Last update:
Pseudonymous Pairwise Identifier
Aug 21, 2026
This section presents an overview of the implementation of PPID within the identity management strategy, outlining the business value, success metrics, and roadmap related to this feature.
Overview
Pairwise pseudonymous identifier (PPID), a component of the OpenID Connect Core 1.0 (OIDC) specification, is an opaque identifier recently implemented into the Aikyam platform for their tenants. This feature addresses the need for enhanced privacy in identity platforms, particularly when users interact with third-party apps.
Availability in Production/Launch date
Pairwise pseudonymous identifier (PPID), a component of the OpenID Connect Core 1.0 (OIDC) specification, is an opaque identifier recently implemented into the Aikyam platform for their tenants. This feature addresses the need for enhanced privacy in identity platforms, particularly when users interact with third-party apps.
Problem Statement
Earlier applications under the same IdP shared a common UUID (Unique User Identifier) across platforms. While acceptable for internal applications, this could lead to privacy risks when interacting with third-party apps, as they could potentially track user activity and misuse user behavior data across ecosystems. Thus, the prevention of user activity tracking across different relying parties led to the idea of implementing Pairwise Id. When the external/third-party apps need access, a PPID is generated using the user’s local UUID, protecting their privacy while allowing access to the application.
Public subject type:
Pairwise Subject Type:
Initial Impacted Personas and LOBs
CDOs (Our Care Delivery Organizations) Epic MyChart and Capillary Healthcare
PPID Flow Description
When a user logs in to a Relying Party (RP), the Identity Provider (IdP) generates a unique Pairwise Pseudonymous Identifier (PPID) if it hasn't been created already for the given user/RP combination. This PPID follows the UUID format (16 alphanumeric characters) but is unique to each application. The Relying Party uses this PPID to identify the user without revealing their identity. The system generates a PPID per user per external entity or sector, ensuring that only authorized external identities receive the designated PPID. Internally, the UUID remains the primary identifier, while PPID serves as pseudonymous identifiers for external use.
There are two types of PPIDs:
- For Individual Clients: Each client will receive a unique Pairwise ID for a user.
- For Sector or Client Groups: In scenarios where multiple external clients collaborate legitimately, such as for accessing user preferences or medical records, clients may be grouped into the same sector. This grouping allows clients within the sector to receive the same Pairwise ID for a user. For example, users logging into different hospital networks can have the same PPID if these networks are grouped within the same sector.
To generate a PPID, Aikyam creates a Globally Unique Identifier (GUID) for the pair of Sector Identifier and local account ID and stores this value in the database for future use.
- Aikyam IdP (Identity Provider) tenant will be able to utilize "Pairwise ID" for subject_type == pairwise relying parties, according to OIDC specification.
- External parties will receive a unique "Pairwise ID" as a user identifier, which has 1:1 association with the combination of "Sector Identifier" (group of relying parties) and Aikyam IdP's local account ID. This prevents the correlation of user's identity across different subject_type == pairwise relying parties.
- Aikyam Admin UI will have additional configurations (subject_type, sector_identifier_URI) for OIDC client registration, to support "Pairwise ID" use. Read more.
Note: Apps using the same sector identifier URL will receive the same PPID for a given user, allowing controlled correlation between specific sets of apps.
Business Value
- Enhanced privacy Protection: PPID ensures that users’ activities across different apps cannot be correlated by external third parties. This is critical for applications handling sensitive information, such as PHI (Personal Health Information).
- Security: Reduce the risk of data breaches affecting multiple services.
- Usability: Allows users to access multiple services without exposing their global identity.
- Improved trust and user confidence: By ensuring that user data is not shared across applications, the platform gains user trust, leading to increased adoption and customer satisfaction.
Use Cases
- Pairwise IDs can be used to securely share patient data among different healthcare providers, ensuring patient privacy while allowing access to necessary information.
- They protect student identities while enabling educational institutions to share academic records securely.
- They protect student identities while enabling educational institutions to share academic records securely.
- Banks can employ Pairwise IDs to secure online banking transactions, ensuring that user identities remain protected.
Previous:
Secure access for third party vendors
Share additional feedback to help us improve.
0/255
|
Powered by Aikyam @2025 All rights reserved
+1 866 451 2735
+1 866 451 2735
+1 855 819 5909