Patent ID: 7404079

Claim:
In a computer network, apparatus for mapping data between different security domains, the apparatus comprising: a communication module stored on a computer-readable medium, the communication module establishing a communication connection between a sender of one security domain and a receiver in a different security domain, wherein the communication connection is a secure communication channel formed by the communication module (i) authenticating the sender with the communication module and authenticating the receiver with the communication module, resulting in an authorized sender and authorized receiver, and (ii) encrypting working data transmitted over the channel; a mapping module stored on a computer-readable medium coupled to the communication module, the mapping module anonymously mapping working data of the one security domain to working data of the different security domain, the working data having (i) a research data portion and (ii) a personal identifier portion related to identifying a person associated with the research data portion, the mapping module mapping the personal identifier portion of the working data in the one security domain to the personal identifier portion of the working data in the different security domain such that the working data transmitted to the receiver over the secure communication channel is anonymous data, while leaving the research data portion unmapped by the anonymous mapping of the personal identifier portions; and a secret sharing module stored on a computer-readable medium, the secret sharing module performing secret sharing to control keyholder access to the mapping module such that a predetermined number of keyholders greater than one is required to compromise access to the mapping module; the apparatus communicating between parties comprising at least the sender and the receiver in at least two different security domains; wherein the communication module (i) transmits both the anonymously mapped personal identifier portion and the unmapped research data portion of the working data to the receiver over the secure communication channel, and (ii) transmits from the receiver to the sender a return of the working data based on a reverse mapping performed by the mapping module; and wherein the anonymous mapping of the personal identifier portion is a one-to-one mapping.