Hash + salt&pepper + Forward relationship

117 Views Asked by At

Well, This question is just for design proposes.

2 clients ClientAand ClientB users can access to their office using their IDcard. This IDCard is saved in a DB using salt&pepper to create a user pseudonymization between the clients.

ClientA DB

Username    String to be Hashed             Hashed Value
ClientA     UserIDCard1+E1F53135E559C253    72ae25495a7981c4062...
ClientA     UserIDCard2+E1F53135E559C253    a52e4f1565c90f048f8...
ClientA     UserIDCard3+E1F53135E559C253    59027bd9c8c8900d5c3...

ClientB DB

Username    String to be Hashed             Hashed Value
ClientB     UserIDCard1+B7E459A02CB31F3C    b4b6603abc67096754...
ClientB     UserIDCard2+B7E459A02CB31F3C    e99c7e7f1389e40cd3...
ClientB     UserIDCard3+B7E459A02CB31F3C    16e78ad38eb1468edf...

That means if UserIDCard1 visits ClientA and then ClientB, the UserIDCard1 will be treated as a different user, which is good for pseudonymization (If an attacker gets access to DB) but bad if in the future Clients decide to merge ClientAB.

Is there a way to keep the pseudonymization across DBs but at the same time know if UserIDCard1 was in ClientA's building and ClientB's building? Or by definition Hash+Salt are NOT to be able to compare hashed values?

edit

The propose of these DBs is to get anonymous statistics about Client's users without compromising user's privacy across different DBs by storing their 'UserIDCard'.

0

There are 0 best solutions below