IP address anonymization

Chulalongkorn
University
Ph.D. Seminar, August 5, 2011
AAnn IIPP AAddddrreessss AAnnoonnyymmiizzaattiioonn
SScchheemmee BBaasseedd oonn PPrriivvaaccyy LLeevveellss
Wongyos Keardsri
Department of Computer Engineering
Faculty of Engineering, Chulalongkorn University
Bangkok, Thailand
E-mail: wongyos@gmail.com

Chulalongkorn
University
OOuuttlliinnee
• Introduction
• Literature Reviews
• Anonymization Scheme
• Privacy Levels
• Anonymization Factors
• Privacy Tree Structures
• Network Analysis Functions
• Computer Law
• Rule-Based Combination
• Results and Discussions
• Conclusion
2 Wongyos Keardsri

Chulalongkorn
University
IInnttrroodduuccttiioonn
• Network Traffic Analysis  Packet Sniffer
IP: 161.200.92.41
IP: 161.200.92.30
IP: 161.200.92.45
IP: 161.200.92.62
IP: 161.200.92.59
CCaappttuurree ppaacckkeettss
AAnnoonnyymmiizzee ppaacckkeettss
AAnnaallyyzzee ppaacckkeettss
3 Wongyos Keardsri

Chulalongkorn
University
IInnttrroodduuccttiioonn ((CCoonntt))
• IP Address Anonymization
To reform the original IP address to the anonymized IP address
OOrriiggiinnaall IIPP AAddddrreessss
AAnnoonnyymmiizzaattiioonn PPrroocceessss
AAnnoonnyymmiizzeedd IIPP AAddddrreessss
116611..220000..9933..337
AAnnoonnyymmiizzaattiioonn PPrroocceessss
744..997..112200..9966
4 Wongyos Keardsri

Chulalongkorn
University
LLiitteerraattuurree RReevviieewwss
• Proposed Anonymization Methods
11999900--11999955 OOnnee--ttoo--oonnee mmaappppiinngg aallggoorriitthhmmss ((HHaasshh FFuunnccttioionn, , MMDD55))
11999966 Greg Minshall TCPdpriv method
22000022 Jun Xu Crypto-PAn method
22000066 Qianli Zhang MAL method
2200007 R. Ramaswamy TSA method
5 Wongyos Keardsri

Chulalongkorn
University
LLiitteerraattuurree RReevviieewwss ((CCoonntt))
• Review of the previous works
 Anonymize all 32 bits of IP address unnecessarily
 Unsuitable for network analysis functions
 Uncover with computer law
 We can anonymize some appropriate bit or parts of IP
address
6 Wongyos Keardsri

Chulalongkorn
University
AAnnoonnyymmiizzaattiioonn SScchheemmee
• Our Anonymization Scheme
Original IP Address
Anonymization Factors
(1) Privacy Tree Structures
(2) Network Analysis Functions
(3) Computer Law
Anonymized IP Address
Privacy
Levels
Rule-Based
Combination
7 Wongyos Keardsri

Chulalongkorn
University
PPrriivvaaccyy LLeevveellss
• This research proposes a new IP address anonymization
scheme by considering and using privacy levels
• To consider the IP address structure
255 .255 .0 .0
11111111.11111111.00000000.00000000
Subnet Mask Address
161 .200 .93 .1
IP Address 10100001.11001000.01011101.00000001
Network Part 116611..220000..00..00 Host Part xx..xx..9933..11
Left bits Right bits
NNeettwwoorrkk PPaarrtt HHoosstt PPaarrtt
8 Wongyos Keardsri

Chulalongkorn
University
PPrriivvaaccyy LLeevveellss ((CCoonntt))
• We anonymize the necessary bits or parts of IP address
with the different privacy levels
• We define the privacy levels into 5 levels
• Privacy Levels
 Non-anonymization
 n-Left anonymization
 n-Right anonymization
 Full anonymization
 Randomly full anonymization
Left bits Right bits
XXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXX
RRRRRRRRRRRRRRRR RRRRRRRRRRRRRRRR
9 Wongyos Keardsri

Chulalongkorn
University
Anonymization Factors
• There are 3 reasons to consider the anonymization
factors
 Do you know about the data which are used to analyze? Much
or little?
 What do you need to use the data for which functions?
 How about the computer law or computer crime act defines
and describes?
• There are 3 anonymization factors
 IP address structures
 Network analysis functions
 Computer law / computer crime act
10 Wongyos Keardsri

