Patent ID: 9705870
Date: 2017-07-11
CPC Classifications: H04L

Claim:
1. An identity exchange system for correlating protected data between at least a first protected data system and a second protected data system that are in communication through a first network, wherein the first and second protected data systems are each in communication with the identity exchange system through a second network, the identity exchange system comprising: a first enterprise connector in communication with a first protected data system, wherein said first enterprise connector includes a first enterprise data store that correlates a first set of record identifiers (“IDs”) with a first set of permanent tokens, wherein the first set of record IDs identify subject records in the first protected data system, and wherein the first set of permanent tokens are identity exchange identifiers that identify subject data records independently of the first set of record IDs, and wherein said first enterprise connector is capable of providing a temporary token that is sent by the first protected data system to the second protected data system, via the first network and that identifies a first data transaction between the first and second protected data systems; a first exchange connector in communication with the identity exchange system, wherein said first exchange connector is in secured communication with the first enterprise connector and permits the distribution of first permanent tokens and temporary tokens between the first protected data system and the identity exchange system while preventing the distribution of the first set of record IDs; a second enterprise connector in communication with a second protected data system, wherein said second enterprise connector includes a second enterprise data store that correlates a second set of record IDs with a second set of permanent tokens, wherein the second set of record IDs identify subject records in the second protected data system, and wherein the second set of permanent tokens are identity exchange identifiers that identify subject data records independently of the second set of record IDs, and wherein said second enterprise connector is capable of providing a second temporary token that is sent by the second protected data system to the first protected data system, via the first network and that identifies a second data transaction between the first and second protected data systems, wherein the first and second temporary tokens each identify, for a defined length of time, a correlation between one of the first set of permanent tokens and one of the second set of permanent tokens; a second exchange connector in communication with the identity exchange system, wherein said second exchange connector is in secured communication with the second enterprise connector and permits the distribution of second permanent tokens and temporary tokens between the second protected data system and the identity exchange system while preventing the distribution of the second set of record IDs; and at least one root server in communication, via said second network, with said first and second exchange connectors, wherein said at least one root server comprises a root data store for storing identity correlations, without the need to store and share any record IDs, as relationships between the first set of permanent tokens with the second set of permanent tokens, wherein, upon receiving an indication that the first protected data system has sent a first request, that includes the first temporary token associated with a first record ID, to the second protected data system for a requested data record residing in the second protected data system, the first enterprise connector is configured to retrieve a first permanent token by locating the first record ID in the first enterprise connector data store and to transmit to the first exchange connector the first temporary token and the first permanent token, wherein the first exchange connector, upon receiving the first temporary token and the first permanent token, is configured to transmit, via the second network, the first permanent token and the first temporary token to the root server, wherein the root server is configured to retrieve a second permanent token by locating the first permanent token in the root data store, to substitute the first permanent token with the second permanent token in the first message, and transmit the second permanent token and the first temporary token to the second exchange connector via the second network, and wherein the second exchange connector, upon receiving an indication that the second protected data system received the first request that includes the first temporary token, is configured to transmit the second permanent token to the second enterprise connector, and wherein the second enterprise connector is configured to determine a second record ID that corresponds with the first request to enable the second protected data system to process the first request.