# US 12,657,337 B2 · Systems and methods for runtime content masking > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,657,337 B2 - Document ID: US12657337B2 - Status: Granted - Kind: B2 - Application number: 18/612,048 - Filed: 2024-03-21 - Published: 2024-08-29 - Granted: 2026-06-16 - Earliest claimed: 2021-10-03 - Assignees: Seraphic Algorithms Ltd. - Applicants: Seraphic Algorithms Ltd. - Inventors: Avihay Cohen - Web page: https://patentgrep.com/patent/US12657337B2 ## CPC - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - G06F 21/6245: {Protecting personal data, e.g. for financial or medical purposes} - G06F 16/986: {Document structures and storage, e.g. HTML extensions} - G06F 21/54: by adding security routines or objects to programs - G06F 21/554: {involving event detection and direct action} - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1483: {service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12)} - H04L 63/1491: {using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment} - G06F 2221/033: Test or assess software - G06F 2221/034: Test or assess a computer or a system - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Systems, methods, and non-transitory computer readable media including instructions for implementing a runtime virtual barrier for fine grained execution control are disclose. Implementing the runtime virtual barrier for fine grained execution control includes receiving, by an application capable of JavaScript execution, an executable code including an API invocation; intercepting, by a virtual barrier, the API invocation; determining that the API invocation is an invocation for a native API configured for subsequent execution in response to a trigger event; based on the determination that the API invocation is an invocation for a native API configured for subsequent execution, recording an invocation source identifier; and upon occurrence of the trigger event: retrieving the invocation source identifier; and influencing execution of the native API based on the invocation source identifier. ## Claims ### Claim 1 A non-transitory computer readable medium containing instructions that when executed by at least one processor cause the at least one processor to perform cyber security operations for masking sensitive data, the operations comprising: receiving for execution, code associated with displaying an unmasked version of sensitive data, wherein the unmasked version of the sensitive data is included in the code, retrieved from a server by executing the code, or computed at runtime as a result of executing the code; and injecting, into an execution environment associated with the code, an agent configured to: identify the unmasked version of the sensitive data based on an indicator; access a Document Object Model (DOM) associated with the code; identify, in the DOM, the unmasked version of the sensitive data; replace in the DOM at least a portion of the unmasked version of the sensitive data with a mask, thereby generating a masked version of the sensitive data and concealing the at least a portion of the unmasked version of the sensitive data when content is displayed based on the code; and if a request for the unmasked version of the sensitive data is detected, return the unmasked version of the sensitive data while maintaining the mask in the DOM. ### Claim 2 (depends on 1) The non-transitory computer readable medium of claim 1, wherein the agent is further configured to intercept a request to access the code and provide the unmasked version of the sensitive data in response to the request, thereby allowing access to the unmasked version of the sensitive data while preventing display of the at least a portion of the unmasked version of the sensitive data. ### Claim 3 (depends on 1) The non-transitory computer readable medium of claim 1, wherein the code is configured for execution by an application and the agent is configured to operate without changing application code associated with the application. ### Claim 4 (depends on 1) The non-transitory computer readable medium of claim 1, wherein the sensitive data is associated with at least one element associated with the code, and wherein identifying in the DOM the unmasked version of the sensitive data includes identifying the at least one element in the DOM. ### Claim 5 (depends on 4) The non-transitory computer readable medium of claim 4, wherein the at least one element includes a hypertext markup language (HTML) element. ### Claim 6 (depends on 5) The non-transitory computer readable medium of claim 5, wherein the at least one HTML element includes a
HTML element. ### Claim 7 (depends on 4) The non-transitory computer readable medium of claim 4, wherein the agent is further configured to store a value-object pair associated with the sensitive data and the at least one element, wherein returning the unmasked version of the sensitive data includes accessing the value-object pair. ### Claim 8 (depends on 1) The non-transitory computer readable medium of claim 1, wherein the sensitive data includes at least one of financial information, personal information, or business information. ### Claim 9 (depends on 1) The non-transitory computer readable medium of claim 1, wherein the sensitive data includes classified information. ### Claim 10 (depends on 1) The non-transitory computer readable medium of claim 1, wherein the sensitive data includes health information. ### Claim 11 (depends on 1) The non-transitory computer readable medium of claim 1, wherein the sensitive data includes educational information. ### Claim 12 (depends on 1) The non-transitory computer readable medium of claim 1, wherein the agent is injected into a top portion of the code. ### Claim 13 (depends on 1) The non-transitory computer readable medium of claim 1, wherein identifying the unmasked version of the sensitive data in the code includes scanning the code to detect the indicator, wherein the indicator includes a contextual character sequence associated with the sensitive data. ### Claim 14 (depends on 13) The non-transitory computer readable medium of claim 13, wherein identifying the unmasked version of the sensitive data in the code includes determining that the contextual character sequence satisfies a predefined format rule. ### Claim 15 (depends on 13) The non-transitory computer readable medium of claim 13, wherein identifying unmasked version of the sensitive data in the code includes determining that the contextual character sequence satisfies a predefined length rule. ### Claim 16 (depends on 13) The non-transitory computer readable medium of claim 13, wherein the contextual character sequence is configured to be displayed when the content is displayed. ### Claim 17 (depends on 13) The non-transitory computer readable medium of claim 13, wherein the contextual character sequence is configured to be withheld when the content is displayed. ### Claim 18 A method for performing cybersecurity operations for masking sensitive data, the method comprising: receiving for execution, code associated with displaying an unmasked version of sensitive data, wherein the unmasked version of the sensitive data is included in the code, retrieved from a server by executing the code, or computed at runtime as a result of executing the code; and injecting, into an execution environment associated with the code, an agent configured to: identify the unmasked version of the sensitive data based on an indicator; access a Document Object Model (DOM) associated with the code; identify in the DOM the unmasked version of the sensitive data; replace in the DOM at least a portion of the unmasked version of the sensitive data with a mask, thereby generating a masked version of the sensitive data and concealing the at least a portion of the unmasked version of the sensitive data when content is displayed based on the code; and if a request for the unmasked version of the sensitive data is detected, return the unmasked version of the sensitive data while maintaining the mask in the DOM. ### Claim 19 (depends on 18) The method of claim 18, wherein the agent is further configured to intercept a request to access the code and provide the unmasked version of the sensitive data in response to the request, thereby allowing access to the sensitive data while preventing display of the at least a portion of the unmasked version of the sensitive data. ### Claim 20 A system for performing cybersecurity operations for masking sensitive data, the system comprising at least one processor configured to: receive for execution, code associated with displaying an unmasked version of sensitive data, wherein the unmasked version of the sensitive data is included in the code, retrieved from a server by executing the code, or computed at runtime as a result of executing the code; and inject, into an execution environment associated with the code, an agent configured to: identify the unmasked version of the sensitive data based on an indicator; access a Document Object Model (DOM) associated with the code; identify in the DOM the unmasked version of the sensitive data; replace in the DOM at least a portion of the unmasked version of the sensitive data with a mask, thereby generating a masked version of the sensitive data and concealing the at least a portion of the unmasked version of the sensitive data when content is displayed based on the code; and if a request for the unmasked version of the sensitive data is detected, return the unmasked version of the sensitive data while maintaining the mask in the DOM.