Subject: Re: [IPFIX] Fwd: I-D Action:draft-ietf-ipfix-anon-02.txt

From: "Schmoll, Carsten" <[email-masked]>
Date: Thu, 18 Mar 2010 19:57:16 +0100

Dear Elisa, Brian,

I’ll have a look at the latest version over the weekend. The last version
was already quite mature so I expect only a few comments will come out of
this review from my side.

More later …

Best regards

Carsten

Von: [email-masked] [mailto:[email-masked]] Im Auftrag von
Elisa Boschi
Gesendet: Freitag, 26. Februar 2010 12:01
An: [email-masked]
Cc: [email-masked]
Betreff: [IPFIX] Fwd: I-D Action:draft-ietf-ipfix-anon-02.txt

Nevil, Jürgen,

as you've seen we've submitted a new revision of the anonymisation draft.
The changes are relatively minor and address all remaining open issues and
comments received so far. At this point we think we're ready for Working
Group Last Call. In order to take advantage of the upcoming meeting we
suggest starting WG last call soon so that we can discuss last call comments
during the anon draft agenda slot.

thanks,
Elisa & Brian

-------- Original Message -------- 

Subject: 

[IPFIX] I-D Action:draft-ietf-ipfix-anon-02.txt

Date: 

Mon, 15 Feb 2010 04:00:01 -0800 (PST)

From: 

[email-masked]

To: 

[email-masked]

CC: 

[email-masked]

A New Internet-Draft is available from the on-line Internet-Drafts
directories.
This draft is a work item of the IP Flow Information Export Working Group of
the IETF.

        Title           : IP Flow Anonymisation Support
        Author(s)       : E. Boschi, B. Trammell
        Filename        : draft-ietf-ipfix-anon-02.txt
        Pages           : 37
        Date            : 2010-02-15
 
This document describes anonymisation techniques for IP flow data and
the export of anonymised data using the IPFIX protocol.  It
categorizes common anonymisation schemes and defines the parameters
needed to describe them.  It provides guidelines for the
implementation of anonymised data export and storage over IPFIX, and
describes an information model and Options-based method for
anonymisation technique metadata export within the IPFIX protocol or
storage in IPFIX Files.
 
A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-ipfix-anon-02.txt
 
Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/
 
Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.

---

From: "Schmoll, Carsten" <[email-masked]>
Date: Fri, 19 Mar 2010 15:31:21 +0100

Dear Elisa, Brian,

I reviewed the latest version of the draft and, apart from a few suggestions for improved wording, found only two issues, which I would consider to address:

If I'm not completely mistaken then there exists no section about "IP address enumeration" yet. Since this is a commonly used technique, I would give it some text (see below).

The second is similar; there is no explicit notion of hashing of IP addresses, which is often used as well, but has some deviations from a perfect permutation, namely collisions.

I wrote some new text as a suggestion, following below. Maybe it could be a subsection of 4.1.3 Permutation. I also think it could be a bit shorter but would leave this open to you. Comments are of course welcome.

<Current text:>

4.1.3.  Permutation

   Permutation is a direct substitution technique, replacing each IP

   address with an address selected from the set of possible IP

   addresses, guaranteeing that each anonymised address represents a

   unique original address.  The selection function is often random,

   though it is not necessarily so.  Permutation does not preserve any

   structural information about a network, but it does preserve the

   unique count of IP addresses.  Any application that requires more

   structure than host-uniqueness will not be able to use permuted IP

   addresses.

<New test could start here:>

As subcategories of permutation exist stateful and stateless permutation techniques: Stateless permutation (e.g., by exchange of address bits in a fixed way) yields a consistent, deterministic mapping of addresses, while stateful permutation (e.g., by renumbering found IP addresses in a packet trace by giving each a new number in a consecutive way) does not yield a consistent anonymisation across multiple packet traces. See section xxx for details on the definition of anonymisation mapping stability.

4.1.3.1 Enumeration

   Enumeration is a substitution function that retains the chronological order in which different IP addresses occurred on the network or in an anonymised packet data trace while eliminating the original IP addresses. IP Addresses are usually replaced by consecutive addresses, e.g. counting up from 1.1.1.1, 1.1.1.2, and so on in the IPv4 case. During this process a map is extended whenever a previously unseen IP address is observed. This kind of permutation produces a unique mapping, which is usually not stable across invocations of this process as the mapping is rarely kept, after an anonymisation run based on enumeration is finished. 

4.1.3.2 Hashing

In this permutation process a hash function is applied to the IP addresses, which usually outputs numbers (values?) in the same dimension as the input, i.e. 32bit output for IPv4 and 128bit output for IPv6. A hash function computes this output number in a deterministic way from the IP address input. It therefore belongs to the stable class of anonymisation techniques. The hash function may also take an additional salt (seed?) parameter, so that not only the hash function type alone determines the actual mapping. This salt value must be kept secret in order to protect the non-reversibility of the hash function. Note that hash functions usually produce a minor amount of collisions in the output numbers, so that there does not exist an exact one-to-one mapping to the original IP addresses. The exception is the choice of a perfect hashing function, which does not show collisions. However such hash function needs to be tailored to the input data set (the set of IP addresses) and cannot be applied to a live stream of IP addresses, since one needs to know the complete set of different IP addresses in order to define the perfect hash function for this set.

What do you think?

Best regards

Carsten

Von: [email-masked] [mailto:[email-masked]] Im Auftrag von Elisa Boschi
Gesendet: Freitag, 26. Februar 2010 12:01
An: [email-masked]
Cc: [email-masked]
Betreff: [IPFIX] Fwd: I-D Action:draft-ietf-ipfix-anon-02.txt

Nevil, Jürgen,

as you've seen we've submitted a new revision of the anonymisation draft. The changes are relatively minor and address all remaining open issues and comments received so far. At this point we think we're ready for Working Group Last Call. In order to take advantage of the upcoming meeting we suggest starting WG last call soon so that we can discuss last call comments during the anon draft agenda slot.

thanks,
Elisa & Brian

-------- Original Message -------- 

Subject: 

Date: 

From: 

[email-masked]

To: 

[email-masked]

CC: 

[email-masked]

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the IP Flow Information Export Working Group of the IETF.