IBM researchers in Israel have developed a new data-masking technology that filters sensitive data from unauthorized viewers on the fly -- before it reaches their computer screens.

The MAGEN (Masking Gateway for Enterprises) prototype, named after the Hebrew word for "shield," is aimed at ensuring customer service or call center users see just the customer or patient information they need to do their jobs, not confidential information from databases, such as credit card numbers or patient health records. The new proof-of-concept uses optical-character recognition to flag sensitive data that should be hidden or replaced with random values, and IBM has applied for patents for MAGEN's image-manipulation and word-scrambling techniques.

IBM isn't the first vendor to develop data-masking technology: Camouflage Software, Oracle , and DataGuise, for instance, all sell data-masking tools to "black out" sensitive data.

But IBM says its approach is different in that it doesn't make copies of the data and remove certain elements of it depending on who will be viewing it and their user rights to the data. Running MAGEN doesn't require any changes to applications, either. Instead, the masking is done "on the fly," a spokesman for IBM Research said.

MAGEN runs in any computing environment that delivers screen images of data. It basically grabs the data before it lands on the computer screen, analyzes it, and places a mask over the data that needs to be hidden. "MAGEN provides a common solution for all applications, regardless of their operating system and communication protocols," said Tamar Domany, project leader at the IBM Haifa Research Lab, in a statement. "The solution is completely generic and can be used with any data, any application, and for different levels of authorization."

"The enterprise application continues to run on a main server, and a MAGEN server is added to the network either remotely or locally -- it makes no difference. The MAGEN server provides a console where the administrator can configure rules about which screen information should be filtered, how it should be filtered, and for whom," the IBM R&D spokesman said.

For example, MAGEN can intercept a bitmap-formatted snapshot of the screen on its way to a call center representative overseas, he said, and its optical character-recognition identifies data structures, fields, and labels. "Screen analysis is carried out to understand the context of the phrases and numbers," the spokesman said. "MAGEN finds and shields sensitive data on the fly, and is reconstructed into a new bitmap-format image with the appropriate masking."

IBM eventually plans to roll the MAGEN technology into both product and service offerings, he said.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.