# US 10,372,940 B2 · Method and device for the pseudonymization of digital data > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,372,940 B2 - Document ID: US10372940B2 - Status: Granted - Kind: B2 - Application number: 12/293,203 - Filed: 2007-03-14 - Published: 2009-10-22 - Granted: 2019-08-06 - Earliest claimed: 2006-03-17 - Assignees: Deutsche Telekom AG - Applicants: Dieter Ehrenschwender; Gerhard Henkel; Stefan Kalck; Heiko Kern - Inventors: Dieter Ehrenschwender; Gerhard Henkel; Stefan Kalck; Heiko Kern - Web page: https://patentgrep.com/patent/US10372940B2 ## CPC - G06F 21/6254: {by anonymising data, e.g. decorrelating personal data from the owner's identification} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A system and method for pseudonymizing digital data records sent from a source system to a destination system, using an identity protector client system and an identity protector master system, includes the steps of receiving, at the identity protector client, person-specific data from a source system provided with a source identifier. The digital data records are pre-pseudonymized by the identity protector client, and the processed digital data records are marked with a source identifier which references the source file in the source system. The pre-pseudonymized digital data records are transmitted to the identity protector master. For every data record, a pseudonym is created by the identity protector master from the pre-pseudonym, the source identifier, and at least one other value generated from an erratic value and a time value. The pseudonym is transmitted to the destination system. ## Claims ### Claim 1 A method for pseudonymizing digital data records for transmission from a source computing system to a destination computing system, the method comprising: receiving, by a client component of an identity protector system, person-specific data from a source computing system provided with a source identifier, wherein the person-specific data comprises unique identifiers corresponding to a person; generating, by the client component of the identity protector system, a pre-pseudonym (PI) based on the unique identifiers and a protected hash function; sending, by the client component of the identity protector system, the PI with the source identifier to the source computing system; erasing, by the client component of the identity protector system, the person-specific data from the client component of the identity protector system; receiving, by a master component of the identity protector system, the PI with the source identifier from the source computing system; generating, by the master component of the identity protector system, a pseudonym (PPI) based on the PI and the source ID, wherein generating the PPI is performed in response to a request for possible re-identification for a data record corresponding to the source identifier from the destination computing system; and transmitting, by the master component of the identity protector system, the PPI to the destination computing system; and storing, at a trusted database component of the identity protector system, an assignment of the PPI to the PI and the source ID to facilitate re-identification for the data record corresponding to the source identifier. ### Claim 2 (depends on 1) The method according to claim 1, further comprising: receiving, by the identity protector system, information from the destination computing system regarding conditions under which the destination computing system is permitted to receive psedonymized data in place of anonymized data. ### Claim 3 (depends on 1) The method according to claim 1, further comprising: providing, by a trust center component of the identity protector system, re-identification for the data record corresponding to the source identifier. ### Claim 4 (depends on 3) The method according to claim 3, wherein providing the re-identification comprises releasing the assignment of the PPI to the PI and the source ID from the trusted database component using a private key. ### Claim 5 (depends on 4) The method according to claim 4, wherein the private key comprises multiple partial keys distributed over multiple trust entities. ### Claim 6 (depends on 1) The method according to claim 1, wherein generating the PPI is further based on a time value and an erratic value. ### Claim 7 An identity protector system for pseudonymizing digital data records for transmission from a source computing system to a destination computing system, the system comprising: a client component, configured to: receive person-specific data from a source computing system provided with a source identifier, wherein the person-specific data comprises unique identifiers corresponding to a person; generate a pre-pseudonym (PI) based on the unique identifiers and a protected hash function; send the PI with the source identifier to the source computing system; and erase the person-specific data from the client component of the identity protector system; a master component, configured to: receive the PI with the source identifier from the source computing system; generate a pseudonym (PPI) based on the PI and the source ID, in response to a request for possible re-identification for a data record corresponding to the source identifier from the destination computing system; and transmit the PPI to the destination computing system; and a trusted database component, configured to store an assignment of the PPI to the PI and the source ID, to facilitate re-identification for the data record corresponding to the source identifier. ### Claim 8 (depends on 7) The identity protector system according to claim 7, further comprising: a trust center component, configured to provide re-identification for the data record corresponding to the source identifier. ### Claim 9 (depends on 8) The identity protector system according to claim 8, wherein the re-identification includes releasing the assignment of the PPI to the PI and the source ID from the trusted database component using a private key. ### Claim 10 (depends on 9) The identity protector system according to claim 9, wherein the private key comprises multiple partial keys distributed over multiple trust entities. ### Claim 11 (depends on 7) The identity protector system according to claim 7, wherein generating the PPI is further based on a time value and an erratic value.