Chulalongkorn
University
Privacy Tree Structure
• Privacy Tree Structure
 A path from root node to each node is network part of IP address
 A path under that node is host part of IP address
Root Node
A
Reference Node
 Given edges are parts of IP address
 Given nodes are connections of parts
Network Part
Host Part
11 Wongyos Keardsri

Chulalongkorn
University
Privacy Tree Structure (Cont)
• Independent subtree
Root Node
Reference Node A
B
A B
A is referenced IP address of organization which analyzes B
B is referenced IP address of organization which is analyzed by A
• Non-anonymization
12 Wongyos Keardsri

Chulalongkorn
University
• Intersection subtree
Root Node
Reference Node
Anonymization part
A B
A B
• n-Left anonymization XXXX
13 Wongyos Keardsri

Chulalongkorn
University
• Proper subtree (A in B)
Root Node
A
Reference Node
B
B
A
Anonymization
part
• n-Right anonymization XXXX
14 Wongyos Keardsri

Chulalongkorn
University
• Proper subtree (B in A)
Root Node
Reference Node A
B
A
B
Anonymization
part
• n-Right anonymization XXXX
15 Wongyos Keardsri

Chulalongkorn
University
• Equivalent subtree
Root Node A = B
Reference Node A = B
• Full anonymization
Anonymization
part
XXXX XXXX
16 Wongyos Keardsri

Chulalongkorn
University
Network Analysis Functions
• A Survey of Popular Network Analysis Functions from 6
Selected Tools
 NTOP, http://www.ntop.org/documentation.html
 Nagios, http://www.nagios.org/docs/
 Tcpdump, http://www.tcpdump.org/
 Ethereal, http://www.ethereal.com/docs/
 MRTG, http://oss.oetiker.ch/mrtg/
 OpenNMS, http://www.opennms.org/index.php/Documentation
17 Wongyos Keardsri

Chulalongkorn
University
Network Analysis Functions (Cont)
• Network Analysis Functions Details
Group of Functions Functions Privacy Levels
Resource and
Capacity Usages
System performances Non-anonymization
Network bandwidth usages
Capacity planning
Multicast traffic analysis
Proxy management
CPU usages n-Right anonymization
Memory usages
Disk usages
Accounting usage; printer,
quota usages
18 Wongyos Keardsri

Chulalongkorn
University
• Network Analysis Functions Details (Cont)
Service Statistics HTTP (1) Non-anonymization
(Network Summary)
(2) n-Right anonymization
(Device Summary)
SNMP
TELNET
POP3
NNTP
ARP / ICMP
FTP
SSH
VoIP
19 Wongyos Keardsri

Chulalongkorn
University
Service Statistics
(Cont)
P2P (1) Non-anonymization
TCP Session History (2) n-Right anonymization
DNS Full anonymization
System Diagnosis and
Anomaly Detection
Intrusion detection Full anonymization
Fault detection
Log analysis
Social network analysis
Behavior analysis
20 Wongyos Keardsri

Chulalongkorn
University
System Report and
Display
Network traffic map Full anonymization
Web application report (1) Full anonymization
(2) Randomly full
anonymization
21 Wongyos Keardsri

Chulalongkorn
University
Computer Law
• Thailand Computer Crimes Act B.E. 2550
Section Privacy Levels
18(2) (1) n-Right Anonymization
(Related with network part)
(2) Full Anonymization
(Related with person, network and host parts)
18(3) Follow by Privacy Tree Structure
18(4) Follow by Privacy Tree Structure and Network Analysis
Function
18(5) Full Anonymization
18(6) Full Anonymization
26-1 Non-anonymization
26-2 n-Right Anonymization
22 Wongyos Keardsri

Chulalongkorn
University
Rule-Based Combination
• Rule-Based Method
 Represent the conditions of 3 factors into the rules
 Consider and combine each rule to select final privacy levels
• Example of Rule-Based Method
23 Wongyos Keardsri

Chulalongkorn
University
Results and Discussions
• Example of the Results of IP Address Anonymization
Based on Privacy Levels with 3 Factors
• Scenarios: CU Network administrators are a competent
official to request packet data from CU-Engineering for
analyzing the web site (HTTP) usages
24 Wongyos Keardsri

