System and method for obfuscating an identifier to protect the identifier from impermissible appropriation

1. A method of operating a database system to protect personal identifiers from being revealed, comprising:

for storing a record in a database of the database system:

obfuscating a personal identifier using a secret value;

storing in a database records containing the obfuscated personal identifier;

storing the secret value in an identifier translation device;

for retrieving a requested record from the database of the database system:

operating a records requester to modify the personal identifier of the requested record into a modified personal identifier and transmitting the modified personal identifier to a request preparer;

receiving at a request preparer the record request identifying the requested record using the modified personal identifier; and

operating the request preparer to direct the identifier translation device to translate the modified personal identifier into an obfuscated personal identifier corresponding to the obfuscated personal identifier used to store the record in the database of the database system using the secret value stored in the identifier translation device and using the obfuscated personal identifier in a query to the database.

2. The method of operating a database system of claim 1 wherein the identifier translation device is a peripheral device connected to the request preparer through a communications interface.

3. The method of operating a database system of claim 1 wherein the identifier translation device is a peripheral device is a trusted platform module.

4. The method of operating a database system according to claim 1 , further comprising storing the secret value in an obfuscated identifier translation module.

5. The method of operating a database system according to claim 1 further comprising protecting the secret value on the identifier translation device using white box cryptography.

6. The method of operating a database system according to claim 1 further comprising storing the secret value on the identifier translation device in an identifier translation module executing within a trusted execution environment.

7. The method of operating a database system according to claim 1 further comprising protecting the secret value by linking the secret value to a specific instance of the identifier translation device such that a translation module performing the translation of the modified personal identifier into an obfuscated personal identifier using the secret value stored in the identifier translation device can only successfully execute on one specific identifier translation device.

8. The method of operating a database system according to claim 1 further comprising storing the secret value on a second machine on a same local network as the identifier translation device in a file readable on launch of a translation module performing the translation of the modified personal identifier into an obfuscated personal identifier using the secret value stored in the identifier translation device using high privileges and storing the secret value in RAM.

9. The method of operating a database system according to claim 1 wherein the translation of the modified personal identifier into an obfuscated personal identifier using the secret value stored in the identifier translation device is performed using a hash function or a block cipher.

10. The method of operating a database system according to claim 1 wherein the translation of the non-obfuscated personal identifier into an obfuscated personal identifier using the secret value stored in the identifier translation device is performed using homomorphic encryption.

11. The method of operating a database system according to claim 10 further comprising updating the secret value and updating all obfuscated personal identifier values stored in the database by using an operation that is homomorphic on the obfuscated personal identifier values.

12. A system for storing and retrieving data from a database, comprising:

a database containing records including an obfuscated personal identifier wherein the obfuscated personal identifier is a function of a non-obfuscated personal identifier and a secret value and corresponds to a modified personal identifier;

an identifier translation device having a processor and a memory storing the secret value and a module that translates a modified personal identifier into an obfuscated personal identifier using the secret value; and

a request preparer operable to:

receive a modified personal identifier and upon receiving the modified personal identifier:

calling upon the identifier translation device to translate the modified personal identifier into an obfuscated personal identifier using the secret value stored in the identifier translation device and the modified personal identifier; and formulate a query to the database using the obfuscated personal identifier and to transmit the query to the database.

13. The system for storing and retrieving data from a database of claim 12 wherein the identifier translation device is a peripheral device connected to the request preparer through a communications interface.

14. The system for storing and retrieving data from a database of claim 12 wherein the identifier translation device is a peripheral device is a trusted platform module.

15. The system for storing and retrieving data from a database according to claim 12 , further comprising an obfuscated identifier translation module storing the secret value.

16. The system for storing and retrieving data from a database according to claim 12 wherein the secret value is protected on the identifier translation device using white box cryptography.

17. The system for storing and retrieving data from a database according to claim 12 further comprising an identifier translation module executing within a trusted execution environment wherein the identifier translation module stores the secret value on the identifier translation device.

18. The system for storing and retrieving data from a database according to claim 12 wherein the secret value is protected by linking the secret value to a specific instance of the identifier translation device such that a translation module performing the translation of the modified personal identifier into an obfuscated personal identifier using the secret value stored in the identifier translation device can only successfully execute on one specific identifier translation device.

19. The system for storing and retrieving data from a database according to claim 12 further comprising the secret value being stored on a second machine on a same local network as the identifier translation device in a file readable on launch of a translation module performing the translation of the modified personal identifier into an obfuscated personal identifier using the secret value stored in the identifier translation device using high privileges and storing the secret value in RAM.

20. The system for storing and retrieving data from a database according to claim 12 wherein the translation of the modified personal identifier into an obfuscated personal identifier using the secret value stored in the identifier translation device is performed using a hash function or a block cipher.

21. The system for storing and retrieving data from a database according to claim 12 wherein the translation of the modified personal identifier into an obfuscated personal identifier using the secret value stored in the identifier translation device is performed using homomorphic encryption.

22. The system for storing and retrieving data from a database according to claim 21 further comprising updating the secret value and updating all obfuscated personal identifier values stored in the database by using an operation that is homomorphic on the obfuscated personal identifier values.