Pseudonymisation method and computer system for performing the method

1 . A pseudonymisation method, wherein the pseudonymisation method comprises:

receiving a data subject identifier from a first data controller, the first data controller having a first data controller identifier,

computing a pseudonym seed based on the data subject identifier using a cryptographic mixing function based on a pseudonym seed generation key, and

computing a global pseudonym as a first hash-based message authentication code on the pseudonym seed with a global pseudonym key;

the method further comprising:

computing a local pseudonym key as a second hash-based message authentication code on the pseudonym seed combined with the first data controller identifier with a local pseudonym key generation key;

computing a local pseudonym based on the global pseudonym using a cryptographic mixing function based on the local pseudonym key; and

providing the local pseudonym to the first data controller.

2 . The pseudonymisation method according to claim 1 , wherein the pseudonym seed is computed based on an encrypted data subject identifier using the cryptographic mixing function based on a pseudonym seed key, the pseudonym seed key being computed based on the pseudonym seed generation key as a cryptographic mixing function based on a random key and wherein the encrypted data subject identifier is computed based on the data subject identifier using the cryptographic mixing function based on the random key and wherein the first hash-based message authentication code is computed on the cryptographic mixing function of the encrypted data subject identifier based on the pseudonym seed key.

3 . The pseudonymisation method according to claim 2 , wherein the second hash-based message authentication code is computed on the cryptographic mixing function of the encrypted data subject identifier based on the pseudonym seed key.

4 . The pseudonymisation method according to claim 2 , wherein the steps of receiving the data subject identifier, computing the pseudonym seed, computing the global pseudonym, computing the local pseudonym key, computing the local pseudonym, and providing the local pseudonym are performed by a second entity separate from the data controller.

5 . The pseudonymisation method according to claim 4 , wherein generation of the random key and the pseudonym seed key is done by a third entity separate from the first data controller and the second entity.

6 . The pseudonymisation method according to claim 5 , wherein shared pseudonyms between the first data controller and a separate second data controller are computed as a third hash-based message authentication code on the global pseudonym combined with the cryptographic mixing function of the first data controller identifier and a second data controller identifier with a shared pseudonym key.

7 . The pseudonymisation method according to claim 6 , wherein for computing the third hash-based message authentication code the first data controller identifier and the second data controller identifier are encrypted.

8 . The pseudonymisation method according to claim 7 , wherein the third hash-based message authentication code is computed by a fourth entity separate from the first data controller, second and third entity.

9 . The pseudonymisation method according to claim 6 , wherein the third hash-based message authentication code is computed according to a policy defined by the first data controller.

10 . The pseudonymisation method according to claim 8 , wherein the encryption of the first data controller identifier and the second data controller identifier is done by a fifth entity separate from the first data controller, second, third and fourth entity.

11 . The pseudonymisation method according to claim 10 , wherein communication of data between said first data controller, second, third, fourth and fifth entities is signed and encrypted using asymmetric cryptography.

12 . The pseudonymisation method according to claim 1 , wherein different keys, the global pseudonym, the local pseudonym and the data controller identifier are bit sequences of a predetermined length and the cryptographic mixing function is an exclusive or function.

13 . A computer system for performing a pseudonymisation method, the computer system comprising at least one computer programmed to:

receive a data subject identifier from a first data controller, the first data controller having a first data controller identifier;

compute a pseudonym seed based on the data subject identifier using a cryptographic mixing function based on a pseudonym seed generation key;

compute a global pseudonym as a first hash-based message authentication code on the pseudonym seed with a global pseudonym key;

compute a local pseudonym key as a second hash-based message authentication code on the pseudonym seed combined with the first data controller identifier with a local pseudonym key generation key;

compute a local pseudonym based on the global pseudonym using a cryptographic mixing function based on the local pseudonym key; and

provide the local pseudonym to the first data controller.

14 . The computer system according to claim 13 , wherein said computer system comprises a plurality of separate computers interconnected by a computer network, each of said separate computers being programmed to perform one or more steps of the pseudonymisation method, such that the pseudonymisation method is collectively performed by the plurality of separate computers, wherein each of said separate computers is operated by a respective separate entity.

15 . The computer system according to claim 14 , wherein the pseudonym seed is computed based on an encrypted data subject identifier using the cryptographic mixing function based on a pseudonym seed key, the pseudonym seed key being computed based on the pseudonym seed generation key as a cryptographic mixing function based on a random key and wherein the encrypted data subject identifier is computed based on the data subject identifier using the cryptographic mixing function based on the random key and wherein the first hash-based message authentication code is computed on the cryptographic mixing function of the encrypted data subject identifier based on the pseudonym seed key.

16 . The computer system according to claim 14 , wherein communication of data between respective separate computers is signed and encrypted using asymmetric cryptography.

17 . The computer system according to claim 15 , wherein the second hash- based message authentication code is computed on the cryptographic mixing function of the encrypted data subject identifier based on the pseudonym seed key.

18 . The computer system according to claim 15 , wherein the steps of receiving the data subject identifier, computing the pseudonym seed, computing the global pseudonym, computing the local pseudonym key, computing the local pseudonym, and providing the local pseudonym are performed by a second computer operated by a second entity, wherein the second computer is one of the separate computers and the second entity is one of the separate entities, and wherein the second entity is separate from the first data controller.

19 . The computer system according to claim 18 , wherein the generation of the random key and the pseudonym seed key is performed by a third computer operated by a third entity, wherein the third computer is one of the separate computers and the third entity is one of the separate entities, and wherein the third entity is separate from the first data controller and the second entity.

20 . The computer system according to claim 19 , further programmed to compute shared pseudonyms between the first data controller and a separate second data controller as a third hash-based message authentication code on the global pseudonym combined with the cryptographic mixing function of the first data controller identifier and a second data controller identifier with a shared pseudonym key.

21 . The computer system according to claim 20 , wherein for computing the third hash-based message authentication code the first data controller identifier and the second data controller identifier are encrypted.

22 . The computer system according to claim 21 , wherein the third hash-based message authentication code is computed by a fourth computer operated by a fourth entity, wherein the fourth computer is one of the separate computers and the fourth entity is one of the separate entities, and wherein the fourth entity is separate from the first data controller, the second data controller, the second entity, and the third entity.

23 . The computer system according to claim 22 , wherein the encryption of the first data controller identifier and the second data controller identifier is performed by a fifth computer operated by a fifth entity, wherein the fifth computer is one of the separate computers and the fifth entity is one of the separate entities, and wherein the fifth entity is separate from the first data controller, the second data controller, the second entity, the third entity, and the fourth entity.

24 . The computer system according to claim 22 , wherein the third hash-based message authentication code is computed according to a policy defined by the first data controller, the policy allowing the first data controller to define rules for sharing data with other data controllers, including specifying which data controllers are authorized to receive shared pseudonyms.