A method of managing data for an anonymous data sharing system that receives data from a plurality of data sources each associated with a unique private encryption key and containing data associated with an entity, comprising:
- receiving a data supply from a data source of the plurality of data sources, the data supply comprising:
- an anonymous data source identifier,
- an encrypted entity identifier that is associated with the entity, wherein the encrypted entity identifier has been encrypted with the unique private encryption key of the data source, and
- the data associated with the entity;
- mapping the encrypted entity identifier to a common anonymous entity identifier by applying a classifier key to the encrypted entity identifier, the classifier key being associated with the anonymous data source identifier and configured in such a manner that every encrypted entity identifier associated with a same entity obtains a same common anonymous entity identifier;
- storing the data associated with the entity in a database so that the data is assigned to the common anonymous entity identifier;
- generating a transaction identifier;
- assigning the transaction identifier to the data stored in the database;
- sending the transaction identifier to the data source in a confirmation message;
- receiving a query concerning the entity from the data source, the query comprising:
- the anonymous data source identifier,
- the encrypted entity identifier encrypted with the unique private encryption key of the data source, and the transaction identifier as a first parameter;
- applying the classifier key associated with the anonymous data source identifier to map the encrypted entity identifier to the common anonymous entity identifier, compile a result of the query wherein only data which is connected to the transaction identifier is included in the result of the query, and encrypt the common anonymous entity identifier with a report key associated with the anonymous data source identifier in the result of the query;
- passing on the result of the query to the data source originating the query, wherein once the result of the query is known, a first data source initiates generation of a secure data channel, adapted for protecting anonymity, to a second data source using a cryptographic mapping,
- a data manager provides the first data source and the second data source access to a data storage, users of the anonymous data sharing system are all aware of a symmetric encryption algorithm (f),
- the first data source encrypts an unencrypted transaction identifier (tr.id) to obtain an encrypted transaction identifier c=f(e.id.tr.id) utilizing an unencrypted entity identifier (e.id) of the entity or entities associated with a transaction selected from the result of the query, wherein the first parameter is applied as a key, and places the encrypted transaction identifier in a mailbox,
- the mailbox is marked with a label including the unencrypted transaction identifier and an unencrypted query identifier,
- an anonymous party access the mailbox by presenting an authentic transaction identifier and an authentic query identifier associated with the label to the data manager,
- the data manager discloses the transaction identifier of the transaction which is a subject of a data query originated by the second data source to access contents of the mailbox identified by the encrypted transaction identifier (c),
- an entity identifier returning the unencrypted transaction identifier for which the formula tr.id=f(e.id,c) holds true is found among the entity identifiers associated with the transaction by the second data source,
- the second data source sends the unencrypted query identifier found in the mailbox to the first data source originating the query using the mailbox and a cryptographic key, thereby confirming a common key,
- the cryptographic mapping is applied exclusively for two instances of message exchange required for a Diffie-Hellman key exchange algorithm, thereby preventing the data manager from mounting a man-in-the-middle attack, and encrypted communication is carried out between the first data source and the second data source using the secure data channel.