Multi-tenant anonymization with forensics capabilities (MAF)

A method for a security management entity for communication with a plurality of trusted entities, the method comprising:

• splitting a cryptographic key into a plurality of key parts where a threshold number of key parts are combinable to reconstruct the cryptographic key according to threshold cryptography;
• anonymizing at least a first data instance at least in part by using the key with threshold cryptography;
• transmitting a respective key part of the plurality of key parts to each one of the plurality of trusted entities;
• storing at least one key part of the plurality of key parts, the stored at least one key part being different from the transmitted respective key parts;
• receiving a message from a first trusted entity of the plurality of trusted entities for investigating the anonymized first data instance, the message including one of the transmitted respective key parts associated with the first trusted entity;
• and
• deanonymizing the first data instance using the cryptographic key that is reconstructed using the stored at least one key part and the one of the transmitted respective key parts associated with the first trusted entity.

A non-transitory computer readable storage medium configured to store instructions, which when executed by a processor, causes the processor to:

• split a cryptographic key into a plurality of key parts where a threshold number of key parts are combinable to reconstruct the cryptographic key according to threshold cryptography;
• anonymize at least a first data instance at least in part by using the key with threshold cryptography;
• transmit a respective key part of the plurality of key parts to each one of a plurality of trusted entities;
• store at least one key part of the plurality of key parts, the stored at least one key part being different from the transmitted respective key parts;
• receive a message from a first trusted entity of the plurality of trusted entities for investigating the anonymized first data instance, the message including one of the transmitted respective key parts associated with the first trusted entity;
• and
• deanonymize the first data instance using the cryptographic key that is reconstructed using the stored at least one key part and the one of the transmitted respective key parts associated with the first trusted entity.