AUTOMATICALLY MASKING SENSITIVE INFORMATION DURING SCREEN SHARING

Aspects for automatically masking sensitive information during screen sharing are described. In an embodiment, one or more processors are configured for detecting a first event corresponding to a start screen sharing session in a webpage browser; transmitting a first notification to the webpage browser to indicate the first event; masking sensitive data images in the webpage browser; detecting a second event corresponding to a stop screen sharing session in the webpage browser; transmitting a second notification to the webpage browser to indicate the second event; and unmasking the sensitive data images in the webpage browser upon receipt of the second notification. The first event and the second event are detected by a screen capturing agent in communication with the webpage browser. Communications between the screen capturing agent and the webpage browser are facilitated using Inter-Process Communication (IPC).

BACKGROUND

The present invention relates generally to the field of computer webpage privacy, and more particularly to automatically masking sensitive data in a webpage during a screen sharing session.

During an interactive web-based session, where a number of users are actively engaged in a videoconferencing platform, one or more of the users may share content within the videoconferencing platform. For example, a first user may be presenting information to other users using a screenshare feature so that the other users are able to view the first user's screen. During the screensharing session, the first user may share a webpage that may enable other users to view the webpage and sensitive information (e.g., passwords, API key) displayed on that webpage. This is a potential security vulnerability, which can be exploited by the other users viewing the first user's screen, especially if one or more of the other users takes a screenshot or records the shared screen or remembers the sensitive information and uses it to gain unauthorized access to some protected application or service.

SUMMARY

Aspects of the present invention disclose a computer-implemented method, computer program product, and computer system for automatically masking sensitive information during screen sharing. One embodiment of the invention may include a computer-implemented method for automatically masking sensitive information during screen sharing.

In an embodiment, the computer-implemented method may include one or more processors configured for detecting a first event corresponding to a start screen sharing session in a webpage browser; transmitting a first notification to the webpage browser to indicate the first event; masking, by the one or more processors, sensitive data images in the webpage browser; detecting, by the one or more processors, a second event corresponding to a stop screen sharing session in the webpage browser; transmitting, by the one or more processors, a second notification to the webpage browser to indicate the second event; and unmasking, by the one or more processors, the sensitive data images in the webpage browser upon receipt of the second notification. In an embodiment, the first event and the second event are detected by a screen capturing agent in communication with the webpage browser.

The computer-implemented method may further include one or more processors configured for facilitating communication between the screen capturing agent and the webpage browser using Inter-Process Communication (IPC). In an embodiment, prior to detecting the first event, the computer-implemented method may further include one or more processors configured for identifying the sensitive data images to be displayed in the webpage browser.

In an embodiment, the computer-implemented method may further include one or more processors configured for embedding a sensitive data tag in the webpage browser configured to enclose the sensitive data images. The sensitive data tag may be configured to mask the sensitive data images upon receiving the first notification and unmask the sensitive data images upon receiving the second notification.

In an embodiment, responsive to receiving the first notification at the webpage browser, the computer-implemented method may further include one or more processors configured for modifying a Document Object Model (DOM) to mask the sensitive data images. In an embodiment, responsive to receiving the second notification at the webpage browser, the computer-implemented method may further include one or more processors configured for modifying a Document Object Model (DOM) to unmask the sensitive data images.

DETAILED DESCRIPTION

Embodiments of the present invention may include one or more processors configured for utilizing inter-process communication (IPC) to resolve a communications gap between the webpage browser and the screen capturing agent as a component operating within a computing device or on a server. Further, the one or more processors may be configured to perform tagging of sensitive elements within a webpage that should be masked and unmasked in appropriate situations. Tagging the sensitive elements can be done during a development stage of the webpage using hypertext markup language (HTML), wherein sensitive elements within the webpage would be surrounded with <sensitive></sensitive> tags, which would serve as an indicator to the webpage browser which elements within the webpage should be masked and unmasked under appropriate situations.

Further, in an embodiment, the one or more processors may be configured to bring both the webpage browser and the screen capturing agent in synchronization by creating a shared memory area within the available system memory of the computing device associated with the user. For example, a shared variable may be used as a flag or a tag, to be turned on and off by the screen capturing agent to represent screen capturing activity status or event to be started and stopped, respectively. In this embodiment, the webpage browser operating within the user interface of the computing device may be configured to share the same memory resource with the screen capturing agent that is configured to continuously perform a polling operation on the shared variable to check the flag status. In the event when the flag is on, the webpage browser may be configured to infer that the screen is being shared in order to update the Document Object Model (DOM) of the presently rendered webpage, so that the sensitive elements are masked out and the visibilities of the sensitive elements are protected from the unauthorized viewing users.

