Automatic masking of sensitive data

Patent metadata

Field	Value
Publication number	US-9965648-B1
Application number	US-201715480512-A
Country	US
Kind code	B1
Filing date	Apr 6, 2017
Priority date	Apr 6, 2017
Publication date	May 8, 2018
Grant date	May 8, 2018

Abstract

A masking system and method for automatically masking sensitive user information on a webpage is provided. The method includes the steps of identifying a location of the first user data of the first type of sensitive user information on the webpage, updating an initial path to the first user data to account for changes to the initial path detected in response to repeated visits to the webpage, wherein the updated initial path to the first user data is stored as a stable path, locating a second user data associated with a second type of sensitive user information on the webpage, by accessing a central database containing path information to a location of the second user data on the webpage, and masking the first user data and the second user data on the webpage, using the stable path and the path information obtained from the central database.

First claim

The invention claimed is:

1. A method for automatically masking sensitive user information on a webpage, the method comprising:
obtaining, by a processor of a computing system, a first user data associated with a first type of sensitive user information;
identifying, by the processor, a location of the first user data of the first type of sensitive user information on the webpage, the location being stored as an initial path;
updating, by the processor, the initial path to the first user data to account for changes to the initial path detected in response to repeated visits to the webpage, wherein the updated initial path to the first user data is stored as a stable path;
locating, by the processor, a second user data associated with a second type of sensitive user information on the webpage, by accessing a central database containing path information to a location of the second user data on the webpage; and
masking, by the processor, the first user data and the second user data on the webpage, using the stable path and the path information obtained from the central database.

2. The method of claim 1 , wherein the obtaining includes accessing an autofill database, the autofill database being a browser cache that contains the first type of sensitive user information.

3. The method of claim 1 , wherein the first user data is identified by scanning the webpage.

4. The method of claim 1 , further comprising maintaining, by the processor, the central database by: (i) analyzing a timestamp associated with a path information entry and removing old entries from the central database, (ii) removing path information that no longer corresponds to a correct location on the webpage, and (iii) continuously receiving new path information from other users.

5. The method of claim 1 , wherein the central database is a shared pool of hashed data related to path information for the second type of sensitive user information, such that other users send path information pertaining to personal data of the other users data associated with the second type of sensitive user information, further wherein a privacy of the other user data is protected by hashing the other user data and path information.

6. The method of claim 1 , wherein updating the initial path to obtain the stable path comprises:
additionally identifying, by the processor, the location of the first user data on the webpage based on a return visit to the webpage, and storing a new path;
comparing, by the processor, the initial path with the new path to determine a presence of new values in the new path, which are not present in the initial path, the new values reflecting a time difference between an initial visit to the website that resulted in the initial path and the return visit to the webpage;
replacing, by the processor, the new values in the new path with a token value, to obtain the stable path, which is resistant to the changes to a path of the first user data associated with the time difference.

7. The method of claim 1 , wherein the second type of sensitive user information is less distinctive and harder to locate on the webpage than the first type of sensitive user information.

8. A computer system, comprising:
a processor;
a memory device coupled to the processor; and
a computer readable storage device coupled to the processor, wherein the storage device contains program code executable by the processor via the memory device to implement a method for automatically masking sensitive user information on a webpage, the method comprising:
obtaining, by a processor of a computing system, a first user data associated with a first type of sensitive user information;
identifying, by the processor, a location of the first user data of the first type of sensitive user information on the webpage, the location being stored as an initial path;
updating, by the processor, the initial path to the first user data to account for changes to the initial path detected in response to repeated visits to the webpage, wherein the updated initial path to the first user data is stored as a stable path;
locating, by the processor, a second user data associated with a second type of sensitive user information on the webpage, by accessing a central database containing path information to a location of the second user data on the webpage; and
masking, by the processor, the first user data and the second user data on the webpage, using the stable path and the path information obtained from the central database.

9. The computer system of claim 8 , wherein the obtaining includes accessing an autofill database, the autofill database being a browser cache that contains the first type of sensitive user information.

10. The computer system of claim 8 , wherein the first user data is identified by scanning the webpage.

11. The computer system of claim 8 , further comprising maintaining, by the processor, the central database by: (i) analyzing a timestamp associated with a path information entry and removing old entries from the central database, (ii) removing path information that no longer corresponds to a correct location on the webpage, and (iii) continuously receiving new path information from other users.

12. The computer system of claim 8 , wherein the central database is a shared pool of hashed data related to path information for the second type of sensitive user information, such that other users send path information pertaining to personal data of the other users data associated with the second type of sensitive user information, further wherein a privacy of the other user data is protected by hashing the other user data and path information.

13. The computer system of claim 8 , wherein updating the initial path to obtain the stable path comprises:
additionally identifying, by the processor, the location of the first user data on the webpage based on a return visit to the webpage, and storing a new path;
comparing, by the processor, the initial path with the new path to determine a presence of new values in the new path, which are not present in the initial path, the new values reflecting a time difference between an initial visit to the website that resulted in the initial path and the return visit to the webpage;
replacing, by the processor, the new values in the new path with a token value, to obtain the stable path, which is resistant to the changes to a path of the first user data associated with the time difference.

14. The computer system of claim 8 , wherein the second type of sensitive user information is less distinctive and harder to locate on the webpage than the first type of sensitive user information.

15. A computer program product, comprising a computer readable hardware storage device storing a computer readable program code, the computer readable program code comprising an algorithm that when executed by a computer processor of a computing system implements a method for automatically masking sensitive user information on a webpage, the method comprising:
obtaining, by a processor of a computing system, a first user data associated with a first type of sensitive user information;
identifying, by the processor, a location of the first user data of the first type of sensitive user information on the webpage, the location being stored as an initial path;
updating, by the processor, the initial path to the first user data to account for changes to the initial path detected in response to repeated visits to the webpage, wherein the updated initial path to the first user data is stored as a stable path;
locating, by the processor, a second user data associated with a

Assignees

• IBM

Inventors

• Cheng Ching-Wei
• Kuo Tzu-Ching
• Lin June-Ray
• Tsai Yi-Chun

Classifications

• G06F21/6245 Primary

  Protecting personal data, e.g. for financial or medical purposes · CPC title

• G06F2221/032

  Protect output to user by software means · CPC title

• H04L9/0643

  Hash functions, e.g. MD5, SHA, HMAC or f9 MAC · CPC title

• G06F21/50

  Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems · CPC title