Subject: Re: [nmrg] Re: nmrgsnmp traffic trace anonymization
From: Juergen Schoenwaelder <[email-masked]>
To: Wes Hardaker <[email-masked]>
Cc: [email-masked], Matus Harvan <[email-masked]>
Date: Fri, 29 Apr 2005 19:34:15 +0200
List-Id: Network Management Research Group <nmrg.ibr.cs.tu-bs.de>

On Fri, Apr 29, 2005 at 10:04:23AM -0700, Wes Hardaker wrote:
> >>>>> On Fri, 29 Apr 2005 13:52:16 +0200, Juergen Schoenwaelder <[email-masked]> said:
> 
> Juergen> We have looked into the problem at IUB. Matus Harvan, one of
> Juergen> my students, has done a project where he developed a
> Juergen> prefix-preserving and lexicographic-order-preserving
> Juergen> anonymization scheme for IP addresses.
> 
> Probably one of the best things you could do would be to take the data
> and strip out everything you don't have a direct understanding of.  At
> least that would provide some level of assurance because a human was
> responsible for saying "I know what this data should contain, and it
> should be safe to show to other humans".

This is called the "filter-in" principle and mentioned in the report 
somewhere. See also the references, i.e. the paper by Pang/Paxson.
(This is where this term originates from.)

We looked at IP addresses because they are most challenging. In general, 
you want to preserve lexicographic order (so that you can analyze
message sequences) while randomizing data. For routing tables, 
preserving the prefix order is also highly desirable. MAC addresses or
similar flat number spaces are simpler to deal with since you only have 
to keep the lexicographic order but otherwise you can hash them as you
want (only bounded by the size of the number space, which for MAC 
addresses is not an issue).

Note that our conclusion of this work is not necessarily that this
approach is practically useful. In fact, for IPv4 addresses, it is 
rather weak since the number of bits that you can randomize is small.
For IPv6, it can potentially work (depends on the privacy requirements
you have). But then IPv6 is not that widely deployed...

/js

-- 
Juergen Schoenwaelder		    International University Bremen
<http://www.eecs.iu-bremen.de/>	    P.O. Box 750 561, 28725 Bremen, Germany

From: Wes Hardaker <[email-masked]>
To: [email-masked]
Organization: Sparta
Date: Fri, 29 Apr 2005 10:04:23 -0700
Cc: Matus Harvan <[email-masked]>
Subject: [nmrg] Re: nmrgsnmp traffic trace anonymization

>>>>> On Fri, 29 Apr 2005 13:52:16 +0200, Juergen Schoenwaelder <[email-masked]> said:

Juergen> We have looked into the problem at IUB. Matus Harvan, one of
Juergen> my students, has done a project where he developed a
Juergen> prefix-preserving and lexicographic-order-preserving
Juergen> anonymization scheme for IP addresses.

If it was just IP addresses, it would be a bit simpler.  The problem
is that devices contain many sources of information beyond just
addresses.  Serial numbers.  Phone numbers.  MAC addresses.
Proprietary forms...  You have to ask people what level they'd feel
comfortable divulging.

Take the example of the configuration available via SNMP for network
port filtering at an edge.  I don't care if the data has the addresses
messed with, as the port information contained within the data is
highly useful to me as an attacker.

Even IP addrs come in many forms.  Embedded in OIDs.  4 byte strings.
6 byte strings which include the port number (TAddress).
dotted-representation.  It's even embedded into many snmpEngineIDs.

It's not that it can't be done.  It's just that I, personally
speaking, probably wouldn't trust something to do it.  In the same way
that a generic MIB is useless without a smart manager that understands
the data within it, or a human to understand it and manipulate it by
hand, you can't figure out how to make all the data anonymous without
understanding of it as well.

Probably one of the best things you could do would be to take the data
and strip out everything you don't have a direct understanding of.  At
least that would provide some level of assurance because a human was
responsible for saying "I know what this data should contain, and it
should be safe to show to other humans".

-- 
Wes Hardaker
Sparta, Inc.

Date: Fri, 29 Apr 2005 13:52:16 +0200
From: Juergen Schoenwaelder <[email-masked]>
To: [email-masked]
Mail-Followup-To: [email-masked], Matus Harvan <[email-masked]>
Cc: Matus Harvan <[email-masked]>
Subject: [nmrg] snmp traffic trace anonymization
Reply-To: [email-masked]

Hi.

During our last meeting, we discussed how we can collect and analyze
network management traffic traces and more specifically SNMP traces.
I showed a tool which converts pcap traces into an XML format which
makes it easy to write analyzer scripts in Perl, Python, ... One
issue that came up during the meeting was whether it is possible
to anynomize traces so that they do not reveal directly where the
trace is coming from but we did not know the details how this could
work. 

