Pseudonymization via Segmented Identity Protector Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current pseudonymization methods fail to effectively prevent re-identification of personal data, especially when transferred across systems, and do not adequately protect data from unauthorized access, violating data protection laws.
Innovation Solution
A method using an identity protector client and master system that pre-pseudonymizes data with a source identifier, generates pseudonyms from erratic and time values, and manages pseudonyms in a trusted database, ensuring controlled re-identification and protecting data from unauthorized use.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional pseudonymization methods are used to convert identification data into pseudonyms, then data can be linked to persons when needed, but random re-identification can occur and data protection is compromised
Solution Approach 1:
The pseudonymization process is segmented into two independent stages: pre-pseudonymization performed at the source system using a source identifier, and final pseudonymization performed at the destination system using a destination identifier. This segmentation ensures that no single system holds both the mapping key and the ability to re-identify, thereby protecting data while maintaining controlled access when needed.
Solution Approach 2:
A trusted database acts as an intermediary between the source and destination systems, storing the mapping between source identifiers and destination identifiers. This intermediary enables controlled re-identification only through authorized queries to the trusted database, preventing random re-identification while allowing legitimate data linkage when boundary conditions are met.
2Reliability
If pseudonymization is implemented to prevent re-identification, then data anonymity is improved, but the ability to re-establish links to persons when needed is lost
Solution Approach 1:
The source system performs pre-pseudonymization in advance, converting personal identification data into a source identifier before data transfer. This preliminary action protects data anonymity during transmission and storage at the destination, while the source identifier is preserved in the trusted database for potential future re-identification when authorized.
Solution Approach 2:
The system introduces a new dimension of identification by using both source identifiers and destination identifiers as separate layers of pseudonymization. This multi-dimensional approach maintains anonymity in the primary data view while preserving re-identification capability through the trusted database mapping between dimensions.
3Reliability
If data is transferred across systems with pseudonymization, then data protection is enhanced, but unauthorized access and re-identification risks increase
Solution Approach 1:
Different systems (source and destination) perform different pseudonymization operations with different identifiers. The source system uses source identifiers for pre-pseudonymization, while the destination system uses destination identifiers for final pseudonymization. This local differentiation ensures that each system has limited capability to re-identify, reducing unauthorized access risk while maintaining overall data protection.
Data Source
AI summary
A system and method for pseudonymizing digital data records sent from a source system to a destination system, using an identity protector client system and an identity protector master system, includes the steps of receiving, at the identity protector client, person-specific data from a source system provided with a source identifier. The digital data records are pre-pseudonymized by the identity protector client, and the processed digital data records are marked with a source identifier which references the source file in the source system. The pre-pseudonymized digital data records are transmitted to the identity protector master. For every data record, a pseudonym is created by the identity protector master from the pre-pseudonym, the source identifier, and at least one other value generated from an erratic value and a time value. The pseudonym is transmitted to the destination system.