Data message sharing

1. A computer implemented method of sharing a data message containing multiple data fields between a provider computer system and a consumer computer system, wherein the provider computer system and the consumer computer system have mutual mistrust, the method comprising:

responsive to an authentication of the provider computer system by an anonymization server trusted by the provider computer system and the consumer computer system, receiving, by the anonymization server, from the provider computer system, a definition of one or more fields in the data message accessible to the consumer computer system, each field having associated a cryptographic key wherein the cryptographic keys of one or more fields are different from one another;

responsive to an indication from a data storage server that a ciphertext of the data message is requested by the provider computer system to be stored in the data storage server including a derivative of an identifier of the provider computer system, confirming, by the anonymization server, an authenticity of the ciphertext by confirming an authenticity of the derivative of the identifier of the provider computer system, wherein each field of the ciphertext is encrypted using a corresponding cryptographic key; and

responsive to an authentication of the consumer computer system, issuing, by the anonymization server, the consumer computer system with a cryptographic key for each of the fields in the data message accessible to the consumer computer system, such that the consumer computer system is operable to obtain the ciphertext from the data storage server and to decrypt the one or more accessible data fields and such that other data fields being non-accessible to the consumer are encrypted to anonymize the other data fields, and communicating a derivative of the data message to the consumer computer system such that the consumer computer system can identify the data message to the data storage server for retrieval of the data message.

2. The method of claim 1 , wherein the derivative of the identifier of the provider computer system is a hash or digest of an identifier of the provider computer system.

3. The method of claim 1 , wherein communication with each of the provider computer system and the consumer computer system is encrypted using separate session keys.

4. The method of claim 1 , wherein the derivative of the data message is a hash or a digest of the data message.

5. The method of claim 1 , wherein at least some of the data fields in the data message are unencrypted.

6. A non-transitory computer-readable storage medium storing a computer program element comprising computer program code to, when loaded into a computer system and executed thereon, cause the computer system to perform the method as claimed in claim 1 .

7. A computer system comprising:

a processor and memory storing computer program code for sharing a data message containing multiple data fields between a provider computer system and a consumer computer system, wherein the provider computer system and the consumer computer system have mutual mistrust, by:

responsive to an authentication of the provider computer system by an anonymization server trusted by the provider computer system and the consumer computer system, receiving, by the anonymization server, from the provider computer system, a definition of one or more fields in the data message accessible to the consumer computer system, each field having associated a cryptographic key wherein the cryptographic keys of one or more fields are different from one another;

responsive to an indication from a data storage server that a ciphertext of the data message is requested by the provider computer system to be stored in the data storage server including a derivative of an identifier of the provider computer system, confirming an authenticity of the ciphertext by confirming, by the anonymization server, an authenticity of the derivative of the identifier of the provider computer system, wherein each field of the ciphertext is encrypted using a corresponding cryptographic key; and

responsive to an authentication of the consumer computer system, issuing, by the anonymization server, the consumer computer system with a cryptographic key for each of the fields in the data message accessible to the consumer computer system, such that the consumer computer system is operable to obtain the ciphertext from the data storage server and to decrypt the one or more accessible data fields and such that other data fields being non-accessible to the consumer are encrypted to anonymize the other data fields, and communicating a derivative of the data message to the consumer computer system such that the consumer computer system can identify the data message to the data storage server for retrieval of the data message.