetic operations. For example, GreDisjointLines provides an array of points and the number of points in the array. To calculate the update area, one can simply iterate through the array, finding the minimum values for xLeft (x1 in the figures) and yBottom (y1in the figures), and the maximum values for xRight (x2in the figures) and yTop (y2in the figures). The resulting points define the rectangle which will bound all of the points in the array. GrelmageData draws a single horizontal line relative to the current position in the device context. The current position is maintained by the graphics engine, and can be queried with GreGetCurrentPosition. One of the parameters to the GrelmageData function indicates the number of pels to be drawn, and a second parameter indicates which row relative to the current position. From this data, the condidate rectangle can be determined.

MONITOR.DLL also contains three functions provided for use by the Capture Module 120: monStart, monStop, and monQueryBounds. These three functions control the accumulation and reporting of updated screen regions.

The function monStart starts the monitoring or "evaluation" of the graphics primitives. The function monStop stops the evaluation of the graphics primitives, although the graphics primitives are still being hooked.

Of particular interest is monQueryBounds, which not only reports the updated portion of the screen (or reports that no changes have occurred), but allows the Monitor Module 122 to reset the Accumulated Changed Rectangle. With this single function call, a user application can poll MONITOR.DLL to find changed areas of the display.

Other additional considerations must also be noted. In a multitasking operating system such as OS/2, care must be taken that updates to the bounding rectangle are performed in a single, atomic operation. This can be accomplished with mutex semaphores. Any operation which acquires the semaphore should execute quickly and release the semaphore. Since any process which writes to the display does so via the hooked graphic primitives, it would be unacceptable for the semaphore to cause any thread to block for any significant period of time.

Not all of the graphics primitives relate to screen updating. However, out of the approximately 200 Graphics Primitives used in OS/2, the following Graphics Primitives have been found to cause screen updates:

GreDisjointLines

GrePolyLine

GreDrawLinesInPath

GrePolyShortLine

GrePolyScanLine

GreDrawBits

GreBitblt

GreSetPel

GrelmageData

GreRestoreScreenBits

GreDrawBorder

GreCharString

GreCharStringPos

GrePolyMarker

GreCharRect

GreCharStr

GreScrollRect

GreErasePS

There are other Graphic Primitives, although not actually drawing on the screen, as will be understood to those skilled in the art provide needed information regarding screen drawing:

GreGetCurrentPosition

GreGetClipBox

GreConvert

GreDeath

GreQueryDeviceCaps

GreResurrection

GreGetDCOrigin

In Windows 3.1, the connection between the graphics engine and Display Drivers is similar in architecture compared to that used in OS/2. However, since Windows 3.1 does not provide an architected method to hook graphics primitives, an alternative method must be used.

Windows 3.1 stores the dispatch table in memory owned by GDI.EXE (the graphics engine). In order to modify the contents of the dispatch table so that we may hook graphics primitives, we must first search the GDI heap for the dispatch table. Windows provides a function, SystemHeapInfo, which provides a starting place for that search.

Use the Windows functions GlobalFirst and GlobalNext to walk through the global memory heap looking for memory owned by GDI. For each memory block owned by GDI, use LocalFirst and LocalNext to walk through the memory block. Each item in the local heap is a GDI object such as a device context, a font, a pen, a brush, or other GDI object. These objects can be identified by a signature at a known offset into the object. For our purposes, we search for the signature of a device context, 0x6f4d. Also at a known offset into the device context is a pointer to the dispatch table.

Since we have relied upon undocumented features of Windows 3.1 to find the dispatch table (device context signature and offset of the dispatch table), it is sensible to verify that we have indeed correctly located the dispatch table. This can be done by the following technique: compare the first entry of the dispatch table, which is the address of the BitBlt function in the display driver, to the address of the BitBlt function which we determine by use of the LoadLibrary and GetProcAddress functions. If the addresses are equal, we can safely assume that we have found the dispatch table.

Once the dispatch table has been found, a copy of the original is made and retained. Updates are then made to the original so that MONITOR.DLL gains control when graphic primitives are called. When information of interest has been extracted, control is passed to the original graphic primitive.

Hooked primitives include:

BitBlt

Output

Pixel

ExtTextOut

FastBorder

SetDIBitsToDevice

StretchBlt

StretchDIBits

BitmapBits

Capture Software Operation

Sequential operation of the capture process will now be described. A poll is issued from the server application over the network to a Capture Module 120 installed on an agent's workstation. The Capture Module 120 responds by sending a query to the Monitor Module 122, which has been constantly accumulating boundaries of the Changed Region. In response to the query, the Monitor Module 122 sends the coordinates of a rectangle bounding the Changed Region, or indicates that no changes have occurred. The Monitor Module then resets the Accumulated Changed Rectangle and begins accumulating new boundaries until it is queried again by the Capture Module 120.

