Data Masking for Mobile-Network Session Records

TL;DR

ASN irreversibly and deterministically masks all mobile network session record data. As sensitive subscriber and device data identifiers are masked, data can be exported to any analytic, security, compliance or partner platform, while maintaining the ability to track and analyze subscriber behavior, as it is deterministic: data in analytics downstream will be correlated to original subscribers identities even without seeing the identities themselves.

Introduction

Real world users are continuously generating session records that are passing across mobile networks. A level of deterministic data-masking takes these records as they traverse, either towards an analytical system, a threat tool, data lake, or pass onto a partner dashboard, never indicating where they came from, with absolutely no way to reverse the mask.

ASN-1 → Threat Analytics tool. You need to export records as they are and the security team works within the boundary and is visible raw identifiers.

ASN-2 → Big Data Analytics platform - The exported fields in the Big Data Analytics platform are masked based on the client config. Analytics platform is to reside outside of boundary and consumes deterministic token. All the joins and trends that will be derived from the data platform do work, however raw identity never gets into the data lake.

ASN-3 → The firewall tool is. Used to export to operational fields which need to be processed by the firewall. Three options, three different levels of trust within the same network.

Why Is Sharing Raw Mobile-Network Data a Problem?

When your phone establishes any connection over the mobile network, a trail remains; this trail tells the story of this call/data connection. This story involves the subscriber, the device, the IP addresses in use, the specific tower you connected through and the time your session lasted, amongst other things. This is the perfect breadcrumb trail to trace any problem, just the thing analytics platforms require for trend analysis. That's what it needs to contain, which means it's inherently personal data.

Why the correlated session data record is valuable is because it is data-rich. Extremely data-rich in fact as it is both rich in data and rich in the capacity for embarrassment. Once the combination of subscriber id and device id/IP address has established a unique identifier for a user, and that record transits the system boundary and arrives at a SIEM, data warehouse, firewall, a partner's monitoring stack or other egress point then you have lost all control of that data with respect to how it’s consumed and by whom it has been seen. Trying to apply simplistic remedies such as the outright deletion of those data fields- which reduces the analytical capabilities of that data for many operational uses by also removing many diagnostic details- or simply not attempting a deletion- with the end result being every export is a potential security nightmare- just will not cut the mustard.

How Does Deterministic Data Masking Work?

This method of tokenization involves substituting sensitive values with strings of fixed length just before a record leaves the system. In doing so, values that are non-sensitive remain the same. This methodology is optimal for my scenario because of two primary reasons.

First, tokenization involves computing a fixed length value through a deterministic transformation of the original value. This means that two dissimilar values will convert to different tokens. This is useful in scenarios where joins, groups, or counts utilize the original values. Since each token has the same length, it can adequately replace original data even when sensitive values are replaced.

Second, tokenization can never be reversed. This is a characteristic that is useful over time. There are no configurable system values or reverse look-up tables that would enable a transformation of a token back to its original IMSI or IP address.

What Sets ASN Apart from Conventional Data Masking?

Traditional Data Masking at the Packet Level In traditional data masking, raw payloads have masks associated to them and data is masked, on a case by case basis, with constants as traffic is sent to the downstream tools. While this prevents sensitive data from being disclosed, it is entirely blind to the session context of the mobility Core. Data masks in this case are not concerned with the semantics of IMSI or MSISDN, but instead focus on a byte by byte basis.

This approach, where each data slice of a packet corresponds to a detected pattern and is thus overwritten with a static constant, significantly impacts the ability to determine which subscriber the activities are related to.

This also affects the ability to correlate activities across sessions and across various protocols and network elements. The ASN solution includes Features that Preserve Privacy and Analytical Value ASN-level privacy preserves data from being reverse engineered while increasing the analytical value. Instead of masking each packet, ASN masks an aggregated session record. This allows the operator to mask different semantics (e.g. MSISDN, IMSI, IMEI, subscriber IP) as opposed to masking on a byte by byte basis.

The process of deterministic tokenization allows an operator to associate a static token with a subscriber, thus allowing the operator to perform efficient correlation across the network, protocols and elements without revealing any PII.

This leads to field-aware and correlation-preserved data exports:

ASN allows operators to select which data should be masked when exported.

Where Can Data Masking Be Used?

Conclusion

Anonymization is usually considered a ‘post-process’ and involves a step of poisoning everything. A better model considers a design that preserves correlations and makes one-way data exports (i.e. the data cannot be linked to any identifier) by design. One should also design such a system to operate at the boundaries of where computation is critical and eliminate its overheads to maximize its performance.

Following these recommendations should result in a system that strictly follows policy, but allows as much per-subscriber analysis as is needed. The system can safely publish the rest of the organization's data (including public release) with an extraordinarily small risk, allowing consumers to continue the analysis they enjoy.