We have looked into the problem at IUB. Matus Harvan, one of my
students, has done a project where he developed a prefix-preserving 
and lexicographic-order-preserving anonymization scheme for IP 
addresses. People interested into this work are invited to take a 
look at Matus' report and implementation which you can find on the
following server:

	<http://pandora.iu-bremen.de/~mharvan/gr/>.

We are generally interested to receive feedback. Note that there is
also an implementation of the algorithm in case you want to try 
it out.

/js

-- 
Juergen Schoenwaelder		    International University Bremen
<http://www.eecs.iu-bremen.de/>	    P.O. Box 750 561, 28725 Bremen, Germany

From: "Michael Alexander" <[email-masked]>
To: <[email-masked]>
Date: Fri, 29 Apr 2005 12:07:24 +0200
Subject: [nmrg] AW: Nmrg Digest, Vol 8, Issue 10

I am planning to attend also - will there be topic specific sessions in the workshop.

Best Regards,

Dr. Michael Alexander
WU Wien Dept. of Information Systems
[email-masked] / +43.1.31336.4467

-----Ursprüngliche Nachricht-----
Von: [email-masked] [mailto:[email-masked]] Im Auftrag von [email-masked]
Gesendet: Montag, 28. März 2005 12:00
An: [email-masked]
Betreff: Nmrg Digest, Vol 8, Issue 10

Send Nmrg mailing list submissions to
	[email-masked]

To subscribe or unsubscribe via the World Wide Web, visit
	https://www.ibr.cs.tu-bs.de/mailman/listinfo/nmrg
or, via email, send a message with subject or body 'help' to
	[email-masked]

You can reach the person managing the list at
	[email-masked]

When replying, please edit your Subject line so it is more specific
than "Re: Contents of Nmrg digest..."

Today's Topics:

   1. Re: voip management meeting (Juergen Schoenwaelder)

----------------------------------------------------------------------

Message: 1
Date: Sun, 27 Mar 2005 21:23:40 +0200
From: Juergen Schoenwaelder <[email-masked]>
Subject: Re: [nmrg] voip management meeting
To: "Romascanu, Dan (Dan)" <[email-masked]>
Cc: [email-masked]
Message-ID: <[email-masked]>
Content-Type: text/plain; charset=us-ascii

On Sun, Mar 27, 2005 at 11:30:23AM +0200, Romascanu, Dan (Dan) wrote:

> I plan to attend. Will there be hotel arrangements, or at least 
> recommendations for Nancy? Also, some directions about how to get 
> there (what train lines, connections form the two principal 
> airports in Paris, etc.) would be welcome. 

I am sure Olivier will provide this information after the easter
break and I will assemble this on the meeting web page. 

/js

-- 
Juergen Schoenwaelder		    International University Bremen
<http://www.eecs.iu-bremen.de/>	    P.O. Box 750 561, 28725 Bremen, Germany

------------------------------

-- 
!! This message is brought to you via the `nmrg' mailing list.
!! Please do not reply to this message to unsubscribe. To unsubscribe or adjust
!! your settings, send a mail message to <[email-masked]>
!! or look at https://www.ibr.cs.tu-bs.de/mailman/listinfo/nmrg.

End of Nmrg Digest, Vol 8, Issue 10
***********************************

Content-class: urn:content-classes:message
Subject: RE: [nmrg] Re: FWD: Invitation to the ITU-T Workshop on NGN inCollaboration with the IETF
Date: Wed, 27 Apr 2005 09:18:03 +0200
From: "Marcus Brunner" <[email-masked]>
To: <[email-masked]>, <[email-masked]>
Cc: 

I also managed to free up the time to got there.

Marcus

---------------------------------------------------

Dr. Marcus Brunner
Network Laboratories
NEC Europe Ltd.

 

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Juergen 
> Schoenwaelder
> Sent: Tuesday, April 26, 2005 1:07 PM
> To: [email-masked]
> Subject: [nmrg] Re: FWD: Invitation to the ITU-T Workshop on 
> NGN inCollaboration with the IETF
> 
> On Thu, Apr 07, 2005 at 11:01:43PM +0200, Juergen Schoenwaelder wrote:
> 
> [...]
> 
> > I was planning to join this meeting. Unfortunately, the 
> scheduling on 
> > May 1-2 makes it extremely difficult for me to be in 
> Geneva. So I am 
> > wondering whether someonelse familiar with the NMRG is able 
> to attend 
> > this meeting.
> 
> Just for your information: I have managed to solve the 
> scheduling problems and I will attend the ITU/IETF meeting in 
> Geneva next weekend. If you have any specific questions you 
> are intersted in, feel free to send me email and I will see 
> whether I can get any answers in Geneva. I am also looking 
> forward to see some of you there.
> 
> /js
> 
> -- 
> Juergen Schoenwaelder		    International University Bremen
> <http://www.eecs.iu-bremen.de/>	    P.O. Box 750 561, 
> 28725 Bremen, Germany
> --
> !! This message is brought to you via the `nmrg' mailing list.
> !! Please do not reply to this message to unsubscribe. To 
> unsubscribe or adjust !! your settings, send a mail message 
> to <[email-masked]> !! or look at 
> https://www.ibr.cs.tu-bs.de/mailman/listinfo/nmrg.
> 

Date: Tue, 26 Apr 2005 13:06:31 +0200
From: Juergen Schoenwaelder <[email-masked]>
To: [email-masked]
Mail-Followup-To: [email-masked]
Subject: [nmrg] Re: FWD: Invitation to the ITU-T Workshop on NGN in Collaboration with the IETF
Reply-To: [email-masked]

On Thu, Apr 07, 2005 at 11:01:43PM +0200, Juergen Schoenwaelder wrote:

[...]

> I was planning to join this meeting. Unfortunately, the scheduling
> on May 1-2 makes it extremely difficult for me to be in Geneva. So
> I am wondering whether someonelse familiar with the NMRG is able to
> attend this meeting.

Just for your information: I have managed to solve the scheduling
problems and I will attend the ITU/IETF meeting in Geneva next
weekend. If you have any specific questions you are intersted in, 
feel free to send me email and I will see whether I can get any 
answers in Geneva. I am also looking forward to see some of you
there.

/js

-- 
Juergen Schoenwaelder		    International University Bremen
<http://www.eecs.iu-bremen.de/>	    P.O. Box 750 561, 28725 Bremen, Germany

Date: Thu, 7 Apr 2005 23:01:43 +0200
From: Juergen Schoenwaelder <[email-masked]>
To: [email-masked]
Mail-Followup-To: [email-masked]
Subject: [nmrg] FWD: Invitation to the ITU-T Workshop on NGN in Collaboration with the IETF
Reply-To: [email-masked]

I am not sure whether everybody on this list has seen the following
announcement. I believe that this meeting is a very interesting event
and it touches quite some management aspects as well, especially in
the context of VoIP. 

I was planning to join this meeting. Unfortunately, the scheduling
on May 1-2 makes it extremely difficult for me to be in Geneva. So
I am wondering whether someonelse familiar with the NMRG is able to
attend this meeting. I know that Aiko has some personal ties to the
mountains in Switzerland or that Olivier is living relatively close
to Geneva (as seen from the world-wide perspective). Please anyone
intending to go there, please drop me a note so that we can ensure
a good information flow into and out of this meeting.

Note that the registration deadline is April 15th.

/js

----- Forwarded message from Allison Mankin <[email-masked]> -----

To: IETF Announcement list <[email-masked]>
From: Allison Mankin <[email-masked]>
Date: Tue, 22 Mar 2005 15:10:19 -0500
Subject: Invitation to the ITU-T Workshop on NGN in Collaboration with the
	IETF 
Precedence: list
Errors-To: [email-masked]

The ITU-T will hold a workshop on NGN (Next Generation Network)
together with the IETF 1-2 May, 2005, Geneva, Switzerland. Attendance
is open to all IETF participants and is free of charge. The deadline
for registration is 15 April 2005. Registration and other information
is available at:
http://www.itu.int/ITU-T/worksem/ngn/200505/index.html

(Be sure to look at the convening letter for more links).

The workshop will also serve as an important meeting point for ITU-T
and IETF management.

The overall objectives of the workshop are to explore specific NGN
issues that impact both the ITU-T and the IETF to better understand
the work underway in the two organizations and to identify areas where
actions could be taken between the ITU-T and IETF to further
coordinate their work.

Six sessions will each be co-chaired by an ITU representative and an
IETF representative. Topics will include (not final) requirements and
functional architecture; nomadicity and mobility; QoS, control and
signalling capabilities; network management; security capabilities, and
evolution.

Objectives:

o To explore specific NGN issues that impact both the ITU-T and the IETF
to better understand the work underway in the two organizations; and

o To identify those areas where actions could be taken between the ITU-T
and the IETF to further should coordinate their NGN-related work, and
to seek to reach agreement on any actions to be taken to coordinate
the work of the two organizations and perhaps establish joint
activities.

If a personal invitation letter is needed, please contact Allison
Mankin ([email-masked]) immediately, who will arrange for an
invitation from the ITU Secretariat.

IETF organizing committee:

Loa Andersson, IAB
Scott Bradner, IETF Liaison to ITU-T
Scott Brim, IETF Liaison to ITU-T NGN Activity
Brian Carpenter, IETF Chair
Russ Housley, IESG Security Area Director
Leslie Daigle, IAB Chair
Allison Mankin, Transport Area Director (organizing committee chair)
Dave Meyer, IAB
Jon Peterson, IESG Transport Area Director

_______________________________________________
IETF-Announce mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf-announce

----- End forwarded message -----