At this point, the Capture Module has the rectangular coordinates of the Changed Region, which in the preferred embodiment is rectangular. In one embodiment, the coordinates are defined by two points at opposing corners of the rectangle. With the knowledge of the coordinates, the Capture Module utilizes the operating system to grab the actual Changed Region image displayed on the screen. Such grabbed data is compressed and sent to the server for time stamping and storage for later decompression and display, or can also be immediately sent to the supervisor's workstation for "real time" viewing. Typically, such "screen portions" are simply overwritten onto the previous screen.

Therefore it may be seen that as changes occur on the agent's desktop, the Monitor Module determines the region of the changes caused by such input, but when the poll comes in from the network to the Capture Module, capturing of the image actually occurs via the Capture Module.

As an example, as shown in FIGS. 3a-3c, assume that alphanumeric characters are typed by the agent between the polls sent to the Monitor Module 122. The invention allows for the determination of the size and location of the window which included these six characters, and allows the Capture Module to grab a rectangular screen portion which circumscribes the alphanumeric characters, whereupon the captured image of same is sent to the server where is it can later be "pasted" over an image corresponding to the screen image seen prior to the typing of the alphanumeric characters.

It may be noted that if the agent is sitting there doing nothing, every time the Capture Module 120 is polled from the network server, it will respond by effectively saying that, "nothing has changed" (as it mas been instructed by the Monitor Module 122) and no further processing will be necessary. It may be understood that this is more efficient than having to grab and compare two identical screen displays, although total screen comparison is also contemplated as an alternate embodiment of the present invention.

The Server

The server consists of server hardware and software installed thereon. The hardware for the server may consist of a Pentium-based PC including voice and network cards, although other hardware may be used without departing from the spirit and scope of the present invention.

The server software includes an operating system such as OS/2, although other operating system software may be used without departing from the sprit and scope of the present invention. In reference to FIG. 7, other software installed on the server includes:

Kernal software

User System software

Data Collection System software

Voice System software

Filter System software (a.k.a. "Filter")

Schedule System software (a.k.a. "Scheduler")

Database software

The Kernal software spawns which include the main controlling processes, which include the User System, Data Collection system, Voice System, Filter System, and Schedule System processes.

The User System software is responsible for accepting user connections from the supervisor software, and for spawning a process to interact with that user, so that each user gets an dedicated process per user. If data to be sent to user it is responsible for actually sending the data to the user over the network. The User System software includes the User Manager (See FIGS. 8 and 9) The User Manager provides the connection of the User System to the network, thus allowing the user to provide monitoring instructions.

The Data Collection System software is responsible for collecting Changed Region data. The Data Collection software includes a Device Manager (See FIGS. 8 and 9) and one or more "virtualized" Agent Devices, each of which corresponds to a particular agent workstation configuration (e.g. OS/2, Windows, etc.,). In the event of multiple agent monitoring, the Agent Device is responsible for tracking each separate monitoring event by allocating a thread for each monitor event.

The Voice System software controls the voice hardware, which is conventional in nature and allows for "live" monitoring of an agent's telephone extension at a remote (e.g. the supervisor/user's) extension, and/or allows for digital storage of the agent's telephone conversation on the server hard drive for later playback in sync with Changed Region data through use of a scriptlike journal file and a replay engine as discussed in detail below. The Voice System software and hardware is conventional, and different configurations may be used without departing from the spirit and scope of the present invention.

The Filter system also allows for random monitoring. The Filter System software provides filtering processes to allow remote device events to be acted upon. For example, if wire transfers are possible from an agent's workstation, it may be desired to record related on-screen and/or voice-related events for purposes of providing an audit trail.

The Schedule System software allows for users to schedule future monitoring events for later playback. For example, monitoring of a particular agent could be scheduled for later specific periods.

The Database software is conventional, and allows for the storage of information such as agent location, workstation type, stored Changed Region data information, voice data storage locations, etc.

Operation of the server is described generally as follows in reference to FIG. 7. After receiving a "start monitor" command (either live from a user through a User Executable or pursuant to scheduling via the Schedule System), the Data Collection System on the server sends a poll to the Capture Module 120 on the monitored workstation 30, and waits to receive data from the Capture Module corresponding to the Changed Region. Upon receiving this data, the Data Collection System passes the data on to the User System, which either passes the data on to the Monitoring Workstation 40 (see also FIG. 1) in the case of live monitoring, and/or stores the data in memory for later playback.

Reference is now made to FIG. 8, to illustrate more details relating to live monitoring. In step "1", the supervisor connects through supervisor software on his/her workstation with a unique "User Executable" which has been spawned by the User Manager. In the case of multiple monitoring events, multiple User Executables are spawned and are all under the domain of the User Manager. The User Manager and the spawned User Executables comprise the User System.

Continuing in reference to FIG. 8, in step "2", the User Executable gets a "start monitor" request from the supervisor/user and forwards the request to the Device Manager, which determines at step "3" which of the available Agent Device processes (e.g. OS/2, windows, etc.) would get the request. The selected Agent Device at step "4" sends the start monitor command to the actual capture software on the agent's workstation. Data and responses would then flow back at step "5" as described above.

