Patent ID: 7814119

Claim:
A method of controlling linkability of a personal database and an anonymity database in a personal data management server, the personal database for storing individual data of a user in accordance with a personal ID as a key, and the anonymity database for storing data of the same user in accordance with an anonymous ID as a key, the personal data management server responding to a request to retrieve data from the personal database by the personal ID as a key; and the personal data management server responding to a request to retrieve data from the anonymity database by the anonymous ID as a key and maintaining the anonymous ID, the method comprising: the personal data management server, in response to a request for retrieving data of the user from the personal database and the anonymity database by a present said anonymous ID taken as a present anonymous ID serving as a key, inquiring of a client apparatus about a personal ID corresponding to the present anonymous ID of the user, the personal data management server receiving the personal ID corresponding to the present anonymous ID and another anonymous ID for replacing the present anonymous ID from the client apparatus, the personal data management server retrieving data from the personal database according to the receiving personal ID and data from the anonymity database according to the present anonymous ID to respond to the retrieving request by the present anonymous ID as a key, and the personal data management server replacing the present anonymous ID with the another anonymous ID after the responding, so as to keep correspondence between the personal ID and the anonymous ID secret; and wherein the personal data management server includes an anonymous ID management server, wherein the method comprising: the client apparatus generating and sending the another anonymous ID for the replacing operation, the personal data management server registering the received anonymous ID in the anonymity database if the anonymous ID does not overlap an existing anonymous ID, or not registering the received anonymous ID in the anonymity database if the anonymous ID overlaps an existing anonymous ID, the personal data management server sending a result indication of one of success and failure of the registration, if receiving the indication of success, the client apparatus sending the personal ID to the personal data management server, and if receiving the indication of failure, the client apparatus repeating the generation and sending one more another anonymous ID for the replacing operation and a receipt of the result, the client apparatus generating the anonymous ID by using a hash function that accepts the personal ID and a random number as input data, and the client apparatus generating, if receiving the indication of failure, another random number and the one more another anonymous ID for the replacing operation.