Chulalongkorn
University
Results and Discussions (Cont)
===================================================================
A is referenced IP address of organization which analyzes B
B is referenced IP address of organization which is analyzed by A
===================================================================
Enter Network Address A : 161.200.0.0
Enter Mask Address A : 255.255.0.0
Enter Network Address B : 161.200.93.0
Enter Mask Address B : 255.255.254.0
Enter Network Function (NF) : 10
Enter Network Function (NF) : 0
Enter Law Section : 1
Enter Law Section : 0
Network Bit of A : 10100001110010000000000000000000
Mask Bit of A : 11111111111111110000000000000000
Network Bit of B : 10100001110010000101110100000000
Mask Bit of B : 11111111111111111111111000000000
Privacy Tree Structure (PTS) : (4) Proper Subtree (B in A)
Privacy Levels of PTS : (3) n-Right Anonymization
Privacy Levels of NF : (1) Non-anonymization
Privacy Levels of LAW : (3) n-Right Anonymization
===================================================================
Privacy Levels of 3 Factors : (3) n-Right Anonymization
===================================================================
25 Wongyos Keardsri

Chulalongkorn
University
• Example of Results
 Given subnet mask is
255.255.0.0 11111111.11111111.00000000.00000000
 Given key is 11101010010011010010110110010010
• Using Non-anonymization
161.200.92.35 10100001.11001000.01011100.00100011
161.200.92.62 10100001.11001000.01011100.00111110
161.200.92.76 10100001.11001000.01011100.01001100
161.200.92.88 10100001.11001000.01011100.01011000
161.200.92.193 10100001.11001000.01011100.11000001
161.200.91.174 10100001.11001000.01011011.10101110
161.200.91.2 10100001.11001000.01011011.00000010
26 Wongyos Keardsri

Chulalongkorn
University
• Using n-Left Anonymization
94.55.92.35 01011110.00110111.01011100.00100011
94.55.92.62 01011110.00110111.01011100.00111110
94.55.92.76 01011110.00110111.01011100.01001100
94.55.92.88 01011110.00110111.01011100.01011000
94.55.92.193 01011110.00110111.01011100.11000001
94.55.91.174 01011110.00110111.01011011.10101110
94.55.91.2 01011110.00110111.01011011.00000010
27 Wongyos Keardsri

Chulalongkorn
University
• Using n-Right Anonymization
161.200.163.220 10100001.11001000.10100011.11011100
161.200.163.193 10100001.11001000.10100011.11000001
161.200.163.179 10100001.11001000.10100011.10110011
161.200.163.167 10100001.11001000.10100011.10100111
161.200.163.62 10100001.11001000.10100011.00111110
161.200.164.81 10100001.11001000.10100100.01010001
161.200.164.253 10100001.11001000.10100100.11111101
28 Wongyos Keardsri

Chulalongkorn
University
• Using Full Anonymization
94.55.163.220 01011110.00110111.10100011.11011100
94.55.163.193 01011110.00110111.10100011.11000001
94.55.163.179 01011110.00110111.10100011.10110011
94.55.163.167 01011110.00110111.10100011.10100111
94.55.163.62 01011110.00110111.10100011.00111110
94.55.164.81 01011110.00110111.10100100.01010001
94.55.164.253 01011110.00110111.10100100.11111101
29 Wongyos Keardsri

Chulalongkorn
University
• Using Randomly Full Anonymization
24.89.192.204 00011000.01011001.11000000.11001100
128.121.188.160 10000000.01111001.10111100.10100000
105.166.62.205 01101001.10100110.00111110.11001101
191.174.6.210 10111111.10101110.00000110.11010010
72.236.28.89 01001000.11101100.00011100.01011001
111.3.171.1 01101111.00000011.10101011.00000001
138.224.26.220 10001010.11100000.00011010.11011100
30 Wongyos Keardsri

Chulalongkorn
University
• Advantage of Our Anonymization Scheme
• Applicable to an administrator who analyzes packet data in
different functions
• Benefits any organizations in exchanging network data
• Appropriates for heavy packet tracers and sniffers
31 Wongyos Keardsri

Chulalongkorn
University
CCoonncclluussiioonn
• This research proposes 5 privacy levels
 Non-anonymization
 n-Left anonymization
 n-Right anonymization
 Full anonymization
 Randomly full anonymization
• This research applies these privacy levels to prefix-preserving
IP address anonymization, specifically to Crypto-
PAn
32 Wongyos Keardsri

Chulalongkorn
University
CCoonncclluussiioonn ((CCoonntt))
• Presenting 3 anonymization factors which are used to
consider and select appropriate privacy level
 Privacy tree structure
 Network analysis functions
 Computer law
• Combining the anonymization factors by using rule-based
method
33 Wongyos Keardsri

Chulalongkorn
University
QQuueessttiioonnss aanndd AAnnsswweerrss
Q? ...
... A!
E-mail : wongyos@gmail.com
Facebook : http://www.facebook.com/wongyos/
34 Wongyos Keardsri

IP address anonymization

More Related Content

Viewers also liked

Similar to IP address anonymization

More from Wongyos Keardsri

Recently uploaded

IP address anonymization