Most importantly, do NOT collect data you do not need to. I don’t see why universities need their students’ SSNs, apart from reporting salaries paid to grad students-as-employees.
Of course, many many students in undergraduate life are also employees of the school part time, so presumably they need to provide this information.
Given the construction of SSNs (first five digits are a key for state-and-date), and our large population of students from different states, reconciling SSN to human was trivial.
Ironically, the foreign students were in better shape because the registrar issued them an ID number which was not their SSN.
Source: I work for a software company in the higher ed market.
It is, just not enough.
X:Q = V->generatepair(Qpub) // Generate a unique ID stri g for interacting with the university. Not confidential, because not verifiable by anyone.
Tok = V->encode(Xpriv, X:Q, Qpub, property:FullName, Vpriv) // Generate a token string unique to the pairing of X:Q, for a specified property like FullName, signed by the verifier.
FullName = decode(Tok, Xpub, Qpriv) // The query entity (university) can decide this blob, but no one else can.
If the Q looses confidentiality of Qpriv and all the Tok, then that data is lost. But having that doesn't let the attacker prove they are X to a different entity.
I'm sure more rigorous schemes have been thought out, but there is so much inertia in changing anything.