In another embodiment, during a successive poll, in the event when the flag is off, the webpage browser may be configured to infer that the screen sharing event has stopped and would update the DOM again to unmask the sensitive elements. However, there may be a chance that the webpage browser is lagging by a controllable extent while performing its due masking and unmasking operations in response to screen capturing agents set and unset of the flag variable. This may result due to a time gap between the screen capturing agent setting or unsetting the flag variable, and the instant, the webpage browser is actually reading the variable. In order to minimize such lag, the one or more processors may be configured to configure the webpage browser to read the flag variable on a more frequent basis, such that the variable will be read prior to the screen sharing event occurring.

In an embodiment, the one or more processors may be configured to perform message passing, wherein the screen capturing agent is configured to create and send a message to the webpage browser immediately prior to the start screensharing event. Upon receipt of the message, the webpage browser may be configured to mask the sensitive elements from the rendered webpage. Further, momentarily after stopping the screensharing event, the screen capturing agent may be configured to send another message to the webpage browser, upon receipt of which, the webpage browser may be configured to unmask all the sensitive elements that were masked earlier.

Furthermore, in another embodiment, the screen capturing agent may be configured to be forced to wait for an acknowledgement message from the webpage browser, which the webpage browser would send back to the screen capturing agent upon successful masking of the sensitive elements and the screen capturing agent may be configured to start the screen capturing event.

In an embodiment, the computer-implemented method may include one or more processors configured for detecting a first event corresponding to a start screen sharing session in a webpage browser; transmitting a first notification to the webpage browser to indicate the first event; masking, by the one or more processors, sensitive data images in the webpage browser; detecting, by the one or more processors, a second event corresponding to a stop screen sharing session in the webpage browser; transmitting, by the one or more processors, a second notification to the webpage browser to indicate the second event; and unmasking, by the one or more processors, the sensitive data images in the webpage browser upon receipt of the second notification. In an embodiment, the first event and the second event are detected by a screen capturing agent in communication with the webpage browser.

The computer-implemented method may further include one or more processors configured for facilitating communication between the screen capturing agent and the webpage browser using IPC.

In an embodiment, prior to detecting the first event, the computer-implemented method may further include one or more processors configured for identifying the sensitive data images to be displayed in the webpage browser.

In an embodiment, the computer-implemented method may further include one or more processors configured for embedding a sensitive data tag in the webpage browser configured to enclose the sensitive data images. The sensitive data tag may be configured to mask the sensitive data images upon receiving the first notification and unmask the sensitive data images upon receiving the second notification.

In an embodiment, responsive to receiving the first notification at the webpage browser, the computer-implemented method may further include one or more processors configured for modifying a DOM to mask the sensitive data images. Responsive to receiving the second notification at the webpage browser, the computer-implemented method may further include one or more processors configured for modifying a DOM to unmask the sensitive data images.

Example embodiments described herein provide for methods, systems, and computer program products for automatically masking sensitive information during screen sharing.

FIG. 1depicts a block diagram of a distributed data processing environment for automatically masking sensitive information during screen sharing, in accordance with an embodiment of the present invention.FIG. 1provides only an illustration of one embodiment of the present invention and does not imply any limitations with regard to the environments in which different embodiments may be implemented.

In the depicted embodiment, distributed data processing environment100includes computing device120, server125, and database124, interconnected over network110. Network110operates as a computing network that can be, for example, a local area network (LAN), a wide area network (WAN), or a combination of the two, and can include wired, wireless, or fiber optic connections. In general, network110can be any combination of connections and protocols that will support communications between computing device120, server125, and database124. Distributed data processing environment100may also include additional servers, computers, or other devices not shown.

Computing device120operates to execute at least a part of a computer program for automatically masking sensitive information during screen sharing. In an embodiment, computing device120may be configured to send and/or receive data from one or more of the other computing device(s) via network110. Computing device120may include user interface122configured to facilitate interaction between a user and computing device120. For example, user interface122may include a display as a mechanism to display data to a user and may be, for example, a touch screen, light emitting diode (LED) screen, or a liquid crystal display (LCD) screen. User interface122may also include a keypad or text entry device configured to receive alphanumeric entries from a user. User interface122may also include other peripheral components to further facilitate user interaction or data entry by user associated with computing device120.

In some embodiments, computing device120may be a management server, a web server, or any other electronic device or computing system capable of receiving and sending data. In some embodiments, computing device120may be a laptop computer, tablet computer, netbook computer, personal computer (PC), a desktop computer, a smart phone, or any programmable electronic device capable of communicating with database124, server125via network110. Computing device120may include components as described in further detail inFIG. 6.

Computing device120may be configured to receive, store, and/or process data received via communication with other computing device(s) connected to network110. For example, computing device120may be communicatively coupled to database124and/or server125and receive, via a communications link, data corresponding to web-based screen sharing/recording applications. Computing device120may be configured to store the data in memory or transmit the data to database124and/or server125via network110for further storage and/or processing.

