Creating Unique IDs - OID and UUID

From IHE Wiki
Jump to: navigation, search

Standards often need to have a way to identify an object in a way that is impossible to be confused. A way to come up with a 'name' for an object that no other object has - A Unique Identifier. Standards have solved this multiple times, with two primary ways common today. One of those common ways being able to incorporate the other. This page does not fully describe these unique identifiers but rather points to the few references that you need to use.

Unique Identifier

A Unique Identifier is a unique identifier for any kind of object. This goes for things like Patient Identifiers, DICOM Study Instance (DICOM calls these a UID), and CDA Documents. To a computer a communications protocol, these are just a Unique Identifier of an Object. Like homeCommunityId, RepositoryUniqueId, etc.

It should also be made clear that a Unique Identifier is an opaque identifier; meaning it is either identifying the object or it is not -- True or False. Some Unique Identifiers are hierarchical and one could possibly determine something about the object by looking at the identifier but this should NOT be relied on, it should be worried about (Risks to Privacy-Security). Meaning that the structure of the unique ID is important when creating a new one, to assure you are truly creating a new one that doesn't exist today or in the future. But also that when 'using' a unique ID one compares the whole thing to determine if it is the unique ID you want or not. Any attempt to see if it is close to the ID you want will only result in trouble down the line.

There are 2 types of unique identifiers discussed here:

  1. UUID - Universally Unique Identifier. These are not absolutely unique, but statistically unique. Not that there is ever a way to prove that any Unique ID is absolutely unique, but UUID is a fixed size and without a structure that tries to guarantee uniqueness. That said, there are different ways to create UUIDs that get so close to statistically unique that one must ask how close to tangent must one get.
  2. OID - Object Identifier. We tend to want to use these more often as they are more structured and thus allow for some additional ways to create Unique Identifiers. The structure also allows for more accurate TRUE/FALSE comparisons. And when it comes to diagnosing problems, their structure can also come in handy.

There are also others (e.g., URI - Universal Resource Indicator, for which there is a subset, URN and URL) but no further guidance is given here for other types of Unique Identifiers.

So, how does one create a Unique Identifier in a way that is globally unique?


The easy way is to use your platform to create a UUID and it is strongly recommended to use your platform. Not because there is the possibility that the platform may have not messed things up, because we all know that mistakes happen and if we all use the platform provided functionality then we will all be watching for the mistakes in the same code. Where as if everyone writes their own algorithm, then mistakes will only be detected by a handful of people who inspected the code, thus a mistake will happen at a bad time. Yes, an open-source platform implementation would make this even better.

How do you create an OID?

The above is all about creating UUIDs, not OIDs. But, if one creates a UUID then you can encode that as an OID very simply. An OID that begins with "2.25." is an OID encoded UUID. The value after "2.25." is the straight decimal encoding of the UUID as an integer. It MUST be a direct decimal encoding of the single integer, all 128 bits. It must not be broken up into parts. E.g., the UUID "f81d4fae-7dec-11d0-a765-00a0c91e6bf6" becomes the OID "2.25.329800735698586629295641978511506172918". (thanks David)

It must be decimal because OIDs are all decimal. This has the additional benefit of being easier to compare for TRUE/FALSE as one doesn't need to worry about the case of the non decimal characters (typically UUIDs are encoded as hex values, so one must compare them using case-insensitive methods). Yes you must work with very large integer math.

Note: Some protocols have limits to the size of a Unique ID. For example DICOM has restricted some OIDs to 64 characters. When encoding a UUID in an OID the proper way, you will not overflow 64 characters. This is because the largest decimal value that can fit in a 128 bit integer encoded as a string is 39 characters long. (Note, another reason to do this as a single integer, as some have tried to encode the parts and ended up with strings that were too long).

See IHE's OID Registration page for guidance on obtaining and managing IHE's OIDs.

How do you create an OID that is not a UUID?

The UUID encoded OID is really not adding much value, but it is very important where UUIDs are well understood. Sometimes one really needs a native OID. For example a native OID is very helpful when it is used to define something that is going to be documented as part of a standard. For example a vocabulary, Value-Set, Service-Endpoint, etc.

  • First one must get a OID prefix.
  • Second one must manage their OID space. Like managing any 'directory', creating a structure that meets your needs helps you organize and control the OIDs. Some good examples are found in the IHE Vol 2x Appendix B For example when you need to build OIDs in a distributed space (like isolated medical-devices), then manage the OID space to assure that each machine gets a unique branch.
  • Third one must manage each instance. Some will use methods similar to those used for UUIDs. Such as using the MAC address and timestamp (be careful to be thread safe).

See IHE's OID Registration page for guidance on obtaining and managing IHE's OIDs.


Note: MAC addresses (e.g., the ethernet address of your machine) are assigned using a manufacture assigned code and a code assigned by that manufacture in a way that they are globally unique. But the MAC address can also be changed by a talented user. And some abstractions (Virtual Machines) don't use manufacture controlled MAC addresses.

URI encoding of UUID and OID

There is a URI (URN) encoding for both UUID and OID. For example:


Don't reinvent, there are plenty of Unique ID standards and widely used implementations of those standards.

This page derived from blog article