Handling sensitive data in an application using external processing

A data processing system, comprising a secure computer system that includes one or more processors, one or more memories, and one or more computer readable hardware storage devices, said one or more hardware storage device containing program code executable by the one or more processors via the one or more memories to implement a method for handling sensitive data required by an application in the secure computer system, said method comprising:

• said one or more processors transforming a request message from a data format required by the application into a data format required by a service in an external computer system that is external to the secure computer system, said transforming including transforming sensitive data in one or more data aspects of the request message, and additional data aspects of the request message, from the data format required by the application into the data format required by the service, said sensitive data needed by the service to provide information to the application;
• after said transforming the request message, said one or more processors tokenizing the transformed sensitive data in the one or more data aspects in the transformed request message by replacing the transformed sensitive data with tokenized data in the transformed request message and storing a mapping between the transformed sensitive data and the tokenized data in the secure computer system;
• said one or more processors sending the transformed request message including the tokenized data to the external computer system;
• after said sending the transformed request message, said one or more processors receiving a response message from the external computer system, said response message including:
• the additional data aspects transformed from the data format required by the service into the data format required by the application;
• the tokenized data in the one or more data aspects, and annotations with transform instructions for transforming the transformed sensitive data, from the data format required by the service into the data format required by the application, after the tokenized data has been replaced by the transformed sensitive data in the one or more data aspects;
• and
• said one or more processors replacing, by utilizing the mapping, the tokenized data in the one or more data aspect of the response message with the sensitive data.

A computer program product, comprising one or more computer readable hardware storage devices having computer readable program code stored therein, said program code containing instructions executable by one or more processors of a secure computer system to implement a method for handling sensitive data required by an application in the secure computer system, said method comprising:

• said one or more processors transforming a request message from a data format required by the application into a data format required by a service in an external computer system that is external to the secure computer system, said transforming including transforming sensitive data in one or more data aspects of the request message, and additional data aspects of the request message, from the data format required by the application into the data format required by the service, said sensitive data needed by the service to provide information to the application;
• after said transforming the request message, said one or more processors tokenizing the transformed sensitive data in the one or more data aspects in the transformed request message by replacing the transformed sensitive data with tokenized data in the transformed request message and storing a mapping between the transformed sensitive data and the tokenized data in the secure computer system;
• said one or more processors sending the transformed request message including the tokenized data to the external computer system;
• after said sending the transformed request message, said one or more processors receiving a response message from the external computer system, said response message including:
• the additional data aspects transformed from the data format required by the service into the data format required by the application;
• the tokenized data in the one or more data aspects, and annotations with transform instructions for transforming the transformed sensitive data, from the data format required by the service into the data format required by the application, after the tokenized data has been replaced by the transformed sensitive data in the one or more data aspects;
• and
• said one or more processors replacing, by utilizing the mapping, the tokenized data in the one or more data aspect of the response message with the sensitive data.