# US 2025/0165626 A1 · Secure interprocess communication bridge for sensitive data transfer > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2025/0165626 A1 - Document ID: US20250165626A1 - Status: Published application - Kind: A1 - Application number: 18/677,085 - Filed: 2024-05-29 - Published: 2025-05-22 - Earliest claimed: 2023-11-20 - Assignees: CyberArk Software Ltd. - Applicants: CyberArk Software Ltd. - Inventors: Naor TEDRI; Yonatan Volkov - Web page: https://patentgrep.com/patent/US20250165626A1 ## CPC - G06F 21/606: {by securing the transmission between two devices or processes} - H04L 63/14: {for detecting or protecting against malicious traffic} - G06F 21/55: Detecting local intrusion or implementing counter-measures - H04W 12/12: Detection or prevention of fraud - G06F 21/10: Protecting distributed programs or content, e.g. vending or licensing of copyrighted material (protection in video systems or pay television H04N7/16) {; Digital rights management [DRM]} - G06F 21/60: Protecting data - H04L 63/04: {for providing a confidential data exchange among entities communicating through data packet networks} - H04W 12/10: Integrity - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Systems, methods, and apparatuses are disclosed for securing the use of secondary processes using an interprocess communication bridge. Techniques may include identifying a sensitive data including at least one secret and invoking a secondary process in a computing environment in a suspended mode, wherein the secondary process is configured to perform at least one operation on a file associated with the sensitive data. Techniques may further include injecting at least one code element into the secondary process, the code element being configured to redirect the secondary process to the sensitive data and resuming the secondary process wherein the at least one operation is performed using the sensitive data. ## Claims ### Claim 1 A non-transitory computer readable medium including instructions that, when executed by at least one processor, cause the at least one processor to perform operations for securing the use of secondary processes using an interprocess communication bridge, the operations comprising: identifying, by a main process, a sensitive data including at least one secret; invoking, by the main process, a secondary process in a computing environment in a suspended mode, wherein the secondary process is configured to perform at least one operation on a file associated with the sensitive data; injecting, by the main process, at least one code element into the secondary process, the code element being configured to redirect the secondary process to the sensitive data; and resuming the secondary process, wherein the at least one operation is performed using the sensitive data. ### Claim 2 (depends on 1) The non-transitory computer readable medium of claim 1, wherein the operations further comprise generating a placeholder file based on the sensitive data, the placeholder file excluding the at least one secret. ### Claim 3 (depends on 1) The non-transitory computer readable medium of claim 1, wherein the operations further comprise generating, by the secondary process, a modified sensitive data based on the sensitive data. ### Claim 4 (depends on 1) The non-transitory computer readable medium of claim 1, wherein the injecting includes overwriting a read file system call of the secondary process. ### Claim 5 (depends on 1) The non-transitory computer readable medium of claim 1, wherein the injecting includes overwriting a write file system call of the secondary process. ### Claim 6 (depends on 2) The non-transitory computer readable medium of claim 2, wherein the operations further comprise making the placeholder file available to the secondary process. ### Claim 7 (depends on 2) The non-transitory computer readable medium of claim 2, wherein redirecting the secondary process to the sensitive data includes redirecting the secondary process from a location of the placeholder file to the sensitive data. ### Claim 8 (depends on 7) The non-transitory computer readable medium of claim 7, wherein the location of the placeholder file is an unsecured location. ### Claim 9 (depends on 3) The non-transitory computer readable medium of claim 3, wherein the operations further comprise receiving, from a data holder, a request for the modified sensitive data. ### Claim 10 (depends on 9) The non-transitory computer readable medium of claim 9, wherein the operations further comprise providing the modified sensitive data to the data holder in response to the request. ### Claim 11 (depends on 1) The non-transitory computer readable medium of claim 1, wherein identifying the sensitive data including at least one secret includes accessing the sensitive data via an interprocess communication bridge. ### Claim 12 A computer-implemented method for securing the use of secondary processes using an interprocess communication bridge, the method comprising: identifying, by a main process, a sensitive data including at least one secret; invoking, by the main process, a secondary process in a computing environment in a suspended mode, wherein the secondary process is configured to perform at least one operation on a file associated with the sensitive data; injecting, by the main process, at least one code element into the secondary process, the code element being configured to redirect the secondary process to the sensitive data; and resuming the secondary process, wherein the at least one operation is performed using the sensitive data. ### Claim 13 (depends on 12) The computer-implemented method of claim 12, wherein the method further comprises: generating a modified sensitive data based on the sensitive data; and writing the modified sensitive data to a secure location. ### Claim 14 (depends on 13) The computer-implemented method of claim 13, wherein the at least one code element is further configured to generate an indication that the at least one code element has been injected into the secondary process, and wherein the secondary process is resumed based on the indication. ### Claim 15 (depends on 12) The computer-implemented method of claim 12, wherein the file associated with the sensitive data is a remote desktop protocol file. ### Claim 16 (depends on 13) The computer-implemented method of claim 13, wherein the modified sensitive data is data in the format of a signed remote desktop protocol file. ### Claim 17 (depends on 16) The computer-implemented method of claim 16, wherein data in the format of the signed remote desktop protocol file includes a signature block. ### Claim 18 (depends on 12) The computer-implemented method of claim 12, wherein the code element is a dynamic-link library. ### Claim 19 (depends on 12) The computer-implemented method of claim 12, wherein the secondary process is suspended immediately upon its initial execution. ### Claim 20 (depends on 12) The computer-implemented method of claim 12, wherein the secondary process is suspended before it processes any file system calls.