# US 10,769,305 B2 · Method and system for double anonymization of data > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,769,305 B2 - Document ID: US10769305B2 - Status: Granted - Kind: B2 - Application number: 15/708,349 - Filed: 2017-09-19 - Published: 2018-03-22 - Granted: 2020-09-08 - Earliest claimed: 2016-09-21 - Assignees: Mastercard International Incorporated - Applicants: Mastercard International Incorporated - Inventors: Todd Christian Lowenberg; Andrew Reiskind; Curtis Villars; Rohit Chauhan; JoAnn C. Stonier - Web page: https://patentgrep.com/patent/US10769305B2 ## CPC - G06F 21/6254: {by anonymising data, e.g. decorrelating personal data from the owner's identification} - G06F 21/602: {Providing cryptographic facilities or services} - G06Q 20/10: specially adapted for electronic funds transfer [EFT] systems; specially adapted for home banking systems - G06Q 20/382: {insuring higher security of transaction} - G06Q 20/3827: {Use of message hashing} - G06Q 20/383: {Anonymous user system} - G06Q 2220/10: Usage protection of distributed data files - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR ## Abstract A method for double anonymization of data includes: receiving, by a first computing system, a plurality of first data sets, each including a set identifier and personally identifiable information; anonymizing, by the first computing system, each of the first data sets, by hashing the set identifier included in each first data set to obtain a hashed identifier and deidentifying the personally identifiable information; transmitting, by the first computing system, the plurality of anonymized first data sets to a second computing system, wherein the second computing system is distinct and separate from the first computing system; anonymizing, by the second computing system, each of the anonymized first data sets, by hashing the hashed identifier to obtain a double-hashed identifier; and storing, in the second computing system or a third separate and distinct computing system, the plurality of double anonymized first data. ## Claims ### Claim 1 A method for double anonymization of data, comprising: receiving, by a receiving device of a first computing system, a plurality of first data sets, each first data set including at least a set identifier and including personally identifiable information, each first data set including data related to an electronic payment transaction, each set identifier included in each first data set being a primary account number used in the related electronic payment transaction, and the personally identifiable information included in each first data set comprising the related primary account number; anonymizing, by the first computing system, each of the first data sets, wherein anonymizing includes at least replacing the set identifier included in each first data set with a hashed identifier and deidentifying the personally identifiable information, where the hashed identifier is generated via the application of one or more hashing algorithms to at least the corresponding set identifier; responsive to and subsequent to deidentifying the personally identifiable information, discarding, by the first computing system, the personally identifiable information; electronically transmitting, by a transmitting device of the first computing system, the plurality of anonymized first data sets to a receiving device of a second computing system, wherein the second computing system is distinct and separate from the first computing system; anonymizing, by the second computing system, each of the anonymized first data sets, wherein anonymizing includes at least replacing the hashed identifier with a double-hashed identifier, the double-hashed identifier being generated via application of one or more hashing algorithms to at least the corresponding hashed identifier; and storing, in the second computing system or a third separate and distinct computing system, the plurality of double anonymized first data. ### Claim 2 (depends on 1) The method of claim 1, wherein, if the double anonymized data sets are stored in the third computing system, the third computing system is controlled by a separate entity from the first computing system and second computing system, and if the double anonymized data sets are stored in the second computing system, the second computing system is controlled by a separate entity from the first computing system. ### Claim 3 (depends on 1) The method of claim 1, wherein the second computing system does not receive or possess the personally identifiable information. ### Claim 4 (depends on 1) The method of claim 1, wherein the one or more hashing algorithms used by the first computing system and the second computing system include at least one different hashing algorithm. ### Claim 5 (depends on 1) The method of claim 1, wherein the hashed identifier is generated via the application of one or more hashing algorithms to the corresponding set identifier and a first salt value. ### Claim 6 (depends on 5) The method of claim 5, wherein the double-hashed identifier is generated via application of one or more hashing algorithms to the corresponding hashed identifier and a second salt value. ### Claim 7 (depends on 6) The method of claim 6, wherein the one or more hashing algorithms used by the first computing system and the second computing system are equivalent. ### Claim 8 (depends on 6) The method of claim 6, wherein the first computing system does not receive or possess the second salt value, and the second computing system does not receive or possess the first salt value. ### Claim 9 A system for double anonymization of data, comprising: a first computing system; and a second computing system, wherein first computing system is configured to receive, by a receiving device of the first computing system, a plurality of first data sets, each first data set including at least a set identifier and including personally identifiable information, each first data set including data related to an electronic payment transaction, each set identifier included in each first data set being a primary account number used in the related electronic payment transaction, and the personally identifiable information included in each first data set comprising the related primary account number, anonymize each of the first data sets, wherein anonymizing includes at least replacing the set identifier included in each first data set with a hashed identifier and deidentifying the personally identifiable information, where the hashed identifier is generated via the application of one or more hashing algorithms to at least the corresponding set identifier, responsive to and subsequent to deidentifying the personally identifiable information, discard the personally identifiable information, and electronically transmit, by a transmitting device of the first computing system, the plurality of anonymized first data sets to a receiving device of a second computing system, wherein the second computing system is distinct and separate from the first computing system, and the second computing system is configured to anonymize each of the anonymized first data sets, wherein anonymizing includes at least replacing the hashed identifier with a double-hashed identifier, the double-hashed identifier being generated via application of one or more hashing algorithms to at least the corresponding hashed identifier, wherein the plurality of double anonymized first data sets is stored in the second computing system or in a distinct and separate third computing system. ### Claim 10 (depends on 9) The system of claim 9, wherein if the double anonymized data sets are stored in the third computing system, the third computing system is controlled by a separate entity from the first computing system and second computing system, and if the double anonymized data sets are stored in the second computing system, the second computing system is controlled by a separate entity from the first computing system. ### Claim 11 (depends on 9) The system of claim 9, wherein the second computing system does not receive or possess the personally identifiable information. ### Claim 12 (depends on 9) The system of claim 9, wherein the one or more hashing algorithms used by the first computing system and the second computing system include at least one different hashing algorithm. ### Claim 13 (depends on 9) The system of claim 9, wherein the hashed identifier is generated via the application of one or more hashing algorithms to the corresponding set identifier and a first salt value. ### Claim 14 (depends on 13) The system of claim 13, wherein the double-hashed identifier is generated via application of one or more hashing algorithms to the corresponding hashed identifier and a second salt value. ### Claim 15 (depends on 14) The system of claim 14, wherein the one or more hashing algorithms used by the first computing system and the second computing system are equivalent. ### Claim 16 (depends on 14) The system of claim 14, wherein the first computing system does not receive or possess the second salt value, and the second computing system does not receive or possess the first salt value.