RSSAC040: Recommendations on Anonymization Processes for Source IP Addresses Submitted for Future Analysis

Recommendation 1

Recommendation 1: Root Server Operators should consider the advantages and disadvantages of harmonization of anonymization for DITL Data.

RSOs need to decide whether to pursue harmonization of anonymization data that comes from multiple operators, particularly the DITL data. That decision needs to include consideration of the advantages and disadvantages from the standpoint of the RSO, of the users of the RSS, and of researchers looking at the anonymized data.

Harmonization using mixing full addresses or bit-by-bit will help the research community correlate sources of DNS queries across datasets that are collected from different RSOs. However, full harmonization inherently relies on sharing a secret value that will invalidate the anonymization if it is later revealed.

Even if the RSOs decide not to harmonize with sharing of secret values, harmonizing the method used can help RSOs choose an anonymization strategy, and simplify understanding the properties of the data for those who use data from multiple RSOs.

Recommendation 2

Recommendation 2: Each RSO should consider the anonymization procedures in this document individually.

Any of the proposals given in Section 4 of this document can be used as the anonymization specification for IP addresses, depending on the policy of the party doing the anonymizing.

Recommendation 3

Recommendation 3: Autonomous System (AS) numbers of original addresses should be made available with the anonymized data if the origin AS is sufficiently general that it does not unnecessarily expose data that should have been anonymized.

It should be possible for an operator to publish a machine-readable table that maps the anonymized addresses to the AS of the original data. Such a table should have a timestamp for when the mapping was made due to AS values changing over time.