I'm wanting to share datasets between two organisations in a pseudonymised way such that they link together via mutual entities (e.g. people) but so that the entities cannot be identified. E.g.:
Organisation A has dataset A. Organisation B has dataset B. Person C appears in both datasets, identified by their unique ID 12345. I want to store both datasets together (in a data warehouse outside of both organisations), linking activity for person C in dataset A with activity for person C in dataset B. However, to ensure person C cannot be identified, I want to store their unique ID (across both datasets) in a hashed way - such that it cannot be reversed (e.g. such that 12345 becomes 29CX9).
I could simply hash the unique identifier via SHA2 512 (or other algorithm) and store this in the warehouse therefore providing a pseudonymn that always maps to the same output for a given input. However, unlike with passwords where one-way hashing is effective, anyone (that knows the hashing algorithm) could run a known unique identifier through the hashing algorithm and get the hashed pseudonym. This method prevents people reversing the hash but as identifiers aren't secrets in the same way passwords are, it doesn't really provide any security.
Create a table that assigns a new randomly generated unique identifier for each identifier we want to create a pseudonym for and then lock this table down so no one has access. This gives us a unique identifier that isn't related to the source identifier so someone who knows a source identifier can't find out what the pseudonym would be in the shared warehouse, however it does then mean that if the table is ever breached, an attacker has everything they need to identify all entities in the warehouse.
Are there further options? Does it essentially boil down to one of these two options - either we can protect a source identifier from being converted to its pseudonym or we can protect a pseudonym from being reversed to its source identifier but not both? Would the best bet be a hybrid were the source identifier is hashed (SHA2 512) and then a locked down lookup table is created that maps hashed identifiers with unique randomly generated identifiers...?