METHOD AND DEVICE FOR THE PSEUDONYMIZATION OF DIGITAL DATA

• US 20090265788A1
• Filed: 03/14/2007
• Published: 10/22/2009
• Est. Priority Date: 03/17/2006
• Status: Active Grant

• Current Assignee: Deutsche Telekom AG
• Original Assignee: Deutsche Telekom AG
• Inventors: Kalck, Stefan, Henkel, Gerhard, Kern, Heiko, Ehrenschwender, Dieter
• Granted Patent: US 10,372,940 B2
• Time in Patent Office: Days
• US Class Current: 726/26
• CPC Class Codes: G06F 21/6254 by anonymising data, e.g. decorrelating personal data from the owner's identification

Abstract

A system and method for pseudonymizing digital data records sent from a source system to a destination system, using an identity protector client system and an identity protector master system, includes the steps of receiving, at the identity protector client, person-specific data from a source system provided with a source identifier. The digital data records are pre-pseudonymized by the identity protector client, and the processed digital data records are marked with a source identifier which references the source file in the source system. The pre-pseudonymized digital data records are transmitted to the identity protector master. For every data record, a pseudonym is created by the identity protector master from the pre-pseudonym, the source identifier, and at least one other value generated from an erratic value and a time value. The pseudonym is transmitted to the destination system.

Claims

1-19. -19. (canceled)

20. A method for pseudonymizing digital data records sent from a source system to a destination system, using an identity protector client system and an identity protector master system, the method comprising the steps of:

receiving, at the identity protector client, person-specific data from a source system provided with a source identifier;

pre-pseudonymizing the digital data records, by the identity protector client, and. marking the processed digital data records with a source identifier which references the source file in the source system;

transmitting the pre-pseudonymized digital data records to the identity protector master;

for every data record, creating, by the identity protector master, a pseudonym from the pre-pseudonym, the source identifier, and at least one other value generated from an erratic value and a time value; and

transmitting the pseudonym to the destination system.

21. The method as recited in claim 20, further comprising the steps of:

forming, by the identity protector master, statistical categories from critical person-specific data; and

modifying the statistical categories so as to render possible a re-identification in combination with other information; and

transmitting the statistical categories as uncritical data to the destination system.

22. The method as recited in claim 20, wherein upon completion of the pseudonymization, the pseudonym, the source identifier, and the pre-pseudonym are available to the source system.

23. The method as recited in claim 20, wherein following the transmission of the pseudonym, the pre-pseudonymized data and the pseudonym are erased from the identity protector client and the identity protector master.

24. The method as recited in claim 20, wherein particular data records are transmitted to the destination system free of the pseudonym so that the destination system only receives anonymized data.

25. The method as recited in claim 20, further comprising the step of transmitting the data records to the destination system with the pseudonym transmitted to the destination system, and wherein for a later re-identification, the data records, the pseudonym from fields of the pseudonym, the source identifier, the pre-pseudonym and the time value are transmitted to an identity protector trusted database.

26. The method. as recited in claim 20, wherein pre-pseudonymized data records are relayed to the identity protector master in encrypted formso as to have authentication with a certificate.

27. The method as recited in claim 20, wherein as a basis for the pre-pseudonym, identifiers are modified by the identity protector client using an algorithm so that a resulting character string unreadable by an attacker lacking knowledge of a data record, and the character string is subsequently converted using a hash function into the pre-pseudonym;

wherein the identifiers are selected from at least the group comprising birth date, place of birth, employee number, and. customer number.

28. The method as recited in claim 20, wherein in the context of the pre-pseudonymization, person-specific data is transmitted in data categories.

29. The method as recited in claim 20, wherein the identity protector client assigns a test value to the pre-pseudonym.

30. The method as recited in claim 20, wherein prior to the transmission to the identity protector master, the pre-pseudonymized data record is provided with a source identifier and a test value, the source identifier informing an identity protector trusted database about the source system from which a data record. required for re-identification originates, and the test value guaranteeing an integrity of the. transmitted data record to the identity protector master.

31. The method as recited in claim 20, wherein the-pseudonym is generated from the pre-pseudonym in permutation with at least one of a time stamp, an erratic value, the source identifier, and a hash function.

32. The method as recited in claim 20, further comprising the step of assigning the pseudonym to a corresponding identifier, and storing the pseudonym in an identity protector trusted database for a later re-identification.

33. The method as recited in claim 32, wherein after a plurality of trust entities of a trust center have made key fragments available, a private key of the trust center is able to be generated in the identity protector trusted database so as to decrypt a session key, wherein the session key permits a decryption of the assignment data.

34. The method as recited in claim 33, wherein the identity protector trusted database stores the assignment data (pseudonym, source identifier, time value, pre-pseudonym) transmitted from the identity protector master;

wherein the source identifier, time value, and pre-pseudonym are symmetrically encrypted using a session key, the session key being asymmetrically encrypted using the public key of the trust center and subsequently stored in the database; and

wherein, when generated, the private key is communicated in a plurality of parts to the trust centers using a multi-eye principle; and

the plurality of parts are delivered to a corresponding number of trust centers.

35. The method as recited in claim 20, wherein the source system is able to identify a person belonging to the pseudonym because one of the source system has stored the pseudonym, and the source system recalculates the respective pseudonym from data records using the identity protector client and matches the recalculated pseudonym to a requested pseudonym.

36. The method as recited in claim 20, wherein the identity protector master has an overview of which destination system is requesting which analysis, and of how many data records have already been delivered to the respective destination system.

37. A system for pseudonymizing digital data records sent from a source system to a destination system comprising:

an identity protector client system and an identity protector master system configured to;

receive, at the identity protector client, person-specific data from a source system provided with a source identifier;

pre-pseudonymize the digital data records, by the identity protector client, and mark the processed digital data records with a source identifier which references the source file in the source system;

transmit the pre-pseudonymized digital data records to the identity protector master;

for every data record, create, by the identity protector master, a pseudonym from the pre-pseudonym, the source identifier, and at least one other value generated from an erratic value and a time value; and

transmit the pseudonym to the destination system.

38. A computer readable medium containing computer instructions configured to execute a method for pseudonymizing digital data records sent from a source system to a destination system, using an identity protector client system and an identity protector master system, the method comprising the steps of:

receiving, at an identity protector client, person-specific data from a source system provided with a source identifier;

pre-pseudonymizing digital data records, by the identity protector client, and marking the processed digital data records with a source identifier which references the source file in the source system;

transmitting the pre-pseudonymized digital data records to the identity protector master;

for every data record creating, by the identity protector master, a pseudonym from the pre-pseudonym, the source identifier, and at least one other value generated from a value and a time value; and

transmitting the pseudonym to the destination system.