Conducting a Privacy Impact Analysis for the Analysis of Communication Records

摘要

Attacks on Voice-over-IP calls happen frequently. The prevention of these attacks depends on understanding the attack patterns. These can be derived from communication records. However, these records contain privacy relevant information of the call participants. These records are also protected by a number of laws and regulations. One has to consider all these laws and regulations and the privacy concerns of call participants before an analysis can be done. We propose a method for changing communication records in such a way that the forensic analysis for VoIP attacks is possible and the privacy of the call participants is preserved. We define privacy requirements for communication records from laws, regulations and concerns of call participants. We also present patterns of communication records based on real world examples. Moreover, analysis patterns for VoIP attack states which have relations to communication records that have to survive the data minimization.