Subject: [ipfix] Re: I-D ACTION:draft-ietf-ipfix-reqs-12.txt

From: Juergen Quittek <[email-masked]>
Date: Thu, 20 Nov 2003 09:26:04 +0100

Dear all,

--On 19.11.2003 15:27 h -0500 [email-masked] wrote:

> A New Internet-Draft is available from the on-line Internet-Drafts directories.
> This draft is a work item of the IP Flow Information Export Working Group of the IETF.
>
> 	Title		: Requirements for IP Flow Information Export
> 	Author(s)	: J. Quittek
> 	Filename	: draft-ietf-ipfix-reqs-12.txt
> 	Pages		: 32
> 	Date		: 2003-11-19
> 	
> This memo defines requirements for the export of measured IP flow
> information out of routers, traffic measurement probes and
> middleboxes.
>
> A URL for this Internet-Draft is:
> http://www.ietf.org/internet-drafts/draft-ietf-ipfix-reqs-12.txt

The list of changes is rather small this time.

It just covers the issue of anonymization.  After we removed anonymization
for the last version, because we felt unable to follow Allison's
request for a MUST on anonymization, now it is back as a MAY feature.

The difference to the original version we had in draft version -10
is that now there are two more paragraphs in the anonymization section
explaining why we cannot make it a MUST at this point in time, and
two more paragraphs in the security considerations explaining why
anonymization is important.

A usual, please find a detailed description of changes below.

Thanks,

    Juergen
-- 
Juergen Quittek        [email-masked]       Tel: +49 6221 90511-15
NEC Europe Ltd.,       Network Laboratories        Fax: +49 6221 90511-55
Kurfuersten-Anlage 36, 69115 Heidelberg, Germany   http://www.ccrle.nec.de

=========================
IPFIX Requirements Issues
=========================

========================================================================
19. Anonymization back to MAY (issue 16 revisited)
========================================================================
Problem Description:
------------------------------------------------------------------------
For version 11, anonymization was removed, because a MUST was considered
as not feasible.  Now, it is inserted again as MAY.

raised by Allison Mankin
========================================================================
Suggested solution:
------------------------------------------------------------------------
The original section 6.7 from version -10 was inserted again and
extended by the two new paragraphs 2 and 3.

   add section 6.7
     "6.7.  Anonymization

         The exporting process MAY be capable of anonymizing source and
         destination IP addresses in flow data before exporting them. It MAY
         support anonymization of port numbers and other fields. Please note
         that anonymization is not originally an application requirement, but
         derived from general requirements for treatment of measured traffic
         data within a network.

         For several applications anonymization cannot be applied, for example
         for accounting and traffic engineering.  However, for protecting the
         network user's privacy, anonymization should be applied whenever
         possible.  In many cases it is sufficient if anonymization is
         performed at the collecting process after flow information has been
         exported.  This provides a reasonable protection of privacy as long
         as confidentiality of the export is provided.

         It would be desirable to request that all IPFIX exporters provide
         anonymization of flow records, but algorithms for anonymization are
         still a research issue.  Several are known but the security they
         provide and their other properties are not yet studied sufficiently.
         Also, there is no standardized method for anonymization.  Therefore,
         the requirement for the exporting process supporting anonymization is
         qualified with 'MAY' and not with 'MUST'.

         If anonymized flow data is exported, this MUST be clearly indicated
         to all receiving collecting processes, such that they can distinguish
         anonymized data from non-anonymized data.

In addition, a hint to anonymization was added to the introduction of
Section 6. The requirement to configure anonymization (if supported) in
Section 7.2 was put back to it's place.

   append to Section 7.2 (configuration requirements)
        "5. flow anonymization
         This requirement only applies if the exporting process supports
         flow anonymization."

And the row on anonymization in the appendix was inserted again.

   add to appendix
     "| 6.7.  | Anonymization (n)       |  O  |  O  |  O  |  O  |  O  |  O   |
      |-------+-------------------------+-----+-----+-----+-----+-----+------|"

   add to appendix
     "(n) Anonymization MUST be clearly indicated to all receiving
          collecting processes."

The two paragraphs on anonymization added in version -11 in order to
replace Section 6.7 are still in the document indicating the
need of anonymization.
========================================================================
Status: solution committed
========================================================================

--
Help        mailto:[email-masked] and say "help" in message body
Unsubscribe mailto:[email-masked] and say
"unsubscribe ipfix" in message body
Archive     http://ipfix.doit.wisc.edu/archive/