# US 12,192,210 B2 · Identity anonymization with controlled masking and format preserving encryption

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,192,210 B2
- Document ID: US12192210B2
- Status: Granted
- Kind: B2
- Application number: 17/966,490
- Filed: 2022-10-14
- Published: 2024-04-18
- Granted: 2025-01-07
- Earliest claimed: 2022-10-14
- Assignees: Microsoft Technology Licensing, LLC
- Applicants: Microsoft Technology Licensing, LLC
- Inventors: Guillermo Paul Proano
- Web page: https://patentgrep.com/patent/US12192210B2

## CPC

- G06F 21/6254: {by anonymising data, e.g. decorrelating personal data from the owner's identification}
- H04L 63/102: {Entity profiles}
- G06F 21/602: {Providing cryptographic facilities or services}
- H04L 9/0891: {Revocation or update of secret information, e.g. encryption key update or rekeying}
- H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage}
- H04L 63/0407: {wherein the identity of one or more communicating identities is hidden (cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00)}
- H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Systems are methods are used for facilitating identify anonymization by using controlled masking and encryption of user identifiers, such as UUIDs. A system that manages a UUID converts the UUID into a set of one or more different unique versions of the UUID for one or more corresponding different partner system(s) by removing and replacing masked portions of the UUID and by selectively encrypting the non-masked portions of the UUID. New masked portions added to the new version(s) of the UUID identify different corresponding partner(s) and/or rules to be applied by the different partner(s) when handling the different unique version(s) of the UUID(s). Partner systems that receive the new versions of the UUID identify and utilize the new masked portions to deterministically control decrypting and/or other processing of the new version of the UUID.

## Claims

### Claim 1

A method for generating new versions of a universally unique user identifier (UUID), the method comprising:
obtaining a UUID corresponding to a user identity, the UUID comprising a masked portion and a non-masked portion, the unmasked portion of the UUID being associated with a user identity in a network, the masked portion identifying a type of UUID;
stripping away the masked portion of the UUID from the non-masked portion the UUID;
selecting a set of one or more new masks to be applied to the UUID, the set of one or more new masks being associated with a corresponding set of rules for handling and processing the non-masked portion of the UUID;
subsequent to stripping away the masked portion of the UUID, selectively generating a modified non-masked portion of the UUID by modifying the non-masked portion of the UUID with a particular modification process while refraining from applying the particular modification process to the masked portion of the UUID; and
subsequent to selectively generating the modified non-masked portion of the UUID, composing a new version of the UUID by adding the set of one or more new masks to the modified non-masked portion of the UUID.

### Claim 2 (depends on 1)

The method of claim 1, wherein the particular modification process comprises encrypting the non-masked portion of the UUID.

### Claim 3 (depends on 1)

The method of claim 1, wherein the particular modification process comprises applying a transform to a string of characters comprising the non-masked portion of the UUID.

### Claim 4 (depends on 1)

The method of claim 1, wherein said obtaining the UUID comprises generating the UUID.

### Claim 5 (depends on 1)

The method of claim 1, wherein the method further comprises generating an additional new version of the UUID that is composed of a different set of one or more new masks and an encrypted version of the non-masked portion of the UUID that is encrypted with a different encryption used to generate the modified non-masked portion of the UUID.

### Claim 6 (depends on 1)

The method of claim 1, wherein the set of one or more masks comprises a plurality of different masks that each correspond to a different set of rules for handling and processing the non-masked portion of the UUID.

### Claim 7 (depends on 1)

The method of claim 1, wherein the set of one or more for handling and processing the non-masked portion of the UUID specifies how to decrypt the modified non-masked portion of the UUID.

### Claim 8 (depends on 1)

The method of claim 1, wherein the set of one or more for handling and processing the non-masked portion of the UUID identifies a third-party system assigned to handle the UUID.

### Claim 9 (depends on 1)

The method of claim 1, wherein the set of one or more for handling and processing the non-masked portion of the UUID specifies an authorization or restriction associated with a user account identified by the non-masked portion of the UUID.

### Claim 10 (depends on 1)

The method of claim 1, wherein the UUID is a 64-bit XUID having a 48-bit non-masked portion.

### Claim 11

A system for generating new versions of a unique user identifier (UID), the system comprising:
a hardware processor; and
one or more storage devices having stored instructions that are executable by the hardware processor for causing the system to implement a method comprising:
accessing the UID corresponding to a user identity;
selecting a mask to be applied to the UID, the mask corresponding to a partner system in a network and a corresponding set of rules for handling and processing a non-masked portion of the UID;
encrypting the non-masked portion of a UID with an encryption key associated with the mask corresponding to the partner system;
subsequent to encrypting the non-masked portion of the UID, composing a new version of the UID by adding the mask to a modified non-masked portion of the UID; and
providing the new version of the UID to the partner system.

### Claim 12 (depends on 11)

The system of claim 11, wherein the method further includes:
identifying and stripping away an original mask from a masked portion of the UID prior to encrypting the non-masked portion of the UID.

### Claim 13 (depends on 11)

The system of claim 11, wherein accessing the UID includes generating the UID.

### Claim 14 (depends on 11)

The system of claim 11, wherein the method further comprises generating an additional new version of the UID that is composed of a different mask corresponding to a different partner system and an encrypted version of the non-masked portion of the UID that is encrypted with a different encryption key that is associated with the different partner system corresponding to the different mask.

### Claim 15 (depends on 11)

The system of claim 11, wherein the UID is a 128-bit UID, wherein the non-masked portion of the UID comprises at least 48 bits of the UID.