It should be noted that the Agent Device can provide flow control for data transmitted over the network. It knows the amount of monitored connections, as well as the number of samples "queued" by the corresponding Capture Modules, so it can dynamically reduce sample size to keep overall network traffic within a threshold. This is one important aspect of the present invention.

When the Agent Device gets Changed Region data back, it stores it in server RAM and sends its stored address to the User Manager at step "6". The User Manager determines which user wanted the monitor, and then sends at step "7" the Changed Region data storage location to the User Executable assigned to that user. The User Executable includes as a source file a replay engine, which plays back the Changed Region data along the network (step "8") to the user/supervisor.

In the case of live monitoring such as described above, it may be understood that the server passes on Changed Region data from the agent's Monitored Workstation to the user's Monitoring Workstation while at the same time providing live telephone monitoring of the agent by the user. This allows the user to monitor the agent's on-screen activities while at the same time listen to the agent's telephone conversation(s). It may be understood that such a monitoring "session" could extend over one or more different telephone calls made/received by the agent.

Reference is now made to FIG. 9, to illustrate the case of scheduled monitoring. In this instance, the Scheduler (being part of the Schedule System) issues a "start monitor" command to the Device Manager, and steps 2-5 of FIG. 9 follow in a manner preferably identical to steps 3-6 immediately above in connection with FIG. 8. However, as shown by step 6 in FIG. 9, typically the User Manager then sends the Changed Region data information to a Journal File where it is time stamped for later replay in sync with the recorded voice data by the Replay Engine. It should be noted that a Journal File could also be created in the "live monitoring" example of FIG. 8; in such an instance live and later monitoring is possible.

The journal file is created by the process which issues the start monitor command, if the record mode is selected. In the case of live monitoring, the journal file will be created by a User Executable. In the case of scheduled monitoring, the journal file will be created by a Schedule System. After creation of the journal file, Changed Region data is written to the journal file as it is received by the User Manager. A typical journal file configuration is shown in FIG. 5. The header of the journal file has the entire journal file database record for safety purposes in case the Database ever gets corrupted. The journal file is in essence a script which is played back later by the Replay Engine.

When the Agent Device confirms contact with the Capture Module of the monitored workstation, it spawns a thread, which begins to poll the Capture Module. At the same time, another separate thread will be sent from the server to the Voice System software, giving it an agent extension number of "login" number, and commanding it to begin recording on a particular channel until told to stop. The login number is utilized to instruct the phone switch hardware to route the voice audio into the connected voice channel, whereupon it can be monitored live or digitally stored.

The two above threads to the Capture Module and the Voice System software are initiated synchronously--they can happen in any order. However, the Voice System software will typically begin recording first because its instructions do not have to go over the network. This is demonstrated in FIG. 5 (showing the journal file 500 makeup), in which the small circle on the time line illustrates a time stamped "begin voice playback" event, written to the journal file before any Changed Region data event is written to the journal file. Similarly, the small triangle on the time line illustrates a time stamped "stop voice playback" event, which is also typically written the journal file before the last Changed Region data event is written to the journal file. Such time stamping of recorded voice events allows for later playback of the Changed Region data in time sync with the recorded voice data, through the use of conventional voice recording and playback techniques.

The Monitoring Workstation

As noted above, the supervisor's workstation is hooked up to the network through a TCP/IP connection.

The supervisor's workstation includes hardware suitable for running an operating system such as OS/2, and software loaded thereon.

The supervisors software includes "front-end" software, which allows someone at the supervisor's workstation to modify the Database Module on the server allowing for definitions as to where a particular agent sits, etc. The supervisor's software also includes software to allow the user to send commands to the user's corresponding User Executable, thus allowing the user to drive the User Executable's Replay Engine for replay of the journal file, to perform live monitoring, or to perform housekeeping duties such as the deletion of old journal files.

Voice Hardware

The voice hardware 50 is typically in the form of a voice card mounted within the server, and is typically wired into the telephone system used to provide telephone extensions to the supervisor and the agent. This configuration can vary depending on whether T1, analog, or digital phone configurations are used.

Alternate Screen Captive Technique

It may be noted that a somewhat separate but related invention is contemplated by applicant, that being the use of "total screen comparison" of two sequential desktop images. Such images are grabbed from the desktop by a Monitor Module (no Capture Module needed) compared for differences, and a Changed Region is defined which includes the screen difference. Such a Changed Region can be sent for viewing at a remote location such as described above. It may be understood that in this alternate configuration, graphics primitives are not "hooked" or evaluated.

Miscellaneous

The Capture Module 120 and Monitor Module 122 software programs can be written in languages such as C, C++, and assembly, although other software languages could be used without departing from the spirit and scope of the present invention.

Conclusion

While this invention has been described in specific detail with reference to the disclosed embodiments, it will be understood that many variations and modifications may be effected within the spirit and scope of the invention as described in the appended claims.