Privacy and security issues have become priority items for the IETF, the Internet Architecture Board (IAB), and the Internet Society. Documents such as RFC 7258 and the recent IAB Statement on Internet Confidentiality demonstrate the community’s commitment to addressing the issues and concerns raised. The goals are to fix existing Internet technologies and protocols, and to develop more-secure solutions to protect users’ privacy.
Although the IETF is taking major actions on several fronts and via a host of working groups, its privacy and security efforts don’t stop there. Coordination and collaboration with other standards organisations on the development of Internet technologies is a necessary next step to providing coherent solutions to today’s privacy and security issues. One of the most important standards organisations is the Institute of Electrical and Electronics Engineers (IEEE), which has developed several technologies at the core of Internet connections, including IEEE 802.1 bridges, IEEE 802.3 Ethernet, and 802.11 WLAN (wireless local area network, a.k.a., WiFi).
As part of coordinated efforts between these organisations, a joint collaboration between the IETF and the IEEE has been established and an IEEE 802 Privacy Executive Committee Study Group was created in July 2014. The group is assessing privacy issues related to IEEE 802 technologies and is planning to develop recommended practices for all IEEE 802 protocols.
One of the privacy issues identified by the group so far relates to the use of media access control (MAC) addresses in over-the-air communications. Protocols such as IEEE 802.11 WLAN openly transmit MAC addresses in several messages. Because MAC addresses, in most cases, are globally unique identifiers that can be associated to personal devices, they can become privacy risks by exposing users to unauthorized tracking.
A possible solution to this tracking issue is the use of randomized MAC addresses. Although it seems like a straightforward thing to do, several implications should be studied. MAC addresses are not only used in link-layer (i.e., layer-two) communications, but also in different higher-layer protocols, such as Dynamic Host Configuration Protocol (DHCP), Internet Protocol Version 6 Neighbor Discovery (IPv6 ND), and Address Resolution Protocol (ARP). In order to assess the implications of MAC address changes in an operating network, an experiment was suggested in which certain individuals randomized their MAC addresses while connecting to the meeting network during IETF 91 in Honolulu.
For this experiment, the first of its kind outside of a lab, a parallel network was established and a different WiFi service set identification (SSID) was broadcast during the meeting. Experiment participants were asked to run scripts on their computers to randomize MAC addresses when connecting to the network. The network was isolated from the rest of the IETF meeting via a different virtual local area network (VLAN) and a separate DHCP address pool. Preliminary observations indicated that several client drivers supported this technique, no major changes were required on the network configuration, and the probability of address duplication in a network of this size was negligible. Since more details and statistics are needed to continue the analysis, the group is fine-tuning the experiment for further exploration in March 2015 at both the IEEE 802 plenary meeting in Berlin and the IETF 92 meeting in Dallas. In addition, the group is developing tools to enable more users to participate in the experiment, this time also with mobile devices. All those attending IETF 92 are encouraged to participate.
MAC randomization is just one way to improve Internet privacy for nontechnical users. Watch for more collaboration and more proposals from the community in the near future.