Database124operates as a repository for data flowing to and from network110. Examples of data include screen sharing session data, notification data, masking data, unmasking data, and other data that may be determined based on the previously mentioned data. A database is an organized collection of data. Database124can be implemented with any type of storage device capable of storing data and configuration files that can be accessed and utilized by computing device120and/or a database server, a hard disk drive, or a flash memory. In an embodiment, database124is accessed by computing device120to store data corresponding to automatically masking sensitive information during screen sharing. In another embodiment, database124may reside elsewhere within distributed network environment100provided database124has access to network110.

Server125operates to execute at least a part of a computer program for automatically masking sensitive information during screen sharing. Server125can be a standalone computing device, a management server, a web server, or any other electronic device or computing system capable of receiving, sending, and processing data and capable of communicating with computing device120and/or database124via network110. In other embodiments, server125represents a server computing system utilizing multiple computers as a server system, such as a cloud computing environment. In yet other embodiments, server125represents a computing system utilizing clustered computers and components (e.g., database server computers, application server computers, etc.) that act as a single pool of seamless resources when accessed within distributed data processing environment100. Server125may include components as described in further detail inFIG. 6.

FIG. 2depicts a block diagram of a system200for automatically masking sensitive information during screen sharing, in accordance with an embodiment of the present invention. In an embodiment, webpage browser222is a software program executing on computing device120that is configured to enable a user to fetch webpages from remote web servers and render those pages so that the information within the webpages is conveyed to the user in the intended manner. The webpages typically consist of various elements including texts, graphics, and multi-media objects (e.g., audio, video). Example webpages may secure the various elements using authentication and authorization techniques configured to convey sensitive information. In this example, the one or more processors may be configured to receive user authentication information to authorize the user based on the user identity provided via biometric data or based on other user credentials provided via user identification information.

Further, the one or more processors may be configured to determine if the user has the appropriate permission to access the server to view or access the various elements displayed on webpage browser222. An important aspect of embodiment described herein is that the web server may be configured to keep the visibility of the various elements (e.g., “sensitive_text_visible”) limited to the intended user only (i.e., the user who had requested the webpage and had been able to pass all the authentication measures). For example, computing device120associated with the user may be configured to make images displayed on a connected monitor visible to one or more users through a modern electronic technique (e.g., screen sharing) in a web-conference or a screen activity recording, wherein the sensitive information will be hidden from the unauthorized viewing users.

FIG. 3depicts a block diagram of a system300for automatically masking sensitive information during screen sharing, in accordance with an embodiment of the present invention. In an embodiment, the one or more processors may be configured to detect310a start screensharing event in a webpage browser. For example, one or more processors (e.g., screen capturing agent330) may be a web-based conferencing component executing within computing device120configured to receive user input corresponding to a command to begin a screensharing event while executing a visual program within the user interface. Further, the user may be referred to as a presenter who may electronically share a view of their computer screen to the other participants of the conference. In another embodiment, screen capturing agent330may be a web-based conferencing component executing within computing device120configured to receive user input corresponding to a command to begin a screen recording event, wherein the user screen may be recorded in a video format. During a screen recording, the one or more processors may be configured to capture or record all parts of the user's computer display at a given point in time.

In an embodiment, the one or more processors may be configured to transmit312a first notification to a webpage browser, e.g., webpage browser222, about the start screensharing event. For example, upon initiation of the screensharing event, the one or more processors may be configured to generate a notification to alert the user that at least a portion of the webpage browser is being shared with other participants in the web-based conference. Further, at the webpage browser end, the one or more processors may not be configured to know which elements of the presently rendered webpage are sensitive unless provided with some indication of the sensitive text. For example, if a user shares a screen with other users, the webpage browser may not be equipped to automatically hide sensitive information. Therefore, the one or more processors may be configured to receive instructions to identify sensitive text to be displayed during a screen sharing event.

In an embodiment, the one or more processors may be configured to mask314sensitive data images in the webpage browser after a start screensharing event has occurred. For example, the web server may be configured to hide the visibility of the various elements (e.g., “sensitive_text_visible”) and make the hidden elements visible to the intended user only. For instance, the one or more processors may be configured to receive instructions from the user or from a software program to tag sensitive information that may be displayed within webpage browser222of computing device120. A tag may include HTML code or any other computer programming instructions configured to label certain text or data images that correspond to sensitive information. Then, once the webpage browser receives a screensharing event notification or detects310a start screensharing event, the one or more processors may be configured to hide the text or images corresponding to the labeled sensitive information. So once the screensharing event begins, the sensitive data images will be hidden or masked from the other users participating in the web-based conference.

FIG. 4depicts a block diagram of a system400for automatically unmasking sensitive information during screen sharing, in accordance with an embodiment of the present invention. In an embodiment, using screen capturing agent330, the one or more processors may be configured to detect410a stop screensharing event in a webpage browser, e.g., webpage browser222of computing device120. For example, the stop screensharing event may be detected as a user input corresponding to a command to terminate the screensharing access. The stop screensharing event may also be detected as a computer program instruction corresponding to a command to terminate the screensharing access, wherein the instruction may be based on a condition of time, security, or another condition that when satisfied, terminates the screensharing access.

In an embodiment, the one or more processors may be configured to transmit412a second notification to the webpage browser about the stop screensharing event. The second notification can be transmitted similarly to how the first notification is transmitted, except that the second notification indicates the screensharing event is stopped or terminated.

In an embodiment, the one or more processors may be configured to unmask414the sensitive data images in the webpage browser. For example, upon completion of the screensharing event, the one or more processors may be configured to unmask or unhide the sensitive information.

FIG. 5depicts a flowchart of steps of a computer-implemented method500for automatically masking sensitive information during screen sharing, in accordance with an embodiment of the present invention.

In an embodiment, the one or more processors may be configured for detecting502a first event corresponding to a start screensharing session in a webpage browser. In an embodiment, the one or more processors may be configured for facilitating communication between the screen capturing agent and the webpage browser using Inter-Process Communication (IPC). In an embodiment, prior to detecting the first event, the one or more processors may be configured for identifying the sensitive data images to be displayed in the webpage browser and embedding a sensitive data tag in the webpage browser configured to enclose the sensitive data images.

In an embodiment, the one or more processors may be configured for transmitting504a first notification to the webpage browser to indicate the first event.

In an embodiment, the one or more processors may be configured for masking506the sensitive data images in the webpage browser. The sensitive data tag may be configured to mask the sensitive data images upon receiving the first notification and unmask the sensitive data images upon receiving the second notification. In an embodiment, responsive to receiving the first notification at the webpage browser, masking the sensitive data images may further include one or more processors configured for modifying a Document Object Model (DOM) to mask the sensitive data images.

In an embodiment, the one or more processors may be configured for detecting508a second event corresponding to a stop screen sharing session in the webpage browser.

In an embodiment, the one or more processors may be configured for transmitting510a second notification to the webpage browser to indicate the second event. In an embodiment, the first event and the second event are detected by a screen capturing agent in communication with the webpage browser.

In an embodiment, the one or more processors may be configured for unmasking512the sensitive data images in the webpage browser upon receipt of the second notification. In an embodiment, unmasking the sensitive data images may further include, responsive to receiving the second notification at the webpage browser, one or more processors configured for modifying a Document Object Model (DOM) to unmask the sensitive data images.

FIG. 6depicts a block diagram of components of a computer600, e.g., computing device120and/or server125, executing the computer-implemented method500for automatically masking sensitive information during screen sharing within the distributed data processing environment ofFIG. 1, in accordance with an embodiment of the present invention.

Computer600includes communications fabric602, which provides communications between cache616, memory606, persistent storage608, communications unit610, and input/output (I/O) interface(s)612. Communications fabric602can be implemented with any architecture designed for passing data and/or control information between processors (such as microprocessors, communications and network processors, etc.), system memory, peripheral devices, and any other hardware components within a system. For example, communications fabric602can be implemented with one or more buses or a crossbar switch.

Memory606and persistent storage608are computer readable storage media. In this embodiment, memory606includes random access memory (RAM). In general, memory606can include any suitable volatile or non-volatile computer readable storage media. Cache616is a fast memory that enhances the performance of computer processor(s)604by holding recently accessed data, and data near accessed data, from memory606.

Programs may be stored in persistent storage608and in memory606for execution and/or access by one or more of the respective computer processors604via cache616. In an embodiment, persistent storage608includes a magnetic hard disk drive. Alternatively, or in addition to a magnetic hard disk drive, persistent storage608can include a solid-state hard drive, a semiconductor storage device, read-only memory (ROM), erasable programmable read-only memory (EPROM), flash memory, or any other computer readable storage media that is capable of storing program instructions or digital information.

Communications unit610, in these examples, provides for communications with other data processing systems or devices. In these examples, communications unit610includes one or more network interface cards. Communications unit610may provide communications through the use of either or both physical and wireless communications links. Programs, as described herein, may be downloaded to persistent storage608through communications unit610.

I/O interface(s)612allows for input and output of data with other devices that may be connected to server125and/or computing device120. For example, I/O interface612may provide a connection to external devices618such as an image sensor, a keyboard, a keypad, a touch screen, and/or some other suitable input device. External devices618can also include portable computer readable storage media such as, for example, thumb drives, portable optical or magnetic disks, and memory cards. Software and data614used to practice embodiments of the present invention can be stored on such portable computer readable storage media and can be loaded onto persistent storage608via I/O interface(s)612. I/O interface(s)612also connect to display620.