1

I am working on a project where I have to identify anomalies in network traffic of business networks with machine learning. The algorithm is feeded with captured network packets from inside of the business LAN. Since the business is located in Europe, constraints by the GDPR have to be considered.

I need a tool that captures, anonymizes and saves data packets with following constraints:

  1. values should stay unique when anonymized (e.g. the same IP address should always be encrypted to the same hash value and any other IP addresses must have a different hash value). This is important so the hash can still be used as a feature for the ML model.

  2. the process of capturing and saving the packets and the commercial use of the resulting, partially hashed data packets should comply with the GDPR guidelines. The packets are recorded on a computer whose owner has agreed. However, not everyone on the network knows that it is sniffed.

What I have tried: I have been searching for tools specifically to capture network traffic and anonymize source and destination IP and MAC adresses and found pktanon. Data captured by tcpdump can be piped to pktanon and anonymized, before it is saved. Also, the payload is completely deleted beforehand.

My Question: Do I have to consider anything else but hashing source and destination IP and MAC adresses?

Apparently it is not sufficient to anonymize IP and MAC addresses. For example, it might be possible to recalculate parts of the payload with the checksum. I'm not 100% sure if this is relevant and also I do not know which encryption algorithms meet the requirements of the GDPR.

In another thread I have found an answer which elaborates the problem. It states, that

it is legal to process personal data if processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data

Does this apply to my problem? Is it possible to argue that it is a legitimate interest to secure our LAN by processing personal data of all incoming data packets?

I think I'm sort of in a gray area when processing (officially) personal data. This can further be divided into packets from employees of my own company, who can be informed, and packets from outside of the LAN.

Thanks in advance!

Improve this question
4
  • 2
    The problem you have with anonymising the IP address is that you aren’t really anonymising it for IPv4 addresses - given the salt, you can unanonymise every address in the IPv4 range in seconds because the address range is so low. IPv6 is a different matter.
    – user28517
    Commented Mar 17, 2020 at 9:21
  • Have you considered writing one as part of the project, rather than looking for one?
    – Criticizing Israel not allowed
    Commented Mar 17, 2020 at 10:09
  • Why do you believe you must or why have you decided to anonymise those IP addresses?
    – Lag
    Commented Mar 17, 2020 at 11:51
  • 1
    @Lag I have edited the question, maybe this clarifies why I'm asking.
    – Joshua
    Commented Mar 17, 2020 at 12:04

2 Answers 2

Reset to default
1

I fear that you have 'jumped the gun' - I think you and your colleagues in the legal/compliance department should first meet to discuss your project. You must facilitate their understanding of the project so that you and they can discuss your options and obligations under GDPR and other such rules in your jurisdiction.

It may be the case that this project has a "specified, explicit and legitimate purpose" (and satisfies other principles under Article 5) for collecting and processing data related to IP addresses and it may be in the "legitimate interest" (or another of the lawful bases under Article 6) of the company to do so.

You/they might decide that verbatim IP addresses are OK; you/they might decide that pseudonymisation (your hashing) is sufficient; you/they might decide that it must not be done unless it involves anonymisation.

But you/they must go through that exercise.

Improve this answer
1

This isn’t anonomization under the GDPR

The reason IP addresses are personal data is because they are unique to an individual. So are your hashes.

Improve this answer
3
  • The idea that IP addresses are unique to an individual is one of the most laughable aspects of GDPR compliance - there are only 3.7 billion public IPv4 addresses, and most westerners will have multiple devices. Some few might have static IP addresses at home, but most will share that with household members. Pretty much no mobile device will have a static IP when using mobile data (and indeed most will go through a proxy at the carrier level). The idea that you can identify a specific individual consistently through an IP address can be disproven fairly easily.
    – user28517
    Commented Mar 17, 2020 at 10:58
  • "The reason IP addresses are personal data is because they are unique to an individual." - they aren't always personal data (GDPR says they may be personal data), they aren't always unique to an individual, they might never be assigned to an individuals such that one person could be identified or singled out by using them.
    – Lag
    Commented Mar 17, 2020 at 11:37
  • True. If an IP adress may be personal data, I have to assume all IP addresses are personal data, because I cannot check if they are static or dynamic, if NAT is used etc. Then it is questionable if I am allowed to use IP addresses, whether they are encrypted or not. I have edited the question for this case.
    – Joshua
    Commented Mar 17, 2020 at 13:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .